Dumping Inode 46250 (0xb4aa) Upd. Seq. Array Off.: 48 (0x30) Upd. Seq. Array Count: 3 (0x3) Upd. Seq. Number: 6 (0x6) LogFile Seq. Number: 0x728bcc0 MFT Record Seq. Numb.: 1 (0x1) Number of Hard Links: 2 (0x2) Attribute Offset: 56 (0x38) MFT Record Flags: IN_USE Bytes Used: 456 (0x1c8) bytes Bytes Allocated: 1024 (0x400) bytes Next Attribute Instance: 5 (0x5) MFT Padding: 00 00 Dumping attribute $STANDARD_INFORMATION (0x10) from mft record 46250 (0xb4aa) Resident: Yes Attribute flags: 0x0000 Attribute instance: 0 (0x0) Data size: 72 (0x48) Resident flags: 0x00 File Creation Time: Fri Sep 5 17:18:49 2008 File Altered Time: Fri Feb 29 07:11:54 2008 MFT Changed Time: Wed May 13 10:07:35 2009 Last Accessed Time: Fri Sep 5 17:18:49 2008 File attributes: ARCHIVE (0x00000000) Maximum versions: 0 Version number: 0 Class ID: 0 User ID: 0 (0x0) Security ID: 450 (0x1c2) Quota charged: 0 (0x0) Update Sequence Number: 0 (0x0) Dumping attribute $FILE_NAME (0x30) from mft record 46250 (0xb4aa) Resident: Yes Attribute flags: 0x0000 Attribute instance: 2 (0x2) Data size: 88 (0x58) Resident flags: 0x01 Parent directory: 5130 (0x140a) File Creation Time: Wed May 13 10:07:35 2009 File Altered Time: Wed May 13 10:07:35 2009 MFT Changed Time: Wed May 13 10:07:35 2009 Last Accessed Time: Wed May 13 10:07:35 2009 Allocated Size: 0 (0x0) Data Size: 0 (0x0) Filename Length: 11 (0xb) File attributes: ARCHIVE (0x00000000) Namespace: Win32 & DOS Filename: 'winload.exe' Dumping attribute $FILE_NAME (0x30) from mft record 46250 (0xb4aa) Resident: Yes Attribute flags: 0x0000 Attribute instance: 4 (0x4) Data size: 88 (0x58) Resident flags: 0x01 Parent directory: 3129 (0xc39) File Creation Time: Fri Sep 5 17:18:49 2008 File Altered Time: Fri Feb 29 07:11:54 2008 MFT Changed Time: Wed May 13 10:07:35 2009 Last Accessed Time: Fri Sep 5 17:18:49 2008 Allocated Size: 991232 (0xf2000) Data Size: 988216 (0xf1438) Filename Length: 11 (0xb) File attributes: ARCHIVE (0x00000000) Namespace: POSIX Filename: 'winload.exe' Dumping attribute $DATA (0x80) from mft record 46250 (0xb4aa) Resident: No Attribute flags: 0x0000 Attribute instance: 3 (0x3) Compression unit: 0 (0x0) Data size: 988216 (0xf1438) Allocated size: 991232 (0xf2000) Initialized size: 988216 (0xf1438) End of inode reached