How to find sector of a file from his... Log Out | Topics | Search
Moderators | Edit Profile

X-Ways Support Forum » Disk Editing » How to find sector of a file from his MFT record « Previous Next »

Author Message
Top of pagePrevious messageNext messageBottom of page Link to this message

David Marques
Username: dmarques

Registered: N/A
Posted on Thursday, Jul 3, 2008 - 13:34:   
Hi,

I have a file that I located in the MFT record 46 on logical sector 6 291 548.
My cluster size is 8.
How can I find the start sector of the file from his MFT location?

And reverse way is possible? From the sector where the file is located discover his MFT location?

Thanks.
Top of pagePrevious messageNext messageBottom of page Link to this message

Stefan Fleischmann
Username: admin

Registered: 1-2001
Posted on Thursday, Jul 3, 2008 - 14:09:   
You mean the FILE record of that file is stored in sector 6,291,548? OK, fine (but that sector number is not needed for your question), then in that sector you find the data runs that point to the first cluster of that file. Or you simply look at the "1st sector" cell of that file in the directory browser in X-Ways Forensics.

The reverse way is also possible. You navigate to the first cluster of the file and find out which file that is in the details panel in X-Ways Forensics.

Add Your Message Here
Post:
Username: Posting Information:
Only registered users may post messages here, i.e. you need to have an account.
Password:
Options: Enable HTML code in message
Automatically activate URLs in message
Action:
Forum operated by X-Ways Software Technology AG.