I wrote a tool that lists the exact locations of a file's extents within an NTFS partition, which we can then use as a block-list for a new block device, gaining access to the file contents without filesystem layer overhead.
My own requirements also need the file to be not encrypted, not compressed, nor sparse, those are also encoded here. Is there interest in having something similar to this included in ntfs-3g? Thanks Daniel Index: ntfs-3g_ntfsprogs-2016.2.22/ntfsprogs/Makefile.am =================================================================== --- ntfs-3g_ntfsprogs-2016.2.22.orig/ntfsprogs/Makefile.am +++ ntfs-3g_ntfsprogs-2016.2.22/ntfsprogs/Makefile.am @@ -14,7 +14,9 @@ LINK=$(STATIC_LINK) $(LIBTOOL_LINK) if ENABLE_NTFSPROGS -bin_PROGRAMS = ntfsfix ntfsinfo ntfscluster ntfsls ntfscat ntfscmp +bin_PROGRAMS = ntfsfix ntfsinfo ntfscluster ntfsls ntfscat ntfscmp \ + ntfsextents + sbin_PROGRAMS = mkntfs ntfslabel ntfsundelete ntfsresize ntfsclone \ ntfscp EXTRA_PROGRAM_NAMES = ntfswipe ntfstruncate ntfsrecover @@ -106,6 +108,10 @@ ntfsrecover_SOURCES = playlog.c ntfsreco ntfsrecover_LDADD = $(AM_LIBS) $(NTFSRECOVER_LIBS) ntfsrecover_LDFLAGS = $(AM_LFLAGS) +ntfsextents_SOURCES = ntfsextents.c utils.c utils.h +ntfsextents_LDADD = $(AM_LIBS) +ntfsextents_LDFLAGS = $(AM_LFLAGS) + # We don't distribute these ntfstruncate_SOURCES = attrdef.c ntfstruncate.c utils.c utils.h Index: ntfs-3g_ntfsprogs-2016.2.22/ntfsprogs/ntfsextents.c =================================================================== --- /dev/null +++ ntfs-3g_ntfsprogs-2016.2.22/ntfsprogs/ntfsextents.c @@ -0,0 +1,126 @@ +/** + * ntfsextents - Part of the Linux-NTFS project. + * + * Copyright (c) 2016 Endless Mobile, Inc. + * + * This utility will list each extent of a file: + * the start offset in the media, and the extent length (both in bytes) + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program (in the main directory of the Linux-NTFS + * distribution in the file COPYING); if not, write to the Free Software + * Foundation,Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ +#include "config.h" + +#ifdef HAVE_STDIO_H +#include <stdio.h> +#endif +#ifdef HAVE_STDLIB_H +#include <stdlib.h> +#endif + +#include "types.h" +#include "volume.h" +#include "dir.h" +#include "utils.h" + +int main(int argc, const char *argv[]) +{ + int ret = 1; + ntfs_volume *vol; + ntfs_inode *ni; + ntfs_attr *na; + runlist_element *rl; + s64 remaining; + + ntfs_log_set_handler(ntfs_log_handler_stderr); + + if (argc < 3) { + ntfs_log_info("\nUsage: %s device file\n", argv[0]); + return 2; + } + + vol = utils_mount_volume(argv[1], NTFS_MNT_RDONLY); + if (!vol) { + ntfs_log_perror("ERROR: couldn't mount volume"); + return 1; + } + + ni = ntfs_pathname_to_inode(vol, NULL, argv[2]); + if (!ni) { + ntfs_log_perror("ERROR: Couldn't open inode"); + goto out; + } + + na = ntfs_attr_open(ni, AT_DATA, NULL, 0); + if (!na) { + ntfs_log_error("ERROR: Couldn't open data attribute\n"); + goto out; + } + + if (!NAttrNonResident(na)) { + ntfs_log_error("ERROR: File data is inode-resident\n"); + goto out; + } + + if (NAttrEncrypted(na)) { + ntfs_log_error("ERROR: File is encrypted\n"); + goto out; + } + + if ((na->data_flags & ATTR_COMPRESSION_MASK) == ATTR_IS_COMPRESSED) { + ntfs_log_error("ERROR: File data is compressed\n"); + goto out; + } + + rl = ntfs_attr_find_vcn(na, 0); + if (!rl) { + ntfs_log_error("ERROR: Couldn't find vcn\n"); + goto out; + } + + for (remaining = na->data_size; remaining; rl++) { + unsigned long data_size; + + if (rl->lcn == LCN_RL_NOT_MAPPED) { + rl = ntfs_attr_find_vcn(na, rl->vcn); + if (!rl) { + if (errno == ENOENT) + ntfs_log_error("ERROR: Failed to find VCN #2\n"); + goto out; + } + } + if (!rl->length) { + ntfs_log_error("ERROR: Zero run length\n"); + goto out; + } + if (rl->lcn < (LCN)0) { + if (rl->lcn != (LCN)LCN_HOLE) { + ntfs_log_error("ERROR: Bad run (%lld)\n", (long long)rl->lcn); + goto out; + } + ntfs_log_error("ERROR: File has hole\n"); + goto out; + } + data_size = min(remaining, rl->length << vol->cluster_size_bits); + printf("%ld %ld\n", rl->lcn << vol->cluster_size_bits, data_size); + remaining -= data_size; + } + + ret = 0; +out: + ntfs_inode_close(ni); + ntfs_umount(vol, FALSE); + return ret; +} ------------------------------------------------------------------------------ What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic patterns at an interface-level. Reveals which users, apps, and protocols are consuming the most bandwidth. Provides multi-vendor support for NetFlow, J-Flow, sFlow and other flows. Make informed decisions using capacity planning reports. http://sdm.link/zohodev2dev _______________________________________________ ntfs-3g-devel mailing list ntfs-3g-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/ntfs-3g-devel