For this experiment a new file was created within three
folders. The folder structure was "2015
> February > Week 3". The file within this final folder was called "birthdaypresent.txt" with the content "I would like a new car for my birthday
please".
The first metadata block, at offset 0x0750000 was largely
the same as the one when just a folder had been added to the ReFS drive. The
only difference that wasn't a MACE time was at offset 0x08, where the byte was
set to 0D rather than 0A.
The next metadata block offset had an entry for the "2015" folder. This entire block was
exactly the same as the next two blocks too, with the only exceptions being the
first two bytes (used for addressing) and the "2015" folder's modified time (and entry modified time in the block
found at offset 0x075C000).
The next metadata block found with a file entry was at
offset 0x07B0000. The metadata block contained entries for the folders "2015" and "February", as did the next two which were exactly the same, apart
from modified times, the eighth and the addressing bytes.
In the metadata block at offset 0x07C0000 was two filename
entries, this time for "February" and
"Week 3". It is interesting to see
that the metadata blocks essentially create a chain linking together the
folders. The next metadata block at offset 0x07C4000 was the same, with the
same differences as noticed in the last few metadata blocks. However unlike the
last ones, where there were two copies, there was only one copy of this one.
This could be because it was the final folder, the one that contained the file.
At offset 0x07D0000 was the metadata block containing the
entry for the file "birthdaypresent.txt",
with a copy of the block at 0x07D4000. This file entry
pointed to 0x07E0000 for the file content.
Offset(h) 00 01 02 03 04 05 06 07 08 09 0A 0B 0C 0D 0E 0F 10 11 12 13 14 15 16 17
18 19 1A 1B 1C 1D 1E 1F
0007E0000 49 20 77 6F 75 6C 64 20 6C 69 6B 65 20 61 20 6E 65 77 20
63 61 72 20 66 6F 72 20 6D 79 20 62 69 I
would like a new car for my bi
0007E0020 72 74 68 64 61 79 20 70 6C 65 61 73 65 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 rthday please...................
