4

Say I receive the following output from chkdsk:

Deleted invalid filename Flatland: A Romance of Many Dimensions (88216) in directory 403737.

Is there any way to find the name(s) of this directory with the id 403737, and its current location? (and a related question, what is the proper name for this "ntfs id" number?)

Improve this question
2
  • 1
    Sounds like an inode number. In POSIX you cannot look up a file by inode number to find the directory entry/entries that point to it. You can only look up a directory entry to find its inode number. MS Windows is likely similar in this respect.
    – Celada
    Oct 23, 2012 at 13:47
  • 2
    I would expect chkdsk to report the file reference numbers, but I'd also expect them to be much bigger so I'm not sure. Try fsutil file queryfilenamebyid c:\ 403737
    – Harry Johnston
    Oct 23, 2012 at 19:37

2 Answers 2

Reset to default
6

Assuming those are MFT Record numbers, you could use a MS tool named nfi to dump ntfs information and then a utility like grep or awk (need to be installed / not native win) to filter out only results you're interested in.
nfi can be downloaded as part of OEM tools

nfi c: |awk "/File 72\r/{c=4;{print}next}c-->0" produces following output on my laptop:

File 72
\WINDOWS\Temp
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$INDEX_ROOT $I30 (resident)

Please be aware that this is 'brute force' linear search so it may take long time to find the entry with high number.

Improve this answer
1
  • I'll have to try that. Do you know of any Linux tools that do the same job as nfi?
    – IQAndreas
    Jan 10, 2013 at 11:46
1

for those who might google this up in the future: I just found out that in Linux, one can do

ntfsls -iaR /dev/sdb1

-i = show inode (i.e., MFT record no.), -a = display all (no idea what it does but it can't harm), -R = recurse into subdirectories, /dev/sdb1 is the partition device file or an NTFS image file.

This produces a nice long greppable list of files along with their MFT record numbers.

ntfsls is in the ntfsprogs package (atleast on Fedora.)

I wanted to post this under the comment above (where @iqandreas asked specifically about Linux) but the site wouldn't let me

Improve this answer
1
  • I haven't tested the command yet, but if it works, there is no need to have this as a comment: it's then a fully fledged answer! :)
    – IQAndreas
    Apr 11, 2015 at 19:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.