Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Say I receive the following output from chkdsk:

Deleted invalid filename Flatland: A Romance of Many Dimensions (88216) in directory 403737.

Is there any way to find the name(s) of this directory with the id 403737, and its current location? (and a related question, what is the proper name for this "ntfs id" number?)

share|improve this question
    
Sounds like an inode number. In POSIX you cannot look up a file by inode number to find the directory entry/entries that point to it. You can only look up a directory entry to find its inode number. MS Windows is likely similar in this respect. – Celada Oct 23 '12 at 13:47
    
I would expect chkdsk to report the file reference numbers, but I'd also expect them to be much bigger so I'm not sure. Try fsutil file queryfilenamebyid c:\ 403737 – Harry Johnston Oct 23 '12 at 19:37

Assuming those are MFT Record numbers, you could use a MS tool named nfi to dump ntfs information and then a utility like grep or awk (need to be installed / not native win) to filter out only results you're interested in.
nfi can be downloaded as part of OEM tools

nfi c: |awk "/File 72\r/{c=4;{print}next}c-->0" produces following output on my laptop:

File 72
\WINDOWS\Temp
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$INDEX_ROOT $I30 (resident)

Please be aware that this is 'brute force' linear search so it may take long time to find the entry with high number.

share|improve this answer
    
I'll have to try that. Do you know of any Linux tools that do the same job as nfi? – IQAndreas Jan 10 '13 at 11:46

for those who might google this up in the future: I just found out that in Linux, one can do

ntfsls -iaR /dev/sdb1

-i = show inode (i.e., MFT record no.), -a = display all (no idea what it does but it can't harm), -R = recurse into subdirectories, /dev/sdb1 is the partition device file or an NTFS image file.

This produces a nice long greppable list of files along with their MFT record numbers.

ntfsls is in the ntfsprogs package (atleast on Fedora.)

I wanted to post this under the comment above (where @iqandreas asked specifically about Linux) but the site wouldn't let me

share|improve this answer
    
I haven't tested the command yet, but if it works, there is no need to have this as a comment: it's then a fully fledged answer! :) – IQAndreas Apr 11 '15 at 19:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .