NTFS文件格式，什么情况会出现属性在slack空间中

vincent_1011 2010-01-22 03:04:33
NTFS文件格式，什么情况会出现属性在slack空间中
这两天解析自己其中一个卷的时候，发现A0属性在第二个扇区，前面的A0属性无效

winhex显示第二个a0属性是在slack上

请问这情况咋判断和处理，网上google了半天，啥都没
...全文
138 9 打赏 收藏 转发到动态 举报
写回复
用AI写文章
9 条回复
切换为时间正序
请发表友善的回复…
发表回复
nevergone 2010-02-06
  • 打赏
  • 举报
 回复
Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F

0C0001400 46 49 4C 45 30 00 03 00 34 D9 1A 08 00 00 00 00 FILE0...4?.....
0C0001410 05 00 01 00 38 00 03 00 48 02 00 00 00 04 00 00 ....8...H.......
序列号
0C0001420 00 00 00 00 00 00 00 00 0B 00 00 00 05 00 00 00 ................
0C0001430 42 03 01 B9 00 00 00 00 10 00 00 00 48 00 00 00 B..?.......H...
$10
0C0001440 00 00 18 00 00 00 00 00 30 00 00 00 18 00 00 00 ........0.......
0C0001450 48 80 F0 9B 78 99 C9 01 8C 82 3C 4C C4 A5 CA 01 H€饹x櫳.寕 <L磨?
0C0001460 8C 82 3C 4C C4 A5 CA 01 A8 F2 33 AA 6E A6 CA 01 寕 <L磨?3猲κ.
0C0001470 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0C0001480 30 00 00 00 60 00 00 00 00 00 18 00 00 00 01 00 0...`...........
$30
0C0001490 44 00 00 00 18 00 01 00 05 00 00 00 00 00 05 00 D...............
0C00014A0 48 80 F0 9B 78 99 C9 01 48 80 F0 9B 78 99 C9 01 H€饹x櫳.H€饹x櫳.
0C00014B0 48 80 F0 9B 78 99 C9 01 48 80 F0 9B 78 99 C9 01 H€饹x櫳.H€饹x櫳.
0C00014C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0C00014D0 06 00 00 10 00 00 00 00 01 03 2E 00 00 00 00 00 ................
0C00014E0 40 00 00 00 28 00 00 00 00 00 00 00 00 00 09 00 @...(...........
$40
0C00014F0 10 00 00 00 18 00 00 00 CE D2 52 43 27 1D DE 11 ........我RC'.?
0C0001500 AD 01 00 13 20 94 E2 84 50 00 00 00 48 00 00 00 ?.. 斺凱...H...
$50
0C0001510 01 00 40 00 00 00 02 00 00 00 00 00 00 00 00 00 ..@.............
0C0001520 01 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ........@.......
0C0001530 00 20 00 00 00 00 00 00 4C 10 00 00 00 00 00 00 . ......L.......
0C0001540 4C 10 00 00 00 00 00 00 31 02 CB B7 13 00 00 00 L.......1.朔....
0C0001550 90 00 00 00 58 00 00 00 00 04 18 00 00 00 0A 00 ?..X...........
$90
0C0001560 38 00 00 00 20 00 00 00 24 00 49 00 33 00 30 00 8... ...$.I.3.0.
0C0001570 30 00 00 00 01 00 00 00 00 10 00 00 01 00 00 00 0...............
0C0001580 10 00 00 00 28 00 00 00 28 00 00 00 01 00 00 00 ....(...(.......
0C0001590 00 00 00 00 00 00 00 00 18 00 00 00 03 00 00 00 ................
0C00015A0 06 00 00 00 00 00 00 00 A0 00 00 00 70 00 00 00 ........?..p...
$A0
0C00015B0 01 04 40 00 00 00 08 00 00 00 00 00 00 00 00 00 ..@.............
0C00015C0 07 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 ........H.......
0C00015D0 00 80 00 00 00 00 00 00 00 80 00 00 00 00 00 00 .€.......€......
