Join Us!

NTFS, number of run...
 
Notifications
Clear all

NTFS, number of runs/extents  

  RSS
CyberGonzo
(@cybergonzo)
Member

Hi,

I have an NTFS parsing implementation that works well.

As an improvement action I'm now looking to see if I can determine the amount of data runs without parsing the actual data attributes. The latter especially if there are 'many' data attributes because there are 'many' MFT records in play (via an attribute list).

Is this 'number' recorded somewhere ?
Or even the number per data attribute (although in that case I may as well parse the attribute to find out)

I actually have the same question for the total number of files/folders in INDX blocks. Is that recorded somewhere ? So that one can immediately say there are so many files+folders in a folder without parsing all INDX blocks ?

Thx

Quote
Posted : 02/02/2020 3:37 am
thefuf
(@thefuf)
Active Member

Hi,

I have an NTFS parsing implementation that works well.

As an improvement action I'm now looking to see if I can determine the amount of data runs without parsing the actual data attributes. The latter especially if there are 'many' data attributes because there are 'many' MFT records in play (via an attribute list).

Is this 'number' recorded somewhere ?
Or even the number per data attribute (although in that case I may as well parse the attribute to find out)

I actually have the same question for the total number of files/folders in INDX blocks. Is that recorded somewhere ? So that one can immediately say there are so many files+folders in a folder without parsing all INDX blocks ?

Thx

You can get the file size but not the exact number of mapping pairs (aka data runs).

What are you trying to achieve? The way how mapping pairs work allows you to seek within a file without reading all attributes.

ReplyQuote
Posted : 02/02/2020 10:05 am
CyberGonzo
(@cybergonzo)
Member

not the exact number of mapping pairs (aka data runs).

OK, it confirms what I believed is the case but I wanted to make sure there is no such field/attribute that I'm not aware of.

What are you trying to achieve?

Just figure out if there is a way to 'report' the amount of data runs without actually reading all MFT records / data attributes.

No biggie. Thanks

ReplyQuote
Posted : 02/02/2020 10:00 pm
Share: