Runlist

Example 1 - Normal file

Data Runs:

21 18 34 56 00

21 18 34 56 - 00 (grouped)

Run 1:

Header = 0x21 - 1 Byte Lange, 2 Byte Offset

Lange = 0x18 (1 Byte)

Offset = 0x5634 (2 Bytes)

Run 2:

Header = 0x00 – End

Summary:

0x18 Cluster @ LCN (logical cluster number) 0x5634

Example 1 is a fragmented file, which is 0x18 cluster from LCN 0x5634

Example 2 - Normal file Fragmented

Data Runs:

31 38 73 25 34 32 14 01 E5 11 02 31 42 AA 00 03 00

31 38 73 25 34 - 32 14 01 E5 11 02 - 31 42 AA 00 03 - 00 (grouped)

Run 1:

Header = 0x31 - 1 Byte Lange, 3 Byte Offset

Lange = 0x38

Offset = 0x342573

Run 2:

Header = 0x32 - 2 Byte Lange, 3 Byte Offset

Lange = 0x114

Offset = 0x363758 (0x211E5 plus 0x342573)

Run 3:

Header = 0x31 - 1 Byte Lange, 3 Byte Offset

Lange = 0x42

Offset = 0x393802 (0x300AA plus 0x363758)

Run 4:

Header = 0x00 - End

Summary :

0x38 Clusters @ LCN 0x342573

0x114 Clusters @ LCN 0x363758

0x42 Clusters @ LCN 0x393802

Example 2 is a fragmented file with a size of 0x18E cluster, with fragments at the LCN 0x342573, 0x363758 and 0x393802.

Example 3 - Normal file, noncontiguous blocks

Data Runs:

11 30 60 21 10 00 01 11 20 E0 00

11 30 60 - 21 10 60 01 - 11 20 E0 - 00 (grouped)

Run 1:

Header = 0x11 - 1 Byte length, 1 Byte Offset

Length = 0x30

Offset = 0x60

Run 2:

Header = 0x21 - 1 Byte length, 2 Byte Offset

Length = 0x10

Offset = 0x160 (0x100 plus 0x60)

Run 3:

Header = 0x11 - 1 Byte length, 1 Byte Offset

Length = 0x20

Offset = 0x E0=negativ=>0x140 because (-0x20 plus 0x160)

Run 4:

Header = 0x00 - End

Summary:

0x30 Clusters @ LCN 0x60

0x10 Clusters @ LCN 0x160

0x20 Clusters @ LCN 0x140

Example 3 is a fragmented file with a size of 0x60 clusters, with fragments at the LCN 0x60, 0x160 and 0x140. The third block is located physically between the first and second block. (The third block has a negative offset, so it is prior to the second)

1.)

In the already created small text file to specify the amount of data that the data part can not be stored in MFT record (min 700-800 bytes) and as before changes to the attributes check.

2.)

Image XP2 If the files

c:\Dokumente und Einstellungen\User0815\Eigene Dateien\readme.txt und c:\NTLDR

fragmented?

If so, how many fragments there are, respectively, and where they are (cluster numbers)?

By default, the attributes are present only once in a Record. NTFS allows, however, that some attributes can occur multiple times. e.g. 8.3 may name as a DOS name.

The attribute with the ID 0x30 then occurs 2 times.

Normally a file has an unnamed data stream $ Data, that an attribute with the ID 0x80.

but an application or an operator can produce more, but now named, data flows as required and access using the name on it. i.e. should occur twice the attribute $ data the second attribute must have a name this is called an alternative data stream