0C00015E0 00 80 00 00 00 00 00 00 24 00 49 00 33 00 30 00 .€......$.I.3.0.
0C00015F0 31 01 CA B7 13 11 01 F9 31 01 98 D6 F3 31 42 03 1.史...?.樦?B.
扇区2
0C0001600 52 FF 31 01 AE D6 0C 31 02 67 A5 09 31 01 37 93 R1..1.g?1.7?
0C0001610 EC 00 00 00 70 D5 5D E1 B0 00 00 00 28 00 00 00 ?..p誡岚...(...
$B0
0C0001620 00 04 18 00 00 00 07 00 08 00 00 00 20 00 00 00 ............ ...
0C0001630 24 00 49 00 33 00 30 00 5F 00 00 00 00 00 00 00 $.I.3.0._.......
0C0001640 FF FF FF FF 00 00 00 00 20 00 00 00 00 00 00 00 .... .......
OVER
0C0001650 09 03 66 00 69 00 72 00 65 00 32 00 2E 00 72 00 ..f.i.r.e.2...r.
0C0001660 61 00 72 00 6C 00 75 00 03 00 00 00 00 00 00 00 a.r.l.u.........
0C0001670 3E 04 00 00 00 00 0B 00 70 00 52 00 01 00 00 00 >.......p.R.....
0C0001680 05 00 00 00 00 00 05 00 00 3F 22 12 28 EE BF 01 .........?".(羁.
0C0001690 00 3F 22 12 28 EE BF 01 D0 8A ED 9D 49 72 CA 01 .?".(羁.袏頋Ir?
0C00016A0 00 3F 22 12 28 EE BF 01 C0 00 00 00 00 00 00 00 .?".(羁.?......
0C00016B0 BE 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 ?...... .......
0C00016C0 08 03 70 00 65 00 6E 00 64 00 2E 00 67 00 69 00 ..p.e.n.d...g.i.
0C00016D0 66 00 74 00 6D 00 75 00 05 00 00 00 00 00 00 00 f.t.m.u.........
0C00016E0 A4 05 00 00 00 00 0D 00 70 00 52 00 01 00 00 00 ?......p.R.....
0C00016F0 05 00 00 00 00 00 05 00 46 A3 B5 DF 7E 31 CA 01 ........F５邁1?
0C0001700 D0 21 39 36 1B 71 CA 01 D0 21 39 36 1B 71 CA 01 ?96.q??96.q?
0C0001710 D0 21 39 36 1B 71 CA 01 00 00 00 00 00 00 00 00 ?96.q?........
0C0001720 00 00 00 00 00 00 00 00 01 00 00 10 00 00 00 00 ................
0C0001730 08 02 54 00 44 00 44 00 4F 00 57 00 4E 00 7E 00 ..T.D.D.O.W.N.~.
0C0001740 31 00 45 00 58 00 45 00 04 00 00 00 00 00 00 00 1.E.X.E.........
0C0001750 00 00 00 00 00 00 00 00 18 00 00 00 03 00 00 00 ................
0C0001760 01 00 00 00 00 00 00 00 A0 00 00 00 68 00 00 00 ........?..h...
0C0001770 01 04 40 00 00 00 08 00 00 00 00 00 00 00 00 00 ..@.............
0C0001780 05 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 ........H.......
0C0001790 00 60 00 00 00 00 00 00 00 60 00 00 00 00 00 00 .`.......`......
0C00017A0 00 60 00 00 00 00 00 00 24 00 49 00 33 00 30 00 .`......$.I.3.0.
0C00017B0 31 01 CA B7 13 11 01 F9 31 01 98 D6 F3 31 01 B9 1.史...?.樦?.?
0C00017C0 52 FF 31 01 AE D6 0C 31 01 67 A5 09 00 0E DA AE R1..1.g?..诋
0C00017D0 B0 00 00 00 28 00 00 00 00 04 18 00 00 00 07 00 ?..(...........
0C00017E0 08 00 00 00 20 00 00 00 24 00 49 00 33 00 30 00 .... ...$.I.3.0.
0C00017F0 3F 00 00 00 00 00 00 00 FF FF FF FF 00 00 42 03 ?.........B.
这里不是结束符

