Changeset 69910 in vbox

Timestamp:

Dec 3, 2017 5:06:56 PM (7 years ago)

Author:

vboxsync

Message:

IPRT/ntfsvfs.cpp: More on the subject of directories (indexes).

Location:

trunk

Files:

• include/iprt/formats/fat.h (modified) (1 diff)
• include/iprt/formats/ntfs.h (modified) (7 diffs)
• src/VBox/Runtime/common/fs/ntfsvfs.cpp (modified) (21 diffs)

trunk/include/iprt/formats/fat.h

@@ -468 +468 @@
     /** 0x41 / 0x36: Reserved. */
     uint8_t         abReserved3[3];
-    /** 0x44 / 0x39: Logical clusters pre index block.
+    /** 0x44 / 0x39: The default logical clusters count per index node.
      * This is a shift count if negative.  */
-    int8_t          cClusterPerIndexBlock;
+    int8_t          cClustersPerIndexNode;
     /** 0x45 / 0x3a: Reserved. */
     uint8_t         abReserved4[3];

trunk/include/iprt/formats/ntfs.h

@@ -139 +139 @@
 /** Pointer to a const NTFS record header. */
 typedef NTFSRECHDR const *PCNTFSRECHDR;
+
+/** The multi-sector update sequence stride.
+ * @see https://msdn.microsoft.com/en-us/library/bb470212%28v=vs.85%29.aspx
+ * @see NTFSRECHDR::offUpdateSeqArray, NTFSRECHDR::cUpdateSeqEntries
+ */
+#define NTFS_MULTI_SECTOR_STRIDE        512
 
 
@@ -332 +338 @@
 #define NTFSATTRIBHDR_GET_NAME(a_pAttrHdr)          ( (PRTUTF16)((uintptr_t)(a_pAttrHdr) + (a_pAttrHdr)->offName) )
 
+/** Get the pointer to resident value.
+ * @note  ASSUMES the caller checks that it's resident and valid. */
+#define NTFSATTRIBHDR_GET_RES_VALUE_PTR(a_pAttrHdr) ( (uint8_t *)(a_pAttrHdr) + (a_pAttrHdr)->u.Res.offValue )
+
 
 /** @name NTFS_RES_AF_XXX
@@ -549 +559 @@
  * NTFS index header.
  *
- * This is used by NTFSATINDEXROOT and NTFSATINDEXALLOC.
- */
-typedef struct NTFSINDEXHEADER
+ * This is used by NTFSATINDEXROOT and NTFSATINDEXALLOC as a prelude to the
+ * sequence of entries in a node.
+ */
+typedef struct NTFSINDEXHDR
 {
     /** 0x00: Offset of the first entry relative to this header. */
     uint32_t        offFirstEntry;
-    /** 0x04: Size of the index in bytes, including this header.  */
-    uint32_t        cbIndex;
+    /** 0x04: Current index size in bytes, including this header.  */
+    uint32_t        cbUsed;
     /** 0x08: Number of bytes allocated for the index (including this header). */
     uint32_t        cbAllocated;
-    /** 0x0c: Flags (NTFSINDEXHEADER_F_XXX).   */
+    /** 0x0c: Flags (NTFSINDEXHDR_F_XXX).   */
     uint8_t         fFlags;
     /** 0x0d: Reserved bytes. */
     uint8_t         abReserved[3];
-} NTFSINDEXHEADER;
-AssertCompileSize(NTFSINDEXHEADER, 16);
+    /* NTFSIDXENTRYHDR sequence typically follows here */
+} NTFSINDEXHDR;
+AssertCompileSize(NTFSINDEXHDR, 16);
 /** Pointer to a NTFS index header. */
-typedef NTFSINDEXHEADER *PNTFSINDEXHEADER;
+typedef NTFSINDEXHDR *PNTFSINDEXHDR;
 /** Pointer to a const NTFS index header. */
-typedef NTFSINDEXHEADER const *PCNTFSINDEXHEADER;
-
-/** Index root only: Small enough to fit inside the index root attrib.  */
-#define NTFSINDEXHEADER_F_ROOT_SMALL        UINT8_C(0x00)
-/** Index root only: Too large to fit inside the index root attrib and/or an
- *  index allocation attribute is present. */
-#define NTFSINDEXHEADER_F_ROOT_LARGE        UINT8_C(0x01)
-
-
-/**
- * NTFS index root (NTFS_AT_INDEX_ROOT).
+typedef NTFSINDEXHDR const *PCNTFSINDEXHDR;
+
+/** @name NTFSINDEXHDR_F_XXX
+ * @{ */
+/** An internal node (as opposed to a leaf node if clear).
+ * This means that the entries will have trailing node references (VCN). */
+#define NTFSINDEXHDR_F_INTERNAL        UINT8_C(0x01)
+/** @} */
+
+
+/**
+ * NTFS index root node (NTFS_AT_INDEX_ROOT).
  *
  * This is a generic index structure, but is most prominently used for
- * implementating directories.
+ * implementating directories.  The index is structured like B-tree, meaning
+ * each node contains multiple entries, and each entry contains data regardless
+ * of whether it's a leaf node or not.
+ *
+ * The index is sorted in ascending order according to the collation rules
+ * defined by the root node (NTFSATINDEXROOT::uCollationRules, see also (see
+ * NTFS_COLLATION_XXX).
+ *
+ * @note    The root directory contains a '.' entry, others don't.
  */
 typedef struct NTFSATINDEXROOT
@@ -589 +610 @@
     /** 0x04: The sorting rules to use (NTFS_COLLATION_XXX). */
     uint32_t        uCollationRules;
-    /** 0x08: Index buffer size (in bytes). */
-    uint32_t        cbIndexBuffer;
-    /** 0x0c: Number of clusters allocated for each index buffer if
-     * cbIndexBuffer is larger than a cluster, otherwise log2(cbIndexBuffer)?  */
-    uint8_t         cClustersPerBuffer;
+    /** 0x08: Number of bytes in
+     *  Index node size (in bytes). */
+    uint32_t        cbIndexNode;
+    /** 0x0c: Number of node addresses per node.
+     * This sounds weird right?  A subnode is generally addressed as a virtual
+     * cluster when cbIndexNode >= cbCluster, but when clusters are large NTFS uses
+     * 512 bytes chunks.
+     *
+     * (You would've thought it would be simpler to just use cbIndexNode as the
+     * addressing unit, maybe storing the log2 here to avoid a ffs call.) */
+    uint8_t         cAddressesPerIndexNode;
     /** 0x0d: Reserved padding or something. */
     uint8_t         abReserved[3];
     /** 0x10: Index header detailing the entries that follows. */
-    NTFSINDEXHEADER Hdr;
-    /* NTFSINDEXENTRYHDR array typically follows */
+    NTFSINDEXHDR    Hdr;
+    /*  0x20: NTFSIDXENTRYHDR sequence typically follows here */
 } NTFSATINDEXROOT;
 AssertCompileSize(NTFSATINDEXROOT, 32);
@@ -611 +638 @@
 #define NTFSATINDEXROOT_TYPE_VIEW           RT_H2LE_U32_C(UINT32_C(0x00000000))
 /** Directory index, NTFSATFILENAME follows NTFSINDEXENTRY. */
-#define NTFSATINDEXROOT_TYPE_DIRECTORY      RT_H2LE_U32_C(UINT32_C(0x00000030))
+#define NTFSATINDEXROOT_TYPE_DIR            RT_H2LE_U32_C(UINT32_C(0x00000030))
 /** @} */
 
