Notes

Windows devices

Reading Windows devices using ReadFile is edge-case ridden process.

File Buffering

Though CreateFile allows to set FILE_FLAG_NO_BUFFERING, some device are not buffered by default e.g.

\\.\C:

The following restrictions apply to non-buffered file handled:

• data must be read in a sector-aligned manner;
• the buffer passed to ReadFile must be correctly memory aligned; Also see: MSDN: File Buffering.

Successful non-read

Windows Volume Shadow Snapshot will have ReadFile return successful if it tries to read from the "unallocated space", however the contents of the buffer passed to ReadFile is not changed.

Unable to read last sector

Volume devices appear to not allow the last sector to be read.