当前位置：首页 > news >正文

Ntfs!LfsFlushLfcb函数分析之Ntfs!_LFCB-＞LbcbWorkque的背景分析3个restart页面一个普通页面的一个例子

news 2025/7/13 16:13:45

第一部分：总纲，4个页面

0: kd> dx -r1 ((Ntfs!_LFCB *)0xe13417d8)
((Ntfs!_LFCB *)0xe13417d8)                 : 0xe13417d8 [Type: _LFCB *]
[+0x000] NodeTypeCode     : 2051 [Type: short]
[+0x002] NodeByteSize     : 352 [Type: short]
[+0x004] LfcbLinks        [Type: _LIST_ENTRY]
[+0x00c] LchLinks         [Type: _LIST_ENTRY]
[+0x014] FileObject       : 0x894d0c60 [Type: _FILE_OBJECT *]
[+0x018] FileSize         : 67108864 [Type: __int64]
[+0x020] LogPageSize      : 4096 [Type: __int64]
[+0x028] LogPageMask      : 0xfff [Type: unsigned long]
[+0x02c] LogPageInverseMask : -4096 [Type: long]
[+0x030] LogPageShift     : 0xc [Type: unsigned long]
[+0x038] FirstLogPage     : 16384 [Type: __int64]
[+0x040] NextLogPage      : 9580544 [Type: __int64]
[+0x048] ReusePageOffset : 0x3c0 [Type: unsigned long]
[+0x04c] RestartDataOffset : 0x30 [Type: unsigned long]
[+0x050] LogPageDataOffset : 64 [Type: __int64]
[+0x058] RestartDataSize : 0xfd0 [Type: unsigned long]
[+0x060] LogPageDataSize : 4032 [Type: __int64]
[+0x068] RecordHeaderLength : 0x30 [Type: unsigned short]
[+0x070] SeqNumber        : 8 [Type: __int64]
[+0x078] SeqNumberForWrap : 9 [Type: __int64]
[+0x080] SeqNumberBits    : 0x28 [Type: unsigned long]
[+0x084] FileDataBits     : 0x18 [Type: unsigned long]
[+0x088] LbcbWorkque      [Type: _LIST_ENTRY]

0: kd> dx -r1 (*((Ntfs!_LIST_ENTRY *)0xe1341860))
(*((Ntfs!_LIST_ENTRY *)0xe1341860))                 [Type: _LIST_ENTRY]
[+0x000] Flink            : 0xe135ed2c [Type: _LIST_ENTRY *]
[+0x004] Blink            : 0xe127bc34 [Type: _LIST_ENTRY *]
0: kd> dx -r1 ((Ntfs!_LIST_ENTRY *)0xe135ed2c)
((Ntfs!_LIST_ENTRY *)0xe135ed2c)                 : 0xe135ed2c [Type: _LIST_ENTRY *]
[+0x000] Flink            : 0xe1277b54 [Type: _LIST_ENTRY *]
[+0x004] Blink            : 0xe1341860 [Type: _LIST_ENTRY *]
0: kd> dx -r1 ((Ntfs!_LIST_ENTRY *)0xe1277b54)
((Ntfs!_LIST_ENTRY *)0xe1277b54)                 : 0xe1277b54 [Type: _LIST_ENTRY *]
[+0x000] Flink            : 0xe1350cec [Type: _LIST_ENTRY *]
[+0x004] Blink            : 0xe135ed2c [Type: _LIST_ENTRY *]
0: kd> dx -r1 ((Ntfs!_LIST_ENTRY *)0xe1350cec)
((Ntfs!_LIST_ENTRY *)0xe1350cec)                 : 0xe1350cec [Type: _LIST_ENTRY *]
[+0x000] Flink            : 0xe127bc34 [Type: _LIST_ENTRY *]
[+0x004] Blink            : 0xe1277b54 [Type: _LIST_ENTRY *]

