Re: [Linux-NTFS-Dev] attribute $UNKNOWN (0x110) from mft record
Development moved to https://sourceforge.net/projects/ntfs-3g/
Brought to you by:
antona,
cha0smaster
From: Anton A. <ai...@ca...> - 2011-06-06 00:06:48
|
Hi, Thanks a lot for your report! On 5 Jun 2011, at 11:19, Grant W wrote: > I am doing my civic duty as a user, reporting malfunctions to the > developers, as requested. The attribute type 0x110 was pointing to > critical data. Where did this attribute come from? It is not listed in the volume's $AttrDef system file thus it is not valid for this volume! > The faulty implementation of NTFS was unable to read a > valid sector pointer for non-resident data. Thus, linux-ntfs was > unable to understand a simple operation, and failed, causing a loss of > many man-hours. I am not sure what you are talking about. First of all which Linux NTFS implementation are you talking about? And second, if you are talking about ntfsprogs or ntfs-3g then neither is faulty and there are no problems with reading valide sector pointers for non-resident data. What however is a problem is that this file has an invalid attribute. > Please add 0x110 as a alternate data stream, as > specified in the standard. What standard are you referring to? NTFS is not documented and there certainly is no standard for it that I know of. > Attached... a well compressed ntfs disk image. Thanks, that is interesting! This file (/dir60/key50883) was created on 17th May. What did you use to create it? Did you create the 0x110 attribute by hand? What software did you use to create it or if you didn't create it then please give details of Windows version used and any special software you are running and in particular if any particular software owns this file. Thanks a lot in advance! Best regards, Anton > --------------------------------------------------------------- > Dumping Inode 13446 (0x3486) > Upd. Seq. Array Off.: 48 (0x30) > Upd. Seq. Array Count: 3 (0x3) > Upd. Seq. Number: 8 (0x8) > LogFile Seq. Number: 0x0 > MFT Record Seq. Numb.: 1 (0x1) > Number of Hard Links: 1 (0x1) > Attribute Offset: 56 (0x38) > MFT Record Flags: IN_USE > Bytes Used: 512 (0x200) bytes > Bytes Allocated: 1024 (0x400) bytes > Next Attribute Instance: 5 (0x5) > MFT Padding: 00 00 > Dumping attribute $STANDARD_INFORMATION (0x10) from mft record 13446 (0x3486) > Resident: Yes > Attribute flags: 0x0000 > Attribute instance: 0 (0x0) > Data size: 48 (0x30) > Resident flags: 0x00 > File Creation Time: Tue May 17 08:55:49 2011 > File Altered Time: Tue May 17 08:55:49 2011 > MFT Changed Time: Tue May 17 08:55:49 2011 > Last Accessed Time: Sat Jun 4 23:48:17 2011 > File attributes: ARCHIVE (0x00000000) > Dumping attribute $FILE_NAME (0x30) from mft record 13446 (0x3486) > Resident: Yes > Attribute flags: 0x0000 > Attribute instance: 3 (0x3) > Data size: 82 (0x52) > Resident flags: 0x01 > Parent directory: 124 (0x7c) > File Creation Time: Tue May 17 08:55:49 2011 > File Altered Time: Tue May 17 08:55:49 2011 > MFT Changed Time: Tue May 17 08:55:49 2011 > Last Accessed Time: Tue May 17 08:55:49 2011 > Allocated Size: 0 (0x0) > Data Size: 0 (0x0) > Filename Length: 8 (0x8) > File attributes: ARCHIVE (0x00000000) > Namespace: POSIX > Filename: 'key50883' > Dumping attribute $SECURITY_DESCRIPTOR (0x50) from mft record 13446 (0x3486) > Resident: Yes > Attribute flags: 0x0000 > Attribute instance: 1 (0x1) > Data size: 80 (0x50) > Resident flags: 0x00 > Revision: 1 > Control: 0x8004 > Owner SID: S-1-5-32-544 > Group SID: S-1-5-32-544 > System ACL: missing > Discretionary ACL: > Revision 2 > ACE: type:allow flags:0x3 access:0x1f01ff > SID: S-1-1-0 > Dumping attribute $DATA (0x80) from mft record 13446 (0x3486) > Resident: No > Attribute flags: 0x0000 > Attribute instance: 2 (0x2) > Compression unit: 0 (0x0) > Data size: 1024 (0x400) > Allocated size: 1024 (0x400) > Initialized size: 1024 (0x400) > Dumping attribute $UNKNOWN (0x110) from mft record 13446 (0x3486) > Resident: No > Attribute flags: 0x0000 > Attribute instance: 4 (0x4) > Compression unit: 0 (0x0) > Data size: 1024 (0x400) > Allocated size: 1024 (0x400) > Initialized size: 1024 (0x400) > ===== Please report this unknown attribute type to > lin...@li... ===== > End of inode reached > <f200_a3c6a7f6a4b4f9511ee83>------------------------------------------------------------------------------ > Simplify data backup and recovery for your virtual environment with vRanger. > Installation's a snap, and flexible recovery options mean your data is safe, > secure and there when you need it. Discover what all the cheering's about. > Get your free trial download today. > http://p.sf.net/sfu/quest-dev2dev2 _______________________________________________ > Linux-NTFS-Dev mailing list > Lin...@li... > https://lists.sourceforge.net/lists/listinfo/linux-ntfs-dev Best regards, Anton -- Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @) Unix Support, Computing Service, University of Cambridge, CB2 3QH, UK Linux NTFS maintainer, http://www.linux-ntfs.org/ |