|
From: Anton A. <an...@us...> - 2001-01-27 14:22:15
|
Changes by: antona
Update of /cvsroot/linux-ntfs/linux-ntfs/ntfstools
In directory usw-pr-cvs1:/tmp/cvs-serv9476/ntfstools
Modified Files:
ntfsfix.c
Added Files:
ntfsdump_logfile.c
Log Message:
Added a logfile dumper as a new utility.
Almost finished the first ntfsfix release. (Still missingin CVS are attrib.c
for ntfslib and the makefiles to build everything.)
Fixes for nested packed structure/union typedefs as gcc doesn't automatically
nest the __attribute__ ((__packed__)), even though according to the gcc info
page it does. (Thanks to Yuri Per <yu...@ac...> for pointing this out.)
--- NEW FILE ---
const char *EXEC_NAME = "NtfsDump_LogFile";
const char *EXEC_VERSION = "0.0.1";
/*
* NtfsDump_LogFile - Part of the Linux-NTFS project.
*
* Copyright (c) 2000,2001 Anton Altaparmakov.
*
* This utility will interpret the contents of the journal ($LogFile) of an
* NTFS partition and display the results on stdout. Errors will be output to
* stderr.
*
* Anton Altaparmakov <ai...@ca...>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program (in the main directory of the Linux-NTFS source
* in the file COPYING); if not, write to the Free Software Foundation,
* Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
*/
/*
* WARNING: This program might not work on architectures which do not allow
* unaligned access. For those, the program would need to start using
* get/put_unaligned macros (#include <asm/unaligned.h>), but not doing it yet,
* since NTFS really mostly applies to ia32 only, which does allow unaligned
* accesses. We might not actually have a problem though, since the structs are
* defined as being packed so that might be enough for gcc to insert the
* correct code.
*
* If anyone using a non-little endian and/or an aligned access only CPU tries
* this program please let me know whether it works or not!
*
* Anton Altaparmakov <ai...@ca...>
*/
#include <unistd.h>
#include <stdlib.h>
#include <stdio.h>
#include <linux/types.h>
#include <fcntl.h>
#include <errno.h>
#include <string.h>
#include "attrib.h"
#include "endians.h"
#include "mft.h"
#include "disk_io.h"
#include "volume.h"
#include "logfile.h"
int main(int argc, char **argv)
{
unsigned char *b1 = NULL;
NONRESIDENT_ATTRIBUTE_RECORD_HEADER *a;
__u64 l;
unsigned char *lfd;
ntfs_volume *vol = NULL;
RESTART_PAGE_HEADER *rph;
RESTART_AREA *rr;
RESTART_CLIENT *cr;
int pass = 1;
int i, lps;
printf("\n");
if (argc != 2) {
printf("%s v%s - Interpret and display information\nabout the "
"journal ($LogFile) of an NTFS volume.\n\n"
/* Generic copyright / disclaimer. */
"Copyright (c) 2000, 2001 Anton Altaparmakov.\n"
"%s is free software, released under the GNU "
"General Public License and you\nare welcome to "
"redistribute it under certain conditions.\n"
"%s comes with ABSOLUTELY NO WARRANTY; for details"
"read the file GNU\nGeneral Public License to be found "
"in the file COPYING in the main Linux-NTFS\n"
"distribution directory.\n\n"
/* Generic part ends here. */
"Syntax: ntfsdump_logfile partition_or_file_name\n"
" e.g. ntfsdump_logfile /dev/hda6\n\n",
EXEC_NAME, EXEC_VERSION, EXEC_NAME, EXEC_NAME);
fprintf(stderr, "Error: incorrect syntax\n");
exit(1);
}
vol = ntfs_open(argv[1]);
if (!vol) {
perror("ntfs_open() failed");
exit(1);
}
b1 = (__u8 *)malloc(vol->mft_record_size);
if (!b1) {
perror("Error allocating internal buffers");
goto error_exit;
}
