Comment 58 for bug 1728354
Revision history for this message
| Alexander Sashoga (sashoga84) wrote | #58 |
© 2004
Canonical Ltd.
•
Terms of use
•
Data privacy
•
Contact Launchpad Support
•
Blog
•
Careers
•
System status
•
1b1ed1a
(Get the code!)
> sudo ntfsinfo -fv -F "/Program Files/internet explorer/xxx.dat" /dev/sdxx
Replace "xxx.dat" by the name of a file which could not be read, and "sdxx" by the name of the Windows partition.
THAT IS IT:
root@sashoga:
Forced to continue.
Dumping Inode 317848 (0x4d998)
Upd. Seq. Array Off.: 48 (0x30)
Upd. Seq. Array Count: 3 (0x3)
Upd. Seq. Number: 21 (0x15)
LogFile Seq. Number: 0x14b4862a6
MFT Record Seq. Numb.: 3 (0x3)
Number of Hard Links: 4 (0x4)
Attribute Offset: 56 (0x38)
MFT Record Flags: IN_USE
Bytes Used: 664 (0x298) bytes
Bytes Allocated: 1024 (0x400) bytes
Next Attribute Instance: 19 (0x13)
MFT Padding: 00 00
Dumping attribute $STANDARD_
Attribute length: 96 (0x60)
Resident: Yes
Name length: 0 (0x0)
Name offset: 0 (0x0)
Attribute flags: 0x0000
Attribute instance: 0 (0x0)
Data size: 72 (0x48)
Data offset: 24 (0x18)
Resident flags: 0x00
ReservedR: 0 (0x0)
File Creation Time: Fri Jun 15 17:59:47 2018 UTC
File Altered Time: Mon Mar 5 13:07:00 2018 UTC
MFT Changed Time: Fri Jun 15 18:00:22 2018 UTC
Last Accessed Time: Fri Jun 15 18:00:06 2018 UTC
File attributes: ARCHIVE SPARSE_FILE REPARSE_POINT UNKNOWN: 0x00040000 (0x00040620)
Maximum versions: 0
Version number: 0
Class ID: 0
User ID: 0 (0x0)
Security ID: 543 (0x21f)
Quota charged: 0 (0x0)
Update Sequence Number: 1910294072 (0x71dcc638)
Dumping attribute $ATTRIBUTE_LIST (0x20) from mft record 317848 (0x4d998)
Attribute length: 376 (0x178)
Resident: Yes
Name length: 0 (0x0)
Name offset: 0 (0x0)
Attribute flags: 0x0000
Attribute instance: 17 (0x11)
Data size: 352 (0x160)
Data offset: 24 (0x18)
Resident flags: 0x00
ReservedR: 0 (0x0)
Dumping attribute list:
Attribute type: 0x10
Record length: 32 (0x20)
Name length: 0 (0x0)
Name offset: 26 (0x1a)
Starting VCN: 0 (0x0)
MFT reference: 317848 (0x4d998)
Instance: 0 (0x0)
Name: unnamed
Padding: 44 43 00 00 00 00
Attribute type: 0x30
Record length: 32 (0x20)
Name length: 0 (0x0)
Name offset: 26 (0x1a)
Starting VCN: 0 (0x0)
MFT reference: 325707 (0x4f84b)
Instance: 0 (0x0)
Name: unnamed
Padding: 00 00 00 00 00 00
Attribute type: 0x30
Record length: 32 (0x20)
Name length: 0 (0x0)
Name offset: 26 (0x1a)
Starting VCN: 0 (0x0)
MFT reference: 325707 (0x4f84b)
Instance: 1 (0x1)
Name: unnamed
Padding: 00 00 00 00 00 00
Attribute type: 0x30
Record length: 32 (0x20)
Name length: 0 (0x0)
Name offset: 26 (0x1a)
Starting VCN: 0 (0x0)
MFT reference: 325707 (0x4f84b)
Instance: 2 (0x2)
Name: unnamed
Padding: 00 00 00 00 00 00
Attribute type: 0x30
Record length: 32 (0x20)
Name length: 0 (0x0)
Name offset: 26 (0x1a)
Starting VCN: 0 (0x0)
MFT reference: 317848 (0x4d998)
Instance: 18 (0x12)
Name: unnamed
Padding: 00 00 00 00 00 00
Attribute type: 0x80
Record length: 32 (0x20)
Name length: 0 (0x0)
Name offset: 26 (0x1a)
Starting VCN: 0 (0x0)
MFT reference: 325707 (0x4f84b)
Instance: 3 (0x3)
Name: unnamed
Padding: 00 00 00 00 00 00
