eb 52 90 2d 46 56 45 26 46 53 2d

eb 58 90 2d 46 56 45 26 46 53 2d

The MFT entry header (FILE_RECORD_SEGMENT_HEADER) is 42 or 48 bytes of size and consists of:

The base record file reference indicates if the MFT entry is used to store additional attributes for another MFT entry, e.g. for attribute list attributes.

According to [MSDN] the sequence number is incremented each time that a file record segment is freed; it is 0 if the segment is not used.

[MSDN] states that the update sequence array must end before the last USHORT value in the first sector. It also claims the update sequence array size value contains the number of bytes. It seems to be more likely to the number of words.

The "BAAD" signature presumably indicates a bad MFT entry. [RUSSON05] states that during chkdsk, if NTFS finds a multi-sector item where the multi-sector header does not match the values at the end of the sector, it marks the item as "BAAD" and fill it with 0-byte values except for a fix-up value at the end of the first sector. The "BAAD" signature has been seen to be used on Windows NT4 and XP.

In NT4 (version 1.2) the MFT entry is 42 bytes in size and the fix-up values are stored at offset 42. This is likely where the field name wfixupPattern originates from.

The MFT attribute header (ATTRIBUTE_RECORD_HEADER) is 16 bytes of size and consists of:

Notes

type					: 0x000000a0 ($INDEX_ALLOCATION)
size					: 458832 (0x70050)
non resident flag			: 0x01
name size				: 4
name offset				: 64
data flags				: 0x0000

identifier				: 4

MFT attribute data flags

The resident MFT attribute data is present when the non-resident flag is not set (0). The resident data is 8 bytes in size and consists of:

Notes

type                                 : 0x00000090 ($INDEX_ROOT)
size                                 : 88
non resident flag                    : 0x00
name size                            : 4
name offset                          : 24
data flags                           : 0x0001
        Is compressed

The non-resident MFT attribute data is present when the non-resident flag is set (1). The non-resident data is 48 or 56 bytes in size and consists of:

The attribute name is variable of size and consists of:

The data runs are stored in a variable size (data) runlist. This runlist consists of runlist elements.

A runlist element is variable of size and consists of:

The data run cluster block number is a singed value, where the MSB is the singed bit, e.g. if the data run cluster block contains \'dbc8' it corresponds to the 64-bit value 0xffffffffffffdbc8.

The first data run offset contains the absolute cluster block number where successive data run offsets are relative to the last data run offset.

The last runlist element is an empty value size tuple; in other words a 0 byte.

Does a data run with a "number of cluster blocks value size" of 0 represent this as well?

The MFT attribute data flag (ATTRIBUTE_FLAG_SPARSE) indicates if the data stream is sparse or not.

A sparse data run has a "cluster block number value size" 0, representing there is no offset (cluster block number). A sparse data run should be filled with 0-byte values.

TODO: what about data runs with a cluster block number value size of 0 but without the necessary flags? Seen in ADS: $BadClus:$Bad. Assuming for now the data run is sparse.

The MFT attribute data flags (0x00ff) indicate if the data stream is compressed or not. The currently known value for LZNT1 compression is 1.

The data is stored in compression unit blocks. A compression unit typically consists of 16 cluster blocks. However the actual value is stored in the non-resident MFT attribute. See Compression for more information on how to determine which data runs store the compressed and which do not.

The compression is specified on a pre attribute basis. Where an attribute chain can consists of attribute with compressed and uncompressed attribute data. Note that it is unknown if mixing compressed and uncompressed attributes is supported by the Windows implementation.

According to [RUSSON05] the size of the runlist is rounded up to the next multitude of 4 bytes. The size of the trailing data can be even larger than 3 and are not always zero-bytes.

See [CARRIER05] and/or [RUSSON05] for examples on reading the runlist.

The attribute list entry consists of:

• the attribute list entry header

• the the attribute name

• alignment padding (8-byte alignment), can contain remnant data

The attribute list entry header

Attribute name

Basically the conversion from a long name to short name boils down to the approach mentioned below. Note that it differs from the approach mentioned in [RUSSON05], in regard of the third case to make the short name unique.

In the long name:

• ignore Unicode characters beyond the first 8-bit (extended ASCII)

• ignore control characters and spaces (character < 0x20)

• ignore non-allowed characters (" * + , / : ; < = > ? \)

• ignore dots except the last one, which is used for the extension

• make all letters upper case

Additional observations:

• [ or ] are replaced by an underscore (_)

Make the name unique:

1. use the characters 1 to 6 add ~1 and if the long name has an extension add the a dot and its first 3 letters

2. if the name already exists try \~2 up to ~9

3. if the name already exists use some 16-bit hexadecimal value for characters 3 to 6 with ~1

[MSDN] Generates the next four letters of the short file name by mathematically manipulating the remaining letters of the long file name.

