FAQ SearchLogin
Tuxera Home
View unanswered posts | View active topics It is currently Wed Oct 16, 2019 18:33



Post new topic Reply to topic  [ 14 posts ] 
Problem with restoring file attribute (system.ntfs_dos_name) 
Author Message

Joined: Wed Sep 19, 2012 12:47
Posts: 7
Post Problem with restoring file attribute (system.ntfs_dos_name)
I have problem with restoring Windows 7 SP1 64bits partition when using fsarchiver.

Code:
[errno=5, Input/output error]: oper_restore.c#255,extractar_restore_attr_windows(): winattr:lsetxattr(/ProgramData/Norton/{0C55C096-0F1D-4F28-AAA2-85EF591126E7}/NIS_20.1.0.24/Definitions/VirusDefs/20120918.017/eraser64.sys,system.ntfs_dos_name) failed


Code:
-[00][ 34%][HARDLINK] /ProgramData/Norton/{0C55C096-0F1D-4F28-AAA2-85EF591126E7}/NIS_20.1.0.24/Definitions/VirusDefs/20120918.017/eraser64.sys
            winattr:lsetxattr(/ProgramData/Norton/{0C55C096-0F1D-4F28-AAA2-85EF591126E7}/NIS_20.1.0.24/Definitions/VirusDefs/20120918.017/eraser64.sys, system.ntfs_acl)=0
            winattr:lsetxattr(/ProgramData/Norton/{0C55C096-0F1D-4F28-AAA2-85EF591126E7}/NIS_20.1.0.24/Definitions/VirusDefs/20120918.017/eraser64.sys, system.ntfs_attrib)=0
            winattr:lsetxattr(/ProgramData/Norton/{0C55C096-0F1D-4F28-AAA2-85EF591126E7}/NIS_20.1.0.24/Definitions/VirusDefs/20120918.017/eraser64.sys, system.ntfs_times)=0
[errno=5, Input/output error]: oper_restore.c#255,extractar_restore_attr_windows(): winattr:lsetxattr(/ProgramData/Norton/{0C55C096-0F1D-4F28-AAA2-85EF591126E7}/NIS_20.1.0.24/Definitions/VirusDefs/20120918.017/eraser64.sys,system.ntfs_dos_name) failed
oper_restore.c#463,extractar_restore_obj_hardlink(): cannot restore file attributes for file [/ProgramData/Norton/{0C55C096-0F1D-4F28-AAA2-85EF591126E7}/NIS_20.1.0.24/Definitions/VirusDefs/20120918.017/eraser64.sys]


Code:
ntfsinfo -vF /ProgramData/Norton/{0C55C096-0F1D-4F28-AAA2-85EF591126E7}/NIS_20.1.0.24/Definitions/VirusDefs/20120918.017/eraser64.sys /dev/sda1
Dumping Inode 165 (0xa5)
Upd. Seq. Array Off.:    48 (0x30)
Upd. Seq. Array Count:    3 (0x3)
Upd. Seq. Number:    81 (0x51)
LogFile Seq. Number:    0x0
MFT Record Seq. Numb.:    1 (0x1)
Number of Hard Links:    2 (0x2)
Attribute Offset:    56 (0x38)
MFT Record Flags:    IN_USE
Bytes Used:       488 (0x1e8) bytes
Bytes Allocated:    1024 (0x400) bytes
Next Attribute Instance: 5 (0x5)
MFT Padding:   00 00
Dumping attribute $STANDARD_INFORMATION (0x10) from mft record 165 (0xa5)
   Attribute length:    96 (0x60)
   Resident:        Yes
   Name length:       0 (0x0)
   Name offset:       0 (0x0)
   Attribute flags:    0x0000
   Attribute instance:    0 (0x0)
   Data size:       72 (0x48)
   Data offset:       24 (0x18)
   Resident flags:       0x00
   ReservedR:       0 (0x0)
   File Creation Time:    Wed Sep 19 01:12:03 2012 UTC
   File Altered Time:    Sat Aug 18 01:00:00 2012 UTC
   MFT Changed Time:    Wed Sep 19 11:28:15 2012 UTC
   Last Accessed Time:    Wed Sep 19 01:12:03 2012 UTC
   File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
   Maximum versions:    0
   Version number:       0
   Class ID:       0
   User ID:       0 (0x0)
   Security ID:       265 (0x109)
   Quota charged:       0 (0x0)
   Update Sequence Number:    0 (0x0)
Dumping attribute $FILE_NAME (0x30) from mft record 165 (0xa5)
   Attribute length:    120 (0x78)
   Resident:        Yes
   Name length:       0 (0x0)
   Name offset:       0 (0x0)
   Attribute flags:    0x0000
   Attribute instance:    4 (0x4)
   Data size:       90 (0x5a)
   Data offset:       24 (0x18)
   Resident flags:       0x01
   ReservedR:       0 (0x0)
   Parent directory:    5260 (0x148c)
   File Creation Time:    Wed Sep 19 01:12:03 2012 UTC
   File Altered Time:    Sat Aug 18 01:00:00 2012 UTC
   MFT Changed Time:    Wed Sep 19 11:28:15 2012 UTC
   Last Accessed Time:    Wed Sep 19 01:12:03 2012 UTC
   Allocated Size:       139264 (0x22000)
   Data Size:       138912 (0x21ea0)
   Filename Length:    12 (0xc)
   File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
   Namespace:       Win32 & DOS
   Filename:       'eraser64.sys'
Dumping attribute $FILE_NAME (0x30) from mft record 165 (0xa5)
   Attribute length:    136 (0x88)
   Resident:        Yes
   Name length:       0 (0x0)
   Name offset:       0 (0x0)
   Attribute flags:    0x0000
   Attribute instance:    3 (0x3)
   Data size:       112 (0x70)
   Data offset:       24 (0x18)
   Resident flags:       0x01
   ReservedR:       0 (0x0)
   Parent directory:    163 (0xa3)
   File Creation Time:    Wed Sep 19 01:12:03 2012 UTC
   File Altered Time:    Sat Aug 18 01:00:00 2012 UTC
   MFT Changed Time:    Wed Sep 19 11:28:15 2012 UTC
   Last Accessed Time:    Wed Sep 19 01:12:03 2012 UTC
   Allocated Size:       139264 (0x22000)
   Data Size:       0 (0x0)
   Filename Length:    23 (0x17)
   File attributes:    ARCHIVE (0x00000000)
   Namespace:       POSIX
   Filename:       'EraserUtilRebootDrv.sys'
Dumping attribute $DATA (0x80) from mft record 165 (0xa5)
   Attribute length:    72 (0x48)
   Resident:        No
   Name length:       0 (0x0)
   Name offset:       64 (0x40)
   Attribute flags:    0x0000
   Attribute instance:    2 (0x2)
   Lowest VCN       0 (0x0)
   Highest VCN:       33 (0x21)
   Mapping pairs offset:    64 (0x40)
   Compression unit:    0 (0x0)
   Data size:       138912 (0x21ea0)
   Allocated size:       139264 (0x22000)
   Initialized size:    138912 (0x21ea0)
   Runlist:   VCN      LCN      Length
         0x0      0x2cdaf8      0x22
End of inode reached


