mft结构（MFT structure）.docVIP

mft结构（MFT structure） This is the 0 cylinder, 0 head, l sector of the physical hard disk 0, that is, the contents of the main boot sector. You can see the main boot sector data, which is on the left of the sixteen hexadecimal data area, the right is the AScII code data area. But to understand its meaning is not easy, sixteen hexadecimal data in the information would not say, taking the AscII code data area, in addition to some error, such as Invalid Partion Table (illegal partition table) can understand, the other is some garbled. As a matter of fact, it is not necessary for beginners to understand all the meanings of each byte in the main boot sector. Only 3 key data structures can be mastered. (Figure 4) Hard disk boot flag: the 3 bytes located at the front of the main boot sector data. The boot flag bits generated by different operating systems and different partitioning tools may vary. For Microsofts operating system, DOS6.xs hard drive flag is FA 33 C0, while the hard disk flag bits generated by W1ndows are 33 C0 8E. The partition table began to flag: located in the master boot sector data 447th bytes, can only be 80 or 00, the 80 on behalf of the partition is the active partition, 00 refers to the non active partition, apparently only one active partition. End flag bit: the last two bytes of data in the main boot sector, as mentioned earlier, can only be 55 AA. Analysis of MFT file record structure The file record of the main file table MFT consists of a record header and a list of attributes, ending by FF FF FF FF, usually of 1K, or a cluster size (which is usually greater). The header includes the following fields: Offset length (byte) attribute The 0X00 4 sign must be FILE The 0X04 2 updates the offset of the sequence US 0X06 2 updates the size and array of the serial number USN, including the first byte 0X08 8 log file serial number LSN 0X10 2 sequence number (SN) 0X12 2 hard connections The offset address of the first property of 0X14 2 The 0X16 2 flag, 1,