File Record Segment Header

File Record Segment Headerの構造

0 1 2 3 4 5 6 7 8 9 A B C D E F
00 Signature Update Seq array offset Update Seq array size LogFile Sequence Number
10 Seq no Hard Link Count 1st attrib offset Flags Used size of file record Allocated size of file record
20 Lower Record# of Origin of AttributeList Higher Record# of Origin of AttributeList Seq# of Origin of AttributeList Next attrib ID reserved MFT Record No
30 Reserved for sequence array Common location of 1st attrib

Signature - "FILE"、その他
Update Seq array offset - Update Sequence Arrayへのoffset
Update Seq array size - Update Sequence Arrayのサイズ
LogFile Sequence Number
Seq no
Hard Link Count
1st attrib offset - 次の Attribute へのoffset

File Record Segment Headerの先頭から数えて次のAttributeへのoffset

Flags - 0x0001:record in use. 0x0002 directory
Used size of record - 使用しているサイズ
Allocated size of file record - 一つのレコードが使えるサイズ
Lower Record# of Origin of AttributeList - Attribute Listで使用
Higher Record# of Origin of AttributeList - Attribute Listで使用
Seq# of Origin of AttributeList - Attribute Listで使用
Next attrib ID
reserved
MFT Record No - レコード一つ一つに振られる番号
MFT Record No
0x0000 $MFT
0x0001 $MFTMirr
0x0002 $LogFile
0x0003 $Volume
0x0004 $AttrDef
0x0005 .
0x0006 $Bitmap
0x0007 $Boot
0x0008 $BadClus
0x0009 $Secure
0x000A $UpCase
0x000B $Extend
0x000C $Reserved
0x000D $Reserved
0x000E $Reserved
0x000F $Reserved
0x0010... User files/directoried

Reserved for Update Seq array
Common location of 1st attrib - 次のAttributeは大体ここから始まる