Thread: While Loop Conditions?

Hi

Firslty, my first post, and I'm new to C programming. Secondly, I'm not overly bright so please bare with me!!

I have a character array assigned of 1024 bytes in length to hold 1024 characters. This is to read in the MFT record headers, one at a time, of a Windows MFT File.

I know that each MFT record begins with the characters 'FILE', (46h, 49h, 45h, 2Ah in Hex). What I want to do is to tell my while loop to continue until the first 4 bytes of the 1024 do not equal the chars FILE (because once this happens the program has reached the end of the MFT).

I am really stuck, and don't really know how to achieve what I want to do . I know I need a while or for loop, but I'm unsure how to go about it.

I have my input file specified as follows :

Code:

if
   ((FileIn = fopen("C:\\DriveImage.1", "rb")) == NULL)      //the use of \\ is to ensure escape char used after the \ of c:\. fopen enters the content of the file into RAM. "rb" is to READ a BINARY file for reading & writing
    {
     printf ("Unable to open binary file. Please try again. \n");
     getch ();
     exit(0);
    }
 else
    {
     printf ("Input File opened successfully\n");
     getch();
    }

Then,

Code:

OffsetValueOfMFT = ((1373544 * 512) + (63 * 512)); /*A byte value is required for fseek function.
                                                       343386 (hex value 00 00 00 00 00 05 3D 5A - from offset 0x30) x 4 = 1373544
                                                       1373544 x 512 = 703254528
                                                       703254528 + (63 x 512) = 703286784
                                                       703286784 in hex is 29 EB 4E 00 - the physical offset of MFT  */

  rewind(FileIn);
  fseek (FileIn, OffsetValueOfMFT, SEEK_SET);        //Look at input file, and set seek point to the start of the MFT, i.e. value of OffsetValueOfMFT

ftell(FileIn);                                     //returns the location of the file position indicator for the file specified by FileIn
  CurrentPosition = ftell(FileIn);
  memset(MFTBufferArray, 0x00, 1024);                //clear the buffer

Then I'm stuck.

Any guidance much appreciated!

Thanks

Ted

try this out-> first get in the first four bytes using say a for loop to loop 4 times. compare for the FILE thing and then if its FILE, then go ahead and copy to the array.

While I was waiting I have done the following :

Code:

memset(MFTBufferArray, 0x00, 1024);                //clear the buffer
  fread(MFTBufferArray, 1, 1024, FileIn);            //read in 1024 bytes from FileIn and store them in the buffer array
  fwrite(MFTBufferArray, 1, 1024, FileOut);


  CurrentPosition = ftell(FileIn);                   //returns the location of the file position indicator for the file specified by FileIn
  printf("The Current position is %d", CurrentPosition);
  getch();
  fclose(FileIn);
  fclose(FileOut);

Now, this works a treat in that the first 1024 bytes are written to my output text file. Great. However, I need it to

a) look at the next 1024 bytes but only if
b) the first 4 bytes of the next 1024 bytes equal the characters FILE.

To help you see what I mean, here is a sample of an MFT extract :

Code:

FILE*...¨ÙG¹........0...............................`...........H.......ÖÎpØPªÄ.ÖÎpØPªÄ.ÖÎpØPªÄ.ÖÎpØPªÄ.
FILE*...î..........0...P...........................`...........H.......ÖÎpØPªÄ.ÖÎpØPªÄ.ÖÎpØPªÄ.ÖÎpØPªÄ
FILE*...4..........0...P...........................`...........H.......ÖÎpØPªÄ.ÖÎpØPªÄ.ÖÎpØPªÄ.ÖÎpØPªÄ

I don't know how to do that. Any suggestions?

Here's a novel idea, why don't you read four bytes, see if it's F I L E, if so, read another 1020 bytes?

Quzah.

thats what i told you in my post. first a loop to loop 4 times, and then check the conditions and go in for the next 1020 bytes. simple as that.

read the FAQ and the tutorials for the syntax.

You've shown how to read 1024 bytes, using fread, so why don't you just check the first four bytes of what you read to see if it's what you want. Just throw that in a loop. Or, change it, and read 4 bytes instead of 1024, and check that. I don't see how you can be stuck on this, since you've all ready illustrated that you know how to read.

Quzah.