|
From: Bird, B. <bar...@ed...> - 2003-07-11 16:19:50
|
OK, I ran dd if=/dev/hda of=cluster.out bs=512 skip=19542631 count=1 This is slightly different from what you had because the partition begins after 63 sectors on /dev/hda. I also found on my linux disc it did not have od available. So I transferred the floppy to Windows and used my binary block printing program to get this: C:\>mblock cluster.out 0 1 Block 0 byte 0 eb 52 90 4e 54 46 53 20 20 20 20 0 2 1 0 0 .R.NTFS ..... byte 16 0 0 0 0 0 f8 0 0 3f 0 f0 0 3f 0 0 0 ........?...?... byte 32 0 0 0 0 80 0 80 0 51 64 54 2 0 0 0 0 ........QdT..... byte 48 10 0 0 0 0 0 0 0 18 72 0 0 0 0 0 0 .........r...... byte 64 2 0 0 0 8 0 0 0 80 34 24 44 4d 24 44 94 .........4$DM$D. byte 80 0 0 0 0 fa 33 c0 8e d0 bc 0 7c fb b8 c0 7 .....3.....|.... byte 96 8e d8 e8 16 0 b8 0 d 8e c0 33 db c6 6 e 0 ..........3..... byte 112 10 e8 53 0 68 0 d 68 6a 2 cb 8a 16 24 0 b4 ..S.h..hj....$.. byte 128 8 cd 13 73 5 b9 ff ff 8a f1 66 f b6 c6 40 66 ...s......f...@f byte 144 f b6 d1 80 e2 3f f7 e2 86 cd c0 ed 6 41 66 f .....?.......Af. byte 160 b7 c9 66 f7 e1 66 a3 20 0 c3 b4 41 bb aa 55 8a ..f..f. ...A..U. byte 176 16 24 0 cd 13 72 f 81 fb 55 aa 75 9 f6 c1 1 .$...r...U.u.... byte 192 74 4 fe 6 14 0 c3 66 60 1e 6 66 a1 10 0 66 t......f`..f...f byte 208 3 6 1c 0 66 3b 6 20 0 f 82 3a 0 1e 66 6a ....f;. ...:..fj byte 224 0 66 50 6 53 66 68 10 0 1 0 80 3e 14 0 0 .fP.Sfh.....>... byte 240 f 85 c 0 e8 b3 ff 80 3e 14 0 0 f 84 61 0 ........>.....a. You are right that this is an old machine recently upgraded, but the origin of the disc image (it was ghosted) is lost in obscurity. If you do enhance ntfsresize, please can I have a copy! Best Wishes, Barry -----Original Message----- From: Szakacsits Szabolcs [mailto:sz...@si...] Sent: 11 July 2003 14:49 To: Anton Altaparmakov Cc: Bird, Barry; 'lin...@li...' Subject: RE: [Linux-NTFS-Dev] Extra cluster half-way along NT flelsystem On Fri, 11 Jul 2003, Anton Altaparmakov wrote: > I have an idea what it could be: the backup boot sector. This indeed sounds a very good idea! However Barry wrote it's a fresh W2K install. It has 512 bytes cluster sizes so probably it was upgraded from a FAT. Barry, could you please do this to see what data is at that location? dd if=device of=cluster.out bs=512 skip=19542568 count=1 If 'od -c cluster.out | head -1' gives something like this 0000000 353 R 220 N T F S \0 002 001 \0 \0 then it's the backup boot sector :) > Szaka I would suggest that you update ntfsresize to detect this case. You If this is the case, of course I'll support it. I'd be quite surprised because from the several 10 thousands users so far nobody met with this situation ... or at least didn't report it. Credit would go to Barry :) > Alternatively the volume has been grown to fill the disk with some strange > ntfsresizer when the machine was factory installed which is so old that it > creates an NT 3.51 NTFS boot sector... This sounds a good explanation also. Cheers, Szaka |
