On File "F:\$mft of NTFS

NTFSD
1

Hi, Every one,

I got an example code from Mark and read his book on NTFS data structure.
One of features of NTFS is all metadata stored as files. $mft is the first
file record for metadata. I felt a bit confused that:
I failed to apply FindFirstFile() to “F:$mft” on the NTFS drive F. My OS is
WinXP prof running NT 5.1. Mark said he didn’t find the way to do so for NT
5.0 or higher. Who knows how to read that file? In kernel mode? If those
files can be readable, any one implemented any disk recovery application
except for NTFS original logging recovery?

Appreciate any suggestions.

-Yuzhong

This email has been scanned for all viruses by the MessageLabs SkyScan
service. For more information on a proactive anti-virus service working
around the clock, around the globe, visit http://www.messagelabs.com

2

There is an FSCTL to read MFT records.

Jamey

-----Original Message-----
From: xxxxx@lists.osr.com
[mailto:xxxxx@lists.osr.com] On Behalf Of Yuzhong Sun
Sent: Monday, February 24, 2003 5:19 PM
To: File Systems Developers
Subject: [ntfsd] On File "F:$mft of NTFS

Hi, Every one,

I got an example code from Mark and read his book on NTFS data
structure.
One of features of NTFS is all metadata stored as files. $mft is the
first
file record for metadata. I felt a bit confused that:
I failed to apply FindFirstFile() to “F:$mft” on the NTFS drive F. My
OS is
WinXP prof running NT 5.1. Mark said he didn’t find the way to do so for
NT
5.0 or higher. Who knows how to read that file? In kernel mode? If
those
files can be readable, any one implemented any disk recovery application
except for NTFS original logging recovery?

Appreciate any suggestions.

-Yuzhong

This email has been scanned for all viruses by the MessageLabs SkyScan
service. For more information on a proactive anti-virus service working
around the clock, around the globe, visit http://www.messagelabs.com

You are currently subscribed to ntfsd as: xxxxx@storagecraft.com
To unsubscribe send a blank email to xxxxx@lists.osr.com