Guest Bob Simon Posted August 7, 2007 Posted August 7, 2007 I'm trying to find some files from a corrupted hard drive that won't boot. I located the MFT by following the pointer at offset 0x30 in the NTFS Boot Record. The MFT records start with 'FILE' as expected and I can see the various attribute files identified as $.M.F.T., $.M.F.T.M.i.r.r., etc. I can't seem to find a record layout for these files anywhere online. Can someone help me with this?
Guest Tim Slattery Posted August 8, 2007 Posted August 8, 2007 Re: MFT Record Layout Bob Simon <nobody@nowhere.com> wrote: >I'm trying to find some files from a corrupted hard drive that won't >boot. I located the MFT by following the pointer at offset 0x30 in >the NTFS Boot Record. The MFT records start with 'FILE' as expected >and I can see the various attribute files identified as $.M.F.T., >$.M.F.T.M.i.r.r., etc. > >I can't seem to find a record layout for these files anywhere online. >Can someone help me with this? http://www.linux-ntfs.org/content/view/103/42/ -- Tim Slattery MS MVP(DTS) Slattery_T@bls.gov http://members.cox.net/slatteryt
Guest Bob Simon Posted August 9, 2007 Posted August 9, 2007 Re: MFT Record Layout On Wed, 08 Aug 2007 09:14:24 -0400, Tim Slattery <Slattery_T@bls.gov> wrote: >Bob Simon <nobody@nowhere.com> wrote: > >>I'm trying to find some files from a corrupted hard drive that won't >>boot. I located the MFT by following the pointer at offset 0x30 in >>the NTFS Boot Record. The MFT records start with 'FILE' as expected >>and I can see the various attribute files identified as $.M.F.T., >>$.M.F.T.M.i.r.r., etc. >> >>I can't seem to find a record layout for these files anywhere online. >>Can someone help me with this? > >http://www.linux-ntfs.org/content/view/103/42/ Thank you Tim. That's what I was looking for. Bob
Guest Tim Slattery Posted August 9, 2007 Posted August 9, 2007 Re: MFT Record Layout Bob Simon <nobody@nowhere.com> wrote: >On Wed, 08 Aug 2007 09:14:24 -0400, Tim Slattery <Slattery_T@bls.gov> >wrote: > >>Bob Simon <nobody@nowhere.com> wrote: >> >>>I'm trying to find some files from a corrupted hard drive that won't >>>boot. I located the MFT by following the pointer at offset 0x30 in >>>the NTFS Boot Record. The MFT records start with 'FILE' as expected >>>and I can see the various attribute files identified as $.M.F.T., >>>$.M.F.T.M.i.r.r., etc. >>> >>>I can't seem to find a record layout for these files anywhere online. >>>Can someone help me with this? >> >>http://www.linux-ntfs.org/content/view/103/42/ > >Thank you Tim. That's what I was looking for. I'm glad it's useful. It's the result of an open-source project to get Linux to read and write NTFS partitions. Microsoft does not make NTFS specs available, in contrast to the FAT and FAT32 specs - at least not without considerable money changing hands, I expect, so these folks have figured it out for themselves. -- Tim Slattery MS MVP(DTS) Slattery_T@bls.gov http://members.cox.net/slatteryt
Recommended Posts