manageiq-smartstate 0.1.0

data/lib/fs/ntfs/attrib_volume_information.rb

@@ -0,0 +1,53 @@
+require 'binary_struct'
+
+module NTFS
+  #
+  # VOLUME_INFORMATION - Attribute: Volume information (0x70).
+  #
+  # NOTE: Always resident.
+  # NOTE: Present only in FILE_Volume.
+  # NOTE: Windows 2000 uses NTFS 3.0 while Windows NT4 service pack 6a uses NTFS 1.2.
+  #
+
+  ATTRIB_VOLUME_INFORMATION = BinaryStruct.new([
+    'Q',  nil,          # No information.
+    'C1', 'ver_major',  # File system major version number.
+    'C1', 'ver_minor',  # File system minor version number.
+    'S',  'flags',      # Volume flags (see VF_ below).
+  ])
+
+  class VolumeInformation
+    attr_reader :version, :flags
+
+    VF_IS_DIRTY            = 0x0001
+    VF_RESIZE_LOG_FILE     = 0x0002
+    VF_UPGRADE_ON_MOUNT    = 0x0004
+    VF_MOUNTED_ON_NT4      = 0x0008
+    VF_DELETE_USN_UNDERWAY = 0x0010
+    VF_REPAIR_OBJECT_ID    = 0x0020
+    VF_CHKDSK_UNDERWAY     = 0x4000
+    VF_MODIFIED_BY_CHKDSK  = 0x8000
+
+    def initialize(buf)
+      raise "MIQ(NTFS::VolumeInformation.initialize) Nil buffer" if buf.nil?
+      buf      = buf.read(buf.length) if buf.kind_of?(DataRun)
+      @avi     = ATTRIB_VOLUME_INFORMATION.decode(buf)
+
+      # Get accessor data.
+      @version = @avi['ver_major'].to_s + "." + @avi['ver_minor'].to_s
+      @flags   = @avi['flags']
+    end
+
+    def to_s
+      @version
+    end
+
+    def dump
+      out = "\#<#{self.class}:0x#{'%08x' % object_id}>\n"
+      out << "  Major ver: #{@avi['ver_major'].to_i}\n"
+      out << "  Minor ver: #{@avi['ver_minor'].to_i}\n"
+      out << "  Flags    : 0x#{'%04x' % @flags}\n"
+      out << "---\n"
+    end
+  end
+end # module NTFS

data/lib/fs/ntfs/attrib_volume_name.rb

@@ -0,0 +1,31 @@
+require 'util/miq-unicode'
+
+module NTFS
+  #
+  # VOLUME_NAME - Attribute: Volume name (0x60).
+  #
+  # NOTE: Always resident.
+  # NOTE: Present only in FILE_Volume.
+  #
+  # Data of this class is not structured.
+  #
+
+  class VolumeName
+    attr_reader :name
+
+    def initialize(buf)
+      buf   = buf.read(buf.length) if buf.kind_of?(DataRun)
+      @name = buf.UnicodeToUtf8
+    end
+
+    def to_s
+      @name
+    end
+
+    def dump
+      out = "\#<#{self.class}:0x#{'%08x' % object_id}>\n  "
+      out << @name
+      out << "---\n"
+    end
+  end
+end # module NTFS

data/lib/fs/ntfs/boot_sect.rb

@@ -0,0 +1,253 @@
+# encoding: US-ASCII
+
+require 'binary_struct'
+require 'fs/ntfs/mft_entry'
+require 'rufus/lru'
+
+#######################################################################################
+# A good source of disk-layout information is in open-source ntfs-3g/include/ntfs-3g/layout.h
+# A good source of understanding how to use this data is in Brian Carrier's File System Forensic Analysis
+#######################################################################################
+
+module NTFS
+  # The boot parameters block, sector 0 byte 0 of a bootable volume.
