The Master File Table

The master file table record consists of a header and the attribute list. It has a size of 400 (=1K), or the cluster size (whichever is larger). The header has the following fields:

    offset(length)   contents
    0(4)             Magic number 'FILE'
    4(2)             Offset to fixup (usually 2C)
    2(2)             Number of fixups, including first word
    10(2)            Sequence number
    12(2)            hard link count
    14(2)            Offset to attributes
    16(2)            Flags: 1-non-resident attributes, 2-record is directory
    18(4)            Length of in-use part of the record (header + attributes)
    1C(4)            Allocated (total) length of the record
    20(8)            Main MFT record, if continuation record, or 0
    28(2)            Number of attributes
    2A(6+)           Fixup (length depends on record size)

The fixup's first word should be found at offsets 1FE and 3FE. If it matches, the words at offset 2C and 2E should be written to the offsets 1FE and 3FE, respectively.

The attribute list is of variable length and terminated with FFFFFFFF. For 1K MFT records, the attribute list starts at offset 0x30.