|
Offset: Hex [Dec]
|
Length (Bytes) |
Description |
| 0x00 |
4 |
"FILE" in ASCII. Value is: 0x46 0x49 0x4C 0x45 |
| 0x04 |
2 |
Offset for the Fixup array/offset to Update Sequence |
| 0x06 |
2 |
Update Sequence size |
| 0x08 |
8 |
Sequence Number for the LogFile - Changes every time the record is modified |
| 0x10 |
2 |
Sequence Number - It records the number of times the MFT record is reused |
| 0x12 |
2 |
Count of the hard link - No. of directory entries that reference this record |
| 0x14 |
2 |
Offset for the first attribute |
| 0x16 |
2 |
Flags
| Value |
Description |
| 0x01 |
Record is in use |
| 0x02 |
Record is a Directory |
| 0x04 |
Unknown |
| 0x08 |
Even more unknown
|
|
| 0x18 |
4 |
Logical Size of the record |
| 0x1C |
4 |
Physical Size of the record |
| 0x20 |
8 |
File reference to the base record |
| 0x28 |
2 |
Next Attribute Identifier |
| 0x2a |
2 |
FixUp codes and Attributes |
| 0x2C |
4 |
This MFT Record Number |
| |
| ****Attribute List is variable. End Marker:
0xFFFFFFFF |
| |
|