Re: [sleuthkit-developers] win32 device opening

[Brian C. <ca...@sl...>]

On Oct 29, 2008, at 3:12 AM, Christophe GRENIER wrote:

> On Tue, 28 Oct 2008, Brian Carrier wrote:
>
>> Hi Michael,
>>
>> I only want read access, but I tried adding GENERIC_WRITE and it
>> still failed.
>>
>> I recently added the FILE_SHARE_WRITE because someone reported that
>> it was needed when the device has already been opened with write
>> access because I am then willing to "share" the device with that
>> program.
>>
>> I don't get the sharing violation when I use \\.\C: though, so
>> perhaps the CreateFile arguments are correct and it is simply that
>> PhysicalDrive0 is opened and not being shared.
>
>>> device_handle = CreateFileA(image, GENERIC_READ | GENERIC_WRITE,
>>>                                 FILE_SHARE_READ | FILE_SHARE_WRITE,
>>>                                 NULL, OPEN_EXISTING, 0, NULL);
>
> Hello,
>
> Windows version of TestDisk is using
>  device_handle = CreateFileA(image, FILE_READ_DATA | FILE_WRITE_DATA,
>                                  FILE_SHARE_READ | FILE_SHARE_WRITE,
>                                  NULL, OPEN_EXISTING, 0, NULL);
>
> FILE_READ_DATA requires less privileges than GENERIC_READ,
> see http://msdn.microsoft.com/fr-fr/aa364399(en-us).aspx

Hi Christophe,

Thanks, but that didn't seem to change anything on my XP system when  
trying to open \\.\PhysicalDrive0. I still get a sharing violation.

> So far, it works well under Vista as long as you run TestDisk
> using right-click "Run as Administrator".

It works on both \\.\C: and \\.\PhysicalDrive0?

thanks,
brian