@@ -631 +658 @@
 /** Sequence of little endian 32-bit unsigned integer values used as sorting key. */
 #define NTFS_COLLATION_UINT32_SEQ           RT_H2LE_U32_C(UINT32_C(0x00000013))
-
-/** @} */
+/** @} */
+
+
+/**
+ * NTFS index non-root node.
+ */
+typedef struct NTFSATINDEXALLOC
+{
+    /** 0x00: Header with NTFSREC_MAGIC_INDEX_ALLOC. */
+    NTFSRECHDR      RecHdr;
+    /** 0x08: Log file sequence number. */
+    uint64_t        uLsn;
+    /** 0x10: The node address of this node (for consistency checking and
+     * perhaps data reconstruction).
+     * @see NTFSATINDEXROOT::cAddressesPerIndexNode for node addressing. */
+    int64_t         iSelfAddress;
+    /** 0x18: Index header detailing the entries that follows. */
+    NTFSINDEXHDR    Hdr;
+    /*  0x28: NTFSIDXENTRYHDR sequence typically follows here */
+} NTFSATINDEXALLOC;
+AssertCompileSize(NTFSATINDEXALLOC, 40);
+/** Pointer to a NTFS index non-root node. */
+typedef NTFSATINDEXALLOC *PNTFSATINDEXALLOC;
+/** Pointer to a const NTFS index non-root node. */
+typedef NTFSATINDEXALLOC const *PCNTFSATINDEXALLOC;
+
+/** NTFS 'INDX' attribute magic value (NTFSATINDEXALLOC).
+ * @todo sort out the record / attribute name clash here.  */
+#define NTFSREC_MAGIC_INDEX_ALLOC           RT_H2LE_U32_C(UINT32_C(0x58444e49))
 
 
 /**
  * NTFS index entry header.
- */
-typedef struct NTFSINDEXENTRYHDR
+ *
+ * Each entry in a node starts with this header.  It is immediately followed by
+ * the key data (NTFSIDXENTRYHDR::cbKey).  When
+ *
+ */
+typedef struct NTFSIDXENTRYHDR
 {
     union
     {
-        /** 0x00: Non-View: Reference to the MFT record being indexed here.
-         * This is invalid if NTFSINDEX_EF_LAST is set.  */
+        /** 0x00: NTFSATINDEXROOT_TYPE_DIR: Reference to the MFT record being indexed here.
+         * @note This is invalid if NTFSIDXENTRYHDR_F_END is set (no key data). */
         NTFSMFTREF      FileMftRec;
-        /** 0x00: View   */
+        /** 0x00: NTFSATINDEXROOT_TYPE_VIEW: Go figure later if necessary. */
         struct
         {
-            /** 0x00: Offset to the data relative to this header. */
+            /** 0x00: Offset to the data relative to this header.
+             * @note This is invalid if NTFSIDXENTRYHDR_F_END is set (no key data). */
             uint16_t    offData;
-            /** 0x02: Size of data at offData. */
+            /** 0x02: Size of data at offData.
+             * @note This is invalid if NTFSIDXENTRYHDR_F_END is set (no key data). */
             uint16_t    cbData;
             /** 0x04: Reserved.   */
@@ -661 +721 @@
     /** 0x0a: Key length (unaligned). */
     uint16_t        cbKey;
-    /** 0x0c: Entry flags, NTFSINDEX_EF_XXX. */
+    /** 0x0c: Entry flags, NTFSIDXENTRYHDR_F_XXX. */
     uint16_t        fFlags;
-    /** 0x0d: Entry flags, NTFSINDEX_EF_XXX. */
+    /** 0x0e: Reserved. */
     uint16_t        uReserved;
-} NTFSINDEXENTRYHDR;
-AssertCompileSize(NTFSINDEXENTRYHDR, 16);
+} NTFSIDXENTRYHDR;
+AssertCompileSize(NTFSIDXENTRYHDR, 16);
 /** Pointer to a NTFS index entry header. */
-typedef NTFSINDEXENTRYHDR *PNTFSINDEXENTRYHDR;
+typedef NTFSIDXENTRYHDR *PNTFSIDXENTRYHDR;
 /** Pointer to a const NTFS index entry header. */
-typedef NTFSINDEXENTRYHDR const *PCNTFSINDEXENTRYHDR;
-
-/** @name  NTFSINDEX_EF_XXX - NTFSINDEXENTRYHDR::fFlags
- * @{ */
-/** Indicates an internal node, as opposed to a leaf node. */
-#define NTFSINDEX_EF_NODE           RT_H2LE_U16_C(UINT16_C(0x0001))
-/** Last entry in a block, may point to the next node. */
-#define NTFSINDEX_EF_LAST           RT_H2LE_U16_C(UINT16_C(0x0002))
+typedef NTFSIDXENTRYHDR const *PCNTFSIDXENTRYHDR;
+
+/** @name  NTFSIDXENTRYHDR_F_XXX - NTFSIDXENTRYHDR::fFlags
+ * @{ */
+/** Indicates an internal node (as opposed to a leaf node).
+ * This indicates that there is a 64-bit integer value at the very end of the
+ * entry (NTFSIDXENTRYHDR::cbEntry - 8) giving the virtual cluster number of the
+ * subnode.  The subnode and all its decendants contain keys that are lower than
+ * the key in this entry.
+ */
+#define NTFSIDXENTRYHDR_F_INTERNAL          RT_H2LE_U16_C(UINT16_C(0x0001))
+/** Set if special end entry in a node.
+ * This does not have any key data, but can point to a subnode with
+ * higher keys.  */
+#define NTFSIDXENTRYHDR_F_END               RT_H2LE_U16_C(UINT16_C(0x0002))
 /** @}  */
 
