=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
mblsha wrote:
> Code is parsing INDX records ok, but I cannot find files using MFT
> references. I'm using first 6 bytes from 8-tyte MFT reference as number of
> FILE record.
Ok. I have found out that FILEs are stored as 0x80 attribute of $MFT FILE.=
=20
But, anyway, attributes in these files are corrupted (at least I think so).
I have released my program. Go to http://maz.sf.net and look out for NTFSvi=
ew=20
:-).
=2D --
Michail "mblsha" Pishchagin - MAZsoft
mb...@us... - http://maz.sf.net
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)
iD8DBQE+p1335mhuYpsVoGwRAnk0AJ4z0q6Acvsv61A36Wukn0oNd0EIBgCdHO0Z
+BaHQgX3ZNKtqcZAlXV5LOM=3D
=3DQIZU
=2D----END PGP SIGNATURE-----
|