第二部分：

第一个：

0: kd> dt _lbcb 0xe135ed2c-4
Ntfs!_LBCB
+0x000 NodeTypeCode     : 0n26512
+0x002 NodeByteSize     : 0n-7897
+0x004 WorkqueLinks     : _LIST_ENTRY [ 0xe13418f4 - 0xe1341860 ]
+0x00c ActiveLinks      : _LIST_ENTRY [ 0x0 - 0x0 ]
+0x018 FileOffset       : 0n4096
+0x020 Length           : 0n4048
+0x028 SeqNumber        : 0n0
+0x030 BufferOffset     : 0n0
+0x038 PageHeader       : 0xe1363008 Void
+0x03c LogPageBcb       : (null)
+0x040 LastLsn          : _LARGE_INTEGER 0x8124466
+0x048 LastEndLsn       : _LARGE_INTEGER 0x8124466
+0x050 Flags            : 0
+0x054 LbcbFlags        : 0x20
+0x058 ResourceThread   : 0

0: kd> dt lfs_restart_area 0xe1363008
Ntfs!LFS_RESTART_AREA
+0x000 CurrentLsn       : _LARGE_INTEGER 0xe128e900
+0x008 LogClients       : 1
+0x00a ClientFreeList   : 0xffff
+0x00c ClientInUseList : 0
+0x00e Flags            : 0
+0x010 SeqNumberBits    : 0x28
+0x014 RestartAreaLength : 0xe0
+0x016 ClientArrayOffset : 0x40
+0x018 FileSize         : 0n67108864
+0x020 LastLsnDataLength : 0x68
+0x024 RecordHeaderLength : 0x30
+0x026 LogPageDataOffset : 0x40
+0x028 RestartOpenLogCount : 0x85e12261
+0x02c LastFailedFlushStatus : 0
+0x030 LastFailedFlushOffset : 0n0
+0x038 LastFailedFlushLsn : _LARGE_INTEGER 0x0
+0x040 LogClientArray   : [1] _LFS_CLIENT_RECORD
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!_LFS_CLIENT_RECORD (*)[1])0xe1363048))
(*((Ntfs!_LFS_CLIENT_RECORD (*)[1])0xe1363048))                 [Type: _LFS_CLIENT_RECORD [1]]
[0]              [Type: _LFS_CLIENT_RECORD]
0: kd> dt Ntfs!_LFS_CLIENT_RECORD 0xe1363048
+0x000 OldestLsn        : _LARGE_INTEGER 0x8124452
+0x008 ClientRestartLsn : _LARGE_INTEGER 0x8124465
+0x010 PrevClient       : 0xffff
+0x012 NextClient       : 0xffff
+0x014 SeqNumber        : 0
+0x016 AlignWord        : 0
+0x018 AlignDWord       : 0
+0x01c ClientNameLength : 8
+0x020 ClientName       : [64] 0x4e

0: kd> ?8*124465
Evaluate expression: 9577256 = 00922328

第三部分：

第二个：

0: kd> dt _lbcb 0xe1277b54-4
Ntfs!_LBCB
+0x000 NodeTypeCode     : 0n2050
+0x002 NodeByteSize     : 0n96
+0x004 WorkqueLinks     : _LIST_ENTRY [ 0xe1350cec - 0xe1341860 ]
+0x00c ActiveLinks      : _LIST_ENTRY [ 0x0 - 0x0 ]
+0x018 FileOffset       : 0n0
+0x020 Length           : 0n4048
+0x028 SeqNumber        : 0n0
+0x030 BufferOffset     : 0n0
+0x038 PageHeader       : 0xe138c008 Void
+0x03c LogPageBcb       : (null)
+0x040 LastLsn          : _LARGE_INTEGER 0x8124467
+0x048 LastEndLsn       : _LARGE_INTEGER 0x8124467
+0x050 Flags            : 0
+0x054 LbcbFlags        : 0x20
+0x058 ResourceThread   : 0

