Ntfs!ReadIndexBuffer函数分析之根目录读取索引缓冲区的一个例子

第一部分：

0: kd> p
Ntfs!ReadIndexBuffer+0xdc:
f7173962 e829f60300      call    Ntfs!NtfsCheckIndexBuffer (f71b2f90)
0: kd> t
Ntfs!NtfsCheckIndexBuffer:
f71b2f90 55              push    ebp
0: kd> kc
 #
00 Ntfs!NtfsCheckIndexBuffer
01 Ntfs!ReadIndexBuffer
02 Ntfs!FindNextIndexEntry
03 Ntfs!NtfsContinueIndexEnumeration
04 Ntfs!NtfsQueryDirectory
05 Ntfs!NtfsCommonDirectoryControl
06 Ntfs!NtfsFsdDirectoryControl
07 nt!IofCallDriver
08 nt!IopSynchronousServiceTail
09 nt!NtQueryDirectoryFile
0a nt!_KiSystemService
0b nt!ZwQueryDirectoryFile
0c nt!CcPfPrefetchDirectoryContents
0d nt!CcPfPrefetchMetadata
0e nt!CcPfBootWorker
0f nt!PspSystemThreadStartup
10 nt!KiThreadStartup
0: kd> dv
            Scb = 0xe1363d20
    IndexBuffer = 0xc14c1000

0: kd> dv
            Scb = 0xe1363d20
    IndexBuffer = 0xc14c1000
0: kd> dx -r1 ((Ntfs!_INDEX_ALLOCATION_BUFFER *)0xc14c1000)
((Ntfs!_INDEX_ALLOCATION_BUFFER *)0xc14c1000)                 : 0xc14c1000 [Type: _INDEX_ALLOCATION_BUFFER *]
    [+0x000] MultiSectorHeader [Type: _MULTI_SECTOR_HEADER]
    [+0x008] Lsn              : {124511565} [Type: _LARGE_INTEGER]
    [+0x010] ThisBlock        : 1 [Type: __int64]
    [+0x018] IndexHeader      [Type: _INDEX_HEADER]
    [+0x028] UpdateSequenceArray [Type: unsigned short [1]]
0: kd> dx -r1 (*((Ntfs!_INDEX_HEADER *)0xc14c1018))
(*((Ntfs!_INDEX_HEADER *)0xc14c1018))                 [Type: _INDEX_HEADER]
    [+0x000] FirstIndexEntry  : 0x28 [Type: unsigned long]
    [+0x004] FirstFreeByte    : 0x828 [Type: unsigned long]
    [+0x008] BytesAvailable   : 0xfe8 [Type: unsigned long]
    [+0x00c] Flags            : 0x0 [Type: unsigned char]
    [+0x00d] Reserved         [Type: unsigned char [3]]

第二部分：

0: kd> dv
            Scb = 0xe1363d20
    IndexBuffer = 0xc14c1000
0: kd> dx -r1 ((Ntfs!_INDEX_ALLOCATION_BUFFER *)0xc14c1000)
((Ntfs!_INDEX_ALLOCATION_BUFFER *)0xc14c1000)                 : 0xc14c1000 [Type: _INDEX_ALLOCATION_BUFFER *]
    [+0x000] MultiSectorHeader [Type: _MULTI_SECTOR_HEADER]
    [+0x008] Lsn              : {124511565} [Type: _LARGE_INTEGER]
    [+0x010] ThisBlock        : 1 [Type: __int64]
    [+0x018] IndexHeader      [Type: _INDEX_HEADER]
    [+0x028] UpdateSequenceArray [Type: unsigned short [1]]
0: kd> dx -r1 (*((Ntfs!_INDEX_HEADER *)0xc14c1018))
(*((Ntfs!_INDEX_HEADER *)0xc14c1018))                 [Type: _INDEX_HEADER]
    [+0x000] FirstIndexEntry  : 0x28 [Type: unsigned long]
    [+0x004] FirstFreeByte    : 0x828 [Type: unsigned long]
    [+0x008] BytesAvailable   : 0xfe8 [Type: unsigned long]
    [+0x00c] Flags            : 0x0 [Type: unsigned char]
    [+0x00d] Reserved         [Type: unsigned char [3]]

0: kd> dt index_entry 0xc14c1018+28
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0xd4a
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x68
   +0x00a AttributeLength  : 0x52
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt file_name 0xc14c1018+28+10
Ntfs!FILE_NAME
   +0x000 ParentDirectory  : _MFT_SEGMENT_REFERENCE
   +0x008 Info             : _DUPLICATED_INFORMATION
   +0x040 FileNameLength   : 0x8 ''
   +0x041 Flags            : 0x2 ''
   +0x042 FileName         : [1] 0x44
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!unsigned short (*)[1])0xc14c1092))
(*((Ntfs!unsigned short (*)[1])0xc14c1092))                 [Type: unsigned short [1]]
    [0]              : 0x44 [Type: unsigned short]
0: kd> db 0xc14c1092
c14c1092  44 00 4f 00 43 00 55 00-4d 00 45 00 7e 00 31 00  D.O.C.U.M.E.~.1.
c14c10a2  2e 00 43 00 4f 00 16 28-00 00 00 00 0e 00 68 00  ..C.O..(......h.
c14c10b2  54 00 00 00 00 00 05 00-00 00 00 00 05 00 fe d9  T...............
c14c10c2  ee 98 50 27 db 01 76 ef-9a a1 b4 30 db 01 d4 44  ..P'..v....0...D
c14c10d2  b9 5b 60 62 db 01 1e d6-3b b7 23 63 db 01 a0 00  .[`b....;.#c....
c14c10e2  00 00 00 00 00 00 9a 00-00 00 00 00 00 00 20 00  .............. .
c14c10f2  00 00 00 00 00 00 09 03-65 00 76 00 65 00 6e 00  ........e.v.e.n.
c14c1102  74 00 2e 00 74 00 78 00-74 00 00 00 01 00 51 1b  t...t.x.t.....Q.