Is this problem with ntfs-3g or fsarchiver?


Thu Sep 20, 2012 08:50
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: Problem with restoring file attribute (system.ntfs_dos_name)
Hi,

Quote:
[errno=5, Input/output error]: oper_restore.c#255,extractar_restore_attr_windows(): winattr:lsetxattr(/ProgramData/Norton/{0C55C096-0F1D-4F28-AAA2-85EF591126E7}/NIS_20.1.0.24/Definitions/VirusDefs/20120918.017/eraser64.sys,system.ntfs_dos_name) failed

This is about setting a short 8.3 name (not shown) to the file eraser64.sys.
Code:
   Namespace:       Win32 & DOS
   Filename:       'eraser64.sys'

We can see that a short name has been set, it is "eraser64.sys" which complies with the 8.3 pattern, so it can be used both as a short name and a long name, but I do not know whether this was the wanted name.
Quote:
Is this problem with ntfs-3g or fsarchiver?

Not easy to tell without knowing what was the short name which was being set. When you get an IO error (error 5), the exact reason is logged into the system log. Can you find it (the location depends on the distribution, can be /var/log/messages) ?

Note : restoring short names into a directory may lead to conflicts with short names already present in the directory. Better restore to a void directory.

Regards

Jean-Pierre


Thu Sep 20, 2012 11:47
Profile

Joined: Wed Sep 19, 2012 12:47
Posts: 7
Post Re: Problem with restoring file attribute (system.ntfs_dos_name)
Hi,
Here is info from messages log:
Code:
Sep 20 13:26:42 localhost ntfs-3g[2812]: Index lookup failed, inode 3820: No such file or directory
Sep 20 13:26:42 localhost ntfs-3g[2812]: Failed to sync FILE_NAME (inode 1831): Input/output error

I'm using ntfs-3g-2012.1.15 and libattr1-2.4.43 if it is relevant.
Thank you for your help.


Thu Sep 20, 2012 14:34
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: Problem with restoring file attribute (system.ntfs_dos_name)
Hi,

Quote:
Sep 20 13:26:42 localhost ntfs-3g[2812]: Index lookup failed, inode 3820: No such file or directory
Sep 20 13:26:42 localhost ntfs-3g[2812]: Failed to sync FILE_NAME (inode 1831): Input/output error

Hmm, no indication of the short name being set...

It would be useful to have the inode info associated to the error messages : the above errors mention inodes 3820 and 1831, but your previous ntfsinfo was about 165. For instance for inode 3820 (assuming no change since the error mentioned above), do
Code:
ntfsinfo -fvi 3820 /dev/sda1

Regards

Jean-Pierre


Thu Sep 20, 2012 21:37
Profile

Joined: Wed Sep 19, 2012 12:47
Posts: 7
Post Re: Problem with restoring file attribute (system.ntfs_dos_name)
You're right, there was second error, which I have missed.
Here is log piece related to inod 165
Code:
Sep 19 12:16:13 localhost ntfs-3g[14822]: Index lookup failed, inode 5260: No such file or directory
Sep 19 12:16:13 localhost ntfs-3g[14822]: Failed to sync FILE_NAME (inode 165): Input/output error