+/** Gets the pointer to the next index entry header. */
+#define NTFSIDXENTRYHDR_GET_NEXT(a_pEntryHdr) \
+    ( (PNTFSIDXENTRYHDR)((uintptr_t)(a_pEntryHdr) + RT_LE2H_U16((a_pEntryHdr)->cbEntry)) )
+/** Gets the subnode address from an index entry.
+ * @see NTFSATINDEXROOT::cAddressesPerIndexNode for node addressing.
+ * @note Only invoke when NTFSIDXENTRYHDR_F_INTERNAL is set! */
+#define NTFSIDXENTRYHDR_GET_SUBNODE(a_pEntryHdr) \
+    ( *(int64_t *)((uintptr_t)(a_pEntryHdr) + RT_LE2H_U16((a_pEntryHdr)->cbEntry) - sizeof(int64_t)) )
+
 /** @} */
 

trunk/src/VBox/Runtime/common/fs/ntfsvfs.cpp

@@ -265 +265 @@
     /** The MFT record size. */
     uint32_t        cbMftRecord;
-    /** The index record size. */
-    uint32_t        cbIndexRecord;
+    /** The default index (B-tree) node size. */
+    uint32_t        cbDefaultIndexNode;
 
     /** The volume serial number. */
@@ -306 +306 @@
 *********************************************************************************************************************************/
 static uint32_t rtFsNtfsCore_Release(PRTFSNTFSCORE pThis);
+#ifdef LOG_ENABLED
+static void     rtFsNtfsVol_LogIndexRoot(PCNTFSATINDEXROOT pIdxRoot, uint32_t cbIdxRoot);
+#endif
 
 
@@ -580 +583 @@
                             //case NTFS_AT_VOLUME_INFORMATION:
                             //case NTFS_AT_DATA:
-                            //case NTFS_AT_INDEX_ROOT:
+
+                            case NTFS_AT_INDEX_ROOT:
+                                rtFsNtfsVol_LogIndexRoot((PCNTFSATINDEXROOT)pbValue, cbValue);
+                                break;
+
                             //case NTFS_AT_INDEX_ALLOCATION:
                             //case NTFS_AT_BITMAP:
@@ -637 +644 @@
                         uint32_t const cbMaxPairs = cbAttrib - offMappingPairs;
                         int64_t iVnc = pHdr->u.NonRes.iVcnFirst;
-                        Log2(("NTFS:     Mapping Pairs: %.*Rhxsd\n", cbMaxPairs, pbPairs));
+                        if (cbMaxPairs < 48)
+                            Log2(("NTFS:     Mapping Pairs: cbMaxPairs=%#x %.*Rhxs\n", cbMaxPairs, cbMaxPairs, pbPairs));
+                        else
+                            Log2(("NTFS:     Mapping Pairs: cbMaxPairs=%#x\n%.*Rhxd\n", cbMaxPairs, cbMaxPairs, pbPairs));
                         if (!iVnc && !*pbPairs)
                             Log2(("NTFS:         [0]: Empty\n"));
@@ -643 +653 @@
                         {
                             if (iVnc != 0)
-                                Log2(("NTFS:         [0]: VCN=%#012RX64 L %#012RX64 - not mapped\n", 0, iVnc));
+                                Log2(("NTFS:         [00/0x000]: VCN=%#012RX64 L %#012RX64 - not mapped\n", 0, iVnc));
                             int64_t  iLnc     = 0;
                             uint32_t iPair    = 0;
@@ -656 +666 @@
                                 if (offPairs + cbRun > cbMaxPairs)
                                 {
-                                    Log2(("NTFS:         [%d]: run overrun! cbRun=%#x bLengths=%#x offPairs=%#x cbMaxPairs=%#x\n",
-                                          iPair, cbRun, bLengths, offPairs, cbMaxPairs));
+                                    Log2(("NTFS:         [%02d/%#05x]: run overrun! cbRun=%#x bLengths=%#x offPairs=%#x cbMaxPairs=%#x\n",
+                                          iPair, offPairs, cbRun, bLengths, offPairs, cbMaxPairs));
                                     break;
                                 }
+                                //Log2(("NTFS:         @%#05x: %.*Rhxs\n", offPairs, cbRun + 1, &pbPairs[offPairs]));
 
                                 /* Value 1: Number of (virtual) clusters in this run. */
@@ -683 +694 @@
                                         cLcnDelta = (cLcnDelta << 8) + *pbNum--;
                                     iLnc += cLcnDelta;
-                                    Log2(("NTFS:         [%d]: VNC=%#012RX64 L %#012RX64 => LNC=%#012RX64\n",
-                                          iPair, iVnc, cClustersInRun, iLnc));
+                                    Log2(("NTFS:         [%02d/%#05x]: VNC=%#012RX64 L %#012RX64 => LNC=%#012RX64\n",
+                                          iPair, offPairs, iVnc, cClustersInRun, iLnc));
                                 }
                                 else
-                                    Log2(("NTFS:         [%d]: VNC=%#012RX64 L %#012RX64 => HOLE\n",
-                                          iPair, iVnc, cClustersInRun));
+                                    Log2(("NTFS:         [%02d/%#05x]: VNC=%#012RX64 L %#012RX64 => HOLE\n",
+                                          iPair, offPairs, iVnc, cClustersInRun));
 
