The following problems should be solved in the near future. 1. Guessing parameters The following parameters are obtained by guessing, rather then from the boot file: - sector size - cluster factor -> cluster size - mft record size 2. Guessing offsets The following offsets are obtained by guessing. It should be verified that they are really constant, or can be obtained from some other information on the volume: - Location of the MFT record for the MFT (0x30) - Start of the attribute list in a MFT record (0x30) - Location of the attribute data for unnamed attributes (0x40) - positions of file access times in the standard attribute (0x18, 0x20, 0x28) 3. Unused bytes/unsupported features As each byte in the infrastructure file probably serves a purpose, they should all be investigated. Also, some features known to be implemented by NTFS are not supported in the tools. These include: - distinction between resident and non-resident attribute (interesting for the data attribute) - sparse and compressed data attributes. Is there a generic algorithm for decoding data run lists? - volume sets. What is the $Volume file for? - named and multiple data attributes - hard links and symlinks - Why appear name attributes to have access times, and why are there four access times, while only three are supported in the API (creation, modification, access)? 4. Comments Why can I never remember to put comments into source files?