How do you open NTFS metadata/System Files: $LogFile, $Volume, $Bitmap?

Question

I am running on 64-bit Windows 7. I want to get the FileID associated with some of the NTFS System Files. Some of them ("$Mft", "$MftMirr") I can open but others ("$LogFile" and "$Bitmap") fail with an "access denied" error or invalid parameter ("$Volume"). I have tried doing that as an administrator and running as a local service but they still fail. I am using the following:

/* open the file for checking the File ID */
h = CreateFileW (
        argv[i]                   , // _In_      LPCTSTR lpFileName,
        FILE_READ_ATTRIBUTES      , // _In_      DWORD dwDesiredAccess,
        FILE_SHARE_DELETE |
        FILE_SHARE_READ   |
        FILE_SHARE_WRITE          , // _In_      DWORD dwShareMode,
        NULL                      , // _In_opt_  LPSECURITY_ATTRIBUTES lpSecurityAttributes,
        OPEN_EXISTING             , // _In_      DWORD dwCreationDisposition,
        FILE_ATTRIBUTE_NORMAL| FILE_FLAG_BACKUP_SEMANTICS, // _In_      DWORD dwFlagsAndAttributes,
        NULL                        // _In_opt_  HANDLE hTemplateFile
    );
if (h == INVALID_HANDLE_VALUE) {
    err = GetLastError();
    wprintf(L"Can't open: '%s'. err:%u(0x%x)\n", argv[i], err, err);
    continue;
}

I did set the following privileges as well (I know it is an overkill but I didn't know which one would work): SE_TCB_NAME, SE_DEBUG_NAME, SE_SECURITY_NAME, SE_BACKUP_NAME, SE_RESTORE_NAME, SE_MANAGE_VOLUME_NAME

Answer 1

You can use fget or ntfscopy that are mentioned here: http://blog.opensecurityresearch.com/2011/10/how-to-acquire-locked-files-from.html