If I load the MFT file into an MFT analyser it tells me that the resident flag is set, so MFT thinks the file is resident within the MFT entry, yet still 0 bytes long. Is this consistent with a situation where the data attribute is pointing to another MFT record?
Hate to be obtuse but I've spent a few hours wrapping my head around MFT flags and am not totally confident of my skills. Here's the raw hex for the MFT entry for this file, if it helps.
Code::
46 49 4C 45 30 00 03 00 E9 EC 00 B9 00 00 00 00
04 00 01 00 38 00 00 00 50 01 00 00 00 04 00 00
00 00 00 00 00 00 00 00 04 00 00 00 7C 3E 00 00
96 0C 00 00 00 00 00 00 10 00 00 00 60 00 00 00
00 00 00 00 00 00 00 00 48 00 00 00 18 00 00 00
22 F6 AD 12 D2 5C CD 01 04 B7 02 D7 D8 5C CD 01
7E EC BC 89 DA 5C CD 01 22 F6 AD 12 D2 5C CD 01
20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 17 01 00 00 00 00 00 00 00 00 00 00
78 8F 40 1A 00 00 00 00 30 00 00 00 68 00 00 00
00 00 00 00 00 00 02 00 4A 00 00 00 18 00 01 00
05 00 00 00 00 00 05 00 22 F6 AD 12 D2 5C CD 01
22 F6 AD 12 D2 5C CD 01 22 F6 AD 12 D2 5C CD 01
22 F6 AD 12 D2 5C CD 01 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00
04 03 64 00 61 00 74 00 61 00 00 00 00 00 00 00
80 00 00 00 48 00 00 00 01 00 00 00 00 00 03 00
00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF
40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 01 00 00 00 00 00 FF FF FF FF 82 79 47 11
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 96 0C
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 96 0C
↧