linux-ntfs-dev

RE: [Linux-NTFS-Dev] Extra cluster half-way along NT flelsystem

[Bird, B. <bar...@ed...>]

Szaka,

Thanks for taking an interest in this problem.

The missing information (I had to write it down off the screen!) is:

----
NTFS volume version: 3.0 (you knew that)
Checking filesystem consistency...
100.00 percent completed

Totally 1 cluster accounting mismatches
----
Yes, it's always the same cluster number, and only one.

This Windows installation has Service Pack 3 installed, plus four 
Hotfixes (Q326830, Q331953, Q810833, Q811493).
These hotfixes are to do with security, fixing unchecked buffers and
the like and I can't see would affect the filesystem as such. 811493 
is the closest, fixing an error in the way the kernel passes error 
messages to a debugger.

Unfortunately I don't seem to be able to turn Norton Antivirus off 
without uninstalling it.  However, it has a 'pause for 10 minutes' 
feature which I selected, then closed Windows down and ran 
ntfsresize again under Linux.  This made no difference, exactly 
the same error occurred again.

If you care to send me a special program that can extract slices 
of this filesystem for inspection, I'd be happy to run it and send 
you the results.

Regards,

Barry

PS I got hold of your ntfsmeta program and ran it to get the 'boot record', 
if that helps (the small number of unused sectors seems at variance with the

report in Windows that more than 91% of the disc is unused 
8388736/39085137 = 21.5% unused! - I suppose I just don't know how to
interpret 
this):

Jump                :                        
OEM_ID              :  NTFS                  
Bytes/sector        :  512                   
Sectors/cluster     :  1                     
Reserved sectors    :  0                     
Fats                :  0                     
Root entries        :  0                     
Sectors             :  0                     
Media type          :  248                   
Sectors/fat         :  0                     
Sectors/track       :  63                    
Heads               :  240                   
Hidden sectors      :  63                    
Large sectors       :  0                     
Unused              :  8388736               
Number of sectors   :  39085137              
LCN of $MFT         :  16                    
LCN of $MFTMirr     :  29208                 
Clusters/MFT record :  2                     
Clusters/index block:  8                     
Volume serial number:  10683704130303964288  
Boot sector checksum:  0                     
End of sector marker:  43605                 
=====================================================================
Volume name         :  
NTFS major version  :  3                     
NTFS minor version  :  0                     
NTFS flags          :  0                     
Number of clusters  :  39085137              
Cluster size        :  512                   
MFT record size     :  1024                  
LCN of $MFT         :  16                    
LCN of $MFTMirr     :  29208                 
Num. of $MFT records:  12935                 

-----Original Message-----
From: Szakacsits Szabolcs [mailto:sz...@si...]
Sent: 10 July 2003 19:02
To: Bird, Barry
Cc: 'lin...@li...'
Subject: Re: [Linux-NTFS-Dev] Extra cluster half-way along NT flelsystem



Hi,

On Wed, 9 Jul 2003, Bird, Barry wrote:

> Perhaps this experience could be used to improve ntfsresize.

Thanks for reporting.

> On running ntfsresize from a floppy I got
>
>   ./ntfsresize -i /dev/hda1
>   ntfsresize version:  1.7.1s
>
>   Cluster Size: 512 bytes
>   Current volume/device size: 20011590144 bytes (20012 MB)
>
>   cluster accounting failed at 19542568 (ox12a3228): extra cluster in
$Bitmap

Here there should be some more information, like

	"Totally <NUMBER> cluster accounting mismatches."

> So I followed the advice, ran Chkdsk, made sure Windows shut down
> properly, and it made no difference. With Windows 2000 you have to
> schedule chkdsk to run and make corrections to NTFS at the next Windows
> reboot.

Right, if it's system partition. Doing it from the GUI Windows just reports
everything is OK but didn't (can't) correct the errors.

> All told I must have run chkdsk 3 times,

It's enough once, I mean if you have only one partition, schedule the
chkdsk, reboot and it must do the check.

> It is interesting to note however, that the position of this alleged
> error is exactly half-way along the partition, which is where the 'More
> metadata' is located.

