Hi
Firslty, my first post, and I'm new to C programming. Secondly, I'm not overly bright so please bare with me!!
I have a character array assigned of 1024 bytes in length to hold 1024 characters. This is to read in the MFT record headers, one at a time, of a Windows MFT File.
I know that each MFT record begins with the characters 'FILE', (46h, 49h, 45h, 2Ah in Hex). What I want to do is to tell my while loop to continue until the first 4 bytes of the 1024 do not equal the chars FILE (because once this happens the program has reached the end of the MFT).
I am really stuck, and don't really know how to achieve what I want to do . I know I need a while or for loop, but I'm unsure how to go about it.
I have my input file specified as follows :
Code:
if
((FileIn = fopen("C:\\DriveImage.1", "rb")) == NULL) //the use of \\ is to ensure escape char used after the \ of c:\. fopen enters the content of the file into RAM. "rb" is to READ a BINARY file for reading & writing
{
printf ("Unable to open binary file. Please try again. \n");
getch ();
exit(0);
}
else
{
printf ("Input File opened successfully\n");
getch();
}
Then,
Code:
OffsetValueOfMFT = ((1373544 * 512) + (63 * 512)); /*A byte value is required for fseek function.
343386 (hex value 00 00 00 00 00 05 3D 5A - from offset 0x30) x 4 = 1373544
1373544 x 512 = 703254528
703254528 + (63 x 512) = 703286784
703286784 in hex is 29 EB 4E 00 - the physical offset of MFT */
rewind(FileIn);
fseek (FileIn, OffsetValueOfMFT, SEEK_SET); //Look at input file, and set seek point to the start of the MFT, i.e. value of OffsetValueOfMFT
ftell(FileIn); //returns the location of the file position indicator for the file specified by FileIn
CurrentPosition = ftell(FileIn);
memset(MFTBufferArray, 0x00, 1024); //clear the buffer
Then I'm stuck.
Any guidance much appreciated!
Thanks
Ted