{"id":58110,"date":"2026-11-05T18:08:58","date_gmt":"2026-11-05T10:08:58","guid":{"rendered":"https:\/\/www.amagicsoft.com\/?p=58110"},"modified":"2026-11-05T18:08:58","modified_gmt":"2026-11-05T10:08:58","slug":"ntfs-deleted-file-mft-test","status":"publish","type":"post","link":"https:\/\/www.amagicsoft.com\/jp\/kb\/lab\/ntfs-deleted-file-mft-test.html","title":{"rendered":"NTFS \u524a\u9664\u6e08\u307f\u30d5\u30a1\u30a4\u30eb\u306e MFT \u30c6\u30b9\u30c8\uff1a\u524a\u9664\u5f8c\u306b\u4f55\u304c\u5909\u5316\u3059\u308b\u306e\u304b\uff1f"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"58110\" class=\"elementor elementor-58110\" data-elementor-post-type=\"post\">\n\t\t\t\t<div class=\"elementor-element elementor-element-dvfmf61 dtec-docx-root dtec-post-58110 e-flex e-con-boxed e-con e-parent\" data-id=\"dvfmf61\" data-element_type=\"container\" data-e-type=\"container\">\n\t\t\t\t\t<div class=\"e-con-inner\">\n\t\t\t\t<div class=\"elementor-element elementor-element-vl257ne elementor-widget elementor-widget-text-editor\" data-id=\"vl257ne\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div><div><p class=\"otl-paragraph\">An <strong>NTFS deleted file MFT test<\/strong> needs to compare more than a filename. Once final deletion completes, NTFS can release the file record, remove its active directory entry, and free its nonresident data clusters. However, those changes do not necessarily erase the old contents. This experiment compares a small resident TXT with a nonresident JPG through deletion and record reuse, then examines a defined overwrite of the JPG\u2019s external data. The comparison separates three questions: does the name survive, does its mapping survive, and do the original bytes still match?<\/p><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c20i4lf elementor-toc--minimized-on-tablet elementor-widget elementor-widget-table-of-contents\" data-id=\"c20i4lf\" data-element_type=\"widget\" data-e-type=\"widget\" data-settings=\"{&quot;headings_by_tags&quot;:[&quot;h2&quot;,&quot;h3&quot;],&quot;exclude_headings_by_selector&quot;:&quot;.faq-no-toc, h2:contains(Data Recovery Assessment)&quot;,&quot;marker_view&quot;:&quot;bullets&quot;,&quot;no_headings_message&quot;:&quot;No headings were found on this page.&quot;,&quot;icon&quot;:{&quot;value&quot;:&quot;fas fa-circle&quot;,&quot;library&quot;:&quot;fa-solid&quot;},&quot;minimize_box&quot;:&quot;yes&quot;,&quot;minimized_on&quot;:&quot;tablet&quot;,&quot;hierarchical_view&quot;:&quot;yes&quot;,&quot;min_height&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;min_height_tablet&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]},&quot;min_height_mobile&quot;:{&quot;unit&quot;:&quot;px&quot;,&quot;size&quot;:&quot;&quot;,&quot;sizes&quot;:[]}}\" data-widget_type=\"table-of-contents.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div class=\"elementor-toc__header\">\n\t\t\t\t\t\t<h4 class=\"elementor-toc__header-title\">\n\t\t\t\tTable of Contents\t\t\t<\/h4>\n\t\t\t\t\t\t\t\t\t\t<div class=\"elementor-toc__toggle-button elementor-toc__toggle-button--expand\" role=\"button\" tabindex=\"0\" aria-controls=\"elementor-toc__c20i4lf\" aria-expanded=\"true\" aria-label=\"Open table of contents\"><i aria-hidden=\"true\" class=\"fas fa-chevron-down\"><\/i><\/div>\n\t\t\t\t<div class=\"elementor-toc__toggle-button elementor-toc__toggle-button--collapse\" role=\"button\" tabindex=\"0\" aria-controls=\"elementor-toc__c20i4lf\" aria-expanded=\"true\" aria-label=\"Close table of contents\"><i aria-hidden=\"true\" class=\"fas fa-chevron-up\"><\/i><\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<div id=\"elementor-toc__c20i4lf\" class=\"elementor-toc__body\">\n\t\t\t<div class=\"elementor-toc__spinner-container\">\n\t\t\t\t<i class=\"elementor-toc__spinner eicon-animation-spin eicon-loading\" aria-hidden=\"true\"><\/i>\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ao798vt elementor-widget elementor-widget-heading\" data-id=\"ao798vt\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What This NTFS Deleted File MFT Test Examines<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-48kapkb elementor-widget elementor-widget-text-editor\" data-id=\"48kapkb\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>The core question is whether a deleted MFT record can still describe a complete file. The answer depends on both metadata and content. A surviving name can identify an old file, while a surviving runlist can locate the former clusters of a nonresident stream. Neither establishes that those clusters still contain the original data.<\/p>\n<p>For background, the <a href=\"https:\/\/www.amagicsoft.com\/wiki\/ntfs-master-file-table.html\">Master File Table<\/a> guide explains how records connect names, attributes, and storage locations. Here, the focus is the change between defined states.<\/p>\n<p>This worked experiment uses generated NTFS structure samples, calculated byte comparisons, and explicitly defined allocation-state transitions. The screenshots show the generated records opened in wxHexEditor, with matched before-and-after selections: the JPG record flags and the TXT\u2019s resident content bytes. The model follows completed deletion of a single-link file, with all handles closed, rather than a move into the Recycle Bin.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-rvrejip elementor-widget elementor-widget-heading\" data-id=\"rvrejip\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">NTFS MFT Test Configuration and Assumptions<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-gydqy8m elementor-widget elementor-widget-text-editor\" data-id=\"gydqy8m\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>This NTFS deleted file MFT test uses an unencrypted NTFS 3.1 logical volume. It uses 512-byte logical sectors, 4,096-byte clusters, and 1,024-byte MFT records. Its partition starts at disk LBA 2048. These are chosen inputs, rather than a device specification.<\/p>\n<p>The target, <code class=\"dtec-inline-code\">mft-lab-file.jpg<\/code>, occupies record 42. Its unnamed, nonresident <code class=\"dtec-inline-code\">$DATA<\/code> stream contains exactly 10,240 bytes. One contiguous run covers three clusters, starting at logical cluster number 8192. Consequently, allocation is 12,288 bytes, with 2,048 bytes beyond the file\u2019s logical end. The <a href=\"https:\/\/www.amagicsoft.com\/kb\/disk-partition\/allocation-unit-size.html\">allocation unit size<\/a> guide explains this size-versus-allocation distinction.<\/p>\n<p>Both targets have <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/fileio\/hard-links-and-junctions\" rel=\"nofollow\">one hard link<\/a> and no NTFS compression, sparse allocation, alternate data streams, or extension records. The JPG is a valid generated 160 \u00d7 120 JPEG with a deterministic pixel pattern and a JPEG comment segment that sets its length to 10,240 bytes. It was decoded to check the sample format. Record 42 starts with sequence number 42.<\/p>\n<p>The second target, <code class=\"dtec-inline-code\">resident-note.txt<\/code>, contains exactly 64 bytes of ASCII text inside record 43, initially at sequence 7. Its <code class=\"dtec-inline-code\">$DATA<\/code> value needs no separate data clusters. In both examples, the <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/devnotes\/attribute-record-header\" rel=\"nofollow\">attribute header<\/a> determines the storage form: a <code class=\"dtec-inline-code\">.txt<\/code> extension alone does not guarantee resident data, and the <code class=\"dtec-inline-code\">.jpg<\/code> extension alone does not establish nonresident data.<\/p>\n<p>For each immediate deletion comparison, the model preserves the payload and old attributes. Subsequent scenarios change the record slot or, for the JPG, one external data cluster. This isolates their effects without assuming a particular SSD readout or Windows write sequence.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-628r1ry elementor-widget elementor-widget-heading\" data-id=\"628r1ry\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">NTFS Deleted File MFT Test Procedure<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-r7gm07x elementor-widget elementor-widget-text-editor\" data-id=\"r7gm07x\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Scenario 1 \u2013 Scenario 4 follow the nonresident JPG. S3 and S4 branch independently from S2. S5\u2013S7 form a separate resident TXT control; those states use record 43 rather than record 42.<\/p><h3>Nonresident JPG: NTFS MFT Test States<\/h3><p><strong>S1 \u2014 JPG baseline.<\/strong><\/p><p>Construct record 42 with its name, nonresident data mapping, and in-use flag set. Set the corresponding record and cluster allocation bits. Generate the complete content and calculate its SHA-256 digest.<\/p><p><strong>S2 \u2014 JPG deletion complete.<\/strong><\/p><p>Starting from S1, remove the original name from active directory membership, clear the record\u2019s in-use bit, reduce its link count to zero, and increment its sequence number. Clear the relevant record and cluster bitmap bits. Preserve the old filename, data attribute, and payload as the defined retained-metadata case.<\/p><p><strong>S3 \u2014 JPG record slot reused.<\/strong><\/p><p>Starting from S2, replace record 42 with the attributes of <code>new-owner.txt<\/code>, a small resident file. Set the record allocation bit again. Leave the former three data clusters unchanged and free. Check whether the current record still supplies the original mapping.<\/p><p><strong>S4 \u2014 JPG middle cluster overwritten.<\/strong><\/p><p>Separately return to S2. Assign LCN 8193 to another file and replace each byte in that cluster with its bitwise inverse (<code>original XOR FF<\/code>). This defined replacement changes every byte in the range. Keep the old, freed target record unchanged. Compare the resulting 10,240-byte stream with the original.<\/p><h3>Resident TXT: NTFS MFT Test States<\/h3><p><strong>S5 \u2014 Resident TXT baseline.<\/strong><\/p><p>Construct record 43 for <code>resident-note.txt<\/code> with 64 bytes inside its resident <code>$DATA<\/code> attribute. Set the record allocation bit, and record the value\u2019s location and digest. Its data stream has no external cluster allocation.<\/p><p><strong>S6 \u2014 Resident TXT deletion complete.<\/strong><\/p><p>Starting from S5, remove the active filename, clear the record\u2019s in-use and allocation bits, set links to zero, and increment sequence 7 to 8. Preserve the resident content bytes. There are no separate payload-cluster bits to clear for this stream.<\/p><p><strong>S7 \u2014 Resident TXT record reused.