Eric Biggers wrote:
> Hi,
>
> I had a report of a file's data disappearing when an NTFS volume was archived
> using wimlib, which uses libntfs-3g to read from NTFS volumes. What seems to
> have happened is that libntfs-3g reported two unnamed data streams for a file:
> one nonempty and one empty, and wimlib happened to store the empty one
> (arbitrarily).
>
> Is it an expected or valid case for a file to have more than one unnamed data
> stream like this? When and how might this happen?
This is wrong, there should be at most one unnamed
data stream.
> If it's relevant: in wimlib I am basically doing something like this:
>
> ntfs_attr_search_ctx *actx = ntfs_attr_get_search_ctx(ni, NULL);
>
> while (!ntfs_attr_lookup(AT_DATA, NULL, 0, CASE_SENSITIVE, 0, NULL, 0,
> actx))
> {
> ATTR_RECORD *record = actx->attr;
> u32 name_nchars = record->name_length;
> ntfschar *name = (ntfschar *) ((u8 *)record +
> le16_to_cpu(record->name_offset));
>
> if (name_chars == 0) {
> /* unnamed stream... */
> } else {
> /* named stream... */
> }
> }
As far as I can tell, this is correct for looking for all
unnamed data streams. It does not explain why two unnamed
ones were created in the first place.
Do you have information about the history of such files ?
(named data streams previously created and deleted, etc.)
> I know that for the problem to have been apparent, ntfs_attr_lookup() must
> have
> provided the nonempty version of the stream first and the empty version
> second.
ntfs_attr_lookup() returns the attributes sequentially,
so you would usually get the first one.
> This may explain why this problem isn't encountered more frequently, since
> perhaps the first matching stream is used ordinarily and the empty duplicate
> streams always appear second.
Does chkdsk detect and fix the issue ?
>
> Eric
>
> ------------------------------------------------------------------------------
> _______________________________________________
> ntfs-3g-devel mailing list
> ntfs-3g-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/ntfs-3g-devel
>
------------------------------------------------------------------------------
_______________________________________________
ntfs-3g-devel mailing list
ntfs-3g-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/ntfs-3g-devel
