Notifications
Clear all
Topic starter
19/11/2006 11:07 am
when i am on windows\system32 MFT entry using NFI(MS tool) i get
File 29
\WINDOWS\system32
$STANDARD_INFORMATION (resident)
$ATTRIBUTE_LIST (resident)
$FILE_NAME (resident)
$OBJECT_ID (resident)
$INDEX_ROOT $I30 (resident)
$BITMAP $I30 (resident)
but when i browse it and i get to OBJECT_ID attribute
the Attribute Type is 64 (0x40) as expected but the FullLength of the attribute is 150994984 Question this blows out everything
struct NTFS_STANDARD_ATTRIBUTE
{
DWORD dwType; <————— this is 64 (0x40)
DWORD dwFullLength; <————— this is 150994984 Question
if i use winhex and i go to that entry the length portion is indeed that but if i count to the next attribute then the length comes out to be 40
there is obviously something i am missing
can ya shed some light