The second error was also related to Symantec Norton files. Strange thing, some time ago problem occurred with AMD ATI driver files.
Code:
[root@localhost log]# ntfsinfo -fvi 3820 /dev/sda1
Dumping Inode 3820 (0xeec)
Upd. Seq. Array Off.:    48 (0x30)
Upd. Seq. Array Count:    3 (0x3)
Upd. Seq. Number:    3566 (0xdee)
LogFile Seq. Number:    0x0
MFT Record Seq. Numb.:    1 (0x1)
Number of Hard Links:    1 (0x1)
Attribute Offset:    56 (0x38)
MFT Record Flags:    IN_USE DIRECTORY
Bytes Used:       600 (0x258) bytes
Bytes Allocated:    1024 (0x400) bytes
Next Attribute Instance: 6 (0x6)
MFT Padding:   00 00
Dumping attribute $STANDARD_INFORMATION (0x10) from mft record 3820 (0xeec)
   Attribute length:    96 (0x60)
   Resident:        Yes
   Name length:       0 (0x0)
   Name offset:       0 (0x0)
   Attribute flags:    0x0000
   Attribute instance:    0 (0x0)
   Data size:       72 (0x48)
   Data offset:       24 (0x18)
   Resident flags:       0x00
   ReservedR:       0 (0x0)
   File Creation Time:    Wed Sep 19 01:11:44 2012 UTC
   File Altered Time:    Wed Sep 19 11:28:15 2012 UTC
   MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
   Last Accessed Time:    Wed Sep 19 01:12:26 2012 UTC
   File attributes:    NOT_CONTENT_INDEXED (0x00000000)
   Maximum versions:    0
   Version number:       0
   Class ID:       0
   User ID:       0 (0x0)
   Security ID:       348 (0x15c)
   Quota charged:       0 (0x0)
   Update Sequence Number:    0 (0x0)
Dumping attribute $FILE_NAME (0x30) from mft record 3820 (0xeec)
   Attribute length:    120 (0x78)
   Resident:        Yes
   Name length:       0 (0x0)
   Name offset:       0 (0x0)
   Attribute flags:    0x0000
   Attribute instance:    3 (0x3)
   Data size:       90 (0x5a)
   Data offset:       24 (0x18)
   Resident flags:       0x01
   ReservedR:       0 (0x0)
   Parent directory:    3819 (0xeeb)
   File Creation Time:    Wed Sep 19 01:11:44 2012 UTC
   File Altered Time:    Wed Sep 19 11:28:15 2012 UTC
   MFT Changed Time:    Thu Sep 20 11:26:41 2012 UTC
   Last Accessed Time:    Wed Sep 19 01:12:26 2012 UTC
   Allocated Size:       0 (0x0)
   Data Size:       0 (0x0)
   Filename Length:    12 (0xc)
   File attributes:    ARCHIVE I30_INDEX (0x00000000)
   Namespace:       Win32 & DOS
   Filename:       '20120918.017'
Dumping attribute $INDEX_ROOT (0x90) from mft record 3820 (0xeec)
   Attribute length:    200 (0xc8)
   Resident:        Yes
   Name length:       4 (0x4)
   Name offset:       24 (0x18)
   Attribute name:       '$I30'
   Attribute flags:    0x0000
   Attribute instance:    2 (0x2)
   Data size:       168 (0xa8)
   Data offset:       32 (0x20)
   Resident flags:       0x00
   ReservedR:       0 (0x0)
   Indexed Attr Type:    DIRECTORY_I30
   Collation Rule:       1 (0x1)
   Index Block Size:    4096 (0x1000)
   Clusters Per Block:    1 (0x1)
   Entries Offset:       16 (0x10)
   Index Size:       152 (0x98)
   Allocated Size:       152 (0x98)
   Index header flags:    0x01
   Dumping index root:
      Entry length:       112 (0x70)
      Key length:       88 (0x58)
      Index entry flags:    0x01
      Subnode VCN:       0 (0x0)
      FILE record number:    3837 (0xefd)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:12:12 2012 UTC
      File Altered Time:    Wed Sep 19 01:12:12 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:45 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:12:12 2012 UTC
      Allocated Size:       364544 (0x59000)
      Data Size:       360576 (0x58080)
      Filename Length:    11 (0xb)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'troj_nv.idx'

      Entry length:       24 (0x18)
      Key length:       0 (0x0)
      Index entry flags:    0x03
      Subnode VCN:       1 (0x1)
   End of index block reached
   Index entries total:    2
Dumping attribute $INDEX_ALLOCATION (0xa0) from mft record 3820 (0xeec)
   Attribute length:    80 (0x50)
   Resident:        No
   Name length:       4 (0x4)
   Name offset:       64 (0x40)
   Attribute name:       '$I30'
   Attribute flags:    0x0000
   Attribute instance:    5 (0x5)
   Lowest VCN       0 (0x0)
   Highest VCN:       1 (0x1)
   Mapping pairs offset:    72 (0x48)
   Compression unit:    0 (0x0)
   Data size:       8192 (0x2000)
   Allocated size:       8192 (0x2000)
   Initialized size:    8192 (0x2000)
   Runlist:   VCN      LCN      Length
         0x0      0xf9d748      0x2
   Dumping index block:
      Upd. Seq. Array Off.:    40 (0x28)
      Upd. Seq. Array Count:    9 (0x9)
      Upd. Seq. Number:    39060 (0x9894)
      LogFile Seq. Number:    0x0
      Node VCN:       0 (0x0)
      Entries Offset:       40 (0x28)
      Index Size:       3392 (0xd40)
      Allocated Size:       4072 (0xfe8)
      Index header flags:    0x00

