NTFS - MFT record properties


Details from a NTFS MFT record analyzed. This record contains one « unamed » stream « pic.jp » and three « alternate data streams » . The buttons allows to position the cursor to the content of each file, to recover the content by exportation and, in case of « non-resident » file, to list the « data runs » (list of clusters groups where allocated for this stream)

tyrhex © Yves Vandermeer  2015-2017   #tyrhex