[Linux-NTFS-Dev] Problem with ParentMftReference

[pawan r. <paw...@ya...>]

Hi All,
    I am reading the MFT sequentially. In the FileName attribute of each MFT record there is a field called ParentMftReference which contains the MFTReference of it's parent.
 for eg. if there is a file called 1.txt in Directory A and MFTReference of A = 0x20
           then ParentMftReference of 1.txt = 0x20.

Ideally it should happen as shown above. Even i am gettin the same results maximum times.

But, sometimes the ParentMftReference of a child doesn't match with the MftReference of the Parent.

If anyone has faced such issue before or if anyone knows how to resolve it or if you can put some light into it, please revert back.


Thanks and Regards,
Pawan Rathi.

       
---------------------------------
 SHOUT IT OUT! Tell everyone, from anywhere, that you're online on Yahoo! Messenger