Sign up ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Say I receive the following output from chkdsk:

Deleted invalid filename Flatland: A Romance of Many Dimensions (88216) in directory 403737.

Is there any way to find the name(s) of this directory with the id 403737, and its current location? (and a related question, what is the proper name for this "ntfs id" number?)

share|improve this question
Sounds like an inode number. In POSIX you cannot look up a file by inode number to find the directory entry/entries that point to it. You can only look up a directory entry to find its inode number. MS Windows is likely similar in this respect. – Celada Oct 23 '12 at 13:47
I would expect chkdsk to report the file reference numbers, but I'd also expect them to be much bigger so I'm not sure. Try fsutil file queryfilenamebyid c:\ 403737 – Harry Johnston Oct 23 '12 at 19:37

2 Answers 2

Assuming those are MFT Record numbers, you could use a MS tool named nfi to dump ntfs information and then a utility like grep or awk (need to be installed / not native win) to filter out only results you're interested in.
nfi can be downloaded as part of OEM tools

nfi c: |awk "/File 72\r/{c=4;{print}next}c-->0" produces following output on my laptop:

File 72
$FILE_NAME (resident)
$INDEX_ROOT $I30 (resident)

Please be aware that this is 'brute force' linear search so it may take long time to find the entry with high number.

share|improve this answer
I'll have to try that. Do you know of any Linux tools that do the same job as nfi? – IQAndreas Jan 10 '13 at 11:46

for those who might google this up in the future: I just found out that in Linux, one can do

ntfsls -iaR /dev/sdb1

-i = show inode (i.e., MFT record no.), -a = display all (no idea what it does but it can't harm), -R = recurse into subdirectories, /dev/sdb1 is the partition device file or an NTFS image file.

This produces a nice long greppable list of files along with their MFT record numbers.

ntfsls is in the ntfsprogs package (atleast on Fedora.)

I wanted to post this under the comment above (where @iqandreas asked specifically about Linux) but the site wouldn't let me

share|improve this answer
I haven't tested the command yet, but if it works, there is no need to have this as a comment: it's then a fully fledged answer! :) – IQAndreas Apr 11 at 19:43

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.