Hi Jean-Pierre, On 24.09.2013 17:40, Jean-Pierre André wrote:
> You may first confirm this by : > dd if=/dev/mapper/trycrypt1 bs=4096 skip=75092490 \ > count=1 | head -c 4 > which should return "FILE", but will probably return > some unprintable chars. Yup: # dd if=/dev/mapper/truecrypt1 bs=4096 skip=75092490 count=1 | head -c 4 | hexdump 0000000 b836 f1e9 > If the full disk was encrypted, and you can read it > partially, I assume the encryption key is correct. > However when customizing the encryption, did you > have to enter the disk size ? No, nothing of the sort. I just said "encrypt whole drive", voilà. No customizing (didn't specify any offsets, sizes, partitions, anything like that). > Actually, what I wanted to know is the sequencing > of events (formatting, encrypting, installing Windows, > installing Linux). I would like to know why the > TrueCrypt directory is just near the encryption issue, > I do not find this consistent with a full disk encryption > earlier than Windows installation. The Linux installation has always been there (for about 15 years, probably 10 years since the last reinstallation). Windows was installed fairly recently on its own drive. After the installation I routinely employ FDE by installing TrueCrypt and encrypt the whole disk (not only the partition with Windows on it, but really the whole disk). Never ran into this issue before, so maybe something really weird is going on. >> Most curiously to me is that all content access works perfectly from >> within Windows and the Windows chkdsk program doesn't find any errors on >> the disk. > > I have no explanation so far. To understand why > Windows and Linux do not get the same data, maybe > you can download a Windows version of ntfsinfo from > http://jp-andre.pagesperso-orange.fr/advanced-ntfs-3g.html#download > > and compare the outputs of > > ntfsinfo -fvi 0 /dev/mapper/truecrypt1 No difference on Windows and Linux. > ntfsinfo -fvi 58368 /dev/mapper/truecrypt1 > (this one will fail...) Linux fails: ntfs_mst_post_read_fixup_warn: magic: 0xf1e9b836 size: 1024 usa_ofs: 59978 usa_count: 60275: Invalid argument Record 58368 has no FILE magic (0xf1e9b836) Error loading node: Input/output error Windows succeeds: Dumping Inode 58368 (0xe400) Upd. Seq. Array Off.: 48 (0x30) Upd. Seq. Array Count: 3 (0x3) Upd. Seq. Number: 50 (0x32) LogFile Seq. Number: 0xd5f101b MFT Record Seq. Numb.: 7 (0x7) Number of Hard Links: 2 (0x2) Attribute Offset: 56 (0x38) MFT Record Flags: IN_USE Bytes Used: 504 (0x1f8) bytes Bytes Allocated: 1024 (0x400) bytes Next Attribute Instance: 7 (0x7) MFT Padding: 00 00 Dumping attribute $STANDARD_INFORMATION (0x10) from mft record 58368 (0xe400) Attribute length: 96 (0x60) Resident: Yes Name length: 0 (0x0) Name offset: 0 (0x0) Attribute flags: 0x0000 Attribute instance: 0 (0x0) Data size: 72 (0x48) Data offset: 24 (0x18) Resident flags: 0x00 ReservedR: 0 (0x0) File Creation Time: Sun May 26 16:46:42 2013 UTC File Altered Time: Sun May 26 16:46:42 2013 UTC MFT Changed Time: Sun May 26 16:46:42 2013 UTC Last Accessed Time: Sun May 26 16:46:42 2013 UTC File attributes: ARCHIVE (0x00000020) Maximum versions: 0 Version number: 0 Class ID: 0 User ID: 0 (0x0) Security ID: 483 (0x1e3) Quota charged: 0 (0x0) Update Sequence Number: 24629840 (0x177d250) Dumping attribute $FILE_NAME (0x30) from mft record 58368 (0xe400) Attribute length: 120 (0x78) Resident: Yes Name length: 0 (0x0) Name offset: 0 (0x0) Attribute flags: 0x0000 Attribute instance: 6 (0x6) Data size: 90 (0x5a) Data offset: 24 (0x18) Resident flags: 0x01 ReservedR: 0 (0x0) Parent directory: 58640 (0xe510) File Creation Time: Sun May 26 16:46:42 2013 UTC File Altered Time: Sun May 26 16:46:42 2013 UTC MFT Changed