Hello,

1. I'd like to know if there's a way to write data to the disk directly (without caching/buffering) once the WriteFile API has been used. Does the FlushFileBuffers API or the FILE_FLAG_NO_BUFFERING flag within the CreateFile API do the job? Which one is better (N.B. the "file access" limits of FILE_FLAG_NO_BUFFERING are not a problem)?

2. I want to check how a particular file was written to the disk. So I need to find out which LBA blocks are allocated to that file so I can check them with a disk editor. Do you know of any utility that could do that? I tried searching the entire disk with the disk editor but it's very time-consuming. The file is on an NTFS partition if that matters.

Any help is appreciated.

TIA.

A1: I would imagine the flags do as they suggest. I see no reason to doubt it. But you can open the physical disk directly in Windows using \\.\PhysicalDriveN (N=0, 1, 2, etc.) and a logical drive using \\.\X: (X=A, B, C etc.).

A2: AFAIK you need to get a program that understands the NTFS format, then you can simply search the directory structures and pinpoint your file location. But remember that NTFS has a habit of storing some smaller files directly in the directory entry, something to keep in mind if you write your own locator app. And don't forget about the meta data also (if you need it).

Thanks for the fast reply.

1. Would I still have to FlushFileBuffers after using CreateFile with the FILE_FLAG_NO_BUFFERING flag or is it redundant since in theory no buffering or caching was done?

2. I'm not writing a disk editor and I don't need to know the physical location of the file within my code.
I just hoped there would be such a utility so I could easily check the job done by my code. Do you know of any editor that understands NTFS structure?

A1: I see no reason for the theory to be wrong.

A2: I know of none, except maybe your brain and a low-level sector viewer.

Using DeviceIoControl with FSCTL_GET_RETRIEVAL_POINTERS will give you a map of clusters used by a file, but then you need to map clusters->sectors.