I have found a strange issue related to hivex/ntfs-3g. After opening a system hive on a volume mounted by ntfs-3g, any access to the Windows directory results device or resource busy error. The patch below fix it by closing the hive file handle in hivex_open() call in the writable path because the handle never been used after its content been read into memory.

--- hivex-1.2.5.orig/lib/hivex.c    2011-04-13 06:04:49.000000000 -0700

+++ hivex-1.2.5/lib/hivex.c   2011-07-07 09:10:06.927429068 -0700

@@ -321,6 +321,8 @@

     if (full_read (h->fd, h->addr, h->size) < h->size)

       goto error;

+    close(h->fd);

+    h->fd = -1;

   }

   /* Check header. */

@@ -541,7 +543,10 @@

     munmap (h->addr, h->size);

   else

     free (h->addr);

-  r = close (h->fd);

+  if (h->fd >= 0)

+       r = close (h->fd);

+  else

+       r = 0;

   free (h->filename);

   free (h);