4 ms·
>NTFS does the same, actually, except it can’t count that low, so you get 1K. Not exactly, a $MFT record (on 512 bytes/sector media) is 1024 bytes, the most yo
by jaclaz 4y ago
>NTFS does the same, actually, except it can’t count that low, so you get 1K.
Not exactly, a $MFT record (on 512 bytes/sector media) is 1024 bytes, the most you can store in it (it slightly varies depending on the length of the filename and on the exact way the file is written) is 744 bytes max.
On 4K disks, the $MFT record is 4096 bytes and allows up to 3776 bytes max.
JFYI:
https://www.forensicfocus.com/forums/general/mft-resident-data/ https://www.forensicfocus.com/forums/general/mft-resident-da...