temp restore

ntfs_utils/db_config.py

@@ -8,9 +8,10 @@ def GetNTFSBootInfo(volume_letter):
     - Bytes per sector
     - Sectors per cluster
     - Cluster size (bytes)
+    - $MFT 起始簇号
 
     参数:
-        volume_letter: 卷标字符串，例如 'C'
+        volume_letter: str，卷标字符串，例如 'C'
 
     返回:
         dict 包含上述信息
@@ -62,10 +63,15 @@ def GetNTFSBootInfo(volume_letter):
     # 计算簇大小
     cluster_size = bytes_per_sector * sectors_per_cluster
 
+    # 解析 $MFT 起始簇号（LCN），偏移 0x30，QWORD（8 字节）
+    mft_lcn_bytes = buffer[0x30:0x38]
+    mft_lcn = int.from_bytes(mft_lcn_bytes, byteorder='little', signed=False)
+
     return {
         "BytesPerSector": bytes_per_sector,
         "SectorsPerCluster": sectors_per_cluster,
-        "ClusterSize": cluster_size
+        "ClusterSize": cluster_size,
+        "MftPosition": mft_lcn
     }