Home | Files | Attributes | Concepts | Glossary | Help |
Type | Description | Name |
---|---|---|
0x10 | $STANDARD_INFORMATION | |
0x30 | $FILE_NAME | $UsnJrnl |
0x80 | $DATA | $J |
0x80 | $DATA | $Max |
repeating group
Offset | Size | Description |
---|---|---|
0x00 | 4 | Size of entry |
0x04 | 4 | ? (Always 0x02) |
0x08 | 8 | MFT Reference 1 |
0x10 | 8 | MFT Reference 2 |
0x18 | 8 | Offset of this entry in $J |
0x20 | 8 | Timestamp |
0x28 | 8 | Flags? (bitfield?) |
0x30 | 8 | Flags? (bitfield?) |
0x38 | 2 | Size of filename (in bytes) |
0x3A | 2 | Offset to filename |
0x3C | V | Filename |
V+0x3C | P | Padding (align to 8 bytes) |
one block -- fixed size?
Offset | Size | Description |
---|---|---|
0x00 | 8 | ? |
0x08 | 8 | ? |
0x10 | 8 | Time |
0x18 | 8 | ? |