> sudo ntfsinfo -fv -F "/Program Files/internet explorer/xxx.dat" /dev/sdxx Replace "xxx.dat" by the name of a file which could not be read, and "sdxx" by the name of the Windows partition. THAT IS IT: root@sashoga:/home/alexander# ntfsinfo -fv -F "/Windows/WinSxS/x86_system.printing_31bf3856ad364e35_10.0.17134.1_none_fca2539126e9425b/System.Printing.dll" /dev/sda4 Forced to continue. Dumping Inode 317848 (0x4d998) Upd. Seq. Array Off.: 48 (0x30) Upd. Seq. Array Count: 3 (0x3) Upd. Seq. Number: 21 (0x15) LogFile Seq. Number: 0x14b4862a6 MFT Record Seq. Numb.: 3 (0x3) Number of Hard Links: 4 (0x4) Attribute Offset: 56 (0x38) MFT Record Flags: IN_USE Bytes Used: 664 (0x298) bytes Bytes Allocated: 1024 (0x400) bytes Next Attribute Instance: 19 (0x13) MFT Padding: 00 00 Dumping attribute $STANDARD_INFORMATION (0x10) from mft record 317848 (0x4d998) Attribute length: 96 (0x60) Resident: Yes Name length: 0 (0x0) Name offset: 0 (0x0) Attribute flags: 0x0000 Attribute instance: 0 (0x0) Data size: 72 (0x48) Data offset: 24 (0x18) Resident flags: 0x00 ReservedR: 0 (0x0) File Creation Time: Fri Jun 15 17:59:47 2018 UTC File Altered Time: Mon Mar 5 13:07:00 2018 UTC MFT Changed Time: Fri Jun 15 18:00:22 2018 UTC Last Accessed Time: Fri Jun 15 18:00:06 2018 UTC File attributes: ARCHIVE SPARSE_FILE REPARSE_POINT UNKNOWN: 0x00040000 (0x00040620) Maximum versions: 0 Version number: 0 Class ID: 0 User ID: 0 (0x0) Security ID: 543 (0x21f) Quota charged: 0 (0x0) Update Sequence Number: 1910294072 (0x71dcc638) Dumping attribute $ATTRIBUTE_LIST (0x20) from mft record 317848 (0x4d998) Attribute length: 376 (0x178) Resident: Yes Name length: 0 (0x0) Name offset: 0 (0x0) Attribute flags: 0x0000 Attribute instance: 17 (0x11) Data size: 352 (0x160) Data offset: 24 (0x18) Resident flags: 0x00 ReservedR: 0 (0x0) Dumping attribute list: Attribute type: 0x10 Record length: 32 (0x20) Name length: 0 (0x0) Name offset: 26 (0x1a) Starting VCN: 0 (0x0) MFT reference: 317848 (0x4d998) Instance: 0 (0x0) Name: unnamed Padding: 44 43 00 00 00 00 Attribute type: 0x30 Record length: 32 (0x20) Name length: 0 (0x0) Name offset: 26 (0x1a) Starting VCN: 0 (0x0) MFT reference: 325707 (0x4f84b) Instance: 0 (0x0) Name: unnamed Padding: 00 00 00 00 00 00 Attribute type: 0x30 Record length: 32 (0x20) Name length: 0 (0x0) Name offset: 26 (0x1a) Starting VCN: 0 (0x0) MFT reference: 325707 (0x4f84b) Instance: 1 (0x1) Name: unnamed Padding: 00 00 00 00 00 00 Attribute type: 0x30 Record length: 32 (0x20) Name length: 0 (0x0) Name offset: 26 (0x1a) Starting VCN: 0 (0x0) MFT reference: 325707 (0x4f84b) Instance: 2 (0x2) Name: unnamed Padding: 00 00 00 00 00 00 Attribute type: 0x30 Record length: 32 (0x20) Name length: 0 (0x0) Name offset: 26 (0x1a) Starting VCN: 0 (0x0) MFT reference: 317848 (0x4d998) Instance: 18 (0x12) Name: unnamed Padding: 00 00 00 00 00 00 Attribute type: 0x80 Record length: 32 (0x20) Name length: 0 (0x0) Name offset: 26 (0x1a) Starting VCN: 0 (0x0) MFT reference: 325707 (0x4f84b) Instance: 3 (0x3) Name: unnamed Padding: 00 00 00 00 00 