给定NTFS文件ID，是否有任何官方方式来获取文件名 [英] Given an NTFS File ID, is there any official way to get the file names

问题描述

如果我有NTFS文件ID，是否有官方方法从该文件ID获取文件名？ （其他扫描硬盘驱动器上的每个文件......？）



看来我至少可以通过调用NtCreateFile验证文件ID是否有效，尽管微软的文档有一个很大的警告，API可能会发生变化。

If I have an NTFS File ID, is there an official way to get the file names from that file ID? (Other then scanning every file on the hard drive...?)

It appears that I can at least verify that a file ID is valid by calling NtCreateFile, although Microsoft's documentation has a big fat warning that the API is subject to change.

推荐答案

好的，只需要捅一下，你可以使用OpenFileById OpenFileById [ ^ ]为您提供帮助然后 GetFileInformationByHandleEx [ ^ ]返回 FILE_NAME_INFO [ ^ ]结构？



我原本以为会有一种方法可以直接从ID中获取名称，但可能缺少该功能，因为系统会重复使用FileID相同的ID并不总是指向与时间过去相同的文件。如果系统是静态的（只读），这不会是一个问题，但它仍然可能不是一个好习惯。

OK, just taking a stab at it, could you use OpenFileById OpenFileById [^]to get you a handle, then GetFileInformationByHandleEx [^]to return a FILE_NAME_INFO[^]structure?

I would have thought there would be a way to get the name directly from the ID, but perhaps that capability is missing because FileIDs are re-used by the system so the same ID won't always point to the same file as time passes. If the system is static (read-only) this won't be a problem, but it still probably isn't a good practice.

在NTFS上

MFT文件本身有一个每个文件的条目。 FileId具有16位序列号和48位

MFT file itself has an entry for every file. The FileId has 16 bits of sequence number and 48-bits of

这篇关于给定NTFS文件ID，是否有任何官方方式来获取文件名的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！