views:

13

answers:

0

Is it possible to get file size info in MFT? I want to make use of dwRecLength, however I found it is 0 sometimes.

struct NTFS_MFT_FILE
{
    char        szSignature[4];         // Signature "FILE"
    WORD        wFixupOffset;           // offset to fixup pattern
    WORD        wFixupSize;         // Size of fixup-list +1
    LONGLONG    n64LogSeqNumber;    // log file seq number
    WORD        wSequence;          // sequence nr in MFT
    WORD        wHardLinks;         // Hard-link count
    WORD        wAttribOffset;          // Offset to seq of Attributes
    WORD        wFlags;                 // 0x01 = InUse; 0x02 = Dir
    DWORD       dwRecLength;            // Real size of the record
    DWORD       dwAllLength;            // Allocated size of the record
    LONGLONG    n64BaseMftRec;      // ptr to base MFT rec or 0
    WORD        wNextAttrID;            // Minimum Identificator +1
    WORD        wFixupPattern;      // Current fixup pattern
    WORD        wFixupList[1];
    DWORD       dwMFTRecNumber; // Number of this MFT Record
    // followed by resident and part of non-res attributes
};