0x82 Direct Access Handle Error Fix: Partition Raw I/O

You're in a tight spot when you hit ERROR_DIRECT_ACCESS_HANDLE (0x00000082). It usually happens in low-level disk tools, backup software that reads raw volumes, or forensic apps. A classic trigger: you're writing a tool that opens \\.\C: with CreateFile, and then you try to call something like ReadFile expecting it to work like a normal file. It won't. The OS is telling you the handle you got is for a partition, but you're trying to use it for something that isn't raw disk I/O — like seeking to a file offset or using it with a regular file API.

What's Actually Going On?

When you open a partition with CreateFile and the share mode flags, Windows gives you a handle that allows raw reads and writes of sectors. But that's it. It's not a file handle in the traditional sense — no directory lookups, no file caching, no standard file operations.

The error comes from the I/O manager when it sees a request on that handle that isn't in the allowed set. For example, if you try to use DeviceIoControl with a control code that isn't partition-related, or if you pass that handle to functions like GetFileInformationByHandle, you'll get this error.

Root Cause in Plain English

Windows separates raw disk handles from file handles. A partition handle only supports raw I/O — reading and writing clusters directly. The moment you ask it to do something that requires a file system context, the OS slaps you with 0x82.

Fix: Use the Right Handle for the Right Job

If you're writing code that needs to touch the partition raw, you have to stick to raw APIs. Here's my step-by-step approach:

1. Open the partition correctly. Use CreateFile with GENERIC_READ | GENERIC_WRITE, and don't forget the FILE_SHARE_READ | FILE_SHARE_WRITE flags. You also need OPEN_EXISTING and leave the template null. If you're only reading, skip GENERIC_WRITE to avoid lock issues.
2. Check the handle type. After opening, call GetFileType. If it returns FILE_TYPE_DISK, good. But that's not enough — you need to make sure you're using raw I/O functions exclusively.
3. Use only ReadFile and WriteFile for raw sector access. These work fine with partition handles. Just make sure your byte offsets are aligned to sector boundaries. Mismatched alignment can cause weird errors that look like this one.
4. Avoid non-raw APIs. Don't call anything like SetFilePointer with random offsets, or DeviceIoControl with file system control codes. Stick to FSCTL_LOCK_VOLUME and FSCTL_DISMOUNT_VOLUME if you need to unmount first.
5. If you need file-level access, open the volume differently. Instead of \\.\C:, open \\.\C:\somefile with normal file APIs. That gives you a regular file handle.

Real-World Scenario: Why This Happens in Backup Tools

I've seen this exact error in a custom backup agent that opened a partition to read the MBR, then tried to use the same handle to read a file's content. The developer reused the handle to save code. Don't do that. Open two separate handles: one for raw partition access and one for file access.

Still Failing? Check These

• Driver interference. If you're using a filter driver, it might be intercepting IRPs incorrectly. Try disabling it temporarily to test.
• Handle duplication. If you duplicate the handle with DuplicateHandle, the new handle might not carry the same access rights. Use GetHandleInformation to verify.
• Antivirus or security software. Some security tools hook disk APIs and can break raw I/O. Run your code on a clean VM to rule that out.
• Check your privileges. You need SeBackupPrivilege and sometimes SeManageVolumePrivilege for full access. Without them, you might get a different error, but it's worth verifying.

That's the meat of it. Fix your handle usage and the error disappears. If it still happens, you're dealing with a deeper system issue, and I'd start by checking drivers.