Converting Byte address to physical address NTFS

1
Converting Byte address to physical address - NTFS

• Assuming the size of each cluster is 1K.
• We want to convert byte address (offset) 355,000
  in our file to the physical address.
• The files data runs are
• run1 Length 200 Offset 5634.
• run2 Length 150 Offset 2018.
• Therefore the file is 350 clusters size, starting
  at cluster number 5634 (first 200 clusters) and
  the rest 150 clusters starting at cluster number
  7652.

2
Converting Byte address to physical address - NTFS

• Each cluster is 1024 bytes, so 355,000/1024
  346. - we need to find the address of cluster
  number 346.
• According 20 data run 2, this cluster will start
  at cluster (physical) 7798.
• Cluster number 7798 will start with byte number
  354,304.
• Byte number 355,000 will be in cluster 7998 at
  offset 696.

3
Converting Byte address to physical address - UNIX

• Byte number 355,000 is calculated as follows
• a. 1st byte of the double indirect block is
  256k10k 272,384
• b. byte number 355,000 is number 82,616 in the
  double indirect block
• c. every single indirect block has 256k bytes --gt
  byte 355,000 is in the 0th single indirect block
  - 231
• d. Every entry is 1k, so byte 82,616 is in the
  80th block - 123
• e. within block 123 it is byte 696

size 228 4542 3 0 0 1111 0 101 367 0 428 9156 824
367 data block
123
123
231
80
231
9156
4
Disk Sizes
5
File sizes