0: kd> dt index_entry 0xc14c1018+28
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0xd4a
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x68
   +0x00a AttributeLength  : 0x52
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt index_entry 0xc14c1018+28+68
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x2816
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0xe0000
   +0x008 Length           : 0x68
   +0x00a AttributeLength  : 0x54
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt file_name 0xc14c1018+28+68+10
Ntfs!FILE_NAME
   +0x000 ParentDirectory  : _MFT_SEGMENT_REFERENCE
   +0x008 Info             : _DUPLICATED_INFORMATION
   +0x040 FileNameLength   : 0x9 ''
   +0x041 Flags            : 0x3 ''
   +0x042 FileName         : [1] 0x65
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!unsigned short (*)[1])0xc14c10fa))
(*((Ntfs!unsigned short (*)[1])0xc14c10fa))                 [Type: unsigned short [1]]
    [0]              : 0x65 [Type: unsigned short]
0: kd> db 0xc14c10fa
c14c10fa  65 00 76 00 65 00 6e 00-74 00 2e 00 74 00 78 00  e.v.e.n.t...t.x.
c14c110a  74 00 00 00 01 00 51 1b-00 00 00 00 01 00 60 00  t.....Q.......`.
c14c111a  4e 00 00 00 00 00 05 00-00 00 00 00 05 00 b4 4a  N..............J
c14c112a  1a cd c7 06 db 01 b4 4a-1a cd c7 06 db 01 b4 4a  .......J.......J
c14c113a  1a cd c7 06 db 01 f0 84-74 d5 23 63 db 01 00 00  ........t.#c....
c14c114a  00 00 00 00 00 00 00 00-00 00 00 00 00 00 27 00  ..............'.
c14c115a  00 00 00 00 00 00 06 03-49 00 4f 00 2e 00 53 00  ........I.O...S.
c14c116a  59 00 53 00 43 00 52 1b-00 00 00 00 01 00 68 00  Y.S.C.R.......h.

0: kd> dt index_entry 0xc14c1018+28+68
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x2816
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0xe0000
   +0x008 Length           : 0x68
   +0x00a AttributeLength  : 0x54
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt index_entry 0xc14c1018+28+68+68
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x1b51
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x60
   +0x00a AttributeLength  : 0x4e
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt file_name 0xc14c1018+28+68+68+10
Ntfs!FILE_NAME
   +0x000 ParentDirectory  : _MFT_SEGMENT_REFERENCE
   +0x008 Info             : _DUPLICATED_INFORMATION
   +0x040 FileNameLength   : 0x6 ''
   +0x041 Flags            : 0x3 ''
   +0x042 FileName         : [1] 0x49
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!unsigned short (*)[1])0xc14c1162))
(*((Ntfs!unsigned short (*)[1])0xc14c1162))                 [Type: unsigned short [1]]
    [0]              : 0x49 [Type: unsigned short]
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!_MFT_SEGMENT_REFERENCE *)0xc14c1120))
(*((Ntfs!_MFT_SEGMENT_REFERENCE *)0xc14c1120))                 [Type: _MFT_SEGMENT_REFERENCE]
    [+0x000] SegmentNumberLowPart : 0x5 [Type: unsigned long]
    [+0x004] SegmentNumberHighPart : 0x0 [Type: unsigned short]
    [+0x006] SequenceNumber   : 0x5 [Type: unsigned short]
0: kd> db 0xc14c1162
c14c1162  49 00 4f 00 2e 00 53 00-59 00 53 00 43 00 52 1b  I.O...S.Y.S.C.R.
c14c1172  00 00 00 00 01 00 68 00-54 00 00 00 00 00 05 00  ......h.T.......
c14c1182  00 00 00 00 05 00 b4 4a-1a cd c7 06 db 01 b4 4a  .......J.......J
c14c1192  1a cd c7 06 db 01 b4 4a-1a cd c7 06 db 01 e4 da  .......J........
c14c11a2  54 cb b7 63 db 01 00 00-00 00 00 00 00 00 00 00  T..c............
c14c11b2  00 00 00 00 00 00 27 00-00 00 00 00 00 00 09 03  ......'.........
c14c11c2  4d 00 53 00 44 00 4f 00-53 00 2e 00 53 00 59 00  M.S.D.O.S...S.Y.
c14c11d2  53 00 43 00 4f 00 a9 28-00 00 00 00 02 00 80 00  S.C.O..(........

