Answer the question
In order to leave comments, you need to log in
How can I find out the MFT record number from the file/directory name?
The question is in the title.
It is necessary to copy files at the physical level (sector by sector)
The option to view all mft records and analyze the file name attribute for each I think is irrational
It is necessary for writing code
Answer the question
In order to leave comments, you need to log in
Who thinks about this option:
you need to follow the path from the root directory
C: \ t1 \ t2
, that is, first analyze the root directory entry (the 5th MFT entry by default), or rather its IR / IA attribute (depending on whether which directory - large or small), by name find the next directory in the path "t1", where will be its entry number
Then analyze the entry of the directory "t1" also, where will we find by name "t2" and its entry number?
If the root directory is large, then we use the nodes of the B-tree of the root directory, if it is small, we immediately find the directory entry number "t1" in the IR attribute, etc.
Didn't find what you were looking for?
Ask your questionAsk a Question
731 491 924 answers to any question