PC Review


Reply
Thread Tools Rate Thread

Accessing MFT

 
 
Monty
Guest
Posts: n/a
 
      17th Nov 2006
Hi all,

i have run into a problem here i am try to read all the records in the
MFT and its working quite well but the problem is in "System32" folder

When i am browing the System32 folder's MFT entry i get an
ATTRIBUTE_LIST attribute and i know what it is but where is the next
MFT's address in ATTRIBUTE_LIST structure below

struct ATTR_ATTRIBUTE_LIST
{
DWORD dwAttrType;
WORD wRecordLength;
BYTE chNameLength;
BYTE chOffsetToName;
LONGLONG u64StartVCN;
LONGLONG u64BaseReference;
WORD wAttributeId;
WORD wAttrName[3];
};

Second and more important right after the ATTRIBUTE_LIST attribute i
get an OBJECT_ID attribute but the problem is its length is 0x8F30028
this is surely wrong as the MFT size itself is 1024 bytes

please help i am kinda stuck and there is not enough docs out there.
thanks

 
Reply With Quote
 
 
 
Reply

Thread Tools
Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
(IFS filter driver) Accessing user buffer from kernel thread or accessing handles within user context RA Windows XP Drivers 4 21st Dec 2005 11:40 AM
IE slow accessing IIS6 versus being fast accessing IIS4 =?Utf-8?B?dmFkaW0=?= Windows XP Internet Explorer 0 20th Oct 2004 08:51 PM
IE slow when accessing IIS6 versus fast accessing IIS4 =?Utf-8?B?dmFkaW0=?= Windows XP Internet Explorer 0 20th Oct 2004 08:49 PM
Problem accessing Internet Explorer 6 when initially accessing internet inowcu2 \(removethis\) @yahoo.com Windows XP Internet Explorer 0 10th Dec 2003 04:40 AM
Re: accessing a C-DLL Qiu Zhang Microsoft C# .NET 1 31st Jul 2003 05:47 PM


Features
 

Advertising
 

Newsgroups
 


All times are GMT +1. The time now is 08:01 PM.