+  BOOT_PARAMETERS_BLOCK = BinaryStruct.new([
+    'a3', 'jmp_boot_loader',          # Jump to boot loader
+    'a8', 'oem_name',                 # OEM Name (should be 'NTFS    ')
+
+    # BIOS Parameter Block
+    'S',  'bytes_per_sector',         # Bytes per sector. The size of a hardware sector. For most disks used in the United States, the value of this field is 512.
+    'C1', 'sectors_per_cluster',      # Sectors per cluster
+    'S',  'reserved_sectors',         # Reserved sectors. Always 0 because NTFS places the boot sector at the beginning of the partition. If the value is not 0, NTFS fails to mount the volume.
+    'C1', 'fats',                     # Value must be 0 or NTFS fails to mount the volume
+    'S',  'root_entries',             # Value must be 0 or NTFS fails to mount the volume
+    'S',  'sectors',                  # Value must be 0 or NTFS fails to mount the volume
+    'C1', 'media_descriptor',         # Provides information about the media being used. A value of 0xF8 indicates a hard disk and 0xF0 indicates a high-density 3.5-inch floppy disk. Media descriptor entries are a legacy of MS-DOS FAT16 disks and are not used in Windows Server 2003.
+    'S',  'sectors_per_fat',          # Value must be 0 or NTFS fails to mount the volume
+    'S',  'sectors_per_track',        # Required to boot Windows
+    'S',  'number_of_heads',          # Required to boot Windows
+    'L',  'hidden_sectors',           # Offset to the start of the partition relative to the disk in sectors.  Required to boot Windows
+    'L',  'large_sectors',            # Must be 0
+
+    # Extended BIOS Parameter Block
+    'C1', 'physical_drive',           # 0x00 floppy, 0x80 hard disk
+    'C1', 'current_head',             # Must be 0
+    'C1', 'extended_boot_signature',  # 0x80
+    'C1', 'reserved2',
+    'Q',  'sectors_per_volume',        # Number of sectors in volume. Gives maximum volume size of 2^63 sectors. Assuming standard sector size of 512 bytes, the maximum byte size is approx. 4.7x10^21 bytes.
+    'Q',  'mft_lcn',                   # Logical Cluster Number for the File $MFT.     Identifies the location of the                      MFT by using its logical cluster number.
+    'Q',  'mftmirr_lcn',               # Logical Cluster Number for the File $MFTMirr. Identifies the location of the mirrored copy of the MFT by using its logical cluster number.
+    'c1', 'clusters_per_mft_record',   # Mft record size in clusters.  NTFS creates a file record for each file and a folder record for each folder that is created on an NTFS volume. Files and folders smaller than this size are contained within the MFT. If this number is positive (up to 7F), then it represents clusters per MFT record. If the number is negative (80 to FF), then the size of the file record is 2 raised to the absolute value of this number.
+    'a3', 'reserved0',
+    'c1', 'clusters_per_index_record', # Index block size in clusters. The size of each index buffer, which is used to allocate space for directories. If this number is positive (up to 7F), then it represents clusters per MFT record. If the number is negative (80 to FF), then the size of the file record is 2 raised to the absolute value of this number.
+    'a3', 'reserved1',
+    'Q',  'volume_serial_number',      # Seems like only the low 32-bits are used
+    'L',  'checksum',                  # Boot sector checksum
+
+    'a426', 'boot_code',               # Boot loader
+    'S',  'signature',                 # Sanity check: always 0xaa55
+  ])
+  SIZEOF_BOOT_PARAMETERS_BLOCK = BOOT_PARAMETERS_BLOCK.size
+
+  NTFS_MAGIC = 0xaa55
+
+  # BootSect represents a volume boot sector.
+  class BootSect
+    attr_reader :stream, :bytesPerSector, :sectorsPerCluster, :mediaDescriptor
+    attr_reader :totalCapacity, :bytesPerFileRec, :bytesPerIndexRec, :serialNumber
+    attr_reader :signature, :bytesPerCluster
+
+    attr_accessor :version, :volumeInfo
+
+    def initialize(stream)
+      raise "MIQ(NTFS::BootSect.initialize) Nil stream" if stream.nil?
