analyzeMFT
analyzeMFT copied to clipboard
dataruns offset in attribute header is from the start of attribute
Hi,
I'm working on similar project and I noticed you use number 64 for you data runs offset. You can get this number (not sure if it is always the same) from the attribute header and it is the offset from the beginning of the attribute.
d['run_off'] = struct.unpack("<H",s[32:34])[0] # == 64
(d['ndataruns'],d['dataruns'],d['drunerror']) = unpack_dataruns(s[64:])
# can change to:
offset = d['run_off']
(d['ndataruns'],d['dataruns'],d['drunerror']) = unpack_dataruns(s[offset:])
I guess if non-resident attribute has name (does that ever happen?), that number would not be 64.. and thus better to use that offset from the header. Maybe thats why you were getting data run oddity (l > 6)?
Hi. Did you ever get an answer for this question?