      Entry length:       104 (0x68)
      Key length:       88 (0x58)
      Index entry flags:    0x00
      FILE record number:    3974 (0xf86)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:38 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:38 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:38 2012 UTC
      Allocated Size:       4096 (0x1000)
      Data Size:       3491 (0xda3)
      Filename Length:    11 (0xb)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'catalog.dat'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3822 (0xeee)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:12:03 2012 UTC
      File Altered Time:    Sat Aug 18 01:00:00 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:41 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:12:03 2012 UTC
      Allocated Size:       3018752 (0x2e1000)
      Data Size:       3016864 (0x2e08a0)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'cceraser.dll'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3823 (0xeef)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:44 2012 UTC
      File Altered Time:    Sat Aug 18 01:00:00 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:41 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:44 2012 UTC
      Allocated Size:       299008 (0x49000)
      Data Size:       296408 (0x485d8)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'ECMSVR32.DLL'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3824 (0xef0)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:12:03 2012 UTC
      File Altered Time:    Sat Aug 18 01:00:00 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:41 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:12:03 2012 UTC
      Allocated Size:       487424 (0x77000)
      Data Size:       484512 (0x764a0)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'eeCtrl64.sys'

      Entry length:       104 (0x68)
      Key length:       84 (0x54)
      Index entry flags:    0x00
      FILE record number:    3825 (0xef1)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:12:03 2012 UTC
      File Altered Time:    Tue Sep 18 14:33:00 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:41 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:12:03 2012 UTC
      Allocated Size:       126976 (0x1f000)
      Data Size:       126112 (0x1eca0)
      Filename Length:    9 (0x9)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'eng64.sys'

      Entry length:       104 (0x68)
      Key length:       86 (0x56)
      Index entry flags:    0x00
      FILE record number:    3975 (0xf87)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:44 2012 UTC
      File Altered Time:    Sat Aug 18 01:00:00 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:44 2012 UTC
      Allocated Size:       232 (0xe8)
      Data Size:       232 (0xe8)
      Filename Length:    10 (0xa)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'ERASER.GRD'

      Entry length:       104 (0x68)
      Key length:       86 (0x56)
      Index entry flags:    0x00
      FILE record number:    3976 (0xf88)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:44 2012 UTC
      File Altered Time:    Sat Aug 18 01:00:00 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:44 2012 UTC
      Allocated Size:       4096 (0x1000)
      Data Size:       2609 (0xa31)
      Filename Length:    10 (0xa)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'ERASER.SIG'

      Entry length:       104 (0x68)
      Key length:       86 (0x56)
      Index entry flags:    0x00
      FILE record number:    3977 (0xf89)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:44 2012 UTC
      File Altered Time:    Sat Aug 18 01:00:00 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:44 2012 UTC
      Allocated Size:       8192 (0x2000)
      Data Size:       4440 (0x1158)
      Filename Length:    10 (0xa)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'ERASER.SPM'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    1831 (0x727)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:12:03 2012 UTC
      File Altered Time:    Sat Aug 18 01:00:00 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:41 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:12:03 2012 UTC
      Allocated Size:       139264 (0x22000)
      Data Size:       138912 (0x21ea0)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'eraser64.sys'

      Entry length:       104 (0x68)
      Key length:       86 (0x56)
      Index entry flags:    0x00
      FILE record number:    3826 (0xef2)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:12:03 2012 UTC
      File Altered Time:    Wed Sep 19 01:12:03 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:42 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:12:03 2012 UTC
      Allocated Size:       7290880 (0x6f4000)
      Data Size:       7288160 (0x6f3560)
      Filename Length:    10 (0xa)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'esrdef.bin'

      Entry length:       104 (0x68)
      Key length:       82 (0x52)
      Index entry flags:    0x00
      FILE record number:    3827 (0xef3)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:12:04 2012 UTC
      File Altered Time:    Tue Sep 18 14:33:01 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:44 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:12:04 2012 UTC
      Allocated Size:       2084864 (0x1fd000)
      Data Size:       2084000 (0x1fcca0)
      Filename Length:    8 (0x8)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'ex64.sys'

      Entry length:       104 (0x68)
      Key length:       88 (0x58)
      Index entry flags:    0x00
      FILE record number:    3828 (0xef4)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:12:14 2012 UTC
      File Altered Time:    Wed Sep 19 01:12:14 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:44 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:12:14 2012 UTC
      Allocated Size:       671744 (0xa4000)
      Data Size:       670208 (0xa3a00)
      Filename Length:    11 (0xb)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'gcrc_nv.idx'

      Entry length:       104 (0x68)
      Key length:       86 (0x56)
      Index entry flags:    0x00
      FILE record number:    3829 (0xef5)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:12:14 2012 UTC
      File Altered Time:    Wed Sep 19 01:12:14 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:44 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:12:14 2012 UTC
      Allocated Size:       2088960 (0x1fe000)
      Data Size:       2086444 (0x1fd62c)
      Filename Length:    10 (0xa)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'gcrc_v.idx'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3830 (0xef6)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:44 2012 UTC
      File Altered Time:    Tue Sep 18 14:32:46 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:44 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:44 2012 UTC
      Allocated Size:       192512 (0x2f000)
      Data Size:       189848 (0x2e598)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'NAVENG32.DLL'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3831 (0xef7)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:44 2012 UTC
      File Altered Time:    Tue Sep 18 14:32:47 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:44 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:44 2012 UTC
      Allocated Size:       1937408 (0x1d9000)
      Data Size:       1934744 (0x1d8598)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'NAVEX32A.DLL'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3978 (0xf8a)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:44 2012 UTC
      File Altered Time:    Sat Aug 18 01:00:00 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:44 2012 UTC
      Allocated Size:       8192 (0x2000)
      Data Size:       6536 (0x1988)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'NCSACERT.TXT'