Is it always at position 19542568 or it changes? Also how many mismatches
ntfsresize reports altogether?

> I should also point out that this is a relatively fresh installation of
> W2k,

If chkdsk indeed doesn't help, you could try applying W2K Service PACK.
There were several NTFS related fixes AFAIR.

> and I had used the Windows 2000 defragmenter to squeeze all the files
> (only 1.7Gb) to the start of the partition (was this my mistake?).

No, but one can try to resize without using it first also.

> Norton Antivirus is installed.

Well, if you think some application could make "last minute" magic to the
filesystem, etc, you could disable it temporarily.

> Has anyone else reported this problem?

Yes, there were several inconsist NTFS reports but chkdsk could always fix
them. So your case is unique.

Cheers,

	Szaka

RE: [Linux-NTFS-Dev] Extra cluster half-way along NT flelsystem

[Bird, B. <bar...@ed...>]

> Just to be sure, did you run chkdsk between these tries?

Sometimes yes, sometimes no.  I often did, but not before the attempt to 
pause Norton Antivirus.

If I understand the output of ntfsresize correctly, it is saying that 1 bit
in the cluster bitmap has one cluster (out of 39 million) in use when in
fact 
nothing is using it (or nothing that ntfsresize knows about).  

The position of this cluster may be significant. Isn't it just before where 
the MFTMirror ought to be? Perhaps there is a bug in chkdsk?   

I do not think this is a big error and it seems that Windows can tolerate
it.  
Of course, there is a risk that it IS valid. 
I appreciate your desire to ensure that chkdsk does get run if errors are 
found.  However, it seems to me that ntfsresize could allow (with suitable 
warnings) resizes down to such a cluster without jeopardising anything.  
Additionally, it could be more restrictive and only allow this in 'special' 
circumstances.

ntfsclone might be useful, here.  I'd have thought that toleration of 
inconsistencies should be allowed in debugging use (2), especially if the 
case I have here crops up now and then.  Could it be used to extract at
least 
the first few records of MFT Mirror?  The volume of data will need to be
kept 
down because I am writing it to the floppy - there is nowhere else!

Unfortunately I don't have fsutil, I can't find it on the resources disc 
- isn't this only in XP? BUT - I used the sysinternals program ntfsinfo 
(even though it's not supposed to work for W2k!):-

Volume Size
-----------
Volume size            : 19084 MB
Total sectors          : 39085137
Total clusters         : 39085137
Free clusters          : 35890639
Free space             : 17524 MB (91% of drive)

Allocation Size
----------------
Bytes per sector       : 512
Bytes per cluster      : 512
Bytes per MFT record   : 1024
Clusters per MFT record: 2

MFT Information
---------------
MFT size               : 12 MB (0% of drive)
MFT start cluster      : 16
MFT zone clusters      : 4420000 - 9279808
MFT zone size          : 2372 MB (12% of drive)
MFT mirror start       : 29208

The results look good on the whole, apart from the MFT mirror start which
looks 
wrong, surely it should be half of total clusters (19542568 not 29208)? It
is 
that value (half the total) on my other W2k machine (on both its 2 NTFS 
partitions), so I think ntfsinfo is giving the correct answer.  
BTW ntfsresize finds no errors on those partitions.

Thanks for your help,

Regards,

Barry

-----Original Message-----
From: Szakacsits Szabolcs [mailto:sz...@si...]
Sent: 11 July 2003 10:36
To: Bird, Barry
Cc: 'lin...@li...'
Subject: RE: [Linux-NTFS-Dev] Extra cluster half-way along NT flelsystem



On Fri, 11 Jul 2003, Bird, Barry wrote:

> Thanks for taking an interest in this problem.

You're welcome :)

> Totally 1 cluster accounting mismatches
> ----
> Yes, it's always the same cluster number, and only one.

Just to be sure, did you run chkdsk between these tries?

> If you care to send me a special program that can extract slices
> of this filesystem for inspection, I'd be happy to run it and send
> you the results.

I recently finished 'ntfsclone'. This can be used to

  1) make a full backup to a sparse file, another partiton or standard
     output, e.g. for full backup through network (basically it's like
     'dd' however it can be _much_ faster because it understands NTFS).