Time: Sun May 26 16:46:42 2013 UTC Last Accessed Time: Sun May 26 16:46:42 2013 UTC Allocated Size: 225280 (0x37000) Data Size: 223744 (0x36a00) Filename Length: 12 (0xc) File attributes: ARCHIVE (0x00000020) Namespace: DOS Filename: 'SYSTEM~1.DLL' Dumping attribute $FILE_NAME (0x30) from mft record 58368 (0xe400) Attribute length: 152 (0x98) Resident: Yes Name length: 0 (0x0) Name offset: 0 (0x0) Attribute flags: 0x0000 Attribute instance: 5 (0x5) Data size: 122 (0x7a) Data offset: 24 (0x18) Resident flags: 0x01 ReservedR: 0 (0x0) Parent directory: 58640 (0xe510) File Creation Time: Sun May 26 16:46:42 2013 UTC File Altered Time: Sun May 26 16:46:42 2013 UTC MFT Changed Time: Sun May 26 16:46:42 2013 UTC Last Accessed Time: Sun May 26 16:46:42 2013 UTC Allocated Size: 225280 (0x37000) Data Size: 223744 (0x36a00) Filename Length: 28 (0x1c) File attributes: ARCHIVE (0x00000020) Namespace: Win32 Filename: 'System.Drawing.Design.ni.dll' Dumping attribute $DATA (0x80) from mft record 58368 (0xe400) Attribute length: 72 (0x48) Resident: No Name length: 0 (0x0) Name offset: 0 (0x0) Attribute flags: 0x0000 Attribute instance: 4 (0x4) Lowest VCN 0 (0x0) Highest VCN: 54 (0x36) Mapping pairs offset: 64 (0x40) Compression unit: 0 (0x0) Data size: 223744 (0x36a00) Allocated size: 225280 (0x37000) Initialized size: 223744 (0x36a00) Runlist: VCN LCN Length 0x0 0x11c18c 0x37 End of inode reached Total runs: 1 (fragments: 1) Same thing for inode 60166; Linux: ntfs_mst_post_read_fixup_warn: magic: 0xa0b1926a size: 1024 usa_ofs: 47168 usa_count: 36485: Invalid argument Record 60166 has no FILE magic (0xa0b1926a) Error loading node: Input/output error and Windows: Dumping Inode 60166 (0xeb06) Upd. Seq. Array Off.: 48 (0x30) Upd. Seq. Array Count: 3 (0x3) Upd. Seq. Number: 10 (0xa) LogFile Seq. Number: 0x15598dee MFT Record Seq. Numb.: 2 (0x2) Number of Hard Links: 2 (0x2) Attribute Offset: 56 (0x38) MFT Record Flags: IN_USE DIRECTORY Bytes Used: 608 (0x260) bytes Bytes Allocated: 1024 (0x400) bytes Next Attribute Instance: 7 (0x7) MFT Padding: 00 00 Dumping attribute $STANDARD_INFORMATION (0x10) from mft record 60166 (0xeb06) Attribute length: 96 (0x60) Resident: Yes Name length: 0 (0x0) Name offset: 0 (0x0) Attribute flags: 0x0000 Attribute instance: 0 (0x0) Data size: 72 (0x48) Data offset: 24 (0x18) Resident flags: 0x00 ReservedR: 0 (0x0) File Creation Time: Sun May 26 11:52:58 2013 UTC File Altered Time: Sun May 26 11:54:25 2013 UTC MFT Changed Time: Sun May 26 11:54:25 2013 UTC Last Accessed Time: Sun May 26 11:54:25 2013 UTC File attributes: (0x00000000) Maximum versions: 0 Version number: 0 Class ID: 0 User ID: 0 (0x0) Security ID: 278 (0x116) Quota charged: 0 (0x0) Update Sequence Number: 18196544 (0x115a840) Dumping attribute $FILE_NAME (0x30) from mft record 60166 (0xeb06) Attribute length: 112 (0x70) Resident: Yes Name length: 0 (0x0) Name offset: 0 (0x0) Attribute flags: 0x0000 Attribute instance: 3 (0x3) Data size: 82 (0x52) Data offset: 24 (0x18) Resident flags: 0x01 ReservedR: 0 (0x0) Parent directory: 60 (0x3c) File Creation Time: Sun May 26 11:52:58 2013 UTC File Altered Time: Sun May 26 11:52:58 2013 UTC MFT Changed Time: Sun May 26 11:52:58 2013 UTC Last Accessed Time: Sun May 26 11:52:58 2013 UTC Allocated Size: 0 (0x0) Data Size: 0 (0x0) Filename Length: 8 (0x8) File attributes: I30_INDEX (0x10000000) Namespace: DOS Filename: 'NVIDIA~1' Dumping attribute $FILE_NAME (0x30) from mft record 60166 (0xeb06) Attribute length: 128 (0x80) Resident: Yes Name length: 0 (0x0) Name offset: 0 (0x0) Attribute flags: 0x0000 Attribute instance: 2 (0x2) Data size: 102 (0x66) Data offset: 24 (0x18) Resident flags: 0x01 ReservedR: 0 (0x0) Parent directory: 60 (0x3c) File