I have created a file and gave the filename. Then I make a search for the filename in the whole drive. Search results bring many results, which is quite normal. Some are in pagefile.sys, some others are in link files and so on. So far so good.
However, I wonder which one of these search hits is from the directory entry of my file? Currently each search results is shown belonging to a file such as index.dat, ntuser.dat, pagefile.sys. That is ok because these files contain my the name of my file. But there should be one more record which I should find, the directory entry. In what file or in what form my directory entry will be shown to me after a search? How do I know which search hit is from the directory entry and which search hits from other places on the drive?
Any comment is appreciated.
I have created a file and gave the filename. Then I make a search for the filename in the whole drive.
What search tool are you referring to? And what file system are you working with?
Yunus, Which file system are you looking at here?
If it is NTFS, did you perform your keyword search in Unicode as well as standard ASCII text?
Directory entries in NTFS appear in the MFT whereas those in a FAT file system have the file name within the directory itself out on the disk somewhere.
The other thing to note is that long filenames in a FAT system may be split up and so the characters for a filename may not appear in a complete sequence. This is because a separate directory entry has to be made for each few characters to be compliant with the legacy 8.3 filename length.
Search with WHAT? 😯
Which OS?
Which searching app?
The "directory entry" is NOT in a file you can normally access/see/search in Windows NT based systems and common filesystems.
If FAT there is no "file" containing it.
If NTFS it is $MFT.
(if appliable) try this wink
http//
and Nfi.exe
http//
jaclaz