Quantcast
Channel: Reading MFT
Viewing all articles
Browse latest Browse all 444

Reading MFT

$
0
0

Also, I know there is an api to get a filename given a 64-bit file reference number.  I've used it in C++ before.  But for the life of me, I can't find it today.  I really want to get rid of the memory and effort of keeping the list of folders on the volume up-to-date.

I know I can code for the one problem area.

Which is if someone deletes a directory, all of the files and the directory are deleted and usn deleted entries are recorded in the usn journal.  But by the time you are asked to process these entries, the files' parent frn in the deleted directory will point to a non-existant folder -- its been deleted!.  So you have to gather all of the deleted directories into a list while you are processing the usn journal entries and resolve these at the end into fully qualified paths.

So, does anyone know/remember how to get file name of a filesystem object given the frn?


StCroixSkipper

Viewing all articles
Browse latest Browse all 444

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>