An alternative way to find files using a 102400 block of NUL was shown earlier, if I tested correctly.
Once you find a thought-to-be-broken version of a path, you could look at its BlocksetEntry entries.
is my ideas for a discussion of how internals connect.
Documentation for the local database format is a slightly stale picture that might help with my words.