I have been working on retrieving file information from MFT. I see that the MFT record has info regarding standard info, file names, data and few other attributes. I tried parsing the MFT record to get all the details that it contains. I am able to get filename, data (including data for alternate streams) for all files but I was not able to obtain the filenames for the named alternate data streams. For the purpose of testing I created a file with two named alternate streams containing data. When I parsed the MFT record corresponding to the file I was not able to identify the alternate stream names. Does that mean the alternate stream names are not stored in the MFT? Then how does some utilities such as stream.exe identify the alternate stream names?
3
-
I think this question is better suited for Stack Overflow. Quoting MSDN: "The default data stream has no name. Data streams can be enumerated using the FindFirstStreamW and FindNextStreamW functions." (Source)– and31415Aug 6, 2014 at 9:52
-
@and31415d These functions cannot be applied on disk image files without mounting. These functions don't suit my need and that is why I am trying to use the MFT.– user3226732Aug 6, 2014 at 10:24
-
If you were referring to this Streams utility, its older version included source code. The program doesn't query the MFT directly, and it calls the NtQueryInformationFile function instead. You might want to take a look at existing projects such as analyzeMFT and NTFS-3G.– and31415Aug 6, 2014 at 15:19
Add a comment
|
1 Answer
There is no file name attributes associated with an alternate data stream. That is why an alternate data stream is also sometimes referred to as a named data stream. For the normally expected single data stream for a file, such as your word document, you do not need a name for the stream because the other attributes of the $MFT have those details. Since the alternate data stream "piggybacks" on this file as a second data stream it cannot have these attributes, so the name of the stream is the first section of that stream.
http://blogs.technet.com/b/askcore/archive/2013/03/24/alternate-data-streams-in-ntfs.aspx
