VirtualBox

source: vbox/trunk/include/iprt/formats/ntfs.h@ 69865

Last change on this file since 69865 was 69865, checked in by vboxsync, 7 years ago

iprt/formats/ntfs: build fixes - g++ sometimes hates unnamed unions, sigh.
  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
File size: 17.8 KB
Line 
1/* $Id: ntfs.h 69865 2017-11-28 19:09:42Z vboxsync $ */
2/** @file
3 * IPRT, NT File System (NTFS).
4 */
5
6/*
7 * Copyright (C) 2017 Oracle Corporation
8 *
9 * This file is part of VirtualBox Open Source Edition (OSE), as
10 * available from http://www.virtualbox.org. This file is free software;
11 * you can redistribute it and/or modify it under the terms of the GNU
12 * General Public License (GPL) as published by the Free Software
13 * Foundation, in version 2 as it comes in the "COPYING" file of the
14 * VirtualBox OSE distribution. VirtualBox OSE is distributed in the
15 * hope that it will be useful, but WITHOUT ANY WARRANTY of any kind.
16 *
17 * The contents of this file may alternatively be used under the terms
18 * of the Common Development and Distribution License Version 1.0
19 * (CDDL) only, as it comes in the "COPYING.CDDL" file of the
20 * VirtualBox OSE distribution, in which case the provisions of the
21 * CDDL are applicable instead of those of the GPL.
22 *
23 * You may elect to license modified versions of this file under the
24 * terms and conditions of either the GPL or the CDDL or both.
25 */
26
27#ifndef ___iprt_formats_ntfs_h
28#define ___iprt_formats_ntfs_h
29
30#include <iprt/formats/fat.h>
31
32
33/** @defgroup grp_rt_formats_ntfs NT File System (NTFS) structures and definitions
34 * @ingroup grp_rt_formats
35 * @{
36 */
37
38/** Value of the FATBOOTSECTOR::achOemName for an NTFS file system. */
39#define NTFS_OEM_ID_MAGIC "NTFS "
40
41
42/** @name NTFS_MFT_IDX_XXX - Predefined MFT indexes.
43 * @{ */
44#define NTFS_MFT_IDX_MFT 0 /**< The MFT itself. */
45#define NTFS_MFT_IDX_MFT_MIRROR 1 /**< Mirror MFT (partial?). */
46#define NTFS_MFT_IDX_LOG_FILE 2 /**< Journalling log. */
47#define NTFS_MFT_IDX_VOLUME 3 /**< Volume attributes. */
48#define NTFS_MFT_IDX_ATTRIB_DEF 4 /**< Attribute definitions. */
49#define NTFS_MFT_IDX_ROOT 5 /**< The root directory. */
50#define NTFS_MFT_IDX_BITMAP 6 /**< Allocation bitmap. */
51#define NTFS_MFT_IDX_BOOT 7 /**< The boot sector. */
52#define NTFS_MFT_IDX_BAD_CLUSTER 8 /**< Bad cluster table. */
53#define NTFS_MFT_IDX_SECURITY 9 /**< Shared security descriptors (w2k and later). */
54#define NTFS_MFT_IDX_UP_CASE 10 /**< Unicode upper case table. */
55#define NTFS_MFT_IDX_EXTEND 11 /**< Directory containing further system files. */
56#define NTFS_MFT_IDX_FIRST_USER 16 /**< The first user file. */
57/** @} */
58
59/**
60 * NTFS MFT record reference.