+
+      # Buffer stream & get enough data to fill BPB.
+      @stream = stream
+      buf     = stream.read(SIZEOF_BOOT_PARAMETERS_BLOCK)
+      @bpb    = BOOT_PARAMETERS_BLOCK.decode(buf)
+
+      # Always check magic number first.
+      @signature = @bpb['signature']
+      raise "MIQ(NTFS::BootSect.initialize) Boot sector is not NTFS: 0x#{'%04x' % signature}" if signature != NTFS_MAGIC
+
+      # Get accessor values.
+      @bytesPerSector    = @bpb['bytes_per_sector']
+      @bytesPerCluster   = @bpb['sectors_per_cluster'] * @bytesPerSector
+      @sectorsPerCluster = @bpb['sectors_per_cluster']
+      @mediaDescriptor   = @bpb['media_descriptor']
+      @totalCapacity     = @bpb['sectors_per_volume'] * @bytesPerSector
+      @bytesPerFileRec   = bytesPerRec(@bpb['clusters_per_mft_record'])
+      @bytesPerIndexRec  = bytesPerRec(@bpb['clusters_per_index_record'])
+      @serialNumber      = @bpb['volume_serial_number']
+
+      # MFTs in-memory
+      @sys_mfts    = {}
+      @mfts        = LruHash.new(NTFS::DEF_CACHE_SIZE)
+    end
+
+    # Convert to string (just return OEM name).
+    def to_s
+      @bpb['oem_name'].strip
+    end
+
+    # NTFS has an interesting shorthand...
+    def bytesPerRec(size)
+      (size < 0) ? 2**size.abs : size * bytesPerCluster
+    end
+
+    # Return the absolute byte position of the MFT.
+    def mftLoc
+      @bpb.nil? ? 0 : lcn2abs(@bpb['mft_lcn'])
+    end
+
+    def fragTable
+      @fragTable || @rootFragTable
+    end
+
+    def maxMft
+      return getMaxMft if @fragTable.nil?
+      @maxMft ||= getMaxMft
+    end
+
+    def setup
+      @rootFragTable = mftEntry(0).rootAttributeData.data.runSpec
+
+      @sys_mfts.clear
+      @mfts.clear
+
+      # MFT Entry 0 ==> Prepare a fragment table.
+      @fragTable  = mftEntry(0).attributeData.data.runSpec   # Get the data runs for the MFT itself.
+
+      # MFT Entry 3 ==> Volume Information
+      @volumeInfo = getVolumeInfo
+      @version    = @volumeInfo["version"].to_i
+    end
+
+    ################################################################################
+    # From "File System Forensic Analysis" by Brian Carrier
+    #
+    # The $Bitmap file, which is located in MFT entry 6, has a $DATA attribute that is used
+    # to manage the allocation status of clusters.  The bitmap data are organized into 1-byte
+    # values, and the least significant bit of each byte corresponds to the cluster that follows
+    # the cluster that the most significant bit of the previous byte corresponds to.
+    ################################################################################
+    def clusterInfo
+      return @clusterInfo unless @clusterInfo.nil?
+
+      # MFT Entry 6 ==> BITMAP Information
+      ad = mftEntry(6).attributeData
+      data = ad.read(ad.length)
+      ad.rewind
+
+      c = data.unpack("b#{data.length * 8}")[0]
+      nclusters = c.length
+      on = c.count("1")
+      uclusters = on
+      fclusters = c.length - on
+
+      @clusterInfo = {"total" => nclusters, "free" => fclusters, "used" => uclusters}
+    end
+
+    # Returns free space on file system in bytes.
