Searching for data usind ReadFile()

[BlitzX]

I'm writing a program that searches for particular sequences of bytes in a USB stick. The problem is that I don't know how to search effectively. ReadFile() allows me to buffer 512 bytes each time. If my sequence is fully present in that block, then there is no problem. But what if the first byte of my sequence starts at the end of that block, and the rest in the next block?

Visualization:

target="GIF"

block1
000000000000000000
000000000000000000
000000000000000000
00000000000000000G

block2
IF0000000000000000
000000000000000000
000000000000000000
000000000000000000

[DeeperShade]

Is it vital that you use ReadFile()?

Would it be easier for you if you used ifstream's .read()?

http://www.cplusplus.com/reference/iostream/istream/read/

[BlitzX]

I'm reading directly from the disk, so I guess I have to use ReadFile();
I know that I can make an image of the file and use ifstream on it, but I'd like to know how it's done directly.

[WaltP]

I'm reading directly from the disk, so I guess I have to use ReadFile();

Why? What does ReadFile() do that any other read technique doesn't do?

To alleviate your real problem, make your buffer larger than 512 -- say 16 more.
Always read into the last 512 of that buffer, leaving the first 16 bytes alone.
Just before reading the next 512 bytes, move the last 16 bytes into the first 16 bytes. You search on the entire 528 bytes.

char buf[528];

read into &buf[16];
compare
move buf[512-527] into buf[0 - 15]
read into &buf[16];
continue...

[BlitzX]

I never actually thought of doing that, WaltP. Thanks.
I think I used a bad choice of words. What I meant is that I'm reading raw bytes from the USB device, not individual files. If ifstreams are capable of doing that, then forgive my ignorance. I'll try to fix it by allocating more for the buffer.
Here's a section from my code to shed some light on my problem:

int main()
{


    DISK_GEOMETRY dg;




    LONG size;
     HANDLE hDrive = CreateFile(L"\\\\.\\F:", GENERIC_READ, FILE_SHARE_READ| FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL);


      if (!DeviceIoControl(hDrive, IOCTL_DISK_GET_DRIVE_GEOMETRY, NULL, 0, &dg, sizeof(dg), &buf, (LPOVERLAPPED)NULL))
          MessageBox(NULL,L"Failed",NULL,MB_OK);



      size=dg.SectorsPerTrack*dg.TracksPerCylinder*dg.Cylinders.QuadPart;


    char *lbuffer;
    lbuffer=new char[512];

    DWORD dwBytesRead=0;

        //Beginning and end of GIF files.
    char GIF[]="GIF";
    char END[2];
    END[0]=(0x00);
    END[1]=(0x3b);

    for(int ii=0;ii<size;ii++)
    {
        if(!ReadFile(hDrive, lbuffer,512, &dwBytesRead, NULL))
                    ErrorExit(TEXT("ReadFile1"));



                        //STUCK HERE

    }
}

What I actually want to do is retrieve recently deleted files, but without having to create an image of the disk.