@port139 Blog

基本的にはデジタル・フォレンジックの技術について取り扱っていますが、記載内容には高確率で誤りが含まれる可能性があります。

MFT Entry Number:36-128-3

MFTレコードの内容を確認

Pointed to by file:
F://b.txt
F://a.txt
F:/test/c.txt
File Type:
ASCII text, with CRLF line terminators
MD5 of content:
a55ab7512f0d0ff4527d898d06afd5c5
SHA-1 of content:
b1b0f3993c24e223152a9a41242cdd6757754a86
Details:
MFT Entry Header Values:
Entry: 36 Sequence: 1
$LogFile Sequence Number: 1269352
Allocated File
Links: 3

$STANDARD_INFORMATION Attribute Values:
Flags: Archive
Owner ID: 0 Security ID: 268
Created: Sat Sep 10 22:12:26 2005
File Modified: Sat Sep 10 22:12:37 2005
MFT Modified: Sat Sep 10 22:35:03 2005
Accessed: Sat Sep 10 22:12:37 2005

$FILE_NAME Attribute Values:
Flags: Archive
Name: b.txt, a.txt, c.txt
Parent MFT Entry: 5 Sequence: 5
Allocated Size: 0 Actual Size: 0
Created: Sat Sep 10 22:12:26 2005
File Modified: Sat Sep 10 22:12:26 2005
MFT Modified: Sat Sep 10 22:12:26 2005
Accessed: Sat Sep 10 22:12:26 2005

Attributes:
$STANDARD_INFORMATION (16-0) Name: N/A Resident size: 72
$FILE_NAME (48-4) Name: N/A Resident size: 76
$FILE_NAME (48-2) Name: N/A Resident size: 76
$FILE_NAME (48-5) Name: N/A Resident size: 76
$DATA (128-3) Name: $Data Resident size: 7