linux-ntfs-dev

[Linux-NTFS-Dev] Directory structure

[mblsha <mai...@ma...>]

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi,

I need to write simple NTFS browser that would work from DOS. I'm in the=20
half-way of doing job, but I'm currently stuck when trying to browse trough=
=20
directories.

Code is parsing INDX records ok, but I cannot find files using MFT referenc=
es.
I'm using first 6 bytes from 8-tyte MFT reference as number of FILE record.

Can someone please enlighten me on what I'm missing?

=2D --=20
 Michail "mblsha" Pishchagin - MAZsoft
mb...@us... - http://maz.sf.net
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+nvAP5mhuYpsVoGwRAmXtAKChHzVaHnEowaG4NL7h7J9R2ucaoACgzNZX
wVL2Z1JtmT+wuL4awFkqphM=3D
=3DtOOY
=2D----END PGP SIGNATURE-----

Re: [Linux-NTFS-Dev] Directory structure

[mblsha <mai...@ma...>]

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

mblsha wrote:
> Code is parsing INDX records ok, but I cannot find files using MFT
> references. I'm using first 6 bytes from 8-tyte MFT reference as number of
> FILE record.

Ok. I have found out that FILEs are stored as 0x80 attribute of $MFT FILE.=
=20
But, anyway, attributes in these files are corrupted (at least I think so).

I have released my program. Go to http://maz.sf.net and look out for NTFSvi=
ew=20
:-).

=2D --
 Michail "mblsha" Pishchagin - MAZsoft
mb...@us... - http://maz.sf.net
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+p1335mhuYpsVoGwRAnk0AJ4z0q6Acvsv61A36Wukn0oNd0EIBgCdHO0Z
+BaHQgX3ZNKtqcZAlXV5LOM=3D
=3DQIZU
=2D----END PGP SIGNATURE-----

Re: [Linux-NTFS-Dev] Directory structure

[Anton A. <ai...@ca...>]

On Thu, 24 Apr 2003, mblsha wrote:
> mblsha wrote:
> > Code is parsing INDX records ok, but I cannot find files using MFT
> > references. I'm using first 6 bytes from 8-tyte MFT reference as number of
> > FILE record.
> 
> Ok. I have found out that FILEs are stored as 0x80 attribute of $MFT FILE. 
> But, anyway, attributes in these files are corrupted (at least I think so).

You probably have forgotten to apply the fixups desribed in the update
sequence array in each mft record...

> I have released my program. Go to http://maz.sf.net and look out for NTFSview 
> :-).

Note to find further mft records than the first few you need to parse the
attribute list attribute and find further $DATA extent attributes which
will be in other mft records.

See our docs which describe both of the above.

Best regards,

	Anton
-- 
Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @)
Linux NTFS maintainer / IRC: #ntfs on irc.freenode.net
WWW: http://linux-ntfs.sf.net/ & http://www-stu.christs.cam.ac.uk/~aia21/

Re: [Linux-NTFS-Dev] Directory structure

[mblsha <mai...@ma...>]

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Anton Altaparmakov wrote:
> > Ok. I have found out that FILEs are stored as 0x80 attribute of $MFT
> > FILE. But, anyway, attributes in these files are corrupted (at least I
> > think so).
>
> You probably have forgotten to apply the fixups desribed in the update
> sequence array in each mft record...

Oh. I didn't ever thought that update sequence is so important :-). Now I c=
an=20
see why my code is falling: I assume that attribute list starts on 0x30 of=
=20
each FILE, which is true for system FILEs, but not true for user ones.=20

Thanks for helping me :)

> Note to find further mft records than the first few you need to parse the
> attribute list attribute and find further $DATA extent attributes which
> will be in other mft records.

=46or now, I've been testing program on really small partitions and thus no=
=20
extended attributes are used. Maybe I'll update the program to support=20
this...

> See our docs which describe both of the above.

Without your ntfsdoc, my NTFSview wouldn't ever existed :-).

=2D --=20
 Michail "mblsha" Pishchagin - MAZsoft
mb...@us... - http://maz.sf.net

We'll pivot at warp 2 and bring all tubes to bear, Mr. Sulu!
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+qDYr5mhuYpsVoGwRAtgJAKCAlLge8gu0WOgOLojujCOonhLNPgCbBD2R
gYvUudYPcEIZooMwAjSHEk4=3D
=3DRw8w
=2D----END PGP SIGNATURE-----

Re: [Linux-NTFS-Dev] Directory structure

[Szakacsits S. <sz...@si...>]

On Thu, 24 Apr 2003, mblsha wrote:

> see why my code is falling: I assume that attribute list starts on 0x30 of
> each FILE, which is true for system FILEs, but not true for user ones.

It starts where 'Offset to the first Attribute' defines it in the FILE
record:
	http://linux-ntfs.sourceforge.net/ntfs/concepts/file_record.html

But why don't you use libntfs from ntfsprogs? You could progress much
faster.

	Szaka

Re: [Linux-NTFS-Dev] Directory structure

[mblsha <mai...@ma...>]

=2D----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Szakacsits Szabolcs wrote:
> It starts where 'Offset to the first Attribute' defines it in the FILE
> record:
> 	http://linux-ntfs.sourceforge.net/ntfs/concepts/file_record.html

Thanks for the tip ;).

> But why don't you use libntfs from ntfsprogs? You could progress much
> faster.

Because it's my term-task, and I need to do NTFS reading by myself.

=2D --=20
 Michail "mblsha" Pishchagin - MAZsoft
mb...@us... - http://maz.sf.net
=2D----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQE+qbM+5mhuYpsVoGwRAq5VAJ9DLc11qPJCC/9cHw22XajBqo0nVQCeOy/v
Xdz3H9iVmZqHMb0lkkcmWQ8=3D
=3Dlnnq
=2D----END PGP SIGNATURE-----