The structure of the Index Record in NTFS 3.1 is clear:

Offset      Description
0x00        MFT Reference of the file
0x08        Size of the index entry
0x0A        Offset to the filename
0x52        Filename

The filename is always located at 0x52. So, why do we need the data stored on 0x0A? And what does it include (Almost not 0x52)?

  • Wait, what? Where did you get that information. Here? For starters attributes (and the file name is an attribute in NTFS terms, IIRC), can be resident (inside the record) or non-resident (elsewhere). So your assumption that the file name ought to be at offset 0x52 is already wrong. But what you describe here looks more like an ATTRIBUTE_RECORD_HEADER? I think you need to give more information.
    – 0xC0000022L
    Jun 15, 2018 at 20:12


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.