0: kd> dt index_entry 0xc14c1018+28+68+68
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x1b51
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x60
   +0x00a AttributeLength  : 0x4e
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt index_entry 0xc14c1018+28+68+68+60
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x1b52
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x68
   +0x00a AttributeLength  : 0x54
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt file_name 0xc14c1018+28+68+68+60+10
Ntfs!FILE_NAME
   +0x000 ParentDirectory  : _MFT_SEGMENT_REFERENCE
   +0x008 Info             : _DUPLICATED_INFORMATION
   +0x040 FileNameLength   : 0x9 ''
   +0x041 Flags            : 0x3 ''
   +0x042 FileName         : [1] 0x4d
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!_MFT_SEGMENT_REFERENCE *)0xc14c1180))
(*((Ntfs!_MFT_SEGMENT_REFERENCE *)0xc14c1180))                 [Type: _MFT_SEGMENT_REFERENCE]
    [+0x000] SegmentNumberLowPart : 0x5 [Type: unsigned long]
    [+0x004] SegmentNumberHighPart : 0x0 [Type: unsigned short]
    [+0x006] SequenceNumber   : 0x5 [Type: unsigned short]
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!unsigned short (*)[1])0xc14c11c2))
(*((Ntfs!unsigned short (*)[1])0xc14c11c2))                 [Type: unsigned short [1]]
    [0]              : 0x4d [Type: unsigned short]
0: kd> db 0xc14c11c2
c14c11c2  4d 00 53 00 44 00 4f 00-53 00 2e 00 53 00 59 00  M.S.D.O.S...S.Y.
c14c11d2  53 00 43 00 4f 00 a9 28-00 00 00 00 02 00 80 00  S.C.O..(........
c14c11e2  6c 00 00 00 00 00 05 00-00 00 00 00 05 00 6a f7  l.............j.
c14c11f2  f9 4d a9 8e db 01 6a f7-f9 4d a9 8e db 01 6a f7  .M....j..M....j.
c14c1202  f9 4d a9 8e db 01 6a f7-f9 4d a9 8e db 01 00 00  .M....j..M......
c14c1212  00 00 00 00 00 00 00 00-00 00 00 00 00 00 20 00  .............. .
c14c1222  00 00 00 00 00 00 15 01-4e 00 65 00 77 00 20 00  ........N.e.w. .
c14c1232  54 00 65 00 78 00 74 00-20 00 44 00 6f 00 63 00  T.e.x.t. .D.o.c.

0: kd> dt index_entry 0xc14c1018+28+68+68+60
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x1b52
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x68
   +0x00a AttributeLength  : 0x54
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt index_entry 0xc14c1018+28+68+68+60+68
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x28a9
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x20000
   +0x008 Length           : 0x80
   +0x00a AttributeLength  : 0x6c
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt file_name 0xc14c1018+28+68+68+60+68+10
Ntfs!FILE_NAME
   +0x000 ParentDirectory  : _MFT_SEGMENT_REFERENCE
   +0x008 Info             : _DUPLICATED_INFORMATION
   +0x040 FileNameLength   : 0x15 ''
   +0x041 Flags            : 0x1 ''
   +0x042 FileName         : [1] 0x4e
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!_MFT_SEGMENT_REFERENCE *)0xc14c11e8))
(*((Ntfs!_MFT_SEGMENT_REFERENCE *)0xc14c11e8))                 [Type: _MFT_SEGMENT_REFERENCE]
    [+0x000] SegmentNumberLowPart : 0x5 [Type: unsigned long]
    [+0x004] SegmentNumberHighPart : 0x0 [Type: unsigned short]
    [+0x006] SequenceNumber   : 0x5 [Type: unsigned short]
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!unsigned short (*)[1])0xc14c122a))
(*((Ntfs!unsigned short (*)[1])0xc14c122a))                 [Type: unsigned short [1]]
    [0]              : 0x4e [Type: unsigned short]
0: kd> db 0xc14c122a
c14c122a  4e 00 65 00 77 00 20 00-54 00 65 00 78 00 74 00  N.e.w. .T.e.x.t.
c14c123a  20 00 44 00 6f 00 63 00-75 00 6d 00 65 00 6e 00   .D.o.c.u.m.e.n.
c14c124a  74 00 2e 00 74 00 78 00-74 00 00 00 00 00 a9 28  t...t.x.t......(
c14c125a  00 00 00 00 02 00 70 00-5a 00 00 00 00 00 05 00  ......p.Z.......
c14c126a  00 00 00 00 05 00 6a f7-f9 4d a9 8e db 01 6a f7  ......j..M....j.
c14c127a  f9 4d a9 8e db 01 6a f7-f9 4d a9 8e db 01 6a f7  .M....j..M....j.
c14c128a  f9 4d a9 8e db 01 00 00-00 00 00 00 00 00 00 00  .M..............
c14c129a  00 00 00 00 00 00 20 00-00 00 00 00 00 00 0c 02  ...... .........

