VERSION 5.00
Begin VB.Form Form21 
   Caption         =   " NTFS Master File Table ($MFT) Record"
   ClientHeight    =   7575
   ClientLeft      =   60
   ClientTop       =   345
   ClientWidth     =   10845
   Icon            =   "ntfsmft.frx":0000
   LinkTopic       =   "Form21"
   MaxButton       =   0   'False
   MinButton       =   0   'False
   ScaleHeight     =   7575
   ScaleWidth      =   10845
   StartUpPosition =   3  'Windows Default
   Begin VB.CommandButton cmdNext 
      DownPicture     =   "ntfsmft.frx":0442
      Height          =   345
      Left            =   10080
      MaskColor       =   &H00FFFFFF&
      Picture         =   "ntfsmft.frx":057E
      Style           =   1  'Graphical
      TabIndex        =   87
      ToolTipText     =   "Next"
      Top             =   120
      UseMaskColor    =   -1  'True
      Width           =   435
   End
   Begin VB.CommandButton cmdPrev 
      DownPicture     =   "ntfsmft.frx":06BA
      Height          =   345
      Left            =   9480
      MaskColor       =   &H00FFFFFF&
      Picture         =   "ntfsmft.frx":07F6
      Style           =   1  'Graphical
      TabIndex        =   86
      ToolTipText     =   "Previous"
      Top             =   120
      UseMaskColor    =   -1  'True
      Width           =   435
   End
   Begin VB.Label Label7 
      Caption         =   $"ntfsmft.frx":0932
      Height          =   2895
      Left            =   240
      TabIndex        =   92
      Top             =   4440
      Width           =   4695
   End
   Begin VB.Label Label23 
      Height          =   255
      Index           =   39
      Left            =   6960
      TabIndex        =   91
      Top             =   4080
      Width           =   3750
   End
   Begin VB.Label Label20 
      Caption         =   "ATTRIBUTE"
      Height          =   255
      Left            =   5280
      TabIndex        =   90
      Top             =   4095
      Width           =   1575
   End
   Begin VB.Label Label9 
      Caption         =   "ATTRIBUTE HEADER"
      Height          =   255
      Left            =   5280
      TabIndex        =   89
      Top             =   500
      Width           =   2055
   End
   Begin VB.Label Label31 
      Height          =   255
      Left            =   6960
      TabIndex        =   88
      Top             =   1080
      Width           =   3750
   End
   Begin VB.Label LabelA12 
      Caption         =   "12:"
      Height          =   255
      Left            =   5280
      TabIndex        =   85
      Top             =   7080
      Width           =   1605
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   38
      Left            =   6960
      TabIndex        =   84
      Top             =   7080
      Width           =   3750
   End
   Begin VB.Label Label35 
      Caption         =   "Offset:"
      Height          =   255
      Left            =   7680
      TabIndex        =   83
      Top             =   120
      Width           =   615
   End
   Begin VB.Label Label34 
      Caption         =   "0"
      Height          =   255
      Left            =   8280
      TabIndex        =   82
      Top             =   120
      Width           =   735
   End
   Begin VB.Label Label33 
      Caption         =   "Sector :"
      Height          =   255
      Left            =   5280
      TabIndex        =   81
      Top             =   120
      Width           =   615
   End
   Begin VB.Label Label32 
      Caption         =   "0"
      Height          =   255
      Left            =   6000
      TabIndex        =   80
      Top             =   120
      Width           =   1575
   End
   Begin VB.Label Label1 
      Caption         =   "Drive"
      BeginProperty Font 
         Name            =   "MS Sans Serif"
         Size            =   8.25
         Charset         =   162
         Weight          =   700
         Underline       =   0   'False
         Italic          =   0   'False
         Strikethrough   =   0   'False
      EndProperty
      Height          =   255
      Left            =   240
      TabIndex        =   79
      Top             =   120
      Width           =   735
   End
   Begin VB.Label Label2 
      Caption         =   "Magic Bytes:"
      Height          =   255
      Left            =   240
      TabIndex        =   78
      Top             =   480
      Width           =   1605
   End
   Begin VB.Label Label3 
      Caption         =   "Offset to Upd. Seq:"
      Height          =   255
      Left            =   240
      TabIndex        =   77
      Top             =   720
      Width           =   1605
   End
   Begin VB.Label Label4 
      Caption         =   "Upd. Seq. Arr. Size:"
      Height          =   255
      Left            =   240
      TabIndex        =   76
      Top             =   960
      Width           =   1605
   End
   Begin VB.Label Label5 
      Caption         =   "$LogFile Seq. Num:"
      Height          =   255
      Left            =   240
      TabIndex        =   75
      Top             =   1200
      Width           =   1605
   End
   Begin VB.Label Label6 
      Caption         =   "Sequence Number:"
      Height          =   255
      Left            =   240
      TabIndex        =   74
      Top             =   1440
      Width           =   1605
   End
   Begin VB.Label Label8 
      Caption         =   "Hard Link Count:"
      Height          =   255
      Left            =   240
      TabIndex        =   73
      Top             =   1680
      Width           =   1605
   End
   Begin VB.Label Label10 
      Caption         =   "Offset to First Attrib:"
      Height          =   255
      Left            =   240
      TabIndex        =   72
      Top             =   1920
      Width           =   1605
   End
   Begin VB.Label Label11 
      Caption         =   "Flags:"
      Height          =   255
      Left            =   240
      TabIndex        =   71
      Top             =   2160
      Width           =   1605
   End
   Begin VB.Label Label12 
      Caption         =   "File Rec. Real Size:"
      Height          =   255
      Left            =   240
      TabIndex        =   70
      Top             =   2400
      Width           =   1605
   End
   Begin VB.Label Label13 
      Caption         =   "File Rec. Alloc. Size:"
      Height          =   255
      Left            =   240
      TabIndex        =   69
      Top             =   2640
      Width           =   1605
   End
   Begin VB.Label Label14 
      Caption         =   "Ref. to Base Record:"
      Height          =   255
      Left            =   240
      TabIndex        =   68
      Top             =   2880
      Width           =   1605
   End
   Begin VB.Label Label15 
      Caption         =   "Next Attribute Id:"
      Height          =   255
      Left            =   240
      TabIndex        =   67
      Top             =   3120
      Width           =   1605
   End
   Begin VB.Label Label16 
      Caption         =   "Align to 4 byte Bound:"
      Height          =   255
      Left            =   240
      TabIndex        =   66
      Top             =   3360
      Width           =   1605
   End
   Begin VB.Label Label17 
      Caption         =   "Num of this MFT Rec:"
      Height          =   255
      Left            =   240
      TabIndex        =   65
      Top             =   3600
      Width           =   1605
   End
   Begin VB.Label Label18 
      Caption         =   "Update Seq. Num:"
      Height          =   255
      Left            =   240
      TabIndex        =   64
      Top             =   3840
      Width           =   1605
   End
   Begin VB.Label Label19 
      Caption         =   "Update Seq. Array:"
      Height          =   255
      Left            =   240
      TabIndex        =   63
      Top             =   4080
      Width           =   1605
   End
   Begin VB.Label LabelAH1 
      Caption         =   "Attribute Type :"
      Height          =   255
      Left            =   5280
      TabIndex        =   62
      Top             =   840
      Width           =   1635
   End
   Begin VB.Label LabelAH2 
      Caption         =   "Total Length :"
      Height          =   255
      Left            =   5280
      TabIndex        =   61
      Top             =   1440
      Width           =   1605
   End
   Begin VB.Label Label22 
      Caption         =   "PhysicalDrive0:"
      BeginProperty Font 
         Name            =   "MS Sans Serif"
         Size            =   8.25
         Charset         =   162
         Weight          =   700
         Underline       =   0   'False
         Italic          =   0   'False
         Strikethrough   =   0   'False
      EndProperty
      Height          =   255
      Left            =   1080
      TabIndex        =   60
      Top             =   120
      Width           =   1695
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   0
      Left            =   1920
      TabIndex        =   59
      Top             =   480
      Width           =   3045
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   1
      Left            =   1920
      TabIndex        =   58
      Top             =   720
      Width           =   3045
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   2
      Left            =   1920
      TabIndex        =   57
      Top             =   960
      Width           =   3045
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   3
      Left            =   1920
      TabIndex        =   56
      Top             =   1200
      Width           =   3045
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   4
      Left            =   1920
      TabIndex        =   55
      Top             =   1440
      Width           =   3045
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   5
      Left            =   1920
      TabIndex        =   54
      Top             =   1680
      Width           =   3045
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   6
      Left            =   1920
      TabIndex        =   53
      Top             =   1920
      Width           =   3045
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   7
      Left            =   1920
      TabIndex        =   52
      Top             =   2160
      Width           =   3045
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   8
      Left            =   1920
      TabIndex        =   51
      Top             =   2400
      Width           =   3045
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   9
      Left            =   1920
      TabIndex        =   50
      Top             =   2640
      Width           =   3045
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   10
      Left            =   1920
      TabIndex        =   49
      Top             =   2880
      Width           =   3045
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   11
      Left            =   1920
      TabIndex        =   48
      Top             =   3120
      Width           =   3045
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   12
      Left            =   1920
      TabIndex        =   47
      Top             =   3360
      Width           =   3045
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   13
      Left            =   1920
      TabIndex        =   46
      Top             =   3600
      Width           =   3045
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   14
      Left            =   1920
      TabIndex        =   45
      Top             =   3840
      Width           =   3045
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   15
      Left            =   1920
      TabIndex        =   44
      Top             =   4080
      Width           =   3045
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   16
      Left            =   6960
      TabIndex        =   43
      Top             =   840
      Width           =   3750
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   17
      Left            =   6960
      TabIndex        =   42
      Top             =   1440
      Width           =   3750
   End
   Begin VB.Label Label24 
      Alignment       =   1  'Right Justify
      Caption         =   "File System Type:"
      Height          =   255
      Left            =   2880
      TabIndex        =   41
      Top             =   120
      Width           =   1335
   End
   Begin VB.Label Label25 
      Caption         =   "NTFS"
