$ MFT Analysis for NTFS file systems

$ MFT is the most important file in the NTFS file system. It consists of a series of file records. Each file record consists of a record header and a record attribute group (attributes. Generally, the size is 1 kb or a cluster. The attributes offset is generally 0x38. Such as light pink.

Figure 1

The following is an analysis of the MTF file:

Figure 2

Check Run, 32 50 08 00 00 0C, and see that the starting lcn is 0c0000h = 786432, a total of 0850 H = 2128 clusters.

A record property group consists of a series of attributes, each of which has a name defined in $ attrdef. There are several common attribute names:

Table 1 common attribute tables

Not complete ....