0: kd> dt lfs_restart_area 0xe138c008
Ntfs!LFS_RESTART_AREA
+0x000 CurrentLsn       : _LARGE_INTEGER 0x8124465
+0x008 LogClients       : 1
+0x00a ClientFreeList   : 0xffff
+0x00c ClientInUseList : 0
+0x00e Flags            : 0
+0x010 SeqNumberBits    : 0x28
+0x014 RestartAreaLength : 0xe0
+0x016 ClientArrayOffset : 0x40
+0x018 FileSize         : 0n67108864
+0x020 LastLsnDataLength : 0x68
+0x024 RecordHeaderLength : 0x30
+0x026 LogPageDataOffset : 0x40
+0x028 RestartOpenLogCount : 0x85e12261
+0x02c LastFailedFlushStatus : 0
+0x030 LastFailedFlushOffset : 0n0
+0x038 LastFailedFlushLsn : _LARGE_INTEGER 0x0
+0x040 LogClientArray   : [1] _LFS_CLIENT_RECORD
0: kd> dx -id 0,0,899a2278 -r1 (*((Ntfs!_LFS_CLIENT_RECORD (*)[1])0xe139d048))
(*((Ntfs!_LFS_CLIENT_RECORD (*)[1])0xe139d048))                 [Type: _LFS_CLIENT_RECORD [1]]
[0]              [Type: _LFS_CLIENT_RECORD]
0: kd> dt Ntfs!_LFS_CLIENT_RECORD 0xe139d048
+0x000 OldestLsn        : _LARGE_INTEGER 0x8124465
+0x008 ClientRestartLsn : _LARGE_INTEGER 0x8124478
+0x010 PrevClient       : 0xffff
+0x012 NextClient       : 0xffff
+0x014 SeqNumber        : 0
+0x016 AlignWord        : 0
+0x018 AlignDWord       : 0
+0x01c ClientNameLength : 8
+0x020 ClientName       : [64] 0x4e

第四部分：

第三个：

0: kd> dt lbcb 0xe1350cec-4
Ntfs!LBCB
+0x000 NodeTypeCode     : 0n2050
+0x002 NodeByteSize     : 0n96
+0x004 WorkqueLinks     : _LIST_ENTRY [ 0xe127bc34 - 0xe1277b54 ]
+0x00c ActiveLinks      : _LIST_ENTRY [ 0xe1341868 - 0xe1341868 ]
+0x018 FileOffset       : 0n9576448
+0x020 Length           : 0n4096
+0x028 SeqNumber        : 0n8
+0x030 BufferOffset     : 0n1112
+0x038 PageHeader       : 0xc11a2000 Void
+0x03c LogPageBcb       : 0x89811ce8 Void
+0x040 LastLsn          : _LARGE_INTEGER 0x8124478
+0x048 LastEndLsn       : _LARGE_INTEGER 0x8124478
+0x050 Flags            : 1
+0x054 LbcbFlags        : 0xe
+0x058 ResourceThread   : 0x8999d023

0: kd> db 0xc11a2000
c11a2000 52 43 52 44 28 00 09 00-78 44 12 08 00 00 00 00 RCRD(...xD......
c11a2010 01 00 00 00 01 00 01 00-58 04 00 00 00 00 00 00 ........X.......
c11a2020 78 44 12 08 00 00 00 00-15 33 00 00 00 00 00 00 xD.......3......
c11a2030 db 01 00 00 00 00 00 00-ff ff 00 00 00 00 00 00 ................
c11a2040 08 44 12 08 00 00 00 00-50 05 12 08 00 00 00 00 .D......P.......
c11a2050 00 00 00 00 00 00 00 00-28 00 00 00 00 00 00 00 ........(.......
c11a2060 01 00 00 00 18 00 00 00-00 00 00 00 00 00 00 00 ................
c11a2070 1b 00 01 00 28 00 00 00-28 00 04 00 44 00 00 00 ....(...(...D...