      Entry length:       104 (0x68)
      Key length:       88 (0x58)
      Index entry flags:    0x00
      FILE record number:    3832 (0xef8)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:44 2012 UTC
      File Altered Time:    Sat Aug 18 01:00:00 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:44 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:44 2012 UTC
      Allocated Size:       98304 (0x18000)
      Data Size:       98112 (0x17f40)
      Filename Length:    11 (0xb)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'SCRAUTH.DAT'

      Entry length:       112 (0x70)
      Key length:       92 (0x5c)
      Index entry flags:    0x00
      FILE record number:    3833 (0xef9)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:12:09 2012 UTC
      File Altered Time:    Tue Sep 18 22:02:26 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:44 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:12:09 2012 UTC
      Allocated Size:       8192 (0x2000)
      Data Size:       4391 (0x1127)
      Filename Length:    13 (0xd)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32
      Filename:       'streamset.dat'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3833 (0xef9)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:12:09 2012 UTC
      File Altered Time:    Tue Sep 18 22:02:26 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:44 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:12:09 2012 UTC
      Allocated Size:       8192 (0x2000)
      Data Size:       4391 (0x1127)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       DOS
      Filename:       'STREAM~1.DAT'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3979 (0xf8b)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:38 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:38 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:38 2012 UTC
      Allocated Size:       12288 (0x3000)
      Data Size:       8746 (0x222a)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'symaveng.cat'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3980 (0xf8c)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:38 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:38 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:38 2012 UTC
      Allocated Size:       4096 (0x1000)
      Data Size:       1062 (0x426)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'symaveng.inf'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3981 (0xf8d)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:12:04 2012 UTC
      File Altered Time:    Sat Aug 18 01:00:00 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:12:04 2012 UTC
      Allocated Size:       8192 (0x2000)
      Data Size:       8010 (0x1f4a)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'symera64.cat'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3982 (0xf8e)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:12:04 2012 UTC
      File Altered Time:    Sat Aug 18 01:00:00 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:12:04 2012 UTC
      Allocated Size:       4096 (0x1000)
      Data Size:       715 (0x2cb)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'symera64.inf'

      Entry length:       104 (0x68)
      Key length:       86 (0x56)
      Index entry flags:    0x00
      FILE record number:    3834 (0xefa)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:44 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:46 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:45 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:44 2012 UTC
      Allocated Size:       40361984 (0x267e000)
      Data Size:       40360656 (0x267dad0)
      Filename Length:    10 (0xa)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'TCDEFS.DAT'

      Entry length:       104 (0x68)
      Key length:       88 (0x58)
      Index entry flags:    0x00
      FILE record number:    3821 (0xeed)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:46 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:47 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:41 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:46 2012 UTC
      Allocated Size:       9916416 (0x975000)
      Data Size:       9913819 (0x9745db)
      Filename Length:    11 (0xb)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'TCSCAN7.DAT'

      Entry length:       104 (0x68)
      Key length:       88 (0x58)
      Index entry flags:    0x00
      FILE record number:    3835 (0xefb)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:47 2012 UTC
      File Altered Time:    Tue Sep 18 14:32:48 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:45 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:47 2012 UTC
      Allocated Size:       184320 (0x2d000)
      Data Size:       180295 (0x2c047)
      Filename Length:    11 (0xb)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'TCSCAN8.DAT'

      Entry length:       104 (0x68)
      Key length:       88 (0x58)
      Index entry flags:    0x00
      FILE record number:    3836 (0xefc)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:47 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:47 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:45 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:47 2012 UTC
      Allocated Size:       737280 (0xb4000)
      Data Size:       735223 (0xb37f7)
      Filename Length:    11 (0xb)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'TCSCAN9.DAT'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3983 (0xf8f)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:47 2012 UTC
      File Altered Time:    Sat Aug 18 01:00:00 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:47 2012 UTC
      Allocated Size:       4096 (0x1000)
      Data Size:       875 (0x36b)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'TECHNOTE.TXT'

      Entry length:       104 (0x68)
      Key length:       82 (0x52)
      Index entry flags:    0x00
      FILE record number:    3984 (0xf90)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:47 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:47 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:47 2012 UTC
      Allocated Size:       456 (0x1c8)
      Data Size:       453 (0x1c5)
      Filename Length:    8 (0x8)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'TINF.DAT'

      Entry length:       104 (0x68)
      Key length:       88 (0x58)
      Index entry flags:    0x00
      FILE record number:    3985 (0xf91)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:47 2012 UTC
      File Altered Time:    Sat Aug 18 01:00:00 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:47 2012 UTC
      Allocated Size:       152 (0x98)
      Data Size:       148 (0x94)
      Filename Length:    11 (0xb)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'TINFIDX.DAT'

