When I read the Runlist of Data, I have a confused question

I use two tools to analyze a MFT sector

WinHex


DiskExplorer for NTFS


The same MFT sector read out will be the same in theory

But the place where the red frame

Runlist Offset of WinHex read is 0x2DDD0A7

Runlist Offset of DiskExplorer for NTFS read is 0x1DDD0A7

The RAW Data that this MFT Sector reads out actually is 0x2DDD0A7

But this real Offset of this file must be 0x1DDD0A7

So what operation Runlist of Data must be done? Or some rules necessary follow ?

I don't understand that how "DiskExplorer for NTFS" is makes 0x2DDD0A7 into 0x1DDD0A7

Hi,


You have to decompress the runlist....

Regards

Jean-Pierre

Thanks....

Can you show the algorithm for this MFT sector??

Hi


It is obviously in http://tuxera.com/opensource/ntfs-3g-2009.11.14.tgz
You just have to comply with the GPL.

Regards

Jean-Pierre

How to check this runlist be compressed or not??

Hi again,


Well, this forum is for "Usage Questions & Problems on Linux" and your question is more on the technology transfer side than usage. You should contact Tuxera for appropriate support (http://www.tuxera.com/support/commercial-services/)

Regards

Jean-Pierre