看我的标注, 你A0属性位置判断错了
怎么可能是跑到后面那个呢

序列号为5, 表明这个MFT文件记录给使用了5次, 因此造成属性结束后还有上次未情况的属性.
vincent_1011 2010-02-05
  • 打赏
  • 举报
 回复
[Quote=引用 5 楼 nevergone 的回复:]
把MFT贴出来看看
[/Quote]

睡着了？
vincent_1011 2010-02-05
  • 打赏
  • 举报
 回复
这就是那个a0属性的runs刚好跨扇区了，其实正确的a0属性在第二个扇区中

Offset 0 1 2 3 4 5 6 7 8 9 A B C D E F

0C0001400 46 49 4C 45 30 00 03 00 34 D9 1A 08 00 00 00 00 FILE0...4?.....
0C0001410 05 00 01 00 38 00 03 00 48 02 00 00 00 04 00 00 ....8...H.......
0C0001420 00 00 00 00 00 00 00 00 0B 00 00 00 05 00 00 00 ................
0C0001430 42 03 01 B9 00 00 00 00 10 00 00 00 48 00 00 00 B..?.......H...
0C0001440 00 00 18 00 00 00 00 00 30 00 00 00 18 00 00 00 ........0.......
0C0001450 48 80 F0 9B 78 99 C9 01 8C 82 3C 4C C4 A5 CA 01 H€饹x櫳.寕<L磨?
0C0001460 8C 82 3C 4C C4 A5 CA 01 A8 F2 33 AA 6E A6 CA 01 寕<L磨?3猲κ.
0C0001470 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0C0001480 30 00 00 00 60 00 00 00 00 00 18 00 00 00 01 00 0...`...........
0C0001490 44 00 00 00 18 00 01 00 05 00 00 00 00 00 05 00 D...............
0C00014A0 48 80 F0 9B 78 99 C9 01 48 80 F0 9B 78 99 C9 01 H€饹x櫳.H€饹x櫳.
0C00014B0 48 80 F0 9B 78 99 C9 01 48 80 F0 9B 78 99 C9 01 H€饹x櫳.H€饹x櫳.
0C00014C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0C00014D0 06 00 00 10 00 00 00 00 01 03 2E 00 00 00 00 00 ................
0C00014E0 40 00 00 00 28 00 00 00 00 00 00 00 00 00 09 00 @...(...........
0C00014F0 10 00 00 00 18 00 00 00 CE D2 52 43 27 1D DE 11 ........我RC'.?
0C0001500 AD 01 00 13 20 94 E2 84 50 00 00 00 48 00 00 00 ?.. 斺凱...H...
0C0001510 01 00 40 00 00 00 02 00 00 00 00 00 00 00 00 00 ..@.............
0C0001520 01 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 ........@.......
0C0001530 00 20 00 00 00 00 00 00 4C 10 00 00 00 00 00 00 . ......L.......
0C0001540 4C 10 00 00 00 00 00 00 31 02 CB B7 13 00 00 00 L.......1.朔....
0C0001550 90 00 00 00 58 00 00 00 00 04 18 00 00 00 0A 00 ?..X...........
0C0001560 38 00 00 00 20 00 00 00 24 00 49 00 33 00 30 00 8... ...$.I.3.0.
0C0001570 30 00 00 00 01 00 00 00 00 10 00 00 01 00 00 00 0...............
0C0001580 10 00 00 00 28 00 00 00 28 00 00 00 01 00 00 00 ....(...(.......
0C0001590 00 00 00 00 00 00 00 00 18 00 00 00 03 00 00 00 ................
0C00015A0 06 00 00 00 00 00 00 00 A0 00 00 00 70 00 00 00 ........?..p...
0C00015B0 01 04 40 00 00 00 08 00 00 00 00 00 00 00 00 00 ..@.............
0C00015C0 07 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 ........H.......
0C00015D0 00 80 00 00 00 00 00 00 00 80 00 00 00 00 00 00 .€.......€......
