If start buffer is more recent than restart, we update committed LSN
with last record LSN of block (last_end_lsn) while applying action but
forget about it while printing records with -f for investigation
purpose.
Note that while applying actions we use start_buffer to calculate
latest page out of block 2 and block 3 and then from latest take
committed LSN. For -f we don't need buffers so we just compare
directly with committed LSN from restart.
(contributed by Rakesh Pandit)
The new compression formats used by Windows 10 uses reparse data, and
a new reparse tag which it is useful to define even though these formats
is not yet supported by ntfs-3g.
This fixes the case where the original bad cluster list requires extents.
The list is processed globally, no relocation is done, and the list is
truncated, possibly fitting into fewer extents.
When block 2 or block 3 points backward to block 4, it is not clear
whether the log file only consists of block 2 or block 3 or the log
file has just wrapped around. The latter is now assumed.
When the bad cluster list required extent, ntfsclone and ntfsresize
did not process the extents, leading to unexpected read errors and
unmatching bitmaps. This fix enables the full list to be taken into
account.
The MFT has two runlists which may be partially stored in extents.
When these runlists have to be relocated, the relocations must be done
after the old runlists are not needed any more to read the data of
standard files, but before the MFT may be needed to extend the runlists
of standard files. Before doing so the MFT runlists have to be refreshed
from device in order to collect the updates which cannot be done in
memory during the first stage.
ntfsrecover applies to the metadata the updates which were requested on
Windows but could not be completed because they were interrupted by
some event such as a power failure, a hardware crash, a software crash
or the device being unplugged. Doing so, the file system is restored
to the latest consistent state.
No update to libntfs-3g is required by this implementation.
When used with the "no-action" option, the test for self-located MFT
still reported the partition to have been repaired. Adapt the report to
only tell repairing is possible.
In an NTFS boot sector, the first sector of the partition is limited to
32 bits and it may overflow on large disks. This field is only used for
booting on the partition and it is ignored by ntfs-3g, but the warning
in mkntfs mislead users, so improve it.
Unused entries in the MFT may have a bad length leading to fetch fixups
from unallocated memory. Check the condition, but do not wipe, leave it
to chkdsk to decide what should be fixed.
When the unmounting of the partition fails after running ntfsfix, a
second try was attempted. This cannot be done and leads to more errors
because some essential records have been freed, so better quit without
making a second try.
When the new option --unused-fast is used, clusters which appear as wiped
are not written again. This is useful for avoiding virtual partitions to
be extended to their full size.
Contributed by michael
ntfsfallocate is the equivalent of fallocate(1) :
Usage : ntfsfallocate [-n] [-p] [-o offset] -l length filename
For now, it is only released as a quarantined ntfsprogs because it can
produce configurations which cause subsequent updates of the file by
Windows to hang.
Distributions have complained about releasing a non-functional ntfsck.
Actually, ntfsck and a few other developer-oriented utilities were not
meant to be released by distributions and are only compiled in if the
configure option --enable-extra is set, and, for some reason, this
option is set by most distributions.
In order to get distributions to not complain, though making the source
code available for candidate developers to improve it, the non functional
or developer-oriented utilities (ntfsck, ntfsdump_logfile, ntfsmftalloc
and ntfsmove) are now only compiled in if the configure option
--enable-quarantined is set.
The ntfsprogs used to return failure when option --version or --help
was used, and this has triggered complains from distribution packagers
who use these options in packaging scripts.
With this patch, success is returned (same behavior as gcc).
When the partition is resized, the global bitmap size is adjusted accordingly,
however so far the new size was not set into the parent index (only minor
consequences).
The ioctl() function is not implemented in the Windows variant. By forcing
a negative apparent return, an alternative is triggered to get the
partition size which is normally obtained from an ioctl().
In some rare situations relocated runlists are longer than the original
ones and do not fit into the same extent. When this happens the runlist
updating is delayed and done globally. Be sure to use the updated global
bitmap for making the needed allocations.
X509 certificates have a purpose field restricting what the certificate
can be used for, and EFS encryption is such a purpose. Allow EFS encryption
to be at any position in the list.
When ntfsclone'ing to a file, the target file was truncated to the volume
size. This is not useful on file systems which support sparse files. In
the case of ntfs-3g this leads to prevent optimizations specific to
appending data. So when a sparse output file is detected, it is emptied
to benefit from subsequent appending of data.
The upcoming libgrypt-1.6 drops the "module" interface which was used
by ntfsdecrypt for decrypting files which were encrypted with the "DESX"
algorithm. This algorithm is a Microsoft variant of DES with a key size
of 128 bits, and is not natively supported by libgrypt. The module interface
made possible to declare an external algorithm so that all the encryption
modes could be processed the same way whether the algorithm was internal
or external.
