Am Sunday 14 October 2012 10:56:58 schrieb Jean-Pierre André: > > > > Hi, > > > > Thanks for your quick reply. > > There's no rush with this problem. I need the data at some point but not > > immediately. > > > > > > First off, i was wrong about the lseek-offset. > > The correct offset it tries to seek to is "4503599627370496" (decimal) or > > 0x10000000000000 (i was missing a few "0"'s) > > The partition is of course not of *THAT* size. I tried serveral partition > > sizes (the harddisk itself is bigger). I tried both sizes ntfsclone > > reported (628592312320 bytes and 628592315904 bytes) as well as 700 GiB > > and a few other. > > The "Variant 1" always fails with the lseek-problem. > > Variant 1 strace log file: http://www.sbsw.net/ntfsclone.strace.gz > > The image is corrupted. > > See from line 219238 in the strace file : > > read(3, > "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., > 4096) = 4096 > write(4, > "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., > 4096) = 4096 > read(3, "\0", 1) = 1 > read(3, "\0\0\0\0\0\0\0\0", 8) = 8 > lseek(4, 0, SEEK_CUR) = 297283584 > read(3, "\0", 1) = 1 > read(3, "\0\0\0\0\0\0\0\0", 8) = 8 > lseek(4, 0, SEEK_CUR) = 297283584 > > From there on, there is a succession of reading one > byte whose value is 0, which means skipping in the > output partition the number of clusters shown in the > next eight bytes. The subsequent reading of eight > bytes yields zero clusters to skip, which is obviously > wrong, and leads to repeat the seek to 297283584. > > At least ntfsclone should check the invalid input.... > > Now, based on the strace output, I can determine > where the corruption is in the input file : > > at 297221153 0x11b73c21 : read(3, "\1", 1) = 1 > at 297221154 0x11b73c22 : read(3, > "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., > 4096) = 4096 > at 297225250 0x11b74c22 : read(3, "\1", 1) = 1 > at 297225251 0x11b74c23 : read(3, > "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., > 4096) = 4096 > at 297229347 0x11b75c23 : read(3, "\0", 1) = 1 > at 297229348 0x11b75c24 : read(3, "\0\0\0\0\0\0\0\0", 8) = 8 > > Reading at 0x11b74c22 yields a byte with value 1 and > a reasonable cluster filled with 4096 zeroes. > At 0x11b75c23 there is a byte with value 0 followed by > a count of zero clusters to skip. This is wrong. > > There are apparently a lot of zeroes after that. > > However at 0x11b76c24 I see another byte with value > 1, and similarly at 0x11b77c25 and 0x11b78c26 > So, from 0x11b76c24 there are valid cluster descriptions > (value 1 followed by 4096 bytes). > > Seeing the sequence 0x11b74c22, 0x11b75c23 (error), > 0x11b76c24, 0x11b77c25 and 0x11b78c26, which would > designate a valid sequence if the byte at 0x11b75c23 > would be a 1, I would suggest the error is simply > getting a 0 there instead of the expected 1. > > For rescuing the image, I would suggest : > > 1) check that there is indeed a 1 byte at offsets > 0x11b74c22, 0x11b76c24, 0x11b77c25 and 0x11b78c26 > and that there is a zero byte at offset 0x11b75c23 > > 2) if so, insert a 1 at 0x11b75c23 and retry. > Of course better make another copy of image before > that... > > Note : better retry with variant 1 which gives an > immediate error, and stracing may help if there are > other similar bugs. > > If successful, I will ask you later to do another backup > to try to identify the source of the corruption. > > Regards > > Jean-Pierre
Hi Jean-Pierre, Thanks a lot for your help so far. I applied the patch to ntfsclone, and also modified the image file as you suggested. 0x11b74c22, 0x11b76c24, 0x11b77c25 and 0x11b78c26 had indeed a 0x1 byte. And 0x11b75c23 was 0x0. I then modified the image so that 0x11b75c23 is now 0x1. ntfsclone now restores more of the image, but still aborts at around 0.47% Output: ntfsclone v2012.1.15 (libntfs-3g) Ntfsclone image version: 10.1 Cluster size : 4096 bytes Image volume size : 628592312320 bytes (628593 MB) Image device size : 628592315904 bytes Space in use : 285916 MB (45,5%) Offset to image data : 56 (0x38) bytes Restoring NTFS from image ... ERROR: restore_image: corrupt image I uploaded the new strace log file at http://www.sbsw.net/ntfsclone.strace-2.gz (the old one is also still there in case you need it again) - Simon ------------------------------------------------------------------------------ Everyone hates slow websites. So do we. Make your web apps faster with AppDynamics Download AppDynamics Lite for free today: http://p.sf.net/sfu/appdyn_sfd2d_oct _______________________________________________ ntfs-3g-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/ntfs-3g-devel
