Re: [sleuthkit-developers] win32 device opening

[Christophe G. <gr...@cg...>]

On Tue, 28 Oct 2008, Brian Carrier wrote:

> Hi Michael,
>
> I only want read access, but I tried adding GENERIC_WRITE and it
> still failed.
>
> I recently added the FILE_SHARE_WRITE because someone reported that
> it was needed when the device has already been opened with write
> access because I am then willing to "share" the device with that
> program.
>
> I don't get the sharing violation when I use \\.\C: though, so
> perhaps the CreateFile arguments are correct and it is simply that
> PhysicalDrive0 is opened and not being shared.

>> device_handle = CreateFileA(image, GENERIC_READ | GENERIC_WRITE,
>>                                 FILE_SHARE_READ | FILE_SHARE_WRITE,
>>                                 NULL, OPEN_EXISTING, 0, NULL);

Hello,

Windows version of TestDisk is using
  device_handle = CreateFileA(image, FILE_READ_DATA | FILE_WRITE_DATA,
                                  FILE_SHARE_READ | FILE_SHARE_WRITE,
                                  NULL, OPEN_EXISTING, 0, NULL);

FILE_READ_DATA requires less privileges than GENERIC_READ,
see http://msdn.microsoft.com/fr-fr/aa364399(en-us).aspx

So far, it works well under Vista as long as you run TestDisk
using right-click "Run as Administrator".

Regards,

 	Christophe
-- 
    ,-~~-.___.     ._.
   / |  '     \    | |--------.   Christophe GRENIER
  (  )         0   | |        | gr...@cg...
   \_/-, ,----'    | |        |
      ====         !_!-v---v--.
      /  \-'~;      .--------.   TestDisk & PhotoRec
     /  __/~| ._-""||        |   Data Recovery
   =(  _____|_|____||________|   http://www.cgsecurity.org