61 */
62typedef union NTFSMFTREF
63{
64 /** unsigned 64-bit view. */
65 uint64_t u64;
66 /** unsigned 32-bit view. */
67 uint32_t au32[2];
68 /** unsigned 16-bit view. */
69 uint16_t au16[4];
70
71 /** Structured view. */
72 struct
73 {
74 /** Index of the master file table record. */
75 uint64_t idxMft : 48;
76 /** MFT record reuse sequence number (for catching dangling references). */
77 uint64_t uRecReuseSeqNo : 16;
78 } s;
79} NTFSMFTREF;
80AssertCompileSize(NTFSMFTREF, 8);
81/** Pointer to a NTFS MFT record reference. */
82typedef NTFSMFTREF *PNTFSMFTREF;
83/** Pointer to a const NTFS MFT record reference. */
84typedef NTFSMFTREF const *PCNTFSMFTREF;
85
86/** @name NTFSMFTREF_GET_IDX
87 * Gets the MFT index number from a MFT reference. */
88/** @name NTFSMFTREF_GET_SEQ
89 * Gets the MFT reuse sequence number from a MFT reference. */
90/** @name NTFSMFTREF_SET_IDX
91 * Sets the MFT index number of a MFT reference. */
92/** @name NTFSMFTREF_SET_SEQ
93 * Sets the MFT reuse sequence number of a MFT reference. */
94/** @name NTFSMFTREF_SET
95 * Sets the values of a MFT reference. */
96#ifdef RT_LITTLE_ENDIAN
97# define NTFSMFTREF_GET_IDX(a_pMftRef) ((a_pMftRef)->s.idxMft)
98# define NTFSMFTREF_GET_SEQ(a_pMftRef) ((a_pMftRef)->s.uRecReuseSeqNo)
99# define NTFSMFTREF_SET_SEQ(a_pMftRef, a_uValue) do { (a_pMftRef)->s.uRecReuseSeqNo = (a_uValue); } while (0)
100# define NTFSMFTREF_SET_IDX(a_pMftRef, a_uValue) do { (a_pMftRef)->s.idxMft = (a_uValue); } while (0)
101# define NTFSMFTREF_SET(a_pMftRef, a_idx, a_uSeq) \
102 do { \
103 (a_pMftRef)->s.idxMft = (a_idx); \
104 (a_pMftRef)->s.uRecReuseSeqNo = (a_uSeq); \
105 } while (0)
106#else
107# define NTFSMFTREF_GET_IDX(a_pMftRef) (RT_LE2H_U64((a_pMftRef)->u64) & UINT64_C(0x0000ffffffffffff))
108# define NTFSMFTREF_GET_SEQ(a_pMftRef) RT_LE2H_U16((uint16_t)(a_pMftRef)->u64)
109# define NTFSMFTREF_SET_SEQ(a_pMftRef, a_uValue) do { (a_pMftRef)->au16[3] = RT_H2LE_U16(a_uValue); } while (0)
110# define NTFSMFTREF_SET_IDX(a_pMftRef, a_uValue) \
111 do { \
112 (a_pMftRef)->au32[0] = RT_H2LE_U32((uint32_t)(a_uValue)); \
113 (a_pMftRef)->au16[2] = RT_H2LE_U16((uint16_t)((a_uValue) >> 32)); \
114 } while (0)
115# define NTFSMFTREF_SET(a_pMftRef, a_idx, a_uSeq) \
116 do { \
117 (a_pMftRef)->au32[0] = RT_H2LE_U32((uint32_t)(a_idx)); \
118 (a_pMftRef)->au16[2] = RT_H2LE_U16((uint16_t)((a_idx) >> 32)); \
119 (a_pMftRef)->au16[3] = RT_H2LE_U16((uint16_t)(a_uSeq)); \
120 } while (0)
121#endif
122
123
124/**
125 * NTFS record header.
126 */
127typedef struct NTFSRECHDR
128{
129 /** Magic number (usually ASCII). */
130 uint32_t uMagic;
131 /** Offset of the update sequence array from the start of the record. */
132 uint16_t offUpdateSeqArray;
133 /** Number of entries in the update sequence array. (uint16_t sized entries) */
134 uint16_t cUpdateSeqEntries;
135} NTFSRECHDR;
136AssertCompileSize(NTFSRECHDR, 8);
137/** Pointer to a NTFS record header. */
138typedef NTFSRECHDR *PNTFSRECHDR;
139/** Pointer to a const NTFS record header. */
140typedef NTFSRECHDR const *PCNTFSRECHDR;
141
142
143/**
144 * NTFS file record (in the MFT).