<\/strong><\/p><p>Starting from S6, reuse record 43 for <code>replacement1.txt<\/code>. Place 64 tilde characters in the same resident-value range. Compare that range with the original text to determine whether the original payload survives this replacement.<\/p><h3>Compare Contents After Deletion and Reuse<\/h3><p><strong>Evaluate content separately.<\/strong> For the JPG, decode the retained mapping, read the external ranges in file order, and stop at 10,240 bytes. For the TXT, read the 64-byte value inside its record. Compare the complete bytes and digest; exclude cluster slack and do not use the filename as the integrity check.<\/p><p>These transformations apply to disposable generated structures. For a device-based follow-up, use expendable test media and verify the target\u2019s identity before deleting anything. Preserve the affected source when investigating actual data loss.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-gm6e3nk elementor-widget elementor-widget-heading\" data-id=\"gm6e3nk\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">NTFS File Deletion Hex Comparison<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9ej51vx elementor-widget elementor-widget-text-editor\" data-id=\"9ej51vx\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>In the paired screenshot section below, compare each file with its own earlier state. The header field at <code class=\"dtec-inline-code\">+0x16<\/code> is the two-byte flags word. Its low bit changes from allocated to free. The nearby sequence and link fields provide supporting context. The <code class=\"dtec-inline-code\">h<\/code> suffix identifies hexadecimal row offsets; the JPG screenshots select <code class=\"dtec-inline-code\">+0x16\u2013+0x17<\/code>; the TXT screenshots instead select the resident content for comparison.<\/p>\n<h3>Deleted File MFT Fields: What Changed?<\/h3>\n<p>The flag change releases the record; it does not instruct a parser to replace the file\u2019s data with zeros. The sequence change also matters: an old reference that names record 42 with sequence 42 is now stale. Microsoft documents <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/devnotes\/file-record-segment-header\" rel=\"nofollow\">the sequence increment when a file record segment is freed<\/a>.<\/p>\n<p>The two bitmap changes describe <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/devnotes\/master-file-table\" rel=\"nofollow\">record and cluster allocation<\/a>. <code class=\"dtec-inline-code\">$MFT::$BITMAP<\/code> tracks record allocation. In this sample, record 42 corresponds to bit 2 of byte <code class=\"dtec-inline-code\">+0x05<\/code>. The volume\u2019s <code class=\"dtec-inline-code\">$Bitmap::$DATA<\/code> tracks cluster allocation. Clusters 8192\u20138194 correspond to bits 0\u20132 of byte <code class=\"dtec-inline-code\">+0x0400<\/code>.<\/p>\n<p>Clearing those bits makes resources available for reuse. It does not establish whether a later read returns original content. Also, the original name\u2019s removal from the active directory index is separate from the retained <code class=\"dtec-inline-code\">$FILE_NAME<\/code> attribute inside the freed record. <a href=\"https:\/\/wiki.sleuthkit.org\/NTFS-File-Recovery\/\" rel=\"nofollow\">Directory-tree updates can shift or overwrite index entries<\/a>, so index remnants need their own interpretation.<\/p>\n<h3>How Does the MFT Locate a Deleted File?<\/h3>\n<p>In S1 and S2, the nonresident data attribute begins at record <code class=\"dtec-inline-code\">+0x118<\/code>. Its <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows\/win32\/devnotes\/attribute-record-header\" rel=\"nofollow\">mapping-pairs offset<\/a> is <code class=\"dtec-inline-code\">0x40<\/code>, placing the runlist at record <code class=\"dtec-inline-code\">+0x158<\/code>. The bytes describe one run of three clusters starting at LCN 8192. The interactive comparison below retains the actual Hex values and lets readers inspect these fields.<\/p>\n<p>LCNs are relative to the volume. Therefore, the first data cluster starts at volume byte offset <code class=\"dtec-inline-code\">0x02000000<\/code>. Adding the chosen partition offset gives disk byte offset <code class=\"dtec-inline-code\">0x02100000<\/code>, or disk LBA 67584. Confusing these bases would make a recovery reader inspect the wrong location.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-nvuae1r elementor-widget elementor-widget-heading\" data-id=\"nvuae1r\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Resident TXT vs Nonresident JPG: The Same Deletion, Different Storage<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9037ec0 elementor-widget elementor-widget-text-editor\" data-id=\"9037ec0\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>Compare the two files at the same stage: S5 versus S1 before deletion, S6 versus S2 after deletion, and S7 versus S3 after record reuse. The TXT occupies record 43; the JPG occupies record 42. Different filenames, record numbers, and initial sequence values identify different objects rather than showing deletion changes.<\/p>\n<table><tbody><tr><td><p><strong>Stage<\/strong><\/p><\/td><td><p><strong>Resident TXT: 64 bytes<\/strong><\/p><\/td><td><p><strong>Nonresident JPG: 10,240 bytes<\/strong><\/p><\/td><\/tr><tr><td><p>Before deletion<\/p><\/td><td><p>Content is inside record 43 at <code class=\"dtec-inline-code\">+0x130\u2013+0x16F<\/code>.<\/p><\/td><td><p>Record 42 holds the runlist; content is in external clusters 8192\u20138194.<\/p><\/td><\/tr><tr><td><p>After deletion<\/p><\/td><td><p>Record is free; all 64 resident content bytes remain in the defined state.<\/p><\/td><td><p>Record and three clusters are free; the old mapping and all 10,240 content bytes remain in the defined state.<\/p><\/td><\/tr><tr><td><p>After record reuse<\/p><\/td><td><p>The replacement value overwrites the same range: 0 \/ 64 original bytes match.<\/p><\/td><td><p>The replacement owner removes the old mapping; the baseline-known external range still matches 10,240 \/ 10,240 bytes.<\/p><\/td><\/tr><\/tbody><\/table>\n<h3>Inspect Deleted File MFT Test Fields<\/h3>\n<p>The interactive comparison opens with the two deleted states side by side. Its summary follows all three matched stages, and its storage view distinguishes resident content from nonresident mapping pairs.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-d08d767 elementor-widget elementor-widget-html\" data-id=\"d08d767\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"html.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div id=\"ntfs-mft-lab-v13\" aria-label=\"NTFS deletion hex comparison\"><style>\r\n#ntfs-mft-lab-v13{--ink:#171717;--line:#aaa;--muted:#555;display:block;box-sizing:border-box;width:100%;max-width:1180px;min-width:0;margin:18px auto;border:1px solid #657184;border-radius:0;background:#d4d0c8;color:var(--ink);font:13px\/1.45 Arial,\"Segoe UI\",sans-serif;text-align:left;box-shadow:1px 2px 3px #0003;isolation:isolate}\r\n#ntfs-mft-lab-v13 *,#ntfs-mft-lab-v13 *::before,#ntfs-mft-lab-v13 *::after{box-sizing:border-box}\r\n#ntfs-mft-lab-v13 .nl-top{padding:0;border-bottom:1px solid #888}\r\n#ntfs-mft-lab-v13 .nl-eyebrow{display:none}\r\n#ntfs-mft-lab-v13 .nl-title{margin:0;background:#49617d;color:white;font:bold 12px\/1.6 Tahoma,Arial,sans-serif;padding:4px 8px;overflow-wrap:anywhere}\r\n#ntfs-mft-lab-v13 .nl-sub{padding:4px 8px;font:11px\/1.5 Tahoma,Arial,sans-serif;background:#e8e5df}\r\n#ntfs-mft-lab-v13 .nl-tools{display:flex;flex-wrap:wrap;align-items:center;gap:6px;padding:7px;border-top:1px solid white;border-bottom:1px solid #aaa;min-width:0}\r\n#ntfs-mft-lab-v13 .nl-hint{font:11px\/1.5 Arial,sans-serif;color:#444}\r\n#ntfs-mft-lab-v13 button,#ntfs-mft-lab-v13 select{appearance:auto;box-sizing:border-box;background:#e8e7e4;color:#171717;border:1px solid #8d8c88;border-top-color:#fff;border-left-color:#fff;border-radius:0;box-shadow:1px 1px #777;font:12px\/1.4 Arial,\"Segoe UI\",sans-serif!important;letter-spacing:normal;text-transform:none;height:auto!important;min-height:30px;max-width:100%;margin:0;padding:5px 8px;cursor:pointer}\r\n#ntfs-mft-lab-v13 button{flex:0 1 auto;white-space:normal}\r\n#ntfs-mft-lab-v13 button[aria-pressed=true]{background:#c9c9c7;border-color:#777;box-shadow:inset 1px 1px #999;font-weight:700!important}\r\n#ntfs-mft-lab-v13 button:focus-visible,#ntfs-mft-lab-v13 select:focus-visible{outline:2px solid #1c449e;outline-offset:2px}\r\n#ntfs-mft-lab-v13 .nl-tools label{display:flex;align-items:center;gap:6px;flex:1 1 280px;max-width:100%;min-width:0;font:12px\/1.4 Arial,sans-serif}\r\n#ntfs-mft-lab-v13 select{display:block;flex:1 1 220px;width:100%;min-width:0;background:#fff;padding-right:22px}\r\n#ntfs-mft-lab-v13 .nl-panes{display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,470px),1fr));gap:8px;min-width:0;padding:6px}\r\n#ntfs-mft-lab-v13 .nl-pane{min-width:0;max-width:100%;background:#fff;border:1px solid #929292;border-radius:0}\r\n#ntfs-mft-lab-v13 .nl-pane-title{background:#dedbd4;padding:4px 6px;border-bottom:1px solid #999;font:600 12px\/1.5 Tahoma,Arial,sans-serif;overflow-wrap:anywhere}\r\n#ntfs-mft-lab-v13 .nl-meta{background:#f4f3f0;padding:3px 6px;border-bottom:1px solid #bbb;font:11px\/1.5 Tahoma,Arial,sans-serif;overflow-wrap:anywhere}\r\n#ntfs-mft-lab-v13 .nl-scroll{width:100%;max-width:100%;min-width:0;overflow-x:auto;background:#fff;padding:0}\r\n#ntfs-mft-lab-v13 .nl-hex{width:100%;max-width:100%;min-width:0;background:#fff}\r\n#ntfs-mft-lab-v13 table.nl-hexgrid{display:table!important;table-layout:fixed!important;border-collapse:collapse!important;width:100%!important;min-width:0!important;max-width:100%!important;margin:0!important;border:0!important;background:#fff;color:#111;font:11px\/18px \"DejaVu Sans Mono\",Consolas,monospace!important}\r\n#ntfs-mft-lab-v13 .nl-hexgrid .nl-offset-col{width:72px}\r\n#ntfs-mft-lab-v13 .nl-hexgrid .nl-ascii-col{width:128px}\r\n#ntfs-mft-lab-v13 .nl-hexgrid.nl-hex-eight .nl-offset-col{width:64px}\r\n#ntfs-mft-lab-v13 .nl-hexgrid.nl-hex-eight .nl-ascii-col{width:76px}\r\n#ntfs-mft-lab-v13 .nl-hexgrid th,#ntfs-mft-lab-v13 .nl-hexgrid td{box-sizing:border-box!important;font-family:\"DejaVu Sans Mono\",Consolas,monospace!important;font-size:11px!important;font-weight:400!important;font-style:normal!important;line-height:18px!important;letter-spacing:0!important;text-transform:none!important;border:0!important;padding:0!important;text-align:center!important;vertical-align:middle!important;height:20px;white-space:nowrap!important;word-break:normal!important;overflow-wrap:normal!important;background:#fff;color:#111}\r\n#ntfs-mft-lab-v13 .nl-hexgrid th{background:#f5f5f3;border-bottom:1px solid #b5b5b5!important;color:#143f8c}\r\n#ntfs-mft-lab-v13 .nl-hexgrid .nl-offset{color:#173f91;border-right:1px solid #c0c0c0!important;text-align:right!important;padding-right:5px!important}\r\n#ntfs-mft-lab-v13 .nl-hexgrid .nl-ascii{border-left:1px solid #bcbcbc!important;text-align:left!important;padding-left:5px!important;white-space:pre!important}\r\n#ntfs-mft-lab-v13 .nl-hexgrid .nl-sel{background:#234fa8!important;color:#fff!important}\r\n#ntfs-mft-lab-v13 .nl-hexgrid .nl-diff{background:#ffe1df!important;color:#9a1729!important;font-weight:700!important;border-bottom:2px solid #b72132!important}\r\n#ntfs-mft-lab-v13 .nl-hexgrid .nl-sel.nl-diff{outline:1px solid #234fa8;outline-offset:-1px}\r\n#ntfs-mft-lab-v13 .nl-info{min-width:0;max-width:100%;padding:5px 6px;border-top:1px solid #bbb;background:#f7f7f5;white-space:normal;overflow-wrap:anywhere;font:11px\/1.5 Tahoma,Arial,sans-serif}\r\n#ntfs-mft-lab-v13 .nl-mini,#ntfs-mft-lab-v13 .nl-mini span{display:block}\r\n#ntfs-mft-lab-v13 .nl-rule{margin:0 6px;padding:5px 6px;background:#efede7;border-left:2px solid #777;overflow-wrap:anywhere;font:11px\/1.5 Tahoma,Arial,sans-serif}\r\n#ntfs-mft-lab-v13 .nl-legend{padding:4px 7px;color:#555;font:11px\/1.5 Tahoma,Arial,sans-serif}\r\n#ntfs-mft-lab-v13 .nl-cross-summary{padding:0 6px 7px;min-width:0}\r\n#ntfs-mft-lab-v13 table.nl-cross-matrix{display:table!important;width:100%!important;min-width:0!important;max-width:100%!important;table-layout:fixed!important;border-collapse:collapse!important;margin:0!important;font:12px\/1.5 Arial,sans-serif!important}\r\n#ntfs-mft-lab-v13 .nl-cross-matrix th,#ntfs-mft-lab-v13 .nl-cross-matrix td{font:12px\/1.5 Arial,sans-serif!important;letter-spacing:normal!important;text-align:left!important;vertical-align:top!important;white-space:normal!important;overflow-wrap:anywhere!important;word-break:normal!important;padding:6px 7px!important;border:1px solid #aaa!important}\r\n#ntfs-mft-lab-v13 .nl-cross-matrix th{background:#eeeae3;font-weight:600!important}\r\n#ntfs-mft-lab-v13 .nl-cross-matrix th:first-child{width:19%}\r\n#ntfs-mft-lab-v13 details{padding:6px 7px;background:#e2dfd8;border-top:1px solid #aaa;min-width:0}\r\n#ntfs-mft-lab-v13 summary{cursor:pointer;font:12px\/1.5 Tahoma,Arial,sans-serif}\r\n#ntfs-mft-lab-v13 details:not([open])>.nl-detail{display:none}\r\n#ntfs-mft-lab-v13 .nl-detail{padding-top:7px;min-width:0;overflow-wrap:anywhere;font:12px\/1.5 Arial,sans-serif}\r\n#ntfs-mft-lab-v13 .nl-detail p{margin:6px 0;font:12px\/1.5 Arial,sans-serif}\r\n#ntfs-mft-lab-v13 code{font:11px\/1.5 \"DejaVu Sans Mono\",Consolas,monospace!important;white-space:normal!important;overflow-wrap:anywhere!important;background:transparent!important;border:0!important;padding:0!important;color:inherit}\r\n#ntfs-mft-lab-v13 .nl-hashes{font:11px\/1.5 Arial,sans-serif;overflow-wrap:anywhere}\r\n\r\n#ntfs-mft-lab-v13{background:#f3f4f5;border-color:#a7afb8;box-shadow:none}\r\n#ntfs-mft-lab-v13 .nl-title{background:#e4e8ed;color:#202e40;font-size:14px;padding:8px 10px}\r\n#ntfs-mft-lab-v13 .nl-tools{background:#f7f8fa;padding:8px 10px;gap:14px}\r\n#ntfs-mft-lab-v13 .nl-tools label{flex:1 1 230px;font-weight:600}\r\n#ntfs-mft-lab-v13 select{box-shadow:none;border:1px solid #9ca6b4;border-radius:3px;min-height:34px;background:#fff}\r\n#ntfs-mft-lab-v13 .nl-change{margin:10px 10px 0;padding:10px 12px;background:#fff;border:1px solid #a4b4c4;border-left:4px solid #536d88}\r\n#ntfs-mft-lab-v13 .nl-change strong{display:block;font:600 14px\/1.6 Arial,sans-serif}\r\n#ntfs-mft-lab-v13 .nl-change span{display:block;font:12px\/1.6 Arial,sans-serif;color:#424c59}\r\n#ntfs-mft-lab-v13 .nl-change code{font-size:15px!important;font-weight:700!important}\r\n#ntfs-mft-lab-v13 .nl-panes{padding:10px;gap:10px;grid-template-columns:repeat(auto-fit,minmax(min(100%,465px),1fr))}\r\n#ntfs-mft-lab-v13 .nl-pane-title{padding:6px 8px;font-size:13px;background:#e6edf4;border-top:3px solid #53799c}\r\n#ntfs-mft-lab-v13 .nl-pane.nl-current .nl-pane-title{background:#fff0e3;border-top-color:#b75c17}\r\n#ntfs-mft-lab-v13 .nl-meta{padding:5px 8px;background:#fafafa;min-height:44px}\r\n#ntfs-mft-lab-v13 .nl-value{padding:8px;background:#f4f7fa;font:600 13px\/1.5 Arial,sans-serif;border-top:1px solid #ccd4dd;overflow-wrap:anywhere}\r\n#ntfs-mft-lab-v13 .nl-current .nl-value{background:#fff2e7}\r\n#ntfs-mft-lab-v13 .nl-hexgrid .nl-sel{background:#dce8fa!important;color:#193f70!important;font-weight:700!important}\r\n#ntfs-mft-lab-v13 .nl-hexgrid .nl-diff,#ntfs-mft-lab-v13 .nl-hexgrid .nl-sel.nl-diff{background:#ffdac2!important;color:#7a2700!important;border-bottom:2px solid #b64c12!important;outline:none}\r\n#ntfs-mft-lab-v13 .nl-hexgrid .nl-before-diff{background:#d6e7fc!important;color:#123f73!important;border-bottom:2px solid #356b9d!important;font-weight:700!important}\r\n#ntfs-mft-lab-v13 .nl-rule{background:#fff;margin:0 10px;padding:7px 9px;border-left:2px solid #8e9dae;font-size:12px}\r\n#ntfs-mft-lab-v13 .nl-legend{padding:7px 10px}\r\n#ntfs-mft-lab-v13 details{background:#eceff2;padding:7px 10px}\r\n#ntfs-mft-lab-v13 .nl-tech{white-space:normal;overflow-wrap:anywhere;font:12px\/1.6 Arial,sans-serif}\r\n<\/style><div class=\"nl-top\"><div class=\"nl-title\">NTFS MFT \u2014 Before \/ After Comparison<\/div><\/div>\r\n<div class=\"nl-tools\"><label>View <select class=\"nl-scenario\" aria-label=\"View scenario\"><option value=\"0\">S1 \u2014 JPG \u00b7 Before deletion<\/option><option value=\"1\" selected>S2 \u2014 JPG \u00b7 After deletion<\/option><option value=\"2\">S3 \u2014 JPG \u00b7 Record reused<\/option><option value=\"3\">S4 \u2014 JPG \u00b7 Cluster overwritten<\/option><option value=\"4\">S5 \u2014 TXT \u00b7 Before deletion<\/option><option value=\"5\">S6 \u2014 TXT \u00b7 After deletion<\/option><option value=\"6\">S7 \u2014 TXT \u00b7 Record reused<\/option><\/select><\/label><label>Field <select class=\"nl-field\" aria-label=\"Inspect field\"><option value=\"flags\">Record flags<\/option><option value=\"sequence\">Sequence + links<\/option><option value=\"form\">$DATA form<\/option><option value=\"runs\">Data storage<\/option><option value=\"name\">Filename bytes<\/option><\/select><\/label><\/div>\r\n<div class=\"nl-change\" aria-live=\"polite\"><\/div><div class=\"nl-panes\"><\/div><div class=\"nl-rule\"><\/div>\r\n<div class=\"nl-legend\">Blue = before. Orange = changed bytes at the same offset. All offsets are record-relative.<\/div>\r\n<details><summary>Allocation, content checks and addresses<\/summary><div class=\"nl-detail nl-tech\"><\/div><\/details>\r\n<script>(()=>{const root=document.getElementById('ntfs-mft-lab-v13');if(!root||root.dataset.ready)return;root.dataset.ready='1';const D={\"states\":[{\"id\":\"S1\",\"name\":\"Allocated baseline\",\"record\":[70,73,76,69,48,0,3,0,0,0,0,0,0,0,0,0,42,0,1,0,56,0,1,0,104,1,0,0,0,4,0,0,0,0,0,0,0,0,0,0,3,0,0,0,42,0,0,0,170,170,0,0,0,0,0,0,16,0,0,0,96,0,0,0,0,0,0,0,0,0,0,0,72,0,0,0,24,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,32,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,48,0,0,0,128,0,0,0,0,0,0,0,0,0,1,0,98,0,0,0,24,0,1,0,5,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,48,0,0,0,0,0,0,0,40,0,0,0,0,0,0,32,0,0,0,0,0,0,0,16,1,109,0,102,0,116,0,45,0,108,0,97,0,98,0,45,0,102,0,105,0,108,0,101,0,46,0,106,0,112,0,103,0,0,0,0,0,0,0,128,0,0,0,72,0,0,0,1,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,64,0,0,0,0,0,0,0,0,48,0,0,0,0,0,0,0,40,0,0,0,0,0,0,0,40,0,0,0,0,0,0,33,3,0,32,0,0,0,0,255,255,255,255,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"mftbit\":\"04\",\"volbit\":\"07\",\"index\":\"Active: mft-lab-file.jpg\",\"oldmap\":true,\"oldname\":true,\"payload\":[255,216,255,224,0,16,74,70,73,70,0,1,1,0,0,1,0,1,0,0,255,219,0,67,0,16,11,12,14,12,10,16],\"hash\":\"49771d08458eae8b919ba05df91c3a29419644b1d2d5d94fd0d7bbbfd8eede64\",\"remaining\":10240,\"desc\":\"Record 42 allocated; three data clusters allocated; all original content matches.\",\"fileName\":\"mft-lab-file.jpg\",\"recordNumber\":42,\"size\":10240,\"group\":\"jpg\",\"baseIndex\":0,\"form\":1,\"dataOffset\":280,\"mftMask\":\"bit 2\"},{\"id\":\"S2\",\"name\":\"Deletion complete\",\"record\":[70,73,76,69,48,0,3,0,0,0,0,0,0,0,0,0,43,0,0,0,56,0,0,0,104,1,0,0,0,4,0,0,0,0,0,0,0,0,0,0,3,0,0,0,42,0,0,0,170,170,0,0,0,0,0,0,16,0,0,0,96,0,0,0,0,0,0,0,0,0,0,0,72,0,0,0,24,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,32,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,48,0,0,0,128,0,0,0,0,0,0,0,0,0,1,0,98,0,0,0,24,0,1,0,5,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,48,0,0,0,0,0,0,0,40,0,0,0,0,0,0,32,0,0,0,0,0,0,0,16,1,109,0,102,0,116,0,45,0,108,0,97,0,98,0,45,0,102,0,105,0,108,0,101,0,46,0,106,0,112,0,103,0,0,0,0,0,0,0,128,0,0,0,72,0,0,0,1,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,64,0,0,0,0,0,0,0,0,48,0,0,0,0,0,0,0,40,0,0,0,0,0,0,0,40,0,0,0,0,0,0,33,3,0,32,0,0,0,0,255,255,255,255,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"mftbit\":\"00\",\"volbit\":\"00\",\"index\":\"Old name removed from active index\",\"oldmap\":true,\"oldname\":true,\"payload\":[255,216,255,224,0,16,74,70,73,70,0,1,1,0,0,1,0,1,0,0,255,219,0,67,0,16,11,12,14,12,10,16],\"hash\":\"49771d08458eae8b919ba05df91c3a29419644b1d2d5d94fd0d7bbbfd8eede64\",\"remaining\":10240,\"desc\":\"Record 42 free; old mapping retained; the defined data range still matches the original.\",\"fileName\":\"mft-lab-file.jpg\",\"recordNumber\":42,\"size\":10240,\"group\":\"jpg\",\"baseIndex\":0,\"form\":1,\"dataOffset\":280,\"mftMask\":\"bit 2\"},{\"id\":\"S3\",\"name\":\"Record slot reused\",\"record\":[70,73,76,69,48,0,3,0,0,0,0,0,0,0,0,0,43,0,1,0,56,0,1,0,64,1,0,0,0,4,0,0,0,0,0,0,0,0,0,0,3,0,0,0,42,0,0,0,170,170,0,0,0,0,0,0,16,0,0,0,96,0,0,0,0,0,0,0,0,0,0,0,72,0,0,0,24,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,32,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,48,0,0,0,120,0,0,0,0,0,0,0,0,0,1,0,92,0,0,0,24,0,1,0,5,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,10,0,0,0,0,0,0,0,32,0,0,0,0,0,0,0,13,1,110,0,101,0,119,0,45,0,111,0,119,0,110,0,101,0,114,0,46,0,116,0,120,0,116,0,0,0,0,0,128,0,0,0,40,0,0,0,0,0,0,0,0,0,2,0,10,0,0,0,24,0,0,0,78,69,87,32,79,87,78,69,82,10,0,0,0,0,0,0,255,255,255,255,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"mftbit\":\"04\",\"volbit\":\"00\",\"index\":\"Active: new-owner.txt\",\"oldmap\":false,\"oldname\":false,\"payload\":[255,216,255,224,0,16,74,70,73,70,0,1,1,0,0,1,0,1,0,0,255,219,0,67,0,16,11,12,14,12,10,16],\"hash\":\"49771d08458eae8b919ba05df91c3a29419644b1d2d5d94fd0d7bbbfd8eede64\",\"remaining\":10240,\"desc\":\"Record 42 belongs to a new resident file. Old data bytes match, but the current record no longer supplies their mapping.