Scan MFT for file entries?

[PSThunter]

Hello all,

We use a vbscript currently that does a recursive search of user machines, looking for *.pst. This makes use of the filesystem object. As it's triggered in login scripts, it's a pain to hit the client machines with unecessary disk i/o at that time.

And this is a true pain in the butt, as it's quite disk i/o intensive and time consuming. I'm wondering if someone would know how to scan the MFT on NTFS disks through a vbscript, rather than doing a recursive search?? Or can we just look at directory entries somehow? We just need the filename, path, owner, and size (although attributes may be handy too).

We can probably come up with some util to do the job (as per methodology employed by FSUtil.exe file findbysid; or salvageNTFS (find 'em in Google)) however vbscript would be simpler for our infrastructure controls.

Anyone?

Cheers

 

[PHV]

Have you tried to grab the output of this command ?
"cmd /c dir /b /s *.pst"

Hope This Help
PH.

 

[PSThunter]

Not yet. /B gives a nicely formatted list but little information, user name, last access on same line would make output grab really simple... thanks for the suggestion!

Interesting - dir /s is only scanning the MFT here? V little disk activity. Cool...

 

[PSThunter]

Nope - on reflection, one finds that dir /s also causes a disk scan (after reboot for example).

Thanks anyway!

 

[bboffin]

You may be expecting too much here in terms of performance. You are asking the computer to search an entire disk (or disks?) for a wildcard specified file. Most PCs will have well in excess of 20,000 files on the C drive and even if you could trawl though the MFT directly it would take some time to do this.

If you could limit the search in some way it would help. For example if you know that the .pst files are normally stored under Documents and Settings you could limit the search to that tree only. If there are several likely trees in which the file(s) could be found this can be repeated for each likely location.

Furthermore if the search can be regarded as complete when you find the first file you can shorten the search enormously by this technique of looking in the likely places first.