                                 /* Advance. */
@@ -1240 +1251 @@
                     {
                         rc = RTVfsFileReadAt(pVol->hVfsBacking, pTable->paExtents[iExtent].off + off, pvBuf, cbThisRead, NULL);
+                        Log4(("NTFS: Volume read: @%#RX64 LB %#zx -> %Rrc\n", pTable->paExtents[iExtent].off + off, cbThisRead, rc));
                         if (RT_FAILURE(rc))
                             break;
@@ -1284 +1296 @@
 
 /**
+ *
+ * @returns
+ * @param   pRecHdr             .
+ * @param   cbRec               .
+ * @param   fRelaxedUsa         .
+ * @param   pErrInfo            .
+ *
+ * @see https://msdn.microsoft.com/en-us/library/bb470212%28v=vs.85%29.aspx
+ */
+static int rtFsNtfsRec_DoMultiSectorFixups(PNTFSRECHDR pRecHdr, uint32_t cbRec, bool fRelaxedUsa, PRTERRINFO pErrInfo)
+{
+    /*
+     * Do sanity checking.
+     */
+    uint16_t offUpdateSeqArray = RT_LE2H_U16(pRecHdr->offUpdateSeqArray);
+    uint16_t cUpdateSeqEntries = RT_LE2H_U16(pRecHdr->cUpdateSeqEntries);
+    if (   !(cbRec & (NTFS_MULTI_SECTOR_STRIDE - 1))
+        && !(offUpdateSeqArray & 1) /* two byte aligned */
+        && cUpdateSeqEntries == 1 + cbRec / NTFS_MULTI_SECTOR_STRIDE
+        && offUpdateSeqArray + (uint32_t)cUpdateSeqEntries * 2U < NTFS_MULTI_SECTOR_STRIDE - 2U)
+    {
+        uint16_t const *pauUsa = (uint16_t const *)((uint8_t *)pRecHdr + offUpdateSeqArray);
+
+        /*
+         * The first update seqence array entry is the value stored at
+         * the fixup locations at the end of the blocks.  We read this
+         * and check each of the blocks.
+         */
+        uint16_t const uCheck = *pauUsa++;
+        cUpdateSeqEntries--;
+        for (uint16_t iBlock = 0; iBlock < cUpdateSeqEntries; iBlock++)
+        {
+            uint16_t const *puBlockCheck = (uint16_t const *)((uint8_t *)pRecHdr + (iBlock + 1) * NTFS_MULTI_SECTOR_STRIDE - 2U);
+            if (*puBlockCheck == uCheck)
+            { /* likely */ }
+            else if (!fRelaxedUsa)
+                return RTERRINFO_LOG_REL_SET_F(pErrInfo, VERR_VFS_BOGUS_OFFSET,
+                                               "Multisector transfer error: block #%u ends with %#x instead of %#x (fixup: %#x)",
+                                               iBlock, RT_LE2H_U16(*puBlockCheck), RT_LE2H_U16(uCheck), RT_LE2H_U16(pauUsa[iBlock]) );
+            else
+            {
+                Log(("NTFS: Multisector transfer warning: block #%u ends with %#x instead of %#x (fixup: %#x)\n",
+                     iBlock, RT_LE2H_U16(*puBlockCheck), RT_LE2H_U16(uCheck), RT_LE2H_U16(pauUsa[iBlock]) ));
+                return VINF_SUCCESS;
+            }
+        }
+
+        /*
+         * Apply the fixups.
+         * Note! We advanced pauUsa above, so it's now at the fixup values.
+         */
+        for (uint16_t iBlock = 0; iBlock < cUpdateSeqEntries; iBlock++)
+        {
+            uint16_t *puFixup = (uint16_t *)((uint8_t *)pRecHdr + (iBlock + 1) * NTFS_MULTI_SECTOR_STRIDE - 2U);
+            *puFixup = pauUsa[iBlock];
+        }
+        return VINF_SUCCESS;
+    }
+    if (fRelaxedUsa)
+    {
+        Log(("NTFS: Ignoring bogus multisector update sequence: cbRec=%#x uMagic=%#RX32 offUpdateSeqArray=%#x cUpdateSeqEntries=%#x\n",
+             cbRec, RT_LE2H_U32(pRecHdr->uMagic), offUpdateSeqArray, cUpdateSeqEntries ));
+        return VINF_SUCCESS;
+    }
+    return RTERRINFO_LOG_REL_SET_F(pErrInfo, VERR_VFS_BOGUS_OFFSET,
+                                   "Bogus multisector update sequence: cbRec=%#x uMagic=%#RX32 offUpdateSeqArray=%#x cUpdateSeqEntries=%#x",
+                                   cbRec, RT_LE2H_U32(pRecHdr->uMagic), offUpdateSeqArray, cUpdateSeqEntries);
+}
+
+
+/**
  * Allocate and parse an MFT record, returning a core object structure.
  *
@@ -1289 +1372 @@
  * @param   pThis               The NTFS volume instance.
  * @param   idxMft              The index of the MTF record.
+ * @param   fRelaxedUsa         Relaxed update sequence checking. Won't fail if
+ *                              checks doesn't work or not present.
  * @param   ppCore              Where to return the core object structure.
  * @param   pErrInfo            Where to return error details.  Optional.
  */
-static int rtFsNtfsVol_NewCoreForMftIdx(PRTFSNTFSVOL pThis, uint64_t idxMft, PRTFSNTFSCORE *ppCore, PRTERRINFO pErrInfo)
+static int rtFsNtfsVol_NewCoreForMftIdx(PRTFSNTFSVOL pThis, uint64_t idxMft, bool fRelaxedUsa,
+                                        PRTFSNTFSCORE *ppCore, PRTERRINFO pErrInfo)
 {
     *ppCore = NULL;
@@ -1303 +1389 @@
     uint64_t offRec = idxMft * pThis->cbMftRecord;
     int rc = rtFsNtfsAttr_Read(pThis->pMftData, offRec, pRec->pbRec, pThis->cbMftRecord);
+    if (RT_SUCCESS(rc))
+        rc = rtFsNtfsRec_DoMultiSectorFixups(&pRec->pFileRec->Hdr, pThis->cbMftRecord, fRelaxedUsa, pErrInfo);
     if (RT_SUCCESS(rc))
     {
@@ -1469 +1557 @@
  */
 