0C00015E0 00 80 00 00 00 00 00 00 24 00 49 00 33 00 30 00 .€......$.I.3.0.
0C00015F0 31 01 CA B7 13 11 01 F9 31 01 98 D6 F3 31 42 03 1.史...?.樦?B.
扇区2
0C0001600 52 FF 31 01 AE D6 0C 31 02 67 A5 09 31 01 37 93 R1..1.g?1.7?
0C0001610 EC 00 00 00 70 D5 5D E1 B0 00 00 00 28 00 00 00 ?..p誡岚...(...
0C0001620 00 04 18 00 00 00 07 00 08 00 00 00 20 00 00 00 ............ ...
0C0001630 24 00 49 00 33 00 30 00 5F 00 00 00 00 00 00 00 $.I.3.0._.......
0C0001640 FF FF FF FF 00 00 00 00 20 00 00 00 00 00 00 00 .... .......
0C0001650 09 03 66 00 69 00 72 00 65 00 32 00 2E 00 72 00 ..f.i.r.e.2...r.
0C0001660 61 00 72 00 6C 00 75 00 03 00 00 00 00 00 00 00 a.r.l.u.........
0C0001670 3E 04 00 00 00 00 0B 00 70 00 52 00 01 00 00 00 >.......p.R.....
0C0001680 05 00 00 00 00 00 05 00 00 3F 22 12 28 EE BF 01 .........?".(羁.
0C0001690 00 3F 22 12 28 EE BF 01 D0 8A ED 9D 49 72 CA 01 .?".(羁.袏頋Ir?
0C00016A0 00 3F 22 12 28 EE BF 01 C0 00 00 00 00 00 00 00 .?".(羁.?......
0C00016B0 BE 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00 ?...... .......
0C00016C0 08 03 70 00 65 00 6E 00 64 00 2E 00 67 00 69 00 ..p.e.n.d...g.i.
0C00016D0 66 00 74 00 6D 00 75 00 05 00 00 00 00 00 00 00 f.t.m.u.........
0C00016E0 A4 05 00 00 00 00 0D 00 70 00 52 00 01 00 00 00 ?......p.R.....
0C00016F0 05 00 00 00 00 00 05 00 46 A3 B5 DF 7E 31 CA 01 ........F５邁1?
0C0001700 D0 21 39 36 1B 71 CA 01 D0 21 39 36 1B 71 CA 01 ?96.q??96.q?
0C0001710 D0 21 39 36 1B 71 CA 01 00 00 00 00 00 00 00 00 ?96.q?........
0C0001720 00 00 00 00 00 00 00 00 01 00 00 10 00 00 00 00 ................
0C0001730 08 02 54 00 44 00 44 00 4F 00 57 00 4E 00 7E 00 ..T.D.D.O.W.N.~.
0C0001740 31 00 45 00 58 00 45 00 04 00 00 00 00 00 00 00 1.E.X.E.........
0C0001750 00 00 00 00 00 00 00 00 18 00 00 00 03 00 00 00 ................
0C0001760 01 00 00 00 00 00 00 00 A0 00 00 00 68 00 00 00 ........?..h...
0C0001770 01 04 40 00 00 00 08 00 00 00 00 00 00 00 00 00 ..@.............
0C0001780 05 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 ........H.......
0C0001790 00 60 00 00 00 00 00 00 00 60 00 00 00 00 00 00 .`.......`......
0C00017A0 00 60 00 00 00 00 00 00 24 00 49 00 33 00 30 00 .`......$.I.3.0.
0C00017B0 31 01 CA B7 13 11 01 F9 31 01 98 D6 F3 31 01 B9 1.史...?.樦?.?
0C00017C0 52 FF 31 01 AE D6 0C 31 01 67 A5 09 00 0E DA AE R1..1.g?..诋
0C00017D0 B0 00 00 00 28 00 00 00 00 04 18 00 00 00 07 00 ?..(...........
0C00017E0 08 00 00 00 20 00 00 00 24 00 49 00 33 00 30 00 .... ...$.I.3.0.
0C00017F0 3F 00 00 00 00 00 00 00 FF FF FF FF 00 00 42 03 ?.........B.

