MFT Records

[Steve]

I need to rebuild a corrupted MFT entry (it's a directory within a directory)
anyone got any good links to a byte for byte breakdown of how MFT record entries are structured

Thanks in advance

[pepe]

Hi,

Here is one I used to use, but it is somehow different now.
http://www.linux-ntfs.org/content/view/103/42/

or I can send U the old one zipped, this old one seems to be more convenient at first glance.

[Steve]

Thanks Pepe

looks like this may take some time to digest

[beto]

in my cases, some times when im get a Disk with MFT or file system damaged,or overwritting some times im check the system overwrite put the original sector in another part,of the disk , sometimes on the end, middle, or after the overwritting sector´s u can try to find MFT original searching by header of the MFT with a sector edit program im use winhex for this task with template analyze.

Like pepe this could help u, this help me to analyze the MFT structure when im search for headers for MFT

http://www.ntfs.com/ntfs_basics.htm