      Height          =   255
      Left            =   4320
      TabIndex        =   40
      Top             =   120
      Width           =   615
   End
   Begin VB.Label LabelAH3 
      Caption         =   "Non-resident Flag:"
      Height          =   255
      Left            =   5280
      TabIndex        =   39
      Top             =   1680
      Width           =   1605
   End
   Begin VB.Label LabelAH4 
      Caption         =   "Name Length:"
      Height          =   255
      Left            =   5280
      TabIndex        =   38
      Top             =   1920
      Width           =   1605
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   18
      Left            =   6960
      TabIndex        =   37
      Top             =   1680
      Width           =   3750
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   19
      Left            =   6960
      TabIndex        =   36
      Top             =   1920
      Width           =   3750
   End
   Begin VB.Label LabelAH5 
      Caption         =   "Offset to Name:"
      Height          =   255
      Left            =   5280
      TabIndex        =   35
      Top             =   2160
      Width           =   1605
   End
   Begin VB.Label LabelAH6 
      Caption         =   "Flags:"
      Height          =   255
      Left            =   5280
      TabIndex        =   34
      Top             =   2400
      Width           =   1605
   End
   Begin VB.Label LabelAH7 
      Caption         =   "Attribute Id:"
      Height          =   255
      Left            =   5280
      TabIndex        =   33
      Top             =   2640
      Width           =   1605
   End
   Begin VB.Label LabelAH8 
      Caption         =   "Length of Attribute:"
      Height          =   255
      Left            =   5280
      TabIndex        =   32
      Top             =   2880
      Width           =   1605
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   20
      Left            =   6960
      TabIndex        =   31
      Top             =   2160
      Width           =   3750
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   21
      Left            =   6960
      TabIndex        =   30
      Top             =   2400
      Width           =   3750
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   22
      Left            =   6960
      TabIndex        =   29
      Top             =   2640
      Width           =   3750
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   23
      Left            =   6960
      TabIndex        =   28
      Top             =   2880
      Width           =   3750
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   37
      Left            =   6960
      TabIndex        =   27
      Top             =   6840
      Width           =   3750
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   36
      Left            =   6960
      TabIndex        =   26
      Top             =   6600
      Width           =   3750
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   35
      Left            =   6960
      TabIndex        =   25
      Top             =   6360
      Width           =   3750
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   34
      Left            =   6960
      TabIndex        =   24
      Top             =   6120
      Width           =   3750
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   33
      Left            =   6960
      TabIndex        =   23
      Top             =   5880
      Width           =   3750
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   32
      Left            =   6960
      TabIndex        =   22
      Top             =   5640
      Width           =   3750
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   31
      Left            =   6960
      TabIndex        =   21
      Top             =   5400
      Width           =   3750
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   30
      Left            =   6960
      TabIndex        =   20
      Top             =   5160
      Width           =   3750
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   29
      Left            =   6960
      TabIndex        =   19
      Top             =   4920
      Width           =   3750
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   28
      Left            =   6960
      TabIndex        =   18
      Top             =   4680
      Width           =   3750
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   27
      Left            =   6960
      TabIndex        =   17
      Top             =   4440
      Width           =   3750
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   26
      Left            =   6960
      TabIndex        =   16
      Top             =   3600
      Width           =   3750
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   25
      Left            =   6960
      TabIndex        =   15
      Top             =   3360
      Width           =   3750
   End
   Begin VB.Label Label23 
      Caption         =   "0"
      Height          =   255
      Index           =   24
      Left            =   6960
      TabIndex        =   14
      Top             =   3120
      Width           =   3750
   End
   Begin VB.Label LabelA11 
      Caption         =   "11:"
      Height          =   255
      Left            =   5280
      TabIndex        =   13
      Top             =   6840
      Width           =   1605
   End
   Begin VB.Label LabelA10 
      Caption         =   "10:"
      Height          =   255
      Left            =   5280
      TabIndex        =   12
      Top             =   6600
      Width           =   1605
   End
   Begin VB.Label LabelA9 
      Caption         =   "9:"
      Height          =   255
      Left            =   5280
      TabIndex        =   11
      Top             =   6360
      Width           =   1605
   End
   Begin VB.Label LabelA8 
      Caption         =   "8:"
      Height          =   255
      Left            =   5280
      TabIndex        =   10
      Top             =   6120
      Width           =   1605
   End
   Begin VB.Label LabelA7 
      Caption         =   "7:"
      Height          =   255
      Left            =   5280
      TabIndex        =   9
      Top             =   5880
      Width           =   1605
   End
   Begin VB.Label LabelA6 
      Caption         =   "6:"
      Height          =   255
      Left            =   5280
      TabIndex        =   8
      Top             =   5640
      Width           =   1605
   End
   Begin VB.Label LabelA5 
      Caption         =   "5:"
      Height          =   255
      Left            =   5280
      TabIndex        =   7
      Top             =   5400
      Width           =   1605
   End
   Begin VB.Label LabelA4 
      Caption         =   "4:"
      Height          =   255
      Left            =   5280
      TabIndex        =   6
      Top             =   5160
      Width           =   1605
   End
   Begin VB.Label LabelA3 
      Caption         =   "3:"
      Height          =   255
      Left            =   5280
      TabIndex        =   5
      Top             =   4920
      Width           =   1605
   End
   Begin VB.Label LabelA2 
      Caption         =   "2:"
      Height          =   255
      Left            =   5280
      TabIndex        =   4
      Top             =   4680
      Width           =   1605
   End
   Begin VB.Label LabelA1 
      Caption         =   "1:"
      Height          =   255
      Left            =   5280
      TabIndex        =   3
      Top             =   4440
      Width           =   1605
   End
   Begin VB.Label LabelAH11 
      Caption         =   "Padding:"
      Height          =   255
      Left            =   5280
      TabIndex        =   2
      Top             =   3600
      Width           =   1605
   End
   Begin VB.Label LabelAH10 
      Caption         =   "Indexed Flag:"
      Height          =   255
      Left            =   5280
      TabIndex        =   1
      Top             =   3360
      Width           =   1605
   End
   Begin VB.Label LabelAH9 
      Caption         =   "Offset to Attribute:"
      Height          =   255
      Left            =   5280
      TabIndex        =   0
      Top             =   3120
      Width           =   1605
   End
End
Attribute VB_Name = "Form21"
Attribute VB_GlobalNameSpace = False
Attribute VB_Creatable = False
Attribute VB_PredeclaredId = True
Attribute VB_Exposed = False
Option Explicit
Dim A_FileTime As FILETIME
Dim A_SystemTime As SYSTEMTIME

Dim TXT As String
Dim X As Integer
Dim Y As Integer
Dim Z As Integer
Dim N As Integer
Dim P As Integer
Dim C As Integer
Rem /* Magic number 'FILE' */
Dim Magic_Bytes As String
Rem /* Offset to the update sequence */
Dim Off_Upd_Seq As Long
Rem /* Size in words of Update Sequence Number & Array (S) */
Dim USNA_Size As Long
Rem /* $LogFile Sequence Number (LSN) */ (QWord)
Dim LogFile_Seq_Num As Double
Rem /* Sequence number */
Dim Sequence_Number As Long
Rem /* Hard link count */
Dim Hard_Link_Count As Long
Rem /* Offset to the first Attribute */
Dim Off_First_Attrib As Long
Rem /* Flags */
Dim Flags As Long
Rem /* Real size of the FILE record */ (DWord)
Dim FRecord_Real_Size As Double
Rem /* Allocated size of the FILE record */ (DWord)
Dim FRecord_Alloc_Size As Double
Rem /* File reference to the base FILE record */ (QWord)
Dim FRecord_BaseFile As Double
Rem /* Next Attribute Id */
Dim Next_Attrib_Id As Long
Rem /* Align to 4 byte boundary */ (WINDOWS XP)
Dim Align_To_4_Byte_Boundary As Long
Rem /* Number of this MFT Record) */ (WINDOWS XP) (DWord)
Dim MFT_Record_Number As Double
Rem /* Update Sequence Number (the offset depends on operation system) */
Dim Upd_Seq_Number As Long
Rem /* Update Sequence Array (the offset depends on operation system) */
Dim Upd_Seq_Num_Array As Long
Dim S1 As Long
Dim S2 As Long
Dim S3 As Long
Dim S4 As Double
Dim H As String
Rem Standard Attribute Header
Rem 0x00 4   Attribute Type (e.g. 0x10, 0x60)
Rem 0x04 4   Length (including this header)
Rem 0x08 1 0x00 Non-resident flag
Rem 0x09 1 0x00 Name length
Rem 0x0A 2 0x00 Offset to the Name
Rem 0x0C 2 0x00 Flags
Rem 0x0E 2   Attribute Id (a)
Rem 0x10 4 L Length of the Attribute
Rem 0x14 2 0x18 Offset to the Attribute
Rem 0x16 1   Indexed flag
Rem 0x17 1 0x00 Padding
Rem 0x18 L   The Attribute
Dim SAH_AttributeType As Long
Dim SAH_TotalLength As Long
Dim SAH_NonResidentFlag As Byte
Dim SAH_NameLength As Byte
Dim SAH_OffsetToName As Integer
Dim SAH_Flags As Integer
Dim SAH_AttributeId As Integer
Dim SAH_AttributeLength As Long
Dim SAH_OffsetToAttribute As Integer
Dim SAH_IndexedFlag As Byte
Dim SAH_Padding As Byte
Rem Attribute
Rem $STANDARD_INFORMATION (0x10)
Rem 0x00 8   C Time - File Creation
Rem 0x08 8   A Time - File Altered
Rem 0x10 8   M Time - MFT Changed
Rem 0x18 8   R Time - File Read
Rem 0x20 4   DOS File Permissions
Rem 0x24 4   Maximum Number of Versions
Rem 0x28 4   Version Number
Rem 0x2C 4   Class Id
Rem 0x30 4   Owner Id
Rem 0x34 4   Security Id
Rem 0x38 8   Quota Charged
Rem 0x40 8   Update Sequence Number (USN)
Dim SI_C_Time As Double
Dim SI_A_Time As Double
Dim SI_M_Time As Double
Dim SI_R_Time As Double
Dim SI_Dos_FilePerms As Long
Dim SI_Max_NumVersions As Long
Dim SI_Version_Number As Long
Dim SI_Class_ID As Long
Dim SI_Owner_ID As Long
Dim SI_Security_ID As Long
Dim SI_Quota_Charged As Double
Dim SI_Upd_Seq_Num As Double
Rem Attribute
Rem $FILE_NAME (0x30)
Rem 0x00 8 File reference to the parent directory.
Rem 0x08 8 C Time - File Creation
Rem 0x10 8 A Time - File Altered
Rem 0x18 8 M Time - MFT Changed
Rem 0x20 8 R Time - File Read
Rem 0x28 8 Allocated size of the file
Rem 0x30 8 Real size of the file
Rem 0x38 4 Flags, e.g. Directory, compressed, hidden
Rem 0x3c 4 Used by EAs and Reparse
Rem 0x40 1 Filename length in characters (L)
Rem 0x41 1 Filename namespace
Rem 0x42 2L File name in Unicode (not null terminated)
Dim FN_RefToParentDir As Double
Dim FN_C_Time As Double
Dim FN_A_Time As Double
Dim FN_M_Time As Double
Dim FN_R_Time As Double
Dim FN_AllocSize As Double
Dim FN_RealSize As Double
Dim FN_Flags As Long
Dim FN_EAs_Reparse As Long
Dim FN_NameLength As Byte
Dim FN_NameSpace As Byte
Dim FN_Name As String
Rem $VOLUME_NAME (0x70)
Rem 0x00 Unicode Name
Dim Volume_Name As String
Rem $VOLUME_INFORMATION (0x70)
Rem 0x00 8 Always zero?
Rem 0x08 1 Major version number
Rem 0x09 1 Minor version number
Rem 0x0A 2 Flags
Rem 0x0C 4 Always zero?
