|
From: Anton A. <ai...@ca...> - 2007-04-27 09:06:15
|
Hi, Are you forgetting about extent mft records? You said you are reading the MFT sequentially so there will be mft records that point back to their base mft record... Best regards, Anton On 27 Apr 2007, at 09:09, pawan rathi wrote: > Dear Anton, > I have taken care of the fixups in my code both for the MFT > record and the Index record. So, that is not the problem for sure. > I thought the reason might be the inconsistency caused in > the file-system because of improper shutdown or anything else. So i > did "chkdsk" on the file system. But still couldn't figure out the > problem. > > Pawan. > > Anton Altaparmakov <ai...@ca...> wrote: > On 27 Apr 2007, at 06:28, pawan rathi wrote: > > > Hi All, > > I am reading the MFT sequentially. In the FileName attribute of > > each MFT record there is a field called ParentMftReference which > > contains the MFTReference of it's parent. > > for eg. if there is a file called 1.txt in Directory A and > > MFTReference of A = 0x20 > > then ParentMftReference of 1.txt = 0x20. > > > > Ideally it should happen as shown above. Even i am gettin the same > > results maximum times. > > > > But, sometimes the ParentMftReference of a child doesn't match with > > the MftReference of the Parent. > > > > If anyone has faced such issue before or if anyone knows how to > > resolve it or if you can put some light into it, please revert back. > > > You probably forgot to remove the fixups from your MFT records and/or > index records... > > See http://www.linux-ntfs.org/content/view/109/48#concept_fixup > > Best regards, > > Anton -- Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @) Unix Support, Computing Service, University of Cambridge, CB2 3QH, UK Linux NTFS maintainer, http://www.linux-ntfs.org/ |
