directoryntfsntfs-mft

Directory organization in NTFS


Write a parser file system NTFS. I need to consistently read catalogs and display information about the contents of the selected directory, that is only necessary to read the MFT record with information about the files and subdirectories. Question: how to organize it? Is there anything in the MFT record a list of links to other MFT record files and subdirectories?


Solution

  • Some file records in MFT are directories, they are described here. The records for directories have a special attribute that holds indexes to other files in the MFT. By design the list of indexes is stored in a special tree structure called a B*-tree (bases on the B+ tree data structure). The INDEX_ROOT attribute is the root node of the tree. The tree can be parsed through the file record's INDEX_ALLOCATION attribute which contains the rest of the nodes. The index entries found in both of these attributes point to file records in the MFT that represent the files contained in that directory.