Note: behavior dependent on fsutil?

case 1: "Program Files" becomes "PROGRA~1" or " ~PLAYMOVIE.REG" becomes "~PLAYM~1.REG"

case 2: "Program Data", in the same directory as "Program Files", becomes "PROGRA~2"

case 3: "x86_microsoft-windows-r..ry-editor.resources_31bf3856ad364e35_6.0.6000.16386_en-us_f89a7b0005d42fd4", in a directory with a lot of filenames starting with "x86_microsoft", becomes "X8FCA6~1.163"

00000000: 08 00 00 00 18 00 00 00                            ........

00000000: 18 00 00 00 00 09 04 00  2e 55 4e 49 58 41 54 54   ........ .UNIXATT
00000010: 52 00 b6 01 00 00 03 87                            R.......

The index root header is 16 bytes of size and consists of:

The index entry header is 32 bytes of size and consists of:

The MFT attribute name of the directory entry index is: $I30.

The directory entry index value contains a file name attribute in the index key data. See section: The file name attribute.

The index value data seems to contain remnant data.

Index values with a single name use either the POSIX or DOS_WINDOWS name space?

A hard link to a file in the same directory will also have a separate index value.

Does the hard link always has POSIX name space?

The MFT attribute name of the security descriptor hash index is: $SDH. It appears to only to be used by the $Secure metadata file.

See section: The security descriptor hash index value

The MFT attribute name of the security descriptor identifier index is: $SII. It appears to only to be used by the $Secure metadata file.

See section: The security descriptor identifier index value

number of chunk offsets = uncompressed size / compression unit size

Predefined reparse point tag values according to [MSDN]:

single-instance storage (SIS): An NTFS feature that implements links with the semantics of copies for files stored on an NTFSvolume. SIS uses copy-on-close to implement the copy semantics of its links.

00000010: 5c 00 3f 00 3f 00 02 00  43 00 3a 00 5c 00 55 00   \.?.?... C.:.\.U.
00000020: 73 00 65 00 72 00 73 00  5c 00 74 00 65 00 73 00   s.e.r.s. \.t.e.s.
00000030: 74 00 5c 00 44 00 6f 00  63 00 75 00 6d 00 65 00   t.\.D.o. c.u.m.e.
00000040: 6e 00 74 00 73 00 00 00                            n.t.s...

For more information about LZXPRESS Huffman see: LIBFWNT]

00000000  00 00 00 00 13 00 00 00  00 10 00 00 01 00 00 00  |................|
00000010  10 00 00 00 88 00 00 00  88 00 00 00 01 00 00 00  |................|
00000020  20 00 38 00 00 00 00 00  60 00 10 00 01 00 00 00  | .8.....`.......|

OBJECT_ID: 43ecee59-e2b3-11dc-ad7e-001c2582598f of root directory

00000030  59 ee ec 43 b3 e2 dc 11  ad 7e 00 1c 25 82 59 8f  |Y..C.....~..%.Y.|

MFT file reference
OBJECT_ID: e6a67b60-c0b5-4b53-b8fe-94470c83df89 of $Volume

00000040  05 00 00 00 00 00 05 00  60 7b a6 e6 b5 c0 53 4b  |........`{....SK|
00000050  b8 fe 94 47 0c 83 df 89  59 ee ec 43 b3 e2 dc 11  |...G....Y..C....|
00000060  ad 7e 00 1c 25 82 59 8f  00 00 00 00 00 00 00 00  |.~..%.Y.........|
00000070  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000080  00 00 00 00 00 00 00 00  18 00 00 00 03 00 00 00  |................|
00000090  01 00 00 00 00 00 00 00                           |........|

LFS_RECORD_HEADER {

    //
    //  The following field is the size of data area for this record.  The
    //  log record header will be padded if necessary to fill to a 64-bit
    //  boundary, so the client data will begin on a 64-bit boundary to
    //  insure that all of his data is 64-bit aligned.  The below value
    //  has not been padded to 64 bits however.
    //

    ULONG ClientDataLength;

    //
    //  Client ID.  This identifies the owner of this log record.  The owner
    //  is uniquely identified by his offset in the client array and the
    //  sequence number associated with that client record.
    //

