Say I receive the following output from chkdsk:

Deleted invalid filename Flatland: A Romance of Many Dimensions (88216) in directory 403737.

Is there any way to find the name(s) of this directory with the id 403737, and its current location? (and a related question, what is the proper name for this "ntfs id" number?)

  • 1
    Sounds like an inode number. In POSIX you cannot look up a file by inode number to find the directory entry/entries that point to it. You can only look up a directory entry to find its inode number. MS Windows is likely similar in this respect.
    – Celada
    Commented Oct 23, 2012 at 13:47
  • 2
    I would expect chkdsk to report the file reference numbers, but I'd also expect them to be much bigger so I'm not sure. Try fsutil file queryfilenamebyid c:\ 403737 Commented Oct 23, 2012 at 19:37

2 Answers 2


Assuming those are MFT Record numbers, you could use a MS tool named nfi to dump ntfs information and then a utility like grep or awk (need to be installed / not native win) to filter out only results you're interested in.
nfi can be downloaded as part of OEM tools

nfi c: |awk "/File 72\r/{c=4;{print}next}c-->0" produces following output on my laptop:

File 72
$FILE_NAME (resident)
$INDEX_ROOT $I30 (resident)

Please be aware that this is 'brute force' linear search so it may take long time to find the entry with high number.

  • I'll have to try that. Do you know of any Linux tools that do the same job as nfi?
    – IQAndreas
    Commented Jan 10, 2013 at 11:46

for those who might google this up in the future: I just found out that in Linux, one can do

ntfsls -iaR /dev/sdb1

-i = show inode (i.e., MFT record no.), -a = display all (no idea what it does but it can't harm), -R = recurse into subdirectories, /dev/sdb1 is the partition device file or an NTFS image file.

This produces a nice long greppable list of files along with their MFT record numbers.

ntfsls is in the ntfsprogs package (atleast on Fedora.)

I wanted to post this under the comment above (where @iqandreas asked specifically about Linux) but the site wouldn't let me

  • I haven't tested the command yet, but if it works, there is no need to have this as a comment: it's then a fully fledged answer! :)
    – IQAndreas
    Commented Apr 11, 2015 at 19:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .