Hi.
Well that wouldn't be very helpful for situations where I am searching for a specific file or directory and then finding it and wanting its full path. How would I remember the path if I work recursively? The best way is to start at the file and work backwards until you reach root. The results are extremely fast, no lag time for working in reverse at all and I don't need much memory either. The only problem is that you receive the path in reverse, so you just toss it through a reversing function and there you have it.
The two approaches to reading an NTFS disk are both valid. If you start with the '.' or Root entry and follow the Index, you will see what a normal user sees with the operating system. If you scan the $MFT you will see all files, including entries that have become separated from parents. These are files that a user will not see through the operating system.
The start at the root is what you do when you have the full path. If you have a search hit in a file and you know it MFT ref then you do as you said.
Hi.
Does every file and directory have its own MFT record? Is there a chance that a file could be apart of let's say a directory's MFT entry? I wonder because I noticed that in a directory's MFT entry is listed some files that are in that folder but not all are listed.