Open $Mft

Hello,
I’ve found a message from Max, which says that I can open the $Mft file.
Do you know how can I EXACTLY do this?

Best:
Mark

Take a look at Gary Nebbett "NT Native API reference"book.
There is a discussion on some variables you must set in order to
be able to open MFT file. (You will need debug info to locate these
variables)

Inaki.

-----Original Message-----
From: Mark Twain
Sent: jueves 16 de marzo de 2000 17:18
To: File Systems Developers
Subject: [ntfsd] Open $Mft

Hello,
I’ve found a message from Max, which says that I can open the $Mft file.
Do you know how can I EXACTLY do this?

Best:
Mark

>I’ve found a message from Max, which says that I can open the $Mft file.

dir /ah $Mft works. From this I conclude that it is possible to open $Mft.

Max

Hi,

Could u kindly elaborate the exact procedure to open $MFT.

----- Original Message -----
From: Maxim S. Shatskih
To: File Systems Developers
Sent: Friday, March 17, 2000 5:29 AM
Subject: [ntfsd] Re: Open $Mft

> >I’ve found a message from Max, which says that I can open the $Mft file.
>
> dir /ah $Mft works. From this I conclude that it is possible to open $Mft.
>
> Max
>
>
> —
> You are currently subscribed to ntfsd as: xxxxx@legato.com
> To unsubscribe send a blank email to $subst(‘Email.Unsub’)

>From: “Mayank Kulshreshtha”
>Could u kindly elaborate the exact procedure to open $MFT.

>From: “Maxim S. Shatskih”
>
>>I’ve found a message from Max, which says that I can open the $Mft file.
>
>dir /ah $Mft works. From this I conclude that it is possible to open $Mft.

There are others
cd dir /ah $mft $mftmirr $logfile $volume $attrdef $bitmap $boot $badclus
$quota $upcase

This list is from the sysinternals utility ntfsinfo.

I don’t believe any of these (“dir /ah”) work on Windows 2000 though, I
think I tried once and they didn’t. See the book “Windows NT/2000 Native
API Reference” by Gary Nebbet, Macmillan Technical Publishing" for
information on problems opening these files, ways that possibly work, and
apparently enough information to read them “directly” instead of via the
file system.

Tread very carefully, this is dangerous territory…

That book should be interesting to many on this list.

- Jay

> There are others

cd > dir /ah $mft $mftmirr $logfile $volume $attrdef $bitmap $boot $badclus
$quota $upcase

BTW - can I rebuild the MFT to eliminate the free space in it by something
like chkdsk?

Max