    LFS_CLIENT_ID ClientId;

    //
    //  This the Log Record type.  This could be a commit protocol record,
    //  a client restart area or a client update record.
    //

    LFS_RECORD_TYPE RecordType;

    //
    //  Transaction ID.  This is used externally by a client (Transaction
    //  Manager) to group log file entries.
    //

    TRANSACTION_ID TransactionId;

    //
    //  Log record flags.
    //

    USHORT Flags;

    //
    //  Alignment field.
    //

    USHORT AlignWord;

USN change journal entry version 2

USN change journal entry version 3

00000000  e9 00 00 00 8c 00 00 00  31 53 50 53 53 f1 ef fc  |........1SPSS...|
00000010  39 e8 f3 4c a9 e7 ea 22  83 20 94 b8 25 00 00 00  |9..L...". ..%...|
00000020  6f 00 00 00 00 1f 10 00  00 01 00 00 00 08 00 00  |o...............|
00000030  00 50 00 72 00 69 00 76  00 61 00 74 00 65 00 00  |.P.r.i.v.a.t.e..|
00000040  00 25 00 00 00 6c 00 00  00 00 1f 00 00 00 09 00  |.%...l..........|
00000050  00 00 53 00 6b 00 79 00  44 00 72 00 69 00 76 00  |..S.k.y.D.r.i.v.|
00000060  65 00 00 00 00 00 11 00  00 00 6d 00 00 00 00 13  |e.........m.....|
00000070  00 00 00 00 0d 04 00 15  00 00 00 6e 00 00 00 00  |...........n....|
00000080  15 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
00000090  59 00 00 00 31 53 50 53  d6 b9 f9 b2 c4 fe d5 4d  |Y...1SPS.......M|
000000a0  94 d7 89 57 48 8c 80 7b  3d 00 00 00 03 00 00 00  |...WH..{=.......|
000000b0  00 1f 00 00 00 15 00 00  00 37 00 46 00 30 00 39  |.........7.F.0.9|
000000c0  00 35 00 31 00 34 00 39  00 30 00 32 00 37 00 38  |.5.1.4.9.0.2.7.8|
000000d0  00 34 00 38 00 45 00 44  00 21 00 31 00 30 00 33  |.4.8.E.D.!.1.0.3|
000000e0  00 00 00 00 00 00 00 00  00 00 00 00 00           |.............|
000000ed

00000000  5b 5a 6f 6e 65 54 72 61  6e 73 66 65 72 5d 0d 0a  |[ZoneTransfer]..|
00000010  5a 6f 6e 65 49 64 3d 33  0d 0a                    |ZoneId=3..|
0000001a

The $Repair:$Config data streams contains:

TODO

The $Tops default (unnamed) data streams contains:

TODO

The $Tops:$T data streams contains the file data that is partially overwritten by a transaction. It consists of multiple pending transaction XML-documents.

Note that the start of each sector contains 0x0001, is this a value indication the sector is empty? Or are there fix-up values stored somewhere else?

A pending transaction XML-document starts with an UTF-8 byte-order-mark. Is roughly contains the following data:

$Extend\$RmMetadata\$TxfLog\TxfLog.blf

$Extend\$RmMetadata\$TxfLog\TxfLogContainer00000000000000000001
$Extend\$RmMetadata\$TxfLog\TxfLogContainer00000000000000000002

parent file reference             : 9711-3
creation time                     : Oct 04, 2014 14:44:40.703125000 UTC
modification time                 : Oct 04, 2014 14:48:37.562500000 UTC
entry modification time           : Oct 04, 2014 14:48:37.750000000 UTC
access time                       : Oct 04, 2014 14:48:37.562500000 UTC
allocated file size               : 40960
file size                         : 38926
file attribute flags              : 0x00000020
        Should be archived (FILE_ATTRIBUTE_ARCHIVE)

extended data                     : 0x00000000
name size                         : 36
name space                        : 1 (Windows)

name data:
00000040:       2e 00 63 dc 79 dc  67 dc 30 00 30 00 32 00     ..c.y. g.0.0.2.
00000050: 65 00 30 00 30 00 30 00  30 00 30 00 30 00 30 00   e.0.0.0. 0.0.0.0.
00000060: 31 00 61 00 39 00 34 00  66 00 62 00 36 00 30 00   1.a.9.4. f.b.6.0.
00000070: 62 00 35 00 30 00 37 00  66 00 30 00 36 00 38 00   b.5.0.7. f.0.6.8.
00000080: 30 00 66 00 39 00 36 00  38 00                     0.f.9.6. 8.