  2) save only the important NTFS structures. This can be very
     useful for developers for debugging, etc.

However it doesn't support inconsistent NTFS, if you think I could add this
feature, I'd be interested in 2).

If you do have backup then another, additional way could be I add optional
support for inconsistent NTFS to the development version of ntfsresize. I
don't think it would cause problems [of course you won't be able to resize
below to stalled/lost cluster], still I'm quite unwilling to do it because
people would use it instead of doing chkdsk (and that always fixed the NTFS
inconsistencies ... so far).

> PS I got hold of your ntfsmeta program

BTW, if you have 'fsutil' on your Windows (should be default or in the
Resource Kit), could you do a

	fsutil fsinfo ntfsinfo C:

> and ran it to get the 'boot record', if that helps (the small number of
> unused sectors seems at variance with the report in Windows that more
> than 91% of the disc is unused 8388736/39085137 = 21.5% unused! - I
> suppose I just don't know how to interpret this):

"Unused" below means the field is "unused", not "unused sectors".
"Reserved or "unknown" would have been a better naming. Well, actually
it's used, because it's value is usually 8388736 or 128 if NTFS is on
an USB device.

> Unused              :  8388736
> Number of sectors   :  39085137

Cheers,

	Szaka

RE: [Linux-NTFS-Dev] Extra cluster half-way along NT flelsystem

[Anton A. <ai...@ca...>]

I have an idea what it could be: the backup boot sector.

In fact it MUST be the backup boot sector.

It is located _excatly_ in the middle of the volume.

Number of sectors(=clusters since cluster size=sector size) is 39085137.
Location of offending cluster is 19542568 * 2 = 39085136

Spot it?

The location of the backup boot sector is defined as either the end of
disk or INT(nr_sectors / 2) = INT(39085137/2) = 19542568

Szaka I would suggest that you update ntfsresize to detect this case. You
should definitely be able to cope with it fine.  It would be best if you
check whether the offending sector contains a valid ntfs boot sector (you
can do this using library functionality:
libntfs/bootsect.c::ntfs_boot_sector_is_ntfs().

And if it does, assume this is all ok.

You could even go as far as deallocating the sector and moving the
allocation to the volume end (considering this is ntfs 3.0 that is ok).

Most likely this volume was upgraded from a windows NT 3.51 NTFS volume
and the upgrade process didn't do the backup boot sector update.

Alternatively the volume has been grown to fill the disk with some strange
ntfsresizer when the machine was factory installed which is so old that it
creates an NT 3.51 NTFS boot sector...

Cheers,
	Anton

On Fri, 11 Jul 2003, Bird, Barry wrote:

