Hi all,

Hopefully this is the right place to post this.

I'm having a bit of a nightmare trying to calculate some data runs present within an NTFS MFT entry, to be more specific, inside of the index allocation attribute.

The data runs taken from the attribute are:



I've written some code to decode them, but for some reason the final value being returned is completely wrong, and doesn't point to an INDX file, like the rest do.

I'm not sure if this is a problem with my decoder, or if that piece of the run is actually telling me something different.

If anyone can help decode these runs, or help shine a bit of light on what might be going wrong, I'd appreciate it.

Thanks

The values that I've gotten from decoding the runs are:

 

Can you try joakim's thingy here?:
www.forensicfocus.com/...ic/t=8010/
code.google.com/p/mft2csv/
maybe it gives the results you are looking for.

jaclaz
_________________
- In theory there is no difference between theory and practice, but in practice there is. - 

1 - THINK in HEX. It is much easier

2 - The frst offfset is 0xbeeef

3 - Multiply this by sectors per cluster (usually 0x8)

4 - Add in the start of of the partition, eg 0x3f, 0x800
_________________
Michael Cotgrove
www.cnwrecovery.com
cnwrecovery.blogspot.com/ 

The normal cockup(tm) here is not to apply the fixup values first, have you done that?

Also it would be useful to provide a screenshot of the complete MFT record, with the bytes that you think are relevant highlighted, so that we can see that you are actually pointing at the start of the data runs.
_________________
Paul Sanderson
Reconnoitre, VSC processing made easy - www.sandersonforensics...oitre.html
www.twitter.com/sandersonforens 

Thanks for the input guys.

I've just this second realised that part of of the data run is within the last two bytes of the sector, therefore I've not looked into the fixup array to get the true values.

I'll go do that now and let you know how I get on!

Thanks Paul for pointing out the error (cockup)