MFT entry: 220 information:
	Is allocated			: true
	File reference			: 220-59
	Base record file reference	: Not set (0)
	Journal sequence number		: 51876429013
	Number of attributes		: 5

Attribute: 1
	Type				: $STANDARD_INFORMATION (0x00000010)
	Creation time			: Jun 05, 2019 06:56:26.032730300 UTC
	Modification time		: Oct 05, 2019 06:56:04.150940700 UTC
	Access time			: Oct 05, 2019 06:56:04.150940700 UTC
	Entry modification time		: Oct 05, 2019 06:56:04.150940700 UTC
	Owner identifier		: 0
	Security descriptor identifier	: 5862
	Update sequence number		: 11553149976
	File attribute flags		: 0x00000820
		Should be archived (FILE_ATTRIBUTE_ARCHIVE)
		Is compressed (FILE_ATTRIBUTE_COMPRESSED)

Attribute: 2
	Type				: $ATTRIBUTE_LIST (0x00000020)

Attribute: 3
	Type				: $FILE_NAME (0x00000030)
	Parent file reference		: 33996-57
	Creation time			: Jun 05, 2019 06:56:26.032730300 UTC
	Modification time		: Oct 05, 2019 06:56:03.510061800 UTC
	Access time			: Oct 05, 2019 06:56:03.510061800 UTC
	Entry modification time		: Oct 05, 2019 06:56:03.510061800 UTC
	File attribute flags		: 0x00000020
		Should be archived (FILE_ATTRIBUTE_ARCHIVE)
	Namespace			: POSIX (0)
	Name				: setupapi.dev.20191005_085603.log

Attribute: 4
	Type				: $DATA (0x00000080)
	Data VCN range			: 513 - 1103
	Data flags			: 0x0000

Attribute: 5
	Type				: $DATA (0x00000080)
	Data VCN range			: 0 - 512
	Data size			: 4487594 bytes
	Data flags			: 0x0001

File entry:
	Path				: \ProgramData\McAfee\Common Framework\Task\5.ini
	File reference			: 51106-400
	Name				: 5.ini
	Parent file reference		: 65804-10
	Size				: 723
	Creation time			: Sep 16, 2011 20:47:54.561041200 UTC
	Modification time		: Apr 07, 2012 21:07:02.684060000 UTC
	Access time			: Apr 07, 2012 21:07:02.652810200 UTC
	Entry modification time		: Apr 07, 2012 21:07:02.684060000 UTC
	File attribute flags		: 0x00002020
		Should be archived (FILE_ATTRIBUTE_ARCHIVE)
		Content should not be indexed (FILE_ATTRIBUTE_NOT_CONTENT_INDEXED)

MFT entry: 51106 information:
	Is allocated			: true
	File reference			: 51106-496
	Base record file reference	: Not set (0)
	Journal sequence number		: 0
	Number of attributes		: 3

Attribute: 1
	Type				: $STANDARD_INFORMATION (0x00000010)
	Creation time			: Sep 16, 2011 20:47:54.561041200 UTC
	Modification time		: Apr 07, 2012 21:07:02.684060000 UTC
	Access time			: Apr 07, 2012 21:07:02.652810200 UTC
	Entry modification time		: Apr 07, 2012 21:07:02.684060000 UTC
	Owner identifier		: 0
	Security descriptor identifier	: 1368
	Update sequence number		: 1947271600
	File attribute flags		: 0x00002020
		Should be archived (FILE_ATTRIBUTE_ARCHIVE)
		Content should not be indexed (FILE_ATTRIBUTE_NOT_CONTENT_INDEXED)

Attribute: 2
	Type				: $FILE_NAME (0x00000030)
	Parent file reference		: 65804-10
	Creation time			: Sep 16, 2011 20:47:54.561041200 UTC
	Modification time		: Apr 07, 2012 21:07:02.652810200 UTC
	Access time			: Apr 07, 2012 21:07:02.652810200 UTC
	Entry modification time		: Apr 07, 2012 21:07:02.652810200 UTC
	File attribute flags		: 0x00002020
		Should be archived (FILE_ATTRIBUTE_ARCHIVE)
		Content should not be indexed (FILE_ATTRIBUTE_NOT_CONTENT_INDEXED)
	Namespace			: DOS and Windows (3)
	Name				: 1.ini