nevergone 2010-02-05
  • 打赏
  • 举报
 回复
把MFT贴出来看看
vincent_1011 2010-02-05
  • 打赏
  • 举报
 回复
[Quote=引用 3 楼 nevergone 的回复:]
不多说
请参考NTFS-3G源码
[/Quote]
看得累死了，没看出什么猫腻。

在那个attrib.c源码文件里面有查找属性的函数。不过里面也是这样

如果你知道的话，希望你能贴个片段
nevergone 2010-02-05
  • 打赏
  • 举报
 回复
不多说
请参考NTFS-3G源码
vincent_1011 2010-02-05
  • 打赏
  • 举报
 回复
汗，继续完工，界面浏览文件（手工解析ntfs）已经接近尾声，无奈有个小bug 问题还是没办法解决

碰到多个index_alloc也就是a0属性的情况下，不知怎么处理。

貌似这个情况下，对于我的卷，第二个属性才是正确的，可是不知道怎么判断和定位，求解。
DontKissBossAss 2010-01-22
  • 打赏
  • 举报
 回复
不会，帮顶
Prometheus+Grafana搭建全方位的监控告警系统
一、prometheus简介 Prometheus是一个开源的系统监控和告警系统，现在已经加入到CNCF基金会，成为继k8s之后第二个在CNCF维护管理的项目，在kubernetes容器管理系统中，通常会搭配prometheus进行监控，prometheus支持...
NTFS体系结构
Microsoft发明了NTFS文件系统，为了能出色的完成使命，NTFS在设计上及其精细和完整。本文详细讨论NTFS卷（volumes）的体系结构，和构成NTFS分区（partition）的关键数据结构，解释NTFS如何使用重要的文件系统结构来...
跟着这份清理教程，帮你的 Mac 腾出更多储存空间
你是否有过这样的经历：明明感觉电脑里什么都没装，macOS 却弹出了储存空间不足的警告。就算你忍痛删掉了一些个人文件，也只释放出了几百 MB 空间，警示框如催命符般持续弹出。 为了解决这一问题，在掏钱购买顶配 ...
Mac软件汇总
收集好用的Mac软件。...其实，macOS 系统本身是已经原生支持 NTFS 磁盘格式的读与写的，只不过 NTFS 毕竟是老对手 微软 Windows 产品下的技术，碍于版权和商业上的原因，苹果只好把 NTFS 的“写入”功能给屏蔽掉，变.
技术揭秘之详解回收站删除文件恢复
日常生活中，我们经常执行的操作里面肯定是有删除操作的，所以误删文件就是一个很令人头疼的问题，如果我们不小心误删了珍贵的文件怎么办？这里就结合回收站删除文件的恢复实例来说明一下数据恢复的方法！！！ ---....
C++ 语言

64,683

社区成员

250,491

社区内容

发帖
与我相关
我的任务
社区描述
C++ 语言相关问题讨论，技术干货分享，前沿动态等
c++ 技术论坛（原bbs）
社区管理员
  • C++ 语言社区
  • encoderlee
  • paschen
加入社区
  • 近7日
  • 近30日
  • 至今

加载中

查看更多榜单
社区公告
  1. 请不要发布与C++技术无关的贴子
  2. 请不要发布与技术无关的招聘、广告的帖子
  3. 请尽可能的描述清楚你的问题，如果涉及到代码请尽可能的格式化一下

试试用AI创作助手写篇文章吧

+ 用AI写文章