OSDev.org

Hi. I just finished writing a DLL that finds a file on disk and locates its LCN then I use that to convert into Physical Address and as far as I can tell it works fine, but I need proof before I commit it to my project, so does anyone know a good and free disk editor that shows you the physical address of a file on disk. It must be able to read an NTFS disk and display the physical address of a file on disk. I have tried ntfsread and it doesn't show you enough information; I think it trys to convert everything to CHS style, so I never see the true stuff. Thanks and I might be wrong about ntfsread so I will give it another go, but until then I would appreciate your input. Also, I cannot find Norton Disk Editor, so a link to that or something equivalent would be swell. thanks again

UPDATE: OK, I checked it again and it just tells me the Logical Number 1171368 (whatever that means). Now, I don't think that is the LCN for two reasons:

01. I am booted outside Windows when I read the disc using NTFSREAD, so the LCN would not apply.
02. The LCN I return is 146421 or 0x23BF5

Now, I don't think that is the physical address either. Could it be a literal sector/cluster count and not the byte offset? If so, then NTFSREAD is no good for me and if not, then maybe I am wrong. I return:

Phy Addr: 0x23BFCE00

That *should* be the physical byte offset on the volume from 0? Am I wrong?

Norton Diskedit is a free utility inside Norton Utilities that does what you want. If you (for some reason) have no access to a Norton Utilities disk, I can email you a zip of the program (it's a standalone, 662K).

Oh my gosh, could you? Thank you so much. I'll PM you my address. Thanks

I want to thank you publicly for the email with attachment just to show the forum how helpful you were to me and how much I appreciate it. That kind of thing is done between friends, yet you and I have never even met in person. Just goes to show how awesome you are man, thanks a lot. You were more than helpful to me and I will always be grateful for it. On the outside it may not seem like a lot, but beneath it all I take notice to the time it took and trouble you went through to help me out. Thanks again. OK, I'm off to work. Take care.

For those who might stumble upon this thread, let me tell you of my adventure.

Well, I got Norton's Disk Edit Tool. And, let me tell you a funny story about it. In like 1980 Mr. Norton wrote a book and in that book he wrote a Disk Editor much like this DISKEDIT tool. He didn't talk about booting the system or anything, he didn't take the time to teach you how he made his fancy UI, but he did tell you how to dump the disk and all that jazz, so it is funny because my first ASM program was this disk editor thing and I dabbled with the code, rewrote it to do other things, and I really learned a lot and how funny it is that I am here today dealing with this very thing. Small World.

OK, we'll I got the tool via email thanks to Bewing and I was super stoked and I wanted to try it out right away. Well maybe in 98 and below you can use this thing from Windows but in NT OSs you cannot access the disk directly. So, I thought 98 bootdisk!! I made a disk with diskedit on it and one for the 98 bootdisk and loaded up my system. Duh, I need to read an NTFS SATA SCSI HDD and 98 bootdisk is like WTF you don't have a HDD!! Well, since I was there I started DISKEDIT up to see what she had to offer and it looks like Mr. Norton was doing this literal sector count thing too! Oh well, I can work with that, so let's get this working on my setup, but how?

OK, I tried using my XP CD to enter the recovery console so that I could load DISKEDIT from floppy, but I couldn't have it run. I am very impatient and if it doesn't work like NOW, then it may get a few more tries before I nix it, and I couldn't get it to work, so I nixed it.

Then I was searching through Google looking for another option and found this: MS Website

But, I couldn't download it due to my having a bootleg copy of Windows XP and that darn authentication thing. You use to be able to hack the registry and the setup files to bypass it, but I am pretty sure they got it under control now as I couldn't bypass it earlier while trying to update my Media Player and I didn't even try, so instead I plugged in the name of the executable I wanted (dskprobe.exe) into Google and found this: DSKPROBE DL

You will not believe this thing! It runs in Windows XP and can access the disk via logical sector number, search for ASCII or UNICODE on disk, write to disk, AND it has a GUI!! I am pretty sure at this point that NTFSREAD is right not to use the byte offset, but instead use the logical sector number to search and determine where a file starts on disk or to simply start reading from; it is so much more precise considering that the phy addr relies upon knowing the LCN and total clusters on disk. Using this method ensures your success IMHO.

OK, enough babbling from me. I'm off to rewrite my DLL. I hope this helps.

Yes!! I figured out how Windows calculates the byte offset and from that the logical sector number. What you do is this:

(offset/512)-63 = logical sector number or start of file on disk

Using the above formula you can translate a physical byte offset into a logical sector number!! OK, I'm going to hurry up and finish my DLL and then I am getting plastered. w00t!