|
From: Phil R. <pru...@gm...> - 2008-05-21 07:23:37
|
Apparently I can't see threes. Here it is: Dumping Inode 3 (0x3) Upd. Seq. Array Off.: 42 (0x2a) Upd. Seq. Array Count: 3 (0x3) Upd. Seq. Number: 2982 (0xba6) LogFile Seq. Number: 0x8000872 MFT Record Seq. Numb.: 3 (0x3) Number of Hard Links: 1 (0x1) Attribute Offset: 48 (0x30) MFT Record Flags: IN_USE Bytes Used: 496 (0x1f0) bytes Bytes Allocated: 1024 (0x400) bytes Next Attribute Instance: 8 (0x8) MFT Padding: Dumping attribute $STANDARD_INFORMATION (0x10) from mft record 3 (0x3) Attribute length: 72 (0x48) Resident: Yes Name length: 0 (0x0) Name offset: 24 (0x18) Attribute flags: 0x0000 Attribute instance: 0 (0x0) Data size: 48 (0x30) Data offset: 24 (0x18) Resident flags: 0x00 ReservedR: 0 (0x0) File Creation Time: Sat Oct 19 22:50:53 2002 File Altered Time: Sat Oct 19 22:50:53 2002 MFT Changed Time: Sat Oct 19 22:50:53 2002 Last Accessed Time: Sat Oct 19 22:50:53 2002 File attributes: HIDDEN SYSTEM (0x00000000) Dumping attribute $FILE_NAME (0x30) from mft record 3 (0x3) Attribute length: 104 (0x68) Resident: Yes Name length: 0 (0x0) Name offset: 24 (0x18) Attribute flags: 0x0000 Attribute instance: 1 (0x1) Data size: 80 (0x50) Data offset: 24 (0x18) Resident flags: 0x01 ReservedR: 0 (0x0) Parent directory: 5 (0x5) File Creation Time: Sat Oct 19 22:50:53 2002 File Altered Time: Sat Oct 19 22:50:53 2002 MFT Changed Time: Sat Oct 19 22:50:53 2002 Last Accessed Time: Sat Oct 19 22:50:53 2002 Allocated Size: 0 (0x0) Data Size: 0 (0x0) Filename Length: 7 (0x7) File attributes: HIDDEN SYSTEM (0x00000000) Namespace: Win32 & DOS Filename: '$Volume' Dumping attribute $OBJECT_ID (0x40) from mft record 3 (0x3) Attribute length: 40 (0x28) Resident: Yes Name length: 0 (0x0) Name offset: 0 (0x0) Attribute flags: 0x0000 Attribute instance: 7 (0x7) Data size: 16 (0x10) Data offset: 24 (0x18) Resident flags: 0x00 ReservedR: 0 (0x0) Object ID: 460d63a0-c774-9046-805e-7674981ac82f Birth Volume ID: missing Birth Object ID: missing Domain ID: missing Dumping attribute $SECURITY_DESCRIPTOR (0x50) from mft record 3 (0x3) Attribute length: 128 (0x80) Resident: Yes Name length: 0 (0x0) Name offset: 24 (0x18) Attribute flags: 0x0000 Attribute instance: 2 (0x2) Data size: 104 (0x68) Data offset: 24 (0x18) Resident flags: 0x00 ReservedR: 0 (0x0) Revision: 1 Control: 0x8004 Owner SID: S-1-5-32-544 Group SID: S-1-5-32-544 System ACL: missing Discretionary ACL: Revision 2 ACE: type:allow flags:0x0 access:0x12019f SID: S-1-5-18 ACE: type:allow flags:0x0 access:0x12019f SID: S-1-5-32-544 Dumping attribute $VOLUME_NAME (0x60) from mft record 3 (0x3) Attribute length: 32 (0x20) Resident: Yes Name length: 0 (0x0) Name offset: 24 (0x18) Attribute flags: 0x0000 Attribute instance: 3 (0x3) Data size: 8 (0x8) Data offset: 24 (0x18) Resident flags: 0x00 ReservedR: 0 (0x0) Volume Name: 'Data' Dumping attribute $VOLUME_INFORMATION (0x70) from mft record 3 (0x3) Attribute length: 40 (0x28) Resident: Yes Name length: 0 (0x0) Name offset: 24 (0x18) Attribute flags: 0x0000 Attribute instance: 4 (0x4) Data size: 12 (0xc) Data offset: 24 (0x18) Resident flags: 0x00 ReservedR: 0 (0x0) Volume Version: 3.1 Volume Flags: none set (0x0000) Dumping attribute $DATA (0x80) from mft record 3 (0x3) Attribute length: 24 (0x18) Resident: Yes Name length: 0 (0x0) Name offset: 24 (0x18) Attribute flags: 0x0000 Attribute instance: 5 (0x5) Data size: 0 (0x0) Data offset: 24 (0x18) Resident flags: 0x00 ReservedR: 0 (0x0) End of inode reached On Mon, May 19, 2008 at 12:35 AM, Anton Altaparmakov <ai...@ca...> wrote: > > Hi, > > On 17 May 2008, at 22:31, Phil Ruggera wrote: >> >> It was asking for an inode. So I used 0. Let me know if you want >> anything else. > > Please look at my email again (included below for your convenience). You didn't type the command properly (hint: it already specifies an inode number "3"). Please try again... > > Best regards, > > Anton > >> On Fri, May 16, 2008 at 5:51 AM, Anton Altaparmakov <ai...@ca...> wrote: >>> >>> Hi, >>> >>> Can you please send the output of the following command run on this volume. >>> >>> ntfsinfo -fvi 3 /dev/sda10 >>> >>> Thanks! >>> >>> Best regards, >>> >>> Anton > > -- > Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @) > Unix Support, Computing Service, University of Cambridge, CB2 3QH, UK > Linux NTFS maintainer, http://www.linux-ntfs.org/ > |