      Entry length:       104 (0x68)
      Key length:       84 (0x54)
      Index entry flags:    0x00
      FILE record number:    3986 (0xf92)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:47 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:47 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:47 2012 UTC
      Allocated Size:       4096 (0x1000)
      Data Size:       1957 (0x7a5)
      Filename Length:    9 (0x9)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'TINFL.DAT'

      Entry length:       16 (0x10)
      Key length:       0 (0x0)
      Index entry flags:    0x02
   End of index block reached
   Index entries:       32
   Dumping index block:
      Upd. Seq. Array Off.:    40 (0x28)
      Upd. Seq. Array Count:    9 (0x9)
      Upd. Seq. Number:    55 (0x37)
      LogFile Seq. Number:    0x0
      Node VCN:       1 (0x1)
      Entries Offset:       40 (0x28)
      Index Size:       2568 (0xa08)
      Allocated Size:       4072 (0xfe8)
      Index header flags:    0x00

      Entry length:       104 (0x68)
      Key length:       86 (0x56)
      Index entry flags:    0x00
      FILE record number:    3838 (0xefe)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:12:12 2012 UTC
      File Altered Time:    Wed Sep 19 01:12:12 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:46 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:12:12 2012 UTC
      Allocated Size:       3518464 (0x35b000)
      Data Size:       3516814 (0x35a98e)
      Filename Length:    10 (0xa)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'troj_v.idx'

      Entry length:       104 (0x68)
      Key length:       86 (0x56)
      Index entry flags:    0x00
      FILE record number:    3839 (0xeff)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:47 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:47 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:46 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:47 2012 UTC
      Allocated Size:       77824 (0x13000)
      Data Size:       74924 (0x124ac)
      Filename Length:    10 (0xa)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'TSCAN1.DAT'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3987 (0xf93)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:47 2012 UTC
      File Altered Time:    Sat Aug 18 01:00:00 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:47 2012 UTC
      Allocated Size:       4096 (0x1000)
      Data Size:       3934 (0xf5e)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'TSCAN1HD.DAT'

      Entry length:       96 (0x60)
      Key length:       76 (0x4c)
      Index entry flags:    0x00
      FILE record number:    3988 (0xf94)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:38 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:38 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:38 2012 UTC
      Allocated Size:       8192 (0x2000)
      Data Size:       5189 (0x1445)
      Filename Length:    5 (0x5)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'v.grd'

      Entry length:       96 (0x60)
      Key length:       76 (0x4c)
      Index entry flags:    0x00
      FILE record number:    3989 (0xf95)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:38 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:38 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:38 2012 UTC
      Allocated Size:       4096 (0x1000)
      Data Size:       2609 (0xa31)
      Filename Length:    5 (0x5)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'v.sig'

      Entry length:       112 (0x70)
      Key length:       96 (0x60)
      Index entry flags:    0x00
      FILE record number:    3840 (0xf00)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:12:09 2012 UTC
      File Altered Time:    Wed Sep 19 01:12:26 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:46 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:12:09 2012 UTC
      Allocated Size:       168 (0xa8)
      Data Size:       164 (0xa4)
      Filename Length:    15 (0xf)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32
      Filename:       'VersionInfo.dat'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3840 (0xf00)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:12:09 2012 UTC
      File Altered Time:    Wed Sep 19 01:12:26 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:46 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:12:09 2012 UTC
      Allocated Size:       168 (0xa8)
      Data Size:       164 (0xa4)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       DOS
      Filename:       'VERSIO~1.DAT'

      Entry length:       104 (0x68)
      Key length:       88 (0x58)
      Index entry flags:    0x00
      FILE record number:    3841 (0xf01)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:47 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:47 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:46 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:47 2012 UTC
      Allocated Size:       106496 (0x1a000)
      Data Size:       106244 (0x19f04)
      Filename Length:    11 (0xb)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'VIRSCAN.INF'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3842 (0xf02)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:47 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:47 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:46 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:47 2012 UTC
      Allocated Size:       1081344 (0x108000)
      Data Size:       1081035 (0x107ecb)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'VIRSCAN1.DAT'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3843 (0xf03)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:47 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:47 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:46 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:47 2012 UTC
      Allocated Size:       577536 (0x8d000)
      Data Size:       575388 (0x8c79c)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'VIRSCAN2.DAT'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3844 (0xf04)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:47 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:47 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:46 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:47 2012 UTC
      Allocated Size:       159744 (0x27000)
      Data Size:       158708 (0x26bf4)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'VIRSCAN3.DAT'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3845 (0xf05)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:47 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:47 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:46 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:47 2012 UTC
      Allocated Size:       323584 (0x4f000)
      Data Size:       320485 (0x4e3e5)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'VIRSCAN4.DAT'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3846 (0xf06)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:47 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:49 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:46 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:47 2012 UTC
      Allocated Size:       16338944 (0xf95000)
      Data Size:       16336365 (0xf945ed)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'VIRSCAN5.DAT'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3847 (0xf07)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:49 2012 UTC
      File Altered Time:    Tue Sep 18 14:32:49 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:47 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:49 2012 UTC
      Allocated Size:       401408 (0x62000)
      Data Size:       399836 (0x619dc)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'VIRSCAN6.DAT'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3848 (0xf08)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:49 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:52 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:49 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:49 2012 UTC
      Allocated Size:       41668608 (0x27bd000)
      Data Size:       41665930 (0x27bc58a)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'VIRSCAN7.DAT'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3849 (0xf09)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:53 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:53 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:49 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:53 2012 UTC
      Allocated Size:       1044480 (0xff000)
      Data Size:       1041614 (0xfe4ce)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'VIRSCAN8.DAT'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3850 (0xf0a)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:53 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:54 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:49 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:53 2012 UTC
      Allocated Size:       7049216 (0x6b9000)
      Data Size:       7045456 (0x6b8150)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'VIRSCAN9.DAT'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3851 (0xf0b)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:54 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:54 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:50 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:54 2012 UTC
      Allocated Size:       4481024 (0x446000)
      Data Size:       4479786 (0x445b2a)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'VIRSCANA.DAT'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3852 (0xf0c)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:54 2012 UTC
      File Altered Time:    Wed Sep 19 01:12:02 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:50 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:54 2012 UTC
      Allocated Size:       25911296 (0x18b6000)
      Data Size:       25909889 (0x18b5a81)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'VIRSCANB.DAT'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3853 (0xf0d)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:12:26 2012 UTC
      File Altered Time:    Wed Sep 19 01:12:26 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:50 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:12:26 2012 UTC
      Allocated Size:       86016 (0x15000)
      Data Size:       82284 (0x1416c)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'virscanb.idx'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3990 (0xf96)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:38 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:38 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:38 2012 UTC
      Allocated Size:       32 (0x20)
      Data Size:       32 (0x20)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'virscant.dat'

