I need to do a data run (0x80) and i need to show the calculations of starting cluster number, number of clusters. How should i do this? it also says to carefully consider the VCN while calculating the starting position of cluster. I have an image of the MFT file record but am unsure how to attach it to this post.
Â
Thanks
Microsoft call MFT data runs "mapping pairs". In some texts, they are called data runs or extents.
For a general overview of how MFT mapping pairs work, I would suggest checking p280 of Brian Carrier's excellent book "File System Forensic Analysis".
For a practical example of how the data can be decoded, I would suggest you look at Appendix A9 (p396) in Samme's and Jenkinson's book "Forensic Computing: A practitioner's guide" (2nd edition).
Both books are available on Amazon.
Finally, Microsoft themselves document it here:
https://learn.microsoft.com/en-gb/windows/win32/devnotes/attribute-record-header
Â
Jim
forensicinternals.com
Â