// NTFS disk structure definitions // // Author: J. van Wijk // // JvW 22-03-98 Initial version, derived from DFSHPFS, MFTFILE definitions // #ifndef DFSNTFS_H #define DFSNTFS_H #define MA_END_LIST 0xffffffff #define MA_STANDARD 0x10 #define MA_ATTRLIST 0x20 #define MA_FILENAME 0x30 #define MA_VERSION 0x40 #define MA_SECURITY 0x50 #define MA_VOLNAME 0x60 #define MA_VOLINFO 0x70 #define MA_DATA 0x80 #define MA_IDXROOT 0x90 #define MA_DIRINDX 0xa0 #define MA_BITMAP 0xb0 #define MA_SYMLINK 0xc0 #define MA_EAINFO 0xd0 #define MA_EADATA 0xe0 #define AF_NONRES 0x01 // holds non-resident attribs #define AF_DIRECT 0x02 // directory file-record #define FN_POSIX 0x00 // Posix style filename #define FN_UNICO 0x01 // Unicode style filename #define FN_DOS83 0x02 // DOS 8.3 style filename #define FN_UNDOS 0x03 // DOS & Unicode filename #define FA_COMPR 0x800 // FAT-attribute compression #define MFT_MFT 0x00 // MFT number MFT itself #define MFT_ROOT 0x05 // MFT number root directory typedef struct ntime // NT time value (64 bits) { ULONG lo; // low 32 bits ULONG hi; // high 32 bits } NTIME; // end of struct "ntime" #define SG_MFTFILE 4 #define SV_MFTFILE (char)0x46,(char)0x49,(char)0x4c,(char)0x45 typedef struct s_mftfile // MFT File table entry { char Signature[SG_MFTFILE]; // Signature "FILE" USHORT FixupOffset; // offset to fixup pattern USHORT FixupSize; // Size of fixup-list +1 ULONG ulFil2; ULONG ulFil3; USHORT Sequence; // sequence nr in MFT USHORT HardLinks; // Hard-link count USHORT AttribOffset; // Offset to seq of Attributes USHORT Flags; // 0x01 = NonRes; 0x02 = Dir ULONG RecLength; // Real size of the record ULONG AllLength; // Allocated size of the record LCN BaseMftRec; // ptr to base MFT rec or 0 USHORT MinIdentificator; // Minimum Identificator +1 USHORT FixupPattern; // Current fixup pattern USHORT FixupList[1]; // Variable-size fixup-list // followed by resident and // part of non-res attributes } S_MFTFILE; // end of struct "s_mftfile" typedef struct s_resident { USHORT Size; // Size of resident attribute USHORT usFil1; USHORT Offset; // offset specific value part USHORT IndexFlag; } S_RESIDENT; // end of struct "s_resident" typedef struct s_nonres { LCN SegFirst; // first LCN in this segment LCN SegLast; // last LCN in this segment USHORT Offset; // Offset to the run-list USHORT ComprEngine; // Id of compression engine USHORT usFil2; USHORT usFil3; XLONG Allocated; // Allocated disk space XLONG Size; // Size of uncompressed attrib XLONG Compressed; // Compressed size of attribute } S_NONRES; // end of struct "s_nonres" typedef struct s_mftattr // MFT attribute header part { ULONG Type; // type of attribute USHORT Length; // length of this attribute USHORT usFil2; // (used on some dir bitmaps) BYTE Recidency; // 0 = resident, 1 in Runs BYTE NameLen; // Length of name (if used) USHORT Offset; // to name or resident data BYTE Compressed; // 1 = compressed BYTE bFil1; USHORT Identificator; union { S_RESIDENT Resident; // Resident attribute S_NONRES NonResid; // Non-resident attribute }; // end of union USHORT Fixup[1]; // variable-size } S_MFTATTR; // end of struct "s_mftattr" typedef struct s_direntry { XLONG Mftnr; // MFT record number USHORT Length; // entry size USHORT fil1; BYTE Flags; // 1 = subnode; 2 = last BYTE fil2[3]; XLONG Parent; // Parent MFT record number NTIME Create; // Creation time NTIME Modify; // Last Modify time NTIME Modfil; // Last modify of record