0: kd> dt LFS_RECORD_HEADER c11a2040
Ntfs!LFS_RECORD_HEADER
+0x000 ThisLsn          : _LARGE_INTEGER 0x8124408
+0x008 ClientPreviousLsn : _LARGE_INTEGER 0x8120550
+0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
+0x018 ClientDataLength : 0x28
+0x01c ClientId         : _LFS_CLIENT_ID
+0x020 RecordType       : 1 ( LfsClientRecord )
+0x024 TransactionId    : 0x18
+0x028 Flags            : 0
+0x02a AlignWord        : 0
0: kd> dt LFS_RECORD_HEADER c11a2040+58
Ntfs!LFS_RECORD_HEADER
+0x000 ThisLsn          : _LARGE_INTEGER 0x8124413
+0x008 ClientPreviousLsn : _LARGE_INTEGER 0x81243ee
+0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
+0x018 ClientDataLength : 0x40
+0x01c ClientId         : _LFS_CLIENT_ID
+0x020 RecordType       : 1 ( LfsClientRecord )
+0x024 TransactionId    : 0x40
+0x028 Flags            : 0
+0x02a AlignWord        : 0
0: kd> dt LFS_RECORD_HEADER c11a2040+58+70
Ntfs!LFS_RECORD_HEADER
+0x000 ThisLsn          : _LARGE_INTEGER 0x8124421
+0x008 ClientPreviousLsn : _LARGE_INTEGER 0x8124413
+0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
+0x018 ClientDataLength : 0x28
+0x01c ClientId         : _LFS_CLIENT_ID
+0x020 RecordType       : 1 ( LfsClientRecord )
+0x024 TransactionId    : 0x40
+0x028 Flags            : 0
+0x02a AlignWord        : 0
0: kd> dt LFS_RECORD_HEADER c11a2040+58+70+58
Ntfs!LFS_RECORD_HEADER
+0x000 ThisLsn          : _LARGE_INTEGER 0x812442c
+0x008 ClientPreviousLsn : _LARGE_INTEGER 0x0
+0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
+0x018 ClientDataLength : 0x68
+0x01c ClientId         : _LFS_CLIENT_ID
+0x020 RecordType       : 2 ( LfsClientRestart )
+0x024 TransactionId    : 0
+0x028 Flags            : 0
+0x02a AlignWord        : 0

0: kd> dt _restart_area c11a2040+58+70+58+30
Ntfs!_RESTART_AREA
+0x000 MajorVersion     : 0
+0x004 MinorVersion     : 0
+0x008 StartOfCheckpoint : _LARGE_INTEGER 0x8124421
+0x010 OpenAttributeTableLsn : _LARGE_INTEGER 0x0
+0x018 AttributeNamesLsn : _LARGE_INTEGER 0x0
+0x020 DirtyPageTableLsn : _LARGE_INTEGER 0x0
+0x028 TransactionTableLsn : _LARGE_INTEGER 0x0
+0x030 OpenAttributeTableLength : 0
+0x034 AttributeNamesLength : 0
+0x038 DirtyPageTableLength : 0
+0x03c TransactionTableLength : 0
+0x040 LowestOpenUsn    : 0n0
+0x048 CurrentLsnAtMount : _LARGE_INTEGER 0x81243ee
+0x050 BytesPerCluster : 0x1000
+0x054 Reserved         : 0
+0x058 UsnJournalReference : _MFT_SEGMENT_REFERENCE
+0x060 UsnCacheBias     : 0n0

0: kd> ?0n9576448
Evaluate expression: 9576448 = 00922000

0: kd> dt LFS_RECORD_HEADER c11a2040+58+70+58+30+68
Ntfs!LFS_RECORD_HEADER
+0x000 ThisLsn          : _LARGE_INTEGER 0x812443f
+0x008 ClientPreviousLsn : _LARGE_INTEGER 0x0
+0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
+0x018 ClientDataLength : 0x68
+0x01c ClientId         : _LFS_CLIENT_ID
+0x020 RecordType       : 2 ( LfsClientRestart )
+0x024 TransactionId    : 0
+0x028 Flags            : 0
+0x02a AlignWord        : 0
0: kd> dt restart_area c11a2040+58+70+58+30+68+30
Ntfs!RESTART_AREA
+0x000 MajorVersion     : 0
+0x004 MinorVersion     : 0
+0x008 StartOfCheckpoint : _LARGE_INTEGER 0x812442c
+0x010 OpenAttributeTableLsn : _LARGE_INTEGER 0x0
+0x018 AttributeNamesLsn : _LARGE_INTEGER 0x0
+0x020 DirtyPageTableLsn : _LARGE_INTEGER 0x0
+0x028 TransactionTableLsn : _LARGE_INTEGER 0x0
+0x030 OpenAttributeTableLength : 0
+0x034 AttributeNamesLength : 0
+0x038 DirtyPageTableLength : 0
+0x03c TransactionTableLength : 0
+0x040 LowestOpenUsn    : 0n0
+0x048 CurrentLsnAtMount : _LARGE_INTEGER 0x812442c
+0x050 BytesPerCluster : 0x1000
+0x054 Reserved         : 0
+0x058 UsnJournalReference : _MFT_SEGMENT_REFERENCE
+0x060 UsnCacheBias     : 0n0

