Parsing a File's Metadata Block in ReFS

General (Technical, Procedural, Software, Hardware etc.)

Last Post by mscotgrove 4 years ago

3 Posts

3 Users

0 Reactions

1,220 Views

RSS

NeriMatrixx

(@nerimatrixx)

Eminent Member

Joined: 6 years ago

Posts: 26

Topic starter 24/02/2021 8:19 am

I have search everywhere trying to find out EXACTLY what's inside an ReFS Metadata Block. Particularly, I would like to know the sector-offset of the file pointer that's within the metadata block.

"...where the file has content a file pointer, it will point to the 16KB metadata block address." - http://resilientfilesystem.co.uk/refs-metadata-block

Also, I have read that the partition ID for ReFS is 07 (the same as NTFS); however, I cant find an official documentation from MS that confirming this. Can anyone provide a link to a reliable source that confirms this?

Quote

Topic Tags

ReFS metadata block

JimC

(@jimc)

Estimable Member

Joined: 8 years ago

Posts: 86

24/02/2021 12:38 pm

I would suggest the following starting point:

Reverse engineering of ReFS

There is quite a lot of ReFS research out there now if you go looking.

Jim

www.binarymarkup.com

ReplyQuote

mscotgrove

(@mscotgrove)

Prominent Member

Joined: 16 years ago

Posts: 940

28/02/2021 11:15 am

My experience of Partition ID for many Linux file systems is that nothing is defined. 7 is always NTFS, and Reiser may or may not be 7. You need to look at the start of the partition to determine the actual format.

Programs such as HP Media Vault use Reiser as JOBD RAID, and have a unique boot sector

ReplyQuote