Parsing MFT using Logical Volume Offset

Question

0.00/5 (No votes)

See more:

Hi ,

I am trying to Relate Volume offset with the MFT Record. Need help and suggestion on the same.

This is what i am trying to do exactly.,

I have a Metadata File that have entry say 1's and 0's for every 4096 bytes in a volume. Now i need to find out the file name where the 1's exist in the metadata file. For example , My metadata file has 1000 entries, which means that my volume size is 1000 * 4096 = 4096000 Bytes.Now, I have a 1 entry in 100th position. I want to find what is the file that reside in my 100* 4096 = 409600 Volume's Logical Offset. Which means i have to parse my MFT table using the Volume Offset.

Any idea or Suggestions on this. Hope i am clear with my question!

Posted 17-Mar-13 21:44pm

gssajith87

Updated 14-Sep-20 7:13am

v2

Add a Solution

Comments

Sergey Alexandrovich Kryukov 18-Mar-13 20:18pm

Master File Table, I presume? Please, avoid acronyms.
—SA

gssajith87 19-Mar-13 9:18am

@Sergey Alexandrovich Kryukov yes., Sorry for that., it is Master File Table

1 solution

Add a Solution

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Hawkfuture · Answer 1 · 2013-03-18T22:01:00

Solution 1

If talking about NTFS, I think you encounter a LCN <--> VCN problem. You can take a look at website ntfs.com.
Also Windows control code "IOCTL_VOLUME_LOGICAL_TO_PHYSICAL" and "IOCTL_VOLUME_PHYSICAL_TO_LOGICAL" may be helpful.

FYI

--SA

Posted 18-Mar-13 22:01pm

Hawkfuture

Comments

gssajith87 19-Mar-13 9:20am

Thanks for bringing in LCN and VCN ., will read regarding this and try to get my problem solved. Better suggestions on this are welcome. MFT is still very unclear.

Parsing MFT using Logical Volume Offset

1 solution

Solution 1

Add your solution here

Preview 0

Parsing MFT using Logical Volume Offset

1 solution

Solution 1

Add your solution here

Preview 0

Existing Members

...or Join us