Data Structures |
| struct | NTFS_VOLUME_INFO |
Functions |
| | DBG_DEFAULT_CHANNEL (FILESYSTEM) |
| static ULONGLONG | NtfsGetAttributeSize (PNTFS_ATTR_RECORD AttrRecord) |
| static PUCHAR | NtfsDecodeRun (PUCHAR DataRun, LONGLONG *DataRunOffset, ULONGLONG *DataRunLength) |
| static PNTFS_ATTR_CONTEXT | NtfsPrepareAttributeContext (PNTFS_ATTR_RECORD AttrRecord) |
| static VOID | NtfsReleaseAttributeContext (PNTFS_ATTR_CONTEXT Context) |
| static BOOLEAN | NtfsDiskRead (PNTFS_VOLUME_INFO Volume, ULONGLONG Offset, ULONGLONG Length, PCHAR Buffer) |
| static ULONG | NtfsReadAttribute (PNTFS_VOLUME_INFO Volume, PNTFS_ATTR_CONTEXT Context, ULONGLONG Offset, PCHAR Buffer, ULONG Length) |
| static PNTFS_ATTR_CONTEXT | NtfsFindAttributeHelper (PNTFS_VOLUME_INFO Volume, PNTFS_ATTR_RECORD AttrRecord, PNTFS_ATTR_RECORD AttrRecordEnd, ULONG Type, const WCHAR *Name, ULONG NameLength) |
| static PNTFS_ATTR_CONTEXT | NtfsFindAttribute (PNTFS_VOLUME_INFO Volume, PNTFS_MFT_RECORD MftRecord, ULONG Type, const WCHAR *Name) |
| static BOOLEAN | NtfsFixupRecord (PNTFS_VOLUME_INFO Volume, PNTFS_RECORD Record) |
| static BOOLEAN | NtfsReadMftRecord (PNTFS_VOLUME_INFO Volume, ULONGLONG MFTIndex, PNTFS_MFT_RECORD Buffer) |
| static BOOLEAN | NtfsCompareFileName (PCHAR FileName, PNTFS_INDEX_ENTRY IndexEntry) |
| static BOOLEAN | NtfsFindMftRecord (PNTFS_VOLUME_INFO Volume, ULONGLONG MFTIndex, PCHAR FileName, ULONGLONG *OutMFTIndex) |
| static BOOLEAN | NtfsLookupFile (PNTFS_VOLUME_INFO Volume, PCSTR FileName, PNTFS_MFT_RECORD MftRecord, PNTFS_ATTR_CONTEXT *DataContext) |
| LONG | NtfsClose (ULONG FileId) |
| LONG | NtfsGetFileInformation (ULONG FileId, FILEINFORMATION *Information) |
| LONG | NtfsOpen (CHAR *Path, OPENMODE OpenMode, ULONG *FileId) |
| LONG | NtfsRead (ULONG FileId, VOID *Buffer, ULONG N, ULONG *Count) |
| LONG | NtfsSeek (ULONG FileId, LARGE_INTEGER *Position, SEEKMODE SeekMode) |
| const DEVVTBL * | NtfsMount (ULONG DeviceId) |
Variables |
| PNTFS_VOLUME_INFO | NtfsVolumes [MAX_FDS] |
| const DEVVTBL | NtfsFuncTable |