FAQ SearchLogin
Tuxera Home
View unanswered posts | View active topics It is currently Sun Apr 11, 2021 03:49



Post new topic Reply to topic  [ 6 posts ] 
Can it be that ntfsinfo reports some symlinks as mountpoints 
Author Message

Joined: Wed Aug 24, 2016 23:26
Posts: 12
Post Can it be that ntfsinfo reports some symlinks as mountpoints
Hi!
I tried the latest ntfsinfo v2016.2.22 (libntfs-3g) for Linux and I have an impression it possibly incorrectly reports some symlinks (reparse tag 0xa000000c) as mountpoints (reparse tag 0xa0000003), can it be so?
For example, "All Users" is correctly reported as symlink, but "Application Data", "My Documents" etc are reported as mounpoints and I think they are symlinks.

Can you, please, check?

Thanks much,

Maxim.

Code:
# ntfsinfo -i 0x4546 /dev/mapper/loop0p2
Dumping Inode 17734 (0x4546)
Upd. Seq. Array Off.:    48 (0x30)
Upd. Seq. Array Count:   3 (0x3)
Upd. Seq. Number:        2 (0x2)
LogFile Seq. Number:     0x1a1b4bd
MFT Record Seq. Numb.:   1 (0x1)
Number of Hard Links:    2 (0x2)
Attribute Offset:        56 (0x38)
MFT Record Flags:        IN_USE DIRECTORY
Bytes Used:              592 (0x250) bytes
Bytes Allocated:         1024 (0x400) bytes
Next Attribute Instance: 6 (0x6)
MFT Padding:    00 00
Dumping attribute $STANDARD_INFORMATION (0x10) from mft record 17734 (0x4546)
        Resident:                Yes
        Attribute flags:         0x0000
        Attribute instance:      0 (0x0)
        Data size:               72 (0x48)
        Resident flags:          0x00
        File Creation Time:      Thu Aug 22 14:48:41 2013 UTC
        File Altered Time:       Thu Aug 22 14:48:41 2013 UTC
        MFT Changed Time:        Tue Jul 12 00:11:57 2016 UTC
        Last Accessed Time:      Thu Aug 22 14:48:41 2013 UTC
        File attributes:         HIDDEN SYSTEM REPARSE_POINT NOT_CONTENT_INDEXED (0x00002406)
        Maximum versions:        0
        Version number:          0
        Class ID:                0
        User ID:                 0 (0x0)
        Security ID:             420 (0x1a4)
        Quota charged:           0 (0x0)
        Update Sequence Number:  0 (0x0)
Dumping attribute $FILE_NAME (0x30) from mft record 17734 (0x4546)
        Resident:                Yes
        Attribute flags:         0x0000
        Attribute instance:      2 (0x2)
        Data size:               98 (0x62)
        Resident flags:          0x01
        Parent directory:        185 (0xb9)
        File Creation Time:      Tue Jul 12 00:11:56 2016 UTC
        File Altered Time:       Tue Jul 12 00:11:56 2016 UTC
        MFT Changed Time:        Tue Jul 12 00:11:56 2016 UTC
        Last Accessed Time:      Tue Jul 12 00:11:56 2016 UTC
        Allocated Size:          0 (0x0)
        Data Size:               0 (0x0)
        Filename Length:         16 (0x10)
        File attributes:         NOT_CONTENT_INDEXED I30_INDEX (0x10002000)
        Namespace:               Win32
        Filename:                'Application Data'
Dumping attribute $FILE_NAME (0x30) from mft record 17734 (0x4546)
        Resident:                Yes
        Attribute flags:         0x0000
        Attribute instance:      5 (0x5)
        Data size:               82 (0x52)
        Resident flags:          0x01
        Parent directory:        185 (0xb9)
        File Creation Time:      Thu Aug 22 14:48:41 2013 UTC
        File Altered Time:       Thu Aug 22 14:48:41 2013 UTC
        MFT Changed Time:        Tue Jul 12 00:11:57 2016 UTC
        Last Accessed Time:      Thu Aug 22 14:48:41 2013 UTC
        Allocated Size:          0 (0x0)
        Data Size:               0 (0x0)
        Filename Length:         8 (0x8)
        File attributes:         HIDDEN SYSTEM REPARSE_POINT NOT_CONTENT_INDEXED I30_INDEX (0x10002406)
        Reparse point tag:       0xa0000003 (mount point)
        Namespace:               DOS
        Filename:                'APPLIC~1'
Dumping attribute $INDEX_ROOT (0x90) from mft record 17734 (0x4546)
        Resident:                Yes
        Attribute name:          '$I30'
        Attribute flags:         0x0000
        Attribute instance:      1 (0x1)
        Data size:               48 (0x30)
        Resident flags:          0x00
        Indexed Attr Type:       DIRECTORY_I30
        Collation Rule:          1 (0x1)
        Index Block Size:        4096 (0x1000)
        Clusters Per Block:      1 (0x1)
        Entries Offset:          16 (0x10)
        Index Size:              32 (0x20)
        Allocated Size:          32 (0x20)
        Index header flags:      0x00
        Index entries total:     1
Dumping attribute $REPARSE_POINT (0xc0) from mft record 17734 (0x4546)
        Resident:                Yes
        Attribute flags:         0x0000
        Attribute instance:      4 (0x4)
        Data size:               84 (0x54)
        Resident flags:          0x00
        Reparse tag:             0xa0000003 (mount point)
        Data length:             76 (0x4c)
        Data:                    0x0000240026001c005c003f003f005c0043003a005c00500072006f0067007200...
End of inode reached