NTIME Access; // Last Access time XLONG Alloc; // Allocated size XLONG Size; // Data real size XLONG fil3; BYTE NameLen; // Name length in words BYTE NameType; // Type of filename USHORT Filename[1]; // Variable length filename } S_DIRENTRY; // end of struct "s_direntry" typedef struct a_standard { NTIME Create; // Creation time NTIME Modify; // Last Modify time NTIME Modfil; // Last modify of record NTIME Access; // Last Access time ULONG FatAttributes; // As FAT + 0x800 = compressed ULONG ulReserved1; // unknown } A_STANDARD; // end of struct "a_standard" typedef struct a_attrlist { ULONG Type; USHORT RecLength; BYTE NameLength; BYTE bFil1; LCN StartVcn; LCN MainMftRecord; // MFT rec containing header USHORT Identificator; USHORT Name[1]; // name in Unicode } A_ATTRLIST; // end of struct "a_attrlist" typedef struct a_filename { ULONG MftParentDir; // Seq-nr parent-dir MFT entry USHORT usFil1; // Unknown, part of seq-nr ? USHORT MftParentSeq; // Seq-nr parent-dir MFT entry NTIME Create; // Creation time NTIME Modify; // Last Modify time NTIME Modfil; // Last modify of record NTIME Access; // Last Access time XLONG Allocated; // Allocated disk space XLONG RealSize; // Size of the attribute XLONG Flags; BYTE FileNameLength; BYTE FileNameType; // 8.3 / Unicode USHORT Filename[1]; // Name (in Unicode ?) } A_FILENAME; // end of struct "a_filename" typedef struct a_version { BYTE contents; } A_VERSION; // end of struct "a_version" typedef struct a_security { BYTE contents; } A_SECURITY; // end of struct "a_security" typedef struct a_volname { USHORT VolumeName[1]; // Volume name in Unicode } A_VOLNAME; // end of struct "a_volname" typedef struct a_volinfo { XLONG bFil1[9]; // unknown BYTE ChkDskRequired; // Checkdisk flag } A_VOLINFO; // end of struct "a_volinfo" typedef struct a_data // main data attribute { BYTE contents; } A_DATA; // end of struct "a_data" typedef struct a_idxroot { ULONG I30; // allways 0x30 ??? ULONG ulOne; // allways 0x01 ??? ULONG Size; ULONG Clusters; // clusters per index ??? ULONG I10; // allways 0x10 ??? ULONG EntrySize1; // size of entry + 0x10 ??? ULONG EntrySize2; // size of entry + 0x10 ??? USHORT usOne; // allways 0x01 USHORT Flags; // ??? S_DIRENTRY EntryList[1]; // list of directory entries } A_IDXROOT; // end of struct "a_idxroot" #define SG_DIRINDX 4 #define SV_DIRINDX (char)0x49,(char)0x4e,(char)0x44,(char)0x58 typedef struct s_dirindx { BYTE Signature[SG_DIRINDX]; // 'INDX' USHORT FixupOffset; // usualy 0x28 USHORT FixupSize; // number of fixups +1 XLONG Unknown; // to be refined LCN BufferVcn; USHORT HeaderSize; ULONG InUseLength; ULONG TotalLength; USHORT Fixup[0xc]; // Size varies! (maybe :-) S_DIRENTRY EntryList[1]; // list of directory entries } S_DIRINDX; // end of struct "s_dirindx" typedef struct a_bitmap { BYTE contents; } A_BITMAP; // end of struct "a_bitmap" typedef struct a_symlink { BYTE contents; } A_SYMLINK; // end of struct "a_symlink" typedef struct a_eainfo { BYTE contents; } A_EAINFO; // end of struct "a_eainfo" typedef struct a_eadata { BYTE contents; } A_EADATA; // end of struct "a_eainfo" typedef union u_mftattr // Attr specific value parts { A_STANDARD Stand; A_ATTRLIST Alist; A_FILENAME Fname; A_VERSION Vvers; A_SECURITY Secur; A_VOLNAME Vname; A_VOLINFO Vinfo; A_DATA Data; A_IDXROOT Index; S_DIRINDX Idxal; A_BITMAP Bitmp; A_SYMLINK Slink; A_EAINFO Eainfo; A_EADATA Eadata; } U_MFTATTR; // end of union "u_mftattr" #endif