none
`findlinks.exe` outputs each file index. Can such indexes be converted to File Reference Numbers? RRS feed

  • Question

  • Hi,

    `findlinks.exe` outputs the index of the input file, as well as the number of extra hard links. Such index looks like a truncated version of the "file ID" or "File Reference Number" (frn) of the input file. For example, `fsutil.exe file queryFileID infile` displays "0x00000000000000000003000000051bf3", while `findlinks.exe infile` displays "0x00051BF3".

    I can input a drive letter and a frn into `fsutil.exe`or into voidtools' `search everything`, and I will get the name of the file (or at least the name of one of its hard links).

    Can I get the original filename if I only know the drive letter and `findlinks.exe` truncated index? Maybe by converting the truncated index into a full length frn?

    Thanks and best regards

    Friday, April 24, 2020 2:00 AM

All replies

  • Hello

    Not answering your question specifically but findlinks displays the first 48 bits of the FileID (that is the 48 bit index into the MFT) but omits the 16 bit sequence number.  Not sure why we don't display the full 64 bit fileID but since REFS has 128 bit file IDs I have added an item to the backlog to update this at least.

    MarkC(MSFT)

    Monday, April 27, 2020 11:57 AM