Read and respond to this message at:
https://sourceforge.net/forum/message.php?msg_id=3041027
By: flatcap
Hi Nicolas,
You are almost there. The INDEX_ROOT and INDEX_ALLOCATION make up a balanced
is the base of a tree of file names. Read though the INDEX_ROOT until you find
a name that's after your target file in the alphabet. Then descend into the
INDEX_ALLOCATION and repeat the process.
I hope that makes sense.
When you have a matching record in the INDEX_ROOT or INDEX_ALLOCATION it will
point to an MFT record. Look up the MFT record and find the data.
Cheers,
FlatCap (Rich).
http://linux-ntfs.sourceforge.net/ntfs
http://linux-ntfs.sourceforge.net/info/readntfs.html
______________________________________________________________________
You are receiving this email because you elected to monitor this forum.
To stop monitoring this forum, login to SourceForge.net and visit:
https://sourceforge.net/forum/unmonitor.php?forum_id=44085
|