Hello!

Im searching for information about attribute $Data in particular Data runs.
I have chosen a big file for testing. Screenns from dmde:
http://obrazki.elektroda.pl/2700708000_1402505169.png

http://obrazki.elektroda.pl/1958852300_1402505330.png
My calculations: 43 8c 0c 08 b5 c0 ac 08 43 07 ee 00 cb 9e 8e fa 33 43 29 01 9e d9 6a 00
Run 1 head 43
length 80c8c offset 8acc0b5 8acc0b5-8B4CD41 (145539253-146066753) {527500}
Run 2 head 43
l ee07 o 1033B5F80 (fa8e9ecb+8acc0b5) 1033B5F80-1033C4D87 (4349717516-4349778451 {60935}
Run 3 head 33
l 12943 o 103A6391E (6ad99e+1033B5F80) 103A6391E-103A76261 {76099}

In Run 1 calculated clusters matches. Number of clusters matches as well (curly brace)
In Run 2 i 3 calculated clusters not matching, but the number of clusters matches.
I have no idea how to sort this out. What im doing wrong, Am I missing somthing?
Im working on this over a month. Can you help me with this?
Links to resources are welcome.
Thank you.

AFAICT, the MFT record is arranged as follows:


According to DMDE's report ...


... which is in hex ...


It appears that value for the starting cluster is actually a signed 32-bit number representing the cluster location relative to the starting cluster of the previous cluster chain.

0xFA8E9ECB + 0x08ACC0B5 = 0x033B5F80
0x6AD99E + 0x033B5F80 = 0x3A6391E

_________________
A backup a day keeps DR away.

It seems logical. You were very helpful. Live long and prosper

"Logical" get it?! Nice one!

I answered in bad place.
Delete pls!