ntfs file record.txt

内存编辑和查询

template "NTFS FILE Record"

// Template by Jens Kirschner
// X-Ways Software Technology AG

// To be applied to the NTFS Master File Table's (MFT's) FILE records.

description "To be applied to records in the Master File Table"
applies_to disk
sector-aligned

begin
	char[4]	"Signature: FILE"
	uint16	"Offset to update sequence"
	uint16	"Update sequence size in words"
	int64		"Logfile sequence number"
	uint16	"Sequence number (reuse count)"
	uint16 	"Hard link count"
	uint16	"Offset to the first attribute"
	hex 2		"Flags"
	uint32	"Real size of the FILE record"
	uint32	"Allocated size of the record"
	int64		"Base record (0: itself)"
	uint16	"ID of next attribute"
	goto "Offset to update sequence"
	hex 2		"Update sequence number"
	//Update Sequence Array ?
	goto "Offset to the first attribute"

	{
		hexadecimal uint32 "Attribute type"
		IfEqual "Attribute type" 4294967295
			ExitLoop
		EndIf
		uint32 "Length of the attribute"
		IfEqual "Attribute type" 16 //Attribute type 0x10: Standard Information
			move 16
			FileTime "Creation in UTC"
			FileTime "Modification in UTC"
			FileTime "Record change in UTC"
			FileTime "Last access in UTC"
			move -48
		EndIf
		IfEqual "Attribute type" 48 //Attribute type 0x30: Filename
			move 56 

			//int64 "Allocated file size"
			//int64 "Real file size"
			move 16

			move 8
			uint8 "Namelength"
			move 1
			char16[Namelength] "Filename"
			move -82
			move (Namelength*(-2))
		EndIf
		move "Length of the attribute"
		move -8

		endsection
	}[unlimited]
	
end