When an attempt is made to open a file relative to the $ mft file, the NtfsFindStartingNode function will not find it, because This function performs a search somewhat differently, in contrast to the function NtfsOpenSubdirectory, which finds this file always. Therefore, the loop starts from the root of the file system. Next, the function NtfsOpenSubdirectory will open this file and grab it ERESOURCE exclusively. At the next iteration, the loop will find that the file is not a directory, and therefore will interrupt its operation with an error. And at the end of its work function NtfsCommonCreate through the function NtfsTeardownStructures will try to close it. Function NtfsTeardownStructures, in turn, will face the fact that it can not close the file, because It is opened by the file system itself when it is mounted. In this case, contrary to the expectations of the NtfsCommonCreate function, the NtfsTeardownStructures function will not free the ERESOURCE $ mft file. Thus, he will remain captured forever. Therefore, for example, when you try to create a file or read a volume file, the NTFS file system will try to grab the ERESOURCE $ mft file and hang at this stage forever.