Creation Time: Sun May 26 11:52:58 2013 UTC File Altered Time: Sun May 26 11:52:58 2013 UTC MFT Changed Time: Sun May 26 11:52:58 2013 UTC Last Accessed Time: Sun May 26 11:52:58 2013 UTC Allocated Size: 0 (0x0) Data Size: 0 (0x0) Filename Length: 18 (0x12) File attributes: I30_INDEX (0x10000000) Namespace: Win32 Filename: 'NVIDIA Corporation' Dumping attribute $INDEX_ROOT (0x90) from mft record 60166 (0xeb06) Attribute length: 88 (0x58) Resident: Yes Name length: 4 (0x4) Name offset: 24 (0x18) Attribute name: '$I30' Attribute flags: 0x0000 Attribute instance: 6 (0x6) Data size: 56 (0x38) Data offset: 32 (0x20) Resident flags: 0x00 ReservedR: 0 (0x0) Indexed Attr Type: DIRECTORY_I30 Collation Rule: 1 (0x1) Index Block Size: 4096 (0x1000) Clusters Per Block: 1 (0x1) Entries Offset: 16 (0x10) Index Size: 40 (0x28) Allocated Size: 40 (0x28) Index header flags: 0x01 Dumping index root: Entry length: 24 (0x18) Key length: 0 (0x0) Index entry flags: 0x03 Subnode VCN: 0 (0x0) End of index block reached Index entries total: 1 Dumping attribute $INDEX_ALLOCATION (0xa0) from mft record 60166 (0xeb06) Attribute length: 80 (0x50) Resident: No Name length: 4 (0x4) Name offset: 64 (0x40) Attribute name: '$I30' Attribute flags: 0x0000 Attribute instance: 4 (0x4) Lowest VCN 0 (0x0) Highest VCN: 0 (0x0) Mapping pairs offset: 72 (0x48) Compression unit: 0 (0x0) Data size: 4096 (0x1000) Allocated size: 4096 (0x1000) Initialized size: 4096 (0x1000) Runlist: VCN LCN Length 0x0 0x6f2 0x1 Dumping index block: Upd. Seq. Array Off.: 40 (0x28) Upd. Seq. Array Count: 9 (0x9) Upd. Seq. Number: 2 (0x2) LogFile Seq. Number: 0xc550568 Node VCN: 0 (0x0) Entries Offset: 40 (0x28) Index Size: 976 (0x3d0) Allocated Size: 4072 (0xfe8) Index header flags: 0x00 Entry length: 128 (0x80) Key length: 106 (0x6a) Index entry flags: 0x00 FILE record number: 61129 (0xeec9) Parent directory: 60166 (0xeb06) File Creation Time: Sun May 26 11:54:25 2013 UTC File Altered Time: Sun May 26 11:54:26 2013 UTC MFT Changed Time: Sun May 26 11:54:26 2013 UTC Last Accessed Time: Sun May 26 11:54:26 2013 UTC Allocated Size: 0 (0x0) Data Size: 0 (0x0) Filename Length: 20 (0x14) File attributes: I30_INDEX (0x10000000) Namespace: Win32 Filename: 'Control Panel Client' Entry length: 104 (0x68) Key length: 82 (0x52) Index entry flags: 0x00 FILE record number: 61129 (0xeec9) Parent directory: 60166 (0xeb06) File Creation Time: Sun May 26 11:54:25 2013 UTC File Altered Time: Sun May 26 11:54:26 2013 UTC MFT Changed Time: Sun May 26 11:54:26 2013 UTC Last Accessed Time: Sun May 26 11:54:26 2013 UTC Allocated Size: 0 (0x0) Data Size: 0 (0x0) Filename Length: 8 (0x8) File attributes: I30_INDEX (0x10000000) Namespace: DOS Filename: 'CONTRO~1' Entry length: 96 (0x60) Key length: 80 (0x50) Index entry flags: 0x00 FILE record number: 61130 (0xeeca) Parent directory: 60166 (0xeb06) File Creation Time: Sun May 26 11:54:25 2013 UTC File Altered Time: Sun May 26 11:54:27 2013 UTC MFT Changed Time: Sun May 26 11:54:27 2013 UTC Last Accessed Time: Sun May 26 11:54:27 2013 UTC Allocated Size: 0 (0x0) Data Size: 0 (0x0) Filename Length: 7 (0x7) File attributes: I30_INDEX (0x10000000) Namespace: Win32 & DOS Filename: 'Display' Entry length: 88 (0x58) Key length: 72 (0x48) Index entry flags: 0x00 FILE record number: 36813 (0x8fcd) Parent directory: 60166 (0xeb06) File Creation Time: Sun May 26 11:54:04 2013 UTC File Altered Time: Sun May 26 11:54:04 2013 UTC MFT Changed Time: Sun May 26 11:54:04 2013 UTC Last Accessed Time: Sun May 26 11:54:04 2013 UTC Allocated Size: 0 (0x0) Data Size: 0 (0x0) Filename Length: 3 (0x3) File attributes: I30_INDEX (0x10000000) Namespace: Win32 & DOS Filename: 'Drs' Entry length: 104 (0x68) Key length: 86 (0x56) Index