0: kd> dt index_entry 0xc14c1018+28+68+68+60+68
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x28a9
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x20000
   +0x008 Length           : 0x80
   +0x00a AttributeLength  : 0x6c
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x28a9
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x20000
   +0x008 Length           : 0x70
   +0x00a AttributeLength  : 0x5a
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt file_name 0xc14c1018+28+68+68+60+68+80+10
Ntfs!FILE_NAME
   +0x000 ParentDirectory  : _MFT_SEGMENT_REFERENCE
   +0x008 Info             : _DUPLICATED_INFORMATION
   +0x040 FileNameLength   : 0xc ''
   +0x041 Flags            : 0x2 ''
   +0x042 FileName         : [1] 0x4e
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!unsigned short (*)[1])0xc14c12aa))
(*((Ntfs!unsigned short (*)[1])0xc14c12aa))                 [Type: unsigned short [1]]
    [0]              : 0x4e [Type: unsigned short]
0: kd> db 0xc14c12aa
c14c12aa  4e 00 45 00 57 00 54 00-45 00 58 00 7e 00 31 00  N.E.W.T.E.X.~.1.
c14c12ba  2e 00 54 00 58 00 54 00-5a 00 00 00 00 00 d3 0c  ..T.X.T.Z.......
c14c12ca  00 00 00 00 01 00 70 00-5a 00 00 00 00 00 05 00  ......p.Z.......
c14c12da  00 00 00 00 05 00 00 62-1c 3c b2 06 db 01 00 62  .......b.<.....b
c14c12ea  1c 3c b2 06 db 01 ea 3a-17 d7 8b 06 db 01 84 97  .<.....:........
c14c12fa  37 98 8b 06 db 01 00 c0-00 00 00 00 00 00 bc b9  7...............
c14c130a  00 00 00 00 00 00 27 00-00 00 00 00 00 00 0c 03  ......'.........
c14c131a  4e 00 54 00 44 00 45 00-54 00 45 00 43 00 54 00  N.T.D.E.T.E.C.T.

0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x28a9
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x20000
   +0x008 Length           : 0x70
   +0x00a AttributeLength  : 0x5a
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0xcd3
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x70
   +0x00a AttributeLength  : 0x5a
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt file_name 0xc14c1018+28+68+68+60+68+80+70+10
Ntfs!FILE_NAME
   +0x000 ParentDirectory  : _MFT_SEGMENT_REFERENCE
   +0x008 Info             : _DUPLICATED_INFORMATION
   +0x040 FileNameLength   : 0xc ''
   +0x041 Flags            : 0x3 ''
   +0x042 FileName         : [1] 0x4e
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!unsigned short (*)[1])0xc14c131a))
(*((Ntfs!unsigned short (*)[1])0xc14c131a))                 [Type: unsigned short [1]]
    [0]              : 0x4e [Type: unsigned short]
0: kd> db 0xc14c131a
c14c131a  4e 00 54 00 44 00 45 00-54 00 45 00 43 00 54 00  N.T.D.E.T.E.C.T.
c14c132a  2e 00 43 00 4f 00 4d 00-5a 00 00 00 00 00 cf 0c  ..C.O.M.Z.......
c14c133a  00 00 00 00 01 00 60 00-4c 00 00 00 00 00 05 00  ......`.L.......
c14c134a  00 00 00 00 05 00 00 07-05 b9 c5 06 db 01 00 07  ................
c14c135a  05 b9 c5 06 db 01 ea 3a-17 d7 8b 06 db 01 e4 71  .......:.......q
c14c136a  11 98 8b 06 db 01 00 c0-04 00 00 00 00 00 a0 b4  ................
c14c137a  04 00 00 00 00 00 27 00-00 00 00 00 00 00 05 03  ......'.........
c14c138a  6e 00 74 00 6c 00 64 00-72 00 49 00 4c 00 c8 27  n.t.l.d.r.I.L..'

0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0xcd3
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x70
   +0x00a AttributeLength  : 0x5a
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0xccf
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x60
   +0x00a AttributeLength  : 0x4c
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt file_name 0xc14c1018+28+68+68+60+68+80+70+70+10
Ntfs!FILE_NAME
   +0x000 ParentDirectory  : _MFT_SEGMENT_REFERENCE
   +0x008 Info             : _DUPLICATED_INFORMATION
   +0x040 FileNameLength   : 0x5 ''
   +0x041 Flags            : 0x3 ''
   +0x042 FileName         : [1] 0x6e
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!unsigned short (*)[1])0xc14c138a))
(*((Ntfs!unsigned short (*)[1])0xc14c138a))                 [Type: unsigned short [1]]
    [0]              : 0x6e [Type: unsigned short]
0: kd> db 0xc14c138a
c14c138a  6e 00 74 00 6c 00 64 00-72 00 49 00 4c 00 c8 27  n.t.l.d.r.I.L..'
c14c139a  00 00 00 00 07 00 70 00-5a 00 00 00 00 00 05 00  ......p.Z.......
c14c13aa  00 00 00 00 05 00 c0 2b-54 88 8b 06 db 01 f2 cf  .......+T.......
c14c13ba  03 b4 e4 be db 01 f2 cf-03 b4 e4 be db 01 f2 cf  ................
c14c13ca  03 b4 e4 be db 01 00 00-e0 7f 00 00 00 00 00 00  ................
c14c13da  e0 7f 00 00 00 00 26 00-00 00 00 00 00 00 0c 03  ......&.........
c14c13ea  70 00 61 00 67 00 65 00-66 00 69 00 6c 00 65 00  p.a.g.e.f.i.l.e.
c14c13fa  2e 00 73 00 79 00 73 00-73 00 20 00 49 00 ca 0e  ..s.y.s.s. .I...

