Samba and MS Shadow Copy

Stefan (metze) Metzmacher metze at
Wed Aug 6 09:08:54 GMT 2003

At 10:59 06.08.2003 +0200, Stefan (metze) Metzmacher wrote:
>At 13:22 04.08.2003 -0400, Ken Cross wrote:
>>typedef struct
>>     uint32      num_volumes;    /* Total number of shadow volumes currently
>>mounted */
>>     uint32      num_labels;     /* Number of volume labels in the "labels"
>>array */
>>     uint32      data_size;      /* Total bytes being sent back */
>This is not what I see in the trace you sent to me...
>It's const 0x98 0x00 0x00 0x00 on the wire
>for both calls
>>     smb_ucs2_t  labels[2];      /* Concatenated list of null-terminated UCS2
>>(2-byte) labels */
>>num_volumes is the number of snapshots available for this volume.
>>Determining this value is highly dependent on the file system.
>>data_size should be 50 * num_volumes, since each label is exactly 50 bytes
>>long (24 UCS2 characters + 1 UCS2 null terminator).
>>If max_data_count == sizeof( SHADOW_COPY_DATA ) == 16, then the handler must
>>compute num_volumes and data_size, and the other elements must be zero.
>>Nothing should be returned in labels.
>the lables field is 0x70 0x00 0x5c 0x00
>in this case....
>>If max_data_count > 16, then fill the labels array with UCS2 strings in
>>*exactly* this format:
>>which is the timestamp of the snapshot, e.g., "@GMT-2003.03.03-03.04.04".
>>Set num_labels to the number of labels provided (should be the same as
>and there are extra 6 0x00 bytes at the end
>Can you send also a trace from a windows client a samba server?

also a trace of the win2k3 server when there are more or less then 3 volumes.

to see if the 6 0x00  extra bytes are constant...

what happens when the amount of label cause the data_count to be greater 
then max_data_count?

a trace of this would be fine too...

does the win2k3 return NT_STATUS_BUFFER_TOO_SMALL

or does returns paged results....

Stefan "metze" Metzmacher <metze at> 

More information about the samba-technical mailing list