cybersecurity · beginner · ~15 min · safe pentest lab

Is it an MFT record?

Recognise the MFT record signature.

Challenge

Validate an NTFS MFT record by its signature — a valid entry begins with FILE, while a corrupt one reads BAAD.

Task

Implement int is_mft_record(const unsigned char *b) that returns 1 if the first four bytes are 'F','I','L','E', else 0.

Input

  • b: a byte buffer of at least 4 bytes holding a (mock) MFT record. The grader passes a fixed buffer.

Output

Returns int: 1 if b[0..3] spell FILE, else 0.

Example

b = 'F' 'I' 'L' 'E' ...   ->   1
b = 'B' 'A' 'A' 'D'       ->   0

Edge cases

  • Only the first four bytes are checked.

Input format

A byte buffer b of at least 4 bytes.

Output format

An int: 1 if the first four bytes are 'F','I','L','E', else 0.

Constraints

The MFT signature is the ASCII bytes FILE.

Starter code

int is_mft_record(const unsigned char *b) {
    /* TODO */
    return 0;
}

Solve this exercise in the browser editor — compile and run against the test harness, no setup required.