145 */
146typedef struct NTFSRECFILE
147{
148 /** 0x00: Header with NTFSREC_MAGIC_FILE. */
149 NTFSRECHDR Hdr;
150 /** 0x08: Log file sequence number. */
151 uint64_t uLsn;
152 /** 0x10: MFT record reuse sequence number (for dangling MFT references). */
153 uint16_t uRecReuseSeqNo;
154 /** 0x12: Number of hard links. */
155 uint16_t cLinks;
156 /** 0x14: Offset of the first attribute (relative to start of record). */
157 uint16_t offFirstAttrib;
158 /** 0x16: Record flags (NTFSRECFILE_F_XXX). */
159 uint16_t fFlags;
160 /** 0x18: Number of byte in use in this MFT record. */
161 uint32_t cbRecUsed;
162 /** 0x1c: The MFT record size. */
163 uint32_t cbRecSize;
164 /** 0x20: Reference to the base MFT record. */
165 NTFSMFTREF BaseMftRec;
166 /** 0x28: Next attribute instance number. */
167 uint16_t idNextAttrib;
168 /** 0x2a: Padding if NTFS 3.1+, update sequence array if older. */
169 uint16_t uPaddingOrUsa;
170 /** 0x2c: MFT index of this record. */
171 uint32_t idxMftSelf;
172} NTFSRECFILE;
173AssertCompileSize(NTFSRECFILE, 0x30);
174/** Pointer to a NTFS file record. */
175typedef NTFSRECFILE *PNTFSRECFILE;
176/** Pointer to a const NTFS file record. */
177typedef NTFSRECFILE const *PCNTFSRECFILE;
178
179
180/** NTFS 'FILE' record magic value. */
181#define NTFSREC_MAGIC_FILE RT_H2LE_U32_C(UINT32_C(0x454c4946))
182
183/** @name NTFSRECFILE_F_XXX - NTFSRECFILE::fFlags.
184 * @{ */
185/** MFT record is in use. */
186#define NTFSRECFILE_F_IN_USE RT_H2LE_U16_C(UINT16_C(0x0001))
187/** Directory record. */
188#define NTFSRECFILE_F_DIRECTORY RT_H2LE_U16_C(UINT16_C(0x0002))
189/** @} */
190
191
192/** @name NTFS_AT_XXX - Attribute types
193 * @{ */
194#define NTFS_AT_UNUSED RT_H2LE_U32_C(UINT32_C(0x00000000))
195/** NTFSATSTDINFO */
196#define NTFS_AT_STANDARD_INFORMATION RT_H2LE_U32_C(UINT32_C(0x00000010))
197#define NTFS_AT_ATTRIBUTE_LIST RT_H2LE_U32_C(UINT32_C(0x00000020))
198/** PCNTFSATFILENAME */
199#define NTFS_AT_FILENAME RT_H2LE_U32_C(UINT32_C(0x00000030))
200#define NTFS_AT_OBJECT_ID RT_H2LE_U32_C(UINT32_C(0x00000040))
201#define NTFS_AT_SECURITY_DESCRIPTOR RT_H2LE_U32_C(UINT32_C(0x00000050))
202#define NTFS_AT_VOLUME_NAME RT_H2LE_U32_C(UINT32_C(0x00000060))
203#define NTFS_AT_VOLUME_INFORMATION RT_H2LE_U32_C(UINT32_C(0x00000070))
204#define NTFS_AT_DATA RT_H2LE_U32_C(UINT32_C(0x00000080))
205#define NTFS_AT_INDEX_ROOT RT_H2LE_U32_C(UINT32_C(0x00000090))
206#define NTFS_AT_INDEX_ALLOCATION RT_H2LE_U32_C(UINT32_C(0x000000a0))
207#define NTFS_AT_BITMAP RT_H2LE_U32_C(UINT32_C(0x000000b0))
208#define NTFS_AT_REPARSE_POINT RT_H2LE_U32_C(UINT32_C(0x000000c0))
209#define NTFS_AT_EA_INFORMATION RT_H2LE_U32_C(UINT32_C(0x000000d0))
210#define NTFS_AT_EA RT_H2LE_U32_C(UINT32_C(0x000000e0))
211#define NTFS_AT_PROPERTY_SET RT_H2LE_U32_C(UINT32_C(0x000000f0))
212#define NTFS_AT_LOGGED_UTILITY_STREAM RT_H2LE_U32_C(UINT32_C(0x00000100))
213#define NTFS_AT_FIRST_USER_DEFINED RT_H2LE_U32_C(UINT32_C(0x00001000))
214#define NTFS_AT_END RT_H2LE_U32_C(UINT32_C(0xffffffff))
215/** @} */
216
217/** @name NTFS_AF_XXX - Attribute flags.
218 * @{ */
219#define NTFS_AF_COMPR_FMT_NONE UINT16_C(0x0000)
220#define NTFS_AF_COMPR_FMT_LZNT1 UINT16_C(0x0001) /**< See RtlCompressBuffer / COMPRESSION_FORMAT_LZNT1. */
221#define NTFS_AF_COMPR_FMT_XPRESS UINT16_C(0x0002) /**< See RtlCompressBuffer / COMPRESSION_FORMAT_XPRESS_HUFF. */
222#define NTFS_AF_COMPR_FMT_XPRESS_HUFF UINT16_C(0x0003) /**< See RtlCompressBuffer / COMPRESSION_FORMAT_XPRESS_HUFF. */
223#define NTFS_AF_COMPR_FMT_MASK UINT16_C(0x00ff)
224#define NTFS_AF_ENCRYPTED UINT16_C(0x4000)
225#define NTFS_AF_SPARSE UINT16_C(0x8000)
226/** @} */
227
228/**
229 * NTFS attribute header.
230 *
231 * This has three forms:
232 * - Resident
233 * - Non-resident, no compression
234 * - Non-resident, compressed.
235 *
236 * Each form translates to a different header size.
237 */
238typedef struct NTFSATTRIBHDR
239{
240 /** 0x00: Attribute type (NTFS_AT_XXX). */
241 uint32_t uAttrType;
242 /** 0x04: Length of this attribute (resident part). */
243 uint32_t cbAttrib;
244 /** 0x08: Set (1) if non-resident attribute, 0 if resident. */
245 uint8_t fNonResident;
246 /** 0x09: Attribute name length (can be zero). */
247 uint8_t cwcName;
248 /** 0x0a: Offset of the name string (relative to the start of this header). */
249 uint16_t offName;
250 /** 0x0c: NTFS_AF_XXX. */
251 uint16_t fFlags;
252 /** 0x0e: Attribute instance number. Unique within the MFT record. */
253 uint16_t idAttrib;
254 /** 0x10: Data depending on the fNonResident member value. */
255 union
256 {
257 /** Resident attributes. */
258 struct
259 {
260 /** 0x10: Attribute value length. */
261 uint32_t cbValue;
262 /** 0x14: Offset of the value (relative to the start of this header). */
263 uint16_t offValue;
264 /** 0x16: NTFS_RES_AF_XXX. */
265 uint8_t fFlags;
266 /** 0x17: Reserved. */
267 uint8_t bReserved;
268 } Res;
269
270 /** Non-resident attributes. */
271 struct
272 {
273 /** 0x10: The first virtual cluster containing data. */
274 int64_t iVcnFirst;
275 /** 0x18: The last virtual cluster containing data (inclusive). */
276 int64_t iVcnLast;
277 /** 0x20: Offset of the mapping pair program. This program gives us a mapping
278 * between VNC and LCN for the attribute value. */
279 uint16_t offMappingPairs;
280 /** 0x22: Power of two compression unit size in clusters (cbCluster << uCompessionUnit).
281 * Zero means uncompressed. */
282 uint8_t uCompressionUnit;
283 /** 0x23: Reserved */
284 uint8_t abReserved[5];
285 /** 0x28: Allocated size. */
286 int64_t cbAllocated;
287 /** 0x30: Initialized size. */
288 int64_t cbInitialized;
289 /** 0x38: Compressed size if compressed, otherwise absent. */
290 int64_t cbCompressed;
291 } NonRes;
292 } u;
293} NTFSATTRIBHDR;
294AssertCompileSize(NTFSATTRIBHDR, 0x40);
295AssertCompileMemberOffset(NTFSATTRIBHDR, u.Res, 0x10);
296AssertCompileMemberOffset(NTFSATTRIBHDR, u.Res.bReserved, 0x17);
297AssertCompileMemberOffset(NTFSATTRIBHDR, u.NonRes, 0x10);
298AssertCompileMemberOffset(NTFSATTRIBHDR, u.NonRes.cbCompressed, 0x38);
299/** Pointer to a NTFS attribute header. */
300typedef NTFSATTRIBHDR *PNTFSATTRIBHDR;
301/** Pointer to a const NTFS attribute header. */
302typedef NTFSATTRIBHDR const *PCNTFSATTRIBHDR;
303
304/** @name NTFSATTRIBHDR_SIZE_XXX - Attribute header sizes.
305 * @{ */
306/** Attribute header size for resident values. */
307#define NTFSATTRIBHDR_SIZE_RESIDENT (0x18)
308/** Attribute header size for uncompressed non-resident values. */
309#define NTFSATTRIBHDR_SIZE_NONRES_UNCOMPRESSED (0x38)
310/** Attribute header size for compressed non-resident values. */
311#define NTFSATTRIBHDR_SIZE_NONRES_COMPRESSED (0x40)
312/** @} */
313
314/**
315 * NTFS standard file info attribute (NTFS_AT_STANDARD_INFORMATION).
316 */
317typedef struct NTFSATSTDINFO
318{
319 /** 0x00: Creation timestamp. */
320 int64_t iCreationTime;
321 /** 0x08: Last data modification timestamp. */
322 int64_t iLastDataModTime;
323 /** 0x10: Last MFT record modification timestamp. */
324 int64_t iLastMftModTime;
325 /** 0x18: Last access timestamp. */
326 int64_t iLastAccessTime;
327 /** 0x20: File attributes. */
328 uint32_t fFileAttribs;
329 /** 0x24: Maximum number of file versions allowed.
330 * @note NTFS 3.x, padding in 1.2 */
331 uint32_t cMaxFileVersions;
332 /** 0x28: Current file version number.
333 * @note NTFS 3.x, padding in 1.2 */
334 uint32_t uFileVersion;
335 /** 0x2c: Class ID (whatever that is).
336 * @note NTFS 3.x, padding in 1.2 */
337 uint32_t idClass;
338 /** 0x30: Owner ID.
339 * Translated via $Q index in NTFS_MFT_IDX_EXTENDED/$Quota.
340 * @note NTFS 3.x, not present in 1.2 */
341 uint32_t idOwner;
342 /** 0x34: Security ID. Translated via $SII index and $SDS data stream in
343 * NTFS_MFT_IDX_SECURITY.
344 * @note NTFS 3.x, not present in 1.2 */
345 uint32_t idSecurity;
346 /** 0x38: Total quota charged for this file.
347 * @note NTFS 3.x, not present in 1.2 */
348 uint64_t cbQuotaChared;
349 /** 0x40: Last update sequence number, index into $UsnJrnl.
350 * @note NTFS 3.x, not present in 1.2 */
351 uint64_t idxUpdateSequence;
352} NTFSATSTDINFO;
353AssertCompileSize(NTFSATSTDINFO, 0x48);
354/** Pointer to NTFS standard file info. */
355typedef NTFSATSTDINFO *PNTFSATSTDINFO;
356/** Pointer to const NTFS standard file info. */
357typedef NTFSATSTDINFO const *PCNTFSATSTDINFO;
358
359/** The size of NTFSATSTDINFO in NTFS v1.2 and earlier. */
360#define NTFSATSTDINFO_SIZE_NTFS_V12 (0x30)
361
362/** @name NTFS_FA_XXX - NTFS file attributes.
