@@ -95,11 +95,10 @@ enum RECORD_NUM {
95
95
MFT_REC_BITMAP = 6 ,
96
96
MFT_REC_BOOT = 7 ,
97
97
MFT_REC_BADCLUST = 8 ,
98
- //MFT_REC_QUOTA = 9,
99
- MFT_REC_SECURE = 9 , // NTFS 3.0
98
+ MFT_REC_SECURE = 9 ,
100
99
MFT_REC_UPCASE = 10 ,
101
- MFT_REC_EXTEND = 11 , // NTFS 3.0
102
- MFT_REC_RESERVED = 11 ,
100
+ MFT_REC_EXTEND = 11 ,
101
+ MFT_REC_RESERVED = 12 ,
103
102
MFT_REC_FREE = 16 ,
104
103
MFT_REC_USER = 24 ,
105
104
};
@@ -109,7 +108,6 @@ enum ATTR_TYPE {
109
108
ATTR_STD = cpu_to_le32 (0x10 ),
110
109
ATTR_LIST = cpu_to_le32 (0x20 ),
111
110
ATTR_NAME = cpu_to_le32 (0x30 ),
112
- // ATTR_VOLUME_VERSION on Nt4
113
111
ATTR_ID = cpu_to_le32 (0x40 ),
114
112
ATTR_SECURE = cpu_to_le32 (0x50 ),
115
113
ATTR_LABEL = cpu_to_le32 (0x60 ),
@@ -118,7 +116,6 @@ enum ATTR_TYPE {
118
116
ATTR_ROOT = cpu_to_le32 (0x90 ),
119
117
ATTR_ALLOC = cpu_to_le32 (0xA0 ),
120
118
ATTR_BITMAP = cpu_to_le32 (0xB0 ),
121
- // ATTR_SYMLINK on Nt4
122
119
ATTR_REPARSE = cpu_to_le32 (0xC0 ),
123
120
ATTR_EA_INFO = cpu_to_le32 (0xD0 ),
124
121
ATTR_EA = cpu_to_le32 (0xE0 ),
@@ -144,6 +141,7 @@ enum FILE_ATTRIBUTE {
144
141
FILE_ATTRIBUTE_ENCRYPTED = cpu_to_le32 (0x00004000 ),
145
142
FILE_ATTRIBUTE_VALID_FLAGS = cpu_to_le32 (0x00007fb7 ),
146
143
FILE_ATTRIBUTE_DIRECTORY = cpu_to_le32 (0x10000000 ),
144
+ FILE_ATTRIBUTE_INDEX = cpu_to_le32 (0x20000000 )
147
145
};
148
146
149
147
static_assert (sizeof (enum FILE_ATTRIBUTE ) == 4 );
@@ -266,7 +264,7 @@ enum RECORD_FLAG {
266
264
RECORD_FLAG_IN_USE = cpu_to_le16 (0x0001 ),
267
265
RECORD_FLAG_DIR = cpu_to_le16 (0x0002 ),
268
266
RECORD_FLAG_SYSTEM = cpu_to_le16 (0x0004 ),
269
- RECORD_FLAG_UNKNOWN = cpu_to_le16 (0x0008 ),
267
+ RECORD_FLAG_INDEX = cpu_to_le16 (0x0008 ),
270
268
};
271
269
272
270
/* MFT Record structure. */
@@ -331,18 +329,18 @@ struct ATTR_NONRESIDENT {
331
329
__le64 svcn ; // 0x10: Starting VCN of this segment.
332
330
__le64 evcn ; // 0x18: End VCN of this segment.
333
331
__le16 run_off ; // 0x20: Offset to packed runs.
334
- // Unit of Compression size for this stream, expressed
335
- // as a log of the cluster size.
332
+ // Unit of Compression size for this stream, expressed
333
+ // as a log of the cluster size.
