MFT 文件的位置？
我有一个分区，格式为 NTFS。我研究过，格式化为 NTFS 的设备有一个 MFT（主文件表），其中包含有关设备内容的大量信息。
MFT 真的是一个文件吗？
它位于哪里？
我怎样才能查看它？
我实际上想查看 $BITMAP 以了解分区中所有文件和目录的位置。
更新： 好像我只能使用 HexEditor 查看 MFT 文件。但仍在寻找更多选择......
I have a partition, formatted as NTFS. I have studied that devices formatted as NTFS have a MFT (Master File Table) which contains a lot of information about the contents of a devices.
Is MFT really a file?
Where is it located?
How can I view it?
I, actually want to view the $BITMAP to know the locations of all the files and directories in a partition.
Update:
Seems like I can only view the MFT file using HexEditor. Still searching for more options though...
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（5）
访问磁盘的群集 BITMAP 可以通过 FSCTL_GET_VOLUME_BITMAP API 调用。但是，它不会告诉每个集群中有哪些文件。您需要解析 MFT （更快）或递归调用 FSCTL_GET_RETRIEVAL_POINTERS 每个文件（慢）。
Accessing a disk's cluster BITMAP can be read via the FSCTL_GET_VOLUME_BITMAP API call. However, it won't tell what files are at each cluster. You need either parse the MFT (faster) or recursively call FSCTL_GET_RETRIEVAL_POINTERS on each file (slow).
如果您的目的是列出驱动器中的文件并查看它们的路径，请在此处检查源文件 链接。这个人解析 MFT 并搜索其中是否存在文件。只需修改代码就可以帮助你获取文件和目录的路径。
If your intention is to list files from a drive and view the path of them then check the source files here a link. This guy parses the MFT and searches for a file present inside it or not. Just modify the code can help you get the path of files and directories.
$MFT 是系统生成的文件，尽管具有管理权限，但用户无法直接访问该文件。
如果您想查看 MFT，您可以使用 FTK imager 或 Autopsy 等免费工具从任何具有 NTFS 文件系统的分区的根目录导出 $MFT。
此外，使用来自github的analyzeMFT包解析MFT可以提供一个exel文件以方便阅读。
$MFT is a system generated file which can't be directly accessed by the user despite administrative privileges.
If you wish to view the MFT you can use free tools like FTK imager or Autopsy to export the $MFT from the root directory of any partition having NTFS file system.
Furthermore parsing that MFT using analyzeMFT package from github can give a exel file to easily read it.
我不完全知道它在哪里，但你可以尝试下一个路径
\\.\C:，据我所知就是它。您可以看看这个程序，它显示了如何获取已删除的文件。I don't exactly know where it is but you can try next path
\\.\C:, as I understood it is it. You can have a look on this program that shows how to get deleted files.MFT 不是文件。 MFT 是文件系统的一部分。要查看它，您必须访问较低级别的磁盘，例如块模式。
MFT is not a file. MFT is a part of the file system. To view it, you will have to access disk on lower level, such as block mode.