|
From: Anton A. <ai...@ca...> - 2007-04-27 07:13:30
|
On 27 Apr 2007, at 06:28, pawan rathi wrote: > Hi All, > I am reading the MFT sequentially. In the FileName attribute of > each MFT record there is a field called ParentMftReference which > contains the MFTReference of it's parent. > for eg. if there is a file called 1.txt in Directory A and > MFTReference of A = 0x20 > then ParentMftReference of 1.txt = 0x20. > > Ideally it should happen as shown above. Even i am gettin the same > results maximum times. > > But, sometimes the ParentMftReference of a child doesn't match with > the MftReference of the Parent. > > If anyone has faced such issue before or if anyone knows how to > resolve it or if you can put some light into it, please revert back. > You probably forgot to remove the fixups from your MFT records and/or index records... See http://www.linux-ntfs.org/content/view/109/48#concept_fixup Best regards, Anton -- Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @) Unix Support, Computing Service, University of Cambridge, CB2 3QH, UK Linux NTFS maintainer, http://www.linux-ntfs.org/ |
