[prev in list] [next in list] [prev in thread] [next in thread] 

List:       linux-ntfs-dev
Subject:    Re: [Linux-NTFS-Dev] ntfsclone, ntfswipe
From:       Szakacsits Szabolcs <szaka () sienet ! hu>
Date:       2003-07-24 8:56:59
[Download RAW message or body]


Hi,

On Wed, 23 Jul 2003, Andrew Somerville wrote:

> ++Im new to the list.

Welcome :)

> I thought I might be able to gain some insite from your ntfsclone code.
> If it works the way I think it does, I should be able to splice part of
> it into ntfswipe to handle locating of unused sectors.

Only for unused clusters. First ntfsclone does a consistency check, if it
passes then the $Bitmap file is considered trustable. You have what
clusters are used and not. clone_ntfs() could be the same up to the point

	if (ntfs_bit_get(bm, i * 8 + cl % 8))

and that should be replaced with [untestted!!!]

	if (!ntfs_bit_get(bm, i * 8 + cl % 8))
		if (ntfs_cluster_write(vol, cl, 1, buf) == -1)
			error
        delete everything from origial code

Locating unused sectors in used clusters (e.g. in last used cluster of a
file, file end) is something you should do additionally.

> 	So my question is does ntfsclone simply ignore all unused space?

Yes unless output is stdout, in that case it sends a 0's.

> And, by zeroing the space that ntfsclone ignores (and ignoring the space
> ntfsclone keeps) should I have correctly wiped all unused sectors?

Depends on how you define "unused sectors". Unused sectors in unused
clusters or unused sectors on the entire partition? Answer to the first
question is yes, and no to the seconds.

However wiping in sector level is not enough. For example there are the
above mentioned file ends and unused bytes in MFT, metadata.

> 	A second question is: Is the sparse file created by ntfs clone left
> formated in the original block order of the file system or has it been
> reordered in some way (say to make it easier for developers to get usefull
> information from)?

It's clone, completely the same from byte to byte except unused space is 0.
You can also mount the clone and see exactly the same as if you would mount
the ntfs partition.

Basically it's an ntfs specific dd, dd_ntfs. A dd that understands NTFS.
Its benefit is it's much faster, e.g. backing up a 200 GB partition having
10 GB data is 20x faster. The recovery is also 20x faster in this case. Its
drawback is e.g. if you want to undelete deleted files, it will not work,
because those clusters were not saved but "replaced" with 0's.

> I.e. If one were to cat the sparse file created by ntfsclone to
> /dev/hdsomething would it reproduce the original NTFS?

Sure, from byte to byte. But it's way much faster to clone it back ;)

	Szaka



-------------------------------------------------------
This SF.Net email sponsored by: Free pre-built ASP.NET sites including
Data Reports, E-commerce, Portals, and Forums are available now.
Download today and enter to win an XBOX or Visual Studio .NET.
http://aspnet.click-url.com/go/psa00100003ave/direct;at.aspnet_072303_01/01
_______________________________________________
Linux-NTFS-Dev mailing list
Linux-NTFS-Dev@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-ntfs-dev
[prev in list] [next in list] [prev in thread] [next in thread]