search

rowingdude / analyzeMFT

MIT License
423 stars 117 forks source link

dataruns offset in attribute header is from the start of attribute #20

Open dariusbakunas opened 10 years ago

dariusbakunas commented 10 years ago

Hi,

I'm working on similar project and I noticed you use number 64 for you data runs offset. You can get this number (not sure if it is always the same) from the attribute header and it is the offset from the beginning of the attribute.

d['run_off'] = struct.unpack("<H",s[32:34])[0] # == 64

(d['ndataruns'],d['dataruns'],d['drunerror']) = unpack_dataruns(s[64:])

# can change to:
offset = d['run_off']

(d['ndataruns'],d['dataruns'],d['drunerror']) = unpack_dataruns(s[offset:])

I guess if non-resident attribute has name (does that ever happen?), that number would not be 64.. and thus better to use that offset from the header. Maybe thats why you were getting data run oddity (l > 6)?

Hexadite-Shlomi commented 8 years ago

Hi. Did you ever get an answer for this question?