NTFS MFT Directory Index
-
Hey guys, I was just wondering, given Master File Table entries on an NTFS system, how would one retrieve the directory of the file? I understand there's an Index attribute somewhere, but i'm not sure how to read the index and convert it to a path or position. Example of a file: - Directory path: C:\Archives\ - Filename name: 09011105010CITV.txt - Full directory path: C:\Archives\09011105010CITV.txt I made these two files and ran a scan on my Master File Table. Using a custom built Hex Viewer, these are the two hexadecimal outputs of the files: MFT output[^] Those are the blocks of data in the Master File Table. Now i'm going to try and see if I can try and figure out how to link the two together, but otherwise can anyone else lend a hand? Thank you. Much appreciated!
-
Hey guys, I was just wondering, given Master File Table entries on an NTFS system, how would one retrieve the directory of the file? I understand there's an Index attribute somewhere, but i'm not sure how to read the index and convert it to a path or position. Example of a file: - Directory path: C:\Archives\ - Filename name: 09011105010CITV.txt - Full directory path: C:\Archives\09011105010CITV.txt I made these two files and ran a scan on my Master File Table. Using a custom built Hex Viewer, these are the two hexadecimal outputs of the files: MFT output[^] Those are the blocks of data in the Master File Table. Now i'm going to try and see if I can try and figure out how to link the two together, but otherwise can anyone else lend a hand? Thank you. Much appreciated!
-
Well, I already have all the MFT reader running. Turns out I just need to parse the Index Root Attribute and read the indexes. Turned out to be quite simple. Thanks anyway :)