FSCTL_GET_RETRIEVAL_POINTERS fails for small files

Question

I am using FSCTL_GET_RETRIEVAL_POINTERS to obtain file's physical offset(sectors). The problem I am facing is I am not able to get the sectors of files whose size is 1 kb or less. I know record of files with size 1 kb or less is stored in the MFT itself. Can someone help me to obtain the sectors of such files? Any kind of help will be appreciated, it will be more better if someone can provide me with the sample code doing the same. Thanks in advance.

Answer 1

You need to parse the file $MFT to retrieve the physical location, the location is stored in the attribute 0x80. You can use winhex to open the raw disk and view the file records of these small files.