|
From: Szakacsits S. <sz...@si...> - 2002-07-09 14:46:42
|
On Tue, 9 Jul 2002, Anton Altaparmakov wrote:
> > for (inode = 0; inode < vol->nr_mft_records; inode++) {
> > mref = (MFT_REF)inode;
> >- if (ntfs_read_file_record(vol, mref, &mrec, NULL))
> >- perr_exit("ntfs_read_file_record");
> >+ if (ntfs_read_file_record(vol, mref, &mrec, NULL)) {
> >+ if (errno == EIO)
> >+ continue;
> >+ perr_exit("ntfs_read_file_record");
> >+ }
> > if (!(mrec->flags & MFT_RECORD_IN_USE))
> > continue;
>
> Are you sure about this one? I am not.
I'm sure it's temporary :) Sorry, I forgot the FIXME.
> Can you tell me what records you found other than file? I have
> seen CHKD (check disk), BAAD (corrupt mft record), and from the
> windows ntfs driver source I know that HOLE is a valid record but
> I haven't seen it in the wild yet and I was too lazy to figure out
> what it meant by reverse engineering it...
Unused (16-23) inodes on NTFS v3.0:
Inodes: 16,18,19 are like
0004000: 0100 0000 0000 0000 0000 0000 0000 0000 ................
0004010: 0000 0000 0000 0000 0000 0000 0000 0000 ................
*
00041f0: 0000 0000 0000 0000 0000 0000 0000 0100 ................
0004200: 0000 0000 0000 0000 0000 0000 0000 0000 ................
*
00043f0: 0000 0000 0000 0000 0000 0000 0000 0100 ................
Inode 17 is OK, FILE.
Inodes: 20-23 are like
0005400: 0000 0000 0000 0000 0000 0000 0000 0000 ................
*
00057f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
Or another case, inode 16 like in the first case, all other between
17-23 is ok, FILE.
Szaka
|
