|
From: Richard R. <ri...@fl...> - 2002-03-26 15:51:54
|
Hi Peter, > I want to get the volume or partition label of a ntfs volume. > Is there a easy way to get this label from a mounted and/or a unmouted > device? No > With dd or so. I can't find the label. Definitely not. All the data describing the volume (the metadata) is stored in files. To find the volume label you need to find and decode the file: $Volume. First have a look at the file $Boot [1], this is located at the very beginning of the partition. This tells us the size of the clusters, how many clusters per MFT record and where the MFT is written. The MFT stores information about itself, the other metadata and all the files and directories. The layout is shown here [2]. We need the 4th record, for $Volume. Fortunately, it is *extremely* unlikely for this part of the MFT to be fragmented. Now we know the size and location of the MFT record, we need to find the attribute which describes the volume label. The MFT record consists of a header [3] and a list of attributes [4]. Before we can read the attributes we have to remove the fixup [5] (a form of integrity check). Iterate through the attributes until we find 0x60 $VOLUME_NAME [6], whose length is shown in the attribute header [7]. [1] http://linux-ntfs.sf.net/ntfs/files/boot.html [2] http://linux-ntfs.sf.net/ntfs/files/index.html [3] http://linux-ntfs.sf.net/ntfs/concepts/file_record.html [4] http://linux-ntfs.sf.net/ntfs/files/volume.html [5] http://linux-ntfs.sf.net/ntfs/concepts/fixup.html [6] http://linux-ntfs.sf.net/ntfs/attributes/volume_name.html [7] http://linux-ntfs.sf.net/ntfs/concepts/attribute_header.html This is why I didn't write a patch for fdisk. Hope this helps, FlatCap (Rich) nt...@fl... |
