Great information on interrogating mounted drives via IOKit in this question. But is there a way to determine which of the devices returned by IOIteratorNext() is the boot drive? Or better yet, might there be a way to get just the boot drive in the iterator returned by IOServiceGetMatchingServices()?
Booting is done from media, not a device per se. Devices have media, media have volumes. I don't believe that volumes are represented in IOKit.
This is probably easiest using Disk Arbitration. Use DADiskCreateFromVolumePath() with the CFURL for /. Then call DADiskCopyDescription() to get the description dictionary. That will include properties of the volume, the media, the device, and even the bus, including IOKit paths if you need them. There's a good chance the information you're looking for is directly in the description dictionary, though.
The NVRAM information cited by Mark Setchell is available from IOKit, too, at path IOService:/AppleACPIPlatformExpert/AppleEFIRuntime/AppleEFINVRAM. There's a property efi-boot-device. Its value is a property list including a service matching dictionary. As you can see, it looks for an entry with provider class of IOMedia whose UUID property is a certain UUID.
You can use this:
nvram efi-boot-device
efi-boot-device <array><dict><key>IOMatch</key><dict><key>IOProviderClass</key><string>IOMedia</string><key>IOPropertyMatch</key><dict><key>UUID</key><string>78025031-4C42-4FDE-8DD1-A515A2BF6032</string></dict></dict><key>BLLastBSDName</key><string>disk0s3</string></dict></array>%00
Related
There are some applications (let us call them providers), which (when running) provide a virtual file and directory structure under a new drive letter. Access requests from other processes to those files and directories are served by the provider.
One example of such provider could be the Google Drive for Windows (the new one, not the old Backup and Sync), which maps the contents of your Google Drive to a chosen drive letter.
I thought there should be some simple user-mode API, which should allow my app to provide a new drive and the contents of files and directories on it. I thought that many applications use such API, but I cannot find it. The closest I could get are IFS (installable file system drivers) and file system filter drivers, but those are kernel-mode and they seem too complex. They just seem not designed to accomplish such task.
So, what API should I use to make a simple software-implemented drive?
In addition to the suggestions in the comments there is also now the Projected Filesystem, which allows software to provide a drive-like interface though callbacks and not just by creating an actual disk image. It is my understanding that Projected FS is how, for instance, SQL Server does its table-backed files interface.
For a Windows machine, I'd like to programatically determine which of its drives are actually iSCSI or Fibre Channel (FC) volumes and what storage (SAN) device they are exposed from, i.e. where the data is actually stored. For example, the C:\ drive may be a volume exposed from My_SAN_Storage_Array (https://mysan.company.org) over Fibre Channel.
Ideally, I'd like to do this using WMI in order to be able to obtain this data for remote hosts as well. I don't want to use SAN vendor-specific tools that need to be deployed on each machine separately.
I've looked at a bunch of WMI classes but found nothing of use, e.g. Win32_LogicalDisk doesn't contain any useful info - all drives are seen as local drives; there is no distinction between network iSCSI/FC drives and local drives. diskpart didn't prove helpful either.
At the very least, I'd like to obtain some kind of drive ID (or SAN IQN/WWN) that I can use to determine the underlying SAN device. By querying the actual SAN devices I can determine what FC/iSCSI volumes (LUNs) are exposed to what hosts, but there's no information about the mapping of LUNs to the actual individual drives as seen by Windows. E.g. I can determine that LUN LogicalUnitA (as seen by the SAN device) is assigned to WindowsHostA, but I don't know how to figure out that LogicalUnitA is the C:\ drive as seen by Windows.
I have an IOKit-based kernel extension on Mac OS X, a subclass of IOService. When this service loads i need to publish additional specific runtime information from it and i need it to be accessible from user space without making some specific IOUserClient requests. The information in question is basically field\value pairs and it's format is shared between the KEXT and it's user-space wrapper library. The contents will change over time on some specific events inside the service when it is active.
On Linux i would have accomplished this with a file in the /proc file system. Can you advise a similar strategy on OS X? Maybe something related to IORegistry?
Thank you.
Well this turned out to be pretty easy.
Your IOKit service is (eventially) inherited from IOService class, which in turn is inherited from IORegistryEntry, which represents an instance of your service's entry in IORegistry and provides a family of setProperty\getProperty methods to add\change\remove your own fields in IORegistry entry for your service.
The IORegistry in an in-memory database that is of course programmatically accessible from user space where you search it for you service's entry and read information published by it.
I am searching for all drives and their contents. I don't want to search network drives. How can I determine if a given drive is network mounted? What I would want further is to get similar information one gets using NET USE command?
You want the GetDriveType function.
Also if you would like to add remove drives or check status, check this article out:
http://support.microsoft.com/kb/173011
That's using the win32 api.
I need to get some information that is contained in the MFT on a Windows machine, and I'm hoping that there is some super-secret API for getting this information. I need to be able to get to this information programmatically, and because of legal concerns I might not be able to use the tools provided by the company formally known as sysinternals.
My other option (which I really don't want to have to do) is to get the start sector of the MFT with DeviceIoControl, and manually parse through the information.
Anyway, in particular, what I really need to get out of the Master File Table is the logical sectors used to hold the data that is associated with a file.
There is a documented API for getting info on file positions on disk since Windows 2000. Look for DeviceIoControl function with FSCTL_GET_RETRIEVAL_POINTERS control code on MSDN:
http://msdn.microsoft.com/en-us/library/aa364572(VS.85).aspx
The API has been provided for writing custom disk defragmenters and consists of several other control codes.