Detecting an NTFS volume

[sinsi]

I've been playing around with checking fragmentation of a file using FSCTL_GET_RETRIEVAL_POINTERS, but this only works on NTFS volumes.
Is there an easy and approved way to check for NTFS? I can think of a few (GetVolumeInformation, reading the boot sector, opening $MFT) but there
seem to be workarounds.

[donkey]

GetVolumeInformation does the trick...

Code Select Expand

invoke GetVolumeInformation,offset DriveName,0,0,0,0,0,offset szFSName,64
invoke szCmpi,offset szFSName,"NTFS"

Pass the volume name for example "C:" in DriveName and the filesystem will be returned in szFSName. FSCTL_FILESYSTEM_GET_STATISTICS should also work.

[sinsi]

Yeah, but I seem to remember reading that you can't rely on it (ralph?old msdn?).

Heh, the current MSDN info is really helpful...

lpFileSystemNameBuffer [out]
A pointer to a buffer that receives the name of the file system, for example, the FAT file system or the NTFS file system. The maximum buffer size is MAX_PATH+1.

I know it will be "FAT32" or "FAT16" or "NTFS", but good feckin explanation.  ::)