I am writing some code to parse through the MFT on disk in NTFS volumes. This is straightforward, but one particular corner case caught my eye, and I can't find a clear answer anywhere on the inter...

I need to access Windows MFT(Master File Table) using C# in my .net application. I have googled about this and couldn't find any good results. I have been searching for the information from the pas...

I am trying to go through the example on MSDN (https://msdn.microsoft.com/en-us/library/windows/desktop/aa365736%28v=vs.85%29.aspx) on how to query USN journal in order to trace file changes on a N...

I know how to read a file, pass these bytes to a hashing algorithm such as MD5SUM, SHA256 or CRC32, and get the hash. Here I'm asking something slightly different: Each time we write/modify a fi...

Before doing a USN journal / NTFS MFT files-enumeration with while (DeviceIoControl(hDrive, FSCTL_ENUM_USN_DATA, &med, sizeof(med), pData, sizeof(pData), &cb, NULL)) { // do stuff here m...

I'm enumerating the files of a NTFS hard drive partition, by looking at the NTFS MFT / USN journal with: HANDLE hDrive = CreateFile(szVolumePath, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, ...

I am trying to read windows Master File Table (MFT) for fast enumeration of files. Till now I have seen two approaches to do this: As suggested by Jeffrey Cooperstein and Jeffrey Richter using De...

Can anyone recommend a tool for MFT cleanup? I want to in my MFT restore the entries for files which once existed but have been deleted to a "pristine" state, with zeroed out entries.

Continuing my previous question, I was able to use this delphi unit to implement crazy FAST drive scan using this EnumMFTEntries() function, but I have trouble doing the following tasks: Task #1: ...

I'm seeking to use Change Journal instead of ReadDirectoryChangesW to track changes in my delphi XE2 application (as for why: ReadDirectoryChangesW is not that reliable) The closest I could find i...

I am in the middle of writing a tool that finds lost files of an iTunes library, for both Mac and Windows. On the Mac, I can quickly find files by naming using the wonderful "CatalogSearch" functio...