3 * By John Hodge (thePowersGang)
4 * This file is published under the terms of the Acess licence. See the
5 * file COPYING for details.
7 * common.h - Common Types and Definitions
19 * In-memory representation of an NTFS Disk
21 typedef struct sNTFS_Disk
33 typedef struct sNTFS_BootSector
37 Uint8 SystemID[8]; // = "NTFS "
38 Uint16 BytesPerSector;
39 Uint8 SectorsPerCluster;
43 Uint8 MediaDescriptor;
45 Uint16 SectorsPerTrack;
50 Uint32 Unkown; // Usually 0x00800080 (according to Linux docs)
53 Uint64 TotalSectorCount; // Size of volume in sectors
54 Uint64 MFTStart; // Logical Cluster Number of Cluster 0 of MFT
55 Uint64 MFTMirrorStart; // Logical Cluster Number of Cluster 0 of MFT Backup
58 // If either of these are -ve, the size can be obtained via
59 // SizeInBytes = 2^(-1 * Value)
60 Sint8 ClustersPerMFTRecord;
62 Sint8 ClustersPerIndexRecord;
67 Uint8 Padding[512-0x50];
69 } PACKED tNTFS_BootSector;
72 * FILE header, an entry in the MFT
74 typedef struct sNTFS_FILE_Header
76 Uint32 Magic; // 'FILE'
77 Uint16 UpdateSequenceOfs;
78 Uint16 UpdateSequenceSize; // Size in words of the UpdateSequenceArray
80 Uint64 LSN; // $LogFile Sequence Number
82 Uint16 SequenceNumber;
84 Uint16 FirstAttribOfs; // Size of header?
85 Uint16 Flags; // 0: In Use, 1: Directory
87 Uint32 RecordSize; // Real Size of FILE Record
88 Uint32 RecordSpace; // Allocated Size for FILE Record
91 * Base address of the MFT containing this record
93 Uint64 Reference; // "File reference to the base FILE record" ???
101 Uint16 RecordNumber; // Number of this MFT Record
102 Uint16 UpdateSequenceNumber;
103 Uint16 UpdateSequenceArray[];
106 Uint16 UpdateSequenceNumber;
107 Uint16 UpdateSequenceArray[];
111 } PACKED tNTFS_FILE_Header;
114 * File Attribute, follows the FILE header
116 typedef struct sNTFS_FILE_Attrib
118 Uint32 Type; // See eNTFS_FILE_Attribs
119 Uint32 Size; // Includes header
121 Uint8 ResidentFlag; // (What does this mean?)
124 Uint16 Flags; // 0: Compressed, 14: Encrypted, 15: Sparse
130 Uint32 AttribLen; // In words
135 Uint16 Name[]; // UTF-16
142 Uint16 CompressionUnitSize;
144 Uint64 AllocatedSize;
146 Uint64 InitiatedSize; // One assumes, ammount of actual data stored
147 Uint16 Name[]; // UTF-16
151 } PACKED tNTFS_FILE_Attrib;