73 replies to this topic

[Sha0]

Hey Paulo and Icecube,

Please check out the attached NTFSTEST.EXE (with source code). I have to goto sleep now, but maybe Paulo can figure out how to plug it into the Syslinux Windows installer? We probably have to check 'fs_type' and leave the libfat stuff intact, for now.

NTFSTEST.EXE dumps cluster and sector information for a file on an NTFS partition.

D'oh! I can't attach the file! I've reported this problem. (Thanks for fixing this, team reboot!)

Attached!  ntfssect.tar.gz   38.17KB   17 downloads

Also at NTFSTEST.EXE source code in a git repository (hosted by H. Peter Anvin )

[Wonko the Sane]

When you are awake check:

C:\>ntfstest.exe
File sector info . . . . . . . . . . . . . . . . . . . . Shao Miller, 2011

Usage: FILESECT.EXE <filename>

Attempts to dump cluster and sector info for <filename>.

Maybe useful, maybe not:
http://www.wd-3.com/...e/luserland.htm
http://www.codeproje...iles/FDump.aspx

Both above tools and yours do not find/take into consideration the "small files" that go directly into the $MFT. (BOOT.INI is a common example of a file that usually is NOT on a cluster, but stored directly inside the $MFT)


Wonko

[Paulo Alcantara]

When you are awake check:

Maybe useful, maybe not:
http://www.wd-3.com/...e/luserland.htm
http://www.codeproje...iles/FDump.aspx

Both above tools and yours do not find/take into consideration the "small files" that go directly into the $MFT. (BOOT.INI is a common example of a file that usually is NOT on a cluster, but stored directly inside the $MFT)


Wonko

The purpose of this application was to find the ldlinux.sys within an NTFS partition, patch it,
and write it again in a contiguous way. As ldlinux.sys is bigger than 1 KiB, then it will never fit
in a MFT record and will be stored as a non-resident attribute.

[Wonko the Sane]

The purpose of this application was to find the ldlinux.sys within an NTFS partition, patch it,
and write it again in a contiguous way. As ldlinux.sys is bigger than 1 KiB, then it will never fit
in a MFT record and will be stored as a non-resident attribute.

Sure , just pointing out a (missing) feature of all three apps, that's the idea of the "maybe useful, maybe not" incipit.


Wonko

[Sha0]

When you are awake check: ...

I could have sworn that the last thing I did before uploading and gotoing sleep was to switch the FILESECT reference to NTFSTEST. I guess not! I must have done them in the other order.

Maybe useful, maybe not:
http://www.wd-3.com/...e/luserland.htm

This link appears in each of the source files.

http://www.codeproje...iles/FDump.aspx

Both above tools and yours do not find/take into consideration the &quot;small files&quot; that go directly into the $MFT. (BOOT.INI is a common example of a file that usually is NOT on a cluster, but stored directly inside the $MFT)

True. Then it can't report clusters nor LBA for those files, I guess.

[Wonko the Sane]

True. Then it can't report clusters nor LBA for those files, I guess.

Yep.
Again, maybe useful, maybe not:
http://www.forensicf...iewtopic&t=7970
http://code.google.com/p/mft2csv/


Wonko

[Paulo Alcantara]

Yep.
Again, maybe useful, maybe not:
http://www.forensicf...iewtopic&t=7970
http://code.google.com/p/mft2csv/


Wonko

Hi,

Uhrm - These links seem to be relevant for what we're looking for.
Thanks!


Regards,

Paulo

[Sha0]

Here is the latest work, attached.
---EDIT--- Newer version in a more recent post. The version that was attached to this post had been downloaded 10 times.

extlinux - Linux 32-bit installer
fresh_hdd.7z - 7-Zip archive w/ a 100 MiB HDD image w/ a fresh NTFS partition
ntfstest.exe - Dumps NTFS file cluster info
syslinux.exe - Windows 32-bit installer

[jimicus]

Hi guys

This is quite well timed for me; I'm putting together a slightly hacked version of DBAN which can be run directly from Windows and SYSLINUX is much easier to set up than GRUB.

I've found Sha0's version works in a Windows 7 VirtualBox machine. I'm installing using the following command line:

syslinux -m -i -a -f %SYSTEMDRIVE%

At point where boot starts, I get an error:

EDD: Error 0100 reading sector 537077760


This doesn't stop DBAN from loading and running properly.

