[ros-kernel] ntfs infinite loop at boot

[Mike Nordell]

jeanmichel.123 wrote:

> Howover I do not know How to find these informations from the boot sector?

You really should have a look at
http://linux-ntfs.sourceforge.net/ntfs/index.html
Maybe especially
http://linux-ntfs.sourceforge.net/ntfs/files/boot.html

> Might be the 0x3f in the unused filed mean
> 1 + 0x3f (double sector) makes $MFT begin at offset 0x4000 ?

No. The offset 0x30 of the unnamed data stream of the $Boot file (i.e. the
boot sector) is what's telling where the MFT begins. Should that one be
trashed, in my experience you can assume the MFT begins at sector 32 (for
the usual 4KB cluster, I haven't verified it with other cluster sizes).

But for completeness, using the file you posted, at offset 0x30 (LCN of
$Mft) we find the value 4. If we the look back to offset 0x0d
(sectors/cluster) we find that each cluster is 8 sectors (4KB). Therefore
the MFT starts at 4*8= sector 32.

Furthermore, I believe the linux-ntfs documentation is (as the Helen Custer
book about NTFS) a bit unclear about the MFT record sizes. Note (c) in
http://linux-ntfs.sourceforge.net/ntfs/files/boot.html
is probably correct, and I therefore believe the (somewhat stale, I admit)
ROS NTFS src I've looked at is a bit wrong. But in my experience (if anyone
has ever seen anything to contradict this, please speak up), the FILE
Record's are *always* 1KB in size. What probably *can* vary in size is the
allocation granularity of the MFT (FILE Record's). I.e. with 4KB clusters
you can only allocate 4 records at a time. With 64KB clusters you can only
allocate 64 records at a time. But the MFT FILE Records themselves are AFAIK
still, always, 1KB large.

/Mike