+#ifdef LOG_ENABLED
+
+/**
+ * Logs an index header and all the entries.
+ *
+ * @param   pIdxHdr     The index header.
+ * @param   cbIndex     The number of valid bytes starting with the header.
+ * @param   offIndex    The offset of the index header into the parent
+ *                      structure.
+ * @param   pszPrefix   The log prefix.
+ * @param   uIdxType    The index type.
+ */
+static void rtFsNtfsVol_LogIndexHdrAndEntries(PCNTFSINDEXHDR pIdxHdr, uint32_t cbIndex, uint32_t offIndex,
+                                              const char *pszPrefix, uint32_t uIdxType)
+{
+    if (!LogIs2Enabled())
+        return;
+
+    /*
+     * Do the header.
+     */
+    if (cbIndex <= sizeof(*pIdxHdr))
+    {
+        Log2(("NTFS: %s: Error! Not enough space for the index header! cbIndex=%#x, index head needs %#x\n",
+              pszPrefix, cbIndex, sizeof(*pIdxHdr)));
+        return;
+    }
+
+    Log2(("NTFS: %s:    offFirstEntry %#x%s\n", pszPrefix, RT_LE2H_U32(pIdxHdr->offFirstEntry),
+          RT_LE2H_U32(pIdxHdr->offFirstEntry) >= cbIndex ? " !out-of-bounds!" : ""));
+    Log2(("NTFS: %s:           cbUsed %#x%s\n", pszPrefix, RT_LE2H_U32(pIdxHdr->cbUsed),
+          RT_LE2H_U32(pIdxHdr->cbUsed) > cbIndex ? " !out-of-bounds!" : ""));
+    Log2(("NTFS: %s:      cbAllocated %#x%s\n", pszPrefix, RT_LE2H_U32(pIdxHdr->cbAllocated),
+          RT_LE2H_U32(pIdxHdr->cbAllocated) > cbIndex ? " !out-of-bounds!" : ""));
+    Log2(("NTFS: %s:           fFlags %#x (%s%s)\n", pszPrefix, pIdxHdr->fFlags,
+          pIdxHdr->fFlags & NTFSINDEXHDR_F_INTERNAL ? "internal" : "leaf",
+          pIdxHdr->fFlags & ~NTFSINDEXHDR_F_INTERNAL ? " !!unknown-flags!!" : ""));
+    if (pIdxHdr->abReserved[0]) Log2(("NTFS: %s:    abReserved[0] %#x\n", pszPrefix, pIdxHdr->abReserved[0]));
+    if (pIdxHdr->abReserved[1]) Log2(("NTFS: %s:    abReserved[0] %#x\n", pszPrefix, pIdxHdr->abReserved[1]));
+    if (pIdxHdr->abReserved[2]) Log2(("NTFS: %s:    abReserved[0] %#x\n", pszPrefix, pIdxHdr->abReserved[2]));
+
+    /*
+     * The entries.
+     */
+    bool        fSeenEnd    = false;
+    uint32_t    iEntry      = 0;
+    uint32_t    offCurEntry = RT_LE2H_U32(pIdxHdr->offFirstEntry);
+    while (offCurEntry < cbIndex)
+    {
+        if (offCurEntry + sizeof(NTFSIDXENTRYHDR) > cbIndex)
+        {
+            Log2(("NTFS:    Entry[%#04x]:  Out of bounds: %#x LB %#x, max %#x\n",
+                  iEntry, offCurEntry, sizeof(NTFSIDXENTRYHDR), cbIndex));
+            break;
+        }
+        PCNTFSIDXENTRYHDR pEntryHdr = (PCNTFSIDXENTRYHDR)((uint8_t const *)pIdxHdr + offCurEntry);
+        Log2(("NTFS:    [%#04x]: @%#05x/@%#05x cbEntry=%#x cbKey=%#x fFlags=%#x (%s%s%s)\n",
+              iEntry, offCurEntry, offCurEntry + offIndex, RT_LE2H_U16(pEntryHdr->cbEntry), RT_LE2H_U16(pEntryHdr->cbKey),
+              RT_LE2H_U16(pEntryHdr->fFlags),
+              pEntryHdr->fFlags & NTFSIDXENTRYHDR_F_INTERNAL ? "internal" : "leaf",
+              pEntryHdr->fFlags & NTFSIDXENTRYHDR_F_END ? " end" : "",
+              pEntryHdr->fFlags & ~(NTFSIDXENTRYHDR_F_INTERNAL | NTFSIDXENTRYHDR_F_END) ? " !unknown!" : ""));
+        if (uIdxType == NTFSATINDEXROOT_TYPE_DIR)
+            Log2(("NTFS:             FileMftRec %#RX64 sqn %#x\n",
+                  NTFSMFTREF_GET_IDX(&pEntryHdr->u.FileMftRec), NTFSMFTREF_GET_SEQ(&pEntryHdr->u.FileMftRec) ));
+        else
+            Log2(("NTFS:             offData=%#x cbData=%#x uReserved=%#x\n",
+                  RT_LE2H_U16(pEntryHdr->u.View.offData), RT_LE2H_U16(pEntryHdr->u.View.cbData),
+                  RT_LE2H_U32(pEntryHdr->u.View.uReserved) ));
+        if (pEntryHdr->fFlags & NTFSIDXENTRYHDR_F_INTERNAL)
+            Log2(("NTFS:             Subnode=%#RX64\n", RT_LE2H_U64(NTFSIDXENTRYHDR_GET_SUBNODE(pEntryHdr)) ));
+
+        if (   RT_LE2H_U16(pEntryHdr->cbKey) >= sizeof(NTFSATFILENAME)
+            && uIdxType == NTFSATINDEXROOT_TYPE_DIR)
+        {
+            PCNTFSATFILENAME pFilename = (PCNTFSATFILENAME)(pEntryHdr + 1);
+            Log2(("NTFS:             Filename=%.*ls\n", pFilename->cwcFilename, pFilename->wszFilename));
+        }
+
+
+        /* next */
+        iEntry++;
+        offCurEntry += RT_LE2H_U16(pEntryHdr->cbEntry);
+        fSeenEnd = RT_BOOL(pEntryHdr->fFlags & NTFSIDXENTRYHDR_F_END);
+        if (fSeenEnd || RT_LE2H_U16(pEntryHdr->cbEntry) < sizeof(*pEntryHdr))
+            break;
+    }
+    if (!fSeenEnd)
+        Log2(("NTFS: %s: Warning! Missing NTFSIDXENTRYHDR_F_END node!\n", pszPrefix));
+}
+
+static void rtFsNtfsVol_LogIndexNode(PCNTFSATINDEXALLOC pIdxNode, uint32_t cbIdxNode, uint32_t uType)
+{
+    if (!LogIs2Enabled())
+        return;
+    if (cbIdxNode < sizeof(*pIdxNode))
+        Log2(("NTFS: Index Node: Error! Too small! cbIdxNode=%#x, index node needs %#x\n", cbIdxNode, sizeof(*pIdxNode)));
+    else
+    {
+        Log2(("NTFS: Index Node:            uMagic %#x\n", RT_LE2H_U32(pIdxNode->RecHdr.uMagic)));
+        Log2(("NTFS: Index Node:    UpdateSeqArray %#x L %#x\n",
+              RT_LE2H_U16(pIdxNode->RecHdr.offUpdateSeqArray), RT_LE2H_U16(pIdxNode->RecHdr.cUpdateSeqEntries) ));
+        Log2(("NTFS: Index Node:              uLsn %#RX64\n", RT_LE2H_U64(pIdxNode->uLsn) ));
+        Log2(("NTFS: Index Node:      iSelfAddress %#RX64\n", RT_LE2H_U64(pIdxNode->iSelfAddress) ));
+        if (pIdxNode->RecHdr.uMagic == NTFSREC_MAGIC_INDEX_ALLOC)
+            rtFsNtfsVol_LogIndexHdrAndEntries(&pIdxNode->Hdr, cbIdxNode - RT_UOFFSETOF(NTFSATINDEXALLOC, Hdr),
+                                              RT_UOFFSETOF(NTFSATINDEXALLOC, Hdr), "Index Node Hdr", uType);
+        else
+            Log2(("NTFS: Index Node: !Error! Invalid magic!\n"));
+    }
+}
+
+
+/**
+ * Logs a index root structure and what follows (index header + entries).
+ *
+ * @param   pIdxRoot    The index root.
+ * @param   cbIdxRoot   Number of valid bytes starting with @a pIdxRoot.
+ */
+static void rtFsNtfsVol_LogIndexRoot(PCNTFSATINDEXROOT pIdxRoot, uint32_t cbIdxRoot)
+{
+    if (!LogIs2Enabled())
+        return;
+    if (cbIdxRoot < sizeof(*pIdxRoot))
+        Log2(("NTFS: Index Root: Error! Too small! cbIndex=%#x, index head needs %#x\n", cbIdxRoot, sizeof(*pIdxRoot)));
+    else
+    {
+        Log2(("NTFS: Index Root:              cbIdxRoot %#x\n", cbIdxRoot));
+        Log2(("NTFS: Index Root:                  uType %#x %s\n", RT_LE2H_U32(pIdxRoot->uType),
+              pIdxRoot->uType == NTFSATINDEXROOT_TYPE_VIEW ? "view"
+              : pIdxRoot->uType == NTFSATINDEXROOT_TYPE_DIR ? "directory" : "!unknown!"));
+        Log2(("NTFS: Index Root:        uCollationRules %#x %s\n", RT_LE2H_U32(pIdxRoot->uCollationRules),
+              pIdxRoot->uCollationRules == NTFS_COLLATION_BINARY ? "binary"
+              : pIdxRoot->uCollationRules == NTFS_COLLATION_FILENAME ? "filename"
+              : pIdxRoot->uCollationRules == NTFS_COLLATION_UNICODE_STRING ? "unicode-string"
+              : pIdxRoot->uCollationRules == NTFS_COLLATION_UINT32 ? "uint32"
+              : pIdxRoot->uCollationRules == NTFS_COLLATION_SID ? "sid"
+              : pIdxRoot->uCollationRules == NTFS_COLLATION_UINT32_PAIR ? "uint32-pair"
+              : pIdxRoot->uCollationRules == NTFS_COLLATION_UINT32_SEQ ? "uint32-sequence" : "!unknown!"));
+        Log2(("NTFS: Index Root:            cbIndexNode %#x\n", RT_LE2H_U32(pIdxRoot->cbIndexNode) ));
+        Log2(("NTFS: Index Root: cAddressesPerIndexNode %#x => cbNodeAddressingUnit=%#x\n",
+              pIdxRoot->cAddressesPerIndexNode, RT_LE2H_U32(pIdxRoot->cbIndexNode) / RT_MAX(1, pIdxRoot->cAddressesPerIndexNode) ));
+        if (pIdxRoot->abReserved[0]) Log2(("NTFS: Index Root:          abReserved[0] %#x\n", pIdxRoot->abReserved[0]));
+        if (pIdxRoot->abReserved[1]) Log2(("NTFS: Index Root:          abReserved[1] %#x\n", pIdxRoot->abReserved[1]));
+        if (pIdxRoot->abReserved[2]) Log2(("NTFS: Index Root:          abReserved[2] %#x\n", pIdxRoot->abReserved[2]));
+
+        rtFsNtfsVol_LogIndexHdrAndEntries(&pIdxRoot->Hdr, cbIdxRoot - RT_UOFFSETOF(NTFSATINDEXROOT, Hdr),
+                                          RT_UOFFSETOF(NTFSATINDEXROOT, Hdr), "Index Root Hdr", pIdxRoot->uType);
+    }
+}
+
+#endif /* LOG_ENABLED */
+
 