> > Just to be sure, did you run chkdsk between these tries?
>
> Sometimes yes, sometimes no.  I often did, but not before the attempt to
> pause Norton Antivirus.
>
> If I understand the output of ntfsresize correctly, it is saying that 1 bit
> in the cluster bitmap has one cluster (out of 39 million) in use when in
> fact
> nothing is using it (or nothing that ntfsresize knows about).
>
> The position of this cluster may be significant. Isn't it just before where
> the MFTMirror ought to be? Perhaps there is a bug in chkdsk?
>
> I do not think this is a big error and it seems that Windows can tolerate
> it.
> Of course, there is a risk that it IS valid.
> I appreciate your desire to ensure that chkdsk does get run if errors are
> found.  However, it seems to me that ntfsresize could allow (with suitable
> warnings) resizes down to such a cluster without jeopardising anything.
> Additionally, it could be more restrictive and only allow this in 'special'
> circumstances.
>
> ntfsclone might be useful, here.  I'd have thought that toleration of
> inconsistencies should be allowed in debugging use (2), especially if the
> case I have here crops up now and then.  Could it be used to extract at
> least
> the first few records of MFT Mirror?  The volume of data will need to be
> kept
> down because I am writing it to the floppy - there is nowhere else!
>
> Unfortunately I don't have fsutil, I can't find it on the resources disc
> - isn't this only in XP? BUT - I used the sysinternals program ntfsinfo
> (even though it's not supposed to work for W2k!):-
>
> Volume Size
> -----------
> Volume size            : 19084 MB
> Total sectors          : 39085137
> Total clusters         : 39085137
> Free clusters          : 35890639
> Free space             : 17524 MB (91% of drive)
>
> Allocation Size
> ----------------
> Bytes per sector       : 512
> Bytes per cluster      : 512
> Bytes per MFT record   : 1024
> Clusters per MFT record: 2
>
> MFT Information
> ---------------
> MFT size               : 12 MB (0% of drive)
> MFT start cluster      : 16
> MFT zone clusters      : 4420000 - 9279808
> MFT zone size          : 2372 MB (12% of drive)
> MFT mirror start       : 29208
>
> The results look good on the whole, apart from the MFT mirror start which
> looks
> wrong, surely it should be half of total clusters (19542568 not 29208)? It
> is
> that value (half the total) on my other W2k machine (on both its 2 NTFS
> partitions), so I think ntfsinfo is giving the correct answer.
> BTW ntfsresize finds no errors on those partitions.
>
> Thanks for your help,
>
> Regards,
>
> Barry
>
> -----Original Message-----
> From: Szakacsits Szabolcs [mailto:sz...@si...]
> Sent: 11 July 2003 10:36
> To: Bird, Barry
> Cc: 'lin...@li...'
> Subject: RE: [Linux-NTFS-Dev] Extra cluster half-way along NT flelsystem
>
>
>
> On Fri, 11 Jul 2003, Bird, Barry wrote:
>
> > Thanks for taking an interest in this problem.
>
> You're welcome :)
>
> > Totally 1 cluster accounting mismatches
> > ----
> > Yes, it's always the same cluster number, and only one.
>
> Just to be sure, did you run chkdsk between these tries?
>
> > If you care to send me a special program that can extract slices
> > of this filesystem for inspection, I'd be happy to run it and send
> > you the results.
>
> I recently finished 'ntfsclone'. This can be used to
>
>   1) make a full backup to a sparse file, another partiton or standard
>      output, e.g. for full backup through network (basically it's like
>      'dd' however it can be _much_ faster because it understands NTFS).
>
>   2) save only the important NTFS structures. This can be very
>      useful for developers for debugging, etc.
>
> However it doesn't support inconsistent NTFS, if you think I could add this
> feature, I'd be interested in 2).
>
> If you do have backup then another, additional way could be I add optional
> support for inconsistent NTFS to the development version of ntfsresize. I
> don't think it would cause problems [of course you won't be able to resize
> below to stalled/lost cluster], still I'm quite unwilling to do it because
> people would use it instead of doing chkdsk (and that always fixed the NTFS
> inconsistencies ... so far).
>
> > PS I got hold of your ntfsmeta program
>
> BTW, if you have 'fsutil' on your Windows (should be default or in the
> Resource Kit), could you do a
>
> 	fsutil fsinfo ntfsinfo C:
>
> > and ran it to get the 'boot record', if that helps (the small number of
> > unused sectors seems at variance with the report in Windows that more
> > than 91% of the disc is unused 8388736/39085137 = 21.5% unused! - I
> > suppose I just don't know how to interpret this):
>
> "Unused" below means the field is "unused", not "unused sectors".
> "Reserved or "unknown" would have been a better naming. Well, actually
> it's used, because it's value is usually 8388736 or 128 if NTFS is on
> an USB device.
>
> > Unused              :  8388736
> > Number of sectors   :  39085137
>
> Cheers,
>
> 	Szaka
>
>
> -------------------------------------------------------
> This SF.Net email sponsored by: Parasoft
> Error proof Web apps, automate testing & more.
> Download & eval WebKing and get a free book.
> www.parasoft.com/bulletproofapps1
> _______________________________________________
> Linux-NTFS-Dev mailing list
> Lin...@li...
> https://lists.sourceforge.net/lists/listinfo/linux-ntfs-dev
>

Best regards,

	Anton
-- 
Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @)
Unix Support, Computing Service, University of Cambridge, CB2 3QH, UK
Linux NTFS maintainer / IRC: #ntfs on irc.freenode.net
WWW: http://linux-ntfs.sf.net/ & http://www-stu.christs.cam.ac.uk/~aia21/

RE: [Linux-NTFS-Dev] Extra cluster half-way along NT flelsystem

[Szakacsits S. <sz...@si...>]

On Fri, 11 Jul 2003, Anton Altaparmakov wrote:

> I have an idea what it could be: the backup boot sector.

