analyzeMFT icon indicating copy to clipboard operation
analyzeMFT copied to clipboard

dataruns offset in attribute header is from the start of attribute

Open dariusbakunas opened this issue 10 years ago • 1 comments

Hi,

I'm working on similar project and I noticed you use number 64 for you data runs offset. You can get this number (not sure if it is always the same) from the attribute header and it is the offset from the beginning of the attribute.

d['run_off'] = struct.unpack("<H",s[32:34])[0] # == 64

(d['ndataruns'],d['dataruns'],d['drunerror']) = unpack_dataruns(s[64:])

# can change to:
offset = d['run_off']

(d['ndataruns'],d['dataruns'],d['drunerror']) = unpack_dataruns(s[offset:])

I guess if non-resident attribute has name (does that ever happen?), that number would not be 64.. and thus better to use that offset from the header. Maybe thats why you were getting data run oddity (l > 6)?

dariusbakunas avatar Jun 13 '14 17:06 dariusbakunas

Hi. Did you ever get an answer for this question?

Hexadite-Shlomi avatar Aug 16 '15 11:08 Hexadite-Shlomi