3

I'm looking for a high-level method to read the MFT entries on an NTFS file system for a Seagate 1TB internal hard drive. The platform is Windows 7.

I need to fetch the filename, block size and LBA.

Is this a specialized task such that I need to write a program to do this?

  • There are a number of free disk editors that can display that information, but that would require manually selecting the data to save. – DrMoishe Pippik Apr 30 '15 at 17:05
  • I can save a file to another storage device, no problem. I'm having issues storing a complete image of the hard drive. So I want to store the file or files that use those LBAs onto another drive for safety, before I use the recovery part of the Seagate Tool. – Thomas Matthews Apr 30 '15 at 18:06
  • Macrium Refkect Free, macrium.com/reflectfree.aspx, can back up all partitions (and restore if need be). – DrMoishe Pippik May 1 '15 at 1:06
5

This information is accessible through the Defrag API. Third-party defragment tools might expose it. On recent Windows systems (8.1 works, 7 not tested) you can use fsutil to query it:

C:\>fsutil file queryextents example.txt
VCN: 0x0        Clusters: 0x2        LCN: 0x18f85e

There is also another subcommand that dumps all information for all data streams in the file:

C:\>fsutil volume filelayout example.exe

********* File 0x01390000000008dd *********
File reference number   : 0x01390000000008dd
File attributes         : 0x00000020: Archive
...
Stream                  : ::$FILE_NAME
    Attributes          : 0x00000000: *NONE*
    Flags               : 0x0000000c: Resident | No clusters allocated
    Size                : 80
    Allocated Size      : 80
Stream                  : ::$DATA (the main data stream)
    Attributes          : 0x00000000: *NONE*
    Flags               : 0x00000000: *NONE*
    Size                : 1681920
    Allocated Size      : 1683456
    Extents             : 1 Extents
                        : 1: VCN: 0 Clusters: 411 LCN: 8527618

In both commands' output, for each "extent" (a contiguous range of clusters), you get the "virtual cluster number" (offset from beginning of file), number of clusters in the extent, and the "logical cluster number" (offset from beginning of volume).

Note: Tiny files, which fit in the MFT base record, are stored ("resident") in their MFT record and will have zero extents. For those, you'll need to use other ways to dig through the MFT itself. (Also, in some cases, the file may be sparse and only have a small part allocated on disk; the rest is just assumed to be null bytes.)

The clusters are filesystem-level, so you need to convert them to block-device-level sectors; my system has 8 sectors per cluster:

C:\>fsutil fsinfo ntfsinfo c:
...
Bytes Per Sector  :               512
Bytes Per Cluster :               4096
...

C:\>set/a 0x18f85e * (4096 / 512)
13091568

C:\>set/a 0x18f85e * 4096
6702882816

This means you can open \\.\C: with HxD or such, and find beginning of file at sector 13091568 (or byte 6702882816).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.