\",\"fileName\":\"new-owner.txt\",\"recordNumber\":42,\"size\":10240,\"group\":\"jpg\",\"baseIndex\":0,\"form\":0,\"dataOffset\":272,\"mftMask\":\"bit 2\"},{\"id\":\"S4\",\"name\":\"Middle cluster overwritten\",\"record\":[70,73,76,69,48,0,3,0,0,0,0,0,0,0,0,0,43,0,0,0,56,0,0,0,104,1,0,0,0,4,0,0,0,0,0,0,0,0,0,0,3,0,0,0,42,0,0,0,170,170,0,0,0,0,0,0,16,0,0,0,96,0,0,0,0,0,0,0,0,0,0,0,72,0,0,0,24,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,32,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,48,0,0,0,128,0,0,0,0,0,0,0,0,0,1,0,98,0,0,0,24,0,1,0,5,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,48,0,0,0,0,0,0,0,40,0,0,0,0,0,0,32,0,0,0,0,0,0,0,16,1,109,0,102,0,116,0,45,0,108,0,97,0,98,0,45,0,102,0,105,0,108,0,101,0,46,0,106,0,112,0,103,0,0,0,0,0,0,0,128,0,0,0,72,0,0,0,1,0,0,0,0,0,2,0,0,0,0,0,0,0,0,0,2,0,0,0,0,0,0,0,64,0,0,0,0,0,0,0,0,48,0,0,0,0,0,0,0,40,0,0,0,0,0,0,0,40,0,0,0,0,0,0,33,3,0,32,0,0,0,0,255,255,255,255,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"mftbit\":\"00\",\"volbit\":\"02\",\"index\":\"Old name remains absent\",\"oldmap\":true,\"oldname\":true,\"payload\":[255,216,255,224,0,16,74,70,73,70,0,1,1,0,0,1,0,1,0,0,255,219,0,67,0,16,11,12,14,12,10,16],\"hash\":\"19d24786a6d8cac837688803869370044a8cf838eb71d48b70d43fe3276489ae\",\"remaining\":6144,\"desc\":\"Another file owns LCN 8193. Its 4,096 overwritten bytes prevent a full original-content match.\",\"fileName\":\"mft-lab-file.jpg\",\"recordNumber\":42,\"size\":10240,\"group\":\"jpg\",\"baseIndex\":0,\"form\":1,\"dataOffset\":280,\"mftMask\":\"bit 2\"},{\"id\":\"S5\",\"name\":\"Resident TXT baseline\",\"record\":[70,73,76,69,48,0,3,0,0,0,0,0,0,0,0,0,7,0,1,0,56,0,1,0,120,1,0,0,0,4,0,0,0,0,0,0,0,0,0,0,3,0,0,0,43,0,0,0,170,170,0,0,0,0,0,0,16,0,0,0,96,0,0,0,0,0,0,0,0,0,0,0,72,0,0,0,24,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,32,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,48,0,0,0,128,0,0,0,0,0,0,0,0,0,1,0,100,0,0,0,24,0,1,0,5,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,64,0,0,0,0,0,0,0,32,0,0,0,0,0,0,0,17,1,114,0,101,0,115,0,105,0,100,0,101,0,110,0,116,0,45,0,110,0,111,0,116,0,101,0,46,0,116,0,120,0,116,0,0,0,0,0,128,0,0,0,88,0,0,0,0,0,0,0,0,0,2,0,64,0,0,0,24,0,0,0,82,101,115,105,100,101,110,116,32,84,88,84,58,32,99,111,110,116,101,110,116,32,115,116,97,121,115,32,105,110,115,105,100,101,32,116,104,105,115,32,77,70,84,32,114,101,99,111,114,100,46,13,10,32,32,32,32,32,32,32,32,32,32,32,255,255,255,255,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"mftbit\":\"08\",\"volbit\":\"unchanged\",\"index\":\"Active: resident-note.txt\",\"oldmap\":false,\"oldname\":true,\"payload\":[82,101,115,105,100,101,110,116,32,84,88,84,58,32,99,111,110,116,101,110,116,32,115,116,97,121,115,32,105,110,115,105],\"hash\":\"4ba27711cc0f655772a257c6bc2e2f2968eecb5d96dd48fa36475ef2e1f001fd\",\"remaining\":64,\"desc\":\"The 64 original bytes are inside record 43 at +0x130\\u2013+0x16F. No external clusters belong to this data stream.\",\"fileName\":\"resident-note.txt\",\"recordNumber\":43,\"size\":64,\"group\":\"txt\",\"baseIndex\":4,\"form\":0,\"dataOffset\":280,\"mftMask\":\"bit 3\"},{\"id\":\"S6\",\"name\":\"Resident TXT deleted\",\"record\":[70,73,76,69,48,0,3,0,0,0,0,0,0,0,0,0,8,0,0,0,56,0,0,0,120,1,0,0,0,4,0,0,0,0,0,0,0,0,0,0,3,0,0,0,43,0,0,0,170,170,0,0,0,0,0,0,16,0,0,0,96,0,0,0,0,0,0,0,0,0,0,0,72,0,0,0,24,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,32,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,48,0,0,0,128,0,0,0,0,0,0,0,0,0,1,0,100,0,0,0,24,0,1,0,5,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,64,0,0,0,0,0,0,0,32,0,0,0,0,0,0,0,17,1,114,0,101,0,115,0,105,0,100,0,101,0,110,0,116,0,45,0,110,0,111,0,116,0,101,0,46,0,116,0,120,0,116,0,0,0,0,0,128,0,0,0,88,0,0,0,0,0,0,0,0,0,2,0,64,0,0,0,24,0,0,0,82,101,115,105,100,101,110,116,32,84,88,84,58,32,99,111,110,116,101,110,116,32,115,116,97,121,115,32,105,110,115,105,100,101,32,116,104,105,115,32,77,70,84,32,114,101,99,111,114,100,46,13,10,32,32,32,32,32,32,32,32,32,32,32,255,255,255,255,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"mftbit\":\"00\",\"volbit\":\"unchanged\",\"index\":\"Original name removed\",\"oldmap\":false,\"oldname\":true,\"payload\":[82,101,115,105,100,101,110,116,32,84,88,84,58,32,99,111,110,116,101,110,116,32,115,116,97,121,115,32,105,110,115,105],\"hash\":\"4ba27711cc0f655772a257c6bc2e2f2968eecb5d96dd48fa36475ef2e1f001fd\",\"remaining\":64,\"desc\":\"Record 43 is free, while its 64 resident content bytes remain in this defined state. No separate data clusters are released.\",\"fileName\":\"resident-note.txt\",\"recordNumber\":43,\"size\":64,\"group\":\"txt\",\"baseIndex\":4,\"form\":0,\"dataOffset\":280,\"mftMask\":\"bit 3\"},{\"id\":\"S7\",\"name\":\"Resident record reused\",\"record\":[70,73,76,69,48,0,3,0,0,0,0,0,0,0,0,0,8,0,1,0,56,0,1,0,120,1,0,0,0,4,0,0,0,0,0,0,0,0,0,0,3,0,0,0,43,0,0,0,170,170,0,0,0,0,0,0,16,0,0,0,96,0,0,0,0,0,0,0,0,0,0,0,72,0,0,0,24,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,32,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,48,0,0,0,128,0,0,0,0,0,0,0,0,0,1,0,98,0,0,0,24,0,1,0,5,0,0,0,0,0,1,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,64,0,0,0,0,0,0,0,32,0,0,0,0,0,0,0,16,1,114,0,101,0,112,0,108,0,97,0,99,0,101,0,109,0,101,0,110,0,116,0,49,0,46,0,116,0,120,0,116,0,0,0,0,0,0,0,128,0,0,0,88,0,0,0,0,0,0,0,0,0,2,0,64,0,0,0,24,0,0,0,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,126,255,255,255,255,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0],\"mftbit\":\"08\",\"volbit\":\"unchanged\",\"index\":\"Active: replacement1.txt\",\"oldmap\":false,\"oldname\":false,\"payload\":[82,101,115,105,100,101,110,116,32,84,88,84,58,32,99,111,110,116,101,110,116,32,115,116,97,121,115,32,105,110,115,105],\"hash\":\"1049f7787008516a44e781e66f45beb7ee7e773124c98e0f8456366a7e9d1113\",\"remaining\":0,\"desc\":\"The replacement resident value occupies the same +0x130\\u2013+0x16F range. All 64 original bytes differ.\",\"fileName\":\"replacement1.txt\",\"recordNumber\":43,\"size\":64,\"group\":\"txt\",\"baseIndex\":4,\"form\":0,\"dataOffset\":280,\"mftMask\":\"bit 3\"}],\"fields\":{\"flags\":{\"label\":\"Record flags\",\"start\":0,\"end\":192,\"hi\":[22,24],\"note\":\"Record-relative +0x16, 2 bytes: 01 00 \\u2192 00 00. Bit 0 is the in-use flag; sequence and link count also change.\"},\"sequence\":{\"label\":\"Sequence + links\",\"start\":0,\"end\":192,\"hi\":[16,20],\"note\":\"Record-relative +0x10: 2A 00 \\u2192 2B 00 (42 \\u2192 43). +0x12: links 01 00 \\u2192 00 00. Old references to sequence 42 become stale.\"},\"runs\":{\"label\":\"Data mapping\",\"start\":272,\"end\":368,\"hi\":[344,349],\"note\":\"S1\/S2\/S4: mapping pairs at +0x158 = 21 03 00 20 00. One run maps VCN 0\\u20132 to LCN 8192\\u20138194. S3 replaces the old attribute layout.\"},\"name\":{\"label\":\"Filename bytes\",\"start\":224,\"end\":320,\"hi\":[242,274],\"note\":\"S1\/S2\/S4: UTF-16LE filename starts at +0xF2. The active directory index is a separate structure. S3 replaces this name.\"},\"form\":{\"label\":\"$DATA form\",\"start\":272,\"end\":336,\"hi\":[288,289],\"note\":\"The $DATA attribute starts at record +0x118. Its FormCode at +0x120 is 01 for the JPG and 00 for the resident TXT.\"}},\"hash\":\"49771d08458eae8b919ba05df91c3a29419644b1d2d5d94fd0d7bbbfd8eede64\",\"partialHash\":\"19d24786a6d8cac837688803869370044a8cf838eb71d48b70d43fe3276489ae\",\"txtHash\":\"4ba27711cc0f655772a257c6bc2e2f2968eecb5d96dd48fa36475ef2e1f001fd\",\"txtReusedHash\":\"1049f7787008516a44e781e66f45beb7ee7e773124c98e0f8456366a7e9d1113\"};let field='flags',scenario=1;\r\nconst q=s=>root.querySelector(s),esc=s=>String(s).replace(\/[&<>\"']\/g,c=>({'&':'&amp;','<':'&lt;','>':'&gt;','\"':'&quot;',\"'\":'&#39;'}[c])),hx=n=>n.toString(16).toUpperCase().padStart(2,'0'),bytes=a=>a.map(hx).join(' '),word=(s,p)=>s.record[p]+256*s.record[p+1];\r\nlet rowBytes=16;\r\nfunction spec(s){let f={...D.fields[field]};if(field==='flags')f={start:0x10,end:0x30,hi:[0x16,0x18]};if(field==='sequence')f={start:0x10,end:0x30,hi:[0x10,0x14]};if(s.id==='S3'&&field==='form')f.hi=[0x118,0x119];if(s.id==='S3'&&field==='runs')f={start:0x110,end:0x170,hi:[0x128,0x132]};if(s.id==='S3'&&field==='name')f.hi=[0xF2,0x10C];if(s.group==='txt'){if(field==='runs')f={start:0x110,end:0x170,hi:[0x130,0x170]};if(field==='name')f.hi=[0xF2,0xF2+s.fileName.length*2];}return f;}\r\nfunction value(s){const f=spec(s);if(field==='flags')return bytes(s.record.slice(22,24))+' \u00b7 '+(word(s,22)&1?'IN USE':'FREE');if(field==='sequence')return 'Sequence '+word(s,16)+' \u00b7 Links '+word(s,18);if(field==='form')return 'FormCode '+hx(s.form)+' \u00b7 '+(s.form?'Nonresident':'Resident');if(field==='name')return s.fileName;if(s.group==='txt')return 'Resident value \u00b7 '+s.remaining+' \/ 64 original bytes match';return 'Old runlist '+(s.oldmap?'retained':'replaced')+' \u00b7 '+s.remaining.toLocaleString('en-US')+' \/ 10,240 external bytes match';}\r\nfunction hex(s,peer,left,start,end){const f=spec(s),n=rowBytes;let h='<table class=\"nl-hexgrid'+(n===8?' nl-hex-eight':'')+'\" aria-label=\"'+(left?'Before':'Selected scenario')+' MFT hex\"><colgroup><col class=\"nl-offset-col\">'+Array(n).fill('<col>').join('')+'<col class=\"nl-ascii-col\"><\/colgroup><thead><tr><th class=\"nl-offset\">OFFSET<\/th>';for(let i=0;i<n;i++)h+='<th>'+hx(i)+'<\/th>';h+='<th class=\"nl-ascii\">ASCII<\/th><\/tr><\/thead><tbody>';for(let p=start;p<end;p+=n){h+='<tr><td class=\"nl-offset\">'+p.toString(16).toUpperCase().padStart(8,'0')+'<\/td>';let ascii='';for(let i=p;i<p+n;i++){const v=s.record[i],different=v!==peer.record[i],sel=i>=f.hi[0]&&i<f.hi[1];const cl=different?