I somehow managed to delete the root directory in a NTFS volume (I know... don't ask).
ntfsundelete on Linux I can find a lot of inodes I can recover 100%. The problem is that I end up with 15,000 files named inode.xxx.
But I've just realized that most of these files were not in the root directory, but in a subfolder. And somewhere in the disk there's a directory structure that maps filenames to inodes. Since it wasn't the root, I'm assuming the table is still there? Or is everything stored in the MFT?
If I could somehow get the directory structure as a file, I can write a parser that will give me back the mapping between filenames and inodes. The question is, does this work in NTFS? I haven't done low level filesystem manipulation since FAT, where I know this would work, but no idea in NTFS.