Attribute type: 0x80
Record length: 64 (0x40)
Name length: 17 (0x11)
Name offset: 26 (0x1a)
Starting VCN: 0 (0x0)
MFT reference: 325707 (0x4f84b)
Instance: 4 (0x4)
Name: WofCompressedData
Padding: 00 00 00 00
Attribute type: 0xc0
Record length: 32 (0x20)
Name length: 0 (0x0)
Name offset: 26 (0x1a)
Starting VCN: 0 (0x0)
MFT reference: 325707 (0x4f84b)
Instance: 5 (0x5)
Name: unnamed
Padding: 00 00 00 00 00 00
Attribute type: 0xd0
Record length: 32 (0x20)
Name length: 0 (0x0)
Name offset: 26 (0x1a)
Starting VCN: 0 (0x0)
MFT reference: 325707 (0x4f84b)
Instance: 6 (0x6)
Name: unnamed
Padding: 00 00 00 00 00 00
Attribute type: 0xe0
Record length: 32 (0x20)
Name length: 0 (0x0)
Name offset: 26 (0x1a)
Starting VCN: 0 (0x0)
MFT reference: 325707 (0x4f84b)
Instance: 7 (0x7)
Name: unnamed
Padding: 00 00 00 00 00 00
End of attribute list reached.
Dumping attribute $FILE_NAME (0x30) from mft record 325707 (0x4f84b)
Attribute length: 120 (0x78)
Resident: Yes
Name length: 0 (0x0)
Name offset: 0 (0x0)
Attribute flags: 0x0000
Attribute instance: 0 (0x0)
Data size: 90 (0x5a)
Data offset: 24 (0x18)
Resident flags: 0x01
ReservedR: 0 (0x0)
Parent directory: 320366 (0x4e36e)
File Creation Time: Fri Jun 15 17:59:47 2018 UTC
File Altered Time: Mon Mar 5 13:07:00 2018 UTC
MFT Changed Time: Fri Jun 15 18:00:06 2018 UTC
Last Accessed Time: Fri Jun 15 18:00:06 2018 UTC
Allocated Size: 0 (0x0)
Data Size: 372736 (0x5b000)
Filename Length: 12 (0xc)
File attributes: ARCHIVE SPARSE_FILE REPARSE_POINT (0x00000620)
Reparse point tag: 0x80000017 (Wof compressed)
Namespace: DOS
Filename: 'SYSTEM~1.DLL'
Dumping attribute $FILE_NAME (0x30) from mft record 325707 (0x4f84b)
Attribute length: 128 (0x80)
Resident: Yes
Name length: 0 (0x0)
Name offset: 0 (0x0)
Attribute flags: 0x0000
Attribute instance: 1 (0x1)
Data size: 104 (0x68)
Data offset: 24 (0x18)
Resident flags: 0x01
ReservedR: 0 (0x0)
Parent directory: 320366 (0x4e36e)
File Creation Time: Fri Jun 15 17:59:47 2018 UTC
File Altered Time: Mon Mar 5 13:07:00 2018 UTC
MFT Changed Time: Fri Jun 15 18:00:06 2018 UTC
Last Accessed Time: Fri Jun 15 18:00:06 2018 UTC
Allocated Size: 0 (0x0)
Data Size: 372736 (0x5b000)
Filename Length: 19 (0x13)
File attributes: ARCHIVE SPARSE_FILE REPARSE_POINT (0x00000620)
Reparse point tag: 0x80000017 (Wof compressed)
Namespace: Win32
Filename: 'System.
Dumping attribute $FILE_NAME (0x30) from mft record 325707 (0x4f84b)
Attribute length: 128 (0x80)
Resident: Yes
Name length: 0 (0x0)
Name offset: 0 (0x0)
Attribute flags: 0x0000
Attribute instance: 2 (0x2)
Data size: 104 (0x68)
Data offset: 24 (0x18)
Resident flags: 0x01
ReservedR: 0 (0x0)
Parent directory: 253636 (0x3dec4)
File Creation Time: Fri Jun 15 17:59:47 2018 UTC
File Altered Time: Mon Mar 5 13:07:00 2018 UTC
MFT Changed Time: Fri Jun 15 18:00:11 2018 UTC
Last Accessed Time: Fri Jun 15 18:00:06 2018 UTC
Allocated Size: 0 (0x0)
Data Size: 372736 (0x5b000)
Filename Length: 19 (0x13)
File attributes: ARCHIVE SPARSE_FILE REPARSE_POINT UNKNOWN: 0x00040000 (0x00040620)
Reparse point tag: 0x80000017 (Wof compressed)
Namespace: POSIX
Filename: 'System.
