NTFS File Sector Information Utility

Last Updated: 12/25/99


1. Usage

NFI dumps information about an NTFS volume, and optionally determines which volume and file contains a particular sector.
Invoking nfi.exe with no arguments shows usage as follows.

nfi drive-letter [logical-sector-number]

Drive-letter can be a single character or a character followed by a colon (i.e., C or C: are acceptable).

Logical-sector-number is a decimal or 0x-prefixed hex number, specifying a sector number relative to the volume
whose drive letter is given by drive-letter. If not specified, then information about every file on the volume is dumped.

nfi NT-device-path physical-sector-number

Determines which volume a given physical sector on a drive is within, and then which file on the volume it is in.

NT-device-path is the NT-style path to a physical device. It must not include a partition specification.

Physical-sector-number is a decimal or 0x-prefixed hex number, specifying a sector number relative to the physical drive whose device path is given by NT-device-path.

nfi full-win32-path

Dumps information about a particular file. full-win32-path must start with a drive letter and a colon.

2. Examples

  1. Dump of drive information.

    D:\work\final>nfi\nfi c: | more
    NTFS File Sector Information Utility.
    Copyright (C) Microsoft Corporation 1999. All rights reserved.


    File 0
    Master File Table ($Mft)
    $STANDARD_INFORMATION (resident)
    $ATTRIBUTE_LIST (resident)
    $FILE_NAME (resident)
    $DATA (nonresident)
    logical sectors 36693-36724 (0x8f55-0x8f74)
    $BITMAP (nonresident)
    logical sectors 36725-36726 (0x8f75-0x8f76)
    logical sectors 36797-36802 (0x8fbd-0x8fc2)

    File 1
    Master File Table Mirror ($MftMirr)
    $STANDARD_INFORMATION (resident)
    $FILE_NAME (resident)
    $DATA (nonresident)
    logical sectors 2059029-2059036 (0x1f6b15-0x1f6b1c)

    File 2
    Log File ($LogFile)
    $STANDARD_INFORMATION (resident)
    $FILE_NAME (resident)
    $DATA (nonresident)
    logical sectors 2086165-2094356 (0x1fd515-0x1ff514)

    File 3
    DASD ($Volume)
    $STANDARD_INFORMATION (resident)
    $FILE_NAME (resident)
    $OBJECT_ID (resident)
    -- More --

  2. Drive letter and logical sector to file mapping.

    D:\>nfi c: 3014000
    NTFS File Sector Information Utility.
    Copyright (C) Microsoft Corporation 1999. All rights reserved.


    ***Logical sector 3014000 (0x2dfd70) on drive C is in file number 204.
    \WINNT\system32\NTOSKRNL.EXE
    $STANDARD_INFORMATION (resident)
    $FILE_NAME (resident)
    $SECURITY_DESCRIPTOR (resident)
    $DATA (nonresident)
    logical sectors 3011038-3011240 (0x2df1de-0x2df2a8)
    logical sectors 3013791-3014281 (0x2dfc9f-0x2dfe89)
    logical sectors 2992479-2992944 (0x2da95f-0x2dab30)
    logical sectors 2986291-2986724 (0x2d9133-0x2d92e4)
    logical sectors 3011755-3012046 (0x2df4ab-0x2df5ce)
    logical sectors 3012690-3012748 (0x2df852-0x2df88c)


  3. File to logical sector mapping.

    D:\>nfi c:\winnt\system32\ntoskrnl.exe
    NTFS File Sector Information Utility.
    Copyright (C) Microsoft Corporation 1999. All rights reserved.

    \WINNT\system32\NTOSKRNL.EXE
    $STANDARD_INFORMATION (resident)
    $FILE_NAME (resident)
    $SECURITY_DESCRIPTOR (resident)
    $DATA (nonresident)
    logical sectors 3011038-3011240 (0x2df1de-0x2df2a8)
    logical sectors 3013791-3014281 (0x2dfc9f-0x2dfe89)
    logical sectors 2992479-2992944 (0x2da95f-0x2dab30)
    logical sectors 2986291-2986724 (0x2d9133-0x2d92e4)
    logical sectors 3011755-3012046 (0x2df4ab-0x2df5ce)
    logical sectors 3012690-3012748 (0x2df852-0x2df88c)


  4. Windows 2000 device path and physical sector to file mapping (1).

    D:\>nfi \device\harddisk1\dr1 8000000
    NTFS File Sector Information Utility.
    Copyright (C) Microsoft Corporation 1999. All rights reserved.


    ***Physical sector 8000000 (0x7a1200) is in file number 3023 on drive F.
    \WINNT50\system32\pifmgr.dll
    $STANDARD_INFORMATION (resident)
    $FILE_NAME (resident)
    $DATA (nonresident)
    physical sectors 7999936-8000015 (0x7a11c0-0x7a120f)


  5. Windows 2000 device path and logical sector to file mapping (2).

    D:\>nfi \device\harddisk1\dr1 8500000
    NTFS File Sector Information Utility.
    Copyright (C) Microsoft Corporation 1999. All rights reserved.

    ***Physical sector 8500000 (0x81b320) is not in any partition on \device\harddisk1\dr1,
    or \device\harddisk1\dr1 is not a legal device name.

  6. Windows NT 4.0 device path and logical sector to file mapping.

    C:\>nfi \device\harddisk0 40000
    NTFS File Sector Information Utility.
    Copyright (C) Microsoft Corporation 1999. All rights reserved.


    ***Physical sector 40000 (0x9c40) is in file number 146 on drive C.
    \demo\PHASE2~1.PPT
    $STANDARD_INFORMATION (resident)
    $FILE_NAME (resident)
    $FILE_NAME (resident)
    $SECURITY_DESCRIPTOR (resident)
    $DATA (nonresident)
    physical sectors 39968-40198 (0x9c20-0x9d06)