0

Using xattrs, one can access Windows extended attributes using the following command

getfattr -h -n system.ntfs_ea Ntfs_Mount_Point/some_file

The problem is instead of an attribute list, it returns a raw single binary value encoded as base64 or hex containing all the underlying attributes. For example

0x1400000000060400244c584d4f4400a411000000

I know how to get a parsed result using ntfsinfo, but it requires the volume to be unmounted and I m looking for a file copy based on xattr data which means I need the volume to be mounted.

So for example (since I know the attitude name I m needing), how to get the value of $LXATTRB from Ntfs_Mount_Point/some_file?

1 Answer 1

0

It would be useful if you included the output it gives.

But in the meantime, maybe this code will help you out.

Perhaps this function specifically:

line 46: def print_getfattr

EDIT:

Okay, after your edit, best I could find is a nudge in the right direction:

This page contains the example you supplied, and another one with some more EA records.

and in this page, you can see it parsed, all the way in the bottom. I'm not sure it is parsed "enough", as I could not find out what file mode "a4 11 00 00" is. But as you can see it comes directly after the attribute name, which is in ascii (separated with a null byte). The EA's length is also there, I think, 0x04 in all of these specifically here. not sure about the 0x06 though.

hexdump1

Seems to be the case with multiple other extended records as well.

hexdump2

This mentions EA Tools, which may also come in handy, and also gives references to msdn in "Technical details"

Maybe try comparing the output from ntfsinfo to the hex dump shown, see if anything pops out.

Good luck in your NTFS journey.

3
  • Wrong answer! From a Linux side, all Windows extended attributes are stored in the $EA extended attributes. getfattr only allows to get $EA containing all attributes and the question is how to parse it. May 1 at 13:40
  • I see. Can you give an example of the $EA "blob" you get? the code I linked also contains parsing, inside the function.
    – Yarin_007
    May 1 at 13:41
  • I m not interested in manual parsing, but in automatic parsing as I ve 2 millions files to update from $LXATTRB. Even then, the format is more difficult to understand as some values are bytes or 16 bits aligned. What gave in tooling is using the Windows api, which can t be used to write $EA May 4 at 18:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.