|
From: Szakacsits S. <sz...@si...> - 2004-04-15 00:58:46
|
On Wed, 14 Apr 2004, Anton Altaparmakov wrote: > On Sat, 10 Apr 2004, Szakacsits Szabolcs wrote: > > On Fri, 9 Apr 2004, Anton Altaparmakov wrote: > > > btw. There is another difference between NTFS 3.1 LFS 1.1 and NTFS < 3.1 > > > LFS 1.1 in that the client_array_offset in the first case is 0x40 and in > > > the second case 0x30 so there might be additional fields in use by NTFS > > > 3.1 LFS 1.1 despite the LFS version being the same as the old one... > > > > Yes, I also think so there are additional things there for XP/W2K3. > > But these are always zero AFAICS so not sure why they added the extra 16 > bytes... Same here. > > Interesting mutant is the W2K with the NTFS 3.1 driver. Seemingly it also > > behaves like what's written in logfile.h (so not the NTFS version but the > > OS seems to matter). > > Very odd. But perhaps not that odd. Do I assume correctly that this is > the XP driver copied to w2k but that the volume was formatted by w2k? I don't think so. I guess W2K service pack, so W2K is able to read 3.1 volumes. > If so the LogFile format would be preserved so this is why it stays > like old driver. If you erase the logfile I would guess that the > newly created one will be like the XP one. > > > I have lots of mostly metadata only images but unfortunately I skipped > > logfile dumping totally for ntfsclone -metadata because its size is too > > huge. But saving the first 8 KB could have been very useful now :( > > > > Maybe I add this feature too, better later than never. > > That would be cool. I checked it in. The first 8 KiB saved or one cluster if the cluster size is greater than 8 KiB. Later, Szaka |
