3 * By John Hodge (thePowersGang)
4 * This file is published under the terms of the Acess licence. See the
5 * file COPYING for details.
7 * attributes.h - MFT Attribute Types
10 #define _ATTRIBUTES_H_
12 enum eNTFS_FILE_Attribs
14 NTFS_FileAttrib_StandardInformation = 0x10,
15 NTFS_FileAttrib_FileName = 0x30,
16 NTFS_FileAttrib_SecurityDescriptor = 0x50,
17 NTFS_FileAttrib_Data = 0x80,
18 NTFS_FileAttrib_IndexRoot = 0x90,
19 NTFS_FileAttrib_IndexAllocation = 0xA0,
20 NTFS_FileAttrib_Bitmap = 0xB0,
30 Uint32 DOSFilePermissions;
31 Uint32 MaxNumVersions;
38 Uint64 UpdateSequenceNumber;
39 } PACKED tNTFS_Attrib_StandardInformation;
41 enum eNTFS_Filename_Namespaces
43 NTFS_FilenameNamespace_POSIX, // [^NUL,/]
44 NTFS_FilenameNamespace_Win32, //
45 NTFS_FilenameNamespace_DOS, //
46 NTFS_FilenameNamespace_Win32DOS, // Same name in both Win32/DOS, so merged
49 typedef struct sNTFS_Attrib_Filename
51 Uint64 ParentDirectory; //!< Parent directory MFT entry
52 Sint64 CreationTime; //!< Time the file was created
53 Sint64 LastDataModTime; //!< Last change time for the data
54 Sint64 LastMftModTime; //!< Last change time for the MFT entry
55 Sint64 LastAccessTime; //!< Last Access Time (unreliable on most systems)
57 Uint64 AllocatedSize; //!< Allocated data size for $DATA unnamed stream
58 Uint64 DataSize; //!< Actual size of $DATA unnamed stream
59 Uint32 Flags; //!< File attribute files
63 Uint16 PackedSize; //!< Size of buffer needed for extended attributes
67 Uint32 Tag; //!< Type of reparse point
68 } PACKED ReparsePoint;
72 Uint8 FilenameNamespace; //!< Filename namespace (DOS, Windows, Unix)
74 } PACKED tNTFS_Attrib_Filename;
76 typedef struct sNTFS_Attrib_IndexEntry
81 Uint8 Flags; // [0]: Sub-node, [1]: Last entry in node
83 // Stream data and sub-node VCN (64-bit) follows
84 } PACKED tNTFS_Attrib_IndexEntry;
86 typedef struct sNTFS_Attrib_IndexRoot
89 Uint32 AttributeType; // Type of indexed attribute
90 Uint32 CollationRule; // Sorting method
91 Uint32 AllocEntrySize; //
92 Uint8 ClustersPerIndexRec;
100 // List of IndexEntry structures follow
101 } PACKED tNTFS_Attrib_IndexRoot;