NTFS $ MFT文件可以有子记录吗? [英] Can the NTFS $MFT file have child records?

问题描述

我正在编写一些代码以通过NTFS卷中磁盘上的MFT进行解析.这很简单，但是有一个特殊的案例引起了我的注意，并且在Internet上的任何地方都找不到清晰的答案.

I am writing some code to parse through the MFT on disk in NTFS volumes. This is straightforward, but one particular corner case caught my eye, and I can't find a clear answer anywhere on the internet.

对于NTFS中的普通文件，如果文件的属性多于单个记录的容量(例如，如果文件具有许多硬链接，则许多$ FILE_NAME属性)，则单个文件可能具有多个MFT记录，或具有许多备用数据流的许多$ DATA属性.

For normal files in NTFS it is possible to have multiple MFT records for a single file, if the file has more attributes than can fit in a single record (for example, many $FILE_NAME attributes if the file has many hard-links, or many $DATA attributes if it has many Alternate Data Streams).

参考编号为0的$ MFT文件保存MFT本身的数据运行.通常，它是一个没有孩子的单记录. $ MFT文件是否可能具有子记录?如果可能的话，您怎么知道在哪里找到它们?这些子记录是否必须以非常低的参考号存储，以便您可以可靠地访问它们而不必解析$ MFT来知道它们在磁盘上的位置?

The $MFT file at reference-number 0 holds the data runs for the MFT itself. Normally it is a single record with no children. Is it possible for the $MFT file to have child records? If it were possible, how would you know where to find them? Would those child records have to be stored with very low reference numbers so that you could reliably get to them without having to have parsed the $MFT already to know where they were on disk?

推荐答案

有一种特殊类型的属性，称为$ATTRIBUTE_LIST.文件或目录最多可以具有65536个属性，它们可能无法放入单个MFT条目中.它基本上包含除他本人之外的所有文件属性的列表.列表中的每个条目都包含属性类型和在何处查找属性的MFT参考.这就是文件记录标题中的基本文件引用字段的作用.

There is a special type of attribute called $ATTRIBUTE_LIST. A file or directory can have up to 65536 attributes and they can't possibly fit into a single MFT entry. It basically contains a list of all the file's attributes except himself. Each entry in the list contains the attribute type and the MFT reference of where to find the attribute. That's what the base file reference field in the file record header is for.

如果列表对于MFT条目而言太大，则该属性可能会变得不驻留，并且可以通过解释该属性的数据运行来找到该列表.

If the list gets too big for a MFT entry, the attribute can become non-resident and the list will be found by interpreting the data run of the attribute.

由于$ATTRIBUTE_LIST的类型为32，因此通常放置在$STANDARD_INFORMATION属性之后，并将包含类型更大的属性(例如$FILE_NAME或$DATA).

Because the type of the $ATTRIBUTE_LIST is 32, it's placed usually right after the $STANDARD_INFORMATION attribute and will contain attributes with greater types (like $FILE_NAME or $DATA).

当文件变得非常分散时，$DATA属性运行列表将不适合单个MFT条目.这也是一种情况，其中$ATTRIBUTE_LIST将用于在多个条目中存储$DATA属性.

When a file becomes very fragmented, the $DATA attribute run list will not fit in a single MFT entry. This is also a case where $ATTRIBUTE_LIST will be used to store the $DATA attribute in multiple entries.

$MFT条目很少出现此问题，因为分配算法旨在防止这种情况.但是，如果卷的$MFT变得非常分散，则可以有多个条目来存储它的$DATA.

The $MFT entry rarely has this problem since the allocation alogrithm is designed to prevent that. But if a $MFT for a volume becomes very fragmented it can have more than one entry to store it's $DATA.

这篇关于NTFS $ MFT文件可以有子记录吗?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！