+    def freeBytes
+      clusterInfo["free"] * @bytesPerCluster
+    end
+
+    def getVolumeInfo
+      mft = mftEntry(3)
+      vi  = {}
+
+      if nameAttrib = mft.getFirstAttribute(AT_VOLUME_NAME)
+        vi["name"] = nameAttrib.name
+      end
+
+      if objectidAttrib = mft.getFirstAttribute(AT_OBJECT_ID)
+        vi["objectId"]      = objectidAttrib.objectId.to_s
+        vi["birthVolumeId"] = objectidAttrib.birthVolumeId.to_s
+        vi["birthObjectId"] = objectidAttrib.birthObjectId.to_s
+        vi["domainId"]      = objectidAttrib.domainId.to_s
+      end
+
+      if infoAttrib = mft.getFirstAttribute(AT_VOLUME_INFORMATION)
+        vi["version"] = infoAttrib.version
+        vi["flags"]   = infoAttrib.flags
+      end
+
+      vi
+    end
+
+    def numFrags
+      fragTable.size / 2
+    end
+
+    # Iterate all run lengths & return how many entries fit.
+    def getMaxMft
+      total_clusters = 0
+      fragTable.each_slice(2) { |_vcn, len| total_clusters += len }
+      total_clusters * @bytesPerCluster / @bytesPerFileRec
+    end
+
+    def rootDir
+      @rootDir ||= mftEntry(5).indexRoot
+    end
+
+    def mftEntry(recordNumber)
+      if recordNumber < 12
+        @sys_mfts[recordNumber] = MftEntry.new(self, recordNumber) unless @sys_mfts.key?(recordNumber)
+        return @sys_mfts[recordNumber]
+      end
+
+      if @mfts.key?(recordNumber)
+        mft = @mfts[recordNumber]
+        mft.attributeData.rewind unless mft.attributeData.nil?
+        return mft
+      end
+      @mfts[recordNumber] = MftEntry.new(self, recordNumber)
+    end
+
+    # Quick check to see if volume is mountable.
+    def isMountable?
+      return false if @bpb.nil?
+      b  = @bpb['reserved_sectors'] == 0
+      b &= @bpb['unused1'] == "\0" * 5
+      b &= @bpb['unused2'] == 0
+      b &= @bpb['unused4'] == 0
+      b &= @bpb['signature'] == 0xaa55
+    end
+
+    # Convert a logical cluster number to an absolute byte position.
+    def lcn2abs(lcn)
+      lcn * bytesPerCluster
+    end
+
+    # Convert a virtual cluster number to an absolute byte position.
+    def vcn2abs(vcn)
+      lcn2abs(vcn)
+    end
+
+    # Use data run to convert mft record number to byte pos.
+    def mftRecToBytePos(recno)
+      # Return start of mft if rec 0 (no point in the rest of this).
+      return mftLoc if recno == 0
+
+      # Find which fragment contains the target mft record.
+      start = fragTable[0]; last_clusters = 0; target_cluster = recno * @bytesPerFileRec / @bytesPerCluster
+      if (recno > @bytesPerCluster / @bytesPerFileRec) && (fragTable.size > 2)
+        total_clusters = 0
+        fragTable.each_slice(2) do |vcn, len|
+          start = vcn # These are now absolute clusters, not offsets.
+          total_clusters += len
+          break if total_clusters > target_cluster
+          last_clusters += len
+        end
+        # Toss if we haven't found the fragment.
+        raise "MIQ(NTFS::BootSect.mftRecToBytePos) Can't find MFT record #{recno} in data run.\ntarget = #{target_cluster}\ntbl = #{fragTable.inspect}" if total_clusters < target_cluster
+      end
+
+      # Calculate offset in target cluster & final byte position.
+      offset = (recno - (last_clusters * @bytesPerCluster / @bytesPerFileRec)) * @bytesPerFileRec
+      start * @bytesPerCluster + offset
+    end
+  end
+end # module NTFS

data/lib/fs/ntfs/data_run.rb

@@ -0,0 +1,358 @@
+require 'memory_buffer'
+
+module NTFS
+  class DataRun
+    DEBUG_TRACE_READS = false
+
+    OffsetCode = {
+      1 => [0xffffff00, 'L', 'l'],
+      2 => [0xffff0000, 'L', 'l'],
+      3 => [0xff000000, 'L', 'l'],
+      4 => [0x00000000, 'L', 'l'],
+      5 => [0xffffff0000000000, 'Q', 'q'],
+      6 => [0xffff000000000000, 'Q', 'q'],
+      7 => [0xff00000000000000, 'Q', 'q'],
+      8 => [0x0000000000000000, 'Q', 'q']
+    }
+
+    attr_reader :runSpec, :boot_sector, :length, :pos
+
+    def initialize(bs, buf, header)
+      raise "MIQ(NTFS::DataRun.initialize) Nil boot sector" if bs.nil?
