Viewing NTFS information with nfi and diskedit

This post describes processes to view details information regarding an NTFS filesystem, including NTFS attributes such as resident $FILE_NAME, nonresident $DATA and the MFT FRS bytes for any particular file on the filesystem.

I’ve always been curious of how to see the details of NTFS, but have never really had the necessity before. As it happens, we’re discovering quite a few ‘Enterprise Vault’ Event ID 20488 errors when FSA is trying to create placeholder records. The only pattern I can find is that files exhibiting this problem (copied from an NFS volume) all have $EA_INFORMATION (resident) and $EA_DATA (resident) NTFS attributes. Stripping the extended attributes (copying to/from FAT, or recreating the file (eg. By compressing/uncompressing with something not clever enough to read the EA’s – arj32 will do it) resolves the issues with Enterprise Vault.

Anyway, back to NTFS, two utilities I’ve found invaluable in this exercise are 'nfi' and 'diskedit' (Microsoft). Nfi.exe comes from the 2000 server utilities in the link below, while diskedit.exe comes with NT4 SP4.

Using nfi.exe

View a directory:

nfi "c:\WINDOWS"
NTFS File Sector Information Utility.
Copyright (C) Microsoft Corporation 1999. All rights reserved.

\WINDOWS
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$INDEX_ROOT $I30 (resident)
$INDEX_ALLOCATION $I30 (nonresident)
logical sectors 21137544-21137647 (0x1428888-0x14288ef)
$BITMAP $I30 (resident)

View a file (showing non-contiguous sectors):

nfi "C:\windows\NOTEPAD.EXE"
NTFS File Sector Information Utility.
Copyright (C) Microsoft Corporation 1999. All rights reserved.

\WINDOWS\NOTEPAD.EXE
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$DATA (nonresident)
logical sectors 5453304-5453383 (0x5335f8-0x533647)
logical sectors 9927784-9927839 (0x977c68-0x977c9f)

Read the first sector of the nonresident data section of notepad.exe, which shows the FRS number (0x1EE5 - 7909).

nfi c: 5453304
NTFS File Sector Information Utility.
Copyright (C) Microsoft Corporation 1999. All rights reserved.


***Logical sector 5453304 (0x5335f8) on drive C is in file number 7909.
\WINDOWS\NOTEPAD.EXE
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$DATA (nonresident)
logical sectors 5453304-5453383 (0x5335f8-0x533647)
logical sectors 9927784-9927839 (0x977c68-0x977c9f)

Read a file that has the extended attributes I was talking about earlier:

nfi "C:\windows\temp\test.ea"
NTFS File Sector Information Utility.
Copyright (C) Microsoft Corporation 1999. All rights reserved.

\Windows\Temp\test.ea
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$FILE_NAME (resident)
$DATA (nonresident)
logical sectors 7069816-7070775 (0x6be078-0x6be437)
$EA_INFORMATION (resident)
$EA (resident)


Using diskedit.exe

Diskedit is much more interesting, but not particularly intuitive to use. Note that when running diskedit on 2000/xp/2003, you need to have a copy of the NT4 SP4 resource DLLs - IFSUTIL.DLL, UFAT.DLL, ULIB.DLL, UNTFS.DLL

Some ways I’ve used diskedit.exe:

View the file record segment for a file
File Open Volume Name - c:
Read NTFS File Record – Hex FRS number (taken from nfi or cracked)

This will show detailed information on the NTFS attributes of the file record, including filenames, relational information such as the parent directory. See the screenshot below.

View particular NTFS attributes of a record:


Attributes such as $STANDARD_INFO, $FILE_NAME. $SECURITY_DESCRIPTOR can be detailed.

File - Open Volume - Name - c:
Read - NTFS Attribte
1. Base Frs Number – Hex FRS number (taken from nfi or cracked)
2. Attribute Type – Select from the list
3. Attribute Name – Use from viewing the record if name exists, eg $I30 for $INDEX_ROOT

Find the FRS number for an object:

File - Open Volume - Name - c:
Crack - NTFS Path – Full path minus c:, eg \windows\notepad.exe


View the record segement bytes, showing the raw resident attributes, including the EA attributes (if they’re resident):

File - Open Volume - Name - c:
Read - NTFS File Record – Hex FRS number (taken from nfi or cracked)
View - Bytes

See the screenshot below.

References

nfi.exe from here shows NTFS information
http://download.microsoft.com/download/win2000srv/utility/3.0/nt45/en-us/oem3sr2.zip

NTFS, good description of NTFS
http://www.alex-ionescu.com/NTFS.pdf

istat from the sleuth kit can report attributes apparently (didn’t have much luck using on NTFS 3.1/5.1)

http://downloads.sourceforge.net/sleuthkit/sleuthkit-win32-2.51.zip?modtime=1202655285&big_mirror=0

Wayne's World of IT (WWoIT), Copyright 2008 Wayne Martin.