A detailed description of the MFT's cluster flow data structure

Last lesson we already know the property body of a very resident property is a cluster flow information. So what is the cluster flow information specifically about? A cluster stream is actually a storage address used to describe the contents of a data. The cluster flow information can be a group of clusters or groups, and a set of cluster flow information indicates that only one fragment of the data is contiguous. If there is more than one set of cluster flow information, then it means that the data content is composed of multiple fragments, is discontinuous.

Each set of cluster flow information is made up of 3 parts.

The first section describes the number of bytes required to make the cluster stream information in the following two.

The second section describes the number of clusters that this cluster stream occupies.

The third section describes the starting cluster number for this cluster stream.

If the following is not followed by 00, it means that there is also cluster flow information behind.

650) this.width=650; "src=" Http://s1.51cto.com/wyfs02/M02/83/F0/wKioL1eAwk2hIaxLAAlfRoXehW8961.jpg "title=" cluster flow information. jpg "alt=" wkiol1eawk2hiaxlaalfroxehw8961.jpg "/>

There are two cluster streams of information

0C for a set of cluster flow information

0B C8 F4 for another set of cluster flow information

These two sets of cluster flow information represent

0C:

32 means the next two bytes 40 19 is the number of clusters occupied by the cluster stream fragment that is 0x1940 equals 6464 clusters

The back 3 bytes, 0 C is the starting cluster number of the cluster stream fragment (since this is the first cluster flow information, so this starting cluster number is relative to the file system of cluster No. 0) that is 0x0c0000 equals 786432 clusters.

The following set of cluster flow information

0B C8 F4

32 means that the next two bytes 0B is the cluster number occupied by the cluster stream fragment that is 0x0b80 equals 2944 clusters.

The back 3 bytes C8 F4 is the starting cluster number of the cluster stream fragment (since this is the second cluster flow information, the starting cluster number is relative to the first cluster's starting cluster 786432) that is 0xf4c840 equals 16042048 clusters of +786432 clusters. So the first cluster number of the 2nd stream fragment is 16828480 clusters

A detailed description of the MFT's cluster flow data structure