 static int rtFsNtfsVol_NewSharedDirFromCore(PRTFSNTFSVOL pThis, PRTFSNTFSCORE pCore, PRTFSNTFSDIRSHRD *ppSharedDir,
@@ -1478 +1719 @@
      * Look for the index root and do some quick checks of it first.
      */
-    PRTFSNTFSATTR pRootAttr = rtFsNtfsCore_FindNamedAttributeAscii(pCore, NTFS_AT_FILENAME,
-                                                                      NTFS_DIR_ATTRIBUTE_NAME, NTFS_AT_INDEX_ROOT);
+    PRTFSNTFSATTR pRootAttr = rtFsNtfsCore_FindNamedAttributeAscii(pCore, NTFS_AT_INDEX_ROOT,
+                                                                   RT_STR_TUPLE(NTFS_DIR_ATTRIBUTE_NAME));
     if (!pRootAttr)
         return RTERRINFO_LOG_REL_SET_F(pErrInfo, VERR_VFS_BOGUS_FORMAT, "%s: Found no INDEX_ROOT attribute named $I30", pszWhat);
     if (pRootAttr->pAttrHdr->fNonResident)
         return RTERRINFO_LOG_REL_SET_F(pErrInfo, VERR_VFS_BOGUS_FORMAT, "%s: INDEX_ROOT is is not resident", pszWhat);
-
+    if (pRootAttr->cbResident < sizeof(NTFSATINDEXROOT))
+        return RTERRINFO_LOG_REL_SET_F(pErrInfo, VERR_VFS_BOGUS_FORMAT, "%s: INDEX_ROOT is too small: %#x, min %#x ",
+                                       pRootAttr->cbResident, sizeof(pRootAttr->cbResident));
+
+    PCNTFSATINDEXROOT pIdxRoot = (PCNTFSATINDEXROOT)NTFSATTRIBHDR_GET_RES_VALUE_PTR(pRootAttr->pAttrHdr);
+#ifdef LOG_ENABLED
+    rtFsNtfsVol_LogIndexRoot(pIdxRoot, pRootAttr->cbResident);
+#endif
+    NOREF(pIdxRoot);
+//    if (pIdxRoot->uType)
+//    {
+//    }
 