(left?'nl-before-diff':'nl-diff'):(sel?'nl-sel':'');h+='<td data-offset=\"'+i+'\" class=\"'+cl+'\" title=\"Record +0x'+i.toString(16).toUpperCase()+(different?' \u00b7 '+hx(peer.record[i])+' \/ '+hx(v):'')+'\">'+hx(v)+'<\/td>';ascii+=v>=32&&v<127?String.fromCharCode(v):'.';}h+='<td class=\"nl-ascii\">'+esc(ascii)+'<\/td><\/tr>';}return h+'<\/tbody><\/table>';}\r\nfunction pane(s,peer,left,start,end){const stage=s.id==='S1'||s.id==='S5'?'Before deletion':s.id==='S2'||s.id==='S6'?'After deletion':s.id==='S4'?'After cluster overwrite':'After record reuse';return '<div class=\"nl-pane'+(left?'':' nl-current')+'\"><div class=\"nl-pane-title\">'+(left?'BEFORE DELETION':'SELECTED: '+stage.toUpperCase())+' \u00b7 '+s.id+'<\/div><div class=\"nl-meta\">Record '+s.recordNumber+' \u00b7 '+esc(s.fileName)+'<br>'+D.fields[field].label+' \u00b7 '+(left?'Original baseline':'Compared with '+peer.id)+'<\/div><div class=\"nl-scroll\">'+hex(s,peer,left,start,end)+'<\/div><div class=\"nl-value\">'+esc(value(s))+'<\/div><\/div>';}\r\nfunction render(){const s=D.states[scenario],b=D.states[s.baseIndex];rowBytes=root.getBoundingClientRect().width<560?8:16;const a=spec(b),c=spec(s),start=Math.min(a.start,c.start),end=Math.max(a.end,c.end);q('.nl-panes').innerHTML=pane(b,s,true,start,end)+pane(s,b,false,start,end);\r\nlet title='',note='';if(s.id==='S1'||s.id==='S5'){title=s.id+' \u2014 Before deletion (baseline)';note='Both panes show the same baseline. Select '+(s.group==='txt'?'S6':'S2')+' to see deletion changes.';}else if(s.id==='S2'||s.id==='S6'){title='Record flags at +0x16: <code>01 00 \u2192 00 00<\/code>';note='IN USE \u2192 FREE. The record is released; '+(s.group==='txt'?'its 64 resident content bytes remain.':'its runlist and 10,240 external content bytes remain.');}else if(s.id==='S3'){title='Record reused: JPG mapping replaced';note='The new owner is new-owner.txt. All 10,240 original JPG bytes still match in the separately checked external range.';}else if(s.id==='S4'){title='External JPG content: 10,240 \u2192 6,144 matching bytes';note='The MFT record matches S2, but the middle data cluster differs in all 4,096 bytes. This damage is outside the displayed MFT record.';}else{title='Resident TXT content: 64 \u2192 0 matching bytes';note='The new owner replaces the original content inside the same MFT record.';}\r\nq('.nl-change').innerHTML='<strong>'+title+'<\/strong><span>'+note+'<\/span>';\r\nlet rule='';if(field==='flags')rule='At +0x16, bit 0 indicates record allocation. Reuse sets it again, so a reused record can have the same flags as the original.';if(field==='sequence')rule='Sequence and link values: '+value(b)+' \u2192 '+value(s)+'. These are the values in this sample.';if(field==='form')rule=s.id==='S3'?'The JPG\u2019s original FormCode is at +0x120; the replacement owner\u2019s FormCode is at +0x118 because the attribute layout moved.':'FormCode at +0x120: 00 = resident; 01 = nonresident. Deletion alone does not change this byte.';if(field==='name')rule='These are filename bytes inside the MFT record. Removing the active directory entry does not require clearing these bytes.';if(field==='runs')rule=s.group==='txt'?'Content is stored at record +0x130\u2013+0x16F. Orange bytes identify replacement of the resident value.':s.id==='S3'?'The old JPG runlist at +0x158 has been replaced. The new owner has resident data; original JPG content is checked outside this record.':'Runlist at +0x158: 21 03 00 20 00 \u2192 LCN 8192\u20138194. Unchanged mapping bytes do not prove unchanged external content.';\r\nq('.nl-rule').textContent=rule;\r\nq('.nl-detail').innerHTML='S'+(s.baseIndex+1)+' \u2192 '+s.id+' \u00b7 '+(s.group==='txt'?'TXT, 64 bytes':'JPG, 10,240 bytes')+'<br>$MFT::$BITMAP +0x05: <code>'+b.mftbit+' \u2192 '+s.mftbit+'<\/code> ('+s.mftMask+')<br>'+(s.group==='txt'?'No external payload clusters.':'Volume $Bitmap::$DATA +0x0400: <code>'+b.volbit+' \u2192 '+s.volbit+'<\/code><br>Original external range: volume +0x02000000 \/ disk +0x02100000.')+'<br>Active directory: '+esc(b.index)+' \u2192 '+esc(s.index)+'<br>Original content bytes matching: '+s.remaining.toLocaleString('en-US')+' \/ '+s.size.toLocaleString('en-US')+'<br>Current content SHA-256: <code>'+s.hash+'<\/code><br>Original SHA-256: <code>'+b.hash+'<\/code><br>S3 and S4 branch independently from S2. TXT follows S5 \u2192 S6 \u2192 S7. Counts describe the generated samples.';\r\n}\r\nq('.nl-scenario').addEventListener('change',e=>{scenario=Number(e.target.value);field=scenario===2||scenario===6?'runs':'flags';q('.nl-field').value=field;render();});q('.nl-field').addEventListener('change',e=>{field=e.target.value;render();});render();let previousWidth=root.getBoundingClientRect().width;if(typeof ResizeObserver!=='undefined')new ResizeObserver(()=>{const w=root.getBoundingClientRect().width;if(w!==previousWidth){previousWidth=w;render();}}).observe(root);\r\n})();<\/script><\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-79qgftc elementor-widget elementor-widget-text-editor\" data-id=\"79qgftc\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<h3>Before Deletion: Where Are the File Contents?<\/h3><p>The 64-byte TXT has FormCode <code class=\"dtec-inline-code\">00<\/code> at record <code class=\"dtec-inline-code\">+0x120<\/code>. Its complete contents occupy <code class=\"dtec-inline-code\">+0x130\u2013+0x16F<\/code> inside the MFT record. The 10,240-byte JPG has FormCode <code class=\"dtec-inline-code\">01<\/code>; its record holds mapping pairs at <code class=\"dtec-inline-code\">+0x158<\/code>, while the image bytes occupy external clusters 8192\u20138194.<\/p><p><strong>Resident TXT<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-aj1srwr elementor-widget elementor-widget-image\" data-id=\"aj1srwr\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.amagicsoft.com\/wp-content\/uploads\/2026\/11\/ntfs-resident-txt-before.webp\" title=\"\" alt=\"ntfs-txt-file-before-deletion\" loading=\"lazy\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-fcm8h3m elementor-widget elementor-widget-text-editor\" data-id=\"fcm8h3m\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><em>S5: The selected text is the file content itself, stored inside record 43.<\/em><\/p>\n<p><strong>Nonresident JPG<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-m7sqpe7 elementor-widget elementor-widget-image\" data-id=\"m7sqpe7\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.amagicsoft.com\/wp-content\/uploads\/2026\/11\/ntfs-mft-before-deletion.webp\" title=\"\" alt=\"ntfs-jpg-before-deletion\" loading=\"lazy\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-p6wlt9p elementor-widget elementor-widget-text-editor\" data-id=\"p6wlt9p\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><em>S1: Record 42 stores the nonresident attribute and runlist; the JPEG content is at the external location described by that mapping.<\/em><\/p>\n<h3>After Deletion: What Is Freed, and What Remains?<\/h3>\n<p>Both records lose their in-use bit. For the TXT, the defined deletion state retains all 64 bytes inside the freed record; this resident stream has no separate payload clusters to release. For the JPG, deletion also releases its three external data clusters. The defined S2 state retains both the old runlist and all 10,240 external content bytes.<\/p>\n<p><strong>Resident TXT<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-zkm8p0u elementor-widget elementor-widget-image\" data-id=\"zkm8p0u\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.amagicsoft.com\/wp-content\/uploads\/2026\/11\/ntfs-resident-txt-deleted.webp\" title=\"\" alt=\"ntfs-txt-file-after-deleted\" loading=\"lazy\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-mwntogm elementor-widget elementor-widget-text-editor\" data-id=\"mwntogm\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><em>S6: Flags become 00 00, but the selected resident content is unchanged from S5.<\/em><\/p>\n<p><strong>Nonresident JPG<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-o134v9m elementor-widget elementor-widget-image\" data-id=\"o134v9m\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.amagicsoft.com\/wp-content\/uploads\/2026\/11\/ntfs-mft-after-deletion.webp\" title=\"\" alt=\"ntfs-jpg-file-after-after-deletion\" loading=\"lazy\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-cvbkq49 elementor-widget elementor-widget-text-editor\" data-id=\"cvbkq49\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<div><div><p class=\"otl-paragraph\"><i>S2: Flags become <\/i><code><i>00 00<\/i><\/code><i>, while the record retains its mapping. The external content check in the HTML reports 10,240 matching bytes.<\/i><\/p><h3 class=\"otl-heading\">After Record Reuse: What Does the Same Operation Destroy?<\/h3><p class=\"otl-paragraph\">In the TXT control, the replacement owner writes 64 tilde characters over the same resident-value range. All 64 original bytes in that range differ. In the JPG control, the replacement owner removes the original record\u2019s mapping, but the defined operation leaves the external image data unchanged. Thus the JPG loses its old map while its data survives elsewhere; the TXT loses its original content within the reused record.<\/p><p class=\"otl-paragraph\"><strong>Resident TXT<\/strong><\/p><\/div><\/div>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9gu5fg4 elementor-widget elementor-widget-image\" data-id=\"9gu5fg4\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.amagicsoft.com\/wp-content\/uploads\/2026\/11\/ntfs-resident-txt-reused.webp\" title=\"\" alt=\"ntfs-resident-txt-reused\" loading=\"lazy\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-c0t5mk7 elementor-widget elementor-widget-text-editor\" data-id=\"c0t5mk7\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><em>S7: The same selected range now contains replacement text. Original resident content matching that range: 0 \/ 64 bytes.<\/em><\/p>\n<p><strong>Nonresident JPG<\/strong><\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-zylr4et elementor-widget elementor-widget-image\" data-id=\"zylr4et\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"image.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<img decoding=\"async\" src=\"https:\/\/www.amagicsoft.com\/wp-content\/uploads\/2026\/11\/ntfs-nonresident-jpg-reused.webp\" title=\"\" alt=\"ntfs-nonresident-jpg-reused\" loading=\"lazy\" \/>\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-ojlimic elementor-widget elementor-widget-text-editor\" data-id=\"ojlimic\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p><em>S3: Record 42 now describes <\/em><code class=\"dtec-inline-code\"><em>new-owner.txt<\/em><\/code><em>; the original JPG mapping is gone. The separately checked original external range still matches all 10,240 JPG bytes.<\/em><\/p>\n<p>These are two different failure paths after the same kind of record reuse. A recovery assessment must check the resident value inside the TXT\u2019s record, but it must check both historical mapping and external contents for the JPG. The record itself still occupies space within <code class=\"dtec-inline-code\">$MFT<\/code>; \u201cno external clusters\u201d describes the resident TXT data stream only.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-5ocfab2 elementor-widget elementor-widget-heading\" data-id=\"5ocfab2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">NTFS Deletion Metadata Experiment Results<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-pr2w052 elementor-widget elementor-widget-text-editor\" data-id=\"pr2w052\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>For the JPG, S2 retains both the old map and all original content by construction. Reading the mapped clusters and trimming to 10,240 bytes produces a full byte-for-byte match and the same SHA-256 digest. That establishes content identity for this generated sample. However, this NTFS deleted file MFT test does not measure any application\u2019s recovery performance.