For large fragmented files the MFT $DATA record might not contain the file 'runs'. A run represents information about a fragment of the file (Cluster offset & number of clusters).
Instead it might just contain a pointer off to another MFT record where all the runs can be found. So you can get a situation where you can see the name of the file but know nothing about the clusters that were used by the file.
You would need to step through the MFT byte by byte to confirm this was the case.
↧