Dim VI_AlwaysZero1 As Double
Dim VI_MajorVersion As Byte
Dim VI_MinorVersion As Byte
Dim VI_Flags As Integer
Dim VI_AlwaysZero2 As Long

Rem $INDEX_ROOT (0x90)
Rem 0x00 4 Attribute Type
Rem 0x04 4 Collation Rule
Rem 0x08 4 Size of Index Allocation Entry (bytes)
Rem 0x0C 1 Clusters per Index Record
Rem 0x0D 3 Padding (Align to 8 bytes)
Dim IR_AttributeType As Long
Dim IR_CollationRule As Long
Dim IR_AllocEntrySize As Long
Dim IR_ClustPerIndexRec As Byte
Dim IR_Padding As String
Rem Index Header
Rem 0x00 4 Offset to first Index Entry
Rem 0x04 4 Total size of the Index Entries
Rem 0x08 4 Allocated size of the Index Entries
Rem 0x0C 1 Flags
Rem 0x0D 3 Padding (align to 8 bytes)
Dim IH_OffFirstIndEnrty As Long
Dim IH_TotalSizeIndEnts As Long
Dim IH_AllocSizeIndEnts As Long
Dim IH_Flags As Byte
Dim IH_Padding As String

Private Sub Form_Load()
Label22.Caption = DRV
Label32.Caption = CStr(Sector + CInt((FP - 1) / 512))
Label34.Caption = 0
N = 0
P = 0
C = 0
Call Show_MFT_File_Record
End Sub

Private Sub Show_MFT_File_Record()
On Error GoTo Hata
Label32.Caption = CStr(Sector + CInt((FP - 1) / 512))
Label34.Caption = CStr(C)
If C > 0 Then GoTo Show_Attribute
Magic_Bytes = Chr$(BSBuffer(0))
Magic_Bytes = Magic_Bytes + Chr$(BSBuffer(1))
Magic_Bytes = Magic_Bytes + Chr$(BSBuffer(2))
Magic_Bytes = Magic_Bytes + Chr$(BSBuffer(3))
S4 = CLng(BSBuffer(0))
S3 = CLng(BSBuffer(1))
S2 = CLng(BSBuffer(2))
S1 = CLng(BSBuffer(3))
Label23(0).Caption = Magic_Bytes + "   [ " + Hex((S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1) + " h ]"
Off_Upd_Seq = CLng(BSBuffer(5) * 256)
Off_Upd_Seq = Off_Upd_Seq + BSBuffer(4)
Label23(1).Caption = CStr(Off_Upd_Seq)
X = Off_Upd_Seq + C
If X < 512 Then
   Upd_Seq_Number = CLng(BSBuffer(X + 1))
   Upd_Seq_Number = Upd_Seq_Number * 256
   Upd_Seq_Number = Upd_Seq_Number + BSBuffer(X)
   Label23(1).Caption = Label23(1).Caption + "   [ " + CStr(Upd_Seq_Number) + " at offset " + CStr(Off_Upd_Seq) + " ]"
End If
USNA_Size = CLng(BSBuffer(7) * 256)
USNA_Size = USNA_Size + BSBuffer(6)
Label23(2).Caption = CStr(USNA_Size)
S1 = CLng(BSBuffer(12))
S2 = CLng(BSBuffer(13))
S3 = CLng(BSBuffer(14))
S4 = CLng(BSBuffer(15))
LogFile_Seq_Num = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
If LogFile_Seq_Num > 0 Then
   Label23(3).Caption = TXT + " "
   S1 = CLng(BSBuffer(8))
   S2 = CLng(BSBuffer(9))
   S3 = CLng(BSBuffer(10))
   S4 = CLng(BSBuffer(11))
   LogFile_Seq_Num = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
   TXT = ""
   For Y = 8 To 15
       H = Hex(CByte(BSBuffer(X + Y)))
       If Len(H) < 2 Then
          H = "0" + H
       End If
       If Y <> 12 Then
          TXT = H + TXT
       Else
          TXT = H + " " + TXT
       End If
   Next Y
   Label23(3).Caption = Label23(3).Caption + TXT + " h"
Else
   S1 = CLng(BSBuffer(8))
   S2 = CLng(BSBuffer(9))
   S3 = CLng(BSBuffer(10))
   S4 = CLng(BSBuffer(11))
   LogFile_Seq_Num = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
   Label23(3).Caption = CStr(LogFile_Seq_Num)
End If
Sequence_Number = CLng(BSBuffer(17) * 256)
Sequence_Number = Sequence_Number + BSBuffer(16)
Label23(4).Caption = CStr(Sequence_Number)
Hard_Link_Count = CLng(BSBuffer(19) * 256)
Hard_Link_Count = Hard_Link_Count + BSBuffer(18)
Label23(5).Caption = CStr(Hard_Link_Count)
Off_First_Attrib = CLng(BSBuffer(21) * 256)
Off_First_Attrib = Off_First_Attrib + BSBuffer(20)
Label23(6).Caption = CStr(Off_First_Attrib)
C = CInt(Off_First_Attrib)
N = C
P = N
Flags = CLng(BSBuffer(23) * 256)
Flags = Flags + BSBuffer(22)
Label23(7).Caption = CStr(Flags)
X = Flags And 3
Select Case X
       Case 1
            TXT = "   [ File, in use ]"
       Case 2
            TXT = "   [ Directory ]"
       Case 3
            TXT = "   [ Directory, in use ]"
       Case Else
            TXT = ""
End Select
If TXT <> "" Then Label23(7).Caption = Label23(7).Caption + TXT
S1 = CLng(BSBuffer(24))
S2 = CLng(BSBuffer(25))
S3 = CLng(BSBuffer(26))
S4 = CLng(BSBuffer(27))
FRecord_Real_Size = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
Label23(8).Caption = CStr(FRecord_Real_Size)
S1 = CLng(BSBuffer(28))
S2 = CLng(BSBuffer(29))
S3 = CLng(BSBuffer(30))
S4 = CLng(BSBuffer(31))
FRecord_Alloc_Size = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
Label23(9).Caption = CStr(FRecord_Alloc_Size)
S1 = CLng(BSBuffer(36))
S2 = CLng(BSBuffer(37))
S3 = CLng(BSBuffer(38))
S4 = CLng(BSBuffer(39))
FRecord_BaseFile = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
If FRecord_BaseFile > 0 Then
   S1 = CLng(BSBuffer(32))
   S2 = CLng(BSBuffer(33))
   S3 = CLng(BSBuffer(34))
   S4 = CLng(BSBuffer(35))
   FRecord_BaseFile = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
   TXT = ""
   For Y = 32 To 39
       H = Hex(CByte(BSBuffer(X + Y)))
       If Len(H) < 2 Then
          H = "0" + H
       End If
       If Y <> 36 Then
          TXT = H + TXT
       Else
          TXT = H + " " + TXT
       End If
   Next Y
   Label23(10).Caption = Label23(3).Caption + TXT + " h"
Else
   S1 = CLng(BSBuffer(32))
   S2 = CLng(BSBuffer(33))
   S3 = CLng(BSBuffer(34))
   S4 = CLng(BSBuffer(35))
   FRecord_BaseFile = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
   Label23(10).Caption = CStr(FRecord_BaseFile)
End If
Next_Attrib_Id = CLng(BSBuffer(41) * 256)
Next_Attrib_Id = Next_Attrib_Id + BSBuffer(40)
Label23(11).Caption = CStr(Next_Attrib_Id)
Align_To_4_Byte_Boundary = CLng(BSBuffer(43) * 256)
Align_To_4_Byte_Boundary = Align_To_4_Byte_Boundary + BSBuffer(42)
Label23(12).Caption = CStr(Align_To_4_Byte_Boundary)
S1 = CLng(BSBuffer(44))
S2 = CLng(BSBuffer(45))
S3 = CLng(BSBuffer(46))
S4 = CLng(BSBuffer(47))
MFT_Record_Number = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
Label23(13).Caption = CStr(MFT_Record_Number)
Upd_Seq_Number = CLng(BSBuffer(49))
Upd_Seq_Number = Upd_Seq_Number * 256
Upd_Seq_Number = Upd_Seq_Number + BSBuffer(48)
Label23(14).Caption = CStr(Upd_Seq_Number)
X = CInt(USNA_Size)
If X > 1 Then
   X = X - 1
   TXT = ""
   If X > 1 Then
      For X = 1 To X - 1
          Upd_Seq_Num_Array = CLng(BSBuffer(50 + X) * 256)
          Upd_Seq_Num_Array = Upd_Seq_Num_Array + BSBuffer(49 + X)
          TXT = TXT + CStr(Upd_Seq_Num_Array) + ", "
      Next X
      Upd_Seq_Num_Array = CLng(BSBuffer(50 + X) * 256)
      Upd_Seq_Num_Array = Upd_Seq_Num_Array + BSBuffer(49 + X)
      TXT = TXT + CStr(Upd_Seq_Num_Array)
   Else
      Upd_Seq_Num_Array = CLng(BSBuffer(50 + X) * 256)
      Upd_Seq_Num_Array = Upd_Seq_Num_Array + BSBuffer(49 + X)
      TXT = TXT + CStr(Upd_Seq_Num_Array)
   End If
   If Len(TXT) > 34 Then
      TXT = Left$(TXT, 30) + " ..."
