|
5.2 MFT data structure:
|
Byte offset (hex)
|
Byte count
|
Meaning
|
|
00-03
|
4
|
Signature value "46494C45" (plaintext "FILE")
|
|
04-05
|
2
|
Update sequence number offset
|
|
06-07
|
2
|
Update sequence number of the number of array
|
|
08-0F
|
8
|
Log sequence number ( LSN)
|
|
10-11
|
2
|
Serial Number
|
|
12-13
|
2
|
Number of hard links
|
|
14-15
|
2
|
The first attribute of the offset address
|
|
16-17
|
2
|
Signs, 00 deleted files; 01 documents; 02 has been deleted directory; 03 directories.
|
|
18-1B
|
4
|
MFT logistic length
|
|
1C-1F
|
4
|
MFT physical length
|
|
20-27
|
8
|
Basic documentation index number
|
|
28-29
|
2
|
The next attribute ID
|
|
2A-2B
|
2
|
Border
|
|
2C-2F
|
4
|
MFT record number (starting number 0)
|
|
30-37
|
8
|
Update sequence number arrays
|
|
38-3FF
|
968
|
Property and correction values
|
Important bytecode interpreted as follows:
1) 00-03: MFT entries signature value "46494C45", expressly for the "FILE".
2) 04-05: Update offset serial number number.
3) 06-07: update sequence number of the number of array, typically 3.
4) 08-0F: log sequence number.
|