0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0xccf
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x60
   +0x00a AttributeLength  : 0x4c
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x27c8
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x70000
   +0x008 Length           : 0x70
   +0x00a AttributeLength  : 0x5a
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt file_name 0xc14c1018+28+68+68+60+68+80+70+70+60+10
Ntfs!FILE_NAME
   +0x000 ParentDirectory  : _MFT_SEGMENT_REFERENCE
   +0x008 Info             : _DUPLICATED_INFORMATION
   +0x040 FileNameLength   : 0xc ''
   +0x041 Flags            : 0x3 ''
   +0x042 FileName         : [1] 0x70
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!unsigned short (*)[1])0xc14c13ea))
(*((Ntfs!unsigned short (*)[1])0xc14c13ea))                 [Type: unsigned short [1]]
    [0]              : 0x70 [Type: unsigned short]
0: kd> db 0xc14c13ea
c14c13ea  70 00 61 00 67 00 65 00-66 00 69 00 6c 00 65 00  p.a.g.e.f.i.l.e.
c14c13fa  2e 00 73 00 79 00 73 00-73 00 20 00 49 00 ca 0e  ..s.y.s.s. .I...
c14c140a  00 00 00 00 01 00 70 00-5c 00 00 00 00 00 05 00  ......p.\.......
c14c141a  00 00 00 00 05 00 64 c4-1d cd 8b 06 db 01 72 d1  ......d.......r.
c14c142a  a9 8f c7 06 db 01 72 d1-a9 8f c7 06 db 01 46 8d  ......r.......F.
c14c143a  fd b2 e4 be db 01 00 00-00 00 00 00 00 00 00 00  ................
c14c144a  00 00 00 00 00 00 01 00-00 10 00 00 00 00 0d 01  ................
c14c145a  50 00 72 00 6f 00 67 00-72 00 61 00 6d 00 20 00  P.r.o.g.r.a.m. .

0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x27c8
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x70000
   +0x008 Length           : 0x70
   +0x00a AttributeLength  : 0x5a
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0xeca
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x70
   +0x00a AttributeLength  : 0x5c
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt file_name 0xc14c1018+28+68+68+60+68+80+70+70+60+70+10
Ntfs!FILE_NAME
   +0x000 ParentDirectory  : _MFT_SEGMENT_REFERENCE
   +0x008 Info             : _DUPLICATED_INFORMATION
   +0x040 FileNameLength   : 0xd ''
   +0x041 Flags            : 0x1 ''
   +0x042 FileName         : [1] 0x50
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!unsigned short (*)[1])0xc14c145a))
(*((Ntfs!unsigned short (*)[1])0xc14c145a))                 [Type: unsigned short [1]]
    [0]              : 0x50 [Type: unsigned short]
0: kd> db 0xc14c145a
c14c145a  50 00 72 00 6f 00 67 00-72 00 61 00 6d 00 20 00  P.r.o.g.r.a.m. .
c14c146a  46 00 69 00 6c 00 65 00-73 00 20 00 49 00 ca 0e  F.i.l.e.s. .I...
c14c147a  00 00 00 00 01 00 68 00-52 00 00 00 00 00 05 00  ......h.R.......
c14c148a  00 00 00 00 05 00 64 c4-1d cd 8b 06 db 01 72 d1  ......d.......r.
c14c149a  a9 8f c7 06 db 01 72 d1-a9 8f c7 06 db 01 46 8d  ......r.......F.
c14c14aa  fd b2 e4 be db 01 00 00-00 00 00 00 00 00 00 00  ................
c14c14ba  00 00 00 00 00 00 01 00-00 10 00 00 00 00 08 02  ................
c14c14ca  50 00 52 00 4f 00 47 00-52 00 41 00 7e 00 31 00  P.R.O.G.R.A.~.1.

0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0xeca
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x70
   +0x00a AttributeLength  : 0x5c
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0xeca
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x68
   +0x00a AttributeLength  : 0x52
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt file_name 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+10
Ntfs!FILE_NAME
   +0x000 ParentDirectory  : _MFT_SEGMENT_REFERENCE
   +0x008 Info             : _DUPLICATED_INFORMATION
   +0x040 FileNameLength   : 0x8 ''
   +0x041 Flags            : 0x2 ''
   +0x042 FileName         : [1] 0x50
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!unsigned short (*)[1])0xc14c14ca))
(*((Ntfs!unsigned short (*)[1])0xc14c14ca))                 [Type: unsigned short [1]]
    [0]              : 0x50 [Type: unsigned short]
0: kd> db 0xc14c14ca
c14c14ca  50 00 52 00 4f 00 47 00-52 00 41 00 7e 00 31 00  P.R.O.G.R.A.~.1.
c14c14da  6f 00 6c 00 75 00 d5 27-00 00 00 00 07 00 68 00  o.l.u..'......h.
c14c14ea  52 00 00 00 00 00 05 00-00 00 00 00 05 00 ca 1f  R...............
c14c14fa  d1 e1 f6 16 db 01 ca 1f-d1 e1 f6 16 db 01 7a 42  ..............zB
c14c150a  28 c7 e8 88 db 01 46 8d-fd b2 e4 be db 01 00 00  (.....F.........
c14c151a  00 00 00 00 00 00 00 00-00 00 00 00 00 00 06 00  ................
c14c152a  00 10 00 00 00 00 08 03-52 00 45 00 43 00 59 00  ........R.E.C.Y.
c14c153a  43 00 4c 00 45 00 52 00-42 00 47 00 75 00 60 19  C.L.E.R.B.G.u.`.

