Insert bytes into middle of a file (in windows filesystem) without reading entire file (using File Allocation Table)?

Question

I need a way to insert some file clusters into the middle of a file to insert some data.

Normally, I would just read the entire file and write it back out again with

Answer 1

Do you understand that it's nearly 99.99% impossible insert non-aligned data in non-aligned places? (Maybe some hack based on compression can be used.) I think that you do.

The "easiest" solution is to create the sparse run records and then write over the sparse ranges.

1. Do something with the NTFS cache. It's best to perform the operations on the offline/unmounted drive.
2. Get the file record (@JerKimball's answer sounds helpful, but stops short of it). There may be problems if the file is overflown with attributes and they are stored away.
3. Get to the file's data run list. The data run concept and format is described here (http://inform.pucp.edu.pe/~inf232/Ntfs/ntfs_doc_v0.5/concepts/data_runs.html) and some other NTFS format data can be seen on the adjacent pages.
4. Iterate through data runs, accumulating the file length, to find the correct insertion spot.
5. You'll most probably find that your insertion point is in the middle of the run. You'll need to split the run which is not hard. (Just store away the two resulting runs for now.)
6. Creating a sparse run record is very easy. It's just the run length (in clusters) prepended by the byte, which contains the byte size of the length in it's lower 4 bits (the higher 4 bits should be zero to indicate a spare run).
7. Now you need to calculate how many additional bytes you have to insert in the data runs list, somehow make way for them and do the insertion/replacement.
8. Then you need to fix the file size attribute to make it consistent with the runs.
9. Finally you can mount the drive and write the inserted information over the spare spots.