Orphaned Files What Does That Mean? © Dr. D. Kall Loper, all rights reserved Orphaned Files What Does That Mean?

Orphaned Files

Orphaned Files Definitions Orphaned Files Files are orphaned when their parent directory is overwritten in the $MFT. Deleted directories and associated files are intact and can be recovered with metadata intact. If the ‘parent’ directory is overwritten, all pointers to the parent directory found in the associated files are invalid—thus orphaning the files. Definitions

Orphaned Files Definitions Master File Table The MFT is an index of data about the files, directories, and metafiles in the system. All the data in a file is simply a ‘property’ or extent of the file object. Definitions

MFT Record Structure MFT Record Structure Record entries are the fundamental unit of the MFT. The basic record entry is 1024 bytes. Additional records can be added to describe a file system object that exceeds that size.

MFT Record Structure NTFS Versions NTFS made slight changes to the MFT between versions 3.0 and 3.1. In this case, the offset from beginning of record to the Standard Information Attribute (SIA) changed from 48 bytes to 56 bytes. Version 1.1 (NT 3.5) Version 1.2 (NT 3.51 & 4.0) Version 3.0 (Windows 2000) Version 3.1 (Windows XP et seq.)

MFT Record Structure Illustration Standard Information Attribute (SIA) Header is 10 00 00 00 Version 3.0 (Win2K) offset=48 bytes Version 3.1 (WinXP) offset=56 bytes Illustration

MFT Record Structure Illustration Standard Information Attribute (SIA) The size of the SIA is variable. To find the size of SIA, read the 4 bytes after the header (little endian). Illustration

MFT Record Structure Illustration Standard Information Attribute (SIA) 0x60h = 96 decimal. So count over 96 bytes and there will be the File Name Attribute header. Illustration

MFT Record Structure Illustration File Name Attribute (FNA) Header = 30 00 00 00 Illustration

MFT Record Structure Within the File Name Attribute is a pointer to the parent or child. Folders have children Files have parents There is no absolute offset from the beginning of the record since the SIA has a variable size. However, the pointer can be found 24 bytes inside of the FNA and is 8 bytes long.

MFT Record Structure Illustration File Name Attribute (FNA) Header = 30 00 00 00 Offset = 24 bytes into the FNA including the header. Illustration

MFT Record Structure Illustration File Name Attribute (FNA) The first 6 bytes of this value (little endian) represent the MFT Record number of the parent. Illustration

MFT Record Structure Parent MFT Record Number To find the offset of the parent, multiply the ParentID number by 1024 (MFT record size).

MFT Record Structure Illustration File Name Attribute (FNA) The last 2 bytes of this value (little endian) is the “stored sequence value” of the parent. Illustration

MFT Record Structure Stored Sequence Value The number of times that the record has been used and reused (i.e. after deletion) is stored as a sequence value in the MFT record. When a record is created it has the hex value 0x01 00. Each time the file or folder is deleted, this value increments, and it never decrements.

MFT Record Structure Illustration Stored Sequence Record offset = 16 bytes Data is 2 byte value stored little endian Illustration

MFT Record Structure Each MFT record contains a sequence value as mentioned above and an allocation value. The allocation value determines whether the record is available for rewrite or is already allocated.

MFT Record Structure Illustration Allocation Value Record offset = 22 bytes Data is 2 byte value stored little endian Illustration

MFT Record Structure The allocation value tells whether the record is or is not allocated. Binary Hex Allocation Type Allocated 0000 0000 00 File Unallocated 0000 0001 01 0000 0010 02 Folder 0000 0011 03

Orphaned Files Deleted Files When the parent is deleted, the Sequence Value increments by 1. The sequence value of the parent is one greater than the child. The parent folder was deleted and thus, the child is deleted too. The parent’s allocation status will be 0x02h (0000 0010 binary).

Orphaned Files Orphaned Files Once the parent is deleted, the allocation value is changed to “unallocated.” When the next record is needed in the MFT, that record may be “reallocated.” Since the child records (folders and/or files) are still present, but their pointers now incorrectly identify the parent, they are called orphans.