The master file table record consists of a header and the attribute list. It has a size of 400 (=1K), or the cluster size (whichever is larger). The header has the following fields:
offset(length) contents 0(4) Magic number 'FILE' 4(2) Offset to fixup (usually 2C) 6(2) Number of fixups, including first word 10(2) Sequence number 12(2) hard link count 14(2) Offset to attributes 16(2) Flags: 1-non-resident attributes, 2-record is directory 18(4) Length of in-use part of the record (header + attributes) 1C(4) Allocated (total) length of the record 20(8) Main MFT record, if continuation record, or 0 28(2) Next free attribute ID 2A(6+) Fixup (length depends on record size)The fixup's first word should be found at offsets 1FE and 3FE. If it matches, the words at offset 2C and 2E should be written to the offsets 1FE and 3FE, respectively. The fixup is incremented each time the record is written.
The attribute list is of variable length and terminated with FFFFFFFF. For 1K MFT records, the attribute list starts at offset 0x30.