如何从NTFS文件系统上的MFT获取文件的LBA(逻辑块寻址)? [英] How to get LBA(logical block addressing) of a file from MFT on NTFS file system?

问题描述

我访问了$ MFT文件并提取了文件属性.

I accessed the $MFT file and extracted file attributes.

鉴于MFT的文件属性，如何从NTFS文件系统上的MFT记录中获取文件的LBA?

Given the file attributes from MFT, how to get a LBA of file from the MFT record on NTFS file system?

要计算LBA，我知道文件的群集号.

To calculate LBA, I know that cluster number of file.

是否可以使用簇号进行计算?

It that possible using cluster number to calculate?

推荐答案

我不能完全确定您的问题-但是，如果您只是想在文件磁盘上查找逻辑位置，则有各种IOCTL将会实现这一目标.

I'm not entirely sure of your question-- But if you're simply trying to find the logical location on disk of a file, there are various IOCTLs that will achieve this.

例如，MFT文件记录:FSCTL_GET_NTFS_FILE_RECORD http://msdn.microsoft. com/en-us/library/windows/desktop/aa364568(v = vs.85).aspx

For instance, MFT File records: FSCTL_GET_NTFS_FILE_RECORD http://msdn.microsoft.com/en-us/library/windows/desktop/aa364568(v=vs.85).aspx

通过HANDLE在特定文件的磁盘上的位置:FSCTL_GET_RETRIEVAL_POINTERS http://msdn.microsoft. com/en-us/library/windows/desktop/aa364572(v = vs.85).aspx

Location on disk of a specific file via HANDLE: FSCTL_GET_RETRIEVAL_POINTERS http://msdn.microsoft.com/en-us/library/windows/desktop/aa364572(v=vs.85).aspx

如果您尝试自行解析NTFS，则需要遵循$ DATA属性-它将始终是非驻留数据运行(除非它是可以在MFT中驻留的小文件) . Microsoft的数据运行相当简单，即前两个半字节中包含的数据结构，它们为下一轮数据指定偏移量和长度.

If you're trying to parse NTFS on your own, you'll need to follow the $DATA attribute-- Which will always be non-resident data runs (unless it's a small file that can be resident within the MFT). Microsoft's data runs are fairly simply structures of data contained in the first two nibbles, which specify offset and length for the next run of data.

这篇关于如何从NTFS文件系统上的MFT获取文件的LBA(逻辑块寻址)?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！