@port139 Blog

基本的にはデジタル・フォレンジックの技術について取り扱っていますが、記載内容には高確率で誤りが含まれる可能性があります。

ReFS and File ID

Note:I translated Japanese into English using Google Translate.
Thank you, Google. 

The File ID of ReFS looks different from NTFS. Using USN Journal, confirm the ReFS File ID.

I enabled the USN Journal on the ReFS volume used for testing.

f:id:hideakii:20181112200756p:plain

Create the folder Pictures and check the File ID.

File ID is "00000000000007020000000000000000". ⇒ 1,794
Parent file ID : 00000000000006000000000000000000 ⇒ 1,536

f:id:hideakii:20181112200913p:plain

Copy Example1.jpg to the Picutres folder. The file ID of Example1.jpg is 00000000000007020000000000000001.

f:id:hideakii:20181112201354p:plain

f:id:hideakii:20181112201541p:plain

Add more files and check the File ID. The last number will increase.

f:id:hideakii:20181112202057p:plain

example2.jpg
File ID : 00000000000007020000000000000002
Parent file ID : 00000000000007020000000000000000

example3.jpg
File ID : 00000000000007020000000000000003
Parent file ID : 00000000000007020000000000000000

 

Delete example3.jpg and copy example4.jpg to the Pictures folder.
Will 0000000000000003 be reused?

f:id:hideakii:20181112202522p:plain

f:id:hideakii:20181112202601p:plain

example4.jpg
File ID : 00000000000007020000000000000004
Parent file ID : 00000000000007020000000000000000 

 

Next, let's move the file. Parent file ID is updated and File ID is unchanged.

move Pictures\example4.jpg e:\

example4.jpg
File ID : 00000000000007020000000000000004
Parent file ID : 00000000000006000000000000000000

Using File ID, can I check the parent folder at the time of file creation?

 

Copy example3.jpg to the Pictures folder and check the File ID.

f:id:hideakii:20181112203731p:plain

example3.jpg
File ID : 00000000000007020000000000000005
Parent file ID : 00000000000007020000000000000000

Create "subfilder1" under the Pictures folder.

f:id:hideakii:20181112204700p:plain

705 was set for the File ID of "subfilder 1". In addition, 703 is in $ RECYCLE.BIN and 704 is a folder of SID.

 

Discard example3.jpg to the trash. The file name of Example3.jpg is changed but the File ID does not change.

f:id:hideakii:20181112205445p:plain

 

Is the File ID in ReFS composed of two of folder number and file number?

 

Verification environment: Windows 10 1083

Reference URL:

docs.microsoft.com

USN_RECORD_V4 structure (Windows)

 

f:id:hideakii:20181112200145j:plain