what $Bitmap in MFT contains

NTDEV
1

Hi All,

I was exploring MFT architecture and found that at 6th index $Bitmap file is placed. It read that it is a map of some free and used cluster which NTFS refer when it has to allocates/deallocates some for a file.

I tried to understand the contents of $data attribute of this file but could not figure out something useful. Is it like FAT table where each entry maps to a specific cluster on the partition?

Can any one provide some insight/hints on what exactly a bitmap files contains and in what format?

Thanks
Aditya

2

BOGUS question, i answered i the question itself. It IS a map where each byte denotes a cluster in the partition and whether it is occupied, free or bad. What byte value it actually uses for that; i do not know.

3

I would like to correct. In NTFS Bitmap, every bit represents a cluster not
every byte.

On Tue, Dec 9, 2008 at 9:44 AM, wrote:

> BOGUS question, i answered i the question itself. It IS a map where each
> byte denotes a cluster in the partition and whether it is occupied, free or
> bad. What byte value it actually uses for that; i do not know.
>
> —
> NTDEV is sponsored by OSR
>
> For our schedule of WDF, WDM, debugging and other seminars visit:
> http://www.osr.com/seminars
>
> To unsubscribe, visit the List Server section of OSR Online at
> http://www.osronline.com/page.cfm?name=ListServer
>

–
Elango C
Unidesk, Inc.
Bangalore, India.
website:http://celango.blogspot.com

“Obstacles are those frightful things you see
when you take your eyes off your goal.”

4

TRUE,

Thanks Elango for correting it.