# ntfsinfo -i 0xf94b /dev/mapper/loop0p2
Dumping Inode 63819 (0xf94b)
Upd. Seq. Array Off.:    48 (0x30)
Upd. Seq. Array Count:   3 (0x3)
Upd. Seq. Number:        8 (0x8)
LogFile Seq. Number:     0x447237b
MFT Record Seq. Numb.:   1 (0x1)
Number of Hard Links:    2 (0x2)
Attribute Offset:        56 (0x38)
MFT Record Flags:        IN_USE DIRECTORY
Bytes Used:              576 (0x240) bytes
Bytes Allocated:         1024 (0x400) bytes
Next Attribute Instance: 6 (0x6)
MFT Padding:    00 00
Dumping attribute $STANDARD_INFORMATION (0x10) from mft record 63819 (0xf94b)
        Resident:                Yes
        Attribute flags:         0x0000
        Attribute instance:      0 (0x0)
        Data size:               72 (0x48)
        Resident flags:          0x00
        File Creation Time:      Thu Aug 22 14:48:41 2013 UTC
        File Altered Time:       Thu Aug 22 14:48:41 2013 UTC
        MFT Changed Time:        Tue Jul 12 00:13:44 2016 UTC
        Last Accessed Time:      Thu Aug 22 14:48:41 2013 UTC
        File attributes:         HIDDEN SYSTEM REPARSE_POINT NOT_CONTENT_INDEXED (0x00002406)
        Maximum versions:        0
        Version number:          0
        Class ID:                0
        User ID:                 0 (0x0)
        Security ID:             420 (0x1a4)
        Quota charged:           0 (0x0)
        Update Sequence Number:  0 (0x0)
Dumping attribute $FILE_NAME (0x30) from mft record 63819 (0xf94b)
        Resident:                Yes
        Attribute flags:         0x0000
       Attribute instance:      2 (0x2)
        Data size:               84 (0x54)
        Resident flags:          0x01
        Parent directory:        251 (0xfb)
        File Creation Time:      Tue Jul 12 00:13:44 2016 UTC
        File Altered Time:       Tue Jul 12 00:13:44 2016 UTC
        MFT Changed Time:        Tue Jul 12 00:13:44 2016 UTC
        Last Accessed Time:      Tue Jul 12 00:13:44 2016 UTC
        Allocated Size:          0 (0x0)
        Data Size:               0 (0x0)
        Filename Length:         9 (0x9)
        File attributes:         I30_INDEX (0x10000000)
        Namespace:               Win32
        Filename:                'All Users'
Dumping attribute $FILE_NAME (0x30) from mft record 63819 (0xf94b)
        Resident:                Yes
        Attribute flags:         0x0000
        Attribute instance:      5 (0x5)
        Data size:               82 (0x52)
        Resident flags:          0x01
        Parent directory:        251 (0xfb)
        File Creation Time:      Thu Aug 22 14:48:41 2013 UTC
        File Altered Time:       Thu Aug 22 14:48:41 2013 UTC
        MFT Changed Time:        Tue Jul 12 00:13:44 2016 UTC
        Last Accessed Time:      Thu Aug 22 14:48:41 2013 UTC
        Allocated Size:          0 (0x0)
        Data Size:               0 (0x0)
        Filename Length:         8 (0x8)
        File attributes:         HIDDEN SYSTEM REPARSE_POINT NOT_CONTENT_INDEXED I30_INDEX (0x10002406)
        Reparse point tag:       0xa000000c (symlink)
        Namespace:               DOS
        Filename:                'ALLUSE~1'
Dumping attribute $INDEX_ROOT (0x90) from mft record 63819 (0xf94b)
        Resident:                Yes
        Attribute name:          '$I30'
        Attribute flags:         0x0000
        Attribute instance:      1 (0x1)
        Data size:               48 (0x30)
        Resident flags:          0x00
        Indexed Attr Type:       DIRECTORY_I30
        Collation Rule:          1 (0x1)
        Index Block Size:        4096 (0x1000)
        Clusters Per Block:      1 (0x1)
        Entries Offset:          16 (0x10)
        Index Size:              32 (0x20)
        Allocated Size:          32 (0x20)
        Index header flags:      0x00
        Index entries total:     1
Dumping attribute $REPARSE_POINT (0xc0) from mft record 63819 (0xf94b)
        Resident:                Yes
        Attribute flags:         0x0000
        Attribute instance:      4 (0x4)
        Data size:               84 (0x54)
        Resident flags:          0x00
        Reparse tag:             0xa000000c (symlink)
        Data length:             76 (0x4c)
        Data:                    0x1c00240000001c000000000043003a005c00500072006f006700720061006d00...
End of inode reached