[Sha0]

Here is the latest version, attached.  ntfslinux.zip   102.27KB   48 downloads
This one passed more tests than the last one. Now I can boot Syslinux on my NTFS partition nicely! Enjoy.

Testers' efforts would be very appreciated!

C:\Documents and Settings\User\Desktop>syslinux.exe -f -i c:

 

C:\Documents and Settings\User\Desktop>copy con c:\syslinux.cfg

LABEL ntldr

  COM32 chain.c32

  APPEND fs ntldr=/ntldr

^Z (<CONTROL>-<Z> on the keyboard)

C:\Documents and Settings\User\Desktop>copy syslinux_download_dir\com32\modules\chain.c32 c:\

  1 file(s) copied.

P. S. Thanks for trying it out, jimicus!

[jimicus]

The error reading sector issue is gone, but it seems to take a very long time (several seconds) to load the image. Given that DBAN.BZI is only 10MB, I'd have expected it to be quite quick.

Two questions:

• Is there any plan to submit these changes upstream?
• Is the link for the latest source code the github one Paulo posted up before?

[Sha0]

The error reading sector issue is gone, but it seems to take a very long time (several seconds) to load the image. Given that DBAN.BZI is only 10MB, I'd have expected it to be quite quick.

It's possible that speed improvements can be made.

Two questions:

• Is there any plan to submit these changes upstream?

If users test and tests pass, then it's possible that H. Peter Anvin will accept Paulo's branch, I believe. This is why testing is appreciated.

• Is the link for the latest source code the github one Paulo posted up before?

The source code is here.

[windstar]

I was wondering whether there is any progress on this promising project... I'd love to see this realized one day!

[Icecube]

I compiled the last version of the experimental NTFS branch.
32-bit and 64-bit Windows syslinux.exe installers included.

Edit: Removed attachment. Newer version attached below.

[CorreoMail]

Sha0 & Icecube, both versions boots but doesnt shows the menu, looks like bucle reading the hard drive any clue about it?

Im trying to install it in a 160Gb USB Drive

[Icecube]

@ CorreoMail
Can you show the exact commands you used to install Syslinux?
Can you post your syslinux.cfg file (and the location: which directory)?
Add ls.c32 to your USB drive (preferable in the root of the partition) and try to list the files in different directories from the boot: prompt:

boot: /ls.c32 /



boot: /ls.c32 /some_dir

[Paulo Alcantara]

I compiled the last version of the experimental NTFS branch.
32-bit and 64-bit Windows syslinux.exe installers included.

Thanks Shao and Gerth for your helps.

It's been a while that I don't touch Syslinux code and don't post
anything in here. (Maintaining PySide drags me out too much)

I uploaded them out again for the #syslinux's people being able to download
them without being a reboot.pro's user and the only guy which tested it got it
working properly and tested hdt.c32 and ls.c32 at the "boot: " prompt.


Paulo

[Paulo Alcantara]

Night all,

Gracefully NTFS readonly file system support is now available on Syslinux version 4.06.
Since commit d2240176af6ac239216b160611ed74d481095a4b.

If any of you find out a bug on the implementation, please report that to the
Syslinux mailing list.


Paulo

[windstar]

Great news there Paulo, going to test it in a couple of days.

[Paulo Alcantara]

Great news there Paulo, going to test it in a couple of days.

Hi,

Indeed!
And thanks for pretending to test it. Heh :-)


Paulo

[Icecube]

Syslinux 4.06 pre-releases:
http://www.kernel.or...x/Testing/4.06/

[Icecube]

Newer version which patches some bugs, attached.

Attached Files

•  syslinux-ntfs-20111227.tar.7z   4.34MB   3585 downloads

[Icecube]

Last test version attached. Please test and report back if you find bugs.

Edit: Removed attachment.

[Icecube]

Last test version attached (bug fix). Please test and report back if you find bugs.

Edit: removed attachment.

[NetFanTom]

@Icecube:
syslinux-ntfs-2012-01-23.tar.7z

Sorry, i miss the win32syslinux.exe and the win64syslinux64.exe.

Regards,
NetFanTom