Z
Z
ZIK13372019-09-23 22:28:03
NTFS
ZIK1337, 2019-09-23 22:28:03

How can I find out the MFT record number from the file/directory name?

The question is in the title.
It is necessary to copy files at the physical level (sector by sector)
The option to view all mft records and analyze the file name attribute for each I think is irrational
It is necessary for writing code

Answer the question

In order to leave comments, you need to log in

2 answer(s)
Z
ZIK1337, 2019-09-24
@ZIK1337

Who thinks about this option:
you need to follow the path from the root directory
C: \ t1 \ t2
, that is, first analyze the root directory entry (the 5th MFT entry by default), or rather its IR / IA attribute (depending on whether which directory - large or small), by name find the next directory in the path "t1", where will be its entry number
Then analyze the entry of the directory "t1" also, where will we find by name "t2" and its entry number?
If the root directory is large, then we use the nodes of the B-tree of the root directory, if it is small, we immediately find the directory entry number "t1" in the IR attribute, etc.

D
dhgr, 2019-09-24
@imnd

On windows: fsutil file queryfileid FILENAME C ++ fileapi
description File ID is stored in: DWORD nFileIndexHigh; DWORD nFileIndexLow; But it is not exactly)

Didn't find what you were looking for?

Ask your question

Ask a Question

731 491 924 answers to any question