mft.html

NTFS(NT文件系统) for Linux的一个实现源码

<title>The Master File Table</title>
The master file table record consists of a header and the attribute list.
It has a size of 400 (=1K), or the cluster size (whichever is larger).
The header has the following fields:
<pre>
offset(length)   contents
0(4)             Magic number 'FILE'
4(2)             Offset to fixup (usually 2C)
6(2)             Number of fixups, including first word
10(2)            Sequence number
12(2)            hard link count
14(2)            Offset to attributes
16(2)            Flags: 1-non-resident attributes, 2-record is directory
18(4)            Length of in-use part of the record (header + attributes)
1C(4)            Allocated (total) length of the record
20(8)            Main MFT record, if continuation record, or 0
28(2)            Next free attribute ID
2A(6+)           Fixup (length depends on record size)
</pre>
The fixup's first word should be found at offsets 1FE and 3FE. 
If it matches, the words at offset 2C and 2E should be written to the offsets
1FE and 3FE, respectively. The fixup is incremented each time the record
is written.
<p>
The <a href="attr.html">attribute list</a> is of variable length and 
terminated with FFFFFFFF. For 1K MFT records, the attribute list starts at offset 0x30.