Attribute: 3
	Type				: $DATA (0x00000080)
	Data size			: 723 bytes
	Data flags			: 0x0000

reading data run: 60.
data run:
00000000: 11 01 01                                           ...

value sizes                               : 1, 1
number of cluster blocks                  : 1 (size: 4096)
cluster block number                      : 687143 (1) (offset: 0xa7c27000)

reading data run: 61.
data run:
00000000: 01 0f                                              ..

value sizes                               : 1, 0
number of cluster blocks                  : 15 (size: 61440)
cluster block number                      : 0 (0) (offset: 0x00000000)
        Is sparse

a7c27000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
...
a7c27ff0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

compressed data offset                    : 0 (0x00000000)
compression chunk header                  : 0x0000
compressed chunk size                     : 1
signature value                           : 0
is compressed flag                        : 0

reading data run: 0.
data run:
00000000: 31 08 48 d8 01                                     1.H..

value sizes                               : 1, 3
number of cluster blocks                  : 8 (size: 32768)
cluster block number                      : 120904 (120904) (offset: 0x1d848000)

reading data run: 1.
data run:
00000000: 01 08                                              ..

value sizes                               : 1, 0
number of cluster blocks                  : 8 (size: 32768)
cluster block number                      : 0 (0) (offset: 0x00000000)
        Is sparse

1d848000  bd b7 50 44 46 50 00 01  00 01 00 40 e0 00 07 0b  |..PDFP.....@....|
...
1d84c000  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
*
1d84fff0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|

compressed data offset                    : 16384 (0x00004000)
compression flag byte                     : 0x00

fsutil fsinfo volumeinfo C:

FILE_CASE_PRESERVED_NAMES
0x00000002

The specified volume supports preserved case of file names when it places a name on disk.

FILE_CASE_SENSITIVE_SEARCH
0x00000001

The specified volume supports case-sensitive file names.

FILE_FILE_COMPRESSION
0x00000010

The specified volume supports file-based compression.

FILE_NAMED_STREAMS
0x00040000

The specified volume supports named streams.

FILE_PERSISTENT_ACLS
0x00000008

The specified volume preserves and enforces access control lists (ACL). For example, the NTFS file system preserves and enforces ACLs, and the FAT file system does not.

FILE_READ_ONLY_VOLUME
0x00080000

The specified volume is read-only.

    Windows 2000:  This value is not supported.

FILE_SEQUENTIAL_WRITE_ONCE
0x00100000

The specified volume supports a single sequential write.

    Windows 2000:  This value is not supported.

FILE_SUPPORTS_ENCRYPTION
0x00020000

The specified volume supports the Encrypted File System (EFS). For more information, see File Encryption.

FILE_SUPPORTS_EXTENDED_ATTRIBUTES
0x00800000

The specified volume supports extended attributes. An extended attribute is a piece of application-specific metadata that an application can associate with a file and is not part of the file's data.

    Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP/2000:  This value is not supported until Windows Server 2008 R2 and Windows 7.

FILE_SUPPORTS_HARD_LINKS
0x00400000

The specified volume supports hard links. For more information, see Hard Links and Junctions.

    Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP/2000:  This value is not supported until Windows Server 2008 R2 and Windows 7.

FILE_SUPPORTS_OBJECT_IDS
0x00010000

The specified volume supports object identifiers.

FILE_SUPPORTS_OPEN_BY_FILE_ID
0x01000000

The file system supports open by FileID. For more information, see FILE_ID_BOTH_DIR_INFO.

    Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP/2000:  This value is not supported until Windows Server 2008 R2 and Windows 7.

FILE_SUPPORTS_REPARSE_POINTS
0x00000080

The specified volume supports re-parse points.

FILE_SUPPORTS_SPARSE_FILES
0x00000040

The specified volume supports sparse files.

FILE_SUPPORTS_TRANSACTIONS
0x00200000

The specified volume supports transactions. For more information, see About KTM.

    Windows 2000:  This value is not supported.

FILE_SUPPORTS_USN_JOURNAL
0x02000000

The specified volume supports update sequence number (USN) journals. For more information, see Change Journal Records.

    Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP/2000:  This value is not supported until Windows Server 2008 R2 and Windows 7.

FILE_UNICODE_ON_DISK
0x00000004

The specified volume supports Unicode in file names as they appear on disk.

FILE_VOLUME_IS_COMPRESSED
0x00008000

The specified volume is a compressed volume, for example, a DoubleSpace volume.

FILE_VOLUME_QUOTAS
0x00000020

The specified volume supports disk quotas.