This indeed sounds a very good idea! However Barry wrote it's a fresh W2K
install. It has 512 bytes cluster sizes so probably it was upgraded from a
FAT.

Barry, could you please do this to see what data is at that location?

   dd if=device of=cluster.out bs=512 skip=19542568 count=1

If 'od -c cluster.out | head -1' gives something like this
0000000 353   R 220   N   T   F   S                  \0 002 001  \0  \0

then it's the backup boot sector :)

> Szaka I would suggest that you update ntfsresize to detect this case. You

If this is the case, of course I'll support it. I'd be quite surprised
because from the several 10 thousands users so far nobody met with this
situation ... or at least didn't report it. Credit would go to Barry :)

> Alternatively the volume has been grown to fill the disk with some strange
> ntfsresizer when the machine was factory installed which is so old that it
> creates an NT 3.51 NTFS boot sector...

This sounds a good explanation also.

Cheers,

	Szaka

RE: [Linux-NTFS-Dev] Extra cluster half-way along NT flelsystem

[Szakacsits S. <sz...@si...>]

On Fri, 11 Jul 2003, Szakacsits Szabolcs wrote:
> On Fri, 11 Jul 2003, Anton Altaparmakov wrote:
>
> > I have an idea what it could be: the backup boot sector.
>
> Barry, could you please do this to see what data is at that location?
>
>    dd if=device of=cluster.out bs=512 skip=19542568 count=1
>
> If 'od -c cluster.out | head -1' gives something like this
> 0000000 353   R 220   N   T   F   S                  \0 002 001  \0  \0
>
> then it's the backup boot sector :)

Well, it's also possible, there was some corruption but chkdsk doesn't fix
the lost cluster if it's in the middle because it thinks it's the backup
boot sector. We will see when Barry answers :)

	Szaka

RE: [Linux-NTFS-Dev] Extra cluster half-way along NT flelsystem

[Bird, B. <bar...@ed...>]

OK,

I ran 

   dd if=/dev/hda of=cluster.out bs=512 skip=19542631 count=1

This is slightly different from what you had because the partition begins 
after 63 sectors on /dev/hda.  I also found on my linux disc it did not have

od available.  So I transferred the floppy to Windows and used my binary
block
printing program to get this:

C:\>mblock cluster.out 0 1
Block 0
byte   0 eb 52 90 4e 54 46 53 20 20 20 20  0  2  1  0  0  .R.NTFS    .....
byte  16  0  0  0  0  0 f8  0  0 3f  0 f0  0 3f  0  0  0  ........?...?...
byte  32  0  0  0  0 80  0 80  0 51 64 54  2  0  0  0  0  ........QdT.....
byte  48 10  0  0  0  0  0  0  0 18 72  0  0  0  0  0  0  .........r......
byte  64  2  0  0  0  8  0  0  0 80 34 24 44 4d 24 44 94  .........4$DM$D.
byte  80  0  0  0  0 fa 33 c0 8e d0 bc  0 7c fb b8 c0  7  .....3.....|....
byte  96 8e d8 e8 16  0 b8  0  d 8e c0 33 db c6  6  e  0  ..........3.....
byte 112 10 e8 53  0 68  0  d 68 6a  2 cb 8a 16 24  0 b4  ..S.h..hj....$..
byte 128  8 cd 13 73  5 b9 ff ff 8a f1 66  f b6 c6 40 66  ...s......f...@f
byte 144  f b6 d1 80 e2 3f f7 e2 86 cd c0 ed  6 41 66  f  .....?.......Af.
byte 160 b7 c9 66 f7 e1 66 a3 20  0 c3 b4 41 bb aa 55 8a  ..f..f. ...A..U.
byte 176 16 24  0 cd 13 72  f 81 fb 55 aa 75  9 f6 c1  1  .$...r...U.u....
byte 192 74  4 fe  6 14  0 c3 66 60 1e  6 66 a1 10  0 66  t......f`..f...f
byte 208  3  6 1c  0 66 3b  6 20  0  f 82 3a  0 1e 66 6a  ....f;. ...:..fj
byte 224  0 66 50  6 53 66 68 10  0  1  0 80 3e 14  0  0  .fP.Sfh.....>...
byte 240  f 85  c  0 e8 b3 ff 80 3e 14  0  0  f 84 61  0  ........>.....a.