   End If
Else
   Upd_Seq_Num_Array = CLng(BSBuffer(51) * 256)
   Upd_Seq_Num_Array = Upd_Seq_Num_Array + BSBuffer(50)
   TXT = CStr(Upd_Seq_Num_Array)
End If
Label23(15).Caption = TXT
Show_Attribute:
S1 = CLng(BSBuffer(C))
S2 = CLng(BSBuffer(C + 1))
S3 = CLng(BSBuffer(C + 2))
S4 = CLng(BSBuffer(C + 3))
If S4 = 255 And S3 = 255 And S2 = 255 And S1 = 255 Then
   N = 0
   P = 0
   MsgBox ("End of MFT Record/Attributes..."), 0, " MFT Record/Attribute"
   Exit Sub
End If
SAH_AttributeType = CLng((S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1)
Select Case SAH_AttributeType
       Case &H10
       Label31.Caption = "$STANDARD_INFORMATION"
       Case &H20
       Label31.Caption = "$ATTRIBUTE_LIST"
       Case &H30
       Label31.Caption = "$FILE_NAME"
       Case &H40
       Label31.Caption = "$OBJECT_ID"
       Case &H50
       Label31.Caption = "$SECURITY_DESCRIPTOR"
       Case &H60
       Label31.Caption = "$VOLUME_NAME"
       Case &H70
       Label31.Caption = "$VOLUME_INFORMATION"
       Case &H80
       Label31.Caption = "$DATA"
       Case &H90
       Label31.Caption = "$INDEX_ROOT"
       Case &HA0
       Label31.Caption = "$INDEX_ALLOCATION"
       Case &HB0
       Label31.Caption = "$BITMAP"
       Case &HC0
       Label31.Caption = "$REPARSE_POINT"
       Case &HD0
       Label31.Caption = "$EA_INFORMATION"
       Case &HE0
       Label31.Caption = "$EA"
       Case &HF0
       Label31.Caption = "$PROPERTY_SET"
       Case &H100
       Label31.Caption = "$LOGGED_UTILITY_STREAM"
       Case Else
       Label31.Caption = "< unknown >"
End Select
TXT = Hex(SAH_AttributeType) + " h"
If Len(TXT) < 4 Then
   TXT = "0" + TXT
End If
Label23(16).Caption = TXT
S1 = CLng(BSBuffer(C + 4))
S2 = CLng(BSBuffer(C + 5))
S3 = CLng(BSBuffer(C + 6))
S4 = CLng(BSBuffer(C + 7))
SAH_TotalLength = CLng((S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1)
Label23(17).Caption = CStr(SAH_TotalLength)
If SAH_TotalLength < 512 - C Then
   N = C + CInt(SAH_TotalLength)
Else
   N = 0
   P = 0
End If
SAH_NonResidentFlag = BSBuffer(C + 8)
Label23(18).Caption = CStr(SAH_NonResidentFlag)
SAH_NameLength = BSBuffer(C + 9)
Label23(19).Caption = CStr(SAH_NameLength)
SAH_OffsetToName = CLng(BSBuffer(C + 11))
SAH_OffsetToName = SAH_OffsetToName * 256
SAH_OffsetToName = SAH_OffsetToName + BSBuffer(C + 10)
Label23(20).Caption = CStr(SAH_OffsetToName)
SAH_Flags = CLng(BSBuffer(C + 13))
SAH_Flags = SAH_Flags * 256
SAH_Flags = SAH_Flags + BSBuffer(C + 12)
If SAH_Flags > 0 Then
   Label23(21).Caption = Hex(SAH_Flags) + " h"
Else
   Label23(21).Caption = "0"
End If
SAH_AttributeId = CLng(BSBuffer(C + 15))
SAH_AttributeId = SAH_AttributeId * 256
SAH_AttributeId = SAH_AttributeId + BSBuffer(C + 14)
Label23(22).Caption = CStr(SAH_AttributeId)
S1 = CLng(BSBuffer(C + 16))
S2 = CLng(BSBuffer(C + 17))
S3 = CLng(BSBuffer(C + 18))
S4 = CLng(BSBuffer(C + 19))
SAH_AttributeLength = CLng((S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1)
Label23(23).Caption = CStr(SAH_AttributeLength)
SAH_OffsetToAttribute = CLng(BSBuffer(C + 21))
SAH_OffsetToAttribute = SAH_OffsetToAttribute * 256
SAH_OffsetToAttribute = SAH_OffsetToAttribute + BSBuffer(C + 20)
Label23(24).Caption = CStr(SAH_AttributeId)
SAH_IndexedFlag = BSBuffer(C + 22)
Label23(25).Caption = CStr(SAH_IndexedFlag)
SAH_Padding = BSBuffer(C + 23)
Label23(26).Caption = CStr(SAH_Padding)
Z = 2 * CInt(SAH_NameLength)
If Z > 0 Then
   TXT = Chr$(255) + Chr$(254)
   For Y = 0 To Z - 1
       TXT = TXT + Chr$(BSBuffer(C + CInt(SAH_OffsetToName) + Y))
   Next Y
   TXT = StrConv(TXT, vbFromUnicode)
   TXT = Right$(TXT, Len(TXT) - 1)
   Label23(39).Caption = TXT
Else
   Label23(39).Caption = ""
End If
Select Case SAH_AttributeType
       Case &H10
       Call Get_SI_Attribute_Layout
       Case &H20
       Call Get_Other_Attribute_Layout
       Case &H30
       Call Get_FN_Attribute_Layout
       Case &H40
       Call Get_Other_Attribute_Layout
       Case &H50
       Call Get_Other_Attribute_Layout
       Case &H60
       Call Get_VN_Attribute_Layout
       Case &H70
       Call Get_VI_Attribute_Layout
       Case &H80
       Call Get_Data_Attribute_Layout
       Case &H90
       Call Get_IR_Attribute_Layout
       Case &HA0
       Call Get_Other_Attribute_Layout
       Case &HB0
       Call Get_Other_Attribute_Layout
       Case &HC0
       Call Get_Other_Attribute_Layout
       Case &HD0
       Call Get_Other_Attribute_Layout
       Case &HE0
       Call Get_Other_Attribute_Layout
       Case &HF0
       Call Get_Other_Attribute_Layout
       Case &H100
       Call Get_Other_Attribute_Layout
       Case Else
       Call Get_Other_Attribute_Layout
End Select
Cikis:
Exit Sub
Hata:
MsgBox ("MFT Record/Attribute is invalid (wrong block) or there is an overflow (very big number) problem..."), 48, "MFT Record/Attribute ! ERROR !"
P = 0
N = 0
C = 0
Resume Cikis
End Sub

Private Sub cmdNext_Click()
P = C
C = N
Call Show_MFT_File_Record
End Sub

Private Sub cmdPrev_Click()
N = C
C = P
Call Show_MFT_File_Record
End Sub

Private Sub Get_SI_Attribute_Layout()
LabelA1.Caption = "File Creation Time:"
LabelA2.Caption = "File Altered Time:"
LabelA3.Caption = "MFT Changed Time:"
LabelA4.Caption = "File Read Time:"
LabelA5.Caption = "DOS File Perms:"
LabelA6.Caption = "Max. Num of Vers:"
LabelA7.Caption = "Version Number:"
LabelA8.Caption = "Class Id:"
LabelA9.Caption = "Owner Id:"
LabelA10.Caption = "Security Id:"
LabelA11.Caption = "Ouota Charged:"
LabelA12.Caption = "Update Seq. Num:"
X = C + SAH_OffsetToAttribute
S1 = CLng(BSBuffer(X + 4))
S2 = CLng(BSBuffer(X + 5))
S3 = CLng(BSBuffer(X + 6))
S4 = CLng(BSBuffer(X + 7))
SI_C_Time = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
S1 = CLng(BSBuffer(X))
S2 = CLng(BSBuffer(X + 1))
S3 = CLng(BSBuffer(X + 2))
S4 = CLng(BSBuffer(X + 3))
SI_C_Time = (SI_C_Time * (2 ^ 32)) + (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
TXT = ""
For Y = 0 To 7
    H = Hex(CByte(BSBuffer(X + Y)))
    If Len(H) < 2 Then
       H = "0" + H
    End If
    If Y <> 4 Then
       TXT = H + TXT
    Else
       TXT = H + " " + TXT
    End If
Next Y
Label23(27).Caption = TXT + " h"
A_FileTime.dwLowDateTime.LowWord.LowByte = BSBuffer(X)
A_FileTime.dwLowDateTime.LowWord.HighByte = BSBuffer(X + 1)
A_FileTime.dwLowDateTime.HighWord.LowByte = BSBuffer(X + 2)
A_FileTime.dwLowDateTime.HighWord.HighByte = BSBuffer(X + 3)
A_FileTime.dwHighDateTime.LowWord.LowByte = BSBuffer(X + 4)
A_FileTime.dwHighDateTime.LowWord.HighByte = BSBuffer(X + 5)
A_FileTime.dwHighDateTime.HighWord.LowByte = BSBuffer(X + 6)
A_FileTime.dwHighDateTime.HighWord.HighByte = BSBuffer(X + 7)
A_SystemTime.wDayOfWeek.LowByte = 0
A_SystemTime.wDayOfWeek.HighByte = 0
A_SystemTime.wDay.LowByte = 0
A_SystemTime.wDay.HighByte = 0
A_SystemTime.wMonth.LowByte = 0
A_SystemTime.wMonth.HighByte = 0
A_SystemTime.wYear.LowByte = 0
A_SystemTime.wYear.HighByte = 0
A_SystemTime.wHour.LowByte = 0
A_SystemTime.wHour.HighByte = 0
A_SystemTime.wMinute.LowByte = 0
A_SystemTime.wMinute.HighByte = 0
A_SystemTime.wSecond.LowByte = 0
A_SystemTime.wSecond.HighByte = 0
A_SystemTime.wMilliSeconds.LowByte = 0
A_SystemTime.wMilliSeconds.HighByte = 0
If FileTimeToSystemTime(A_FileTime, A_SystemTime) <> 0 Then
   TXT = CStr((A_SystemTime.wDay.HighByte * 256) + A_SystemTime.wDay.LowByte) + "/"
   TXT = TXT + CStr((A_SystemTime.wMonth.HighByte * 256) + A_SystemTime.wMonth.LowByte) + "/"
   TXT = TXT + CStr((A_SystemTime.wYear.HighByte * 256) + A_SystemTime.wYear.LowByte) + "  "
   TXT = TXT + CStr((A_SystemTime.wHour.HighByte * 256) + A_SystemTime.wHour.LowByte) + ":"
   TXT = TXT + CStr((A_SystemTime.wMinute.HighByte * 256) + A_SystemTime.wMinute.LowByte) + ":"
   TXT = TXT + CStr((A_SystemTime.wSecond.HighByte * 256) + A_SystemTime.wSecond.LowByte)
   Label23(27).Caption = Label23(27).Caption + "   [ " + TXT + " ]"
End If
S1 = CLng(BSBuffer(X + 12))
S2 = CLng(BSBuffer(X + 13))
S3 = CLng(BSBuffer(X + 14))
S4 = CLng(BSBuffer(X + 15))
SI_A_Time = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
S1 = CLng(BSBuffer(X + 8))
S2 = CLng(BSBuffer(X + 9))
S3 = CLng(BSBuffer(X + 10))
S4 = CLng(BSBuffer(X + 11))
SI_A_Time = (SI_A_Time * (2 ^ 32)) + (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
TXT = ""
For Y = 8 To 15
    H = Hex(CByte(BSBuffer(X + Y)))
    If Len(H) < 2 Then
       H = "0" + H