0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0xeca
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x68
   +0x00a AttributeLength  : 0x52
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x27d5
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x70000
   +0x008 Length           : 0x68
   +0x00a AttributeLength  : 0x52
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt file_name 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+10
Ntfs!FILE_NAME
   +0x000 ParentDirectory  : _MFT_SEGMENT_REFERENCE
   +0x008 Info             : _DUPLICATED_INFORMATION
   +0x040 FileNameLength   : 0x8 ''
   +0x041 Flags            : 0x3 ''
   +0x042 FileName         : [1] 0x52
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!unsigned short (*)[1])0xc14c1532))
(*((Ntfs!unsigned short (*)[1])0xc14c1532))                 [Type: unsigned short [1]]
    [0]              : 0x52 [Type: unsigned short]
0: kd> db 0xc14c1532
c14c1532  52 00 45 00 43 00 59 00-43 00 4c 00 45 00 52 00  R.E.C.Y.C.L.E.R.
c14c1542  42 00 47 00 75 00 60 19-00 00 00 00 01 00 68 00  B.G.u.`.......h.
c14c1552  56 00 00 00 00 00 05 00-00 00 00 00 05 00 8c 99  V...............
c14c1562  68 a8 c7 06 db 01 ea a4-73 b1 c7 06 db 01 ea a4  h.......s.......
c14c1572  73 b1 c7 06 db 01 50 8c-7f d6 23 63 db 01 00 20  s.....P...#c...
c14c1582  00 00 00 00 00 00 a8 15-00 00 00 00 00 00 20 00  .............. .
c14c1592  00 00 00 00 00 00 0a 03-53 00 49 00 50 00 4f 00  ........S.I.P.O.
c14c15a2  42 00 4a 00 2e 00 44 00-42 00 47 00 75 00 48 0d  B.J...D.B.G.u.H.

0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x27d5
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x70000
   +0x008 Length           : 0x68
   +0x00a AttributeLength  : 0x52
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x1960
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x68
   +0x00a AttributeLength  : 0x56
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt file_name 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+10
Ntfs!FILE_NAME
   +0x000 ParentDirectory  : _MFT_SEGMENT_REFERENCE
   +0x008 Info             : _DUPLICATED_INFORMATION
   +0x040 FileNameLength   : 0xa ''
   +0x041 Flags            : 0x3 ''
   +0x042 FileName         : [1] 0x53
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!unsigned short (*)[1])0xc14c159a))
(*((Ntfs!unsigned short (*)[1])0xc14c159a))                 [Type: unsigned short [1]]
    [0]              : 0x53 [Type: unsigned short]
0: kd> db 0xc14c159a
c14c159a  53 00 49 00 50 00 4f 00-42 00 4a 00 2e 00 44 00  S.I.P.O.B.J...D.
c14c15aa  42 00 47 00 75 00 48 0d-00 00 00 00 01 00 88 00  B.G.u.H.........
c14c15ba  74 00 00 00 00 00 05 00-00 00 00 00 05 00 f2 b1  t...............
c14c15ca  aa ba 8b 06 db 01 58 ee-b9 5b 03 b4 db 01 58 ee  ......X..[....X.
c14c15da  b9 5b 03 b4 db 01 46 8d-fd b2 e4 be db 01 00 00  .[....F.........
c14c15ea  00 00 00 00 00 00 00 00-00 00 00 00 00 00 06 00  ................
c14c15fa  00 10 00 00 00 00 19 01-53 00 79 00 73 00 74 00  ........S.y.s.t.
c14c160a  65 00 6d 00 20 00 56 00-6f 00 6c 00 75 00 6d 00  e.m. .V.o.l.u.m.

0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x1960
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x68
   +0x00a AttributeLength  : 0x56
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+68
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0xd48
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x88
   +0x00a AttributeLength  : 0x74
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt file_name 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+68+10
Ntfs!FILE_NAME
   +0x000 ParentDirectory  : _MFT_SEGMENT_REFERENCE
   +0x008 Info             : _DUPLICATED_INFORMATION
   +0x040 FileNameLength   : 0x19 ''
   +0x041 Flags            : 0x1 ''
   +0x042 FileName         : [1] 0x53
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!unsigned short (*)[1])0xc14c1602))
(*((Ntfs!unsigned short (*)[1])0xc14c1602))                 [Type: unsigned short [1]]
    [0]              : 0x53 [Type: unsigned short]
0: kd> db 0xc14c1602
c14c1602  53 00 79 00 73 00 74 00-65 00 6d 00 20 00 56 00  S.y.s.t.e.m. .V.
c14c1612  6f 00 6c 00 75 00 6d 00-65 00 20 00 49 00 6e 00  o.l.u.m.e. .I.n.
c14c1622  66 00 6f 00 72 00 6d 00-61 00 74 00 69 00 6f 00  f.o.r.m.a.t.i.o.
c14c1632  6e 00 00 00 00 00 48 0d-00 00 00 00 01 00 68 00  n.....H.......h.
c14c1642  52 00 00 00 00 00 05 00-00 00 00 00 05 00 f2 b1  R...............
c14c1652  aa ba 8b 06 db 01 58 ee-b9 5b 03 b4 db 01 58 ee  ......X..[....X.
c14c1662  b9 5b 03 b4 db 01 46 8d-fd b2 e4 be db 01 00 00  .[....F.........
c14c1672  00 00 00 00 00 00 00 00-00 00 00 00 00 00 06 00  ................

