|
From: SourceForge.net <no...@so...> - 2004-11-05 20:33:40
|
Read and respond to this message at: https://sourceforge.net/forum/message.php?msg_id=2839452 By: nobody Hello, I am working on my own ntfs reading code. I have run across something that I think is very strange and was wondering if anyone working on the ntfs linux code has seen anything like it. This is a real mft record from one of my disks - its a tiff image(in case you were wondering). The image reads fine and checkdisk reports 0 errors. I have also used /f. The volume was created using XP Home SP1. The issue with this record is the LastVCN of the unnamed data attribute. It only makes sense if you do not look at it using the full 8 bytes of a signed number. If you only look at 32 bits worth - it looks ok. Heres a debug dump of the data: ////////////////////////////////////////////////////////////////////// MFT Record: 124 ////////////////////////////////////////////////////////////////////// MagicNumber: 0x454c4946 UpdateSequnceOffset: 0x30 UpdateSequnceSize: 0x03 LogFileSequenceNumber: 0x0b490420 SequenceNumber: 0x4902 HardLinkCount: 0x02 AttributeOffset: 0x38 Flags: 0x01 RealSize: 0x0230 AllocSize: 0x00400 BaseRecord: 0x00000000 NextAttributeID: 0x06 ////////////////////////////////////////////////////////////////////// Unnammed Attribute ////////////////////////////////////////////////////////////////////// Type: 0x0010 RecordSIB: 0x60 NonResidentFlag: 0x0 NameLength: 0x0 NameOffset: 0x00 Flags: 0x00 AttributeID: 0x00 Length: 0x0048 Offset: 0x18 IndexedFlag: 0x0 Padding: 0x0 ////////////////////////////////////////////////////////////////////// Unnammed Attribute ////////////////////////////////////////////////////////////////////// Type: 0x0030 RecordSIB: 0x78 NonResidentFlag: 0x0 NameLength: 0x0 NameOffset: 0x00 Flags: 0x00 AttributeID: 0x03 Length: 0x005a Offset: 0x18 IndexedFlag: 0x1 Padding: 0x0 ////////////////////////////////////////////////////////////////////// Unnammed Attribute ////////////////////////////////////////////////////////////////////// Type: 0x0030 RecordSIB: 0xa8 NonResidentFlag: 0x0 NameLength: 0x0 NameOffset: 0x00 Flags: 0x00 AttributeID: 0x02 Length: 0x0090 Offset: 0x18 IndexedFlag: 0x1 Padding: 0x0 ////////////////////////////////////////////////////////////////////// Unnammed Attribute ////////////////////////////////////////////////////////////////////// Type: 0x0040 RecordSIB: 0x28 NonResidentFlag: 0x0 NameLength: 0x0 NameOffset: 0x00 Flags: 0x00 AttributeID: 0x05 Length: 0x0010 Offset: 0x18 IndexedFlag: 0x0 Padding: 0x0 ////////////////////////////////////////////////////////////////////// Unnammed Attribute ////////////////////////////////////////////////////////////////////// Type: 0x0080 RecordSIB: 0x48 NonResidentFlag: 0x1 NameLength: 0x0 NameOffset: 0x00 Flags: 0x00 AttributeID: 0x04 StartVCN: 0x00000000 LastVCN: 0x11000000000129 DataRunOffset: 0x40 CompressionUnit: 0x0 AllocatedSize: 0x0012a000 RealSize: 0x00129cd8 InitializedSize: 0x00129cd8 RunlistData: 0x32 0x2A 0x01 0x6E 0x0E 0x0D 0x00 ______________________________________________________________________ You are receiving this email because you elected to monitor this forum. To stop monitoring this forum, login to SourceForge.net and visit: https://sourceforge.net/forum/unmonitor.php?forum_id=44084 |