00 Attribute type: 0x80 Record length: 64 (0x40) Name length: 17 (0x11) Name offset: 26 (0x1a) Starting VCN: 0 (0x0) MFT reference: 325707 (0x4f84b) Instance: 4 (0x4) Name: WofCompressedData Padding: 00 00 00 00 Attribute type: 0xc0 Record length: 32 (0x20) Name length: 0 (0x0) Name offset: 26 (0x1a) Starting VCN: 0 (0x0) MFT reference: 325707 (0x4f84b) Instance: 5 (0x5) Name: unnamed Padding: 00 00 00 00 00 00 Attribute type: 0xd0 Record length: 32 (0x20) Name length: 0 (0x0) Name offset: 26 (0x1a) Starting VCN: 0 (0x0) MFT reference: 325707 (0x4f84b) Instance: 6 (0x6) Name: unnamed Padding: 00 00 00 00 00 00 Attribute type: 0xe0 Record length: 32 (0x20) Name length: 0 (0x0) Name offset: 26 (0x1a) Starting VCN: 0 (0x0) MFT reference: 325707 (0x4f84b) Instance: 7 (0x7) Name: unnamed Padding: 00 00 00 00 00 00 End of attribute list reached. Dumping attribute $FILE_NAME (0x30) from mft record 325707 (0x4f84b) Attribute length: 120 (0x78) Resident: Yes Name length: 0 (0x0) Name offset: 0 (0x0) Attribute flags: 0x0000 Attribute instance: 0 (0x0) Data size: 90 (0x5a) Data offset: 24 (0x18) Resident flags: 0x01 ReservedR: 0 (0x0) Parent directory: 320366 (0x4e36e) File Creation Time: Fri Jun 15 17:59:47 2018 UTC File Altered Time: Mon Mar 5 13:07:00 2018 UTC MFT Changed Time: Fri Jun 15 18:00:06 2018 UTC Last Accessed Time: Fri Jun 15 18:00:06 2018 UTC Allocated Size: 0 (0x0) Data Size: 372736 (0x5b000) Filename Length: 12 (0xc) File attributes: ARCHIVE SPARSE_FILE REPARSE_POINT (0x00000620) Reparse point tag: 0x80000017 (Wof compressed) Namespace: DOS Filename: 'SYSTEM~1.DLL' Dumping attribute $FILE_NAME (0x30) from mft record 325707 (0x4f84b) Attribute length: 128 (0x80) Resident: Yes Name length: 0 (0x0) Name offset: 0 (0x0) Attribute flags: 0x0000 Attribute instance: 1 (0x1) Data size: 104 (0x68) Data offset: 24 (0x18) Resident flags: 0x01 ReservedR: 0 (0x0) Parent directory: 320366 (0x4e36e) File Creation Time: Fri Jun 15 17:59:47 2018 UTC File Altered Time: Mon Mar 5 13:07:00 2018 UTC MFT Changed Time: Fri Jun 15 18:00:06 2018 UTC Last Accessed Time: Fri Jun 15 18:00:06 2018 UTC Allocated Size: 0 (0x0) Data Size: 372736 (0x5b000) Filename Length: 19 (0x13) File attributes: ARCHIVE SPARSE_FILE REPARSE_POINT (0x00000620) Reparse point tag: 0x80000017 (Wof compressed) Namespace: Win32 Filename: 'System.Printing.dll' Dumping attribute $FILE_NAME (0x30) from mft record 325707 (0x4f84b) Attribute length: 128 (0x80) Resident: Yes Name length: 0 (0x0) Name offset: 0 (0x0) Attribute flags: 0x0000 Attribute instance: 2 (0x2) Data size: 104 (0x68) Data offset: 24 (0x18) Resident flags: 0x01 ReservedR: 0 (0x0) Parent directory: 253636 (0x3dec4) File Creation Time: Fri Jun 15 17:59:47 2018 UTC File Altered Time: Mon Mar 5 13:07:00 2018 UTC MFT Changed Time: Fri Jun 15 18:00:11 2018 UTC Last Accessed Time: Fri Jun 15 18:00:06 2018 UTC Allocated Size: 0 (0x0) Data Size: 372736 (0x5b000) Filename Length: 19 (0x13) File attributes: ARCHIVE SPARSE_FILE REPARSE_POINT UNKNOWN: 0x00040000 (0x00040620) Reparse point tag: 