MFT Record Layout

[Bob Simon]

I'm trying to find some files from a corrupted hard drive that won't
boot. I located the MFT by following the pointer at offset 0x30 in
the NTFS Boot Record. The MFT records start with 'FILE' as expected
and I can see the various attribute files identified as $.M.F.T.,
$.M.F.T.M.i.r.r., etc.

I can't seem to find a record layout for these files anywhere online.
Can someone help me with this?

 

[Phil Weldon]

'Bob Simon' wrote:
| I'm trying to find some files from a corrupted hard drive that won't
| boot. I located the MFT by following the pointer at offset 0x30 in
| the NTFS Boot Record. The MFT records start with 'FILE' as expected
| and I can see the various attribute files identified as $.M.F.T.,
| $.M.F.T.M.i.r.r., etc.
|
| I can't seem to find a record layout for these files anywhere online.
| Can someone help me with this?
_____

Search
Microsoft TechNet
for
How NTFS Works

Phil Weldon

news:[email protected]...

 

[Bob Simon]

'Bob Simon' wrote:
| I'm trying to find some files from a corrupted hard drive that won't
| boot. I located the MFT by following the pointer at offset 0x30 in
| the NTFS Boot Record. The MFT records start with 'FILE' as expected
| and I can see the various attribute files identified as $.M.F.T.,
| $.M.F.T.M.i.r.r., etc.
|
| I can't seem to find a record layout for these files anywhere online.
| Can someone help me with this?
_____

Search
Microsoft TechNet
for
How NTFS Works

Phil Weldon

Phil,
Thanks for the pointer. Actually, I already had the article you
mentioned on one of my browser tabs:
http://technet2.microsoft.com/windo...bd32-4786-a849-03245d68d8e41033.mspx?mfr=true

The table titled:
BPB and Extended BPB Fields on NTFS Volumes
has the kind of detailed record layout that I'm looking for on the
MFT. Unfortunately, while this guide contains some of the most
detailed information on the MFT that I have found, it does not include
offset and length for the key fields in any of the 11 listed types of
MFT records.

Bob Simon