📄 data_runs.html
字号:
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><!-- http://linux-ntfs.sourceforge.net/ntfs/concepts/data_runs.html --><html lang="en"> <head> <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1"> <meta name="description" content="NTFS Documentation"> <link rel="stylesheet" type="text/css" href="../style/ntfsdoc.css"> <link rel="start" type="text/html" href="../index.html" title="NTFS Documentation"> <link rel="stylesheet" type="text/css" href="../style/dataruns.css"> <title>Data Runs - Concept - NTFS Documentation</title> </head> <body> <table border="0" class="toolbar" summary="" cellspacing="0"> <tr> <td class="toolbar"><a accesskey="1" class="toolbar" href="../index.html">Home</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="2" class="toolbar" href="../files/index.html">Files</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="3" class="toolbar" href="../attributes/index.html">Attributes</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="4" class="toolbar" href="../concepts/index.html">Concepts</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="5" class="toolbar" href="../help/glossary.html">Glossary</a></td> <td class="toolbar"> </td> <td class="toolbar"><a accesskey="6" class="toolbar" href="../help/index.html">Help</a></td> </tr> </table> <h1>Concept - Data Runs</h1> <a class="prevnext" accesskey="," href="compression.html">Previous</a> <a class="prevnext" accesskey="." href="directory.html">Next</a> <h2>Overview</h2> <p> Non-resident attributes are stored in intervals of clusters called runs. Each run is represented by its starting cluster and its length. The starting cluster of a run is coded as an offset to the starting cluster of the previous run. </p> <p> Normal, compressed and sparse files are all defined by runs. </p> <p> The examples start simple, then quickly get complicated. </p> <p> This is a table written in the content part of a non-resident file attribute, which allows to have access to its stream. </p> <p> NB Assume a 1KB cluster size, throughout. And little endian disk storage. </p> <hr> <h2>Example 1 - Normal, Unfragmented File</h2> <h3>Data runs:</h3> <ul> <li>21 18 34 56 00</li> <li>21 18 34 56 - 00 (regrouped)</li> </ul> <h3>Run 1:</h3> <ul> <li>Header = 0x21 - 1 byte length, 2 byte offset</li> <li>Length = 0x18 (1 byte)</li> <li>Offset = 0x5634 (2 bytes)</li> </ul> <h3>Run 2:</h3> <ul> <li>Header = 0x00 - the end</li> </ul> <h3>Summary:</h3> <ul> <li>0x18 Clusters @ LCN 0x5634</li> </ul> <p> Therefore, Data1 is a unfragmented file, of size 0x18 clusters, starting at LCN 0x5634. </p> <hr> <h2>Example 2 - Normal, Fragmented File</h2> <h3>Data runs:</h3> <ul> <li>31 38 73 25 34 32 14 01 E5 11 02 31 42 AA 00 03 00</li> <li>31 38 73 25 34 - 32 14 01 E5 11 02 - 31 42 AA 00 03 - 00 (regrouped)</li> </ul> <h3>Run 1:</h3> <ul> <li>Header = 0x31 - 1 byte length, 3 byte offset</li> <li>Length = 0x38</li> <li>Offset = 0x342573</li> </ul> <h3>Run 2:</h3> <ul> <li>Header = 0x32 - 2 byte length, 3 byte offset</li> <li>Length = 0x114</li> <li>Offset = 0x363758 (0x211E5 relative to 0x342573)</li> </ul> <h3>Run 3:</h3> <ul> <li>Header = 0x31 - 1 byte length, 3 byte offset</li> <li>Length = 0x42</li> <li>Offset = 0x393802 (0x300AA relative to 0x363758)</li> </ul> <h3>Run 4:</h3> <ul> <li>Header = 0x00 - the end</li> </ul> <h3>Summary:</h3> <ul> <li>0x38 Clusters @ LCN 0x342573</li> <li>0x114 Clusters @ LCN 0x363758</li> <li>0x42 Clusters @ LCN 0x393802</li> </ul> <p> Therefore, Data2 is a fragmented file, of size 0x18E clusters, with data blocks at LCNs 0x342573, 0x363758 and 0x393802. </p> <hr> <h2>Example 3 - Normal, Scrambled