NTFS $ObjID and ObjectID

Note:I translated Japanese into English using Google Translate.
Thank you, Google. 

Let's check NTFS $ObjID:$O and the deleted ObjectID. 
There is image files on the sample E: drive, but these files do not have an ObjectID.

Browse the image file and check the ObjectID.

Confirm that the ObjectID was given.

Let's look at the FILE record of $ObjID. In the figure below, you can find the $O index record in $ INDEX_ROOT (0x90).

At this point, $ObjID:$O does not exist.

Refer to multiple files and add ObjectID to $ObjID.

$O was created as $INDEX_ALLOCATION (0xA0). ( In my test environment $O was created with seven references, including root. )

Using the fte tool, see the result of parsing ObjID.

Delete boat.jpg which we last referred to.

By this operation, the record of boat.jpg in $O is deleted.
The fte tool can refer to deleted records if there are data remaining. 

note:
When there is no $O, ObjectID is not displayed even if you use the fet tool. 

Verification environment: Windows 10 1083

Reference URL:

http://www.kazamiya.net/en/fte

GitHub - jschicht/Indx2Csv: An advanced parser for INDX records