Finding cluster info of a file - c++

Question

I've been trying to find information on a file by using CreateFile() and DeviceIoControl(). However I keep running into ERROR_HANDLE_EOF which from my understanding means that the starting virtual cluster number is past the end of the file even though I am starting at 0. Here is a few snippets of my code, let me know if you guys have any idea what's going wrong.
HANDLE hFile = INVALID_HANDLE_VALUE; //drive or file to be checked
LPWSTR txtFile = L"Text.txt"; //text file
hFile = CreateFile(txtFile, //target file
GENERIC_READ | GENERIC_WRITE, //read and write
FILE_SHARE_READ|FILE_SHARE_WRITE,//allows sharing of read and writes
NULL, //security prevents child process from inheriting the handle
OPEN_EXISTING, //open file or drive if it exist
FILE_ATTRIBUTE_NORMAL, //default settings for files
NULL); //template file with generiv read access rights
if (hFile == INVALID_HANDLE_VALUE) //error handling
{
cout<<"File does not exist"<<endl;
CloseHandle (hFile);
system("pause");
}
cout<<"you opened the file succesfully: "<<hFile<<endl;
STARTING_VCN_INPUT_BUFFER startVcn;
RETRIEVAL_POINTERS_BUFFER retrievalBuffer;
DWORD error =ERROR_MORE_DATA;
BOOL returns;
startVcn.StartingVcn.QuadPart = 0;
while( error ==ERROR_MORE_DATA){
DWORD bytesReturned;
returns = DeviceIoControl(hFile,
FSCTL_GET_RETRIEVAL_POINTERS,
&startVcn,
sizeof(STARTING_VCN_INPUT_BUFFER),
&retrievalBuffer,
sizeof(RETRIEVAL_POINTERS_BUFFER),
&bytesReturned,
NULL);
error = GetLastError();
switch(error){
case ERROR_HANDLE_EOF:
cout<<"ERROR_HANDLE_EOF"<<endl;
returns = true;
break;
case ERROR_MORE_DATA:
cout<<"ERROR_MORE_DATA"<<endl;
startVcn.StartingVcn = retrievalBuffer.Extents[0].NextVcn;
case NO_ERROR:
cout<<"NO_ERROR, here is some info: "<<endl
<<retrievalBuffer.StartingVcn.QuadPart<<endl
<<retrievalBuffer.Extents[0].Lcn.QuadPart<<endl
<<retrievalBuffer.Extents[0].NextVcn.QuadPart
- retrievalBuffer.StartingVcn.QuadPart<<endl;
returns = true;
break;
default:
cout<<"Error in the code or input error"<<endl;
break;
}
}

Answer 1

I wrote pretty much the same program myself and, like the OP, I found that I was getting ERROR_HANDLE_EOF which I couldn’t explain. When I went looking for an explanation, I never found one but stumbled across this post. The OP’s program looks correct to me so I strongly suspect the explanation for the behaviour is the same as mine. I realize it is way too late to help the OP but for the benefit of anyone else who spends 1 whole day working this out, I think the answer is…
Educated guess: ‘Small files’ don’t get a cluster assigned to them and when you query a ‘small file’ with the above program you will receive ERROR_HANDLE_EOF. This sort of makes sense, but is very unfriendly and useless to a newbie like myself. Experiments on the machine I have led me to believe that a ‘small file’ is 736 bytes or less. 737 bytes or more starts using clusters. I found these limits by performing a binary search on various file sizes using Linux/cygwin ‘dd’ command to generate files of the required size.
At this time, I have not found anyone supporting my claim about 736 vs 737 bytes, but http://www.ntfs.com/ntfs_optimization.htm does say “On NTFS if file is small enough, it can be stored in MFT record itself without using additional clusters.”
My systems are using Windows 10, NTFS simple volumes. I don’t understand NTFS, the MFT or attributes very well. Perhaps someday I will find the appropriate structure that explains why this number comes about (like structure can be up to 1K and already has 288 bytes in use??).