从VHDX文件中检索数据 [英] Retrieving data from VHDX file
问题描述
你好，
我对VHDX文件数据存储和检索算法感兴趣，
因此创建了具有一些文件的示例动态类型VHDX文件，
现在按照规范（ https://www.microsoft.com/en -in / download / details.aspx？id = 34750 ）能够检索实际的
磁盘结构
ie
1.能够读取MBR，
2.获取具有2个分区的分区表，即NTFS
3读取有多个数据运行的NTFS MFT条目
成功检索到第一个数据运行但第二个数据运行无法找到MFT文件进入其他地方。
---------------------------------------- -------------------------------------------------- -------------------
以下步骤提取MFT表
磁盘偏移量映射到vhdx文件中的实际偏移量，
bat index = Diskoffset / BlockSize
startIndexInBlock = Diskoffset％BlockSize
vhdxOffset = BlockAllocationTable [BatIndex] .FileOffsetMB
vhdxOffset + = startIndexInBlock
---------------------------------------- -------------------------------------------------- -------------------
你能帮我看一下VHDX文件中MFT文件输入物理偏移的这个发现吗？
在固定类型的VHDX中获得正确的MFT输入。
问候，
Dev
< blockquote>
Hi Dev，
感谢您提供有关VHDX文件格式的协议问题。我想协助解决此问题。请发送电子邮件至我们的dochelp（microsoft.com）地址，这样我就可以设置工作区来上传您正在使用的示例VHDX文件。
谢谢，
Hello,
I’m interested in the VHDX file data store and retrieving algorithms,
so created the sample dynamic type VHDX file which having some files ,
Now as per specification (https://www.microsoft.com/en-in/download/details.aspx?id=34750) able to retrieve the Actual
disk structure
i.e
1. Able to read MBR,
2. Get Partition Table which having 2 partitions i.e NTFS
3. Reading the NTFS MFT entry which having multiple data runs
1st data run successfully retrieved but for 2nd data run not able to found MFT file entry going somewhere else.
-------------------------------------------------------------------------------------------------------------
following steps to do extract MFT Table
mapping of disk offset to actual offset in vhdx file,
bat index = Diskoffset / BlockSize
startIndexInBlock = Diskoffset % BlockSize
vhdxOffset = BlockAllocationTable[BatIndex].FileOffsetMB
vhdxOffset += startIndexInBlock
-------------------------------------------------------------------------------------------------------------
Will you help me into this findings of MFT File entry physical offset in VHDX file?
In Fixed type of VHDX getting the proper MFT Entry.
Regards,
Dev
Hi Dev,
Thank you for your protocols question on VHDX file format. I would like to assist with this issue. Please send us email at our dochelp (at microsoft.com) address, so I can set up a workspace for you to upload the sample VHDX file you're working with.
Thanks,
这篇关于从VHDX文件中检索数据的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！
