2

how does the computer retrive a particular entry in the MFT table for a file or directory? I read through many documents which describe the structure of NTFS and MFT, but i fail to understand say i have a file in E:\documents\test.txt, how can i identify it's entry in the MFT index. Is it sequential?

Roman R.
  • 68,205
  • 6
  • 94
  • 158
Anirudh Goel
  • 4,571
  • 19
  • 79
  • 109

2 Answers2

0

NTFS uses B+trees internally for the file indexes. A B+tree is a binary tree. This article is as good an explanation as any w/r to how B+trees work.

Christopher
  • 8,815
  • 2
  • 32
  • 41
  • thanks, so if i go about implementing enumerating all files and directory in a folder, there is no place i can start from? I will have to iterate through all entries? like in FAT32 where there is an entry for Root, isn't there such entry poing in MFT – Anirudh Goel Jul 17 '09 at 13:13
  • NTFS uses B trees, not B+ trees. FYI. – jrtipton Aug 28 '10 at 15:30
0

I implemented a readonly ntfs library (UMFS) in the distant past.

The root directory of a volume is always stored in mft record 5. Once you can read the data stream for the directory, you can walk the b+tree (as @Christopher said) stored in the stream, finding the subdirectory or file you are interested in.

Trevor Harrison
  • 1,744
  • 1
  • 14
  • 20