Hi all,
i have run into a problem here i am try to read all the records in the
MFT and its working quite well but the problem is in "System32" folder
When i am browing the System32 folder's MFT entry i get an
ATTRIBUTE_LIST attribute and i know what it is but where is the next
MFT's address in ATTRIBUTE_LIST structure below
struct ATTR_ATTRIBUTE_LIST
{
DWORD dwAttrType;
WORD wRecordLength;
BYTE chNameLength;
BYTE chOffsetToName;
LONGLONG u64StartVCN;
LONGLONG u64BaseReference;
WORD wAttributeId;
WORD wAttrName[3];
};
Second and more important right after the ATTRIBUTE_LIST attribute i
get an OBJECT_ID attribute but the problem is its length is 0x8F30028
this is surely wrong as the MFT size itself is 1024 bytes
please help i am kinda stuck and there is not enough docs out there.
thanks
|