Native C# Class to Read and Parse MFT for NTFS FileSystem

I am looking for a C# class to parse the MFT of an NTFS filesystem and return the attributes. ? It should also be able to parse data runs to provide the full path information.

I have sample code in C# and VB.Net that you can work from. ? a completed project exists that parse and list the full path from the mft exists. ? it currently does not have dates included (which are needed)

sample projects are hosted in my subversion repository

## Deliverables

I have several sample projects in c# and vb.net and C that i can send as samples. ? this code is a component of a larger development project.

this app is a proof of concept for me to work with. ? it is a single form with a combobox and a "go" button. ? it should:

1.) ? list volumes on a drive (done)

2.) ? when a volume is selected, it should check to see if it is NTFS. ? this needs to be done by opening a raw disk handle and reading in and parsing the volume boot natively.

3.) ? find, read, and parse the $Mft and attributes

this project will be extended in a future version, developer will have option for future work

the results will be placed in a sqlite database. ? i need (at a minimum): ? filename, created date, modified date, last written date, mft entry modified date, logical size, full path

the goal is to be able to find the clusters that a file occupies, and copy them out (even if it is a locked file) to a new file (i.e. C:\Windows\system32\config\system).

bonus if you can also tell if the file is deleted and any of it's clusters have been overwritten.

the code should be well documented, readable, and easily expanded upon

C# Programming Computer Security Microsoft Project Management Software Architecture Web Security Windows Desktop

Project ID: #3701011

About the project