 #if 1 /* later */
@@ -1492 +1744 @@
      *
      */
-    PRTFSNTFSATTR pAllocAttr  = rtFsNtfsCore_FindNamedAttributeAscii(pCore, NTFS_AT_FILENAME,
-                                                                      NTFS_DIR_ATTRIBUTE_NAME, NTFS_AT_INDEX_ALLOCATION);
-    PRTFSNTFSATTR pBitmapAttr = rtFsNtfsCore_FindNamedAttributeAscii(pCore, NTFS_AT_FILENAME,
-                                                                      NTFS_DIR_ATTRIBUTE_NAME, NTFS_AT_BITMAP);
+    PRTFSNTFSATTR pIndexAlloc  = rtFsNtfsCore_FindNamedAttributeAscii(pCore, NTFS_AT_INDEX_ALLOCATION,
+                                                                      RT_STR_TUPLE(NTFS_DIR_ATTRIBUTE_NAME));
+    PRTFSNTFSATTR pIndexBitmap = rtFsNtfsCore_FindNamedAttributeAscii(pCore, NTFS_AT_BITMAP,
+                                                                      RT_STR_TUPLE(NTFS_DIR_ATTRIBUTE_NAME));
 #endif
     return VINF_SUCCESS;
@@ -1781 +2033 @@
      */
     PRTFSNTFSCORE pCore;
-    int rc = rtFsNtfsVol_NewCoreForMftIdx(pThis, NTFS_MFT_IDX_ROOT, &pCore, pErrInfo);
+    int rc = rtFsNtfsVol_NewCoreForMftIdx(pThis, NTFS_MFT_IDX_ROOT, false /*fRelaxedUsa*/, &pCore, pErrInfo); // DON'T COMMIT
     if (RT_SUCCESS(rc))
     {
@@ -1805 +2057 @@
             else
             {
-                PRTFSNTFSATTR pIndexRoot   = rtFsNtfsCore_FindNamedAttributeAscii(pCore, NTFS_AT_FILENAME,
-                                                                                  NTFS_DIR_ATTRIBUTE_NAME, NTFS_AT_INDEX_ROOT);
-                PRTFSNTFSATTR pIndexAlloc  = rtFsNtfsCore_FindNamedAttributeAscii(pCore, NTFS_AT_FILENAME,
-                                                                                  NTFS_DIR_ATTRIBUTE_NAME, NTFS_AT_INDEX_ALLOCATION);
-                PRTFSNTFSATTR pIndexBitmap = rtFsNtfsCore_FindNamedAttributeAscii(pCore, NTFS_AT_FILENAME,
-                                                                                  NTFS_DIR_ATTRIBUTE_NAME, NTFS_AT_BITMAP);
+                PRTFSNTFSATTR pIndexRoot   = rtFsNtfsCore_FindNamedAttributeAscii(pCore, NTFS_AT_INDEX_ROOT,
+                                                                                  RT_STR_TUPLE(NTFS_DIR_ATTRIBUTE_NAME));
+                PRTFSNTFSATTR pIndexAlloc  = rtFsNtfsCore_FindNamedAttributeAscii(pCore, NTFS_AT_INDEX_ALLOCATION,
+                                                                                  RT_STR_TUPLE(NTFS_DIR_ATTRIBUTE_NAME));
+                PRTFSNTFSATTR pIndexBitmap = rtFsNtfsCore_FindNamedAttributeAscii(pCore, NTFS_AT_BITMAP,
+                                                                                  RT_STR_TUPLE(NTFS_DIR_ATTRIBUTE_NAME));
                 if (!pIndexRoot)
                     rc = RTERRINFO_LOG_REL_SET(pErrInfo, VERR_VFS_BOGUS_FORMAT, "RootDir: Found no INDEX_ROOT attribute named $I30");
@@ -1857 +2109 @@
 {
     PRTFSNTFSCORE pCore;
-    int rc = rtFsNtfsVol_NewCoreForMftIdx(pThis, NTFS_MFT_IDX_UP_CASE, &pCore, pErrInfo);
+    int rc = rtFsNtfsVol_NewCoreForMftIdx(pThis, NTFS_MFT_IDX_UP_CASE, false /*fRelaxedUsa*/, &pCore, pErrInfo);
     if (RT_SUCCESS(rc))
     {
@@ -1979 +2231 @@
 {
     PRTFSNTFSCORE pCore;
-    int rc = rtFsNtfsVol_NewCoreForMftIdx(pThis, NTFS_MFT_IDX_BITMAP, &pCore, pErrInfo);
+    int rc = rtFsNtfsVol_NewCoreForMftIdx(pThis, NTFS_MFT_IDX_BITMAP, false /*fRelaxedUsa*/, &pCore, pErrInfo);
     if (RT_SUCCESS(rc))
     {
@@ -2102 +2354 @@
 {
     PRTFSNTFSCORE pCore;
-    int rc = rtFsNtfsVol_NewCoreForMftIdx(pThis, NTFS_MFT_IDX_VOLUME, &pCore, pErrInfo);
+    int rc = rtFsNtfsVol_NewCoreForMftIdx(pThis, NTFS_MFT_IDX_VOLUME, false /*fRelaxedUsa*/, &pCore, pErrInfo);
     if (RT_SUCCESS(rc))
     {
@@ -2184 +2436 @@
     AssertReturn(pRec, VERR_NO_MEMORY);
 