<\/p>\n<p>S3 separates content survival from metadata survival. The original data bytes still match, but the current record belongs to a different file and no longer holds the original runlist. The saved baseline identifies where those bytes used to be; that knowledge is a comparison reference, not metadata available from the reused record. Other surviving structures or content analysis would be needed to locate and identify the old stream independently.<\/p>\n<p>S4 demonstrates the opposite problem. The original filename and map remain in the freed record, but its middle cluster contains replacement bytes. Only 6,144 original bytes match; 4,096 differ. Reading the complete old range still produces a 10,240-byte result, yet its digest fails the original-content check. A correct filename and file length can therefore accompany damaged content. JPEG viewing behavior is a separate check from byte-for-byte identity.<\/p>\n<p>For the TXT, S6 retains all 64 resident content bytes. In S7, none of those bytes match the replacement value. This is a content loss within the defined record replacement, without overwriting an external data cluster.<\/p>\n<p>The NTFS deleted file MFT test above pairs the TXT and JPG at the same stage. Its other views retain the per-file before-and-after checks, while the details provide the calculated content digests.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-qwhddso elementor-widget elementor-widget-heading\" data-id=\"qwhddso\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">Why Deleted File MFT Flags Cannot Prove Recoverability<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-wpyc6y2 elementor-widget elementor-widget-text-editor\" data-id=\"wpyc6y2\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>A useful assessment needs three separate checks. First, establish the file\u2019s identity from coherent metadata. Next, interpret its storage attributes, including resident-value boundaries, external mappings, and any additional records or streams. Finally, verify the contents available from those ranges. The generated scenarios deliberately let those checks produce different answers.<\/p>\n<p>The two targets require different content checks. The resident TXT keeps its payload inside its record; the nonresident JPG relies on mapping information to reach external clusters. In S3, the new owner is resident to isolate record reuse from reuse of the JPG\u2019s old data clusters. S5\u2013S7 separately demonstrate what happens when the deleted target itself has resident data. Fragmented, compressed, encrypted, and sparse streams introduce additional interpretation requirements.<\/p>\n<p>Nor should a tool equate an unused record with an intact deleted file automatically. Structural validity, allocation state, ownership, mapping consistency, and readable content answer different questions. Even a valid text fragment does not establish that a document, photograph, or video is complete.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-g2zi1df elementor-widget elementor-widget-heading\" data-id=\"g2zi1df\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">What File Explorer and Disk Management Can Show<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-jxtwo46 elementor-widget elementor-widget-text-editor\" data-id=\"jxtwo46\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>After final deletion, the original name should disappear from normal directory enumeration. Free space can increase once the file system releases its allocation, although unrelated activity can change the displayed total.<\/p>\n<p>Ordinary deletion of one file does not turn an otherwise healthy NTFS volume into RAW or unallocated space. Disk Management describes volumes and partitions; it does not expose individual MFT record flags. A RAW label or missing partition therefore calls for a separate file-system or partition diagnosis, rather than being treated as confirmation of this deletion mechanism.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-bfno5oj elementor-widget elementor-widget-heading\" data-id=\"bfno5oj\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">When File Recovery Comes Before File-System Repair<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-9sbnaz5 elementor-widget elementor-widget-text-editor\" data-id=\"9sbnaz5\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>If the volume still works and only files are missing, repair is not the first explanation or action. Continued writes can reuse both freed records and freed clusters. Avoid installing tools, saving recovered files, or running unnecessary repair operations on the affected volume. Examine a suitable preserved copy when possible and save recovered content elsewhere.<\/p>\n<p>For a practical check, <a href=\"https:\/\/www.amagicsoft.com\/magic-data-recovery\">Magic Data Recovery<\/a> can scan the affected drive and preview supported files before recovery. Install it on another drive and save recovered files elsewhere; the software cannot recover content that later writes have overwritten.<\/p>\n<p>SSD behavior adds another condition. The <a href=\"https:\/\/www.amagicsoft.com\/wiki\/trim-command-ssd-how-to-use.html\">TRIM command<\/a> can notify storage that released logical ranges are no longer needed. Microsoft\u2019s read-only query <code class=\"dtec-inline-code\">fsutil behavior query DisableDeleteNotify<\/code> <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows-server\/administration\/windows-commands\/fsutil-behavior\" rel=\"nofollow\">reports the notification setting<\/a>; it does not prove that a specific range retains its bytes.<\/p>\n<p>If the original logical ranges return zeros or replacement content, a surviving MFT name cannot supply the missing nonresident payload. Conversely, readable old bytes still require correct mapping and content validation. Disabling notifications later does not reverse notifications already issued.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-visiw0r elementor-widget elementor-widget-heading\" data-id=\"visiw0r\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">NTFS Deleted File MFT Test: Conclusion<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-8esi5ct elementor-widget elementor-widget-text-editor\" data-id=\"8esi5ct\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t\t\t<p>This <strong>NTFS deleted file MFT test<\/strong> separates record allocation, data mapping, and content integrity. In the JPG\u2019s retained-metadata scenario, deletion frees the record and clusters while the original content still matches. However, record reuse removes the old map without changing those data bytes, and a cluster overwrite damages content while leaving the old name and map available.<\/p>\n<p>The resident TXT control adds a different failure path: deleting its record leaves the defined 64-byte value intact, but reusing that record replaces the value itself. The JPG instead requires separate checks of its record and external data.<\/p>\n<p>The practical conclusion is to verify each layer independently. A filename identifies a candidate; a resident-value offset or nonresident runlist identifies its content location; a complete content check determines whether that location still reproduces the original stream. That distinction explains why a deleted file can appear in a scan yet fail to open correctly after extraction.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-z4uquvd elementor-widget elementor-widget-heading\" data-id=\"z4uquvd\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"heading.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<h2 class=\"elementor-heading-title elementor-size-default\">FAQ<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<div class=\"elementor-element elementor-element-hfd4uy8 faq-no-toc dtec-faq elementor-widget elementor-widget-elementskit-faq\" data-id=\"hfd4uy8\" data-element_type=\"widget\" data-e-type=\"widget\" data-widget_type=\"elementskit-faq.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t<div class=\"ekit-wid-con\" >\n                <div class=\"elementskit-single-faq elementor-repeater-item-dl9arih\">\n            <div class=\"elementskit-faq-header\">\n                <h3 class=\"elementskit-faq-title\">Do MFT Flags of 0x0002 Identify a Deleted File?<\/h3>\n            <\/div>\n            <div class=\"elementskit-faq-body\">\n                It means the in-use bit is clear while the directory-related bit is set. Interpret the individual bits and the record type. Do not assume every unused record has a flags word of exactly zero.            <\/div>\n        <\/div>\n                <div class=\"elementskit-single-faq elementor-repeater-item-5d491dg\">\n            <div class=\"elementskit-faq-header\">\n                <h3 class=\"elementskit-faq-title\">Does the FILE Signature Validate an NTFS MFT Record?<\/h3>\n            <\/div>\n            <div class=\"elementskit-faq-body\">\n                No. A parser also needs plausible structure lengths, attribute boundaries, and valid update-sequence protection where applicable. The signature identifies a candidate structure; it does not establish that every field is intact or belongs to the same historical file.            <\/div>\n        <\/div>\n                <div class=\"elementskit-single-faq elementor-repeater-item-rjgmai3\">\n            <div class=\"elementskit-faq-header\">\n                <h3 class=\"elementskit-faq-title\">Does the Sequence Number Reveal How Many Times a File Was Deleted?<\/h3>\n            <\/div>\n            <div class=\"elementskit-faq-body\">\n                No. It concerns the lifecycle of a record slot. That slot can describe different files over time. A sequence value alone cannot count deletions of one named file or determine when a deletion occurred.            <\/div>\n        <\/div>\n                <div class=\"elementskit-single-faq elementor-repeater-item-7dwpozl\">\n            <div class=\"elementskit-faq-header\">\n                <h3 class=\"elementskit-faq-title\">Can a Free Cluster Be Assigned to a Deleted File by Its Bitmap Bit Alone?<\/h3>\n            <\/div>\n            <div class=\"elementskit-faq-body\">\n                No. A free bit describes current allocation, without identifying a previous owner. Associating content with an old file requires coherent historical metadata or other evidence, followed by validation of the candidate contents.            <\/div>\n        <\/div>\n                <div class=\"elementskit-single-faq elementor-repeater-item-ab2p926\">\n            <div class=\"elementskit-faq-header\">\n                <h3 class=\"elementskit-faq-title\">Does Deleting One Hard Link Always Release the File\u2019s Data?<\/h3>\n            <\/div>\n            <div class=\"elementskit-faq-body\">\n                No. Other hard links can still reference the same underlying file. This experiment selects single-link targets and completed deletion so that removing the final name can release its record and data allocation.            <\/div>\n        <\/div>\n                <div class=\"elementskit-single-faq elementor-repeater-item-2u16lvt\">\n            <div class=\"elementskit-faq-header\">\n                <h3 class=\"elementskit-faq-title\">Does a Correct Extension Prove That Extracted Content Is Valid?<\/h3>\n            <\/div>\n            <div class=\"elementskit-faq-body\">\n                No. The extension comes from the name, which may survive independently of the payload. Validate the content\u2019s structure and open it in an appropriate application. When an original reference is available, compare the full file rather than only its header.            <\/div>\n        <\/div>\n                                <script type=\"application\/ld+json\">{\"@context\":\"https:\/\/schema.org\",\"@type\":\"FAQPage\",\"mainEntity\":[{\"@type\":\"Question\",\"name\":\"Do MFT Flags of 0x0002 Identify a Deleted File?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"It means the in-use bit is clear while the directory-related bit is set. Interpret the individual bits and the record type. Do not assume every unused record has a flags word of exactly zero.\"}},{\"@type\":\"Question\",\"name\":\"Does the FILE Signature Validate an NTFS MFT Record?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"No. A parser also needs plausible structure lengths, attribute boundaries, and valid update-sequence protection where applicable. The signature identifies a candidate structure; it does not establish that every field is intact or belongs to the same historical file.\"}},{\"@type\":\"Question\",\"name\":\"Does the Sequence Number Reveal How Many Times a File Was Deleted?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"No. It concerns the lifecycle of a record slot. That slot can describe different files over time. A sequence value alone cannot count deletions of one named file or determine when a deletion occurred.\"}},{\"@type\":\"Question\",\"name\":\"Can a Free Cluster Be Assigned to a Deleted File by Its Bitmap Bit Alone?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"No. A free bit describes current allocation, without identifying a previous owner. Associating content with an old file requires coherent historical metadata or other evidence, followed by validation of the candidate contents.\"}},{\"@type\":\"Question\",\"name\":\"Does Deleting One Hard Link Always Release the File\u2019s Data?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"No. Other hard links can still reference the same underlying file. This experiment selects single-link targets and completed deletion so that removing the final name can release its record and data allocation.\"}},{\"@type\":\"Question\",\"name\":\"Does a Correct Extension Prove That Extracted Content Is Valid?\",\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"No. The extension comes from the name, which may survive independently of the payload. Validate the content\u2019s structure and open it in an appropriate application. When an original reference is available, compare the full file rather than only its header.\"}}]}<\/script>\n                \n    <\/div>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>An NTFS deleted file MFT test needs to compare more than a filename. Once final deletion completes, NTFS can release the file record, remove its active directory entry, and free its nonresident data clusters. However, those changes do not necessarily erase the old contents. This experiment compares a small resident TXT with a nonresident JPG through deletion and record reuse, then examines a defined overwrite of the JPG\u2019s external data. The comparison separates three questions: does the name survive, does its mapping survive, and do the original bytes still match? Table of Contents What This NTFS Deleted File MFT Test Examines The core question is whether a deleted MFT record [&hellip;]<\/p>\n","protected":false},"author":6,"featured_media":58111,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[843],"tags":[841],"class_list":["post-58110","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-lab","tag-knowledge-base"],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v25.0 (Yoast SEO v27.9) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>NTFS Deleted File MFT Test | Amagicsoft<\/title>\n<meta name=\"description\" content=\"Compare resident TXT and nonresident JPG files in an NTFS deleted file MFT test. See hex changes after deletion and MFT record reuse.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.amagicsoft.com\/jp\/kb\/lab\/ntfs-deleted-file-mft-test.html\" \/>\n<meta property=\"og:locale\" content=\"ja_JP\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"NTFS Deleted File MFT Test: What Changes After Deletion?\" \/>\n<meta property=\"og:description\" content=\"Compare resident TXT and nonresident JPG files in an NTFS deleted file MFT test. See hex changes after deletion and MFT record reuse.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.amagicsoft.com\/jp\/kb\/lab\/ntfs-deleted-file-mft-test.html\" \/>\n<meta property=\"og:site_name\" content=\"Amagicsoft\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/amagicsoft.2024\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-11-05T10:08:58+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.amagicsoft.com\/wp-content\/uploads\/2026\/11\/ntfs-deleted-file-mft-test.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1350\" \/>\n\t<meta property=\"og:image:height\" content=\"760\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/webp\" \/>\n<meta name=\"author\" content=\"Vasilii\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@Amagicsoft\" \/>\n<meta name=\"twitter:site\" content=\"@Amagicsoft\" \/>\n<meta name=\"twitter:label1\" content=\"\u57f7\u7b46\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"Vasilii\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u63a8\u5b9a\u8aad\u307f\u53d6\u308a\u6642\u9593\" \/>\n\t<meta name=\"twitter:data2\" content=\"15\u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.amagicsoft.com\\\/kb\\\/lab\\\/ntfs-deleted-file-mft-test.html#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.amagicsoft.com\\\/kb\\\/lab\\\/ntfs-deleted-file-mft-test.html\"},\"author\":{\"name\":\"Vasilii\",\"@id\":\"https:\\\/\\\/www.amagicsoft.com\\\/zh\\\/#\\\/schema\\\/person\\\/5cc725a7bfa9bc0e962db26a19dfb8c2\"},\"headline\":\"NTFS Deleted File MFT Test: What Changes After Deletion?\",\"datePublished\":\"2026-11-05T10:08:58+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.amagicsoft.com\\\/kb\\\/lab\\\/ntfs-deleted-file-mft-test.html\"},\"wordCount\":2938,\"publisher\":{\"@id\":\"https:\\\/\\\/www.amagicsoft.com\\\/zh\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.amagicsoft.com\\\/kb\\\/lab\\\/ntfs-deleted-file-mft-test.html#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.amagicsoft.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/ntfs-deleted-file-mft-test.webp\",\"keywords\":[\"Knowledge Base\"],\"articleSection\":[\"Recovery Lab\"],\"inLanguage\":\"ja\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.amagicsoft.com\\\/kb\\\/lab\\\/ntfs-deleted-file-mft-test.html\",\"url\":\"https:\\\/\\\/www.amagicsoft.com\\\/kb\\\/lab\\\/ntfs-deleted-file-mft-test.html\",\"name\":\"NTFS Deleted File MFT Test | Amagicsoft\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.amagicsoft.com\\\/zh\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.amagicsoft.com\\\/kb\\\/lab\\\/ntfs-deleted-file-mft-test.html#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.amagicsoft.com\\\/kb\\\/lab\\\/ntfs-deleted-file-mft-test.html#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.amagicsoft.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/ntfs-deleted-file-mft-test.webp\",\"datePublished\":\"2026-11-05T10:08:58+00:00\",\"description\":\"Compare resident TXT and nonresident JPG files in an NTFS deleted file MFT test. See hex changes after deletion and MFT record reuse.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.amagicsoft.com\\\/kb\\\/lab\\\/ntfs-deleted-file-mft-test.html#breadcrumb\"},\"inLanguage\":\"ja\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.amagicsoft.com\\\/kb\\\/lab\\\/ntfs-deleted-file-mft-test.html\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"ja\",\"@id\":\"https:\\\/\\\/www.amagicsoft.com\\\/kb\\\/lab\\\/ntfs-deleted-file-mft-test.html#primaryimage\",\"url\":\"https:\\\/\\\/www.amagicsoft.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/ntfs-deleted-file-mft-test.webp\",\"contentUrl\":\"https:\\\/\\\/www.amagicsoft.com\\\/wp-content\\\/uploads\\\/2026\\\/11\\\/ntfs-deleted-file-mft-test.webp\",\"width\":1350,\"height\":760,\"caption\":\"ntfs-deleted-file-mft-test\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.amagicsoft.com\\\/kb\\\/lab\\\/ntfs-deleted-file-mft-test.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.amagicsoft.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"NTFS Deleted File MFT Test: What Changes After Deletion?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.amagicsoft.com\\\/zh\\\/#website\",\"url\":\"https:\\\/\\\/www.amagicsoft.com\\\/zh\\\/\",\"name\":\"Amagicsoft\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.amagicsoft.com\\\/zh\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.amagicsoft.com\\\/zh\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"ja\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.amagicsoft.com\\\/zh\\\/#organization\",\"name\":\"Amagicsoft\",\"url\":\"https:\\\/\\\/www.amagicsoft.com\\\/zh\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"ja\",\"@id\":\"https:\\\/\\\/www.amagicsoft.