336
334
//
337
- // 0 means file is not compressed
338
- // 1, 2, 3, and 4 are potentially legal values if the
339
- // stream is compressed, however the implementation
340
- // may only choose to use 4, or possibly 3. Note
341
- // that 4 means cluster size time 16. If convenient
342
- // the implementation may wish to accept a
343
- // reasonable range of legal values here (1-5?),
344
- // even if the implementation only generates
345
- // a smaller set of values itself.
335
+ // 0 means file is not compressed
336
+ // 1, 2, 3, and 4 are potentially legal values if the
337
+ // stream is compressed, however the implementation
338
+ // may only choose to use 4, or possibly 3.
339
+ // Note that 4 means cluster size time 16.
340
+ // If convenient the implementation may wish to accept a
341
+ // reasonable range of legal values here (1-5?),
342
+ // even if the implementation only generates
343
+ // a smaller set of values itself.
346
344
u8 c_unit ; // 0x22:
347
345
u8 res1 [5 ]; // 0x23:
348
346
__le64 alloc_size ; // 0x28: The allocated size of attribute in bytes.
@@ -836,16 +834,22 @@ static_assert(sizeof(struct ATTR_DEF_ENTRY) == 0xa0);
836
834
/* Object ID (0x40) */
837
835
struct OBJECT_ID {
838
836
struct GUID ObjId ; // 0x00: Unique Id assigned to file.
839
- struct GUID BirthVolumeId ; // 0x10: Birth Volume Id is the Object Id of the Volume on.
840
- // which the Object Id was allocated. It never changes.
841
- struct GUID BirthObjectId ; // 0x20: Birth Object Id is the first Object Id that was
842
- // ever assigned to this MFT Record. I.e. If the Object Id
843
- // is changed for some reason, this field will reflect the
844
- // original value of the Object Id.
845
- struct GUID DomainId ; // 0x30: Domain Id is currently unused but it is intended to be
846
- // used in a network environment where the local machine is
847
- // part of a Windows 2000 Domain. This may be used in a Windows
848
- // 2000 Advanced Server managed domain.
837
+
838
+ // Birth Volume Id is the Object Id of the Volume on.
839
+ // which the Object Id was allocated. It never changes.
840
+ struct GUID BirthVolumeId ; //0x10:
841
+
842
+ // Birth Object Id is the first Object Id that was
843
+ // ever assigned to this MFT Record. I.e. If the Object Id
844
+ // is changed for some reason, this field will reflect the
845
+ // original value of the Object Id.
846
+ struct GUID BirthObjectId ; // 0x20:
847
+
848
+ // Domain Id is currently unused but it is intended to be
849
+ // used in a network environment where the local machine is
850
+ // part of a Windows 2000 Domain. This may be used in a Windows
851
+ // 2000 Advanced Server managed domain.
852
+ struct GUID DomainId ; // 0x30:
849
853
};
850
854
851
855
static_assert (sizeof (struct OBJECT_ID ) == 0x40 );
@@ -855,42 +859,45 @@ struct NTFS_DE_O {
855
859
struct NTFS_DE de ;
856
860
struct GUID ObjId ; // 0x10: Unique Id assigned to file.
857
861
struct MFT_REF ref ; // 0x20: MFT record number with this file.
858
- struct GUID BirthVolumeId ; // 0x28: Birth Volume Id is the Object Id of the Volume on
859
- // which the Object Id was allocated. It never changes.
860
- struct GUID BirthObjectId ; // 0x38: Birth Object Id is the first Object Id that was
861
- // ever assigned to this MFT Record. I.e. If the Object Id
862
- // is changed for some reason, this field will reflect the
863
- // original value of the Object Id.
864
- // This field is valid if data_size == 0x48.
865
- struct GUID BirthDomainId ; // 0x48: Domain Id is currently unused but it is intended
866
- // to be used in a network environment where the local
867
- // machine is part of a Windows 2000 Domain. This may be
868
- // used in a Windows 2000 Advanced Server managed domain.
862
+
863
+ // Birth Volume Id is the Object Id of the Volume on
864
+ // which the Object Id was allocated. It never changes.
