linux-ntfs-dev

[Linux-NTFS-Dev] read the volume label online and offline

[pkorfgen <pe...@ni...>]

Hi, developers,

I want to get the volume or partition label of a ntfs volume.
Is there a easy way to get this label from a mounted and/or a unmouted
device?
With dd or so. I can't find the label.

Many thanks,
Peter

Re: [Linux-NTFS-Dev] read the volume label online and offline

[Richard R. <ri...@fl...>]

Hi Peter,

> I want to get the volume or partition label of a ntfs volume.
> Is there a easy way to get this label from a mounted and/or a unmouted
> device?

No

> With dd or so. I can't find the label.

Definitely not.

All the data describing the volume (the metadata) is stored in files.
To find the volume label you need to find and decode the file: $Volume.

First have a look at the file $Boot [1], this is located at the very
beginning of the partition.  This tells us the size of the clusters, how
many clusters per MFT record and where the MFT is written.

The MFT stores information about itself, the other metadata and all the
files and directories.  The layout is shown here [2].  We need the 4th
record, for $Volume.  Fortunately, it is *extremely* unlikely for this
part of the MFT to be fragmented.

Now we know the size and location of the MFT record, we need to find
the attribute which describes the volume label.  The MFT record consists
of a header [3] and a list of attributes [4].  Before we can read the
attributes we have to remove the fixup [5] (a form of integrity check).

Iterate through the attributes until we find 0x60 $VOLUME_NAME [6],
whose length is shown in the attribute header [7].

[1]  http://linux-ntfs.sf.net/ntfs/files/boot.html
[2]  http://linux-ntfs.sf.net/ntfs/files/index.html
[3]  http://linux-ntfs.sf.net/ntfs/concepts/file_record.html
[4]  http://linux-ntfs.sf.net/ntfs/files/volume.html
[5]  http://linux-ntfs.sf.net/ntfs/concepts/fixup.html
[6]  http://linux-ntfs.sf.net/ntfs/attributes/volume_name.html
[7]  http://linux-ntfs.sf.net/ntfs/concepts/attribute_header.html

This is why I didn't write a patch for fdisk.

Hope this helps,
  FlatCap (Rich)
  nt...@fl...