ntfs.h File Reference

#include <pshpack1.h>
#include <poppack.h>

Include dependency graph for ntfs.h:

This graph shows which files directly or indirectly include this file:

Go to the source code of this file.

Classes
struct	NTFS_BOOTSECTOR
struct	NTFS_RECORD
struct	NTFS_MFT_RECORD
struct	NTFS_ATTR_RECORD
struct	NTFS_INDEX_HEADER
struct	NTFS_INDEX_ROOT
struct	NTFS_FILE_NAME_ATTR
struct	NTFS_ATTR_LIST_ATTR
struct	NTFS_INDEX_ENTRY
struct	NTFS_ATTR_CONTEXT
struct	_NTFS_FILE_HANDLE

Macros
#define	NTFS_FILE_MFT   0
#define	NTFS_FILE_MFTMIRR   1
#define	NTFS_FILE_LOGFILE   2
#define	NTFS_FILE_VOLUME   3
#define	NTFS_FILE_ATTRDEF   4
#define	NTFS_FILE_ROOT   5
#define	NTFS_FILE_BITMAP   6
#define	NTFS_FILE_BOOT   7
#define	NTFS_FILE_BADCLUS   8
#define	NTFS_FILE_QUOTA   9
#define	NTFS_FILE_UPCASE   10
#define	NTFS_FILE_EXTEND   11
#define	NTFS_ATTR_TYPE_STANDARD_INFORMATION   0x10
#define	NTFS_ATTR_TYPE_ATTRIBUTE_LIST   0x20
#define	NTFS_ATTR_TYPE_FILENAME   0x30
#define	NTFS_ATTR_TYPE_OBJECT_ID   0x40
#define	NTFS_ATTR_TYPE_SECURITY_DESCRIPTOR   0x50
#define	NTFS_ATTR_TYPE_VOLUME_NAME   0x60
#define	NTFS_ATTR_TYPE_VOLUME_INFORMATION   0x70
#define	NTFS_ATTR_TYPE_DATA   0x80
#define	NTFS_ATTR_TYPE_INDEX_ROOT   0x90
#define	NTFS_ATTR_TYPE_INDEX_ALLOCATION   0xa0
#define	NTFS_ATTR_TYPE_BITMAP   0xb0
#define	NTFS_ATTR_TYPE_REPARSE_POINT   0xc0
#define	NTFS_ATTR_TYPE_EA_INFORMATION   0xd0
#define	NTFS_ATTR_TYPE_EA   0xe0
#define	NTFS_ATTR_TYPE_END   0xffffffff
#define	NTFS_ATTR_NORMAL   0
#define	NTFS_ATTR_COMPRESSED   1
#define	NTFS_ATTR_RESIDENT   2
#define	NTFS_ATTR_ENCRYPTED   0x4000
#define	NTFS_SMALL_INDEX   0
#define	NTFS_LARGE_INDEX   1
#define	NTFS_INDEX_ENTRY_NODE   1
#define	NTFS_INDEX_ENTRY_END   2
#define	NTFS_FILE_NAME_POSIX   0
#define	NTFS_FILE_NAME_WIN32   1
#define	NTFS_FILE_NAME_DOS   2
#define	NTFS_FILE_NAME_WIN32_AND_DOS   3
#define	NTFS_FILE_ATTR_NORMAL   0x00
#define	NTFS_FILE_ATTR_READONLY   0x01
#define	NTFS_FILE_ATTR_HIDDEN   0x02
#define	NTFS_FILE_ATTR_SYSTEM   0x04
#define	NTFS_FILE_ATTR_ARCHIVE   0x20
#define	NTFS_FILE_ATTR_DIRECTORY   0x10000000
#define	NTFS_MFT_MASK   0x0000FFFFFFFFFFFFULL

Typedefs
typedef struct NTFS_BOOTSECTOR *	PNTFS_BOOTSECTOR
typedef struct NTFS_RECORD *	PNTFS_RECORD
typedef struct NTFS_MFT_RECORD *	PNTFS_MFT_RECORD
typedef struct NTFS_ATTR_RECORD *	PNTFS_ATTR_RECORD
typedef struct NTFS_INDEX_HEADER *	PNTFS_INDEX_HEADER
typedef struct NTFS_INDEX_ROOT *	PNTFS_INDEX_ROOT
typedef struct NTFS_FILE_NAME_ATTR *	PNTFS_FILE_NAME_ATTR
typedef struct NTFS_ATTR_LIST_ATTR *	PNTFS_ATTR_LIST_ATTR
typedef struct NTFS_INDEX_ENTRY *	PNTFS_INDEX_ENTRY
typedef struct NTFS_ATTR_CONTEXT *	PNTFS_ATTR_CONTEXT
typedef struct _NTFS_VOLUME_INFO *	PNTFS_VOLUME_INFO
typedef struct _NTFS_FILE_HANDLE	NTFS_FILE_HANDLE
typedef struct _NTFS_FILE_HANDLE *	PNTFS_FILE_HANDLE

Functions
ULONGLONG	NtfsGetVolumeSize (_In_ ULONG DeviceId)
	Returns the size of the NTFS volume laid on the storage media device opened via DeviceId.
const DEVVTBL *	NtfsMount (ULONG DeviceId)

Macro Definition Documentation

NTFS_ATTR_COMPRESSED

#define NTFS_ATTR_COMPRESSED   1

Definition at line 53 of file ntfs.h.