865
+ struct GUID BirthVolumeId ; // 0x28:
866
+
867
+ // Birth Object Id is the first Object Id that was
868
+ // ever assigned to this MFT Record. I.e. If the Object Id
869
+ // is changed for some reason, this field will reflect the
870
+ // original value of the Object Id.
871
+ // This field is valid if data_size == 0x48.
872
+ struct GUID BirthObjectId ; // 0x38:
873
+
874
+ // Domain Id is currently unused but it is intended
875
+ // to be used in a network environment where the local
876
+ // machine is part of a Windows 2000 Domain. This may be
877
+ // used in a Windows 2000 Advanced Server managed domain.
878
+ struct GUID BirthDomainId ; // 0x48:
869
879
};
870
880
871
881
static_assert (sizeof (struct NTFS_DE_O ) == 0x58 );
872
882
873
- #define NTFS_OBJECT_ENTRY_DATA_SIZE1 \
874
- 0x38 // struct NTFS_DE_O.BirthDomainId is not used
875
- #define NTFS_OBJECT_ENTRY_DATA_SIZE2 \
876
- 0x48 // struct NTFS_DE_O.BirthDomainId is used
877
-
878
883
/* Q Directory entry structure ( rule = 0x11 ) */
879
884
struct NTFS_DE_Q {
880
885
struct NTFS_DE de ;
881
886
__le32 owner_id ; // 0x10: Unique Id assigned to file
887
+
888
+ /* here is 0x30 bytes of user quota. NOTE: 4 byte aligned! */
882
889
__le32 Version ; // 0x14: 0x02
883
- __le32 flags2 ; // 0x18: Quota flags, see above
890
+ __le32 Flags ; // 0x18: Quota flags, see above
884
891
__le64 BytesUsed ; // 0x1C:
885
892
__le64 ChangeTime ; // 0x24:
886
893
__le64 WarningLimit ; // 0x28:
887
894
__le64 HardLimit ; // 0x34:
888
895
__le64 ExceededTime ; // 0x3C:
889
896
890
897
// SID is placed here
891
- }; // sizeof() = 0x44
898
+ }__packed ; // sizeof() = 0x44
892
899
893
- #define SIZEOF_NTFS_DE_Q 0x44
900
+ static_assert ( sizeof ( struct NTFS_DE_Q ) == 0x44 );
894
901
895
902
#define SecurityDescriptorsBlockSize 0x40000 // 256K
896
903
#define SecurityDescriptorMaxSize 0x20000 // 128K
@@ -912,7 +919,7 @@ struct SECURITY_HDR {
912
919
*/
913
920
} __packed ;
914
921
915
- #define SIZEOF_SECURITY_HDR 0x14
922
+ static_assert ( sizeof ( struct SECURITY_HDR ) == 0x14 );
916
923
917
924
/* SII Directory entry structure */
918
925
struct NTFS_DE_SII {
@@ -921,7 +928,8 @@ struct NTFS_DE_SII {
921
928
struct SECURITY_HDR sec_hdr ; // 0x14:
922
929
} __packed ;
923
930
924
- #define SIZEOF_SII_DIRENTRY 0x28
931
+ static_assert (offsetof(struct NTFS_DE_SII , sec_hdr ) == 0x14 );
932
+ static_assert (sizeof (struct NTFS_DE_SII ) == 0x28 );
925
933
926
934
/* SDH Directory entry structure */
927
935
struct NTFS_DE_SDH {
@@ -1155,7 +1163,7 @@ struct REPARSE_DATA_BUFFER {
1155
1163
1156
1164
#define FILE_NEED_EA 0x80 // See ntifs.h
1157
1165
/*
1158
- *FILE_NEED_EA, indicates that the file to which the EA belongs cannot be
1166
+ * FILE_NEED_EA, indicates that the file to which the EA belongs cannot be
1159
1167
* interpreted without understanding the associated extended attributes.
1160
1168
*/
1161
1169
struct EA_INFO {
0 commit comments