« Windows: simple web scraping with Wget.exe | Main | About base64 »

October 09, 2009


Ken Pryor

Excellent post! I learned a lot from this. It's very timely for me, as I've been learning about NTFS and the MFT recently in a course I'm taking. Keep up the good work and thanks!


You're welcome Ken ! Let me know if I can help you with other things regarding NTFS and MFT, Mark


31h is not a marker for a cluster run. This number describes the cluster run, and can be other values than 31.


Thought I would expand on Troy's post. 31h is not a marker for the cluster run. However, if you go to offset 32(decimal)within the $DATA attribute and convert the two byte value, this will give you the decimal offset to the cluster run in decimal. So, in the above example the value at offset 32 is 0x40 00. Convert this (little endian of course) to decimal and you get 64. Go to byte 64 from the beginning of the $DATA attribute and you have the first part of the cluster run.

Hyip Monitor

Very nice article thanks for sharing this info.

The comments to this entry are closed.