You are right that this is an old machine recently upgraded, but the 
origin of the disc image (it was ghosted) is lost in obscurity.

If you do enhance ntfsresize, please can I have a copy!

Best Wishes,

Barry
 

-----Original Message-----
From: Szakacsits Szabolcs [mailto:sz...@si...]
Sent: 11 July 2003 14:49
To: Anton Altaparmakov
Cc: Bird, Barry; 'lin...@li...'
Subject: RE: [Linux-NTFS-Dev] Extra cluster half-way along NT flelsystem



On Fri, 11 Jul 2003, Anton Altaparmakov wrote:

> I have an idea what it could be: the backup boot sector.

This indeed sounds a very good idea! However Barry wrote it's a fresh W2K
install. It has 512 bytes cluster sizes so probably it was upgraded from a
FAT.

Barry, could you please do this to see what data is at that location?

   dd if=device of=cluster.out bs=512 skip=19542568 count=1

If 'od -c cluster.out | head -1' gives something like this
0000000 353   R 220   N   T   F   S                  \0 002 001  \0  \0

then it's the backup boot sector :)

> Szaka I would suggest that you update ntfsresize to detect this case. You

If this is the case, of course I'll support it. I'd be quite surprised
because from the several 10 thousands users so far nobody met with this
situation ... or at least didn't report it. Credit would go to Barry :)

> Alternatively the volume has been grown to fill the disk with some strange
> ntfsresizer when the machine was factory installed which is so old that it
> creates an NT 3.51 NTFS boot sector...

This sounds a good explanation also.

Cheers,

	Szaka

RE: [Linux-NTFS-Dev] Extra cluster half-way along NT flelsystem

[Szakacsits S. <sz...@si...>]

On Fri, 11 Jul 2003, Bird, Barry wrote:

>    dd if=/dev/hda of=cluster.out bs=512 skip=19542631 count=1

OK, this is equivalent what I tried to ask in my poor English (sorry I
wasn't more exact):

     dd if=/dev/hda1 of=cluster.out bs=512 skip=19542568 count=1

> byte   0 eb 52 90 4e 54 46 53 20 20 20 20  0  2  1  0  0  .R.NTFS    .....

Yes, this is the backup boot sector :)

> If you do enhance ntfsresize, please can I have a copy!

I'll do, but unfortunately probably I will have time for it only in the
next week.

Thanks everybody, great job :)

	Szaka

RE: [Linux-NTFS-Dev] Extra cluster half-way along NT flelsystem

[Anton A. <ai...@ca...>]

On Fri, 11 Jul 2003, Bird, Barry wrote:
> C:\>mblock cluster.out 0 1
> Block 0
> byte   0 eb 52 90 4e 54 46 53 20 20 20 20  0  2  1  0  0  .R.NTFS    .....

Yes, this certainly looks like an ntfs backup boot sector!

> You are right that this is an old machine recently upgraded, but the
> origin of the disc image (it was ghosted) is lost in obscurity.

Interesting. Ghost created the boot sector (assuming you ghosted a "by
file" image rather than an "by clusters" image) which means that either
you have an old copy of ghost or ghost is just being very strange. It is
valid ntfs just a little odd.

> If you do enhance ntfsresize, please can I have a copy!

I will leave that one to Szaka...

Cheers,
	Anton

RE: [Linux-NTFS-Dev] Extra cluster half-way along NT flelsystem

[Szakacsits S. <sz...@si...>]

On Sat, 12 Jul 2003, Anton Altaparmakov wrote:
> On Fri, 11 Jul 2003, Bird, Barry wrote:
>
> > If you do enhance ntfsresize, please can I have a copy!
>
> I will leave that one to Szaka...

