Linux????????????NTFS?????
?????????(??????) ???????[ 2017/3/29 10:22:40 ] ?????????????? Linux
????????
???????????NTFS??????????
????1??$MFT????2?????
????2?????????90?????1????????????????????????????????80-100??????????????1???????
????3???д??????????2?????????????ɡ?(???????2?????)
????1??shell ??????£?
#!/bin/sh
#
#
# Created by www.frombyte.com ???? on 2017/3/29.
#
mkdir /mnt/padding
cd /mnt/padding
#?????for???????30???????????????80-100?????????С?16K-48K??????λ???????
for((i=1;i<=30;i++));do
mkdir /mnt/$i
r1=$(($RANDOM % 20))
for((ii=1;ii<80+$r1;ii++));do
r2=$(($RANDOM % 8 + 4))
dd if=/dev/urandom of=/mnt/$i/$ii bs=4096 count=$r2
done
done
#sleep 60 ???????????flush
sleep 60
#?????for?????dd??????for???????????????0-16K??λ???д??48K-80K??????????2?????
for((i=1;i<=30;i++));do
cd /mnt/$i
r2=$(($RANDOM % 8 + 12))
r3=$(($RANDOM % 4))
for ii in `ls`;do
r2=$(($RANDOM % 8 + 12))
dd if=/dev/urandom of=/mnt/$i/$ii bs=4096 seek=$r3 count=$r2
done
done
#???65000????????????????NTFS $MFT???????????????????Σ????????$MFT ?????
for((i=1;i<65000;i++));do
touch $i
done
#????????for?????????????????for????????????Щ????????????д??$mft?????????????????????????????????
for((i=31;i<=90;i++));do
mkdir /mnt/$i
r1=$(($RANDOM % 20))
for((ii=1;ii<80+$r1;ii++));do
r2=$(($RANDOM % 8 + 4))
dd if=/dev/urandom of=/mnt/$i/$ii bs=4096 count=$r2
done
done
sleep 60
for((i=31;i<=90;i++));do
cd /mnt/$i
r2=$(($RANDOM % 8 + 12))
r3=$(($RANDOM % 4))
for ii in `ls`;do
r2=$(($RANDOM % 8 + 12))
dd if=/dev/urandom of=/mnt/$i/$ii bs=4096 seek=$r3 count=$r2
done
done
#???padding??????????????
rm -rf /mnt/padding
????2????shell?????????????
qemu-img create -f raw test2.img 1G
qemu-nbd -f raw -c /dev/nbd0 test2.img
fdisk /dev/nbd0 #??????????????/dev/nbd0????????????????????parted?????
mkfs.ntfs -f /dev/nbd0p1
mount.ntfs-3g /dev/nbd0p1 /mnt
/bin/bash run.sh
????3???????????????
???????????ntfscluster -f -I 0 /dev/nbd0p1
?????????????????$mft????2??????
Forced to continue.
Dump: /$MFT
0x10 - resident
0x30 - resident
0x80 - non-resident
VCN LCN Length
0 4 16387
16387 20488 1880
0xb0 - non-resident
VCN LCN Length
0 2 2
2 16391 1
???????????ntfscluster -f -F 1/ /dev/nbd0p1
???????????????????????????2?????
Forced to continue.
Unnormalized path 1/
Dump: /1
0x10 - resident
0x30 - resident
0x50 - resident
0x90 - resident
0xa0 - non-resident
VCN LCN Length
0 53328 2
2 49238 1
0xb0 - resident
????????????
????ntfscluster -f -F 60/9 /dev/nbd0p1
????????????????????????????2?????
Forced to continue.
Dump: /60/9
0x10 - resident
0x30 - resident
0x50 - resident
0x80 - non-resident
VCN LCN Length
0 211991 8
8 115298 7
??????
???·???
??????????????????
2023/3/23 14:23:39???д?ò??????????
2023/3/22 16:17:39????????????????????Щ??
2022/6/14 16:14:27??????????????????????????
2021/10/18 15:37:44???????????????
2021/9/17 15:19:29???·???????·
2021/9/14 15:42:25?????????????
2021/5/28 17:25:47??????APP??????????
2021/5/8 17:01:11