    End If
    If Y <> 12 Then
       TXT = H + TXT
    Else
       TXT = H + " " + TXT
    End If
Next Y
Label23(28).Caption = TXT + " h"
A_FileTime.dwLowDateTime.LowWord.LowByte = BSBuffer(X + 8)
A_FileTime.dwLowDateTime.LowWord.HighByte = BSBuffer(X + 9)
A_FileTime.dwLowDateTime.HighWord.LowByte = BSBuffer(X + 10)
A_FileTime.dwLowDateTime.HighWord.HighByte = BSBuffer(X + 11)
A_FileTime.dwHighDateTime.LowWord.LowByte = BSBuffer(X + 12)
A_FileTime.dwHighDateTime.LowWord.HighByte = BSBuffer(X + 13)
A_FileTime.dwHighDateTime.HighWord.LowByte = BSBuffer(X + 14)
A_FileTime.dwHighDateTime.HighWord.HighByte = BSBuffer(X + 15)
A_SystemTime.wDayOfWeek.LowByte = 0
A_SystemTime.wDayOfWeek.HighByte = 0
A_SystemTime.wDay.LowByte = 0
A_SystemTime.wDay.HighByte = 0
A_SystemTime.wMonth.LowByte = 0
A_SystemTime.wMonth.HighByte = 0
A_SystemTime.wYear.LowByte = 0
A_SystemTime.wYear.HighByte = 0
A_SystemTime.wHour.LowByte = 0
A_SystemTime.wHour.HighByte = 0
A_SystemTime.wMinute.LowByte = 0
A_SystemTime.wMinute.HighByte = 0
A_SystemTime.wSecond.LowByte = 0
A_SystemTime.wSecond.HighByte = 0
A_SystemTime.wMilliSeconds.LowByte = 0
A_SystemTime.wMilliSeconds.HighByte = 0
If FileTimeToSystemTime(A_FileTime, A_SystemTime) <> 0 Then
   TXT = CStr((A_SystemTime.wDay.HighByte * 256) + A_SystemTime.wDay.LowByte) + "/"
   TXT = TXT + CStr((A_SystemTime.wMonth.HighByte * 256) + A_SystemTime.wMonth.LowByte) + "/"
   TXT = TXT + CStr((A_SystemTime.wYear.HighByte * 256) + A_SystemTime.wYear.LowByte) + "  "
   TXT = TXT + CStr((A_SystemTime.wHour.HighByte * 256) + A_SystemTime.wHour.LowByte) + ":"
   TXT = TXT + CStr((A_SystemTime.wMinute.HighByte * 256) + A_SystemTime.wMinute.LowByte) + ":"
   TXT = TXT + CStr((A_SystemTime.wSecond.HighByte * 256) + A_SystemTime.wSecond.LowByte)
   Label23(28).Caption = Label23(28).Caption + "   [ " + TXT + " ]"
End If
S1 = CLng(BSBuffer(X + 20))
S2 = CLng(BSBuffer(X + 21))
S3 = CLng(BSBuffer(X + 22))
S4 = CLng(BSBuffer(X + 23))
SI_M_Time = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
S1 = CLng(BSBuffer(X + 16))
S2 = CLng(BSBuffer(X + 17))
S3 = CLng(BSBuffer(X + 18))
S4 = CLng(BSBuffer(X + 19))
SI_M_Time = (SI_M_Time * (2 ^ 32)) + (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
TXT = ""
For Y = 16 To 23
    H = Hex(CByte(BSBuffer(X + Y)))
    If Len(H) < 2 Then
       H = "0" + H
    End If
    If Y <> 20 Then
       TXT = H + TXT
    Else
       TXT = H + " " + TXT
    End If
Next Y
Label23(29).Caption = TXT + " h"
A_FileTime.dwLowDateTime.LowWord.LowByte = BSBuffer(X + 16)
A_FileTime.dwLowDateTime.LowWord.HighByte = BSBuffer(X + 17)
A_FileTime.dwLowDateTime.HighWord.LowByte = BSBuffer(X + 18)
A_FileTime.dwLowDateTime.HighWord.HighByte = BSBuffer(X + 19)
A_FileTime.dwHighDateTime.LowWord.LowByte = BSBuffer(X + 20)
A_FileTime.dwHighDateTime.LowWord.HighByte = BSBuffer(X + 21)
A_FileTime.dwHighDateTime.HighWord.LowByte = BSBuffer(X + 22)
A_FileTime.dwHighDateTime.HighWord.HighByte = BSBuffer(X + 23)
A_SystemTime.wDayOfWeek.LowByte = 0
A_SystemTime.wDayOfWeek.HighByte = 0
A_SystemTime.wDay.LowByte = 0
A_SystemTime.wDay.HighByte = 0
A_SystemTime.wMonth.LowByte = 0
A_SystemTime.wMonth.HighByte = 0
A_SystemTime.wYear.LowByte = 0
A_SystemTime.wYear.HighByte = 0
A_SystemTime.wHour.LowByte = 0
A_SystemTime.wHour.HighByte = 0
A_SystemTime.wMinute.LowByte = 0
A_SystemTime.wMinute.HighByte = 0
A_SystemTime.wSecond.LowByte = 0
A_SystemTime.wSecond.HighByte = 0
A_SystemTime.wMilliSeconds.LowByte = 0
A_SystemTime.wMilliSeconds.HighByte = 0
If FileTimeToSystemTime(A_FileTime, A_SystemTime) <> 0 Then
   TXT = CStr((A_SystemTime.wDay.HighByte * 256) + A_SystemTime.wDay.LowByte) + "/"
   TXT = TXT + CStr((A_SystemTime.wMonth.HighByte * 256) + A_SystemTime.wMonth.LowByte) + "/"
   TXT = TXT + CStr((A_SystemTime.wYear.HighByte * 256) + A_SystemTime.wYear.LowByte) + "  "
   TXT = TXT + CStr((A_SystemTime.wHour.HighByte * 256) + A_SystemTime.wHour.LowByte) + ":"
   TXT = TXT + CStr((A_SystemTime.wMinute.HighByte * 256) + A_SystemTime.wMinute.LowByte) + ":"
   TXT = TXT + CStr((A_SystemTime.wSecond.HighByte * 256) + A_SystemTime.wSecond.LowByte)
   Label23(29).Caption = Label23(29).Caption + "   [ " + TXT + " ]"
End If
S1 = CLng(BSBuffer(X + 28))
S2 = CLng(BSBuffer(X + 29))
S3 = CLng(BSBuffer(X + 30))
S4 = CLng(BSBuffer(X + 31))
SI_R_Time = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
S1 = CLng(BSBuffer(X + 24))
S2 = CLng(BSBuffer(X + 25))
S3 = CLng(BSBuffer(X + 26))
S4 = CLng(BSBuffer(X + 27))
SI_R_Time = (SI_R_Time * (2 ^ 32)) + (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
TXT = ""
For Y = 24 To 31
    H = Hex(CByte(BSBuffer(X + Y)))
    If Len(H) < 2 Then
       H = "0" + H
    End If
    If Y <> 28 Then
       TXT = H + TXT
    Else
       TXT = H + " " + TXT
    End If
Next Y
Label23(30).Caption = TXT + " h"
A_FileTime.dwLowDateTime.LowWord.LowByte = BSBuffer(X + 24)
A_FileTime.dwLowDateTime.LowWord.HighByte = BSBuffer(X + 25)
A_FileTime.dwLowDateTime.HighWord.LowByte = BSBuffer(X + 26)
A_FileTime.dwLowDateTime.HighWord.HighByte = BSBuffer(X + 27)
A_FileTime.dwHighDateTime.LowWord.LowByte = BSBuffer(X + 28)
A_FileTime.dwHighDateTime.LowWord.HighByte = BSBuffer(X + 29)
A_FileTime.dwHighDateTime.HighWord.LowByte = BSBuffer(X + 30)
A_FileTime.dwHighDateTime.HighWord.HighByte = BSBuffer(X + 31)
A_SystemTime.wDayOfWeek.LowByte = 0
A_SystemTime.wDayOfWeek.HighByte = 0
A_SystemTime.wDay.LowByte = 0
A_SystemTime.wDay.HighByte = 0
A_SystemTime.wMonth.LowByte = 0
A_SystemTime.wMonth.HighByte = 0
A_SystemTime.wYear.LowByte = 0
A_SystemTime.wYear.HighByte = 0
A_SystemTime.wHour.LowByte = 0
A_SystemTime.wHour.HighByte = 0
A_SystemTime.wMinute.LowByte = 0
A_SystemTime.wMinute.HighByte = 0
A_SystemTime.wSecond.LowByte = 0
A_SystemTime.wSecond.HighByte = 0
A_SystemTime.wMilliSeconds.LowByte = 0
A_SystemTime.wMilliSeconds.HighByte = 0
If FileTimeToSystemTime(A_FileTime, A_SystemTime) <> 0 Then
   TXT = CStr((A_SystemTime.wDay.HighByte * 256) + A_SystemTime.wDay.LowByte) + "/"
   TXT = TXT + CStr((A_SystemTime.wMonth.HighByte * 256) + A_SystemTime.wMonth.LowByte) + "/"
   TXT = TXT + CStr((A_SystemTime.wYear.HighByte * 256) + A_SystemTime.wYear.LowByte) + "  "
   TXT = TXT + CStr((A_SystemTime.wHour.HighByte * 256) + A_SystemTime.wHour.LowByte) + ":"
   TXT = TXT + CStr((A_SystemTime.wMinute.HighByte * 256) + A_SystemTime.wMinute.LowByte) + ":"
   TXT = TXT + CStr((A_SystemTime.wSecond.HighByte * 256) + A_SystemTime.wSecond.LowByte)
   Label23(30).Caption = Label23(30).Caption + "   [ " + TXT + " ]"
End If
S1 = CLng(BSBuffer(X + 32))
S2 = CLng(BSBuffer(X + 33))
S3 = CLng(BSBuffer(X + 34))
S4 = CLng(BSBuffer(X + 35))
SI_Dos_FilePerms = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
If (SI_Dos_FilePerms And 1) = 1 Then
   Rem Read-Only
   TXT = "R "
Else
   TXT = ""
End If
If (SI_Dos_FilePerms And 2) = 2 Then
   Rem Hidden
   TXT = "H " + TXT
End If
If (SI_Dos_FilePerms And 4) = 4 Then
   Rem Hidden
   TXT = "S " + TXT
End If
If (SI_Dos_FilePerms And 32) = 32 Then
   Rem Archive
   TXT = "A " + TXT
End If
If (SI_Dos_FilePerms And 64) = 64 Then
   Rem Device
   TXT = "Dev " + TXT
End If
If (SI_Dos_FilePerms And 128) = 128 Then
   Rem Normal
   TXT = "N " + TXT
End If
If (SI_Dos_FilePerms And 256) = 256 Then
   Rem Temporary
   TXT = "T " + TXT
End If
If (SI_Dos_FilePerms And 512) = 512 Then
   Rem Sparse File
   TXT = "Sp " + TXT
End If
If (SI_Dos_FilePerms And 1024) = 1024 Then
   Rem Reparse point
   TXT = "Rp " + TXT
End If
If (SI_Dos_FilePerms And 2048) = 2048 Then
   Rem Compressed
   TXT = "C " + TXT
End If
If (SI_Dos_FilePerms And 4096) = 4096 Then
   Rem Offline
   TXT = "O " + TXT
End If
If (SI_Dos_FilePerms And 8192) = 8192 Then
   Rem Not Content Indexed
   TXT = "Ni " + TXT
End If
If (SI_Dos_FilePerms And 16384) = 16384 Then
   Rem Encrypted
   TXT = "E " + TXT
End If
Label23(31).Caption = Hex(SI_Dos_FilePerms) + " h" + "   [ " + TXT + "]"
S1 = CLng(BSBuffer(X + 36))
S2 = CLng(BSBuffer(X + 37))
S3 = CLng(BSBuffer(X + 38))
S4 = CLng(BSBuffer(X + 39))
SI_Max_NumVersions = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
Label23(32).Caption = Hex(SI_Max_NumVersions)
S1 = CLng(BSBuffer(X + 40))
S2 = CLng(BSBuffer(X + 41))
S3 = CLng(BSBuffer(X + 42))
S4 = CLng(BSBuffer(X + 43))
SI_Version_Number = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
