| Back to logs list
141529 2010 年 11 月 30 日 19:17 Reading (loading. ..) Comments (0) Category: Previous log
NTFS MFT table
the length of the fixed location of the role of head
00H-03H 4 fixed value, it must be 45 ASCII codes in the 30H
06H-07H 2 fixed list size 03 bytes
08H-0FH 8 log file sequence number
10H-11H 2 Serial Number (for records to be reused in this document records the number of times, each time the file is deleted by 1, skip value of 0, if 0,
Strongest in the history of the ghost story of fiv, remains as 0)
12H-13H 2 hard connection,
new new balance shoes, only the basic documents in the record, directory contains the number of items to be used to it
14H-15H 2 first attribute stream starting address ; 38H began
16H-17H 2 The first is to remove the flag byte flag, 0 removed 1 1 second that the normal file / directory directory file 1 00 0 01 normal file delete files delete the directory 03 02 normal directory
18H-1BH 4 ; files record the actual size of the
1CH-1FH 4 ; file records the size distribution of 400H is 1KB
20H-27H 8 corresponding to the basic document records the file reference number, (the use of extended documentation,
反应今世社会的100张照片,看了让人不由得落泪｛接待转, and basic documentation for the 0,
new balance sneakers, documentation in the basic list of attributes stored in extended attributes 0x20 documented information)
28H ~ 29H The next free ID number 2, when adding new property, the value assigned to the new property, then the value increase, if the MFT record of re-use,
new balance running shoes, then it is set to 0,
new balance outlet, the first instance is always 0
2AH ~ 2BH 2 ; border,
Only ten words, but I watched ten minutes - Qzone, Windows XP use,
new balance shoes, which is used in the two sectors recorded the last two bytes of the value of the
2CH ~ 2FH 4 ; Windows XP to use, the MFT record number
list of attributes 14H-15H 2 38H began
00H-03H ; 4 0x10 attribute type (10H standard attributes)
04H-07H 4 0x60 total length (including the standard properties on head itself) 38H +60 H = 98H to the next property starting offset 98H
08H 1 0x00-resident flag 0 1 attribute value is in
09H Permanent 1 0x00 Length of the name attribute name 0 property is $ AttrDef standard attributes defined in
0AH-0BH 2 Offset 0x18 attribute name the name of the length of the name 0, so the value here does not make sense.
0CH-0DH 2 0x00 flag (seems to have no use,
new balance 574, unified on the file properties)
0EH-0FH 2 0x00 ID
10H-13H ; 4 L 0x48 attribute length 18H +48 H = 60H is the property of the length of
14H-15H 2 starting offset 0x18 attribute content ; relative start address of the property attribute the start offset
16H 1 ; 0x00 flag
17H 1 0x00 Index Fill
18H L L byte attribute byte ; use the offset is relative to the content of the starting offset of the offset attribute, that attribute relative to the starting offset 0x18 the first place, relative to the entire file offset 0x48 record at
attribute file directory logo