3 * By John Hodge (thePowersGang)
4 * This file is published under the terms of the Acess licence. See the
5 * file COPYING for details.
7 * common.h - Common Types and Definitions
17 * In-memory representation of an NTFS Disk
19 typedef struct sNTFS_Disk
29 typedef struct sNTFS_BootSector
33 Uint8 SystemID[8]; // = "NTFS "
34 Uint16 BytesPerSector;
35 Uint8 SectorsPerCluster;
39 Uint8 MediaDescriptor;
41 Uint16 SectorsPerTrack;
47 Uint64 TotalSectorCount; // Size of volume in sectors
48 Uint64 MFTStart; // Logical Cluster Number of Cluster 0 of MFT
49 Uint64 MFTMirrorStart; // Logical Cluster Number of Cluster 0 of MFT Backup
52 // If either of these are -ve, the size can be obtained via
53 // SizeInBytes = 2^(-1 * Value)
54 Uint32 ClustersPerMFTRecord;
55 Uint32 ClustersPerIndexRecord;
59 Uint8 Padding[512-72];
64 * FILE header, an entry in the MFT
66 typedef struct sNTFS_FILE_Header
68 Uint32 Magic; // 'FILE'
69 Uint16 UpdateSequenceOfs;
70 Uint16 UpdateSequenceSize; // Size in words of the UpdateSequenceArray
72 Uint64 LSN; // $LogFile Sequence Number
74 Uint16 SequenceNumber;
76 Uint16 FirstAttribOfs; // Size of header?
77 Uint16 Flags; // 0: In Use, 1: Directory
79 Uint32 RecordSize; // Real Size of FILE Record
80 Uint32 RecordSpace; // Allocated Size for FILE Record
83 * Base address of the MFT containing this record
85 Uint64 Reference; // "File reference to the base FILE record" ???
93 Uint16 RecordNumber; // Number of this MFT Record
94 Uint16 UpdateSequenceNumber;
95 Uint16 UpdateSequenceArray[];
98 Uint16 UpdateSequenceNumber;
99 Uint16 UpdateSequenceArray[];
106 * File Attribute, follows the FILE header
108 typedef struct sNTFS_FILE_Attrib
110 Uint32 Type; // See eNTFS_FILE_Attribs
111 Uint32 Size; // Includes header
113 Uint8 ResidentFlag; // (What does this mean?)
116 Uint16 Flags; // 0: Compressed, 14: Encrypted, 15: Sparse
122 Uint32 AttribLen; // In words
127 Uint16 Name[]; // UTF-16
134 Uint16 CompressionUnitSize;
136 Uint64 AllocatedSize;
138 Uint64 InitiatedSize; // One assumes, ammount of actual data stored
139 Uint16 Name[]; // UTF-16