Label23(33).Caption = Hex(SI_Version_Number)
S1 = CLng(BSBuffer(X + 44))
S2 = CLng(BSBuffer(X + 45))
S3 = CLng(BSBuffer(X + 46))
S4 = CLng(BSBuffer(X + 47))
SI_Class_ID = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
Label23(34).Caption = Hex(SI_Class_ID)
S1 = CLng(BSBuffer(X + 48))
S2 = CLng(BSBuffer(X + 49))
S3 = CLng(BSBuffer(X + 50))
S4 = CLng(BSBuffer(X + 51))
SI_Owner_ID = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
Label23(35).Caption = Hex(SI_Owner_ID)
S1 = CLng(BSBuffer(X + 52))
S2 = CLng(BSBuffer(X + 53))
S3 = CLng(BSBuffer(X + 54))
S4 = CLng(BSBuffer(X + 55))
SI_Security_ID = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
Label23(36).Caption = Hex(SI_Security_ID)
S1 = CLng(BSBuffer(X + 60))
S2 = CLng(BSBuffer(X + 61))
S3 = CLng(BSBuffer(X + 62))
S4 = CLng(BSBuffer(X + 63))
SI_Quota_Charged = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
If SI_Quota_Charged > 0 Then
   S1 = CLng(BSBuffer(X + 56))
   S2 = CLng(BSBuffer(X + 57))
   S3 = CLng(BSBuffer(X + 58))
   S4 = CLng(BSBuffer(X + 59))
   SI_Quota_Charged = (SI_Quota_Charged * (2 ^ 32)) + (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
   TXT = ""
   For Y = 56 To 63
       H = Hex(CByte(BSBuffer(X + Y)))
       If Len(H) < 2 Then
          H = "0" + H
       End If
       If Y <> 60 Then
          TXT = H + TXT
       Else
          TXT = H + " " + TXT
       End If
   Next Y
   Label23(37).Caption = TXT + " h"
Else
   S1 = CLng(BSBuffer(X + 56))
   S2 = CLng(BSBuffer(X + 57))
   S3 = CLng(BSBuffer(X + 58))
   S4 = CLng(BSBuffer(X + 59))
   SI_Quota_Charged = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
   Label23(37).Caption = CStr(SI_Quota_Charged)
End If
S1 = CLng(BSBuffer(X + 68))
S2 = CLng(BSBuffer(X + 69))
S3 = CLng(BSBuffer(X + 70))
S4 = CLng(BSBuffer(X + 71))
SI_Upd_Seq_Num = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
If SI_Upd_Seq_Num > 0 Then
   S1 = CLng(BSBuffer(X + 64))
   S2 = CLng(BSBuffer(X + 65))
   S3 = CLng(BSBuffer(X + 66))
   S4 = CLng(BSBuffer(X + 67))
   SI_Upd_Seq_Num = (SI_Upd_Seq_Num * (2 ^ 32)) + (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
   TXT = ""
   For Y = 64 To 71
       H = Hex(CByte(BSBuffer(X + Y)))
       If Len(H) < 2 Then
          H = "0" + H
       End If
       If Y <> 68 Then
          TXT = H + TXT
       Else
          TXT = H + " " + TXT
       End If
   Next Y
   Label23(38).Caption = TXT + " h"
Else
   S1 = CLng(BSBuffer(X + 64))
   S2 = CLng(BSBuffer(X + 65))
   S3 = CLng(BSBuffer(X + 66))
   S4 = CLng(BSBuffer(X + 67))
   SI_Upd_Seq_Num = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
   Label23(38).Caption = CStr(SI_Upd_Seq_Num)
End If
End Sub

Private Sub Get_FN_Attribute_Layout()
LabelA1.Caption = "Ref. to Parent Dir:"
LabelA2.Caption = "File Creation Time:"
LabelA3.Caption = "File Altered Time:"
LabelA4.Caption = "MFT Changed Time:"
LabelA5.Caption = "File Read Time:"
LabelA6.Caption = "Allocated Size:"
LabelA7.Caption = "Real File Size:"
LabelA8.Caption = "Flags:"
LabelA9.Caption = "EAs and Reparse:"
LabelA10.Caption = "File Name Length:"
LabelA11.Caption = "Name Space:"
LabelA12.Caption = "File Name:"
X = C + SAH_OffsetToAttribute
S1 = CLng(BSBuffer(X + 4))
S2 = CLng(BSBuffer(X + 5))
S3 = CLng(BSBuffer(X + 6))
S4 = CLng(BSBuffer(X + 7))
FN_RefToParentDir = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
If FN_RefToParentDir > 0 Then
   S1 = CLng(BSBuffer(X))
   S2 = CLng(BSBuffer(X + 1))
   S3 = CLng(BSBuffer(X + 2))
   S4 = CLng(BSBuffer(X + 3))
   FN_RefToParentDir = (FN_RefToParentDir * (2 ^ 32)) + (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
   TXT = ""
   For Y = 0 To 7
       H = Hex(CByte(BSBuffer(X + Y)))
       If Len(H) < 2 Then
          H = "0" + H
       End If
       If Y <> 4 Then
          TXT = H + TXT
       Else
          TXT = H + " " + TXT
       End If
   Next Y
   Label23(27).Caption = TXT + " h"
Else
   S1 = CLng(BSBuffer(X))
   S2 = CLng(BSBuffer(X + 1))
   S3 = CLng(BSBuffer(X + 2))
   S4 = CLng(BSBuffer(X + 3))
   FN_RefToParentDir = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
   Label23(27).Caption = CStr(FN_RefToParentDir)
End If
S1 = CLng(BSBuffer(X + 12))
S2 = CLng(BSBuffer(X + 13))
S3 = CLng(BSBuffer(X + 14))
S4 = CLng(BSBuffer(X + 15))
FN_C_Time = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
S1 = CLng(BSBuffer(X + 8))
S2 = CLng(BSBuffer(X + 9))
S3 = CLng(BSBuffer(X + 10))
S4 = CLng(BSBuffer(X + 11))
FN_C_Time = (FN_C_Time * (2 ^ 32)) + (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
TXT = ""
For Y = 8 To 15
    H = Hex(CByte(BSBuffer(X + Y)))
    If Len(H) < 2 Then
       H = "0" + H
    End If
    If Y <> 12 Then
       TXT = H + TXT
    Else
      TXT = H + " " + TXT
    End If
Next Y
Label23(28).Caption = TXT + " h"
A_FileTime.dwLowDateTime.LowWord.LowByte = BSBuffer(X + 8)
A_FileTime.dwLowDateTime.LowWord.HighByte = BSBuffer(X + 9)
A_FileTime.dwLowDateTime.HighWord.LowByte = BSBuffer(X + 10)
A_FileTime.dwLowDateTime.HighWord.HighByte = BSBuffer(X + 11)
A_FileTime.dwHighDateTime.LowWord.LowByte = BSBuffer(X + 12)
A_FileTime.dwHighDateTime.LowWord.HighByte = BSBuffer(X + 13)
A_FileTime.dwHighDateTime.HighWord.LowByte = BSBuffer(X + 14)
A_FileTime.dwHighDateTime.HighWord.HighByte = BSBuffer(X + 15)
A_SystemTime.wDayOfWeek.LowByte = 0
A_SystemTime.wDayOfWeek.HighByte = 0
A_SystemTime.wDay.LowByte = 0
A_SystemTime.wDay.HighByte = 0
A_SystemTime.wMonth.LowByte = 0
A_SystemTime.wMonth.HighByte = 0
A_SystemTime.wYear.LowByte = 0
A_SystemTime.wYear.HighByte = 0
A_SystemTime.wHour.LowByte = 0
A_SystemTime.wHour.HighByte = 0
A_SystemTime.wMinute.LowByte = 0
A_SystemTime.wMinute.HighByte = 0
A_SystemTime.wSecond.LowByte = 0
A_SystemTime.wSecond.HighByte = 0
A_SystemTime.wMilliSeconds.LowByte = 0
A_SystemTime.wMilliSeconds.HighByte = 0
If FileTimeToSystemTime(A_FileTime, A_SystemTime) <> 0 Then
   TXT = CStr((A_SystemTime.wDay.HighByte * 256) + A_SystemTime.wDay.LowByte) + "/"
   TXT = TXT + CStr((A_SystemTime.wMonth.HighByte * 256) + A_SystemTime.wMonth.LowByte) + "/"
   TXT = TXT + CStr((A_SystemTime.wYear.HighByte * 256) + A_SystemTime.wYear.LowByte) + "  "
   TXT = TXT + CStr((A_SystemTime.wHour.HighByte * 256) + A_SystemTime.wHour.LowByte) + ":"
   TXT = TXT + CStr((A_SystemTime.wMinute.HighByte * 256) + A_SystemTime.wMinute.LowByte) + ":"
   TXT = TXT + CStr((A_SystemTime.wSecond.HighByte * 256) + A_SystemTime.wSecond.LowByte)
   Label23(28).Caption = Label23(28).Caption + "   [ " + TXT + " ]"
End If
S1 = CLng(BSBuffer(X + 20))
S2 = CLng(BSBuffer(X + 21))
S3 = CLng(BSBuffer(X + 22))
S4 = CLng(BSBuffer(X + 23))
FN_A_Time = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
S1 = CLng(BSBuffer(X + 16))
S2 = CLng(BSBuffer(X + 17))
S3 = CLng(BSBuffer(X + 18))
S4 = CLng(BSBuffer(X + 19))
FN_A_Time = (FN_A_Time * (2 ^ 32)) + (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
TXT = ""
For Y = 16 To 23
    H = Hex(CByte(BSBuffer(X + Y)))
    If Len(H) < 2 Then
       H = "0" + H
    End If
    If Y <> 20 Then
       TXT = H + TXT
    Else
       TXT = H + " " + TXT
    End If
Next Y
Label23(29).Caption = TXT + " h"
A_FileTime.dwLowDateTime.LowWord.LowByte = BSBuffer(X + 16)
A_FileTime.dwLowDateTime.LowWord.HighByte = BSBuffer(X + 17)
A_FileTime.dwLowDateTime.HighWord.LowByte = BSBuffer(X + 18)
A_FileTime.dwLowDateTime.HighWord.HighByte = BSBuffer(X + 19)
A_FileTime.dwHighDateTime.LowWord.LowByte = BSBuffer(X + 20)
A_FileTime.dwHighDateTime.LowWord.HighByte = BSBuffer(X + 21)
A_FileTime.dwHighDateTime.HighWord.LowByte = BSBuffer(X + 22)
A_FileTime.dwHighDateTime.HighWord.HighByte = BSBuffer(X + 23)
A_SystemTime.wDayOfWeek.LowByte = 0
A_SystemTime.wDayOfWeek.HighByte = 0
A_SystemTime.wDay.LowByte = 0
A_SystemTime.wDay.HighByte = 0
A_SystemTime.wMonth.LowByte = 0
A_SystemTime.wMonth.HighByte = 0
A_SystemTime.wYear.LowByte = 0
A_SystemTime.wYear.HighByte = 0
A_SystemTime.wHour.LowByte = 0
A_SystemTime.wHour.HighByte = 0
A_SystemTime.wMinute.LowByte = 0
A_SystemTime.wMinute.HighByte = 0
A_SystemTime.wSecond.LowByte = 0
A_SystemTime.wSecond.HighByte = 0
A_SystemTime.wMilliSeconds.LowByte = 0
A_SystemTime.wMilliSeconds.HighByte = 0
If FileTimeToSystemTime(A_FileTime, A_SystemTime) <> 0 Then
   TXT = CStr((A_SystemTime.wDay.HighByte * 256) + A_SystemTime.wDay.LowByte) + "/"