This patch makes DESX a specific case, so that the module interface is
not needed any more. It is compatible with current libgrypt and upcoming
libgrypt-1.6
When trying to undelete a file which was modified several times the
same day, it is difficult to tell which one is the latest unless the
modification time is displayed.
Traditionally the backup boot sector is not set by ntfsresize because
the exact partition size is not yet known. A chkdsk is triggered to
subsequently insert it.
However ntfsresize is frequently activated by a partition editor which
has an exact knowledge of the wanted layout, and the backup boot sector
can be inserted by ntfsresize. This is only done if the target partition
size is defined with no unit suffix, and it is a multiple of the sector
size. Anyway the backup boot sector cannot overwrite useful data as it
is inserted between the file system size and the target partition size.
The usa sequence is used to make sure the sectors containing metadata
are fully written. The values are always put at the end of 512-byte
chunks even if the sectors are greater.
When the MFT is partially located beyond the end of a resized partition,
it has to be relocated after the other files have been processed
because the MFT data is needed to do the relocations. When the MFT runlist
is split over extents, all of them have to be processed.
When the beginning of the MFT is beyond the end of the resized
partition, a specific procedure has to be used to relocate this part
of the MFT and adjust the bitmap accordingly. On a test run, these
updates should not be done.
The long long printing formats (such as %lld or %llx) have to be
translated to %I64 on older Windows systems, and the buffers to
receive the translated format must be able to hold the tool banners
which can be quite lengthy.
The size argument of ntfsresize is the target partition size. This is
not the file system size as returned by df(1) or statvfs(3) because a
sector is reserved for the backup boot sector, and the remaining sector
count might not be a multiple of clusters per sector.
When a sector is unreadable, consider the whole sector as bad, instead
of trying to find which 512-byte parts of it are bad. This was causing
unwanted retries for devices with 4K sectors.
Older msvcrt.dll (on XP and earlier) did not support "%ll" print editing
formats frequently used by ntfsclone. So translate them to "%I64" when
running on Windows. This format appears to be supported by all Windows
versions. Error messages from libntfs-3g are still not translated.
This mainly means using the functions in win32_io.c instead of the
standard msvcrt.dll ones in order to be able to truncate files and
create sparse ones.
This mainly means using the functions in win32_io.c instead of the
standard msvcrt.dll ones in order to be able to truncate files and
create sparse ones.
The summary of 'runcount.runs' and 'runcount.fragments' was displayed in
non-verbose mode. However these variables are not updated in non-verbose
mode, so they would always be 0.
We now only display this summary in verbose mode.
The filtering of files to undelete is usually done through the regex
library. This patch offers an alternate way when such a library is
not readily available (typically on Windows).
When ntfsundelete scans the $MFT for possible deleted files, it may
examine extries which have never been used, producing error messages
which most users do not understand. This patch silences such messages.
Allow the "--ignore-fs-check" option to be used when cloning a file system
which has allocation errors. This is useful when there is a fear that
repairing the file system might create further damage, or when the repair
has to be made on another computer.
This patch adds a new option -n to ntfsclone for simulating a restore
without writing anything. This is useful for checking the consistency
of an image without destroying the original partition.
Upgrade the Win32 interface (win32_io.c) which was designed for Cygwin
so that it can be used for using the ntfsprogs utilities on native Windows.
Two new entries are added for truncating a file and creating a sparse
file, both of which not being supported through msvcrt.dll.
When creating a metadata image, all user data is supposed to be wiped off,
but this was wrong for $MFT and directory indexes when they were
fragmented. This patch cleans the tails of metadata fragments.
The MS_* flags originated from system constants. However the flags
passed to ntfs_mount were really unrelated to the system constants and
many new MS_* flags had to be introduced as different features were
added to the library. Those flags had no counterparts in any system
APIs, so using the same naming scheme is inappropriate.
Instead, let's namespace these flags similarly to what has already been
done in ntfsprogs/libntfs earlier. This avoids any possible conflicts
with system constants.
The values of the flags themselves are kept the same as earlier, so
backward compatibility is retained.
The variable 'flags' was modified along the way and did not contain the
original flags at the end as assumed by the last printout. Fixed by
storing the original state of the flags in a temporary const variable.
Since Windows 8 a new stream is added to the upper case file to record
a CRC of the upper case data. This way, if the file does not match the
one defined on the current Windows system, chkdsk can tell whether the
file is damaged or just out of date, and an error is only displayed if
the file is damaged.
The $Info data has been checked to be ignored by Windows XP, Windows
Vista and Windows 7. If not present, chkdsk for Windows 8 complains about
a wrong upper case file.
The named attributes sizes were wrongly computed in mkntfs. This did not
lead to visible errors so far owing to 8-byte alignments in attribute
records (current names $SDS, $R, $O, etc).
