|
From: Anton A. <ai...@ca...> - 2004-02-27 18:50:50
|
On Fri, 2004-02-27 at 18:09, nag talekar wrote:
> hi
> thanks again for ur reply
> I am sending u the FILE record of system32 folder (hex
> dump).
> please go thru it (Hex editor is required)
> I found a problem there.
> $BITMAP says that first 46h Index records r occupied
>
> but when i try to access 6th Index record i go to
> invalid index record.
>
> I ve checked my calculation based on docs at linx-ntfs
> site .I think its correct.
>
> My cluster offset for 6th Index record comes to abt
> 10071c6h
>
> This problem occurs only on win2k system
> My code works fine for winxp system.
>
> My coding is in assembly lang.It is for final year
> project at my college.
>
> could u plz reply :)
>
> can i join u on chat to clear some doubts?
>
> r u there online right now
Sorry am about to go home... Its been a long day.
I suggest you look at
ntfsprogs/libntfs/dir.c::ntfs_inode_lookup_by_name(). For example did
you take into consideration this:
/* Get to the index root value. */
ir = (INDEX_ROOT*)((u8*)ctx->attr +
le16_to_cpu(ctx->attr->value_offset));
index_block_size = le32_to_cpu(ir->index_block_size);
[snip]
/* Determine the size of a vcn in the directory index. */
if (vol->cluster_size <= index_block_size) {
index_vcn_size = vol->cluster_size;
index_vcn_size_bits = vol->cluster_size_bits;
} else {
index_vcn_size = vol->sector_size;
index_vcn_size_bits = vol->sector_size_bits;
}
Also you can double check the VCN of each INDX record you find (you seem
to find the first 5 so make sure they are the right ones). In the INDX
record the field ->index_block_vcn gives you the VCN of the INDX block.
Compare it to what you think the VCN should be...
if they match for the first 5 records then chances are you are doing things right but I suspect you are doing them wrong...
Sorry have to go now.
Best regards,
Anton
--
Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @)
Unix Support, Computing Service, University of Cambridge, CB2 3QH, UK
Linux NTFS maintainer / IRC: #ntfs on irc.freenode.net
WWW: http://linux-ntfs.sf.net/ &
http://www-stu.christs.cam.ac.uk/~aia21/
|
