Click here to Skip to main content
15,844,903 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
Hi ,

I am trying to Relate Volume offset with the MFT Record. Need help and suggestion on the same.

This is what i am trying to do exactly.,

I have a Metadata File that have entry say 1's and 0's for every 4096 bytes in a volume. Now i need to find out the file name where the 1's exist in the metadata file. For example , My metadata file has 1000 entries, which means that my volume size is 1000 * 4096 = 4096000 Bytes.Now, I have a 1 entry in 100th position. I want to find what is the file that reside in my 100* 4096 = 409600 Volume's Logical Offset. Which means i have to parse my MFT table using the Volume Offset.

Any idea or Suggestions on this. Hope i am clear with my question!
Posted
Updated 14-Sep-20 8:13am
v2
Comments
Sergey Alexandrovich Kryukov 18-Mar-13 20:18pm    
Master File Table, I presume? Please, avoid acronyms.
—SA
gssajith87 19-Mar-13 9:18am    
@Sergey Alexandrovich Kryukov yes., Sorry for that., it is Master File Table

1 solution

If talking about NTFS, I think you encounter a LCN <--> VCN problem. You can take a look at website ntfs.com.
Also Windows control code "IOCTL_VOLUME_LOGICAL_TO_PHYSICAL" and "IOCTL_VOLUME_PHYSICAL_TO_LOGICAL" may be helpful.

FYI

--SA
 
Share this answer
 
Comments
gssajith87 19-Mar-13 9:20am    
Thanks for bringing in LCN and VCN ., will read regarding this and try to get my problem solved. Better suggestions on this are welcome. MFT is still very unclear.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900