Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 2 down vote favorite
2

Say I receive the following output from chkdsk:

Deleted invalid filename Flatland: A Romance of Many Dimensions (88216) in directory 403737.

Is there any way to find the name(s) of this directory with the id 403737, and its current location? (and a related question, what is the proper name for this "ntfs id" number?)

share|improve this question
Sounds like an inode number. In POSIX you cannot look up a file by inode number to find the directory entry/entries that point to it. You can only look up a directory entry to find its inode number. MS Windows is likely similar in this respect. – Celada Oct 23 '12 at 13:47
I would expect chkdsk to report the file reference numbers, but I'd also expect them to be much bigger so I'm not sure. Try fsutil file queryfilenamebyid c:\ 403737 – Harry Johnston Oct 23 '12 at 19:37

1 Answer

up vote 1 down vote

Assuming those are MFT Record numbers, you could use a MS tool named nfi to dump ntfs information and then a utility like grep or awk (need to be installed / not native win) to filter out only results you're interested in.
nfi can be downloaded as part of OEM tools

nfi c: |awk "/File 72\r/{c=4;{print}next}c-->0" produces following output on my laptop:

File 72
\WINDOWS\Temp
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$INDEX_ROOT $I30 (resident)

Please be aware that this is 'brute force' linear search so it may take long time to find the entry with high number.

share|improve this answer
I'll have to try that. Do you know of any Linux tools that do the same job as nfi? – IQAndreas Jan 10 at 11:46

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.