Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17


View 2000 MFT records

Posted on 2001-09-09
Medium Priority
Last Modified: 2007-11-27
I am looking for any applications that can view MFT records in a Windows 2000 NTFS drive. I have seen Sysinternals NTFSinfo to see detailed information about NTFS volumes, but I was hoping to find something to view info on the records of the MFT.
Question by:vmaxx
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
  • 2
  • +1
LVL 25

Accepted Solution

dew_associates earned 800 total points
ID: 6469629
Just use Microsoft's DISKEDIT utility

You might not know it, but there is a disk editor utility for Windows NT in the style of the venerable Norton Disk Edit for DOS. What?s more, the utility understands FAT and NTFS and it?s free. Microsoft apparently shipped DiskEdit accidentally, a tool that must be an internal debugging tool for their file systems teams, on the Windows NT 4.0 Service Pack 4 CD. DiskEdit has a peculiar interface that would take a small manual to document, but I?m going to get you started with a simple walkthrough. I?ll focus on using DiskEdit to unravel the NTFS file system format, since DiskEdit is the only publicly available tool I know of that understands NTFS.

First you need to get DiskEdit from the Service Pack 4 (SP4) CD-ROM. Simply copy it from the \i386 directory to your hard disk. If you want to use DiskEdit under Win2K you?ll need to create a private directory for it and copy the following DLLs from a SP4 winnt\system32 directory (or SP4 CD) to the same directory as DiskEdit:


Now you can start DiskEdit.

For this walkthrough create a directory called TEMP at the root of a NTFS drive and create a file called OUT.TXT in that directory by typing the following command in a command-prompt window with TEMP as the current directory: echo hello > out.txt. Select the drive with your new OUT.TXT file in DiskEdit by choosing the File|Open menu item and entering the drive?s letter in the Volume Name field of the resulting dialog box. Make sure you include the colon e.g. ?d:?. Virtually all of DiskEdit?s functionality requires that you?ve opened a drive.

We?re going to locate the OUT.TXT file by starting at the root directory of the NTFS drive. Select the menu entry Read|NTFS File Record to open a dialog box that lets you view any MFT record entry just by entering its number.  The first 16 MFT record entries of every NTFS drive are reserved and correspond to pre-defined NTFS metadata files. Here are the number assignments (note that DiskEdit interprets all input as hexadecimal):

0: $MFT - MFT
1: $MFTMirr - MFT Mirror (a copy of the first 4 entries of the MFT)
2: $LogFile - NTFS LogFile
3: $Volume - volume information file
4: $AttrDef - the attribute definition file
5: . - the root directory
6: $Bitmap - the volume allocation bitmap file
7: $Boot - the boot sector
8: $BadClus - the bad cluster database file
9: $Secure - new to SP4, the security attribute database
A: $UpCase - the lower-to-upper case mapping file
B: $Extend - new to Win2K, the directory that contains the reparse, object ID, and quota metadata files C-F: Unused as of NTFS v5.0 (Win2K)

Go ahead and look at some of these MFT entries. You?ll start to notice a common theme: they all consist of attributes like $INDEX_ROOT, $FILE_NAME, and $DATA. It?s in attributes where data specific to a file is stored. When attribute data is small NTFS stores the data within the file?s MFT record as ?resident? data, and when the data is large NTFS stores the data external to the record in clusters on disk as ?non-resident? data.

Now enter ?5? as the file number and you?ll be viewing the root directory?s file. We?re going to look at the files and directories that are in the root directory by viewing the directory?s $INDEX_ALLOCATION attribute, an attribute specific to directories that records a directory?s contents. To do so select the Read|NTFS Attribute menu entry, which opens another dialog box. DiskEdit is sensitive to case so enter the following precisely as I?ve listed it:

Base Frs Number: 5

Base Frs (Base File Record Segment) is another name for MFT number. You enter to 5 to specify that you want to read an attribute from the root directory.


This indicates to DiskEdit that you want to read the directory?s content data. I recommend using the pull-down menu to chose the attribute you want since DiskEdit is very picky about the way the attribute type is entered.

Attribute Name: $I30

If you view the $INDEX_ALLOCATION attribute of the root directory you?ll see that ?$I30? is listed as its name in its ?Type code, name? line, so that?s what you enter as the attribute name.

Press OK and you?ll see a hexadecimal dump of the attribute?s contents. We want to see something more intelligible so select the View|NTFS Index Buffer menu entry. You?ll be presented with the listing of the directory?s contents. Scroll through the listing until you see the entry that has the name ?TEMP?. If you don?t see it, the entry might be located in the root directory?s $INDEX_ROOT attribute, an attribute type also associated with directories, and that always has its value stored in the MFT record. Index root entries and allocation entries together form a B+ tree structure storing all of a directory?s entries. If you have to view the $INDEX_ROOT attribute just follow the same steps for viewing that attribute as you did for viewing the $INDEX_ALLOCATION attribute.  As you scroll through an index buffer you may come upon double-lines of asterisks: these designate the end of one index buffer and the beginning of the next.

Once you?ve found the TEMP directory?s entry make a note of its File Reference (FRS). Select Read|NTFS File Record and enter TEMP?s FRS. Now you?re looking at the MFT record for the TEMP directory. We want to find the OUT.TXT file, so we?ll have to look through TEMP?s contents to find it. View the $INDEX_ALLOCATION (or $INDEX_ROOT) attribute of the TEMP directory, switch to viewing the data as a NTFS Index Buffer, and locate the OUT.TXT file. Remember to enter TEMP?s FRS as the base FRS number in the attribute selection dialog. If you just created TEMP then it will only have an $INDEX_ROOT (if you mistype something you?ll get the pleasure of seeing on of DiskEdit?s empty error dialogs).

When you?ve found OUT.TXT and determined its FRS use Read|NTFS File Record to look at its MFT entry. Scroll down until you find the $DATA attribute. You?re now looking at the location of OUT.TXT?s data. Since we made a small file, the data is stored in the MFT record. If you try to view OUT.TXT?s $DATA attribute using DiskEdit you?ll see nothing, since DiskEdit doesn?t properly show resident data (one of DiskEdit?s many bugs). So, copy a largish (> 2KB) text file to \TEMP\ OUT.TXT. Now you can view the OUT.TXT data in one of two ways: you can examine the start of the data (or all of it if its contiguously stored on disk) by using Read|NTFS Cluster and specifying the first ?lcn? value you see in OUT.TXT?s $DATA attribute ?Extent List?; or you can use Read|NTFS Attribute and enter ?$DATA? as the attribute type and nothing (as in don?t type anything into that field) as the attribute name.

Extent lists describe the location of an attribute?s non-resident data. Each contiguous block of data of up to 16 clusters in length is described by one extent list entry. An extent list entry specifies a virtual cluster number (vcn), logical cluster number (lcn), and run length. A Vcn is the cluster within the file at which the data described by the entry starts. A Lcn designates the logical cluster
where the data is stored on disk, and the runlength is the number of bytes of attribute data at that location (remember, DiskEdit is showing you hexadecimal values).

I walked you through the long way of finding the OUT.TXT file?s MFT record by showing you how to scan directory contents. There?s a shortcut, however: select Crack|NTFS Path and enter TEMP\OUT.TXT. You?ll be presented with OUT.TXT?s FRS and you can use Read|NTFS File Record to go right to it.

Its highly unlikely that you?ll ever find occasion to use DiskEdit to modify data in order to get your disk out of a jam, but if you?re curious about the NTFS on-disk format (the FAT format is well-documented) this is the perfect tool for investigating it.

LVL 16

Expert Comment

ID: 6469745
Ahhhh Dew :)

Author Comment

ID: 6469846
Wow, that answer is worth a few extra points. Unfortunatly I don't have the sp4 disk and have searched MS and some of the software sites like tucows and can't find it - any idea where to snag the app?
Comprehensive Backup Solutions for Microsoft

Acronis protects the complete Microsoft technology stack: Windows Server, Windows PC, laptop and Surface data; Microsoft business applications; Microsoft Hyper-V; Azure VMs; Microsoft Windows Server 2016; Microsoft Exchange 2016 and SQL Server 2016.

LVL 16

Expert Comment

ID: 6469858
Ummm Dew is sleeping right now - but I am sure that he will provide an answer for you in the AM :))

Author Comment

ID: 6469910
Actually - I just checked the contents of sp6a and it was there as well.

LVL 25

Expert Comment

ID: 6470892
Glad I could help!

Author Comment

ID: 6471819
Could you recommend any references to learn more about this. I am tracing an ADS, I see the file names but no clue as to where the data is.

I checked Amazon for any books on this topic and found none as well as MS press. I seen an article at MS techinfo but not much detail there.

Expert Comment

ID: 7024041
My company is looking for a tool which will detect when a file is added or changed (so we can back it up via SQL Server to a remote ftp site.

There is apparently some code out there but no robust products.

Is it going to be feasible to do this in-house?

Featured Post

Hire Technology Freelancers with Gigs

Work with freelancers specializing in everything from database administration to programming, who have proven themselves as experts in their field. Hire the best, collaborate easily, pay securely, and get projects done right.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
Check out what's been happening in the Experts Exchange community.
In this video you will find out how to export Office 365 mailboxes using the built in eDiscovery tool. Bear in mind that although this method might be useful in some cases, using PST files as Office 365 backup is troublesome in a long run (more on t…
In this video, Percona Director of Solution Engineering Jon Tobin discusses the function and features of Percona Server for MongoDB. How Percona can help Percona can help you determine if Percona Server for MongoDB is the right solution for …

715 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question