Messages in this thread | | | Subject | Re: [BUG] 2.6.5 ntfs | From | Anton Altaparmakov <> | Date | Wed, 05 May 2004 14:36:07 +0100 |
| |
On Wed, 2004-05-05 at 13:32, Marcin Gibuła wrote: > > not be zero any more. Have you ever run memtest on your machine? > > I'll try to do this. > > > If you run "chkdsk /f" from windows on this partition, does it detect > > any errors? > > It doesn't.
Ok.
> > dd if=~/mymftdump of=~/inode0x78a bs=1024 count=1 skip=1930 > > > > And then email me the file ~/inode0x78a (this is only 1kiB in size). > > Here it goes.
Thanks. Analyzing this it is a highly fragmented file so it the $DATA attribute is spread over three more inodes. Could you email them to me, too please? They are 0x790 (= 1936), 0x791 (= 1937), and 0x792 (1938).
You can get them like this (assuming you are using Bash as your shell):
for i in 1936 1937 1938; do dd if=~/mymftdump of=~/inode$i bs=1024 count=1 skip=$i done
Once I have those I can uncompress the mapping pairs arrays in the data extents and ask you to capture the compressed data for me. It will be a simple script simillar to the above...
Thanks a lot for your help.
Best regards,
Anton -- Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @) Unix Support, Computing Service, University of Cambridge, CB2 3QH, UK Linux NTFS maintainer / IRC: #ntfs on irc.freenode.net WWW: http://linux-ntfs.sf.net/ & http://www-stu.christs.cam.ac.uk/~aia21/
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |