MFT Attribute troub...
 
Notifications
Clear all

MFT Attribute trouble

1 Posts
1 Users
0 Reactions
351 Views
(@monty)
New Member
Joined: 19 years ago
Posts: 4
Topic starter  

when i am on windows\system32 MFT entry using NFI(MS tool) i get
File 29
\WINDOWS\system32
$STANDARD_INFORMATION (resident)
$ATTRIBUTE_LIST (resident)
$FILE_NAME (resident)
$OBJECT_ID (resident)
$INDEX_ROOT $I30 (resident)
$BITMAP $I30 (resident)

but when i browse it and i get to OBJECT_ID attribute
the Attribute Type is 64 (0x40) as expected but the FullLength of the attribute is 150994984 Question this blows out everything

struct NTFS_STANDARD_ATTRIBUTE
{
DWORD dwType; <————— this is 64 (0x40)
DWORD dwFullLength; <————— this is 150994984 Question

if i use winhex and i go to that entry the length portion is indeed that but if i count to the next attribute then the length comes out to be 40

there is obviously something i am missing
can ya shed some light


   
Quote
Share: