Hi Jean-Pierre,
On 24.09.2013 16:15, Jean-Pierre André wrote:
>> Do and of you have a clue what could be happening here and how to fix it?
>
> This all shows that you cannot access files whose inode
> number is greater or equal 58368. Instead of the expected
> magic number there is a random (or encrypted) value. I see
> that TrueCrypt is inode 58065, which tends to mean you have
> encrypted files which were created since May 25th keeping
> former files unencrypted.
I agree with you that instead of the magic value it finds some garbage,
but I cannot imagine how it could be encrypted: I use full-disk
encryption and try to mount the *decrypted* device-mapper device
(/dev/mapper/truecrypt1), i.e. this is a 1:1 mapping of the original
block-device with all content already decrypted. So ntfs3g actually
doesn't even know that it's an encypted device
> As a first step, please post the formatting parameters
> and the MFT data, which you get (as root, from
> unmounted partition) from :
>
> ntfsinfo -fm /dev/mapper/truecrypt1
Volume Information
Name of device: /dev/mapper/truecrypt1
Device state: 11
Volume Name:
Volume State: 91
Volume Flags: 0x0000
Volume Version: 3.1
Sector Size: 512
Cluster Size: 4096
Index Block Size: 4096
Volume Size in Clusters: 115199999
MFT Information
MFT Record Size: 1024
MFT Zone Multiplier: 0
MFT Data Position: 24
MFT Zone Start: 786432
MFT Zone End: 15186431
MFT Zone Position: 786432
Current Position in First Data Zone: 15186431
Current Position in Second Data Zone: 0
Allocated clusters 51584 (0,0%)
LCN of Data Attribute for FILE_MFT: 786432
FILE_MFTMirr Size: 4
LCN of Data Attribute for File_MFTMirr: 2
Size of Attribute Definition Table: 2560
Number of Attached Extent Inodes: 0
FILE_Bitmap Information
FILE_Bitmap MFT Record Number: 6
State of FILE_Bitmap Inode: 80
Length of Attribute List: 0
Number of Attached Extent Inodes: 0
FILE_Bitmap Data Attribute Information
Decompressed Runlist: not done yet
Base Inode: 6
Attribute Types: not done yet
Attribute Name Length: 0
Attribute State: 3
Attribute Allocated Size: 14401536
Attribute Data Size: 14400000
Attribute Initialized Size: 14400000
Attribute Compressed Size: 0
Compression Block Size: 0
Compression Block Size Bits: 0
Compression Block Clusters: 0
Free Clusters: 51193769 (44,4%)
> ntfsinfo -fvi 0 /dev/mapper/truecrypt1
Dumping Inode 0 (0x0)
Upd. Seq. Array Off.: 48 (0x30)
Upd. Seq. Array Count: 3 (0x3)
Upd. Seq. Number: 49870 (0xc2ce)
LogFile Seq. Number: 0x1342ba614
MFT Record Seq. Numb.: 1 (0x1)
Number of Hard Links: 1 (0x1)
Attribute Offset: 56 (0x38)
MFT Record Flags: IN_USE
Bytes Used: 416 (0x1a0) bytes
Bytes Allocated: 1024 (0x400) bytes
Next Attribute Instance: 7 (0x7)
MFT Padding: 00 00
Dumping attribute $STANDARD_INFORMATION (0x10) from mft record 0 (0x0)
Attribute length: 96 (0x60)
Resident: Yes
Name length: 0 (0x0)
Name offset: 24 (0x18)
Attribute flags: 0x0000
Attribute instance: 0 (0x0)
Data size: 72 (0x48)
Data offset: 24 (0x18)
Resident flags: 0x00
ReservedR: 0 (0x0)
File Creation Time: Mon Jan 1 00:00:00 1601 UTC
File Altered Time: Mon Jan 1 00:00:00 1601 UTC
MFT Changed Time: Mon Jan 1 00:00:00 1601 UTC
Last Accessed Time: Mon Jan 1 00:00:00 1601 UTC
