While I was waiting I have done the following :
Code:
memset(MFTBufferArray, 0x00, 1024); //clear the buffer
fread(MFTBufferArray, 1, 1024, FileIn); //read in 1024 bytes from FileIn and store them in the buffer array
fwrite(MFTBufferArray, 1, 1024, FileOut);
CurrentPosition = ftell(FileIn); //returns the location of the file position indicator for the file specified by FileIn
printf("The Current position is %d", CurrentPosition);
getch();
fclose(FileIn);
fclose(FileOut);
Now, this works a treat in that the first 1024 bytes are written to my output text file. Great. However, I need it to
a) look at the next 1024 bytes but only if
b) the first 4 bytes of the next 1024 bytes equal the characters FILE.
To help you see what I mean, here is a sample of an MFT extract :
Code:
FILE*...¨ÙG¹........0...............................`...........H.......ÖÎpØPªÄ.ÖÎpØPªÄ.ÖÎpØPªÄ.ÖÎpØPªÄ.
FILE*...î..........0...P...........................`...........H.......ÖÎpØPªÄ.ÖÎpØPªÄ.ÖÎpØPªÄ.ÖÎpØPªÄ
FILE*...4..........0...P...........................`...........H.......ÖÎpØPªÄ.ÖÎpØPªÄ.ÖÎpØPªÄ.ÖÎpØPªÄ
I don't know how to do that. Any suggestions?