   TXT = TXT + CStr((A_SystemTime.wMonth.HighByte * 256) + A_SystemTime.wMonth.LowByte) + "/"
   TXT = TXT + CStr((A_SystemTime.wYear.HighByte * 256) + A_SystemTime.wYear.LowByte) + "  "
   TXT = TXT + CStr((A_SystemTime.wHour.HighByte * 256) + A_SystemTime.wHour.LowByte) + ":"
   TXT = TXT + CStr((A_SystemTime.wMinute.HighByte * 256) + A_SystemTime.wMinute.LowByte) + ":"
   TXT = TXT + CStr((A_SystemTime.wSecond.HighByte * 256) + A_SystemTime.wSecond.LowByte)
   Label23(29).Caption = Label23(29).Caption + "   [ " + TXT + " ]"
End If
S1 = CLng(BSBuffer(X + 28))
S2 = CLng(BSBuffer(X + 29))
S3 = CLng(BSBuffer(X + 30))
S4 = CLng(BSBuffer(X + 31))
FN_M_Time = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
S1 = CLng(BSBuffer(X + 24))
S2 = CLng(BSBuffer(X + 25))
S3 = CLng(BSBuffer(X + 26))
S4 = CLng(BSBuffer(X + 27))
FN_M_Time = (FN_M_Time * (2 ^ 32)) + (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
TXT = ""
For Y = 24 To 31
    H = Hex(CByte(BSBuffer(X + Y)))
    If Len(H) < 2 Then
       H = "0" + H
    End If
    If Y <> 28 Then
       TXT = H + TXT
    Else
       TXT = H + " " + TXT
    End If
Next Y
Label23(30).Caption = TXT + " h"
A_FileTime.dwLowDateTime.LowWord.LowByte = BSBuffer(X + 24)
A_FileTime.dwLowDateTime.LowWord.HighByte = BSBuffer(X + 25)
A_FileTime.dwLowDateTime.HighWord.LowByte = BSBuffer(X + 26)
A_FileTime.dwLowDateTime.HighWord.HighByte = BSBuffer(X + 27)
A_FileTime.dwHighDateTime.LowWord.LowByte = BSBuffer(X + 28)
A_FileTime.dwHighDateTime.LowWord.HighByte = BSBuffer(X + 29)
A_FileTime.dwHighDateTime.HighWord.LowByte = BSBuffer(X + 30)
A_FileTime.dwHighDateTime.HighWord.HighByte = BSBuffer(X + 31)
A_SystemTime.wDayOfWeek.LowByte = 0
A_SystemTime.wDayOfWeek.HighByte = 0
A_SystemTime.wDay.LowByte = 0
A_SystemTime.wDay.HighByte = 0
A_SystemTime.wMonth.LowByte = 0
A_SystemTime.wMonth.HighByte = 0
A_SystemTime.wYear.LowByte = 0
A_SystemTime.wYear.HighByte = 0
A_SystemTime.wHour.LowByte = 0
A_SystemTime.wHour.HighByte = 0
A_SystemTime.wMinute.LowByte = 0
A_SystemTime.wMinute.HighByte = 0
A_SystemTime.wSecond.LowByte = 0
A_SystemTime.wSecond.HighByte = 0
A_SystemTime.wMilliSeconds.LowByte = 0
A_SystemTime.wMilliSeconds.HighByte = 0
If FileTimeToSystemTime(A_FileTime, A_SystemTime) <> 0 Then
   TXT = CStr((A_SystemTime.wDay.HighByte * 256) + A_SystemTime.wDay.LowByte) + "/"
   TXT = TXT + CStr((A_SystemTime.wMonth.HighByte * 256) + A_SystemTime.wMonth.LowByte) + "/"
   TXT = TXT + CStr((A_SystemTime.wYear.HighByte * 256) + A_SystemTime.wYear.LowByte) + "  "
   TXT = TXT + CStr((A_SystemTime.wHour.HighByte * 256) + A_SystemTime.wHour.LowByte) + ":"
   TXT = TXT + CStr((A_SystemTime.wMinute.HighByte * 256) + A_SystemTime.wMinute.LowByte) + ":"
   TXT = TXT + CStr((A_SystemTime.wSecond.HighByte * 256) + A_SystemTime.wSecond.LowByte)
   Label23(30).Caption = Label23(30).Caption + "   [ " + TXT + " ]"
End If
S1 = CLng(BSBuffer(X + 36))
S2 = CLng(BSBuffer(X + 37))
S3 = CLng(BSBuffer(X + 38))
S4 = CLng(BSBuffer(X + 39))
FN_R_Time = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
S1 = CLng(BSBuffer(X + 32))
S2 = CLng(BSBuffer(X + 33))
S3 = CLng(BSBuffer(X + 34))
S4 = CLng(BSBuffer(X + 35))
FN_R_Time = (FN_R_Time * (2 ^ 32)) + (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
TXT = ""
For Y = 32 To 39
    H = Hex(CByte(BSBuffer(X + Y)))
    If Len(H) < 2 Then
       H = "0" + H
    End If
    If Y <> 36 Then
       TXT = H + TXT
    Else
       TXT = H + " " + TXT
    End If
Next Y
Label23(31).Caption = TXT + " h"
A_FileTime.dwLowDateTime.LowWord.LowByte = BSBuffer(X + 32)
A_FileTime.dwLowDateTime.LowWord.HighByte = BSBuffer(X + 33)
A_FileTime.dwLowDateTime.HighWord.LowByte = BSBuffer(X + 34)
A_FileTime.dwLowDateTime.HighWord.HighByte = BSBuffer(X + 35)
A_FileTime.dwHighDateTime.LowWord.LowByte = BSBuffer(X + 36)
A_FileTime.dwHighDateTime.LowWord.HighByte = BSBuffer(X + 37)
A_FileTime.dwHighDateTime.HighWord.LowByte = BSBuffer(X + 38)
A_FileTime.dwHighDateTime.HighWord.HighByte = BSBuffer(X + 39)
A_SystemTime.wDayOfWeek.LowByte = 0
A_SystemTime.wDayOfWeek.HighByte = 0
A_SystemTime.wDay.LowByte = 0
A_SystemTime.wDay.HighByte = 0
A_SystemTime.wMonth.LowByte = 0
A_SystemTime.wMonth.HighByte = 0
A_SystemTime.wYear.LowByte = 0
A_SystemTime.wYear.HighByte = 0
A_SystemTime.wHour.LowByte = 0
A_SystemTime.wHour.HighByte = 0
A_SystemTime.wMinute.LowByte = 0
A_SystemTime.wMinute.HighByte = 0
A_SystemTime.wSecond.LowByte = 0
A_SystemTime.wSecond.HighByte = 0
A_SystemTime.wMilliSeconds.LowByte = 0
A_SystemTime.wMilliSeconds.HighByte = 0
If FileTimeToSystemTime(A_FileTime, A_SystemTime) <> 0 Then
   TXT = CStr((A_SystemTime.wDay.HighByte * 256) + A_SystemTime.wDay.LowByte) + "/"
   TXT = TXT + CStr((A_SystemTime.wMonth.HighByte * 256) + A_SystemTime.wMonth.LowByte) + "/"
   TXT = TXT + CStr((A_SystemTime.wYear.HighByte * 256) + A_SystemTime.wYear.LowByte) + "  "
   TXT = TXT + CStr((A_SystemTime.wHour.HighByte * 256) + A_SystemTime.wHour.LowByte) + ":"
   TXT = TXT + CStr((A_SystemTime.wMinute.HighByte * 256) + A_SystemTime.wMinute.LowByte) + ":"
   TXT = TXT + CStr((A_SystemTime.wSecond.HighByte * 256) + A_SystemTime.wSecond.LowByte)
   Label23(31).Caption = Label23(31).Caption + "   [ " + TXT + " ]"
End If
S1 = CLng(BSBuffer(X + 44))
S2 = CLng(BSBuffer(X + 45))
S3 = CLng(BSBuffer(X + 46))
S4 = CLng(BSBuffer(X + 47))
FN_AllocSize = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
If FN_AllocSize > 0 Then
   S1 = CLng(BSBuffer(X + 40))
   S2 = CLng(BSBuffer(X + 41))
   S3 = CLng(BSBuffer(X + 42))
   S4 = CLng(BSBuffer(X + 43))
   FN_AllocSize = (FN_AllocSize * (2 ^ 32)) + (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
   TXT = ""
   For Y = 40 To 47
       H = Hex(CByte(BSBuffer(X + Y)))
       If Len(H) < 2 Then
          H = "0" + H
       End If
       If Y <> 44 Then
          TXT = H + TXT
       Else
          TXT = H + " " + TXT
       End If
   Next Y
   Label23(32).Caption = TXT + " h"
Else
   S1 = CLng(BSBuffer(X + 40))
   S2 = CLng(BSBuffer(X + 41))
   S3 = CLng(BSBuffer(X + 42))
   S4 = CLng(BSBuffer(X + 43))
   FN_AllocSize = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
   Label23(32).Caption = CStr(FN_AllocSize)
End If
S1 = CLng(BSBuffer(X + 52))
S2 = CLng(BSBuffer(X + 53))
S3 = CLng(BSBuffer(X + 54))
S4 = CLng(BSBuffer(X + 55))
FN_RealSize = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
If FN_RealSize > 0 Then
   S1 = CLng(BSBuffer(X + 48))
   S2 = CLng(BSBuffer(X + 49))
   S3 = CLng(BSBuffer(X + 50))
   S4 = CLng(BSBuffer(X + 51))
   FN_RealSize = (FN_RealSize * (2 ^ 32)) + (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
   TXT = ""
   For Y = 48 To 55
       H = Hex(CByte(BSBuffer(X + Y)))
       If Len(H) < 2 Then
          H = "0" + H
       End If
       If Y <> 52 Then
          TXT = H + TXT
       Else
          TXT = H + " " + TXT
       End If
   Next Y
   Label23(33).Caption = TXT + " h"
Else
   S1 = CLng(BSBuffer(X + 48))
   S2 = CLng(BSBuffer(X + 49))
   S3 = CLng(BSBuffer(X + 50))
   S4 = CLng(BSBuffer(X + 51))
   FN_RealSize = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
   Label23(33).Caption = CStr(FN_RealSize)
End If
S1 = CLng(BSBuffer(X + 56))
S2 = CLng(BSBuffer(X + 57))
S3 = CLng(BSBuffer(X + 58))
S4 = CLng(BSBuffer(X + 59))
FN_Flags = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
If (FN_Flags And 1) = 1 Then
   Rem Read-Only
   TXT = "R "
Else
   TXT = ""
End If
If (FN_Flags And 2) = 2 Then
   Rem Hidden
   TXT = "H " + TXT
End If
If (FN_Flags And 4) = 4 Then
   Rem Hidden
   TXT = "S " + TXT
End If
If (FN_Flags And 32) = 32 Then
   Rem Archive
   TXT = "A " + TXT
End If
If (FN_Flags And 64) = 64 Then
   Rem Device
   TXT = "Dev " + TXT
End If
If (FN_Flags And 128) = 128 Then
   Rem Normal
   TXT = "N " + TXT
End If
If (FN_Flags And 256) = 256 Then
   Rem Temporary
   TXT = "T " + TXT
End If
If (FN_Flags And 512) = 512 Then
   Rem Sparse File
   TXT = "Sp " + TXT
End If
If (FN_Flags And 1024) = 1024 Then
   Rem Reparse point
   TXT = "Rp " + TXT
End If
If (FN_Flags And 2048) = 2048 Then
   Rem Compressed
   TXT = "C " + TXT
End If
If (FN_Flags And 4096) = 4096 Then
   Rem Offline
   TXT = "O " + TXT
End If
If (FN_Flags And 8192) = 8192 Then
   Rem Not Content Indexed
   TXT = "Ni " + TXT
End If
If (FN_Flags And 16384) = 16384 Then
   Rem Encrypted
   TXT = "E " + TXT
End If
