|
From: cdavid87 <dav...@gm...> - 2009-10-29 00:36:29
|
Hello. I'm developing an application to recover files and I'm stuck at this point: I want to find out all the MFT location on the disk. For that I took the DATA Attribute from the $MTF file and parse it like it says in the linux-ntfs documentation ... With the data runs etc ... The first run guides me to the right partition => the current one, but I can't get the next one properly ... I took a disk analysor and got the following offset: 1st FILE0 list of files at 0xC0000000 2nd FILE0 lst: 0x63FFA7000 But my program first gives me : 1st ->0xc0000 (*0x200 * 0x08) --- 2nd -> offset is FE0742 ... This means (FE & 0x80 = 0x10 => we have to sustract) we get something like : (0xc0000 - 20742 ) * 0x1000 != 0x63FFA7000 And of course that at that offset I don't get the magic FILE0 at the beggining :( Can somebody help me ... I really need this done and I'm stuck here for a long time :(( David -- View this message in context: http://www.nabble.com/MFT-record-problem-tp26104473p26104473.html Sent from the linux-ntfs-dev mailing list archive at Nabble.com. |