/* Read $MFT and $MFTmirr. */
if (get_mft_records(vol, b1, 2, 1) != 1) {
fprintf(stderr, "Error reading mft record for $LogFile.\n");
goto error_exit;
}
/* Check the $LogFile mft record. */
if (is_baad_record(b1)) {
puts(FAILED);
fprintf(stderr, "Error: Incomplete multi sector "
"transfer detected in $LogFile.\nCannot "
"handle this yet. )-:\n");
goto error_exit;
}
if (!is_mft_recordp(b1)) {
puts(FAILED);
fprintf(stderr, "Error: Invalid mft record for $LogFile.\n"
"Cannot handle this yet. )-:\n");
goto error_exit;
}
/* Check NTFS version is ok for us. */
printf("\nNTFS volume version is %i.%i.\n", vol->major_ver,
vol->minor_ver);
switch (vol->major_ver) {
case 1:
if (vol->minor_ver == 1 || vol->minor_ver == 2)
break;
else
goto version_error;
case 2: case 3:
if (vol->minor_ver == 0)
break;
/* Fall through on error. */
default:
version_error:
fprintf(stderr, "Error: Unknown NTFS version.\n");
goto error_exit;
}
/* Find the $DATA attribute of the $LogFile. */
a = (NONRESIDENT_ATTRIBUTE_RECORD_HEADER*)
find_attribute((MFT_RECORD_HEADER*)b1, $DATA, NULL);
if (!a) {
puts(FAILED);
fprintf(stderr, "Error: Attribute $DATA was not found in" \
"$LogFile!\n");
goto log_file_error;
}
/* Get length of $LogFile contents. */
l = get_attribute_value_length((ATTRIBUTE_RECORD_HEADER*)a);
if (!l) {
puts(OK);
puts("$LogFile has zero length, no need to write to disk.");
goto log_file_error;
}
/* Allocate a buffer to hold all of the $LogFile contents. */
lfd = (unsigned char*)malloc(l);
if (!lfd) {
puts(FAILED);
puts("Not enough memory to load $LogFile.");
goto log_file_error;
}
/* Read in the $LogFile into the buffer. */
if (l != get_attribute_value(vol, (ATTRIBUTE_RECORD_HEADER*)a, lfd)) {
puts(FAILED);
puts("Amount of data read does not correspond to expected "
"length!");
free(lfd);
goto log_file_error;
}
/* Check restart area. */
if (!is_rstr_recordp(lfd)) {
puts(FAILED);
puts("$LogFile contents are corrupt (magic RSTR missing)!");
free(lfd);
goto log_file_error;
}
/* Do the interpretation and display now. */
rph = (RESTART_PAGE_HEADER*)lfd;
lps = le32_to_cpu(rph->LogPageSize);
pass_loc:
if (!post_read_mst_fixup((NTFS_RECORD_HEADER*)rph, lps) ||
is_baad_recordp(rph)) {
puts(FAILED);
puts("$LogFile incomplete multi sector transfer detected! "
"Cannot handle this yet!");
free(lfd);
goto log_file_error;
}
if (le16_to_cpu(rph->major_version != 1) ||
le16_to_cpu(rph->minor_version != 1)) {
puts(FAILED);
fprintf(stderr, "$LogFile version %i.%i! Error: Unknown "
"$LogFilee version!\n",
le16_to_cpu(rph->major_ver),
le16_to_cpu(rph->minor_ver));
free(lfd);
goto log_file_error;
}
rr = (RESTART_AREA*)((char*)rph + le16_to_cpu(rph->restart_offset));
cr = (RESTART_CLIENT*)((char*)rr + sizeof(RESTART_AREA));
/* Dump of the interpreted $LogFile restart area. */
if (pass == 1)
printf("\n$LogFile version %i.%i.\n",
le16_to_cpu(rph->major_ver),
le16_to_cpu(rph->minor_ver));
printf("%s restart area:\n", pass == 1? "1st": "2nd");
printf("magic = RSTR\n");
printf("Lsn = 0x%Lx\n", sle64_to_cpu(rph->chkdsk_lsn));
printf("SystempageSize = %u\n", le32_to_cpu(rph->system_page_size));
printf("LogPageSize = %u\n", le32_to_cpu(rph->log_page_size));
printf("RestartOffset = 0x%x\n", le16_to_cpu(rph->restart_offset));
printf("\n(1st) restart record:\n");
printf("CurrentLsn = %Lx\n", sle64_to_cpu(rr->current_lsn));
printf("LogClients = %u\n", le16_to_cpu(rr->log_clients));
printf("ClientFreeList = %u\n", le16_to_cpu(rr->client_free_list));
