Sysinternals Homepage
Forum Home Forum Home > Windows Discussions > Internals
  New Posts New Posts RSS Feed: NTFS - file deletion
  FAQ FAQ  Forum Search   Calendar   Register Register  Login Login

NTFS - file deletion
 Post Reply Post Reply
Author
Message Reverse Sort Order
  Share Topic Share Topic  Topic Search Topic Search  Topic Options Topic Options
vrtule View Drop Down
Senior Member
Senior Member
Avatar

Joined: 22 September 2006
Location: Czech Republic
Online Status: Offline
Posts: 121 		Post Options Post Options   Quote vrtule Quote  Post ReplyReply Direct Link To This Post Topic: NTFS - file deletion
    Posted: 03 September 2007 at 6:45am
Thank you very much
Back to Top
Deepak View Drop Down
Groupie
Groupie
Avatar

Joined: 06 May 2007
Location: India
Online Status: Offline
Posts: 46 		Post Options Post Options   Quote Deepak Quote  Post ReplyReply Direct Link To This Post Posted: 03 September 2007 at 5:22am
Here is the structure of MFT entry
 
 
typedef struct MftEntry
{
   char         Signature [4];          // Magic "FILE"
   ushort       FixupOffset;
   ushort       FixupSize;
   ulong
   ulong
   ushort       Sequence;               // Sequence number in MFT
   ushort       HardLinks;              // Hard link count
   ushort       AttribOffset;           // Offset of attributes
   ushort       Flags;
   ulong        RecLength;              // True record size
   ulong        AllLength;              // Allocated record size
   cluster      BaseMftRec;             // Base entry of this entry or 0
   ushort       MinIdentificator;
   ushort       FixupPattern;
   ushort       FixupList [];
};
Calm down dear! It is just a recession
Back to Top
Deepak View Drop Down
Groupie
Groupie
Avatar

Joined: 06 May 2007
Location: India
Online Status: Offline
Posts: 46 		Post Options Post Options   Quote Deepak Quote  Post ReplyReply Direct Link To This Post Posted: 03 September 2007 at 5:18am
Oth Bit of Flag field of MFT Entry will be turned off indicating the Record is no longer in use....
Hence can be reused for creating MFT of other new files/directoies...
Calm down dear! It is just a recession
Back to Top
vrtule View Drop Down
Senior Member
Senior Member
Avatar

Joined: 22 September 2006
Location: Czech Republic
Online Status: Offline
Posts: 121 		Post Options Post Options   Quote vrtule Quote  Post ReplyReply Direct Link To This Post Posted: 31 August 2007 at 5:51am
Hello,
 
I have one question... what will happen when the file (directory) is deleted in volume with NTFS filesystem? I am interested in the changes in MFT record of that file.
Back to Top
 Post Reply Post Reply

Forum Jump Forum Permissions View Drop Down