+      raise "MIQ(NTFS::DataRun.initialize) Nil buffer"      if buf.nil?
+
+      # Buffer boot sector & start spec array.
+      @boot_sector     = bs
+      @bytesPerCluster = bs.bytesPerCluster
+      @header          = header
+      @runSpec         = []
+      rewind
+
+      # Read bytes until 0.
+      # puts "specification is:"
+      # buf.hex_dump(:obj => STDOUT, :meth => :puts, :newline => false)
+
+      last_lcn = 0
+      spec_pos = 0
+      total_clusters = 0
+      while buf[spec_pos, 1].ord != 0
+        # print "spec 0x#{'%02x' % buf[spec_pos]}\n"
+
+        # Size of offset is hi nibble, size of length is lo nibble.
+        size_of_offset, size_of_length = buf[spec_pos, 1].ord.divmod(16)
+        spec_pos += 1
+        # puts "size_of_length 0x#{'%08x' % size_of_length}"
+        # puts "size_of_offset 0x#{'%08x' % size_of_offset}"
+
+        # Get length of run (number of clusters).
+        run_length = suckBytes(buf[spec_pos, size_of_length])
+        spec_pos += size_of_length
+        # puts "length      0x#{'%08x' % run_length}"
+
+        # Get offset (offset from previous cluster).
+        run_offset = suckBytes(buf[spec_pos, size_of_offset])
+        spec_pos += size_of_offset
+        # puts "offset      0x#{'%08x' % run_offset}"
+
+        # Offset is signed (only check if size gt 0. 0 size means 0 offset means sparse run).
+        if size_of_offset > 0
+          hi_bit = 2**(8 * size_of_offset - 1) # 1 << (8 * size_of_offset - 1)
+          # If this goofy number is negative, make it negative.
+          if run_offset & hi_bit == hi_bit
+            run_offset |= OffsetCode[size_of_offset][0]
+            run_offset = [run_offset].pack(OffsetCode[size_of_offset][1]).unpack(OffsetCode[size_of_offset][2])[0]
+          end
+        end
+        # puts "offset      0x#{'%08x' % run_offset}"
+
+        # Not Sparse
+        if size_of_offset > 0
+          lcn = run_offset + last_lcn
+          last_lcn = lcn
+        else
+          lcn = nil
+        end
+
+        # Store run spec.
+        total_clusters += run_length
+        @runSpec << lcn
+        @runSpec << run_length
+      end
+      @length = header.specific['data_size']
+      @length = total_clusters * @bytesPerCluster if @length == 0
+
+      # Cache the clusters we've already read.
+      @clusters = {}
+    end
+
+    def to_s
+      # @current_run
+    end
+
+    def addRun(r)
+      @runSpec += r.runSpec
+      @length += r.length
+    end
+
+    def [](offset, len)
+      seek(offset)
+      read(len)
+    end
+
+    def rewind
+      @pos = 0
+    end
+
+    def seek(offset, method = IO::SEEK_SET)
+      @pos = case method
+             when IO::SEEK_SET then offset
+             when IO::SEEK_CUR then @pos + offset
+             when IO::SEEK_END then @length - offset
+             end
+      @pos = 0 if @pos < 0
+      @pos = @length if @pos > @length
+      @pos
+    end
+
+    def seekToVcn(vcn)
+      seek(vcn * @bytesPerCluster)
+    end
+
+    def read(bytes = @length)
+      return nil if @pos >= @length
+      $log.info "#{self.class} #{object_id}: Reading #{bytes} bytes @ #{@pos}" if DEBUG_TRACE_READS
+
+      startCluster, startOffset = @pos.divmod(@bytesPerCluster)
+      endCluster, endOffset = (@pos + (bytes - 1)).divmod(@bytesPerCluster)
+
+      ret = getClusters(startCluster, endCluster)
+      ret = ret[startOffset..endOffset - @bytesPerCluster]
+      @pos += ret.length
+
+      ret
+    end
+
+    def getClusters(start_vcn, end_vcn = nil)
+      end_vcn = start_vcn if end_vcn.nil?