Dumping attribute $FILE_NAME (0x30) from mft record 317848 (0x4d998)
Attribute length: 128 (0x80)
Resident: Yes
Name length: 0 (0x0)
Name offset: 0 (0x0)
Attribute flags: 0x0000
Attribute instance: 18 (0x12)
Data size: 104 (0x68)
Data offset: 24 (0x18)
Resident flags: 0x01
ReservedR: 0 (0x0)
Parent directory: 325706 (0x4f84a)
File Creation Time: Fri Jun 15 17:59:47 2018 UTC
File Altered Time: Mon Mar 5 13:07:00 2018 UTC
MFT Changed Time: Fri Jun 15 18:00:22 2018 UTC
Last Accessed Time: Fri Jun 15 18:00:06 2018 UTC
Allocated Size: 0 (0x0)
Data Size: 372736 (0x5b000)
Filename Length: 19 (0x13)
File attributes: ARCHIVE SPARSE_FILE REPARSE_POINT UNKNOWN: 0x00040000 (0x00040620)
Reparse point tag: 0x80000017 (Wof compressed)
Namespace: POSIX
Filename: 'System.
Dumping attribute $DATA (0x80) from mft record 325707 (0x4f84b)
Attribute length: 80 (0x50)
Resident: No
Name length: 0 (0x0)
Name offset: 0 (0x0)
Attribute flags: 0x8000
Attribute instance: 3 (0x3)
Lowest VCN 0 (0x0)
Highest VCN: 95 (0x5f)
Mapping pairs offset: 72 (0x48)
Compression unit: 4 (0x4)
Data size: 372736 (0x5b000)
Allocated size: 393216 (0x60000)
Initialized size: 372736 (0x5b000)
Compressed size: 0 (0x0)
Runlist: VCN LCN Length
0x0 <HOLE> 0x60
Dumping attribute $DATA (0x80) from mft record 325707 (0x4f84b)
Attribute length: 112 (0x70)
Resident: No
Name length: 17 (0x11)
Name offset: 64 (0x40)
Attribute name: 'WofCompressedData'
Attribute flags: 0x0000
Attribute instance: 4 (0x4)
Lowest VCN 0 (0x0)
Highest VCN: 38 (0x26)
Mapping pairs offset: 104 (0x68)
Compression unit: 0 (0x0)
Data size: 156455 (0x26327)
Allocated size: 159744 (0x27000)
Initialized size: 156455 (0x26327)
Runlist: VCN LCN Length
0x0 0x1a7bfd8 0x27
Dumping attribute $REPARSE_POINT (0xc0) from mft record 325707 (0x4f84b)
Attribute length: 48 (0x30)
Resident: Yes
Name length: 0 (0x0)
Name offset: 0 (0x0)
Attribute flags: 0x0000
Attribute instance: 5 (0x5)
Data size: 24 (0x18)
Data offset: 24 (0x18)
Resident flags: 0x00
ReservedR: 0 (0x0)
Reparse tag: 0x80000017 (Wof compressed)
Data length: 16 (0x10)
Data: 0x0100000002000
Dumping attribute $EA_INFORMATION (0xd0) from mft record 325707 (0x4f84b)
Attribute length: 32 (0x20)
Resident: Yes
Name length: 0 (0x0)
Name offset: 0 (0x0)
Attribute flags: 0x0000
Attribute instance: 6 (0x6)
Data size: 8 (0x8)
Data offset: 24 (0x18)
Resident flags: 0x00
ReservedR: 0 (0x0)
Packed EA length: 103 (0x67)
NEED_EA count: 0 (0x0)
Unpacked EA length: 108 (0x6c)
Dumping attribute $EA (0xe0) from mft record 325707 (0x4f84b)
Attribute length: 136 (0x88)
Resident: Yes
Name length: 0 (0x0)
Name offset: 0 (0x0)
Attribute flags: 0x0000
Attribute instance: 7 (0x7)
Data size: 108 (0x6c)
Data offset: 24 (0x18)
Resident flags: 0x00
ReservedR: 0 (0x0)
EA flags: NONE
Name length: 15 (0xf)
Value length: 83 (0x53)
Name: '$CI.CATALOGHINT'
Value: 0x01004f004d696
End of inode reached
Total runs: 2 (fragments: 2)