0: kd> dt LFS_RECORD_HEADER c11a2040+58+70+58+30+68+30+68
Ntfs!LFS_RECORD_HEADER
+0x000 ThisLsn          : _LARGE_INTEGER 0x8124452
+0x008 ClientPreviousLsn : _LARGE_INTEGER 0x0
+0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
+0x018 ClientDataLength : 0x68
+0x01c ClientId         : _LFS_CLIENT_ID
+0x020 RecordType       : 2 ( LfsClientRestart )
+0x024 TransactionId    : 0
+0x028 Flags            : 0
+0x02a AlignWord        : 0
0: kd> dt restart_area c11a2040+58+70+58+30+68+30+68+30
Ntfs!RESTART_AREA
+0x000 MajorVersion     : 0
+0x004 MinorVersion     : 0
+0x008 StartOfCheckpoint : _LARGE_INTEGER 0x812443f
+0x010 OpenAttributeTableLsn : _LARGE_INTEGER 0x0
+0x018 AttributeNamesLsn : _LARGE_INTEGER 0x0
+0x020 DirtyPageTableLsn : _LARGE_INTEGER 0x0
+0x028 TransactionTableLsn : _LARGE_INTEGER 0x0
+0x030 OpenAttributeTableLength : 0
+0x034 AttributeNamesLength : 0
+0x038 DirtyPageTableLength : 0
+0x03c TransactionTableLength : 0
+0x040 LowestOpenUsn    : 0n0
+0x048 CurrentLsnAtMount : _LARGE_INTEGER 0x812443f
+0x050 BytesPerCluster : 0x1000
+0x054 Reserved         : 0
+0x058 UsnJournalReference : _MFT_SEGMENT_REFERENCE
+0x060 UsnCacheBias     : 0n0

0: kd> dt LFS_RECORD_HEADER c11a2040+58+70+58+30+68+30+68+30+68+30+68
Ntfs!LFS_RECORD_HEADER
+0x000 ThisLsn          : _LARGE_INTEGER 0x8124478
+0x008 ClientPreviousLsn : _LARGE_INTEGER 0x0
+0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
+0x018 ClientDataLength : 0x68
+0x01c ClientId         : _LFS_CLIENT_ID
+0x020 RecordType       : 2 ( LfsClientRestart )
+0x024 TransactionId    : 0
+0x028 Flags            : 0
+0x02a AlignWord        : 0
0: kd> dt restart_area c11a2040+58+70+58+30+68+30+68+30+68+30+68+30
Ntfs!RESTART_AREA
+0x000 MajorVersion     : 0
+0x004 MinorVersion     : 0
+0x008 StartOfCheckpoint : _LARGE_INTEGER 0x8124465
+0x010 OpenAttributeTableLsn : _LARGE_INTEGER 0x0
+0x018 AttributeNamesLsn : _LARGE_INTEGER 0x0
+0x020 DirtyPageTableLsn : _LARGE_INTEGER 0x0
+0x028 TransactionTableLsn : _LARGE_INTEGER 0x0
+0x030 OpenAttributeTableLength : 0
+0x034 AttributeNamesLength : 0
+0x038 DirtyPageTableLength : 0
+0x03c TransactionTableLength : 0
+0x040 LowestOpenUsn    : 0n0
+0x048 CurrentLsnAtMount : _LARGE_INTEGER 0x8124465
+0x050 BytesPerCluster : 0x1000
+0x054 Reserved         : 0
+0x058 UsnJournalReference : _MFT_SEGMENT_REFERENCE
+0x060 UsnCacheBias     : 0n0

