hacking

一个linux下NTFS文件格式源代码

Please read the README file before this one.

I Architecture of this distribution
-----------------------------------

The 'common' subdirectory contains the real NTFS engine.
All other directories are interfaces for this engine :
 linux20 : interface to the Linux kernel 2.0
 linux21 : interface to the Linux kernel 2.1
 44bsd : interface to the 4.4BSD kernel
 user : interface to a system user

II Bug tracking
---------------

If a Linux kernel interface crashes, check /var/adm/debug. If it works, but is
unreasonably slow, recompile w/o -DDEBUG.

You can also use the user interface to track bugs :

  ./ntdir

  This should give you a listing of the files. Once you found an interesting
  entry (say at offset 0x12F000), do

  ./ntdump --mft -o 0x12F000

  This should give you the list of attributes. Check whether the names file
  dates, and the size of the data attribute are reported correctly. Then, look
  at the data runs. Dump these to see whether file contents location is
  reported correctly.

  Use ntdir to locate the $AttrDef file. Locate the data runs either with the
  --mft option, or by looking at the hex dump, if the prior method fails. Look
  at the attribute names and numbers and compare them to what dump.c uses.

III Conclusion
--------------

Now you are in the position to start improving the NTFS driver. We are waiting
for your suggestions. Here is a ToDo-list :

1. Guessing parameters
   Most of these are solved, but there may be still some hidden assumptions
   about the size of things somewhere.
2. Guessing offsets
   The following offsets are obtained by guessing. It should be verified that
   they are really constant, or can be obtained from some other information
   on the volume:
   - Start of the attribute list in a MFT record (0x30)
   - Location of the attribute data for unnamed attributes (0x40)
   - positions of file access times in the standard attribute 
   (0x18, 0x20, 0x28)
3. Unused bytes/unsupported features
   As each byte in the infrastructure file probably serves a purpose,
   they should all be investigated. Also, some features known to be 
   implemented by NTFS are not supported in the tools. These include:
   - volume sets. What is the $Volume file for?
   - named and multiple data attributes
   - hard links and symlinks
   - Why appear name attributes to have access times, and why are there
   four access times, while only three are supported in the API (creation,
   modification, access)?
4. Comments
   Why can I never remember to put comments into source files?

Martin von L鰓is <[e-mail]>
R間is Duchesne <[e-mail]>