使用逻辑卷偏移解析MFT [英] Parsing MFT using Logical Volume Offset

问题描述

我试图将音量偏移与MFT记录联系起来。需要帮助和建议。



这就是我正在努力做的事情。



我有一个元数据文件，对于卷中的每4096个字节，条目为1'和0'。现在我需要找出元数据文件中存在1'的文件名。例如，我的元数据文件有1000个条目，这意味着我的卷大小是1000 * 4096 = 4096000 Bytes.Now，我在第100个位置有1个条目。我想找到我的100 * 4096 = 409600卷的逻辑偏移中的文件是什么。这意味着我必须使用Volume Offset解析我的MFT表。



对此有任何想法或建议。希望我对我的问题很清楚！

Hi ,

I am trying to Relate Volume offset with the MFT Record. Need help and suggestion on the same.

This is what i am trying to do exactly.,

I have a Metadata File that have entry say 1''s and 0''s for every 4096 bytes in a volume. Now i need to find out the file name where the 1''s exist in the metadata file. For example , My metadata file has 1000 entries, which means that my volume size is 1000 * 4096 = 4096000 Bytes.Now, I have a 1 entry in 100th position. I want to find what is the file that reside in my 100* 4096 = 409600 Volume''s Logical Offset. Which means i have to parse my MFT table using the Volume Offset.

Any idea or Suggestions on this. Hope i am clear with my question!

推荐答案

如果谈论NTFS，我认为你会遇到一个LCN< - > VCN问题。你可以看看网站ntfs.com。

Windows控制代码IOCTL_VOLUME_LOGICAL_TO_PHYSICAL和IOCTL_VOLUME_PHYSICAL_TO_LOGICAL可能会有所帮助。



仅供参考



- SA

If talking about NTFS, I think you encounter a LCN <--> VCN problem. You can take a look at website ntfs.com.
Also Windows control code "IOCTL_VOLUME_LOGICAL_TO_PHYSICAL" and "IOCTL_VOLUME_PHYSICAL_TO_LOGICAL" may be helpful.

FYI

--SA

这篇关于使用逻辑卷偏移解析MFT的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！