I began studying about file systems, especially about FAT* and NTFS.
In FAT file systems clusters may be Data or Directory clusters, and the starting cluster number of the Root directory is always known, as prior to FAT32 it was fixed at formatting time, and as with FAT32 is found in the extended BIOS block in the boot sector.
NTFS in the other hand organizes everything under the Master File Table, with a MFT record for each file and directory in the system. The Master File Table has its first 27th position marked as reserved and the first index consists of the $MFT record, which describes the MFT itself.
I understand how NTFS keeps track of data via the resident / non-resident data attribute, while FAT uses Directory Entries to find the first cluster of the cluster chain and refer to the File Allocation Table for further processing.
Now my mind find difficult "processing" these things.
Where do I find the Root directory in a NTFS?
How is a directory represented in a MFT record? Both in a resident and non-resident way, and how do I find a sub-directory MFT record via the current MFT record?
What if cluster runs specified in the second half of the MFT record go beyond the 1024 bytes limit? (I understand this means a badly fragmented file)
I have to answer myself, as it may be useful to others.
The root directory in a NTFS is found at the index 5 of the reserved records of the MFT.
A directory MTF record in a NTFS is represented almost as a file MTF record, but instead of the Data Attribute part, Index Root and Index Allocation attributes are stored. The Index Root contains the indexes of the MFT records in the MFT which represent files and directories stored inside the actual directory.
The Index Allocation is used in case the data runs are bigger then the 1024 bytes limit, to de-reference the data continuation to another MFT record.