+
+      # Single cluster
+      if start_vcn == end_vcn && @clusters.key?(start_vcn)
+        $log.info "#{self.class} #{object_id}: Reading clusters [#{start_vcn}, 1, true]" if DEBUG_TRACE_READS
+        return readCachedClusters(start_vcn, 1)[0]
+      end
+
+      # Multiple clusters (part of which may be cached)
+      num = end_vcn - start_vcn + 1
+      ret = MemoryBuffer.create(num * @bytesPerCluster)
+      offset = 0
+
+      to_read = findCachedClusters(start_vcn, end_vcn)
+      $log.info "#{self.class} #{object_id}: Reading clusters #{to_read.inspect}" if DEBUG_TRACE_READS
+      to_read.each_slice(3) do |vcn, len, cached|
+        clusters = cached ? readCachedClusters(vcn, len) : readRawClusters(vcn, len)
+        clusters.each do |c|
+          len = c.length
+          ret[offset, len] = c
+          offset += len
+        end
+      end
+
+      addClusterCache(start_vcn, ret)
+
+      ret
+    end
+
+    def findCachedClusters(start_vcn, end_vcn)
+      to_read = []
+      cur = run = last_cached = nil
+
+      start_vcn.upto(end_vcn) do |vcn|
+        check_last_cached = @clusters.key?(vcn)
+        if last_cached == check_last_cached
+          run += 1
+        else
+          to_read << cur << run << last_cached unless last_cached.nil?
+          last_cached = check_last_cached
+          cur = vcn
+          run = 1
+        end
+      end
+      to_read << cur << run << last_cached
+
+      to_read
+    end
+
+    def readCachedClusters(vcn, num)
+      ret = []
+
+      while num > 0
+        data, start_vcn, end_vcn, data_len, offset = getCacheInfo(vcn)
+
+        len = data_len - offset
+        len = num if num < len
+
+        ret << data[offset * @bytesPerCluster, len * @bytesPerCluster]
+
+        num -= len
+        vcn += len
+      end
+
+      ret
+    end
+
+    def addClusterCache(start_vcn, data)
+      end_vcn = start_vcn + (data.length / @bytesPerCluster) - 1
+
+      has_start = @clusters.key?(start_vcn)
+      start_data, start_data_vcn, = getCacheInfo(start_vcn) if has_start
+
+      has_end = @clusters.key?(end_vcn)
+      end_data, end_data_vcn, end_data_end_vcn, end_data_len, end_offset = getCacheInfo(end_vcn) if has_end
+
+      # Determine if we are adding an existing item or sub-item back into the cache
+      return if has_start && has_end && start_data_vcn == end_data_vcn
+
+      # Determine if we are overlapping an existing cached item at the start
+      if has_start && start_data_vcn != start_vcn
+        leftover_len = start_vcn - start_data_vcn
+        leftover = start_data[0, leftover_len * @bytesPerCluster]
+
+        # Recache only the leftover portion
+        @clusters[start_data_vcn] = leftover
+      end
+
+      # Determine if we are overlapping an existing cached item at the end
+      if has_end && end_data_end_vcn != end_vcn
+        leftover_start_vcn = end_vcn + 1
+        leftover = end_data[(end_offset + 1) * @bytesPerCluster..-1]
+
+        # Recache only the leftover portion
+        @clusters[leftover_start_vcn] = leftover
+        (leftover_start_vcn + 1..end_data_end_vcn).each { |i| @clusters[i] = leftover_start_vcn }
+      end
+
+      # Cache the data
+      @clusters[start_vcn] = data
+      (start_vcn + 1..end_vcn).each { |i| @clusters[i] = start_vcn }
+    end
+
+    def getCacheInfo(vcn)
+      data = @clusters[vcn]
+      offset = 0
+      start_vcn = vcn
+      if data.kind_of?(Integer)
+        start_vcn = data
+        offset = vcn - start_vcn
+        data = @clusters[data]
+      end
+
+      len = data.length / @bytesPerCluster
+      end_vcn = start_vcn + len - 1
+
+      return data, start_vcn, end_vcn, len, offset
+    end
+
+    def readRawClusters(vcn, num)
+      ret = []
+      offset = 0
+
+      lcns = getLCNs(vcn, num)
+      lcns.each_slice(2) do |lcn, len|
+        len *= @bytesPerCluster
+
+        clusters = unless lcn.nil?