+#if 0 && defined(LOG_ENABLED)
+    for (uint32_t i = 0; i < 128; i++)
+    {
+        uint64_t const offDisk = (pThis->uLcnMft << pThis->cClusterShift) + i * pThis->cbMftRecord;
+        int rc = RTVfsFileReadAt(pThis->hVfsBacking, offDisk, pRec->pbRec, pThis->cbMftRecord, NULL);
+        if (RT_SUCCESS(rc))
+        {
+            pRec->TreeNode.Key = i;
+            rtfsNtfsMftRec_Log(pRec, pThis->cbMftRecord);
+            pRec->TreeNode.Key = 0;
+        }
+    }
+#endif
+
     uint64_t const offDisk = pThis->uLcnMft << pThis->cClusterShift;
     int rc = RTVfsFileReadAt(pThis->hVfsBacking, offDisk, pRec->pbRec, pThis->cbMftRecord, NULL);
     if (RT_SUCCESS(rc))
     {
+        rc = rtFsNtfsRec_DoMultiSectorFixups(&pRec->pFileRec->Hdr, pThis->cbMftRecord, true, pErrInfo);
+        if (RT_SUCCESS(rc))
+        {
 #ifdef LOG_ENABLED
-        rtfsNtfsMftRec_Log(pRec, pThis->cbMftRecord);
+            rtfsNtfsMftRec_Log(pRec, pThis->cbMftRecord);
 #endif
-        rc = rtFsNtfsVol_ParseMft(pThis, pRec, pErrInfo);
+            rc = rtFsNtfsVol_ParseMft(pThis, pRec, pErrInfo);
+        }
         if (RT_SUCCESS(rc))
         {
@@ -2398 +2668 @@
                                    "Unsupported NTFS MFT record size: %#x", pThis->cbMftRecord);
 
-    /* NTFS BPB: Index block size */
-    if (pBootSector->Bpb.Ntfs.cClusterPerIndexBlock >= 0)
-    {
-        if (   !RT_IS_POWER_OF_TWO((uint32_t)pBootSector->Bpb.Ntfs.cClusterPerIndexBlock)
-            || pBootSector->Bpb.Ntfs.cClusterPerIndexBlock == 0)
+    /* NTFS BPB: Default index node size */
+    if (pBootSector->Bpb.Ntfs.cClustersPerIndexNode >= 0)
+    {
+        if (   !RT_IS_POWER_OF_TWO((uint32_t)pBootSector->Bpb.Ntfs.cClustersPerIndexNode)
+            || pBootSector->Bpb.Ntfs.cClustersPerIndexNode == 0)
             return RTERRINFO_LOG_SET_F(pErrInfo, VERR_VFS_UNSUPPORTED_FORMAT,
-                                       "NTFS clusters-per-index-block is zero or not a power of two: %#x",
-                                        pBootSector->Bpb.Ntfs.cClusterPerIndexBlock);
-        pThis->cbIndexRecord = (uint32_t)pBootSector->Bpb.Ntfs.cClusterPerIndexBlock << pThis->cClusterShift;
-        Assert(pThis->cbIndexRecord == pBootSector->Bpb.Ntfs.cClusterPerIndexBlock * pThis->cbCluster);
-    }
-    else if (   pBootSector->Bpb.Ntfs.cClusterPerIndexBlock < -32
-             || pBootSector->Bpb.Ntfs.cClusterPerIndexBlock > -9)
+                                       "NTFS default clusters-per-index-tree-node is zero or not a power of two: %#x",
+                                        pBootSector->Bpb.Ntfs.cClustersPerIndexNode);
+        pThis->cbDefaultIndexNode = (uint32_t)pBootSector->Bpb.Ntfs.cClustersPerIndexNode << pThis->cClusterShift;
+        Assert(pThis->cbDefaultIndexNode == pBootSector->Bpb.Ntfs.cClustersPerIndexNode * pThis->cbCluster);
+    }
+    else if (   pBootSector->Bpb.Ntfs.cClustersPerIndexNode < -32
+             || pBootSector->Bpb.Ntfs.cClustersPerIndexNode > -9)
         return RTERRINFO_LOG_SET_F(pErrInfo, VERR_VFS_UNSUPPORTED_FORMAT,
-                                   "NTFS clusters-per-index-block is out of shift range: %d",
-                                    pBootSector->Bpb.Ntfs.cClusterPerIndexBlock);
+                                   "NTFS default clusters-per-index-tree-node is out of shift range: %d",
+                                    pBootSector->Bpb.Ntfs.cClustersPerIndexNode);
     else
-        pThis->cbIndexRecord = UINT32_C(1) << -pBootSector->Bpb.Ntfs.cClustersPerMftRecord;
-    Log2(("NTFS BPB: cbIndexRecord=%#x\n", pThis->cbIndexRecord));
+        pThis->cbDefaultIndexNode = UINT32_C(1) << -pBootSector->Bpb.Ntfs.cClustersPerMftRecord;
+    Log2(("NTFS BPB: cbDefaultIndexNode=%#x\n", pThis->cbDefaultIndexNode));
 
     pThis->uSerialNo = RT_LE2H_U64(pBootSector->Bpb.Ntfs.uSerialNumber);