|
From: Anton A. <ai...@ca...> - 2007-04-27 09:10:31
|
Or you may be forgetting about hard links? i.e. where there are multiple parents for the same mft record (it will have multiple file name attributes in it each pointing to a different parent). Other than that you must either be seeing corruption or are doing something wrong. If you show an example we can probably tell you which. (-: Best regards, Anton On 27 Apr 2007, at 10:05, Anton Altaparmakov wrote: > Hi, > > Are you forgetting about extent mft records? You said you are > reading the MFT sequentially so there will be mft records that > point back to their base mft record... > > Best regards, > > Anton > > On 27 Apr 2007, at 09:09, pawan rathi wrote: > >> Dear Anton, >> I have taken care of the fixups in my code both for the >> MFT record and the Index record. So, that is not the problem for >> sure. >> I thought the reason might be the inconsistency caused in >> the file-system because of improper shutdown or anything else. So >> i did "chkdsk" on the file system. But still couldn't figure out >> the problem. >> >> Pawan. >> >> Anton Altaparmakov <ai...@ca...> wrote: >> On 27 Apr 2007, at 06:28, pawan rathi wrote: >> >> > Hi All, >> > I am reading the MFT sequentially. In the FileName attribute of >> > each MFT record there is a field called ParentMftReference which >> > contains the MFTReference of it's parent. >> > for eg. if there is a file called 1.txt in Directory A and >> > MFTReference of A = 0x20 >> > then ParentMftReference of 1.txt = 0x20. >> > >> > Ideally it should happen as shown above. Even i am gettin the same >> > results maximum times. >> > >> > But, sometimes the ParentMftReference of a child doesn't match with >> > the MftReference of the Parent. >> > >> > If anyone has faced such issue before or if anyone knows how to >> > resolve it or if you can put some light into it, please revert >> back. >> > >> You probably forgot to remove the fixups from your MFT records and/or >> index records... >> >> See http://www.linux-ntfs.org/content/view/109/48#concept_fixup >> >> Best regards, >> >> Anton -- Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @) Unix Support, Computing Service, University of Cambridge, CB2 3QH, UK Linux NTFS maintainer, http://www.linux-ntfs.org/ |
