Re: [BUG] 2.6.5 ntfs

[Anton Altaparmakov <aia21@cam.ac.uk>]

On Wed, 2004-05-05 at 13:32, Marcin Gibuła wrote:
> > not be zero any more.  Have you ever run memtest on your machine?
> 
> I'll try to do this.
> 
> > If you run "chkdsk /f" from windows on this partition, does it detect
> > any errors?
> 
> It doesn't.

Ok.

> > dd if=~/mymftdump of=~/inode0x78a bs=1024 count=1 skip=1930
> >
> > And then email me the file ~/inode0x78a (this is only 1kiB in size).
> 
> Here it goes.

Thanks.  Analyzing this it is a highly fragmented file so it the $DATA
attribute is spread over three more inodes.  Could you email them to me,
too please?  They are 0x790 (= 1936), 0x791 (= 1937), and 0x792 (1938).

You can get them like this (assuming you are using Bash as your shell):

for i in 1936 1937 1938; do
	dd if=~/mymftdump of=~/inode$i bs=1024 count=1 skip=$i
done

Once I have those I can uncompress the mapping pairs arrays in the data
extents and ask you to capture the compressed data for me.  It will be a
simple script simillar to the above...

Thanks a lot for your help.

Best regards,

	Anton
-- 
Anton Altaparmakov <aia21 at cam.ac.uk> (replace at with @)
Unix Support, Computing Service, University of Cambridge, CB2 3QH, UK
Linux NTFS maintainer / IRC: #ntfs on irc.freenode.net
WWW: http://linux-ntfs.sf.net/ &
http://www-stu.christs.cam.ac.uk/~aia21/