0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+68
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0xd48
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x88
   +0x00a AttributeLength  : 0x74
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+68+88
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0xd48
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x68
   +0x00a AttributeLength  : 0x52
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt file_name 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+68+88+10
Ntfs!FILE_NAME
   +0x000 ParentDirectory  : _MFT_SEGMENT_REFERENCE
   +0x008 Info             : _DUPLICATED_INFORMATION
   +0x040 FileNameLength   : 0x8 ''
   +0x041 Flags            : 0x2 ''
   +0x042 FileName         : [1] 0x53
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!unsigned short (*)[1])0xc14c168a))
(*((Ntfs!unsigned short (*)[1])0xc14c168a))                 [Type: unsigned short [1]]
    [0]              : 0x53 [Type: unsigned short]
0: kd> db 0xc14c168a
c14c168a  53 00 59 00 53 00 54 00-45 00 4d 00 7e 00 31 00  S.Y.S.T.E.M.~.1.
c14c169a  00 00 00 00 00 00 f4 27-00 00 00 00 0e 00 68 00  .......'......h.
c14c16aa  54 00 00 00 00 00 05 00-00 00 00 00 05 00 9a b0  T...............
c14c16ba  99 05 66 23 db 01 74 64-82 83 40 27 db 01 74 64  ..f#..td..@'..td
c14c16ca  82 83 40 27 db 01 4e c2-2d 35 ff 6e db 01 00 00  ..@'..N.-5.n....
c14c16da  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
c14c16ea  00 10 00 00 00 00 09 01-74 00 66 00 74 00 70 00  ........t.f.t.p.
c14c16fa  64 00 72 00 6f 00 6f 00-74 00 00 00 01 00 f4 27  d.r.o.o.t......'

0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+68+88
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0xd48
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x68
   +0x00a AttributeLength  : 0x52
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+68+88+68
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x27f4
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0xe0000
   +0x008 Length           : 0x68
   +0x00a AttributeLength  : 0x54
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt file_name 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+68+88+68+10
Ntfs!FILE_NAME
   +0x000 ParentDirectory  : _MFT_SEGMENT_REFERENCE
   +0x008 Info             : _DUPLICATED_INFORMATION
   +0x040 FileNameLength   : 0x9 ''
   +0x041 Flags            : 0x1 ''
   +0x042 FileName         : [1] 0x74
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!_MFT_SEGMENT_REFERENCE *)0xc14c16b0))
(*((Ntfs!_MFT_SEGMENT_REFERENCE *)0xc14c16b0))                 [Type: _MFT_SEGMENT_REFERENCE]
    [+0x000] SegmentNumberLowPart : 0x5 [Type: unsigned long]
    [+0x004] SegmentNumberHighPart : 0x0 [Type: unsigned short]
    [+0x006] SequenceNumber   : 0x5 [Type: unsigned short]
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!unsigned short (*)[1])0xc14c16f2))
(*((Ntfs!unsigned short (*)[1])0xc14c16f2))                 [Type: unsigned short [1]]
    [0]              : 0x74 [Type: unsigned short]
0: kd> db 0xc14c16f2
c14c16f2  74 00 66 00 74 00 70 00-64 00 72 00 6f 00 6f 00  t.f.t.p.d.r.o.o.
c14c1702  74 00 00 00 01 00 f4 27-00 00 00 00 0e 00 68 00  t......'......h.
c14c1712  52 00 00 00 00 00 05 00-00 00 00 00 05 00 9a b0  R...............
c14c1722  99 05 66 23 db 01 74 64-82 83 40 27 db 01 74 64  ..f#..td..@'..td
c14c1732  82 83 40 27 db 01 4e c2-2d 35 ff 6e db 01 00 00  ..@'..N.-5.n....
c14c1742  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
c14c1752  00 10 00 00 00 00 08 02-54 00 46 00 54 00 50 00  ........T.F.T.P.
c14c1762  44 00 52 00 7e 00 31 00-00 00 00 00 01 00 1c 00  D.R.~.1.........

0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+68+88+68
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x27f4
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0xe0000
   +0x008 Length           : 0x68
   +0x00a AttributeLength  : 0x54
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+68+88+68+68
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x27f4
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0xe0000
   +0x008 Length           : 0x68
   +0x00a AttributeLength  : 0x52
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt file_name 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+68+88+68+68+10
Ntfs!FILE_NAME
   +0x000 ParentDirectory  : _MFT_SEGMENT_REFERENCE
   +0x008 Info             : _DUPLICATED_INFORMATION
   +0x040 FileNameLength   : 0x8 ''
   +0x041 Flags            : 0x2 ''
   +0x042 FileName         : [1] 0x54
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!unsigned short (*)[1])0xc14c175a))
(*((Ntfs!unsigned short (*)[1])0xc14c175a))                 [Type: unsigned short [1]]
    [0]              : 0x54 [Type: unsigned short]
0: kd> db 0xc14c175a
c14c175a  54 00 46 00 54 00 50 00-44 00 52 00 7e 00 31 00  T.F.T.P.D.R.~.1.
c14c176a  00 00 00 00 01 00 1c 00-00 00 00 00 01 00 60 00  ..............`.
c14c177a  50 00 00 00 00 00 05 00-00 00 00 00 05 00 82 17  P...............
c14c178a  60 88 8b 06 db 01 c0 4c-84 b5 43 93 db 01 c0 4c  `......L..C....L
c14c179a  84 b5 43 93 db 01 46 8d-fd b2 e4 be db 01 00 00  ..C...F.........
c14c17aa  00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00  ................
c14c17ba  00 10 00 00 00 00 07 03-57 00 49 00 4e 00 44 00  ........W.I.N.D.
c14c17ca  4f 00 57 00 53 00 da 1b-00 00 00 00 01 00 60 00  O.W.S.........`.