      Entry length:       112 (0x70)
      Key length:       90 (0x5a)
      Index entry flags:    0x00
      FILE record number:    3991 (0xf97)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:11:38 2012 UTC
      File Altered Time:    Wed Sep 19 01:11:38 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:11:38 2012 UTC
      Allocated Size:       45056 (0xb000)
      Data Size:       41493 (0xa215)
      Filename Length:    12 (0xc)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'whatsnew.TXT'

      Entry length:       104 (0x68)
      Key length:       84 (0x54)
      Index entry flags:    0x00
      FILE record number:    3992 (0xf98)
      Parent directory:    3820 (0xeec)
      File Creation Time:    Wed Sep 19 01:12:03 2012 UTC
      File Altered Time:    Sat Aug 18 01:00:00 2012 UTC
      MFT Changed Time:    Thu Sep 20 11:26:51 2012 UTC
      Last Accessed Time:    Wed Sep 19 01:12:03 2012 UTC
      Allocated Size:       224 (0xe0)
      Data Size:       224 (0xe0)
      Filename Length:    9 (0x9)
      File attributes:    ARCHIVE NOT_CONTENT_INDEXED (0x00000000)
      Namespace:       Win32 & DOS
      Filename:       'ZDONE.DAT'

      Entry length:       16 (0x10)
      Key length:       0 (0x0)
      Index entry flags:    0x02
   End of index block reached
   Index entries:       24
   Index entries total:    56
   INDX blocks total:    2
Dumping attribute $BITMAP (0xb0) from mft record 3820 (0xeec)
   Attribute length:    40 (0x28)
   Resident:        Yes
   Name length:       4 (0x4)
   Name offset:       24 (0x18)
   Attribute name:       '$I30'
   Attribute flags:    0x0000
   Attribute instance:    4 (0x4)
   Data size:       8 (0x8)
   Data offset:       32 (0x20)
   Resident flags:       0x00
   ReservedR:       0 (0x0)
End of inode reached


Fri Sep 21, 2012 08:28
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: Problem with restoring file attribute (system.ntfs_dos_name)
Hi,

Is there a debug option in fsarchiver which could show what it tried to do ?

This could be related to files having short names in different directories : your file 165 has two long names : it has the name eraser64.sys in directory 5260, and the name EraserUtilRebootDrv.sys in directory 163. The name eraser64.sys is actually both a long name and a short name, as it complies with the 8.3 pattern. There is a possibility that fsarchiver wanted to also set a short name in directory 163.

This may lead to a problem with no current solution : due to the interface with fuse and the Linux kernel (based on inode numbers, not on paths), the parent directory of a file is ambiguous when a file has several parent directories, so the short name could be set in a wrong directory. Even worst, the ambiguity also arises when querying short names, so the backup could contain wrong short names.

Maybe some trace in fsarchiver could confirm this, but I have no idea of a possible workaround.

Regards

Jean-Pierre


Fri Sep 21, 2012 12:22
Profile

Joined: Wed Sep 19, 2012 12:47
Posts: 7
Post Re: Problem with restoring file attribute (system.ntfs_dos_name)
Hi,
I had to format this partition and reinstall Windows because it was altered by my tests, fsarchiver begun to show a lot of errors. With clean Windows I wasn't able to reproduce this error, but as I wrote, the error occurs randomly.
I will try to reproduce this problem and get debug logs from creation of backup and its restoration.
I'm will try also to contact fsarchiver developer, so far no comment from him.

Thanks for your help.
Kind regards, Kobi.


Tue Sep 25, 2012 19:08
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: Problem with restoring file attribute (system.ntfs_dos_name)
Hi,

There is a bug in ntfs-3g when getting/setting dos names on file with several names (hard links). I cannot fix it, so I have to remove the ability to get/set dos names on such files.

Can you test the attached patch ? You will get the error "too many links" when getting/setting dos names in dangerous situations. This may have a bad consequence on being able to run some software related to these files, but directory corruptions should be over. Please make sure you restore over a clean condition (run chkdsk) and do another chkdsk after restoring, and report problems.