File attributes: HIDDEN SYSTEM (0x00000006)
Maximum versions: 0
Version number: 0
Class ID: 0
User ID: 0 (0x0)
Security ID: 0 (0x0)
Quota charged: 0 (0x0)
Update Sequence Number: 0 (0x0)
Dumping attribute $FILE_NAME (0x30) from mft record 0 (0x0)
Attribute length: 104 (0x68)
Resident: Yes
Name length: 0 (0x0)
Name offset: 24 (0x18)
Attribute flags: 0x0000
Attribute instance: 3 (0x3)
Data size: 74 (0x4a)
Data offset: 24 (0x18)
Resident flags: 0x01
ReservedR: 0 (0x0)
Parent directory: 5 (0x5)
File Creation Time: Mon Jan 1 00:00:00 1601 UTC
File Altered Time: Mon Jan 1 00:00:00 1601 UTC
MFT Changed Time: Mon Jan 1 00:00:00 1601 UTC
Last Accessed Time: Mon Jan 1 00:00:00 1601 UTC
Allocated Size: 211288064 (0xc980000)
Data Size: 211288064 (0xc980000)
Filename Length: 4 (0x4)
File attributes: HIDDEN SYSTEM (0x00000006)
Namespace: Win32 & DOS
Filename: '$MFT'
Dumping attribute $DATA (0x80) from mft record 0 (0x0)
Attribute length: 80 (0x50)
Resident: No
Name length: 0 (0x0)
Name offset: 64 (0x40)
Attribute flags: 0x0000
Attribute instance: 1 (0x1)
Lowest VCN 0 (0x0)
Highest VCN: 51583 (0xc97f)
Mapping pairs offset: 64 (0x40)
Compression unit: 0 (0x0)
Data size: 211288064 (0xc980000)
Allocated size: 211288064 (0xc980000)
Initialized size: 211288064 (0xc980000)
Runlist: VCN LCN Length
0x0 0xc0000 0x3900
0x3900 0x479d20a 0x9080
Dumping attribute $BITMAP (0xb0) from mft record 0 (0x0)
Attribute length: 72 (0x48)
Resident: No
Name length: 0 (0x0)
Name offset: 64 (0x40)
Attribute flags: 0x0000
Attribute instance: 6 (0x6)
Lowest VCN 0 (0x0)
Highest VCN: 6 (0x6)
Mapping pairs offset: 64 (0x40)
Compression unit: 0 (0x0)
Data size: 25792 (0x64c0)
Allocated size: 28672 (0x7000)
Initialized size: 25792 (0x64c0)
Runlist: VCN LCN Length
0x0 0x73355 0x7
End of inode reached
Total runs: 3 (fragments: 3)
> I would also like to know the physical sector size.
That's 512 bytes.
All partitions are (at least) 4096-byte aligned, however (don't know if
that matters or not).
> It would also be useful to know the history of this
> partition :
>
> - how was it formatted ? (Bastille Day 2009 tends to
> mean Windows 7)
Yes, Windows 7 professional, the disk was formatted during the
installation phase.
> - how was it encrypted ? (can it be partially encrypted) ?
It is encrypted using full-disk-encryption, i.e. the complete system
(including all partitions on that device) are encrypted.
> - are you using the same TrueCrypt version and the
> same key on Window and Linux ?
Yes, 7.1a.
> - what is "the installation of the OS" ? (reinstallation
> of Windows ? of Linux ?)
I meant the installation of the Windows OS on that disk. Everything in
the "early" age of the disk appears to be fine, while (as you also
noted) everything in the later age of the disk is not readable by ntfs3g.
Most curiously to me is that all content access works perfectly from
within Windows and the Windows chkdsk program doesn't find any errors on
the disk.
Best regards,
Johannes
------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60133471&iu=/4140/ostg.clktrk
_______________________________________________
ntfs-3g-devel mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/ntfs-3g-devel
