I have been reading about MFT for few days. Some docs mentioned that I can
look at the first 16 reserved entries in MFT by typing dir /ah $XXXX . but
when I type the following, I get nothing…
dir /ah $mft
dir /ah $bitmap
how can i list these files?
Secondly, I was trying to follow the undelete utility code from Gary
Nebbet’s book. the code tries to access AttributeBitmap of MFT. when I
tried to do the same on Windows2000 system, i found out that there was no
AttributeBitmap attribute present in MFT. Is this attribute present or
not?
How can i access the 6th entry in MFT which corresponds to $Bitmap?
Please provide answers considering that I am toally new to this?
Thanks.