Parse Windows raw data on Linux machine

Question

0.00/5 (No votes)

See more:

I am working on a backup application using C/C++. I have backed up all the data from a Windows volume snapshot(client is Windows) and has send it to our server which is a linux machine. The data that I have backed up and send is all the sectors and raw data. Now at the server side(linux machine) I want to parse this data, means I want the actual data, filename, size, etc. So how can I achieve this from the sectors? Actually I want to develop a NTFS parser at the server side(linux).I have refer ntfs-3g but it did not helped me much, they are also using kernel driver. And in my case I actually have the raw data and sectors stored in a .db file.

Any kind of help will be appreciated. Thanks in advance.

Posted 10-Sep-13 4:20am

Jameswilliam

Add a Solution

Comments

Richard MacCutchan 10-Sep-13 11:38am

It is most unlikely that you can do this easily since you have to reconstruct the actual NTFS sectors in order to parse the file content. You need to read all the documentation on the NTFS file system. The first link here should go some way to helping you.

[no name] 10-Sep-13 19:46pm

It will help you if you think about what it is you have got. It is a disk image. Files are splattered all over the place in non contiguous blocks. There is 'deleted' data etc. How do you imagine this can be put together to make any sense. SA has hit the nail on the head.

2 solutions

Solution 2

I am not sure that you want to do that.

NTFS structure is far more complicated than FAT and also changes from version to version. Why not do an usual file copy?

If the copy is for restauration purpose, then you should buy an existing software done for that purpose.

Also if you do a backup utility that works at that level, it might be hard to filter stuff when doing a restauration. Do you always want to restore the disk exactly as it was?

Also, in many case a full backup does not make that much sense. If your system fails, it is usually best to take a day or 2 to reinstall every software as it will cleanup the system. Also, by the time that the disk fails, a new OS might be available so you might want to upgrade anyway.

And if you are doing software utilities or drivers for Linux then you need to know much more that what you would find on site such as CodeProject as seldom people do such low-level stuff and much less publish it.

Posted 10-Sep-13 10:52am

Philippe Mori

Comments

Sergey Alexandrovich Kryukov 10-Sep-13 20:08pm

No, it can actually make some sense: clone the whole disk at once, as it would be very fast, important for time-critical business. But of course, it should be done without any interpretation of the raw disk data. And file-level backup should also be done. I think I explained why in my answer.
—SA

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Sergey Alexandrovich Kryukov · Accepted Answer · 2013-09-10T05:39:00

What you describe is not "Window raw data", this is disk raw data. It has nothing to do with Windows or Linux and has the same structure for both. There is nothing to "parse".

And let me tell you that you are not saving any files. You are saving raw data which you can utilize if you have the disk with identical structure: exact same number of cylinders, sectors, etc. Also, this data only makes sense if you want to restore the whole disk, or at least the whole physical partition of the disk with identical structure, but this such disk should first get identical partition set. So, do you also backup partition information? Do you also backup the specs of the disk?

As to your "low-level" backup/restore, you should develop (and test thoroughly) the restore procedure which us inverted backup: you should be able to take the disk with the same specs and fill in the same exact sectors as in the original saved disk. No parsing or anything like that should be involved.

Let me tell you: such kind of backup and restore does makes some sense, as restoration of the system with damaged disk can be done very quickly, to put the system back to production without a considerable delay (I hope this is your goal, isn't it?), but it is only useful when the disks of the same physical structure are available. Imagine what happens if they go out of stock? At least you should keep an eye on it and reinstall the whole system to move to the newer sort of a disk. So, your kind of backup/restore would be by far not enough. Do you also backup all relevant files and metadata which would allow you to re-install the whole system on a different kind of computer with different (and unknown) hardware configuration? If you don't do it in parallel with your low-level backup/restore, your system is still at risk.

—SA