File</h2> <h3>Data runs:</h3> <ul> <li>11 30 60 21 10 00 01 11 20 E0 00</li> <li>11 30 60 - 21 10 00 01 - 11 20 E0 - 00 (regrouped)</li> </ul> <h3>Run 1:</h3> <ul> <li>Header = 0x11 - 1 byte length, 1 byte offset</li> <li>Length = 0x30</li> <li>Offset = 0x60</li> </ul> <h3>Run 2:</h3> <ul> <li>Header = 0x21 - 1 byte length, 2 byte offset</li> <li>Length = 0x10</li> <li>Offset = 0x160 (0x100 relative to 0x60)</li> </ul> <h3>Run 3:</h3> <ul> <li>Header = 0x11 - 1 byte length, 1 byte offset</li> <li>Length = 0x20</li> <li>Offset = 0x140 (-0x20 relative to 0x160)</li> </ul> <h3>Run 4:</h3> <ul> <li>Header = 0x00 - the end</li> </ul> <h3>Summary:</h3> <ul> <li>0x30 Clusters @ LCN 0x60</li> <li>0x10 Clusters @ LCN 0x160</li> <li>0x20 Clusters @ LCN 0x140</li> </ul> <p> Therefore, Data3 is a badly fragmented file of size 0x80 clusters, with data blocks at LCNs 0x60, 0x160 and 0x140. Furthermore, the third block of data is physically located between the first and second blocks. (The third run has a negative offset, placing it before the previous run). </p> <hr> <h2>Example 4 - Sparse, Unfragmented File</h2> <h3>Data runs:</h3> <ul> <li>11 30 20 01 60 11 10 50 00</li> <li>11 30 20 - 01 60 - 11 10 30 - 00 (regrouped)</li> </ul> <h3>Run 1:</h3> <ul> <li>Header = 0x11 - 1 byte length, 1 byte offset</li> <li>Length = 0x30</li> <li>Offset = 0x20</li> </ul> <h3>Run 2:</h3> <ul> <li>Header = 0x01 - 1 byte length, 0 byte offset (sparse)</li> <li>Length = 0x60</li> <li>Offset = N/A</li> </ul> <h3>Run 3:</h3> <ul> <li>Header = 0x11 - 1 byte length, 1 byte offset</li> <li>Length = 0x10</li> <li>Offset = 0x30</li> </ul> <h3>Run 4:</h3> <ul> <li>Header = 0x00 - the end</li> </ul> <h3>Summary:</h3> <ul> <li>0x30 Clusters @ LCN 0x20</li> <li>0x60 Clusters (sparse)</li> <li>0x10 Clusters @ LCN 0x50</li> </ul> <p> Therefore, Data4 is a sparse, unfragmented file, of size 0xA0 clusters, with data blocks at LCNs 0x20 and 0x50. </p> <p> This file has a sparse part in the middle of size 0x60 clusters. It takes up no space on disk, but it it represented by 0x60 VCNs. </p> <hr> <h2>Example 5 - Compressed, Unfragmented File</h2> <h3>Data runs:</h3> <ul> <li>11 08 40 01 08 11 10 08 11 0C 10 01 04 00</li> <li>11 08 40 - 01 08 - 11 10 08 - 11 0C 10 - 01 04 - 00 (regrouped)</li> </ul> <h3>Run 1:</h3> <ul> <li>Header = 0x11 - 1 byte length, 1 byte offset</li> <li>Length = 0x08</li> <li>Offset = 0x40</li> </ul> <h3>Run 2:</h3> <ul> <li>Header = 0x01 - 1 byte length, 0 byte offset (sparse)</li> <li>Length = 0x08</li> <li>Offset = N/A</li> </ul> <h3>Run 3:</h3> <ul> <li>Header = 0x11 - 1 byte length, 1 byte offset</li> <li>Length = 0x10</li> <li>Offset = 0x48 (0x8 relative to 0x40)</li> </ul> <h3>Run 4:</h3> <ul> <li>Header = 0x11 - 1 byte length, 1 byte offset</li> <li>Length = 0x0C</li> <li>Offset = 0x58 (0x10 relative to 0x48)</li> </ul> <h3>Run 5:</h3> <ul> <li>Header = 0x01 - 1 byte length, 0 byte offset (sparse)</li> <li>Length = 0x04</li> <li>Offset = N/A</li> </ul> <h3>Run 6:</h3> <ul> <li>Header = 0x00 - the end</li> </ul> <h3>Summary:</h3> <ul> <li>0x08 Clusters @ LCN 0x40</li> <li>0x08 Clusters (sparse)</li> <li>0x10 Clusters @ LCN 0x48</li> <li>0x0C Clusters @ LCN 0x58</li> <li>0x04 Clusters (sparse)</li> </ul> <p> Therefore, Data5 is a compressed, unfragmented, file of length 0x30, with data blocks at LCNs 0x40, 0x48 and 0x58. </p> <p> The data, as stored on disk, is contiguous. The sparse runs pad out the compression units to blocks of 16 clusters (0x10). </p> <hr> <h2>Example 6 - Compressed, Sparse, Fragmented File</h2> brain damaged file <hr>⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -