Clever Geek Handbook

Extract $ bitmap file from NTFS image

Does anyone know of any software that can extract a file $bitmap

from NTFS images?

Or does anyone know of any site that documents NTFS enough for me to encode this myself?

(I want to read $bitmap

so that I can determine which clusters are not being used, so they can be removed from images.)

+1


source to share


3 answers


There is one short paragraph in this early talent post:



http://www.alex-ionescu.com/NTFS.pdf

+2


source


There is also "Forensic Filesystems" by Brian Career. He explains NTFS in detail. ntfs.org is also helpful.



Since it $Bitmap

is a system file, you cannot open and read it. Also, be careful that if the drive is in use it may change.

0


source


I answered this elsewhere, but on a real Windows machine, the best answer is probably FSCTL_GET_VOLUME_BITMAP . This will reflect any changes that FS knows about off-disk.

0


source






More articles:


All Articles