第五部分：

logfile文件循环使用，seq number为7，是原来的日志记录！

0: kd> dd c11a2040+58+70+58+30+68+30+68+30+68+30+68+80*2
c11a24c0 3672784e 01db4091 0014e000 00000000
c11a24d0 0014e000 00000000 00000022 00000000
c11a24e0 0712449c 00000000 07124483 00000000
c11a24f0 00000000 00000000 00000028 00000000
c11a2500 00000001 00000040 00000000 00000000
c11a2510 0001001b 00000028 00040028 00000044
c11a2520 00000000 00000000 00000000 00000000
c11a2530 ffffffff ffffffff 071244a7 00000000
0: kd> dt LFS_RECORD_HEADER c11a24e0
Ntfs!LFS_RECORD_HEADER
+0x000 ThisLsn          : _LARGE_INTEGER 0x712449c
+0x008 ClientPreviousLsn : _LARGE_INTEGER 0x7124483
+0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
+0x018 ClientDataLength : 0x28
+0x01c ClientId         : _LFS_CLIENT_ID
+0x020 RecordType       : 1 ( LfsClientRecord )
+0x024 TransactionId    : 0x40
+0x028 Flags            : 0
+0x02a AlignWord        : 0
0: kd> dt LFS_RECORD_HEADER c11a24e0+58
Ntfs!LFS_RECORD_HEADER
+0x000 ThisLsn          : _LARGE_INTEGER 0x71244a7
+0x008 ClientPreviousLsn : _LARGE_INTEGER 0x0
+0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
+0x018 ClientDataLength : 0x30
+0x01c ClientId         : _LFS_CLIENT_ID
+0x020 RecordType       : 1 ( LfsClientRecord )
+0x024 TransactionId    : 0x40
+0x028 Flags            : 0
+0x02a AlignWord        : 0
0: kd> dt LFS_RECORD_HEADER c11a24e0+58+60
Ntfs!LFS_RECORD_HEADER
+0x000 ThisLsn          : _LARGE_INTEGER 0x71244b3
+0x008 ClientPreviousLsn : _LARGE_INTEGER 0x71244a7
+0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x71244a7
+0x018 ClientDataLength : 0x58
+0x01c ClientId         : _LFS_CLIENT_ID
+0x020 RecordType       : 1 ( LfsClientRecord )
+0x024 TransactionId    : 0x40
+0x028 Flags            : 0
+0x02a AlignWord        : 0
0: kd> dt LFS_RECORD_HEADER c11a24e0+58+60+88
Ntfs!LFS_RECORD_HEADER
+0x000 ThisLsn          : _LARGE_INTEGER 0x71244c4
+0x008 ClientPreviousLsn : _LARGE_INTEGER 0x71244b3
+0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x71244b3
+0x018 ClientDataLength : 0x38
+0x01c ClientId         : _LFS_CLIENT_ID
+0x020 RecordType       : 1 ( LfsClientRecord )
+0x024 TransactionId    : 0x40
+0x028 Flags            : 0
+0x02a AlignWord        : 0

0: kd> dt LFS_RECORD_HEADER c11a24e0+58+60+88+68
Ntfs!LFS_RECORD_HEADER
+0x000 ThisLsn          : _LARGE_INTEGER 0x71244d1
+0x008 ClientPreviousLsn : _LARGE_INTEGER 0x71244c4
+0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x71244c4
+0x018 ClientDataLength : 0x58
+0x01c ClientId         : _LFS_CLIENT_ID
+0x020 RecordType       : 1 ( LfsClientRecord )
+0x024 TransactionId    : 0x40
+0x028 Flags            : 0
+0x02a AlignWord        : 0
0: kd> dt LFS_RECORD_HEADER c11a24e0+58+60+88+68+88
Ntfs!LFS_RECORD_HEADER
+0x000 ThisLsn          : _LARGE_INTEGER 0x71244e2
+0x008 ClientPreviousLsn : _LARGE_INTEGER 0x71244d1
+0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
+0x018 ClientDataLength : 0x28
+0x01c ClientId         : _LFS_CLIENT_ID
+0x020 RecordType       : 1 ( LfsClientRecord )
+0x024 TransactionId    : 0x40
+0x028 Flags            : 0
+0x02a AlignWord        : 0

第六部分：0xe139d008应该是日志文件的一部分内容复制到了系统空间。

[+0x0a0] RestartArea : 0xe1364f20 [Type: _LFS_RESTART_AREA *]

