Re: [Linux-NTFS-Dev] MFT Structure

[S. C. <ser...@gm...>]

Thanks! It's just the thing I was looking for!

Best Regards!

On Mon, Dec 22, 2008 at 5:43 PM, Anton Altaparmakov <ai...@ca...> wrote:
> Hi,
>
> On 22 Dec 2008, at 17:38, Sergio Campamá wrote:
>>
>> Hello. I am currently working at a Data Recovery Center, and my
>> project has to deal with the actual files inside a NTFS Partition and
>> I was wondering if anyone could answer me a question.
>>
>> The question is, can I know, with 100% certainty, where are ALL the
>> clusters currently used by the partition, just by looking at the MFT?
>> Does the MFT contain ALL the Dataruns used by the partition? Or do I
>> have to actually read the INDX record to know where the files are?
>> (Disk-wise, not directory-wise)
>>
>> I'm not looking to save the contents of the file, I don't need them,
>> just want to know which clusters are free.
>
> You want to read the system file $Bitmap in its $DATA attribute.  It
> contains a bitmap of all used clusters.  Bit 0 in $Bitmap is the first
> cluster, bit 1 is the second cluster, etc, until the end of the $Bitmap/the
> volume.  All bits that are set (i.e. 1) in $Bitmap mean the cluster is in
> use, and all bits that are not set (i.e. 0) in the $Bitmap mean the cluster
> is not in use.
>
> This fully answers what you want to know in a very efficient / fast
> manner...
>
> Best regards,
>
>        Anton
> --
> Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @)
> Unix Support, Computing Service, University of Cambridge, CB2 3QH, UK
> Linux NTFS maintainer, http://www.linux-ntfs.org/
>
>



-- 
Sergio Campamá
ser...@gm...