Hi,
I am afraid this is bad news. The contents of your file
is not sitting in this computer (at least not in this file
system).
This is a sparse file with none of the 2320694 bytes of
the file. The contents lies in a remote cloud server.
There are only a "ms-properties" record which probably
is a reference to the remote file, and a ms-thumbnail"
record (14345 bytes) which could be an icon to select the
file.
As this is using an obsolete methodology, I can only think
of two ways out, provided you have some information about
the account under which the data is stored :
- configuring the cloud server on a Windows 8.1 computer
- finding some tool to convert the access mode to a more
recent one (OneDrive).
So, the solution is more likely to reside in the Microsoft/Windows
world rather than in the Linux one.
I am sorry to not be able to provide more help. Good luck.
Jean-Pierre
Rashid N. Achilov wrote on 9/10/20 1:18 PM:
Hi.
I am that person, which detected at our corporate backups (which did
done at 2016 under Windows) reparse point with tag 0x80000015.
I have hundred files with this reparse point, any of these lies at
'OneDrive' subdir and possibly related to it.
ntfsinfo with verbose switch on shows this:
Dumping Inode 507809 (0x7bfa1)
Upd. Seq. Array Off.: 48 (0x30)
Upd. Seq. Array Count: 3 (0x3)
Upd. Seq. Number: 6 (0x6)
LogFile Seq. Number: 0x1d634644
MFT Record Seq. Numb.: 1 (0x1)
Number of Hard Links: 1 (0x1)
Attribute Offset: 56 (0x38)
MFT Record Flags: IN_USE
Bytes Used: 648 (0x288) bytes
Bytes Allocated: 1024 (0x400) bytes
Next Attribute Instance: 7 (0x7)
MFT Padding: 00 00
Dumping attribute $STANDARD_INFORMATION (0x10) from mft record 507809
(0x7bfa1)
Attribute length: 96 (0x60)
Resident: Yes
Name length: 0 (0x0)
Name offset: 0 (0x0)
Attribute flags: 0x0000
Attribute instance: 0 (0x0)
Data size: 72 (0x48)
Data offset: 24 (0x18)
Resident flags: 0x00
ReservedR: 0 (0x0)
File Creation Time: Wed Dec 14 11:51:27 2016 UTC
File Altered Time: Sat Nov 1 12:57:33 2014 UTC
MFT Changed Time: Wed Dec 14 11:51:27 2016 UTC
Last Accessed Time: Wed Dec 14 11:51:27 2016 UTC
File attributes: HIDDEN SYSTEM ARCHIVE SPARSE_FILE
REPARSE_POINT OFFLINE (0x00001626)
Maximum versions: 0
Version number: 0
Class ID: 0
User ID: 0 (0x0)
Security ID: 270 (0x10e)
Quota charged: 0 (0x0)
Update Sequence Number: 0 (0x0)
Dumping attribute $FILE_NAME (0x30) from mft record 507809 (0x7bfa1)
Attribute length: 160 (0xa0)
Resident: Yes
Name length: 0 (0x0)
Name offset: 0 (0x0)
Attribute flags: 0x0000
Attribute instance: 2 (0x2)
Data size: 132 (0x84)
Data offset: 24 (0x18)
Resident flags: 0x01
ReservedR: 0 (0x0)
Parent directory: 507806 (0x7bf9e)
File Creation Time: Wed Dec 14 11:51:27 2016 UTC
File Altered Time: Wed Dec 14 11:51:27 2016 UTC
MFT Changed Time: Wed Dec 14 11:51:27 2016 UTC
Last Accessed Time: Wed Dec 14 11:51:27 2016 UTC
Allocated Size: 2322432 (0x237000)
Data Size: 0 (0x0)
Filename Length: 33 (0x21)
File attributes: HIDDEN SYSTEM ARCHIVE (0x00000026)
Namespace: POSIX
Filename: 'WP_20141101_15_55_39_Panorama.jpg'
Dumping attribute $DATA (0x80) from mft record 507809 (0x7bfa1)
Attribute length: 80 (0x50)
Resident: No
Name length: 0 (0x0)
Name offset: 0 (0x0)
Attribute flags: 0x8000
Attribute instance: 1 (0x1)
Lowest VCN 0 (0x0)
Highest VCN: 575 (0x23f)
Mapping pairs offset: 72 (0x48)
Compression unit: 4 (0x4)
Data size: 2320694 (0x236936)
Allocated size: 2359296 (0x240000)
Initialized size: 2320694 (0x236936)
Compressed size: 0 (0x0)
Runlist: VCN LCN Length
0x0 <HOLE> 0x240
Dumping attribute $DATA (0x80) from mft record 507809 (0x7bfa1)
Attribute length: 104 (0x68)
Resident: No
Name length: 13 (0xd)
Name offset: 64 (0x40)
Attribute name: 'ms-properties'
Attribute flags: 0x0000
Attribute instance: 4 (0x4)
Lowest VCN 0 (0x0)
Highest VCN: 0 (0x0)
Mapping pairs offset: 96 (0x60)
Compression unit: 0 (0x0)
Data size: 584 (0x248)
Allocated size: 4096 (0x1000)
Initialized size: 584 (0x248)
Runlist: VCN LCN Length
0x0 0x5e74103 0x1
Dumping attribute $DATA (0x80) from mft record 507809 (0x7bfa1)
Attribute length: 96 (0x60)
Resident: No
Name length: 12 (0xc)
Name offset: 64 (0x40)
Attribute name: 'ms-thumbnail'
Attribute flags: 0x0000
Attribute instance: 5 (0x5)
Lowest VCN 0 (0x0)
Highest VCN: 3 (0x3)
Mapping pairs offset: 88 (0x58)
Compression unit: 0 (0x0)
Data size: 14345 (0x3809)
Allocated size: 16384 (0x4000)
Initialized size: 14345 (0x3809)
Runlist: VCN LCN Length
0x0 0xab5f7d5 0x4
Dumping attribute $REPARSE_POINT (0xc0) from mft record 507809 (0x7bfa1)
Attribute length: 48 (0x30)
Resident: Yes
Name length: 0 (0x0)
Name offset: 0 (0x0)
Attribute flags: 0x0000
Attribute instance: 6 (0x6)
Data size: 24 (0x18)
Data offset: 24 (0x18)
Resident flags: 0x00
ReservedR: 0 (0x0)
Reparse tag: 0x80000015
Data length: 0 (0x0)
Data: (NONE)
End of inode reached
Total runs: 3 (fragments: 3)
_______________________________________________
ntfs-3g-devel mailing list
ntfs-3g-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/ntfs-3g-devel
