Displaying 2 results from an estimated 2 matches for "ntfsicat".
Did you mean:
ntfscat
2016 Feb 02
2
Re: extract NTFS Master File Table for analysis
On Tue, Feb 02, 2016 at 07:40:12PM +0200, noxdafox wrote:
> Greetings,
>
> I'm playing around an idea and I'd like to ask you some questions.
>
> I'd like to extract the MFT table from a disk image file. The idea
> is to employ it to build a sort of reverse lookup table which, given
> a cluster, could retrieve the corresponding file with the related
>
2016 Feb 18
0
Re: extract NTFS Master File Table for analysis
...s to say I'd like to add the possibility of extracting files
via their inode. This functionality has the advantage of not requiring
the FS to be mounted. Would libguestfs benefit from this?
If so how should I proceed? Which API names to use?
Most straightforward would be something like:
ntfsicat(device, inode)
or
ntfsidownload(device, inode)
I guess also linux guest disks would benefit from this but this requires
a bit more research.
>
> This question of how do you find which disk block is associated with a
> particular file comes up often enough that I have looked at it v...