Michael Bisbjerg
Michael Bisbjerg
You could also add attributes or classes (by default) to the rendered items, which I can affect w/ CSS. Something like: ```
> Bonus to having events per message, rather than just counters, is also being able to see how long it actually took to deliver that "turn on" message. Would help...
I know there are some issues with the first parse of the mft. For example, if your mft is fragmented just rigt, the program will continue reading past one of...
What your describing is exactly fragmentation of the mft file. What happens is that record 0 contains $mft and one of the attributes will tell you the fragments. The parsers...
It isn't quite - that's why I haven't jumped at it :) You're entirely correct on NTFSDiskStream. If I remember correctly, I read the MFT itself as an NTFSDiskStream, but...
Heh. You're following along very nicely :) Try fragmenting the file "a lot".. The goal here is for the fragments part (the `$DATA` attribute) for the $MFT record to become...
I believe your first exception (reg. fragment being null) is what I was referring to. Iirc the fragment is found in a loop which returns null if it doesn't find...
NTFS does not support any form of recursive lookups like the Win32 API does. So you'll have to do your own recursion.. (It might be that there is a helper...
To do stuff like that, I've iterated all MFT entries in one linear go, and then stitched them together after the fact. This is the fastest, as it moves all...
I wouldn't know how to test it :P But it certainly seems like that slash-filter would be the culprit.