ntfs-3g and unsupported reparse points

raefdhaon · 02-07-2012, 09:50 PM

Hi all,

I need some help determining how to get ntfs-3g to handle (delete) a Windows (directory) junction. The junction(s) in question is created by malware. Ubuntu 10.04.1 will delete them no problem (ntfs-3g version 2010.3.6), despite recognizing them as 'unsupported reparse point'. Puppy Linux and xPUD both choke on them with a 'directory not empty' error. I compiled both the current ntfs-3g stable release (2012.1.15) and the Advanced release, then replaced the ntfs-3g binary and supporting libraries (libntfs-3g.so, so.83, so.83.0.0 and so.831, so.831.0.0) in both Puppy and xPUD, then remounted the drives, to no avail. Then added the updated ntfs-3g.probe, ntfs-3g.secaudit, ntfs-3g.usermap files to the list of replacements and still no results. I tried building with FUSE internal and external. I then used the /configure options --enable-xattr-mappings and --disable-posix-acls, because I noticed that was the configuration used in Ubuntu. I also tried the 2010.3.6 version files from the default 10.04.1 build. What am I missing? Do I need to replace the mount.ntfs-3g file from /sbin as well? One odd thing I noticed is that in Puppy and xPUD, after updating the ntfs-3g files, it was necessary to first access the target directory before the junction would appear visibly - Ubuntu showed it without the need to access the target first.

TIA

sag47 · 02-09-2012, 08:12 AM

Have you tried to force remove it recursively?

Code:

rm -rf directory
man rm

raefdhaon · 02-09-2012, 11:39 AM

Absolutely! No luck with that either.

Should also mention that prior to updating the ntfs-3g driver in xPUD, it is recognized as a regular folder, and accessible as such. It contains 2 malware folders with files in each, and a single file. The folders can be deleted, the single file cannot ...... 'operation not supported'. I have checked permissions and have full read/write access on all items. Once the driver is updated, it appears as a symlink and ls -l reports it 'unsupported reparse point'.

sag47 · 02-10-2012, 08:19 AM

Do you have a Windows machine available to boot to and attach the drive? If not I recommend creating a Windows Preinstalled Environment (WinPE) which is basically a live CD with Windows on it. I recommend using Ultimate Boot CD (UBCD). It has several useful troubleshooting tools.

Then when you have the drive hooked up to Windows run a "chkdsk /f" from the cmd. Once filesystem errors are potentially resolved then boot to Linux again and attempt to delete it.

Can you create a simple file on the volume and delete that simple file? Example

Code:

cd /media/windowsdrive
touch afile
rm afile

If not and the filesystem is mounted as readonly then you'll need to remount it read/write.

Code:

mount -o remount,rw /media/windowsdrive

raefdhaon · 02-10-2012, 08:16 PM

Thank you for the response. As stated in my last post, it is not a problem with read/write permissions on the volume.

Quote:

The folders can be deleted, the single file cannot ...... 'operation not supported'. I have checked permissions and have full read/write access on all items.

Nor is it filesystem corruption. It has something to do with the way ntfs-3g is handling the junction in xPUD - I can only guess a configuration difference between Ubuntu's installed ntfs-3g and the one I compiled. I did find that via commandline, I can rename the junction, or move it to anywhere on the same partition, if I mount it using the -o permissions option.