0x80000017 (Wof compressed) Namespace: POSIX Filename: 'System.Printing.dll' Dumping attribute $FILE_NAME (0x30) from mft record 317848 (0x4d998) Attribute length: 128 (0x80) Resident: Yes Name length: 0 (0x0) Name offset: 0 (0x0) Attribute flags: 0x0000 Attribute instance: 18 (0x12) Data size: 104 (0x68) Data offset: 24 (0x18) Resident flags: 0x01 ReservedR: 0 (0x0) Parent directory: 325706 (0x4f84a) File Creation Time: Fri Jun 15 17:59:47 2018 UTC File Altered Time: Mon Mar 5 13:07:00 2018 UTC MFT Changed Time: Fri Jun 15 18:00:22 2018 UTC Last Accessed Time: Fri Jun 15 18:00:06 2018 UTC Allocated Size: 0 (0x0) Data Size: 372736 (0x5b000) Filename Length: 19 (0x13) File attributes: ARCHIVE SPARSE_FILE REPARSE_POINT UNKNOWN: 0x00040000 (0x00040620) Reparse point tag: 0x80000017 (Wof compressed) Namespace: POSIX Filename: 'System.Printing.dll' Dumping attribute $DATA (0x80) from mft record 325707 (0x4f84b) Attribute length: 80 (0x50) Resident: No Name length: 0 (0x0) Name offset: 0 (0x0) Attribute flags: 0x8000 Attribute instance: 3 (0x3) Lowest VCN 0 (0x0) Highest VCN: 95 (0x5f) Mapping pairs offset: 72 (0x48) Compression unit: 4 (0x4) Data size: 372736 (0x5b000) Allocated size: 393216 (0x60000) Initialized size: 372736 (0x5b000) Compressed size: 0 (0x0) Runlist: VCN LCN Length 0x0 0x60 Dumping attribute $DATA (0x80) from mft record 325707 (0x4f84b) Attribute length: 112 (0x70) Resident: No Name length: 17 (0x11) Name offset: 64 (0x40) Attribute name: 'WofCompressedData' Attribute flags: 0x0000 Attribute instance: 4 (0x4) Lowest VCN 0 (0x0) Highest VCN: 38 (0x26) Mapping pairs offset: 104 (0x68) Compression unit: 0 (0x0) Data size: 156455 (0x26327) Allocated size: 159744 (0x27000) Initialized size: 156455 (0x26327) Runlist: VCN LCN Length 0x0 0x1a7bfd8 0x27 Dumping attribute $REPARSE_POINT (0xc0) from mft record 325707 (0x4f84b) Attribute length: 48 (0x30) Resident: Yes Name length: 0 (0x0) Name offset: 0 (0x0) Attribute flags: 0x0000 Attribute instance: 5 (0x5) Data size: 24 (0x18) Data offset: 24 (0x18) Resident flags: 0x00 ReservedR: 0 (0x0) Reparse tag: 0x80000017 (Wof compressed) Data length: 16 (0x10) Data: 0x01000000020000000100000002000000 Dumping attribute $EA_INFORMATION (0xd0) from mft record 325707 (0x4f84b) Attribute length: 32 (0x20) Resident: Yes Name length: 0 (0x0) Name offset: 0 (0x0) Attribute flags: 0x0000 Attribute instance: 6 (0x6) Data size: 8 (0x8) Data offset: 24 (0x18) Resident flags: 0x00 ReservedR: 0 (0x0) Packed EA length: 103 (0x67) NEED_EA count: 0 (0x0) Unpacked EA length: 108 (0x6c) Dumping attribute $EA (0xe0) from mft record 325707 (0x4f84b) Attribute length: 136 (0x88) Resident: Yes Name length: 0 (0x0) Name offset: 0 (0x0) Attribute flags: 0x0000 Attribute instance: 7 (0x7) Data size: 108 (0x6c) Data offset: 24 (0x18) Resident flags: 0x00 ReservedR: 0 (0x0) EA flags: NONE Name length: 15 (0xf) Value length: 83 (0x53) Name: '$CI.CATALOGHINT' Value: 0x01004f004d6963726f736f66742d57696e646f77732d50726573656e74617469... End of inode reached Total runs: 2 (fragments: 2)