NTFS文件系统分析（国外英文资料）.docVIP

NTFS文件系统分析 NTFS file system analysis NTFS Data continued 08 December 2004 NTFS is a much more complex system than fat NTFS boot sector is to guide and define the partition parameter, and FAT partitioning, FAT partition BOOT record is normal, no partition error display, even if the file is not correct, but the BOOT is not a NTFS partition partition sufficient conditions, it must be recorded in MFT system such as $MFT normal to normal access to the partition. The BPB parameter is shown in the table below. Byte offset length, common value, meaning 0x0B word 0x0002 per sector byte number 0x0D bytes 0x08 number of sectors per cluster 0x0E word 0x0000 reserved sector 0x10 3 bytes 0x000000 total 0 0x13 word 0x0000 NTFS unused, for 0 0x15 byte 0xF8 media description 0x16 word 0x0000 total 0 0x18 word 0x3F00 per disk sector number 0x1A word 0xFF00 head number 0x1C double word 0x3F000000 implied sector 0x20 double word 0NTFS unused, for 0 0x28 8 bytes 0x4AF57F0000000000 total number of sectors 0x30 8 bytes 0x0400000000000000 $MFT logical cluster number 0x38 8 bytes 0x54FF070000000000 $MFTMirr logical cluster number 0x40 double word 0xF6000000 per MFT record cluster number 0x44 double word 0the number of clusters per index 0x48 8 bytes of 0x14A51B74C91B741C. 0x50 double word 0test and The file size in MFT is generally fixed, regardless of the size of the cluster, 1KB. The file records are physically contiguous in the MFT file record array and numbered from 0, so NTFS is a predefined file system. MFT is for the system itself, and for the architecture file system, which is called metadata in NTFS (metadata, the data that is stored on the volume to support file system format management). It can not be accessed by applications but can only serve the system. Among the most basic, the first 16 records are very important metadata files used by the operating system. The names of these metadata files start with $, so hide files, and cannot use the dir comm