|
From: Anton A. <ai...@ca...> - 2004-04-14 16:08:17
|
On Sat, 10 Apr 2004, Szakacsits Szabolcs wrote: > On Fri, 9 Apr 2004, Anton Altaparmakov wrote: > > btw. There is another difference between NTFS 3.1 LFS 1.1 and NTFS < 3.1 > > LFS 1.1 in that the client_array_offset in the first case is 0x40 and in > > the second case 0x30 so there might be additional fields in use by NTFS > > 3.1 LFS 1.1 despite the LFS version being the same as the old one... > > Yes, I also think so there are additional things there for XP/W2K3. But these are always zero AFAICS so not sure why they added the extra 16 bytes... > Apparently what's in logfile.h is for W2K. Yes, and I assume NT4 is identical although I haven't actually verified this. I suggest to assume it is until someone complains. (-; > client_free_list, > client_in_use_list, seq_number_bits, restart_area_length, seq_number > are also differ in case of W2K and XP/W2K3. client_free_list and _in_use_list differ because win2k ntfs detaches from the logfile as client while shutting down the volume, and hence the free_list is 0 and the in_use_list is 0xffff. XP OTOH doesn't detach from the logfile and keeps it open (presumably to gain a speedup on next boot) and hence the free_list is 0xffff and the in_use_list is 0. seq_number_bits you don't need to worry about. You can just verify it against the filesize, etc for sanity checking. It has nothing to do with LFS version, it is purely a feature of logfile size. restart_area_length is obviously different as the client is at offset 0x30 in 2k and 0x40 in XP thus the restart area has 16 extra bytes in XP. The seq_number is some funny sequence number and XP uses it differently to 2k. This is quite possibly related to the fact that 2k NTFS detaches from the logfile which results in it being zeroed while XP doesn't and it is left (this is purely a guess). > Interesting mutant is the W2K with the NTFS 3.1 driver. Seemingly it also > behaves like what's written in logfile.h (so not the NTFS version but the > OS seems to matter). Very odd. But perhaps not that odd. Do I assume correctly that this is the XP driver copied to w2k but that the volume was formatted by w2k? If so the LogFile format would be preserved so this is why it stays like old driver. If you erase the logfile I would guess that the newly created one will be like the XP one. > I have lots of mostly metadata only images but unfortunately I skipped > logfile dumping totally for ntfsclone -metadata because its size is too > huge. But saving the first 8 KB could have been very useful now :( > > Maybe I add this feature too, better later than never. That would be cool. Best regards, Anton -- Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @) Unix Support, Computing Service, University of Cambridge, CB2 3QH, UK Linux NTFS maintainer / IRC: #ntfs on irc.freenode.net WWW: http://linux-ntfs.sf.net/ & http://www-stu.christs.cam.ac.uk/~aia21/ |
