|
From: Anton A. <ai...@ca...> - 2003-04-24 09:50:43
|
On Thu, 24 Apr 2003, mblsha wrote: > mblsha wrote: > > Code is parsing INDX records ok, but I cannot find files using MFT > > references. I'm using first 6 bytes from 8-tyte MFT reference as number of > > FILE record. > > Ok. I have found out that FILEs are stored as 0x80 attribute of $MFT FILE. > But, anyway, attributes in these files are corrupted (at least I think so). You probably have forgotten to apply the fixups desribed in the update sequence array in each mft record... > I have released my program. Go to http://maz.sf.net and look out for NTFSview > :-). Note to find further mft records than the first few you need to parse the attribute list attribute and find further $DATA extent attributes which will be in other mft records. See our docs which describe both of the above. Best regards, Anton -- Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @) Linux NTFS maintainer / IRC: #ntfs on irc.freenode.net WWW: http://linux-ntfs.sf.net/ & http://www-stu.christs.cam.ac.uk/~aia21/ |