printf("ClientInUseList = %u\n", le16_to_cpu(rr->client_in_use_list));
printf("Flags = 0x%x\n", le16_to_cpu(rr->flags));
printf("SeqNumberBits = %u\n", le32_to_cpu(rr->seq_number_bits));
printf("RestartAreaLength = 0x%x\n",
le16_to_cpu(rr->restart_area_length));
printf("ClientArrayOffset = 0x%x\n",
le16_to_cpu(rr->client_array_offset));
printf("FileSize = %Lu\n", le64_to_cpu(rr->file_size));
if (le64_to_cpu(rr->file_size) != l)
puts("$LogFile restart area indicates a log file size"
"different from the actual size!");
printf("LastLsnDataLength = 0x%x\n",
le32_to_cpu(rr->last_lsn_data_length));
printf("RecordLength = 0x%x\n", le16_to_cpu(rr->record_length));
printf("LogPageDataOffset = 0x%x\n",
le16_to_cpu(rr->log_page_data_offset));
printf("\n1st Client record:\n");
printf("OldestLsn = 0x%Lx\n", sle64_to_cpu(cr->oldest_lsn));
printf("ClientRestartLsn = 0x%Lx\n",
sle64_to_cpu(cr->client_restart_lsn));
printf("PrevClient = 0x%x\n", le16_to_cpu(cr->prev_client));
printf("NextClient = 0x%x\n", le16_to_cpu(cr->next_client));
printf("SeqNumber = 0x%x\n", le16_to_cpu(cr->seq_number));
printf("ClientName = %u\n", le16_to_cpu(cr->client_name));
printf("\nTerminator = 0x%x\n", *(__u32*)((char*)cr +
sizeof(RESTART_CLIENT)));
if (*(__u32*)((char*)cr + sizeof(RESTART_CLIENT)) != 0xffffffff)
puts("$LogFile restart area is not terminated!");
printf("Unicode string \"NTFS\"%spresent\n", *(__u64*)((char*)cr +
sizeof(RESTART_CLIENT) + 0x10) ==
cpu_to_le64(0x005300460054004e) ? " ": " not ");
rph = (RESTART_PAGE_HEADER*)((char*)rph + lps);
if (pass == 1) {
++pass;
goto pass_loc;
}
if (!is_rcrd_recordp(rph))
puts("$LogFile's first record area magic RCRD is missing!");
}
puts("That's all for now. Dumping of the actual log contents is not "
"implemented yet.");
/* Release the allocated buffer. */
free(lfd);
log_file_error:
printf("\n");
/* Set return code to 0. */
i = 0;
final_exit:
if (b1)
free(b1);
if (vol)
ntfs_close(vol);
return i;
error_exit:
i = 1;
goto final_exit;
}
Index: ntfsfix.c
===================================================================
RCS file: /cvsroot/linux-ntfs/linux-ntfs/ntfstools/ntfsfix.c,v
retrieving revision 1.1
retrieving revision 1.2
diff -C2 -r1.1 -r1.2
*** ntfsfix.c 2001/01/24 21:02:37 1.1
--- ntfsfix.c 2001/01/27 14:22:02 1.2
***************
*** 321,336 ****
puts(OK);
printf("\n");
!
! /* Zero the value of the $LogFile data attribute (ie. the contents of
! * the file) thus erasing the journal.
* FIXME(?): We might need to zero the LSN field of every single $Mft
* record as well. (But, first try without doing that and see what
* happens, since chkdsk might pickup the pieces and do it for us...)
! * FIXME: This results in winNT/2k saying the partition is corrupt and
! * tells us to run chkdsk but when it is the boot drive it doesn't
! * boot up so can't run chkdsk!!!
! *
! * Try to clear the $LogFile by modifying the restart areas... */
! printf("Going to fixup the journal ($LogFile)... ");
/* Find the $DATA attribute. */
a = (NONRESIDENT_ATTRIBUTE_RECORD_HEADER*)
--- 321,332 ----
puts(OK);
printf("\n");
! /*
! * Fill the value of the $LogFile data attribute (ie. the contents of
! * the file) with 0xff's, thus marking the journal as empty.
* FIXME(?): We might need to zero the LSN field of every single $Mft
* record as well. (But, first try without doing that and see what
* happens, since chkdsk might pickup the pieces and do it for us...)
