ntfs mft结构（ntfs mft结构）.doc

ntfs mft结构（ntfs mft结构） NTFS MFT - Data Recovery Tool - -oracle database recovery -Raid5 data recovery -RAID0 data recovery [Full] full version [Rss] subscription [Xml] no plate, [Xhtml], no plate, Rss SiteMap -oracle database recovery, -Raid5 data recovery, -RAID0 data recovery, Oracle database recovery -Raid5 data recovery -RAID data recovery -RAID0 data recovery -oracle data recovery \ \ -oracle database recovery, -Raid5 data recovery, -RAID0 data recovery, data recovery tools - NTFS, MFT structure, a total of 1 records, each page shows 10, page: [1] [title]: NTFS MFT structure 1 floor sosdb published at: 2009-5-27 16:40:52 Here are a few important MFT properties introduced (1) MFT file record attribute header structure Table 6 header description of file properties Offset length description 0X00 4 fixed value FILE 0X04 2 updates serial number offset associated with the operating system 0X06 2 fixed list size 0X08 8 log file serial number 0X10 2 serial number (used to record the number of times files are reused) 0X12 2, the number of hard connections, associated with items in the directory, very important parameters The offset of the first property of 0X14 2 0X16 2 flag byte 0X18 4 file record real time size (bytes) II 0X1C 4 file record allocation size (bytes) 0C20 8 base record (0:, itself) 0X28 2, the next free ID number 0X2A 2 boundary 0X2C 4 WINDOWS XP used in this MFT record number 0X30 4 MFT use mark (2) file name attribute Table 7 file name property description Offset size value property type description 0X00 4 0X 30 0X04 4 0X68 total length 0X08 1 0X00 nonresident sign (0X00: resident property; 0X01: nonresident property) Name length of 0X09 1 0X00 property name The name shift of the 0X0A 2 0X18 property name 0X0C 2 0X00 signs 0X0E 2 0X03 logo 0X10 4 0X4A attribute length (L) 0X14 2 0X18 property content start offset 0X16 1 0X01 index flag 0X17 1 0X00 fill 0X18 80500000000000500 parent directory record number (previous 6 bytes) + sequence number (relativ