how does the computer retrive a particular entry in the MFT table for a file or directory? I read through many documents which describe the structure of NTFS and MFT, but i fail to understand say i have a file in E:\documents\test.txt, how can i identify it's entry in the MFT index. Is it sequential?
I implemented a readonly ntfs library (UMFS) in the distant past.
The root directory of a volume is always stored in mft record 5. Once you can read the data stream for the directory, you can walk the b+tree (as @Christopher said) stored in the stream, finding the subdirectory or file you are interested in.