+                     @boot_sector.stream.seek(@boot_sector.lcn2abs(lcn))
+                     @boot_sector.stream.read(len)
+                   else
+                     MemoryBuffer.create(len)
+                   end
+
+        ret << clusters
+        offset += len
+      end
+
+      ret
+    end
+
+    def getLCNs(start_vcn, num)
+      lcns = []
+      end_vcn = start_vcn + num - 1
+      vcn = start_vcn
+      total_clusters = 0
+
+      @runSpec.each_slice(2) do |lcn, len|
+        total_clusters += len
+        next unless total_clusters > start_vcn
+
+        start = lcn + (vcn - (total_clusters - len))
+        count = len - (start - lcn)
+        count = count >= num ? num : count
+        lcns << start << count
+
+        vcn += count
+        num -= count
+        break if num <= 0
+      end
+
+      lcns << nil << end_vcn - vcn + 1 if vcn <= end_vcn
+
+      lcns
+    end
+
+    def suckBytes(buf)
+      return buf[0, 1].ord if buf.size == 1
+      val = 0
+      (buf.size - 1).downto(0) { |i| val *= 256; val += buf[i, 1].ord }
+      val
+    end
+
+    # Return true if a particular compression unit is compressed.
+    def isUnitCompr?(unit = 0)
+      return false unless header.isCompressd?
+      mkComprUnits if @compr_units.nil?
+      @compr_units[unit].isCompressed?
+    end
+
+    # Organize run list into compression units.
+    def mkComprUnits
+    end
+
+    def dump
+      out = "\#<#{self.class}:0x#{'%08x' % object_id}>\n"
+      out << "  Length       : #{@length}\n"
+      out << "  Position     : #{@pos}\n"
+      out << "  Run List     : #{@runSpec.inspect}\n"
+      out << "  Cache Ranges : #{dumpCacheRanges}\n"
+      out << "---\n"
+      out
+    end
+
+    def dumpRunList
+      @runSpec.each_slice(2) { |lcn, len| puts "lcn = #{lcn.nil? ? 0 : lcn}, len = #{len}" }
+    end
+
+    def dumpCacheRanges
+      str = k_start = k_prev = nil
+      invalid = true
+      out = []
+      @clusters.keys.sort.each do |k|
+        if @clusters[k].kind_of?(String)
+          out << "#{invalid ? "*(#{str}) " : ''}#{k_start}..#{k_prev}" unless k_start.nil?
+          str = k
+          k_start = k
+          invalid = false
+        elsif @clusters[k] != str
+          out << "#{invalid ? "*(#{str}) " : ''}#{k_start}..#{k_prev}" unless k_start.nil?
+          str = @clusters[k]
+          k_start = k
+          invalid = true
+        elsif k != k_prev + 1
+          out << "#{k}^"
+        end
+        k_prev = k
+      end
+      out << "#{invalid ? "*(#{str}) " : ''}#{k_start}..#{k_prev}" unless k_start.nil?
+      out.inspect
+    end
+  end # class
+end # module NTFS