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.amagicsoft.com\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/cropped-logo_512x512-1.webp\",\"contentUrl\":\"https:\\\/\\\/www.amagicsoft.com\\\/wp-content\\\/uploads\\\/2025\\\/04\\\/cropped-logo_512x512-1.webp\",\"width\":512,\"height\":512,\"caption\":\"Amagicsoft\"},\"image\":{\"@id\":\"https:\\\/\\\/www.amagicsoft.com\\\/zh\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/amagicsoft.2024\\\/\",\"https:\\\/\\\/x.com\\\/Amagicsoft\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.amagicsoft.com\\\/zh\\\/#\\\/schema\\\/person\\\/5cc725a7bfa9bc0e962db26a19dfb8c2\",\"name\":\"Vasilii\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"ja\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/12fbd3cf5c3fd435565e0ee05fea6fb3ae89413aafdccfb30c0c821c69a44d12?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/12fbd3cf5c3fd435565e0ee05fea6fb3ae89413aafdccfb30c0c821c69a44d12?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/12fbd3cf5c3fd435565e0ee05fea6fb3ae89413aafdccfb30c0c821c69a44d12?s=96&d=mm&r=g\",\"caption\":\"Vasilii\"},\"description\":\"Vasilii is a data recovery specialist with around 10 years of hands-on experience in the field. Throughout his career, he has successfully solved thousands of complex cases involving deleted files, formatted drives, lost partitions, and RAW file systems. His expertise covers both manual recovery methods using professional tools like hex editors and advanced automated solutions with recovery software. Vasilii's mission is to make reliable data recovery knowledge accessible to both IT professionals and everyday users, helping them safeguard their valuable digital assets.\",\"sameAs\":[\"https:\\\/\\\/www.linkedin.com\\\/in\\\/vasilii-zaitsev-65894b376\\\/\"],\"url\":\"https:\\\/\\\/www.amagicsoft.com\\\/jp\\\/author\\\/vasilii\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"NTFS \u524a\u9664\u6e08\u307f\u30d5\u30a1\u30a4\u30eb MFT \u30c6\u30b9\u30c8 | Amagicsoft","description":"NTFS\u306e\u524a\u9664\u6e08\u307f\u30d5\u30a1\u30a4\u30ebMFT\u30c6\u30b9\u30c8\u306b\u304a\u3044\u3066\u3001\u30ed\u30fc\u30ab\u30ebTXT\u30d5\u30a1\u30a4\u30eb\u3068\u5916\u90e8JPG\u30d5\u30a1\u30a4\u30eb\u3092\u6bd4\u8f03\u3057\u307e\u3059\u3002\u524a\u9664\u5f8c\u306e16\u9032\u6570\u306e\u5909\u5316\u3084\u3001MFT\u30ec\u30b3\u30fc\u30c9\u306e\u518d\u5229\u7528\u72b6\u6cc1\u3092\u78ba\u8a8d\u3057\u3066\u304f\u3060\u3055\u3044\u3002.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.amagicsoft.com\/jp\/kb\/lab\/ntfs-deleted-file-mft-test.html","og_locale":"ja_JP","og_type":"article","og_title":"NTFS Deleted File MFT Test: What Changes After Deletion?","og_description":"Compare resident TXT and nonresident JPG files in an NTFS deleted file MFT test. See hex changes after deletion and MFT record reuse.","og_url":"https:\/\/www.amagicsoft.com\/jp\/kb\/lab\/ntfs-deleted-file-mft-test.html","og_site_name":"Amagicsoft","article_publisher":"https:\/\/www.facebook.com\/amagicsoft.2024\/","article_published_time":"2026-11-05T10:08:58+00:00","og_image":[{"width":1350,"height":760,"url":"https:\/\/www.amagicsoft.com\/wp-content\/uploads\/2026\/11\/ntfs-deleted-file-mft-test.webp","type":"image\/webp"}],"author":"Vasilii","twitter_card":"summary_large_image","twitter_creator":"@Amagicsoft","twitter_site":"@Amagicsoft","twitter_misc":{"\u57f7\u7b46\u8005":"Vasilii","\u63a8\u5b9a\u8aad\u307f\u53d6\u308a\u6642\u9593":"15\u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.amagicsoft.com\/kb\/lab\/ntfs-deleted-file-mft-test.html#article","isPartOf":{"@id":"https:\/\/www.amagicsoft.com\/kb\/lab\/ntfs-deleted-file-mft-test.html"},"author":{"name":"Vasilii","@id":"https:\/\/www.amagicsoft.com\/zh\/#\/schema\/person\/5cc725a7bfa9bc0e962db26a19dfb8c2"},"headline":"NTFS Deleted File MFT Test: What Changes After Deletion?","datePublished":"2026-11-05T10:08:58+00:00","mainEntityOfPage":{"@id":"https:\/\/www.amagicsoft.com\/kb\/lab\/ntfs-deleted-file-mft-test.html"},"wordCount":2938,"publisher":{"@id":"https:\/\/www.amagicsoft.com\/zh\/#organization"},"image":{"@id":"https:\/\/www.amagicsoft.com\/kb\/lab\/ntfs-deleted-file-mft-test.html#primaryimage"},"thumbnailUrl":"https:\/\/www.amagicsoft.com\/wp-content\/uploads\/2026\/11\/ntfs-deleted-file-mft-test.webp","keywords":["Knowledge Base"],"articleSection":["Recovery Lab"],"inLanguage":"ja"},{"@type":"WebPage","@id":"https:\/\/www.amagicsoft.com\/kb\/lab\/ntfs-deleted-file-mft-test.html","url":"https:\/\/www.amagicsoft.com\/kb\/lab\/ntfs-deleted-file-mft-test.html","name":"NTFS \u524a\u9664\u6e08\u307f\u30d5\u30a1\u30a4\u30eb MFT \u30c6\u30b9\u30c8 | Amagicsoft","isPartOf":{"@id":"https:\/\/www.amagicsoft.com\/zh\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.amagicsoft.com\/kb\/lab\/ntfs-deleted-file-mft-test.html#primaryimage"},"image":{"@id":"https:\/\/www.amagicsoft.com\/kb\/lab\/ntfs-deleted-file-mft-test.html#primaryimage"},"thumbnailUrl":"https:\/\/www.amagicsoft.com\/wp-content\/uploads\/2026\/11\/ntfs-deleted-file-mft-test.webp","datePublished":"2026-11-05T10:08:58+00:00","description":"NTFS\u306e\u524a\u9664\u6e08\u307f\u30d5\u30a1\u30a4\u30ebMFT\u30c6\u30b9\u30c8\u306b\u304a\u3044\u3066\u3001\u30ed\u30fc\u30ab\u30ebTXT\u30d5\u30a1\u30a4\u30eb\u3068\u5916\u90e8JPG\u30d5\u30a1\u30a4\u30eb\u3092\u6bd4\u8f03\u3057\u307e\u3059\u3002\u524a\u9664\u5f8c\u306e16\u9032\u6570\u306e\u5909\u5316\u3084\u3001MFT\u30ec\u30b3\u30fc\u30c9\u306e\u518d\u5229\u7528\u72b6\u6cc1\u3092\u78ba\u8a8d\u3057\u3066\u304f\u3060\u3055\u3044\u3002.","breadcrumb":{"@id":"https:\/\/www.amagicsoft.com\/kb\/lab\/ntfs-deleted-file-mft-test.html#breadcrumb"},"inLanguage":"ja","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.amagicsoft.com\/kb\/lab\/ntfs-deleted-file-mft-test.html"]}]},{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/www.amagicsoft.com\/kb\/lab\/ntfs-deleted-file-mft-test.html#primaryimage","url":"https:\/\/www.amagicsoft.com\/wp-content\/uploads\/2026\/11\/ntfs-deleted-file-mft-test.webp","contentUrl":"https:\/\/www.amagicsoft.com\/wp-content\/uploads\/2026\/11\/ntfs-deleted-file-mft-test.webp","width":1350,"height":760,"caption":"ntfs-deleted-file-mft-test"},{"@type":"BreadcrumbList","@id":"https:\/\/www.amagicsoft.com\/kb\/lab\/ntfs-deleted-file-mft-test.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.amagicsoft.com\/"},{"@type":"ListItem","position":2,"name":"NTFS Deleted File MFT Test: What Changes After Deletion?"}]},{"@type":"WebSite","@id":"https:\/\/www.amagicsoft.com\/zh\/#website","url":"https:\/\/www.amagicsoft.com\/zh\/","name":"\u30a2\u30de\u30b8\u30c3\u30af\u30bd\u30d5\u30c8","description":"","publisher":{"@id":"https:\/\/www.amagicsoft.com\/zh\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.amagicsoft.com\/zh\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"ja"},{"@type":"Organization","@id":"https:\/\/www.amagicsoft.com\/zh\/#organization","name":"\u30a2\u30de\u30b8\u30c3\u30af\u30bd\u30d5\u30c8","url":"https:\/\/www.amagicsoft.com\/zh\/","logo":{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/www.amagicsoft.com\/zh\/#\/schema\/logo\/image\/","url":"https:\/\/www.amagicsoft.com\/wp-content\/uploads\/2025\/04\/cropped-logo_512x512-1.webp","contentUrl":"https:\/\/www.amagicsoft.com\/wp-content\/uploads\/2025\/04\/cropped-logo_512x512-1.webp","width":512,"height":512,"caption":"Amagicsoft"},"image":{"@id":"https:\/\/www.amagicsoft.com\/zh\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/amagicsoft.2024\/","https:\/\/x.com\/Amagicsoft"]},{"@type":"Person","@id":"https:\/\/www.amagicsoft.com\/zh\/#\/schema\/person\/5cc725a7bfa9bc0e962db26a19dfb8c2","name":"Vasilii","image":{"@type":"ImageObject","inLanguage":"ja","@id":"https:\/\/secure.gravatar.com\/avatar\/12fbd3cf5c3fd435565e0ee05fea6fb3ae89413aafdccfb30c0c821c69a44d12?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/12fbd3cf5c3fd435565e0ee05fea6fb3ae89413aafdccfb30c0c821c69a44d12?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/12fbd3cf5c3fd435565e0ee05fea6fb3ae89413aafdccfb30c0c821c69a44d12?s=96&d=mm&r=g","caption":"Vasilii"},"description":"\u30d0\u30b7\u30ea\u30a4\u306f\u3001\u3053\u306e\u5206\u91ce\u3067\u7d0410\u5e74\u306e\u5b9f\u52d9\u7d4c\u9a13\u3092\u6301\u3064\u30c7\u30fc\u30bf\u5fa9\u5143\u306e\u30b9\u30da\u30b7\u30e3\u30ea\u30b9\u30c8\u3067\u3059\u3002\u305d\u306e\u30ad\u30e3\u30ea\u30a2\u3092\u901a\u3058\u3066\u3001\u5f7c\u306f\u524a\u9664\u3055\u308c\u305f\u30d5\u30a1\u30a4\u30eb\u3001\u30d5\u30a9\u30fc\u30de\u30c3\u30c8\u3055\u308c\u305f\u30c9\u30e9\u30a4\u30d6\u3001\u5931\u308f\u308c\u305f\u30d1\u30fc\u30c6\u30a3\u30b7\u30e7\u30f3\u3001RAW\u30d5\u30a1\u30a4\u30eb\u30b7\u30b9\u30c6\u30e0\u3092\u542b\u3080\u4f55\u5343\u3082\u306e\u8907\u96d1\u306a\u30b1\u30fc\u30b9\u306e\u89e3\u6c7a\u306b\u6210\u529f\u3057\u3066\u304d\u307e\u3057\u305f\u3002\u5f7c\u306e\u5c02\u9580\u77e5\u8b58\u306f\u300116\u9032\u30a8\u30c7\u30a3\u30bf\u306a\u3069\u306e\u5c02\u9580\u30c4\u30fc\u30eb\u3092\u4f7f\u7528\u3057\u305f\u624b\u52d5\u5fa9\u5143\u65b9\u6cd5\u3068\u3001\u5fa9\u5143\u30bd\u30d5\u30c8\u30a6\u30a7\u30a2\u3092\u4f7f\u7528\u3057\u305f\u9ad8\u5ea6\u306a\u81ea\u52d5\u5316\u30bd\u30ea\u30e5\u30fc\u30b7\u30e7\u30f3\u306e\u4e21\u65b9\u3092\u30ab\u30d0\u30fc\u3057\u3066\u3044\u307e\u3059\u3002\u30d0\u30b7\u30ea\u306e\u4f7f\u547d\u306f\u3001\u4fe1\u983c\u3067\u304d\u308b\u30c7\u30fc\u30bf\u5fa9\u5143\u77e5\u8b58\u3092IT\u30d7\u30ed\u30d5\u30a7\u30c3\u30b7\u30e7\u30ca\u30eb\u3068\u4e00\u822c\u30e6\u30fc\u30b6\u30fc\u306e\u53cc\u65b9\u304c\u5229\u7528\u3067\u304d\u308b\u3088\u3046\u306b\u3057\u3001\u8cb4\u91cd\u306a\u30c7\u30b8\u30bf\u30eb\u8cc7\u7523\u3092\u4fdd\u8b77\u3067\u304d\u308b\u3088\u3046\u306b\u3059\u308b\u3053\u3068\u3067\u3059\u3002.","sameAs":["https:\/\/www.linkedin.com\/in\/vasilii-zaitsev-65894b376\/"],"url":"https:\/\/www.amagicsoft.com\/jp\/author\/vasilii"}]}},"_links":{"self":[{"href":"https:\/\/www.amagicsoft.com\/jp\/wp-json\/wp\/v2\/posts\/58110","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.amagicsoft.com\/jp\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.amagicsoft.com\/jp\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.amagicsoft.com\/jp\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.amagicsoft.com\/jp\/wp-json\/wp\/v2\/comments?post=58110"}],"version-history":[{"count":3,"href":"https:\/\/www.amagicsoft.com\/jp\/wp-json\/wp\/v2\/posts\/58110\/revisions"}],"predecessor-version":[{"id":58121,"href":"https:\/\/www.amagicsoft.com\/jp\/wp-json\/wp\/v2\/posts\/58110\/revisions\/58121"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.amagicsoft.com\/jp\/wp-json\/wp\/v2\/media\/58111"}],"wp:attachment":[{"href":"https:\/\/www.amagicsoft.com\/jp\/wp-json\/wp\/v2\/media?parent=58110"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.amagicsoft.com\/jp\/wp-json\/wp\/v2\/categories?post=58110"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.amagicsoft.com\/jp\/wp-json\/wp\/v2\/tags?post=58110"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}