! */
! printf("Going to empty the journal ($LogFile)... ");
/* Find the $DATA attribute. */
a = (NONRESIDENT_ATTRIBUTE_RECORD_HEADER*)
***************
*** 342,345 ****
--- 338,347 ----
goto log_file_error;
}
+ /* The $DATA attribute of the $LogFile has to be non-resident. */
+ if (!a->non_resident) {
+ puts(FAILED);
+ fprintf(stderr, "$LogFile $DATA attribute is resident!?!\n");
+ goto log_file_error;
+ }
/* Get length of $LogFile contents. */
l = get_attribute_value_length((ATTRIBUTE_RECORD_HEADER*)a);
***************
*** 356,360 ****
goto log_file_error;
}
! /* Read in the $LogFile into the buffer. */
if (l != get_attribute_value(vol, (ATTRIBUTE_RECORD_HEADER*)a, lfd)) {
puts(FAILED);
--- 358,365 ----
goto log_file_error;
}
! /* Read in the $LogFile into the buffer. We do this more as a check
! for correct length than anything else. We thus make sure we are
! decompressing the mapping pairs array correctly and hence writing
! below if safe as well. */
if (l != get_attribute_value(vol, (ATTRIBUTE_RECORD_HEADER*)a, lfd)) {
puts(FAILED);
***************
*** 363,492 ****
free(lfd);
goto log_file_error;
- }
- /* Check and then modify restart area. */
- if (!is_rstr_recordp(lfd)) {
- puts(FAILED);
- puts("$LogFile contents are corrupt (magic RSTR missing)!");
- free(lfd);
- goto log_file_error;
- }
- { RESTART_PAGE_HEADER *rph;
- RESTART_AREA *rr;
- RESTART_CLIENT *cr;
- int pass = 1;
- int lps;
-
- rph = (RESTART_PAGE_HEADER*)lfd;
- lps = le32_to_cpu(rph->LogPageSize);
- pass_loc:
- if (!post_read_mst_fixup((NTFS_RECORD_HEADER*)rph, lps) ||
- is_baad_recordp(rph)) {
- puts(FAILED);
- puts("$LogFile incomplete multi sector transfer detected! "
- "Cannot handle this yet!");
- free(lfd);
- goto log_file_error;
- }
- if (le16_to_cpu(rph->major_version != 1) ||
- le16_to_cpu(rph->minor_version != 1)) {
- puts(FAILED);
- printf("$LogFile version %i.%i! Cannot handle this yet!\n",
- le16_to_cpu(rph->major_ver),
- le16_to_cpu(rph->minor_ver));
- free(lfd);
- goto log_file_error;
}
! rr = (RESTART_AREA*)((char*)rph + le16_to_cpu(rph->restart_offset));
! cr = (RESTART_CLIENT*)((char*)rr + sizeof(RESTART_AREA));
! #ifdef DEBUG
! /* Do a dump of the $LogFile restart area. */
! if (pass == 1)
! printf("\n$LogFile version %i.%i.\n",
! le16_to_cpu(rph->major_ver),
! le16_to_cpu(rph->minor_ver));
! printf("%s restart area:\n", pass == 1? "1st": "2nd");
! printf("magic = RSTR\n");
! printf("Lsn = 0x%Lx\n", sle64_to_cpu(rph->chkdsk_lsn));
! printf("SystempageSize = %u\n", le32_to_cpu(rph->system_page_size));
! printf("LogPageSize = %u\n", le32_to_cpu(rph->log_page_size));
! printf("RestartOffset = 0x%x\n", le16_to_cpu(rph->restart_offset));
! printf("\n(1st) restart record:\n");
! printf("CurrentLsn = %Lx\n", sle64_to_cpu(rr->current_lsn));
! printf("LogClients = %u\n", le16_to_cpu(rr->log_clients));
! printf("ClientFreeList = %u\n", le16_to_cpu(rr->client_free_list));
! printf("ClientInUseList = %u\n", le16_to_cpu(rr->client_in_use_list));
! printf("Flags = 0x%x\n", le16_to_cpu(rr->flags));
! printf("SeqNumberBits = %u\n", le32_to_cpu(rr->seq_number_bits));
! printf("RestartAreaLength = 0x%x\n",
! le16_to_cpu(rr->restart_area_length));
! printf("ClientArrayOffset = 0x%x\n",
! le16_to_cpu(rr->client_array_offset));
! printf("FileSize = %Lu\n", le64_to_cpu(rr->file_size));
! printf("LastLsnDataLength = 0x%x\n",
! le32_to_cpu(rr->last_lsn_data_length));
! printf("RecordLength = 0x%x\n", le16_to_cpu(rr->record_length));
! printf("LogPageDataOffset = 0x%x\n",
! le16_to_cpu(rr->log_page_data_offset));
! printf("\n1st Client record:\n");
! printf("OldestLsn = 0x%Lx\n", sle64_to_cpu(cr->oldest_lsn));
! printf("ClientRestartLsn = 0x%Lx\n",
