Please read the entire post before downloading it..
Here's a tiny fun project; https://github.com/jschicht/PowerMft
It is a commandline tool that enables low level modification to NTFS system files. Currently it supports direct edit of the following attributes in MFT records:
- The record header
- $STANDARD_INFORMATION
- $FILE_NAME
- $OBJECT_ID
- $REPARSE_POINT
- $I30 index in $INDEX_ROOT and $INDEX_ALLOCATION (parent of target)
- $O index in $ObjId at $INDEX_ROOT/$INDEX_ALLOCATION (relevant for files containing the $OBJECT_ID attribute)
- $R index in $Reparse at $INDEX_ROOT/$INDEX_ALLOCATION (relevant for files containing the $REPARSE_POINT attribute)
- $DATA in $AttrDef (Attribute Definition Table)
Read the readme for more detailed information about usage.
It's a good start, and more can be added for sure.
Is this a useful tool? If you are not sure what this is, do not download and mess with it! It is very likely that you will end up with a broken volume or deleted files, either through incorrect use of the tool or bugs in the code. A big WARNING is therefore submitted for a very good reason. Don't blame me for any lost data or damage done through the use of this tool, as you have been warned. This tool is ONLY provided for educational purpose.
Set aside all the harm this tool can do, there is at least 1 use case (not being a mis-use) I can think of ..
For invalid filenames (possibly generated by other non-Windows OS) there does not exist any native tool or method in Windows to fix those filenames. Chkdsk will only be able to fix it by deleting the file, even though it reports it as a minor filename error!!