Notifications

Clear all

NTFS ins and outs

CyberGonzo · 2012-02-04T17:41:14Z

Hi,I have implemented NTFS parsing the last 9 days and I have a nice working version now despite the horror of finding information on topic.However, on my system, I still run into a few issues that seem to do with marginal behaviour. I found and tried other tools such as spiff NTFS explorer to check on the issues but they don't do better (or worse) than my app.I can formulate several questions backed up with some data where possible but before I do I was wondering if this is the right place for it ?Are there people reading this forum that know NTFS well (enough) to go deep with me and try to figure things out ?In short;- trouble finding second (/third, …) MFT entries for files that span multiple MFT entries. I think I have a few of those on my system- File MFT entries without a DATA attribute (probably related to previous, ie spanned MFT entries)- Issues with a few data runs. This works well for most files but there are some issues with some files. E.g. 10 bytes for an offset yet the 64 bit offset is (obviously) only 8 bytes long etc. So does the Header byte need to be filtered first with a value ? Header &= 0x77 ?- And a few more questions, but above info to illustrate the issues I'm dealing with.Cheers,Peter

Page 8 / 8 Prev

General (Technical, Procedural, Software, Hardware etc.)

Last Post by CyberGonzo 13 years ago

75 Posts

10 Users

0 Reactions

9,105 Views

RSS

CyberGonzo

(@cybergonzo)

Estimable Member

Joined: 14 years ago

Posts: 100

Topic starter 11/03/2012 1:25 pm

Hi Ddan,

It is strange indeed.
I wish I could repeat this.

ReplyQuote

CyberGonzo

(@cybergonzo)

Estimable Member

Joined: 14 years ago

Posts: 100

Topic starter 12/03/2012 8:08 pm

Hi Ddan,

I have fixed an issue that MAY have an influence on the things that you're seeing.
If you have the chance to check it out, download www.isobuster.com/beta/

Cheers.

ReplyQuote

Ddan

(@ddan)

Eminent Member

Joined: 14 years ago

Posts: 42

17/03/2012 6:00 am

Hi Ddan,

I have fixed an issue that MAY have an influence on the things that you're seeing.
If you have the chance to check it out, download www.isobuster.com/beta/

Cheers.

It looks like that problem has now gone, but a more subtle one has surfaced.

It involves small resident files which have an ADS attached. A typical live situation would show up in those internet favorite urls which have a 'favicon'. The favicon is held as an ADS. Some of these occurrencies are extracted properly but others are not.

The ones that are not handled properly are consistent in that they have the resident data starting on the second sector boundary of the mft record. What is extracted comes from the first sector boundary. That is, it starts with the mft record signature, instead of the real data.

Ddan

ReplyQuote

CyberGonzo

(@cybergonzo)

Estimable Member

Joined: 14 years ago

Posts: 100

Topic starter 17/03/2012 11:55 am

Sounds like a bug Ddan. Thanks for reporting it ! I'll look into it.

ReplyQuote

CyberGonzo

(@cybergonzo)

Estimable Member

Joined: 14 years ago

Posts: 100

Topic starter 31/03/2012 2:21 pm

I released IsoBuster 3.0

Thanks all for helping with NTFS support.

FYI
http//www.isobuster.com/news.php?news_page=55

ReplyQuote

Page 8 / 8 Prev

8 Forums
15.7 K Topics
92.3 K Posts
213 Online
41.1 K Members

Forum Icons: Forum contains no unread posts Forum contains unread posts

Topic Icons: Not Replied Replied Active Hot Sticky Unapproved Solved Private Closed