If (FN_Flags And 268435456) = 268435456 Then
   Rem Directory
   TXT = "D " + TXT
End If
If (FN_Flags And 536870912) = 536870912 Then
   Rem Index View
   TXT = "I " + TXT
End If
Label23(34).Caption = Hex(FN_Flags) + " h" + "   [ " + TXT + "]"
S1 = CLng(BSBuffer(X + 60))
S2 = CLng(BSBuffer(X + 61))
S3 = CLng(BSBuffer(X + 62))
S4 = CLng(BSBuffer(X + 63))
FN_EAs_Reparse = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
Label23(35).Caption = CStr(FN_EAs_Reparse)
FN_NameLength = BSBuffer(X + 64)
Label23(36).Caption = CStr(FN_NameLength)
FN_NameSpace = BSBuffer(X + 65)
Label23(37).Caption = CStr(FN_NameSpace)
TXT = Chr(255) + Chr(254)
Z = 2 * CInt(FN_NameLength)
Label23(38).Caption = ""
For Y = 1 To Z
    TXT = TXT + Chr$(BSBuffer(X + 65 + Y))
Next Y
TXT = StrConv(TXT, vbFromUnicode)
TXT = Right$(TXT, Len(TXT) - 1)
Label23(38).Caption = TXT
End Sub

Private Sub Get_VN_Attribute_Layout()
LabelA1.Caption = "Volume Name:"
LabelA2.Caption = ""
LabelA3.Caption = ""
LabelA4.Caption = ""
LabelA5.Caption = ""
LabelA6.Caption = ""
LabelA7.Caption = ""
LabelA8.Caption = ""
LabelA9.Caption = ""
LabelA10.Caption = ""
LabelA11.Caption = ""
LabelA12.Caption = ""
X = C + SAH_OffsetToAttribute
TXT = Chr(255) + Chr(254)
Z = CInt(SAH_AttributeLength)
If Z > 0 And Z < 256 Then
   Label23(38).Caption = ""
   For Y = 0 To Z - 1
       TXT = TXT + Chr$(BSBuffer(X + Y))
   Next Y
   TXT = StrConv(TXT, vbFromUnicode)
   TXT = Right$(TXT, Len(TXT) - 1)
   Volume_Name = TXT
Else
   TXT = "< no name >"
   Volume_Name = ""
End If
Label23(27).Caption = TXT
Label23(28).Caption = ""
Label23(29).Caption = ""
Label23(30).Caption = ""
Label23(31).Caption = ""
Label23(32).Caption = ""
Label23(33).Caption = ""
Label23(34).Caption = ""
Label23(35).Caption = ""
Label23(36).Caption = ""
Label23(37).Caption = ""
Label23(38).Caption = ""
End Sub

Private Sub Get_VI_Attribute_Layout()
LabelA1.Caption = "Always Zero:"
LabelA2.Caption = "Major Version No:"
LabelA3.Caption = "Minor Version No:"
LabelA4.Caption = "Flags:"
LabelA5.Caption = "Always Zero:"
LabelA6.Caption = ""
LabelA7.Caption = ""
LabelA8.Caption = ""
LabelA9.Caption = ""
LabelA10.Caption = ""
LabelA11.Caption = ""
LabelA12.Caption = ""
X = C + SAH_OffsetToAttribute
S1 = CLng(BSBuffer(X + 4))
S2 = CLng(BSBuffer(X + 5))
S3 = CLng(BSBuffer(X + 6))
S4 = CLng(BSBuffer(X + 7))
VI_AlwaysZero1 = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
If VI_AlwaysZero1 > 0 Then
   S1 = CLng(BSBuffer(X))
   S2 = CLng(BSBuffer(X + 1))
   S3 = CLng(BSBuffer(X + 2))
   S4 = CLng(BSBuffer(X + 3))
   VI_AlwaysZero1 = (VI_AlwaysZero1 * (2 ^ 32)) + (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
   TXT = ""
   For Y = 0 To 7
       H = Hex(CByte(BSBuffer(X + Y)))
       If Len(H) < 2 Then
          H = "0" + H
       End If
       If Y <> 4 Then
          TXT = H + TXT
       Else
          TXT = H + " " + TXT
       End If
   Next Y
   Label23(27).Caption = TXT + " h"
Else
   S1 = CLng(BSBuffer(X))
   S2 = CLng(BSBuffer(X + 1))
   S3 = CLng(BSBuffer(X + 2))
   S4 = CLng(BSBuffer(X + 3))
   VI_AlwaysZero1 = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
   Label23(27).Caption = CStr(VI_AlwaysZero1)
End If
VI_MajorVersion = BSBuffer(X + 8)
Label23(28).Caption = CStr(VI_MajorVersion)
VI_MinorVersion = BSBuffer(X + 9)
Label23(29).Caption = CStr(VI_MinorVersion)
VI_Flags = BSBuffer(X + 11)
VI_Flags = VI_Flags * 256
VI_Flags = VI_Flags + BSBuffer(X + 10)
If (VI_Flags And 1) = 1 Then
   Label23(30).Caption = Hex(VI_Flags) + " h" + "   [ Dirty ]"
Else
   Label23(30).Caption = Hex(VI_Flags)
End If
S1 = CLng(BSBuffer(X + 12))
S2 = CLng(BSBuffer(X + 13))
S3 = CLng(BSBuffer(X + 14))
S4 = CLng(BSBuffer(X + 15))
VI_AlwaysZero2 = (S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1
Label23(31).Caption = CStr(VI_AlwaysZero2)
Label23(32).Caption = ""
Label23(33).Caption = ""
Label23(34).Caption = ""
Label23(35).Caption = ""
Label23(36).Caption = ""
Label23(37).Caption = ""
Label23(38).Caption = ""
End Sub

Private Sub Get_Data_Attribute_Layout()
LabelA1.Caption = ""
LabelA2.Caption = ""
LabelA3.Caption = ""
LabelA4.Caption = ""
LabelA5.Caption = ""
LabelA6.Caption = ""
LabelA7.Caption = ""
LabelA8.Caption = ""
LabelA9.Caption = ""
LabelA10.Caption = ""
LabelA11.Caption = ""
LabelA12.Caption = ""
Label23(27).Caption = ""
Label23(28).Caption = ""
Label23(29).Caption = ""
Label23(30).Caption = ""
Label23(31).Caption = ""
Label23(32).Caption = ""
Label23(33).Caption = ""
Label23(34).Caption = ""
Label23(35).Caption = ""
Label23(36).Caption = ""
Label23(37).Caption = ""
Label23(38).Caption = ""
End Sub

Private Sub Get_IR_Attribute_Layout()
LabelA1.Caption = "Attribute Type:"
LabelA2.Caption = "Collation Rule:"
LabelA3.Caption = "Alloc. Entry Size:"
LabelA4.Caption = "Clust. per In. Rec:"
LabelA5.Caption = "Padding:"
LabelA6.Caption = ""
LabelA7.Caption = "First I. Entry Off:"
LabelA8.Caption = "I. Ent. Total Size:"
LabelA9.Caption = "I. Ent. Alloc Size"
LabelA10.Caption = "Flags"
LabelA11.Caption = "Padding"
LabelA12.Caption = ""
X = C + SAH_OffsetToAttribute
S1 = CLng(BSBuffer(X))
S2 = CLng(BSBuffer(X + 1))
S3 = CLng(BSBuffer(X + 2))
S4 = CLng(BSBuffer(X + 3))
IR_AttributeType = CLng((S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1)
Label23(27).Caption = Hex(IR_AttributeType) + " h"
S1 = CLng(BSBuffer(X + 4))
S2 = CLng(BSBuffer(X + 5))
S3 = CLng(BSBuffer(X + 6))
S4 = CLng(BSBuffer(X + 7))
IR_CollationRule = CLng((S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1)
Label23(28).Caption = Hex(IR_CollationRule) + " h"
S1 = CLng(BSBuffer(X + 8))
S2 = CLng(BSBuffer(X + 9))
S3 = CLng(BSBuffer(X + 10))
S4 = CLng(BSBuffer(X + 11))
IR_AllocEntrySize = CLng((S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1)
Label23(29).Caption = CStr(IR_AllocEntrySize)
IR_ClustPerIndexRec = BSBuffer(X + 12)
Label23(30).Caption = CStr(IR_ClustPerIndexRec)
H = Hex(BSBuffer(X + 13))
If Len(H) < 2 Then
   H = "0" + H
End If
IR_Padding = H
H = Hex(BSBuffer(X + 14))
If Len(H) < 2 Then
   H = "0" + H
End If
IR_Padding = H + " " + IR_Padding
H = Hex(BSBuffer(X + 15))
If Len(H) < 2 Then
   H = "0" + H
End If
IR_Padding = H + " " + IR_Padding
Label23(31).Caption = IR_Padding
Label23(32).Caption = ""
Dim IH_OffFirstIndEnrty As Long
Dim IH_TotalSizeIndEnts As Long
Dim IH_AllocSizeIndEnts As Long
Dim IH_Flags As Byte
Dim IH_Padding As String
S1 = CLng(BSBuffer(X + 16))
S2 = CLng(BSBuffer(X + 17))
S3 = CLng(BSBuffer(X + 18))
S4 = CLng(BSBuffer(X + 19))
IH_OffFirstIndEnrty = CLng((S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1)
Label23(33).Caption = CStr(IH_OffFirstIndEnrty)
S1 = CLng(BSBuffer(X + 20))
S2 = CLng(BSBuffer(X + 21))
S3 = CLng(BSBuffer(X + 22))
S4 = CLng(BSBuffer(X + 23))
IH_TotalSizeIndEnts = CLng((S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1)
Label23(34).Caption = CStr(IH_TotalSizeIndEnts)
S1 = CLng(BSBuffer(X + 24))
S2 = CLng(BSBuffer(X + 25))
S3 = CLng(BSBuffer(X + 26))
S4 = CLng(BSBuffer(X + 27))
IH_AllocSizeIndEnts = CLng((S4 * 16777216) + (S3 * 65536) + (S2 * 256) + S1)
Label23(35).Caption = CStr(IH_AllocSizeIndEnts)
IH_Flags = BSBuffer(X + 28)
If IH_Flags = 0 Then
   Label23(36).Caption = Hex(CByte(IH_Flags)) + " h   [ Small Index ]"
Else
   If IH_Flags = 1 Then
      Label23(36).Caption = Hex(CByte(IH_Flags)) + " h   [ Large Index ]"
   Else
      Label23(36).Caption = Hex(CByte(IH_Flags)) + " h"
   End If
End If
H = Hex(BSBuffer(X + 29))
If Len(H) < 2 Then
   H = "0" + H
End If
IH_Padding = H
H = Hex(BSBuffer(X + 30))
If Len(H) < 2 Then
   H = "0" + H
End If
IH_Padding = H + " " + IH_Padding
H = Hex(BSBuffer(X + 31))
If Len(H) < 2 Then
   H = "0" + H
End If
IH_Padding = H + " " + IH_Padding
Label23(37).Caption = IH_Padding
Label23(38).Caption = ""
End Sub

Private Sub Get_Other_Attribute_Layout()
LabelA1.Caption = ""
LabelA2.Caption = ""
LabelA3.Caption = ""
LabelA4.Caption = ""
LabelA5.Caption = ""
LabelA6.Caption = ""
LabelA7.Caption = ""
LabelA8.Caption = ""
LabelA9.Caption = ""
LabelA10.Caption = ""
LabelA11.Caption = ""
LabelA12.Caption = ""
Label23(27).Caption = ""
Label23(28).Caption = ""
Label23(29).Caption = ""
Label23(30).Caption = ""
Label23(31).Caption = ""
Label23(32).Caption = ""
Label23(33).Caption = ""
Label23(34).Caption = ""
Label23(35).Caption = ""
Label23(36).Caption = ""
Label23(37).Caption = ""
Label23(38).Caption = ""
End Sub