Re: [opensuse] ntfs or ntfs-3g?
On 16/10/2018 18.41, DennisG wrote:
On 10/15/18 6:06 PM, Carlos E. R. wrote:
I have 2 W10 partitions using ntfs. When I set the first one up for mount in fstab, I manually edited the file to use the ntfs-3g driver because the openSUSE documentation recommends using that FUSE driver. Later, for the second partition I used YaST Partitioner to set the mount point in fstab; in that case YaST wrote ntfs to fstab rather than ntfs-3g. Both appear to work.
Which is correct? And why do they both work? Because nowdays they are actually the same driver. They were not, in the
On 15/10/2018 23.57, DennisG wrote: past.
You can verify by issuing the command "mount" and compare the lines for both mounts. Probably they say "fuse".
Right you are. Both report "fuseblk". I should have thought of that.
No, I thought of that because I made myself that question some time ago ;-) And I also wonder what would be the keyword if anybody wants the ntfs kernel driver instead. But maybe that one has been abandoned. -- Cheers / Saludos, Carlos E. R. (from 42.3 x86_64 "Malachite" at Telcontar)
Op dinsdag 16 oktober 2018 20:41:00 CEST schreef Carlos E. R.:
On 16/10/2018 18.41, DennisG wrote:
On 10/15/18 6:06 PM, Carlos E. R. wrote:
On 15/10/2018 23.57, DennisG wrote:
I have 2 W10 partitions using ntfs. When I set the first one up for mount in fstab, I manually edited the file to use the ntfs-3g driver because the openSUSE documentation recommends using that FUSE driver. Later, for the second partition I used YaST Partitioner to set the mount point in fstab; in that case YaST wrote ntfs to fstab rather than ntfs-3g. Both appear to work.
Which is correct? And why do they both work?
Because nowdays they are actually the same driver. They were not, in the past.
You can verify by issuing the command "mount" and compare the lines for both mounts. Probably they say "fuse".
Right you are. Both report "fuseblk". I should have thought of that.
No, I thought of that because I made myself that question some time ago ;-)
And I also wonder what would be the keyword if anybody wants the ntfs kernel driver instead. But maybe that one has been abandoned. I would think so, I remember read was OK, but writing would result in an unclean ntfs filesystem.
-- Gertjan Lettink a.k.a. Knurpht openSUSE Board Member openSUSE Forums Team -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
On Tue, Oct 16, 2018 at 9:56 PM Knurpht-openSUSE <knurpht@opensuse.org> wrote:
I would think so, I remember read was OK, but writing would result in an unclean ntfs filesystem.
Last summer we did a test of NTFS vs ext4. We did not have any trouble writing to either. The main issue we had was that NTFS was significantly slower. We had some clients who preferred NTFS to ease use of removable data disks back in the office. We settled on ext4, and then installed an ext4 driver on the Windows machine. Everyone seems happy with the solution. -- Roger Oberholtzer -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
On 17/10/2018 07.41, Roger Oberholtzer wrote:
On Tue, Oct 16, 2018 at 9:56 PM Knurpht-openSUSE <knurpht@opensuse.org> wrote:
I would think so, I remember read was OK, but writing would result in an unclean ntfs filesystem.
That's so. Write support was experimental. It is possible, though, that the old kernel driver might run faster, but read only.
Last summer we did a test of NTFS vs ext4. We did not have any trouble writing to either. The main issue we had was that NTFS was significantly slower. We had some clients who preferred NTFS to ease use of removable data disks back in the office. We settled on ext4, and then installed an ext4 driver on the Windows machine. Everyone seems happy with the solution.
ntfs-3g is significantly slow and cpu intensive. Under some circumstances this is very noticeable. Recently Microsoft changed something in the filesystem that caused trouble, Linux could not read some files. Let me see if I can find a reference [...] Ah, yes, the message was: 'Unsupported reparse point' <https://www.swiftforensics.com/2016/10/wofcompressed-streams-in-windows-10.html> Friday, October 28, 2016 On windows 10, there is a new 'System Compression' option that compresses files using reparse points. This is not the NTFS-based compression that earlier versions of windows utilized, its different. This post is about the new compression scheme and how it affects forensic analysts. ... Lets get to the point, how does this impact forensics? Well, as of now, no tools will recognize and decompress these files. Hence, you can't read, keyword search or extract these files in their original uncompressed form. ... How it works? System compression utilizes reparse points and creates a new Alternate Data Stream (ADS) having the name 'WofCompressedData'. The compressed data is stored here. Reparse points are an NTFS feature that allow custom implementation like this. However this means that other applications that are not aware of this custom implementation will not be able to read/write to that file. In encase (or other forensic tools), you can see the file and the WofCompressedData stream. Clicking on the file just shows the contents to be all zeroes. Clicking on the stream, you can get the compressed data, but as of now, no automatic transparent decompression (as it does with NTFS compressed files). This is seen in screenshot below. ... If you mount a volume containing such compressed files in SIFT Workstation or any linux system (they all use the same NTFS-3g FUSE driver), you will see the message 'Unsupported reparse point' when trying to list these files. Trying to access file contents will result in errors as seen in screenshot below. -- Cheers / Saludos, Carlos E. R. (from 42.3 x86_64 "Malachite" at Telcontar)
On 17/10/2018 11.51, Carlos E. R. wrote:
On 17/10/2018 07.41, Roger Oberholtzer wrote:
On Tue, Oct 16, 2018 at 9:56 PM Knurpht-openSUSE <> wrote:
Recently Microsoft changed something in the filesystem that caused trouble, Linux could not read some files. Let me see if I can find a reference [...] Ah, yes, the message was: 'Unsupported reparse point'
<https://www.swiftforensics.com/2016/10/wofcompressed-streams-in-windows-10.html>
Friday, October 28, 2016
And I found about that here: <https://groups.google.com/forum/#!topic/alt.os.linux/3XyLpV-Za9o> -- Cheers / Saludos, Carlos E. R. (from 42.3 x86_64 "Malachite" at Telcontar)
On 17/10/2018 11:55, Carlos E. R. wrote:
On 17/10/2018 11.51, Carlos E. R. wrote:
On 17/10/2018 07.41, Roger Oberholtzer wrote:
On Tue, Oct 16, 2018 at 9:56 PM Knurpht-openSUSE <> wrote:
Recently Microsoft changed something in the filesystem that caused trouble, Linux could not read some files. Let me see if I can find a reference [...] Ah, yes, the message was: 'Unsupported reparse point'
<https://www.swiftforensics.com/2016/10/wofcompressed-streams-in-windows-10.html>
Friday, October 28, 2016 And I found about that here:
<https://groups.google.com/forum/#!topic/alt.os.linux/3XyLpV-Za9o>
Good find! More proof that "Microsoft <3 Linux" is just a lie for marketing purposes. -- Liam Proven - Technical Writer, SUSE Linux s.r.o. Corso II, Křižíkova 148/34, 186-00 Praha 8 - Karlín, Czechia Email: lproven@suse.com - Office telephone: +420 284 241 084 -- To unsubscribe, e-mail: opensuse+unsubscribe@opensuse.org To contact the owner, e-mail: opensuse+owner@opensuse.org
participants (4)
-
Carlos E. R. -
Knurpht-openSUSE -
Liam Proven -
Roger Oberholtzer