Is it possible to get file size info in MFT? I want to make use of dwRecLength, however I found it is 0 sometimes.
struct NTFS_MFT_FILE
{
char szSignature[4]; // Signature "FILE"
WORD wFixupOffset; // offset to fixup pattern
WORD wFixupSize; // Size of fixup-list +1
LONGLONG n64LogSeqNumber; // log file seq number
WORD wSequence; // sequence nr in MFT
WORD wHardLinks; // Hard-link count
WORD wAttribOffset; // Offset to seq of Attributes
WORD wFlags; // 0x01 = InUse; 0x02 = Dir
DWORD dwRecLength; // Real size of the record
DWORD dwAllLength; // Allocated size of the record
LONGLONG n64BaseMftRec; // ptr to base MFT rec or 0
WORD wNextAttrID; // Minimum Identificator +1
WORD wFixupPattern; // Current fixup pattern
WORD wFixupList[1];
DWORD dwMFTRecNumber; // Number of this MFT Record
// followed by resident and part of non-res attributes
};