For fsarchiver (and similar software) to be able to get/set dos names on hard linked files, a new interface will have to be defined.

Regards

Jean-Pierre


Attachments:
dosnames.patch.gz [823 Bytes]
Downloaded 750 times
Fri Sep 28, 2012 09:54
Profile

Joined: Wed Sep 19, 2012 12:47
Posts: 7
Post Re: Problem with restoring file attribute (system.ntfs_dos_name)
Hi,
I recompiled ntfs-3g with your patch, indeed now it returns "[errno=31, Too many links]:" error, but fsarchiver had problem with near 10000 files:
Code:
Statistics for filesystem 0
* files successfully processed:....regfiles=65458, directories=16973, symlinks=67, hardlinks=11735, specials=3
* files with errors:...............regfiles=0, directories=0, symlinks=0, hardlinks=9834, specials=0


Without this patch fsarchiver has only one error:
Code:
* files successfully processed:....regfiles=65458, directories=16973, symlinks=67, hardlinks=21568, specials=3
* files with errors:...............regfiles=0, directories=0, symlinks=0, hardlinks=1, specials=0

And I have checked, this file was restored, and Norton worked fine.
As far I understand fsarchiver restored this file but it doesn't have dos name, so very old application can't have problems?


Fri Sep 28, 2012 12:40
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: Problem with restoring file attribute (system.ntfs_dos_name)
Hi,

Quote:
And I have checked, this file was restored, and Norton worked fine.

Fine.
Quote:
As far I understand fsarchiver restored this file but it doesn't have dos name

Not exactly : there are dos names on files with no hardlinks, but there are none on files with symlinks (there are probably 21568-11735 = 9833 dos names missing over 65458 files).
Also note that the "too many links" error will generally happen while saving a file system, not while restoring.
Quote:
so very old application can't have problems?

Yes, some old application may need a missing dos name, though I hope this must be rare by now and you will not get into trouble. I cannot accept a situation where a bug may strike once in a million because of an unmanageable race condition.

Regards

Jean-Pierre


Fri Sep 28, 2012 13:06
Profile

Joined: Wed Sep 19, 2012 12:47
Posts: 7
Post Re: Problem with restoring file attribute (system.ntfs_dos_name)
OK, I will try to create fsarchiver file with patched ntfs-3g and see if there are errors when restoring partition with this file. Only one more question, with this patch fsarchiver won't save dos name attributes for files with more then one dos name, but file itself will be stored in image and when restoring partition it will be restored (of course without dos name attributes)?


Fri Sep 28, 2012 14:21
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: Problem with restoring file attribute (system.ntfs_dos_name)
Hi,

Quote:
Only one more question, with this patch fsarchiver won't save dos name attributes for files with more then one dos name,

Should be "fsarchiver won't save dos name attributes for files with more then one NON-dos name"
Quote:
file itself will be stored in image and when restoring partition it will be restored (of course without dos name attributes)?

Should be so, unless fsarchiver gives up copying when getting the "too many links" error.

Regards

Jean-Pierre


Fri Sep 28, 2012 17:22
Profile

Joined: Wed Sep 19, 2012 12:47
Posts: 7
Post Re: Problem with restoring file attribute (system.ntfs_dos_name)
Hi Jean-Pierre.
I was able to create a new backup with patched ntfs-3g, here are logs from ntfs-3g:
Code:
Statistics for filesystem 0
* files successfully processed:....regfiles=34494, directories=16346, symlinks=67, hardlinks=0, specials=3
* files with errors:...............regfiles=20516, directories=0, symlinks=0, hardlinks=21594, specials=0


And logs from restoring partition with:
Code:
Statistics for filesystem 0
* files successfully processed:....regfiles=34492, directories=16346, symlinks=67, hardlinks=0, specials=3
* files with errors:...............regfiles=2, directories=0, symlinks=0, hardlinks=0, specials=0

Strange thing, in logs there is no trac of those two regfiles with error.

Kind regards.
Kobi.


Mon Oct 01, 2012 09:59
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: Problem with restoring file attribute (system.ntfs_dos_name)
Hi,

The new figures are not similar to the old ones. You get roughly the same number of directories (16346 instead of 16973), but the number of files is quite different (55010 instead of 65458), and only 34492 of them have been restored.

At first glance, fsarchiver did not save a file when it could not get its dos name.

How many files are present in the original tree ? I would like to be sure of the way files and hardlinks are counted by fsarchiver.

Here is a script for sorting the files by type and inode number (so hardlinks are not counted) :
Code:
ls -lRai treebase | grep '^[ 0-9]' | sed -e 's/^\( *[0-9][0-9]*\) \(.\).*$/\2 \1/' | sort -u > inodes

(copy-paste and replace "treebase" and "inodes" by your actual tree base and resulting file)
You will then get the numbers of directories, symlinks and files by
Code:
grep '^d' inodes | wc -l
grep '^l' inodes | wc -l
grep '^-' inodes | wc -l


You will get the number of file names by repeating the procedure, replacing "sort -u" by just "sort", and the number of hard links is the difference between the names and the files.

Regards

Jean-Pierre


Mon Oct 01, 2012 16:47
Profile
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 14 posts ] 


Who is online

Users browsing this forum: No registered users and 11 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group.
Original forum style by Vjacheslav Trushkin.