here
You haven't shown the full MFT record. It is 0x400 bytes long. It logically ends with 0xffffffff
NB Far clearer if you show offsets in Hex - it is the way pointers etc 'think'
Thanks for your help as you see but we need to find file begining and finish sector which mft record is belong to
Your first MFT entry there is a directory entry but you've missed off the data attribute (the line with 08 00 00 00 on it and the few after that). Your second entry is on a complete different part of the disk to the first and is confusing me. It doesn't seem to have a data attribute at all and just has the standard information attribute and the filename attribute, and a bit of MFT slack.
Can you show us the entire 1024byte MFT record for the actual entry you want help with?
Second picture is damaged turecrypt file we know password and file size but we need to find start sector
Is this a homework question?
if you know tell us
if you know tell us
Nightworker, when asking for help it is customary to be polite and listen to what people are saying. You do not have enough information in those graphics to establish the starting cluster of any files. Neither one has a data attribute. I understand that English may not be your first language, but the word "please" may be useful to you in the future.
Please do not change your question part way through. It does sound too much like a homework question. I will help you, but not give you any answers.
How are you trying to analyse the MFT and which records can YOU see in the last example.
Where is the MFT terminator?
Is the MFT complete?
What is the file size of the TrueCrypt file?
Knowing that information you can probably answer your question. I think I know the answer.
NB the MFT does not give the start sector, only the relative cluster in the NTFS volume