BTW, Barry confirmed on Tuesday, the enhanced version worked for him,
thanks again! So I'll send the patch as I have the time to merge with the
latest ntfsprogs-devel.

Anton, did you get one of my other patches from last Friday, subject was
"[PATCH] ntfsresize bad sector check" (it moves the check to a better
place). If not, I can't see it being applied, then I'll resend that one
also.

	Szaka

RE: [Linux-NTFS-Dev] Extra cluster half-way along NT flelsystem

[Anton A. <ai...@ca...>]

On Sun, 20 Jul 2003, Szakacsits Szabolcs wrote:
> On Sat, 12 Jul 2003, Anton Altaparmakov wrote:
> > On Fri, 11 Jul 2003, Bird, Barry wrote:
> >
> > > If you do enhance ntfsresize, please can I have a copy!
> >
> > I will leave that one to Szaka...
>
> BTW, Barry confirmed on Tuesday, the enhanced version worked for him,
> thanks again! So I'll send the patch as I have the time to merge with the
> latest ntfsprogs-devel.

Great!

> Anton, did you get one of my other patches from last Friday, subject was
> "[PATCH] ntfsresize bad sector check" (it moves the check to a better
> place). If not, I can't see it being applied, then I'll resend that one
> also.

Er, not sure to be honest. It may well be somewhere in my inbox that is
currently at 809 messages (after deleting spam and stuff I don't care
about)...

You can assume that anything sent after last Wednesday is either lost or
berried in my inbox so if you could resend that would be great, otherwise
it may take some time for me to get to finding it again and doing
something with it...

Cheers,

	Anton
-- 
Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @)
Unix Support, Computing Service, University of Cambridge, CB2 3QH, UK
Linux NTFS maintainer / IRC: #ntfs on irc.freenode.net
WWW: http://linux-ntfs.sf.net/ & http://www-stu.christs.cam.ac.uk/~aia21/

RE: [Linux-NTFS-Dev] Extra cluster half-way along NT flelsystem

[Szakacsits S. <sz...@si...>]

On Fri, 11 Jul 2003, Bird, Barry wrote:

> Thanks for taking an interest in this problem.

You're welcome :)

> Totally 1 cluster accounting mismatches
> ----
> Yes, it's always the same cluster number, and only one.

Just to be sure, did you run chkdsk between these tries?

> If you care to send me a special program that can extract slices
> of this filesystem for inspection, I'd be happy to run it and send
> you the results.

I recently finished 'ntfsclone'. This can be used to

  1) make a full backup to a sparse file, another partiton or standard
     output, e.g. for full backup through network (basically it's like
     'dd' however it can be _much_ faster because it understands NTFS).

  2) save only the important NTFS structures. This can be very
     useful for developers for debugging, etc.

However it doesn't support inconsistent NTFS, if you think I could add this
feature, I'd be interested in 2).

If you do have backup then another, additional way could be I add optional
support for inconsistent NTFS to the development version of ntfsresize. I
don't think it would cause problems [of course you won't be able to resize
below to stalled/lost cluster], still I'm quite unwilling to do it because
people would use it instead of doing chkdsk (and that always fixed the NTFS
inconsistencies ... so far).

> PS I got hold of your ntfsmeta program

BTW, if you have 'fsutil' on your Windows (should be default or in the
Resource Kit), could you do a

	fsutil fsinfo ntfsinfo C:

> and ran it to get the 'boot record', if that helps (the small number of
> unused sectors seems at variance with the report in Windows that more
> than 91% of the disc is unused 8388736/39085137 = 21.5% unused! - I
> suppose I just don't know how to interpret this):

"Unused" below means the field is "unused", not "unused sectors".
"Reserved or "unknown" would have been a better naming. Well, actually
it's used, because it's value is usually 8388736 or 128 if NTFS is on
an USB device.

> Unused              :  8388736
> Number of sectors   :  39085137

Cheers,

	Szaka