CODEWITHSUNDEEP
ntfs
Khuzema Kamaal
Khuzema Kamaal

Reputation: 321

how to differentiate between folder and file with NTFS

i know that if 1 is present at the 4th position of binary representation of attribute then this is a directory, but i am not sure if 1 is not present at that location should i consider it as a file?

or is there any other attribute present to determine folder or file ? please help me.

Thanks.

Upvotes: 0

Views: 524

Answers (1)

LostInTime
LostInTime

Reputation: 36

Every file has a File Record in Master File Table (MFT) of the volume.

You can check the 2-byte flag stored at 0x16 and 0x17(attention, little endian). The second bit (counting from right) tells whether it's a folder(1), or a file(0).

if (flag & 0x02)
    it's a folder
else
    it's a file

If you change this bit that would originally represent a file to 1 by force, for example with the help of WinHex, and (probably a restart or system cache fresh is needed) double click it, OS would report that the file is corrupted.

In addition, the first bit tells if it is deleted.

if (flag & 0x01)
    it's a normal file or folder not deleted
else
    it's a deleted file or folder

Upvotes: 1

Related Questions