Displaying 2 results from an estimated 2 matches for "usnjrnl".
2016 Feb 18
0
Re: extract NTFS Master File Table for analysis
...-new-api
I played around a bit and I need to confess I am impressed on how easy
is to add functionalities to libguestfs.
I could easily extract the Master File Table using the download API and
parse it with third party tools.
I'd like to extract as well the Update Sequence Number Journal
($UsnJrnl) but it seems unaccessible via it's path (C:\$Extend\$UsnJrnl).
I tried on a real disk and it seems to be a limitation of the NTFS-3g
driver: it can extract C:\$MTF and C:\$LogFile, it can list C:\$Extend
content but it cannot access those files.
Curiously enough, stat() syscall on C:\$Exten...
2016 Feb 02
2
Re: extract NTFS Master File Table for analysis
On Tue, Feb 02, 2016 at 07:40:12PM +0200, noxdafox wrote:
> Greetings,
>
> I'm playing around an idea and I'd like to ask you some questions.
>
> I'd like to extract the MFT table from a disk image file. The idea
> is to employ it to build a sort of reverse lookup table which, given
> a cluster, could retrieve the corresponding file with the related
>