0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+68+88+68+68
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x27f4
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0xe0000
   +0x008 Length           : 0x68
   +0x00a AttributeLength  : 0x52
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+68+88+68+68+68
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x1c
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x60
   +0x00a AttributeLength  : 0x50
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt file_name 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+68+88+68+68+68+10
Ntfs!FILE_NAME
   +0x000 ParentDirectory  : _MFT_SEGMENT_REFERENCE
   +0x008 Info             : _DUPLICATED_INFORMATION
   +0x040 FileNameLength   : 0x7 ''
   +0x041 Flags            : 0x3 ''
   +0x042 FileName         : [1] 0x57
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!unsigned short (*)[1])0xc14c17c2))
(*((Ntfs!unsigned short (*)[1])0xc14c17c2))                 [Type: unsigned short [1]]
    [0]              : 0x57 [Type: unsigned short]
0: kd> db 0xc14c17c2
c14c17c2  57 00 49 00 4e 00 44 00-4f 00 57 00 53 00 da 1b  W.I.N.D.O.W.S...
c14c17d2  00 00 00 00 01 00 60 00-4c 00 00 00 00 00 05 00  ......`.L.......
c14c17e2  00 00 00 00 05 00 6e 76-13 da c7 06 db 01 6e 76  ......nv......nv
c14c17f2  13 da c7 06 db 01 6e 76-13 da c7 06 db 01 4e c2  ......nv......N.
c14c1802  2d 35 ff 6e db 01 00 00-00 00 00 00 00 00 00 00  -5.n............
c14c1812  00 00 00 00 00 00 00 00-00 10 00 00 00 00 05 03  ................
c14c1822  77 00 6d 00 70 00 75 00-62 00 00 00 00 00 00 00  w.m.p.u.b.......
c14c1832  00 00 00 00 00 00 10 00-00 00 02 00 00 00 10 00  ................

0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+68+88+68+68+68
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x1c
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x60
   +0x00a AttributeLength  : 0x50
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+68+88+68+68+68+60
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x1bda
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x60
   +0x00a AttributeLength  : 0x4c
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt file_name 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+68+88+68+68+68+60+10
Ntfs!FILE_NAME
   +0x000 ParentDirectory  : _MFT_SEGMENT_REFERENCE
   +0x008 Info             : _DUPLICATED_INFORMATION
   +0x040 FileNameLength   : 0x5 ''
   +0x041 Flags            : 0x3 ''
   +0x042 FileName         : [1] 0x77
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!unsigned short (*)[1])0xc14c1822))
(*((Ntfs!unsigned short (*)[1])0xc14c1822))                 [Type: unsigned short [1]]
    [0]              : 0x77 [Type: unsigned short]
0: kd> db 0xc14c1822
c14c1822  77 00 6d 00 70 00 75 00-62 00 00 00 00 00 00 00  w.m.p.u.b.......
c14c1832  00 00 00 00 00 00 10 00-00 00 02 00 00 00 10 00  ................
c14c1842  00 00 02 00 00 00 60 00-4c 00 00 00 00 00 05 00  ......`.L.......
c14c1852  00 00 00 00 05 00 6e 76-13 da c7 06 db 01 6e 76  ......nv......nv
c14c1862  13 da c7 06 db 01 6e 76-13 da c7 06 db 01 4e c2  ......nv......N.
c14c1872  2d 35 ff 6e db 01 00 00-00 00 00 00 00 00 00 00  -5.n............
c14c1882  00 00 00 00 00 00 00 00-00 10 00 00 00 00 05 03  ................
c14c1892  77 00 6d 00 70 00 75 00-62 00 00 00 00 00 00 00  w.m.p.u.b.......

0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+68+88+68+68+68+60
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0x1bda
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0x10000
   +0x008 Length           : 0x60
   +0x00a AttributeLength  : 0x4c
   +0x00c Flags            : 0
   +0x00e Reserved         : 0
0: kd> dt index_entry 0xc14c1018+28+68+68+60+68+80+70+70+60+70+70+68+68+68+88+68+68+68+60+60
Ntfs!INDEX_ENTRY
   +0x000 FileReference    : _MFT_SEGMENT_REFERENCE
   +0x000 DataOffset       : 0
   +0x002 DataLength       : 0
   +0x004 ReservedForZero  : 0
   +0x008 Length           : 0x10
   +0x00a AttributeLength  : 0
   +0x00c Flags            : 2
   +0x00e Reserved         : 0