Error parsing MFT records in VHD file

Viki
2013-04-16
2013-04-30
  • Viki

    Viki - 2013-04-16

    Hi igor,

    I have a problem parsing the MFT of a volume. Actually total no of MFT record is 398640 and problem occurs at 398635. When i call parse function on 398635 it fails at
    if (!IsFILE())
    return IsEmpty() || IsBAAD();

    How can i debug this issue?
    

    /Thanks

     
  • Igor Pavlov

    Igor Pavlov - 2013-04-16

    What value of Magic variable?

     
  • Viki

    Viki - 2013-04-16

    Hi Igor,

    Magic value for 398635 is 3.

    /Thanks

     
  • Igor Pavlov

    Igor Pavlov - 2013-04-17

    Try to change the code
    bool IsEmpty() const { return (Magic <= 2); }
    to
    bool IsEmpty() const { return (Magic <= 3); }

     
  • Viki

    Viki - 2013-04-17

    Hi Igor,

    I have have changed the code as you mentioned and its working for that volume. Whereas for other volume in the same disk its failing its Magic number is 4.

    I am trying to open a volume from a incremental VHD (Differencing Disk) it has 320864 MFT records and its failing to parse 320859 Record at
    if (!IsFILE())
    return IsEmpty() || IsBAAD();
    Now my magic variable is 4.

    Any help on this?

     
  • Igor Pavlov

    Igor Pavlov - 2013-04-17

    I don't know why the Magic is 3 or 4.
    try
    bool IsEmpty() const { return (Magic <= 4); }

     
  • Viki

    Viki - 2013-04-18

    Hi Igor,

    I am trying to write a utility for Parsing MFT only and find the corresponding block number for the files in the MFT. So i have taken some parsing code from 7Zip source.

    But my code fails while parsing MFT Record attribute.

    UInt32 length = Get32(p + 0x04); in UInt32 CAttr::Parse(const Byte *p, unsigned size) for certain records.

    i will attach the project solution for your reference.

     
  • Igor Pavlov

    Igor Pavlov - 2013-04-18

    I don't want to debug your code.
    Write about 7-zip code here.

     
  • Viki

    Viki - 2013-04-30

    Hi igor,

    I open a VHD in 7zip and tried opening 1.ntfs. But 7zip fails opening the filesystem and gives no error. I attached the VHD in disk management and checked the volume was perfect without errors.

    So i debugged 7zip code to find the error, and found
    if (attr0.AllocatedSize < attr0.Size ||
    (attrs[attrIndexLim - 1].HighVcn + 1) != (attr0.AllocatedSize >> clusterSizeLog) ||
    (attr0.AllocatedSize & ((1 << clusterSizeLog) - 1)) != 0)
    return S_FALSE;

    Failing inside DataParseExtents function in NTFSHandler.cpp.

    Any help on this

    /Thanks

     
  • Igor Pavlov

    Igor Pavlov - 2013-04-30

    what values for:
    clusterSizeLog
    attr0.AllocatedSize
    attr0.Size
    attrs[attrIndexLim - 1].HighVcn

     
  • Viki

    Viki - 2013-04-30

    Igor,

    clusterSizeLog = 12
    attr0.AllocatedSize = 353796096
    attr0.Size = 353796096
    attrs[attrIndexLim - 1].HighVcn = 3

     
  • Igor Pavlov

    Igor Pavlov - 2013-04-30

    Now it's difficult for me to find the fix.
    I don't remember details of that code.

    Maybe there is some unusual like sparse file or somehing else.
    7-Zip doesn't support all possible ntfs files.
    I had no ntfs examples for some cases. So 7-Zip just returns S_FALSE in these cases.

    Your case can be pretty complex.
    You can try to enable
    SHOW_DEBUG_INFO
    SHOW_DEBUG_INFO2
    and then look the log in console version.
    Also maybe you need to printf all "attrs" items to find the reason.

     

Log in to post a comment.

Get latest updates about Open Source Projects, Conferences and News.

Sign up for the SourceForge newsletter:

JavaScript is required for this form.





No, thanks