Parse NT/FILE headers