entry flags: 0x00 FILE record number: 60167 (0xeb07) Parent directory: 60166 (0xeb06) File Creation Time: Sun May 26 11:52:58 2013 UTC File Altered Time: Sun May 26 11:54:23 2013 UTC MFT Changed Time: Sun May 26 11:54:23 2013 UTC Last Accessed Time: Sun May 26 11:54:23 2013 UTC Allocated Size: 0 (0x0) Data Size: 0 (0x0) Filename Length: 10 (0xa) File attributes: I30_INDEX (0x10000000) Namespace: Win32 Filename: 'Installer2' Entry length: 104 (0x68) Key length: 82 (0x52) Index entry flags: 0x00 FILE record number: 60167 (0xeb07) Parent directory: 60166 (0xeb06) File Creation Time: Sun May 26 11:52:58 2013 UTC File Altered Time: Sun May 26 11:54:23 2013 UTC MFT Changed Time: Sun May 26 11:54:23 2013 UTC Last Accessed Time: Sun May 26 11:54:23 2013 UTC Allocated Size: 0 (0x0) Data Size: 0 (0x0) Filename Length: 8 (0x8) File attributes: I30_INDEX (0x10000000) Namespace: DOS Filename: 'INSTAL~1' Entry length: 104 (0x68) Key length: 88 (0x58) Index entry flags: 0x00 FILE record number: 36825 (0x8fd9) Parent directory: 60166 (0xeb06) File Creation Time: Sun May 26 11:53:39 2013 UTC File Altered Time: Sun May 12 21:42:27 2013 UTC MFT Changed Time: Sun May 26 11:54:04 2013 UTC Last Accessed Time: Sun May 26 11:53:39 2013 UTC Allocated Size: 24576 (0x6000) Data Size: 21898 (0x558a) Filename Length: 11 (0xb) File attributes: ARCHIVE (0x00000020) Namespace: Win32 & DOS Filename: 'license.txt' Entry length: 96 (0x60) Key length: 76 (0x4c) Index entry flags: 0x00 FILE record number: 36829 (0x8fdd) Parent directory: 60166 (0xeb06) File Creation Time: Sun May 26 11:54:04 2013 UTC File Altered Time: Sun May 26 11:54:04 2013 UTC MFT Changed Time: Sun May 26 11:54:04 2013 UTC Last Accessed Time: Sun May 26 11:54:04 2013 UTC Allocated Size: 0 (0x0) Data Size: 0 (0x0) Filename Length: 5 (0x5) File attributes: I30_INDEX (0x10000000) Namespace: Win32 & DOS Filename: 'NVSMI' Entry length: 96 (0x60) Key length: 78 (0x4e) Index entry flags: 0x00 FILE record number: 40815 (0x9f6f) Parent directory: 60166 (0xeb06) File Creation Time: Sun May 26 11:54:04 2013 UTC File Altered Time: Sun May 26 11:54:04 2013 UTC MFT Changed Time: Sun May 26 11:54:04 2013 UTC Last Accessed Time: Sun May 26 11:54:04 2013 UTC Allocated Size: 0 (0x0) Data Size: 0 (0x0) Filename Length: 6 (0x6) File attributes: I30_INDEX (0x10000000) Namespace: Win32 & DOS Filename: 'OpenCL' Entry length: 16 (0x10) Key length: 0 (0x0) Index entry flags: 0x02 End of index block reached Index entries: 10 Index entries total: 10 INDX blocks total: 1 Dumping attribute $BITMAP (0xb0) from mft record 60166 (0xeb06) Attribute length: 40 (0x28) Resident: Yes Name length: 4 (0x4) Name offset: 24 (0x18) Attribute name: '$I30' Attribute flags: 0x0000 Attribute instance: 5 (0x5) Data size: 8 (0x8) Data offset: 32 (0x20) Resident flags: 0x00 ReservedR: 0 (0x0) End of inode reached Total runs: 1 (fragments: 1) > If this succeeds, the issue does not lie in ntfs-3g... Jean-Pierre, I sincerely thank you for helping me with this one and I agree that the problem doesn't lie within ntfs-3g. I'll try to track it down on the Truecrypt mailing list and see if I have any luck there. Thank you again for the help, Best regards, Joe ------------------------------------------------------------------------------ October Webinars: Code for Performance Free Intel webinars can help you accelerate application performance. Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from the latest Intel processors and coprocessors. See abstracts and register > http://pubads.g.doubleclick.net/gampad/clk?id=60133471&iu=/4140/ostg.clktrk _______________________________________________ ntfs-3g-devel mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/ntfs-3g-devel
