|
From: Anton A. <ai...@ca...> - 2002-07-09 14:57:35
|
On Tue, 9 Jul 2002, Szakacsits Szabolcs wrote:
> On Tue, 9 Jul 2002, Anton Altaparmakov wrote:
>
> > > for (inode = 0; inode < vol->nr_mft_records; inode++) {
> > > mref = (MFT_REF)inode;
> > >- if (ntfs_read_file_record(vol, mref, &mrec, NULL))
> > >- perr_exit("ntfs_read_file_record");
> > >+ if (ntfs_read_file_record(vol, mref, &mrec, NULL)) {
> > >+ if (errno == EIO)
> > >+ continue;
> > >+ perr_exit("ntfs_read_file_record");
> > >+ }
> > > if (!(mrec->flags & MFT_RECORD_IN_USE))
> > > continue;
> >
> > Are you sure about this one? I am not.
>
> I'm sure it's temporary :) Sorry, I forgot the FIXME.
>
> > Can you tell me what records you found other than file? I have
> > seen CHKD (check disk), BAAD (corrupt mft record), and from the
> > windows ntfs driver source I know that HOLE is a valid record but
> > I haven't seen it in the wild yet and I was too lazy to figure out
> > what it meant by reverse engineering it...
>
> Unused (16-23) inodes on NTFS v3.0:
>
> Inodes: 16,18,19 are like
> 0004000: 0100 0000 0000 0000 0000 0000 0000 0000 ................
> 0004010: 0000 0000 0000 0000 0000 0000 0000 0000 ................
> *
> 00041f0: 0000 0000 0000 0000 0000 0000 0000 0100 ................
> 0004200: 0000 0000 0000 0000 0000 0000 0000 0000 ................
> *
> 00043f0: 0000 0000 0000 0000 0000 0000 0000 0100 ................
>
> Inode 17 is OK, FILE.
>
> Inodes: 20-23 are like
> 0005400: 0000 0000 0000 0000 0000 0000 0000 0000 ................
> *
> 00057f0: 0000 0000 0000 0000 0000 0000 0000 0000 ................
>
> Or another case, inode 16 like in the first case, all other between
> 17-23 is ok, FILE.
System/special/reserved files. Typical. )-: Ok, we need to do something
about those... I think the best approach would be to special case inodes
0-23 and treat them specially. For them it is allowed to not have FILE in
which case you just need to skip them. But actually you should also make
sure that the magic isn't BAAD, CHKD, or HOLE. For either of these you
should abort for now at least. So the best way would be to use
read_mft_record and (pseudo code):
if (magic != FILE) {
if ((mft_no < 24) && (mft_no >= 16) &&
(magic != one of BAAD, CHKD, HOLE))
continue;
abort;
}
Best regards,
Anton
--
Anton Altaparmakov <aia21 at cantab.net> (replace at with @)
Linux NTFS maintainer / IRC: #ntfs on irc.openprojects.net
WWW: http://linux-ntfs.sf.net/ & http://www-stu.christs.cam.ac.uk/~aia21/
|
