When a user queries an extended attribute in the trusted namespace,
the traditional error return was EPERM. This has been recently changed
to ENODATA. See https://lkml.org/lkml/2011/5/27/199
On Windows XP and Vista, the system hibernation is identified by the
sequence "hibr" at the beginning of hiberfil.sys. This had been changed
to "HIBR" in Windows 7, so both sequences have to be accepted as
hibernation criteria.
When extracting the metadata, unused data at the end of MFT records is
supposed to be cleared. This was done for the base record of each file,
but not for the extent records.
Clearing the bad cluster list was done by truncating $BadClus:$Bad,
this turned out not to be reliable because chkdsk does not adjust
the size of $BadClus:$Bad when declaring a cluster bad.
This avoids name collisions with Mac OS X system headers (specifically
/usr/include/sys/queue.h). It's quite possible that other operating
systems also have similarly named macros in their system headers since
the function/macro names are very generic.
'wipe_mft' didn't write any $MFTMirr entries for newly manufactured
entries (i.e. entries that were unused and therefore competely wiped and
replaced with a newly initialized copy).
The dereferencing of 'offset' and 'usa' from the MFT record wasn't an
le16* dereference but a u8* dereference, leading to only the least
significant byte (little-endian systems) or the most significant byte
(big-endian systems) being part of the value. (So while this bug could
go unnoticed on little-endian systems for volumes with small values of
'usa', it caused even more significant problems on big-endian systems.)
Fixed by properly casting the address to le16* before dereferencing.
'wipe_mft' was hardcoded to use the USA size of a 1024 byte MFT record
when creating new blank MFT entries. It now calculates the USA size
based on vol->mft_record_size.
This bug led 'utils_mftrec_in_use' to use 'cached' data before it had
been initialized (i.e. its contents was undefined), producing incorrect
results for the first 3584 MFT entries.
When the cluster size is bigger than the index block size, the index
block size unit is 512 (not the sector size) instead of the cluster size.
The partitions formatted by mkntfs and used by ntfs-3g were not
interoperable with Windows when the cluster size is bigger than 4K
and the sector size is not 512.
The booting process has recently been changed so that partitions
which are requested to be checked at mount time with no checker
available, cause a specific user interaction while booting.
The patch warns users against requesting such a check, as there
is no known open-source ntfs file system checker.
When computing the runlist for the first non-resident write to an
attribute, an inconsistency was created between the attribute image
and the ntfs_attr structure, which could cause an MFT record overflow
when the first write is huge and fragmented (reported by Vito Caputo).
With the default mount options, compression of new files are now done
if the parent directory is marked for compression. The mount option
"compression" is not needed any more, but the option "nocompression"
can be used to disable compression of new files.
The default option also applies to applications using libntfs-3g with
no mount command.
When undeleting a file whose name cannot be recovered, this patch
defines a name to which the inode number is appended to facilitate
a bulk recovery (recovering the unwanted deletion of a subtree).
When a file is deleted, ntfs-3g deletes the name from the MFT record,
so the name is not available when the file has to be undeleted.
This patch tries to recover the name when it has not been overwritten.
This is mostly possible when data is non-resident and not fragmented.
Under some rare and obscure circumstances probably unrelated to ntfs-3g,
a part of the runlist of MFT describes its own location, therefore
it cannot be loaded. This patch relocates the MFT extent to inode 15
to fix this. Note : chkdsk cannot fix it and destroys all the files.
When the lower bound of an ntfs partition is moved down this patch
recreated new metadata in the expanded space without copying the
actual data. The existing code for moving the upper bound of the
partition has been kept unchanged.
This patch avoid updating the time stamps whenever a file is modified,
by delaying the time stamps updating until the file is closed.
This is mostly useful when the ntfs file system hosts another loop-monted
file system to avoid frequent updates of the time stamps in the outer
file system.
Logging of fixup errors for uninitialized inodes cause unnecessary
worries and suspicion of malfunctions in ntfs-3g. This patch silences
these loggings in ntfsclone and ntfsresize which have to analyze all
inodes, including the uninitialized ones.
The label changing code in ntfslabel was cleaned up and modified to use the more
advanced functionality of libntfs-3g instead of using older custom code to
resize and create resident attributes.
The core label changing functionality was also moved into the library so it can
be reused by other programs.
When clearing a volume name in Windows, $VOLUME_NAME is set to size 0, even if
the standard $AttrDef says that the minimum size is 2.
So the definition in $AttrDef doesn't reflect actual Windows behaviour in this
particular case, and to clear volume names ourselves the way Windows does it,
we must must add a special rule to permit us to truncate the $VOLUME_NAME
attribute to 0 even when $AttrDef specifies a higher value as minimum size.
When an attribute is truncated and made resident, the NAttrFullyMapped
flags has to be cleared, otherwise the attribute cannot be properly
mapped when the attribute is later made non-resident again.
When getting extents of MFT, we must be sure they are in the MFT part which
has already been mapped, otherwise we fall into an endless recursion.
Situations have been met where extents locations are described in themselves,
as a consequence of a bug, probably unrelated to ntfs-3g.
This is a severe error which chkdsk cannot fix.
