|
From: Anton A. <ai...@ca...> - 2004-05-05 13:38:25
|
On Wed, 2004-05-05 at 13:32, Marcin Gibu=B3a wrote: > > not be zero any more. Have you ever run memtest on your machine? >=20 > I'll try to do this. >=20 > > If you run "chkdsk /f" from windows on this partition, does it detect > > any errors? >=20 > It doesn't. Ok. > > dd if=3D~/mymftdump of=3D~/inode0x78a bs=3D1024 count=3D1 skip=3D1930 > > > > And then email me the file ~/inode0x78a (this is only 1kiB in size). >=20 > Here it goes. Thanks. Analyzing this it is a highly fragmented file so it the $DATA attribute is spread over three more inodes. Could you email them to me, too please? They are 0x790 (=3D 1936), 0x791 (=3D 1937), and 0x792 (1938). You can get them like this (assuming you are using Bash as your shell): for i in 1936 1937 1938; do dd if=3D~/mymftdump of=3D~/inode$i bs=3D1024 count=3D1 skip=3D$i done Once I have those I can uncompress the mapping pairs arrays in the data extents and ask you to capture the compressed data for me. It will be a simple script simillar to the above... Thanks a lot for your help. Best regards, Anton --=20 Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @) Unix Support, Computing Service, University of Cambridge, CB2 3QH, UK Linux NTFS maintainer / IRC: #ntfs on irc.freenode.net WWW: http://linux-ntfs.sf.net/ & http://www-stu.christs.cam.ac.uk/~aia21/ |
