Can a mft_reference correspond to two different files at different time?

Question

I am working on parsing USN Journal files now, and what I know is that in USN Journal log entry, there is a mft_reference field, it references the corresponding FileRecord in MFT table.

After a period of time, the USN Journal files may accumulate quite lot of file change records, such as file adding, file modifying, file deleting.

If I just get a mft_reference number(64 bits integer) mft_refer_1 at the very beginning of the USN Journal file, and get another mft_reference number mft_refer_2 at the end of the USN Journal file, and they are equal in value, mft_refer_1 == mft_refer_2 Can I say the two journal records are specifying the same file?

What I am not quite sure is if an later added FileRecord will replace the position of a former deleted FileRecord.

Thank you in advance!

Answer 1

I figure out this by experimenting with "fsutil usn" tools;

First we should know how mft_refer is composed: 0xAAAABBBBBBBBBBBB, where AAAA stands for update number, and BBBBBBBBBBBB stands for File Record index into MFT table.

First I create a text document named by "daniel.txt", and find out its mft_refer is 0x00050000000c6c3f,

and then I delete it to Recycle Bin, its name is changed to something like "$R2QW90X.txt", but its mft_refer is still 0x00050000000c6c3f,

I delete it thoroughtly from Recycle Bin, and create another document also named as "daniel.txt", now the new document's mft_refer is 0x00040000000c6c48,

and then I create several other temporary files, one of these files occupies the 0x00000000000c6c3f-th file record with an updated mft_refer 0x00060000000c6c3f.

So my coclusion is the file record space is very precious in MFT, if a previous file has been thoroughtly deleted, then the file record space will be reclaimed for a new created file, but will update the "update number" field in mft_refer.

For the detailed experiment process, see here