📄 logfile.html
字号:
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><!-- http://linux-ntfs.sourceforge.net/ntfs/files/logfile.html --><html lang="en"> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="description" content="NTFS Documentation"> <link rel="stylesheet" type="text/css" href="../style/ntfsdoc.css"> <link rel="start" type="text/html" href="../index.html" title="NTFS Documentation"> <title>$LogFile (2) - File - NTFS Documentation</title> </head> <body> <table border="0" class="toolbar" summary="" cellspacing="0"> <tr> <td class="toolbar"><a accesskey="1" class="toolbar" href="../index.html">Home</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="2" class="toolbar" href="../files/index.html">Files</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="3" class="toolbar" href="../attributes/index.html">Attributes</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="4" class="toolbar" href="../concepts/index.html">Concepts</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="5" class="toolbar" href="../help/glossary.html">Glossary</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="6" class="toolbar" href="../help/index.html">Help</a></td> </tr> </table> <h1>File - $LogFile (2)</h1> <a class="prevnext" accesskey="," href="mftmirr.html">Previous</a> <a class="prevnext" accesskey="." href="volume.html">Next</a> <h2>Overview</h2> <h2><a class="heading" href="../attributes/index.html">Attributes</a></h2> <table border="1" summary="" cellspacing="0"> <tr> <th class="numeric">Type</th> <th>Description</th> <th>Name</th> </tr> <tr> <td class="numeric"><a class="numeric" href="../attributes/standard_information.html">0x10</a></td> <td><a href="../attributes/standard_information.html">$STANDARD_INFORMATION</a></td> <td> </td> </tr> <tr> <td class="numeric"><a class="numeric" href="../attributes/file_name.html">0x30</a></td> <td><a href="../attributes/file_name.html">$FILE_NAME</a></td> <td>$LogFile</td> </tr> <tr> <td class="numeric"><a class="numeric" href="../attributes/data.html">0x80</a></td> <td><a href="../attributes/data.html">$DATA</a></td> <td>[Unnamed]</td> </tr> </table> <h2>Layout of the File</h2> <h3>Unnamed Data Stream</h3> <p> Little is known about the LogFile's structure. </p> <!-- <table border="1" summary="" cellspacing="0"> <tr> <th></th> </tr> <tr> <td></td> </tr> </table> --> <h2>Notes</h2> <h3>Other Information</h3> <p> The logging area consists of a sequence of 4KB log records. Each logrecord is structured as follows: </p> <pre> offset(length) contents 0(4) Magic number 'RCRD' 1E(12) Fixup </pre> <p> The logrecord supposedly contains a sequence of variable sized records. The structuring of those is not clear. File 2 is $LogFile, which contains transaction records to guarantee data integrity in case of a system failure. As pp. 37 describe, it consists of 2 copies of the restart area, and the 'infinite' logging area. </p> <p>When you want to write a file on a storage unit, you have to update the file itself plus some tables of the filesystem (say as an example the date of the file). At this point, you need a transaction made of 2 operations (update the file itself, update the date of the file).</p> <p>If the transaction is realized, you are sure that your file is written on the storage unit, and that the filesystem has been left in a defined state.</p> <p>If the transaction is not realized (in case of e.g. power failure, or system failure in general), the filesystem is in an undefined state. The only way for you to put it back in a defined (and sane) state (this operation is called a roll-back) is to log in a special file, the log file, which operations of the transaction have been successfully completed.</p> <p>At the first access to the disk after a system failure, the system read the log file and rolls back all the operations to the beginning of the last transaction.</p> <ul> <li>When the system writes to the log file, the operation must be atomic and immediate.</li> <li> You can put back your volume in sane state in a short time which is not related to the size of your disk but only to the complexity of the transaction that failed. <p>Note: This operation is not performed by the Windows NT chkdsk utility, but by the system: this normal and reliable operation is a feature of NTFS.</p> </li> <li>If your hardware is reliable, you are sure that you always have access to all the files of your volume, because it is consistent. But you can't restore eventual data losses.</li> </ul> <pre> Log file organization: Two restart areas present in the first two pages (restart pages). When the volume is unmounted they should be identical. These are followed by log records organized in pages headed by a record header going up to log file size. Not all pages contain log records when a volume is first formatted, but as the volume ages, all records will be used. When the log file fills up, the records at the beginning are purged (by modifying the oldest_lsn to a higher value presumably) and writing begins at the beginning of the file. Effectively, the log file is viewed as a circular entity. Log file restart page header (begins the restart area). struct { NTFS_RECORD; The magic is "RSTR". __u64 chkdsk_lsn; The check disk log file sequence number for this restart page. Only used when the magic is changed to "CHKD". = 0 __u32 system_page_size; Byte size of system pages, has to be >= 512 and a power of 2. Use this to calculate the required size of the usa and add this to the ntfs.usa_offset value. Then verify that the result is less than the value of the restart_offset. = 0x1000 __u32 log_page_size; Byte size of log file records, has to be >= 512 and a power of 2. = 0x1000 __u16 restart_offset; Byte offset from the start of the record to the restart record. Value has to be aligned to 8-byte boundary. = 0x30 __s16 minor_ver; Log file minor version. Only check if major version is 1. (=1 but >=1 is treated the same and <=0 is also ok)⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -