VirtualBox

Changeset 69861 in vbox for trunk/include/iprt/formats


Ignore:
Timestamp:
Nov 28, 2017 7:01:35 PM (7 years ago)
Author:
vboxsync
svn:sync-xref-src-repo-rev:
119307
Message:

iprt/formats/ntfs: updates

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/include/iprt/formats/ntfs.h

    r69849 r69861  
    4040
    4141
    42 /** @} */
    43 
     42/** @name NTFS_MFT_IDX_XXX - Predefined MFT indexes.
     43 * @{ */
     44#define NTFS_MFT_IDX_MFT            0   /**< The MFT itself. */
     45#define NTFS_MFT_IDX_MFT_MIRROR     1   /**< Mirror MFT (partial?). */
     46#define NTFS_MFT_IDX_LOG_FILE       2   /**< Journalling log. */
     47#define NTFS_MFT_IDX_VOLUME         3   /**< Volume attributes. */
     48#define NTFS_MFT_IDX_ATTRIB_DEF     4   /**< Attribute definitions. */
     49#define NTFS_MFT_IDX_ROOT           5   /**< The root directory. */
     50#define NTFS_MFT_IDX_BITMAP         6   /**< Allocation bitmap. */
     51#define NTFS_MFT_IDX_BOOT           7   /**< The boot sector. */
     52#define NTFS_MFT_IDX_BAD_CLUSTER    8   /**< Bad cluster table. */
     53#define NTFS_MFT_IDX_SECURITY       9   /**< Shared security descriptors (w2k and later). */
     54#define NTFS_MFT_IDX_UP_CASE        10  /**< Unicode upper case table. */
     55#define NTFS_MFT_IDX_EXTEND         11  /**< Directory containing further system files. */
     56#define NTFS_MFT_IDX_FIRST_USER     16  /**< The first user file. */
     57/** @} */
     58
     59/**
     60 * NTFS MFT record reference.
     61 */
     62typedef union NTFSMFTREF
     63{
     64    /** unsigned 64-bit view. */
     65    uint64_t        u64;
     66    /** unsigned 32-bit view. */
     67    uint32_t        au32[2];
     68    /** unsigned 16-bit view. */
     69    uint16_t        au16[4];
     70
     71    /** Structured view. */
     72    struct
     73    {
     74        /** Index of the master file table record. */
     75        uint64_t        idxMft : 48;
     76        /** MFT record reuse sequence number (for catching dangling references). */
     77        uint64_t        uRecReuseSeqNo : 16;
     78    } RT_UNION_NM(s);
     79} NTFSMFTREF;
     80AssertCompileSize(NTFSMFTREF, 8);
     81/** Pointer to a NTFS MFT record reference. */
     82typedef NTFSMFTREF *PNTFSMFTREF;
     83/** Pointer to a const NTFS MFT record reference. */
     84typedef NTFSMFTREF const *PCNTFSMFTREF;
     85
     86/** @name NTFSMFTREF_GET_IDX
     87 * Gets the MFT index number from a MFT reference. */
     88/** @name NTFSMFTREF_GET_SEQ
     89 * Gets the MFT reuse sequence number from a MFT reference. */
     90/** @name NTFSMFTREF_SET_IDX
     91 * Sets the MFT index number of a MFT reference. */
     92/** @name NTFSMFTREF_SET_SEQ
     93 * Sets the MFT reuse sequence number of a MFT reference. */
     94/** @name NTFSMFTREF_SET
     95 * Sets the values of a MFT reference. */
     96#ifdef RT_LITTLE_ENDIAN
     97# define NTFSMFTREF_GET_IDX(a_pMftRef)              ((a_pMftRef)->RT_UNION_NM(s.)idxMft)
     98# define NTFSMFTREF_GET_SEQ(a_pMftRef)              ((a_pMftRef)->RT_UNION_NM(s.)uRecReuseSeqNo)
     99# define NTFSMFTREF_SET_SEQ(a_pMftRef, a_uValue)    do { (a_pMftRef)->RT_UNION_NM(s.)uRecReuseSeqNo = (a_uValue); } while (0)
     100# define NTFSMFTREF_SET_IDX(a_pMftRef, a_uValue)    do { (a_pMftRef)->RT_UNION_NM(s.)idxMft         = (a_uValue); } while (0)
     101# define NTFSMFTREF_SET(a_pMftRef, a_idx, a_uSeq)  \
     102    do { \
     103        (a_pMftRef)->RT_UNION_NM(s.)idxMft         = (a_idx); \
     104        (a_pMftRef)->RT_UNION_NM(s.)uRecReuseSeqNo = (a_uSeq); \
     105    } while (0)
     106#else
     107# define NTFSMFTREF_GET_IDX(a_pMftRef)              (RT_LE2H_U64((a_pMftRef)->u64) & UINT64_C(0x0000ffffffffffff))
     108# define NTFSMFTREF_GET_SEQ(a_pMftRef)              RT_LE2H_U16((uint16_t)(a_pMftRef)->u64)
     109# define NTFSMFTREF_SET_SEQ(a_pMftRef, a_uValue)    do { (a_pMftRef)->au16[3] = RT_H2LE_U16(a_uValue); } while (0)
     110# define NTFSMFTREF_SET_IDX(a_pMftRef, a_uValue)  \
     111    do { \
     112        (a_pMftRef)->au32[0] = RT_H2LE_U32((uint32_t)(a_uValue)); \
     113        (a_pMftRef)->au16[2] = RT_H2LE_U16((uint16_t)((a_uValue) >> 32)); \
     114    } while (0)
     115# define NTFSMFTREF_SET(a_pMftRef, a_idx, a_uSeq)  \
     116    do { \
     117        (a_pMftRef)->au32[0] = RT_H2LE_U32((uint32_t)(a_idx)); \
     118        (a_pMftRef)->au16[2] = RT_H2LE_U16((uint16_t)((a_idx) >> 32)); \
     119        (a_pMftRef)->au16[3] = RT_H2LE_U16((uint16_t)(a_uSeq)); \
     120    } while (0)
    44121#endif
    45122
    46123
     124/**
     125 * NTFS record header.
     126 */
     127typedef struct NTFSRECHDR
     128{
     129    /** Magic number (usually ASCII). */
     130    uint32_t        uMagic;
     131    /** Offset of the update sequence array from the start of the record. */
     132    uint16_t        offUpdateSeqArray;
     133    /** Number of entries in the update sequence array. (uint16_t sized entries) */
     134    uint16_t        cUpdateSeqEntries;
     135} NTFSRECHDR;
     136AssertCompileSize(NTFSRECHDR, 8);
     137/** Pointer to a NTFS record header. */
     138typedef NTFSRECHDR *PNTFSRECHDR;
     139/** Pointer to a const NTFS record header. */
     140typedef NTFSRECHDR const *PCNTFSRECHDR;
     141
     142
     143/**
     144 * NTFS file record (in the MFT).
     145 */
     146typedef struct NTFSRECFILE
     147{
     148    /** 0x00: Header with NTFSREC_MAGIC_FILE. */
     149    NTFSRECHDR          Hdr;
     150    /** 0x08: Log file sequence number. */
     151    uint64_t            uLsn;
     152    /** 0x10: MFT record reuse sequence number (for dangling MFT references). */
     153    uint16_t            uRecReuseSeqNo;
     154    /** 0x12: Number of hard links. */
     155    uint16_t            cLinks;
     156    /** 0x14: Offset of the first attribute (relative to start of record). */
     157    uint16_t            offFirstAttrib;
     158    /** 0x16: Record flags (NTFSRECFILE_F_XXX). */
     159    uint16_t            fFlags;
     160    /** 0x18: Number of byte in use in this MFT record. */
     161    uint32_t            cbRecUsed;
     162    /** 0x1c: The MFT record size. */
     163    uint32_t            cbRecSize;
     164    /** 0x20: Reference to the base MFT record. */
     165    NTFSMFTREF          BaseMftRec;
     166    /** 0x28: Next attribute instance number. */
     167    uint16_t            idNextAttrib;
     168    /** 0x2a: Padding if NTFS 3.1+, update sequence array if older. */
     169    uint16_t            uPaddingOrUsa;
     170    /** 0x2c: MFT index of this record. */
     171    uint32_t            idxMftSelf;
     172} NTFSRECFILE;
     173AssertCompileSize(NTFSRECFILE, 0x30);
     174/** Pointer to a NTFS file record. */
     175typedef NTFSRECFILE *PNTFSRECFILE;
     176/** Pointer to a const NTFS file record. */
     177typedef NTFSRECFILE const *PCNTFSRECFILE;
     178
     179
     180/** NTFS 'FILE' record magic value. */
     181#define NTFSREC_MAGIC_FILE      RT_H2LE_U32_C(UINT32_C(0x454c4946))
     182
     183/** @name NTFSRECFILE_F_XXX - NTFSRECFILE::fFlags.
     184 * @{ */
     185/** MFT record is in use. */
     186#define NTFSRECFILE_F_IN_USE        RT_H2LE_U16_C(UINT16_C(0x0001))
     187/** Directory record. */
     188#define NTFSRECFILE_F_DIRECTORY     RT_H2LE_U16_C(UINT16_C(0x0002))
     189/** @} */
     190
     191
     192/** @name NTFS_AT_XXX - Attribute types
     193 * @{ */
     194#define NTFS_AT_UNUSED                      RT_H2LE_U32_C(UINT32_C(0x00000000))
     195/** NTFSATSTDINFO */
     196#define NTFS_AT_STANDARD_INFORMATION        RT_H2LE_U32_C(UINT32_C(0x00000010))
     197#define NTFS_AT_ATTRIBUTE_LIST              RT_H2LE_U32_C(UINT32_C(0x00000020))
     198/** PCNTFSATFILENAME */
     199#define NTFS_AT_FILENAME                    RT_H2LE_U32_C(UINT32_C(0x00000030))
     200#define NTFS_AT_OBJECT_ID                   RT_H2LE_U32_C(UINT32_C(0x00000040))
     201#define NTFS_AT_SECURITY_DESCRIPTOR         RT_H2LE_U32_C(UINT32_C(0x00000050))
     202#define NTFS_AT_VOLUME_NAME                 RT_H2LE_U32_C(UINT32_C(0x00000060))
     203#define NTFS_AT_VOLUME_INFORMATION          RT_H2LE_U32_C(UINT32_C(0x00000070))
     204#define NTFS_AT_DATA                        RT_H2LE_U32_C(UINT32_C(0x00000080))
     205#define NTFS_AT_INDEX_ROOT                  RT_H2LE_U32_C(UINT32_C(0x00000090))
     206#define NTFS_AT_INDEX_ALLOCATION            RT_H2LE_U32_C(UINT32_C(0x000000a0))
     207#define NTFS_AT_BITMAP                      RT_H2LE_U32_C(UINT32_C(0x000000b0))
     208#define NTFS_AT_REPARSE_POINT               RT_H2LE_U32_C(UINT32_C(0x000000c0))
     209#define NTFS_AT_EA_INFORMATION              RT_H2LE_U32_C(UINT32_C(0x000000d0))
     210#define NTFS_AT_EA                          RT_H2LE_U32_C(UINT32_C(0x000000e0))
     211#define NTFS_AT_PROPERTY_SET                RT_H2LE_U32_C(UINT32_C(0x000000f0))
     212#define NTFS_AT_LOGGED_UTILITY_STREAM       RT_H2LE_U32_C(UINT32_C(0x00000100))
     213#define NTFS_AT_FIRST_USER_DEFINED          RT_H2LE_U32_C(UINT32_C(0x00001000))
     214#define NTFS_AT_END                         RT_H2LE_U32_C(UINT32_C(0xffffffff))
     215/** @} */
     216
     217/** @name NTFS_AF_XXX - Attribute flags.
     218 * @{ */
     219#define NTFS_AF_COMPR_FMT_NONE              UINT16_C(0x0000)
     220#define NTFS_AF_COMPR_FMT_LZNT1             UINT16_C(0x0001)    /**< See RtlCompressBuffer / COMPRESSION_FORMAT_LZNT1. */
     221#define NTFS_AF_COMPR_FMT_XPRESS            UINT16_C(0x0002)    /**< See RtlCompressBuffer / COMPRESSION_FORMAT_XPRESS_HUFF. */
     222#define NTFS_AF_COMPR_FMT_XPRESS_HUFF       UINT16_C(0x0003)    /**< See RtlCompressBuffer / COMPRESSION_FORMAT_XPRESS_HUFF. */
     223#define NTFS_AF_COMPR_FMT_MASK              UINT16_C(0x00ff)
     224#define NTFS_AF_ENCRYPTED                   UINT16_C(0x4000)
     225#define NTFS_AF_SPARSE                      UINT16_C(0x8000)
     226/** @} */
     227
     228/**
     229 * NTFS attribute header.
     230 *
     231 * This has three forms:
     232 *      - Resident
     233 *      - Non-resident, no compression
     234 *      - Non-resident, compressed.
     235 *
     236 * Each form translates to a different header size.
     237 */
     238typedef struct NTFSATTRIBHDR
     239{
     240    /** 0x00: Attribute type (NTFS_AT_XXX). */
     241    uint32_t                uAttrType;
     242    /** 0x04: Length of this attribute (resident part). */
     243    uint32_t                cbAttrib;
     244    /** 0x08: Set (1) if non-resident attribute, 0 if resident. */
     245    uint8_t                 fNonResident;
     246    /** 0x09: Attribute name length (can be zero). */
     247    uint8_t                 cwcName;
     248    /** 0x0a: Offset of the name string (relative to the start of this header). */
     249    uint16_t                offName;
     250    /** 0x0c: NTFS_AF_XXX. */
     251    uint16_t                fFlags;
     252    /** 0x0e: Attribute instance number.  Unique within the MFT record. */
     253    uint16_t                idAttrib;
     254    /** 0x10: Data depending on the fNonResident member value. */
     255    union
     256    {
     257        /** Resident attributes. */
     258        struct
     259        {
     260            /** 0x10: Attribute value length. */
     261            uint32_t        cbValue;
     262            /** 0x14: Offset of the value (relative to the start of this header). */
     263            uint16_t        offValue;
     264            /** 0x16: NTFS_RES_AF_XXX. */
     265            uint8_t         fFlags;
     266            /** 0x17: Reserved. */
     267            uint8_t         bReserved;
     268        } Res;
     269
     270        /** Non-resident attributes. */
     271        struct
     272        {
     273            /** 0x10: The first virtual cluster containing data. */
     274            int64_t         iVcnFirst;
     275            /** 0x18: The last virtual cluster containing data (inclusive). */
     276            int64_t         iVcnLast;
     277            /** 0x20: Offset of the mapping pair program.  This program gives us a mapping
     278             * between VNC and LCN for the attribute value. */
     279            uint16_t        offMappingPairs;
     280            /** 0x22: Power of two compression unit size in clusters (cbCluster << uCompessionUnit).
     281             * Zero means uncompressed.  */
     282            uint8_t         uCompressionUnit;
     283            /** 0x23: Reserved */
     284            uint8_t         abReserved[5];
     285            /** 0x28: Allocated size. */
     286            int64_t         cbAllocated;
     287            /** 0x30: Initialized size. */
     288            int64_t         cbInitialized;
     289            /** 0x38: Compressed size if compressed, otherwise absent. */
     290            int64_t         cbCompressed;
     291        } NonRes;
     292    } RT_UNION_NM(u);
     293} NTFSATTRIBHDR;
     294AssertCompileSize(NTFSATTRIBHDR, 0x40);
     295AssertCompileMemberOffset(NTFSATTRIBHDR, RT_UNION_NM(u.) Res, 0x10);
     296AssertCompileMemberOffset(NTFSATTRIBHDR, RT_UNION_NM(u.) Res.bReserved, 0x17);
     297AssertCompileMemberOffset(NTFSATTRIBHDR, RT_UNION_NM(u.) NonRes, 0x10);
     298AssertCompileMemberOffset(NTFSATTRIBHDR, RT_UNION_NM(u.) NonRes.cbCompressed, 0x38);
     299/** Pointer to a NTFS attribute header. */
     300typedef NTFSATTRIBHDR *PNTFSATTRIBHDR;
     301/** Pointer to a const NTFS attribute header. */
     302typedef NTFSATTRIBHDR const *PCNTFSATTRIBHDR;
     303
     304/** @name NTFSATTRIBHDR_SIZE_XXX - Attribute header sizes.
     305 * @{ */
     306/** Attribute header size for resident values. */
     307#define NTFSATTRIBHDR_SIZE_RESIDENT                 (0x18)
     308/** Attribute header size for uncompressed non-resident values. */
     309#define NTFSATTRIBHDR_SIZE_NONRES_UNCOMPRESSED      (0x38)
     310/** Attribute header size for compressed non-resident values. */
     311#define NTFSATTRIBHDR_SIZE_NONRES_COMPRESSED        (0x40)
     312/** @} */
     313
     314/**
     315 * NTFS standard file info attribute (NTFS_AT_STANDARD_INFORMATION).
     316 */
     317typedef struct NTFSATSTDINFO
     318{
     319    /** 0x00: Creation timestamp. */
     320    int64_t             iCreationTime;
     321    /** 0x08: Last data modification timestamp. */
     322    int64_t             iLastDataModTime;
     323    /** 0x10: Last MFT record modification timestamp. */
     324    int64_t             iLastMftModTime;
     325    /** 0x18: Last access timestamp. */
     326    int64_t             iLastAccessTime;
     327    /** 0x20: File attributes. */
     328    uint32_t            fFileAttribs;
     329    /** 0x24: Maximum number of file versions allowed.
     330     * @note NTFS 3.x, padding in 1.2  */
     331    uint32_t            cMaxFileVersions;
     332    /** 0x28: Current file version number.
     333     * @note NTFS 3.x, padding in 1.2  */
     334    uint32_t            uFileVersion;
     335    /** 0x2c: Class ID (whatever that is).
     336     * @note NTFS 3.x, padding in 1.2  */
     337    uint32_t            idClass;
     338    /** 0x30: Owner ID.
     339     * Translated via $Q index in NTFS_MFT_IDX_EXTENDED/$Quota.
     340     * @note NTFS 3.x, not present in 1.2  */
     341    uint32_t            idOwner;
     342    /** 0x34: Security ID. Translated via $SII index and $SDS data stream in
     343     *  NTFS_MFT_IDX_SECURITY.
     344     * @note NTFS 3.x, not present in 1.2  */
     345    uint32_t            idSecurity;
     346    /** 0x38: Total quota charged for this file.
     347     * @note NTFS 3.x, not present in 1.2  */
     348    uint64_t            cbQuotaChared;
     349    /** 0x40: Last update sequence number, index into $UsnJrnl.
     350     * @note NTFS 3.x, not present in 1.2  */
     351    uint64_t            idxUpdateSequence;
     352} NTFSATSTDINFO;
     353AssertCompileSize(NTFSATSTDINFO, 0x48);
     354/** Pointer to NTFS standard file info. */
     355typedef NTFSATSTDINFO *PNTFSATSTDINFO;
     356/** Pointer to const NTFS standard file info. */
     357typedef NTFSATSTDINFO const *PCNTFSATSTDINFO;
     358
     359/** The size of NTFSATSTDINFO in NTFS v1.2 and earlier. */
     360#define NTFSATSTDINFO_SIZE_NTFS_V12     (0x30)
     361
     362/** @name NTFS_FA_XXX - NTFS file attributes.
     363 * @{ */
     364#define NTFS_FA_READONLY                            UINT32_C(0x00000001)
     365#define NTFS_FA_HIDDEN                              UINT32_C(0x00000002)
     366#define NTFS_FA_SYSTEM                              UINT32_C(0x00000004)
     367#define NTFS_FA_DIRECTORY                           UINT32_C(0x00000010)
     368#define NTFS_FA_ARCHIVE                             UINT32_C(0x00000020)
     369#define NTFS_FA_DEVICE                              UINT32_C(0x00000040)
     370#define NTFS_FA_NORMAL                              UINT32_C(0x00000080)
     371#define NTFS_FA_TEMPORARY                           UINT32_C(0x00000100)
     372#define NTFS_FA_SPARSE_FILE                         UINT32_C(0x00000200)
     373#define NTFS_FA_REPARSE_POINT                       UINT32_C(0x00000400)
     374#define NTFS_FA_COMPRESSED                          UINT32_C(0x00000800)
     375#define NTFS_FA_OFFLINE                             UINT32_C(0x00001000)
     376#define NTFS_FA_NOT_CONTENT_INDEXED                 UINT32_C(0x00002000)
     377#define NTFS_FA_ENCRYPTED                           UINT32_C(0x00004000)
     378#define NTFS_FA_VALID_FLAGS                         UINT32_C(0x00007fb7)
     379#define NTFS_FA_VALID_SET_FLAGS                     UINT32_C(0x000031a7)
     380#define NTFS_FA_DUP_FILE_NAME_INDEX_PRESENT         UINT32_C(0x10000000) /**< ?? */
     381#define NTFS_FA_DUP_VIEW_INDEX_PRESENT              UINT32_C(0x20000000) /**< ?? */
     382/** @} */
     383
     384
     385
     386/**
     387 * NTFS filename attribute (NTFS_AT_FILENAME).
     388 */
     389typedef struct NTFSATFILENAME
     390{
     391    /** 0x00: The parent directory MFT record. */
     392    NTFSMFTREF          ParentDirMftRec;
     393    /** 0x08: Creation timestamp. */
     394    int64_t             iCreationTime;
     395    /** 0x10: Last data modification timestamp. */
     396    int64_t             iLastDataModTime;
     397    /** 0x18: Last MFT record modification timestamp. */
     398    int64_t             iLastMftModTime;
     399    /** 0x20: Last access timestamp. */
     400    int64_t             iLastAccessTime;
     401    /** 0x28: Allocated disk space for the unnamed data attribute. */
     402    int64_t             cbAllocated;
     403    /** 0x30: Actual size of unnamed data attribute. */
     404    int64_t             cbData;
     405    /** 0x38: File attributes. */
     406    uint32_t            fFileAttribs;
     407    union
     408    {
     409        /** 0x3c: Packed EA length. */
     410        uint16_t        cbPackedEas;
     411        /** 0x3c: Reparse tag, if no EAs. */
     412        uint32_t        uReparseTag;
     413    };
     414    /** 0x40: Filename length in unicode chars. */
     415    uint8_t             cwcFilename;
     416    /** 0x41: Filename type (NTFS_FILENAME_T_XXX). */
     417    uint8_t             fFilenameType;
     418    /** 0x42: The filename. */
     419    RTUTF16             wszFilename[RT_FLEXIBLE_ARRAY];
     420} NTFSATFILENAME;
     421AssertCompileMemberOffset(NTFSATFILENAME, cbData, 0x30);
     422AssertCompileMemberOffset(NTFSATFILENAME, cbPackedEas, 0x3c);
     423AssertCompileMemberOffset(NTFSATFILENAME, uReparseTag, 0x3c);
     424AssertCompileMemberOffset(NTFSATFILENAME, wszFilename, 0x42);
     425/** Pointer to a NTFS filename attribute. */
     426typedef NTFSATFILENAME *PNTFSATFILENAME;
     427/** Pointer to a const NTFS filename attribute. */
     428typedef NTFSATFILENAME const *PCNTFSATFILENAME;
     429
     430/** @name NTFS_FILENAME_T_XXX - filename types
     431 * @{ */
     432#define NTFS_FILENAME_T_POSIX           0
     433#define NTFS_FILENAME_T_WINDOWS         1
     434#define NTFS_FILENAME_T_DOS             2
     435#define NTFS_FILENAME_T_WINDOWS_AND_DSO 3
     436/** @} */
     437
     438/** @} */
     439
     440#endif
     441
Note: See TracChangeset for help on using the changeset viewer.

© 2025 Oracle Support Privacy / Do Not Sell My Info Terms of Use Trademark Policy Automated Access Etiquette