! sle64_to_cpu(cr->client_restart_lsn));
! printf("PrevClient = 0x%x\n", le16_to_cpu(cr->prev_client));
! printf("NextClient = 0x%x\n", le16_to_cpu(cr->next_client));
! printf("SeqNumber = 0x%x\n", le16_to_cpu(cr->seq_number));
! printf("ClientName = %u\n", le16_to_cpu(cr->client_name));
! printf("\nTerminator = 0x%x\n", *(__u32*)((char*)cr +
! sizeof(RESTART_CLIENT)));
! printf("Unicode string \"NTFS\"%spresent\n", *(__u64*)((char*)cr +
! sizeof(RESTART_CLIENT) + 0x10) ==
! cpu_to_le64(0x005300460054004e) ? " ": " not ");
! #endif
! rr->log_clients = cpu_to_le16(1);
! rr->client_free_list = cpu_to_le16(0xffff);
! rr->client_in_use_list = cpu_to_le16(0);
! rr->flags = cpu_to_le16(0);
! if (le64_to_cpu(rr->file_size) != l) {
! puts(FAILED);
! puts("$LogFile restart area indicates a log file size"
! "different from the actual size!");
! free(lfd);
! goto log_file_error;
! }
! rr->last_lsn_data_length = cpu_to_le32(0);
! rr->current_lsn = cr->client_restart_lsn;
! cr->prev_client = cpu_to_le16(0);
! cr->next_client = cpu_to_le16(0);
! if (le16_to_cpu(cr->client_name) != 0) {
! puts(FAILED);
! puts("$LogFile restart area Client Name != 0.");
! free(lfd);
! goto log_file_error;
! }
! if (*(__u32*)((char*)cr + sizeof(RESTART_CLIENT)) !=
! 0xffffffff) {
! puts(FAILED);
! puts("$LogFile restart area not terminated!");
! free(lfd);
! goto log_file_error;
! }
! if (!pre_write_mst_fixup((NTFS_RECORD_HEADER*)rph, lps)) {
! puts(FAILED);
! puts("$LogFile restart area multi sector protection not "
! "completed!");
! free(lfd);
! goto log_file_error;
! }
! rph = (RESTART_PAGE_HEADER*)((char*)rph + lps);
! if (pass == 1) {
! ++pass;
! goto pass_loc;
! }
! if (!is_rcrd_recordp(rph)) {
! puts(FAILED);
! puts("$LogFile's first record area magic RCRD is missing!");
! free(lfd);
! goto log_file_error;
! }
! }
/* Set the $DATA attribute. */
/* FIXME: set_attribute_value needs to either:
--- 368,374 ----
free(lfd);
goto log_file_error;
}
! /* Fill the buffer with 0xff's. */
! memset(lfd, -1, l);
/* Set the $DATA attribute. */
/* FIXME: set_attribute_value needs to either:
***************
*** 499,504 ****
* For now, just assume that attribute length remains constant, since
* this is the case for the $LogFile zeroing out. */
-
- /* DON'T WRITE IT BACK YET!!!
if (!set_attribute_value(vol, (ATTRIBUTE_RECORD_HEADER*)a, lfd, l)) {
puts(FAILED);
--- 381,384 ----
***************
*** 507,531 ****
goto log_file_error;
}
! */
!
! /* Release the allocated buffer. */
free(lfd);
puts(OK);
- puts("$LogFile was left untouched as we don't know what to do with "
- "it yet!");
log_file_error:
-
printf("\n");
/* FIXME: If on NTFS 3.0+, check for presence of the usn journal and
disable it (if present) as Win2k might be unhappy otherwise and Bad
! Thing(TM) could happen depending on what applications are actually
using it for. */
/* FIXME: Should we be marking the quota out of date, too? */
/* That's all for now! */
-
printf("NTFS partition %s was processed successfully.\n",
vol->vol_name);
--- 387,409 ----
goto log_file_error;
}
! /* No need to sync the $LogFile mft record to disk as we haven't
! touched it at all. */
! /* Release the allocated buffer and finish $LogFile processing. */
free(lfd);
puts(OK);
log_file_error:
printf("\n");
+ if (vol->major_ver >= 3) {
/* FIXME: If on NTFS 3.0+, check for presence of the usn journal and
disable it (if present) as Win2k might be unhappy otherwise and Bad
! Things(TM) could happen depending on what applications are actually
using it for. */
+ }
/* FIXME: Should we be marking the quota out of date, too? */
/* That's all for now! */
printf("NTFS partition %s was processed successfully.\n",
vol->vol_name);
|
