NTFS File Sector Information Utility
Last Updated: 12/25/99
1. Usage
NFI dumps information about an NTFS volume, and optionally determines which
volume and file contains a particular sector.
Invoking nfi.exe with no arguments shows usage as follows.
nfi drive-letter [logical-sector-number]
Drive-letter can be a single character or a character followed by a colon
(i.e., C or C: are acceptable).
Logical-sector-number is a decimal or 0x-prefixed hex number, specifying a
sector number relative to the volume
whose drive letter is given by drive-letter. If not specified, then
information about every file on the volume is dumped.
nfi NT-device-path physical-sector-number
Determines which volume a given physical sector on a drive is within, and
then which file on the volume it is in.
NT-device-path is the NT-style path to a physical device. It must not include
a partition specification.
Physical-sector-number is a decimal or 0x-prefixed hex number, specifying a
sector number relative to the physical drive whose device path is given by
NT-device-path.
nfi full-win32-path
Dumps information about a particular file. full-win32-path must start with
a drive letter and a colon.
2. Examples
- Dump of drive information.
D:\work\final>nfi\nfi c: | more
NTFS File Sector Information Utility.
Copyright (C) Microsoft Corporation 1999. All rights reserved.
File 0
Master File Table ($Mft)
$STANDARD_INFORMATION (resident)
$ATTRIBUTE_LIST (resident)
$FILE_NAME (resident)
$DATA (nonresident)
logical sectors 36693-36724 (0x8f55-0x8f74)
$BITMAP (nonresident)
logical sectors 36725-36726 (0x8f75-0x8f76)
logical sectors 36797-36802 (0x8fbd-0x8fc2)
File 1
Master File Table Mirror ($MftMirr)
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$DATA (nonresident)
logical sectors 2059029-2059036 (0x1f6b15-0x1f6b1c)
File 2
Log File ($LogFile)
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$DATA (nonresident)
logical sectors 2086165-2094356 (0x1fd515-0x1ff514)
File 3
DASD ($Volume)
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$OBJECT_ID (resident)
-- More --
- Drive letter and logical sector to file mapping.
D:\>nfi c: 3014000
NTFS File Sector Information Utility.
Copyright (C) Microsoft Corporation 1999. All rights reserved.
***Logical sector 3014000 (0x2dfd70) on drive C is in file number 204.
\WINNT\system32\NTOSKRNL.EXE
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$SECURITY_DESCRIPTOR (resident)
$DATA (nonresident)
logical sectors 3011038-3011240 (0x2df1de-0x2df2a8)
logical sectors 3013791-3014281 (0x2dfc9f-0x2dfe89)
logical sectors 2992479-2992944 (0x2da95f-0x2dab30)
logical sectors 2986291-2986724 (0x2d9133-0x2d92e4)
logical sectors 3011755-3012046 (0x2df4ab-0x2df5ce)
logical sectors 3012690-3012748 (0x2df852-0x2df88c)
- File to logical sector mapping.
D:\>nfi c:\winnt\system32\ntoskrnl.exe
NTFS File Sector Information Utility.
Copyright (C) Microsoft Corporation 1999. All rights reserved.
\WINNT\system32\NTOSKRNL.EXE
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$SECURITY_DESCRIPTOR (resident)
$DATA (nonresident)
logical sectors 3011038-3011240 (0x2df1de-0x2df2a8)
logical sectors 3013791-3014281 (0x2dfc9f-0x2dfe89)
logical sectors 2992479-2992944 (0x2da95f-0x2dab30)
logical sectors 2986291-2986724 (0x2d9133-0x2d92e4)
logical sectors 3011755-3012046 (0x2df4ab-0x2df5ce)
logical sectors 3012690-3012748 (0x2df852-0x2df88c)
- Windows 2000 device path and physical sector to file mapping (1).
D:\>nfi \device\harddisk1\dr1 8000000
NTFS File Sector Information Utility.
Copyright (C) Microsoft Corporation 1999. All rights reserved.
***Physical sector 8000000 (0x7a1200) is in file number 3023 on drive F.
\WINNT50\system32\pifmgr.dll
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$DATA (nonresident)
physical sectors 7999936-8000015 (0x7a11c0-0x7a120f)
- Windows 2000 device path and logical sector to file mapping (2).
D:\>nfi \device\harddisk1\dr1 8500000
NTFS File Sector Information Utility.
Copyright (C) Microsoft Corporation 1999. All rights reserved.
***Physical sector 8500000 (0x81b320) is not in any partition on
\device\harddisk1\dr1,
or \device\harddisk1\dr1 is not a legal device name.
- Windows NT 4.0 device path and logical sector to file mapping.
C:\>nfi \device\harddisk0 40000
NTFS File Sector Information Utility.
Copyright (C) Microsoft Corporation 1999. All rights reserved.
***Physical sector 40000 (0x9c40) is in file number 146 on drive C.
\demo\PHASE2~1.PPT
$STANDARD_INFORMATION (resident)
$FILE_NAME (resident)
$FILE_NAME (resident)
$SECURITY_DESCRIPTOR (resident)
$DATA (nonresident)
physical sectors 39968-40198 (0x9c20-0x9d06)