第四个：
0: kd> dt lbcb 0xe127bc34-4
Ntfs!LBCB
+0x000 NodeTypeCode     : 0n2050
+0x002 NodeByteSize     : 0n96
+0x004 WorkqueLinks     : _LIST_ENTRY [ 0xe1341860 - 0xe1350cec ]
+0x00c ActiveLinks      : _LIST_ENTRY [ 0x0 - 0x0 ]
+0x018 FileOffset       : 0n4096
+0x020 Length           : 0n224
+0x028 SeqNumber        : 0n0
+0x030 BufferOffset     : 0n0
+0x038 PageHeader       : 0xe139d008 Void
+0x03c LogPageBcb       : (null)
+0x040 LastLsn          : _LARGE_INTEGER 0x8124479
+0x048 LastEndLsn       : _LARGE_INTEGER 0x8124479
+0x050 Flags            : 0
+0x054 LbcbFlags        : 0x20
+0x058 ResourceThread   : 0

0: kd> dt lfs_restart_area 0xe139d008
Ntfs!LFS_RESTART_AREA
+0x000 CurrentLsn       : _LARGE_INTEGER 0x8124478
+0x008 LogClients       : 1
+0x00a ClientFreeList   : 0xffff
+0x00c ClientInUseList : 0
+0x00e Flags            : 0
+0x010 SeqNumberBits    : 0x28
+0x014 RestartAreaLength : 0xe0
+0x016 ClientArrayOffset : 0x40
+0x018 FileSize         : 0n67108864
+0x020 LastLsnDataLength : 0x68
+0x024 RecordHeaderLength : 0x30
+0x026 LogPageDataOffset : 0x40
+0x028 RestartOpenLogCount : 0x85e12261
+0x02c LastFailedFlushStatus : 0
+0x030 LastFailedFlushOffset : 0n0
+0x038 LastFailedFlushLsn : _LARGE_INTEGER 0x0
+0x040 LogClientArray   : [1] _LFS_CLIENT_RECORD

0: kd> dt _LFS_CLIENT_RECORD 0xe139d048
Ntfs!_LFS_CLIENT_RECORD
+0x000 OldestLsn        : _LARGE_INTEGER 0x8124465
+0x008 ClientRestartLsn : _LARGE_INTEGER 0x8124478
+0x010 PrevClient       : 0xffff
+0x012 NextClient       : 0xffff
+0x014 SeqNumber        : 0
+0x016 AlignWord        : 0
+0x018 AlignDWord       : 0
+0x01c ClientNameLength : 8
+0x020 ClientName       : [64] 0x4e

0: kd> ?8*124478
Evaluate expression: 9577408 = 009223c0

0: kd> dt lfs_record_header c11a2000+3c0
Ntfs!LFS_RECORD_HEADER
+0x000 ThisLsn          : _LARGE_INTEGER 0x8124478
+0x008 ClientPreviousLsn : _LARGE_INTEGER 0x0
+0x010 ClientUndoNextLsn : _LARGE_INTEGER 0x0
+0x018 ClientDataLength : 0x68
+0x01c ClientId         : _LFS_CLIENT_ID
+0x020 RecordType       : 2 ( LfsClientRestart )
+0x024 TransactionId    : 0
+0x028 Flags            : 0
+0x02a AlignWord        : 0
0: kd> dt restart_area c11a2000+3c0+30
Ntfs!RESTART_AREA
+0x000 MajorVersion     : 0
+0x004 MinorVersion     : 0
+0x008 StartOfCheckpoint : _LARGE_INTEGER 0x8124465
+0x010 OpenAttributeTableLsn : _LARGE_INTEGER 0x0
+0x018 AttributeNamesLsn : _LARGE_INTEGER 0x0
+0x020 DirtyPageTableLsn : _LARGE_INTEGER 0x0
+0x028 TransactionTableLsn : _LARGE_INTEGER 0x0
+0x030 OpenAttributeTableLength : 0
+0x034 AttributeNamesLength : 0
+0x038 DirtyPageTableLength : 0
+0x03c TransactionTableLength : 0
+0x040 LowestOpenUsn    : 0n0
+0x048 CurrentLsnAtMount : _LARGE_INTEGER 0x8124465
+0x050 BytesPerCluster : 0x1000
+0x054 Reserved         : 0
+0x058 UsnJournalReference : _MFT_SEGMENT_REFERENCE
+0x060 UsnCacheBias     : 0n0