Sat Aug 27, 2016 02:36
Profile

Joined: Wed Aug 24, 2016 23:26
Posts: 12
Post Re: Can it be that ntfsinfo reports some symlinks as mountpoints
Hi,
No, ntfsinfo v2016.2.22 (libntfs-3g) for Linux shows everything correctly.
Thank you!
It is possibly Microsoft that uses the same term mountpoint in slightly different contexts in NTFS and OS.
It seems in Windows a mountpoint is a junction that points to some volume GUID, and a junction that points to something like C:\dir is a junction.
In NTFS both have reparse tag 0xa0000003 (mountpoint), so only by looking at the reparse point data one can tell if it's a mountpoint in Windows meaning of the term.

Thanks,

Maxim.


Sun Aug 28, 2016 19:07
Profile

Joined: Wed Aug 24, 2016 23:26
Posts: 12
Post Re: Can it be that ntfsinfo reports some symlinks as mountpoints
Actually in reparse.c those 2 cases are called directory junction and volume junction.
Is there any way to show this info up in the utilities, please?

Thanks,

Maxim.


Sun Aug 28, 2016 21:27
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: Can it be that ntfsinfo reports some symlinks as mountpoints
Hi,

Quote:
It seems in Windows a mountpoint is a junction that points to some volume GUID, and a junction that points to something like C:\dir is a junction.
In NTFS both have reparse tag 0xa0000003 (mountpoint), so only by looking at the reparse point data one can tell if it's a mountpoint in Windows meaning of the term.

For details on symlinks and junctions and how they are interpreted by ntfs-3g, see
http://jp-andre.pagesperso-orange.fr/junctions.html
The reparse tag 0xa0000003 is named IO_REPARSE_TAG_MOUNT_POINT and this is the collective name in Windows to mean either a volume junction and a directory junction.

Regards

Jean-Pierre


Tue Aug 30, 2016 08:26
Profile

Joined: Wed Aug 24, 2016 23:26
Posts: 12
Post Re: Can it be that ntfsinfo reports some symlinks as mountpoints
Thank you very much, Jean-Pierre!
The only problem with having .NTFS-3G directory in the filesystem is that we often look at the collection of uncleanly unmounted NTFS partitions of foreign Windows VMs (a snapshot made without VSS consistency on a running Windows) using libguestfs, so have to mount those partition read-only and can't create .NTFS-3G directory even when we have some info about MountedDevices and could make the mapping. Unless fsck of those partitions is really instant?

Thanks,

Maxim.


Wed Aug 31, 2016 09:44
Profile
NTFS-3G Lead Developer

Joined: Tue Sep 04, 2007 17:22
Posts: 1286
Post Re: Can it be that ntfsinfo reports some symlinks as mountpoints
Hi,

Quote:
uncleanly unmounted NTFS partitions of foreign Windows VMs (a snapshot made without VSS consistency on a running Windows) using libguestfs, so have to mount those partition read-only

The utility ntfsrecover is supposed to be able to recover the Windows journal and restore integrity for partitions which have not been unmounted properly.
You should however take care because I have not got much feedback about it, and it may have only been tested by myself.
Also note that the fast restarting of Windows 8 or 10 is quite a different topic.
Quote:
Unless fsck of those partitions is really instant?

I do not know about a public fsck for ntfs. I use chkdsk (even on Linux), but chkdsk disables the journal, so unfinished transactions are lost.

Regards

Jean-Pierre


Wed Aug 31, 2016 11:06
Profile
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 6 posts ] 


Who is online

Users browsing this forum: Majestic-12 [Bot] and 3 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
Powered by phpBB © 2000, 2002, 2005, 2007 phpBB Group.
Original forum style by Vjacheslav Trushkin.