How to get LBA(logical block addressing) of a file from MFT on NTFS file system?

Question

I accessed the $MFT file and extracted file attributes.

Given the file attributes from MFT, how to get a LBA of file from the MFT record on NTFS file system?

To

Answer 1

I'm not entirely sure of your question-- But if you're simply trying to find the logical location on disk of a file, there are various IOCTLs that will achieve this.

For instance, MFT File records: FSCTL_GET_NTFS_FILE_RECORD http://msdn.microsoft.com/en-us/library/windows/desktop/aa364568(v=vs.85).aspx

Location on disk of a specific file via HANDLE: FSCTL_GET_RETRIEVAL_POINTERS http://msdn.microsoft.com/en-us/library/windows/desktop/aa364572(v=vs.85).aspx

If you're trying to parse NTFS on your own, you'll need to follow the $DATA attribute-- Which will always be non-resident data runs (unless it's a small file that can be resident within the MFT). Microsoft's data runs are fairly simply structures of data contained in the first two nibbles, which specify offset and length for the next run of data.