363 * @{ */
364#define NTFS_FA_READONLY UINT32_C(0x00000001)
365#define NTFS_FA_HIDDEN UINT32_C(0x00000002)
366#define NTFS_FA_SYSTEM UINT32_C(0x00000004)
367#define NTFS_FA_DIRECTORY UINT32_C(0x00000010)
368#define NTFS_FA_ARCHIVE UINT32_C(0x00000020)
369#define NTFS_FA_DEVICE UINT32_C(0x00000040)
370#define NTFS_FA_NORMAL UINT32_C(0x00000080)
371#define NTFS_FA_TEMPORARY UINT32_C(0x00000100)
372#define NTFS_FA_SPARSE_FILE UINT32_C(0x00000200)
373#define NTFS_FA_REPARSE_POINT UINT32_C(0x00000400)
374#define NTFS_FA_COMPRESSED UINT32_C(0x00000800)
375#define NTFS_FA_OFFLINE UINT32_C(0x00001000)
376#define NTFS_FA_NOT_CONTENT_INDEXED UINT32_C(0x00002000)
377#define NTFS_FA_ENCRYPTED UINT32_C(0x00004000)
378#define NTFS_FA_VALID_FLAGS UINT32_C(0x00007fb7)
379#define NTFS_FA_VALID_SET_FLAGS UINT32_C(0x000031a7)
380#define NTFS_FA_DUP_FILE_NAME_INDEX_PRESENT UINT32_C(0x10000000) /**< ?? */
381#define NTFS_FA_DUP_VIEW_INDEX_PRESENT UINT32_C(0x20000000) /**< ?? */
382/** @} */
383
384
385
386/**
387 * NTFS filename attribute (NTFS_AT_FILENAME).
388 */
389typedef struct NTFSATFILENAME
390{
391 /** 0x00: The parent directory MFT record. */
392 NTFSMFTREF ParentDirMftRec;
393 /** 0x08: Creation timestamp. */
394 int64_t iCreationTime;
395 /** 0x10: Last data modification timestamp. */
396 int64_t iLastDataModTime;
397 /** 0x18: Last MFT record modification timestamp. */
398 int64_t iLastMftModTime;
399 /** 0x20: Last access timestamp. */
400 int64_t iLastAccessTime;
401 /** 0x28: Allocated disk space for the unnamed data attribute. */
402 int64_t cbAllocated;
403 /** 0x30: Actual size of unnamed data attribute. */
404 int64_t cbData;
405 /** 0x38: File attributes. */
406 uint32_t fFileAttribs;
407 union
408 {
409 /** 0x3c: Packed EA length. */
410 uint16_t cbPackedEas;
411 /** 0x3c: Reparse tag, if no EAs. */
412 uint32_t uReparseTag;
413 };
414 /** 0x40: Filename length in unicode chars. */
415 uint8_t cwcFilename;
416 /** 0x41: Filename type (NTFS_FILENAME_T_XXX). */
417 uint8_t fFilenameType;
418 /** 0x42: The filename. */
419 RTUTF16 wszFilename[RT_FLEXIBLE_ARRAY];
420} NTFSATFILENAME;
421AssertCompileMemberOffset(NTFSATFILENAME, cbData, 0x30);
422AssertCompileMemberOffset(NTFSATFILENAME, cbPackedEas, 0x3c);
423AssertCompileMemberOffset(NTFSATFILENAME, uReparseTag, 0x3c);
424AssertCompileMemberOffset(NTFSATFILENAME, wszFilename, 0x42);
425/** Pointer to a NTFS filename attribute. */
426typedef NTFSATFILENAME *PNTFSATFILENAME;
427/** Pointer to a const NTFS filename attribute. */
428typedef NTFSATFILENAME const *PCNTFSATFILENAME;
429
430/** @name NTFS_FILENAME_T_XXX - filename types
431 * @{ */
432#define NTFS_FILENAME_T_POSIX 0
433#define NTFS_FILENAME_T_WINDOWS 1
434#define NTFS_FILENAME_T_DOS 2
435#define NTFS_FILENAME_T_WINDOWS_AND_DSO 3
436/** @} */
437
438/** @} */
439
440#endif
441
Note: See TracBrowser for help on using the repository browser.

© 2024 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette