I have found a strange issue related to hivex/ntfs-3g. After opening a system hive on a
volume mounted by ntfs-3g, any access to the Windows directory results device or resource
busy error. The patch below fix it by closing the hive file handle in hivex_open() call in
the writable path because the handle never been used after its content been read into
memory.
--- hivex-1.2.5.orig/lib/hivex.c 2011-04-13 06:04:49.000000000 -0700
+++ hivex-1.2.5/lib/hivex.c 2011-07-07 09:10:06.927429068 -0700
@@ -321,6 +321,8 @@
if (full_read (h->fd, h->addr, h->size) < h->size)
goto error;
+ close(h->fd);
+ h->fd = -1;
}
/* Check header. */
@@ -541,7 +543,10 @@
munmap (h->addr, h->size);
else
free (h->addr);
- r = close (h->fd);
+ if (h->fd >= 0)
+ r = close (h->fd);
+ else
+ r = 0;
free (h->filename);
free (h);