NTFS_ATTR_ENCRYPTED

#define NTFS_ATTR_ENCRYPTED   0x4000

Definition at line 55 of file ntfs.h.

NTFS_ATTR_NORMAL

#define NTFS_ATTR_NORMAL   0

Definition at line 52 of file ntfs.h.

NTFS_ATTR_RESIDENT

#define NTFS_ATTR_RESIDENT   2

Definition at line 54 of file ntfs.h.

NTFS_ATTR_TYPE_ATTRIBUTE_LIST

#define NTFS_ATTR_TYPE_ATTRIBUTE_LIST   0x20

Definition at line 37 of file ntfs.h.

NTFS_ATTR_TYPE_BITMAP

#define NTFS_ATTR_TYPE_BITMAP   0xb0

Definition at line 46 of file ntfs.h.

NTFS_ATTR_TYPE_DATA

#define NTFS_ATTR_TYPE_DATA   0x80

Definition at line 43 of file ntfs.h.

NTFS_ATTR_TYPE_EA

#define NTFS_ATTR_TYPE_EA   0xe0

Definition at line 49 of file ntfs.h.

NTFS_ATTR_TYPE_EA_INFORMATION

#define NTFS_ATTR_TYPE_EA_INFORMATION   0xd0

Definition at line 48 of file ntfs.h.

NTFS_ATTR_TYPE_END

#define NTFS_ATTR_TYPE_END   0xffffffff

Definition at line 50 of file ntfs.h.

NTFS_ATTR_TYPE_FILENAME

#define NTFS_ATTR_TYPE_FILENAME   0x30

Definition at line 38 of file ntfs.h.

NTFS_ATTR_TYPE_INDEX_ALLOCATION

#define NTFS_ATTR_TYPE_INDEX_ALLOCATION   0xa0

Definition at line 45 of file ntfs.h.

NTFS_ATTR_TYPE_INDEX_ROOT

#define NTFS_ATTR_TYPE_INDEX_ROOT   0x90

Definition at line 44 of file ntfs.h.

NTFS_ATTR_TYPE_OBJECT_ID

#define NTFS_ATTR_TYPE_OBJECT_ID   0x40

Definition at line 39 of file ntfs.h.

NTFS_ATTR_TYPE_REPARSE_POINT

#define NTFS_ATTR_TYPE_REPARSE_POINT   0xc0

Definition at line 47 of file ntfs.h.

NTFS_ATTR_TYPE_SECURITY_DESCRIPTOR

#define NTFS_ATTR_TYPE_SECURITY_DESCRIPTOR   0x50

Definition at line 40 of file ntfs.h.

NTFS_ATTR_TYPE_STANDARD_INFORMATION

#define NTFS_ATTR_TYPE_STANDARD_INFORMATION   0x10

Definition at line 36 of file ntfs.h.

NTFS_ATTR_TYPE_VOLUME_INFORMATION

#define NTFS_ATTR_TYPE_VOLUME_INFORMATION   0x70

Definition at line 42 of file ntfs.h.

NTFS_ATTR_TYPE_VOLUME_NAME

#define NTFS_ATTR_TYPE_VOLUME_NAME   0x60

Definition at line 41 of file ntfs.h.

NTFS_FILE_ATTR_ARCHIVE

#define NTFS_FILE_ATTR_ARCHIVE   0x20

Definition at line 73 of file ntfs.h.

NTFS_FILE_ATTR_DIRECTORY

#define NTFS_FILE_ATTR_DIRECTORY   0x10000000

Definition at line 74 of file ntfs.h.

NTFS_FILE_ATTR_HIDDEN

#define NTFS_FILE_ATTR_HIDDEN   0x02

Definition at line 70 of file ntfs.h.

NTFS_FILE_ATTR_NORMAL

#define NTFS_FILE_ATTR_NORMAL   0x00

Definition at line 68 of file ntfs.h.

NTFS_FILE_ATTR_READONLY

#define NTFS_FILE_ATTR_READONLY   0x01

Definition at line 69 of file ntfs.h.

NTFS_FILE_ATTR_SYSTEM

#define NTFS_FILE_ATTR_SYSTEM   0x04

Definition at line 71 of file ntfs.h.

NTFS_FILE_ATTRDEF

#define NTFS_FILE_ATTRDEF   4

Definition at line 27 of file ntfs.h.

NTFS_FILE_BADCLUS

#define NTFS_FILE_BADCLUS   8

Definition at line 31 of file ntfs.h.

NTFS_FILE_BITMAP

#define NTFS_FILE_BITMAP   6

Definition at line 29 of file ntfs.h.

NTFS_FILE_BOOT

#define NTFS_FILE_BOOT   7

Definition at line 30 of file ntfs.h.

NTFS_FILE_EXTEND

#define NTFS_FILE_EXTEND   11

Definition at line 34 of file ntfs.h.

NTFS_FILE_LOGFILE

#define NTFS_FILE_LOGFILE   2

Definition at line 25 of file ntfs.h.

NTFS_FILE_MFT

#define NTFS_FILE_MFT   0

Definition at line 23 of file ntfs.h.

NTFS_FILE_MFTMIRR

#define NTFS_FILE_MFTMIRR   1

Definition at line 24 of file ntfs.h.

NTFS_FILE_NAME_DOS

#define NTFS_FILE_NAME_DOS   2

Definition at line 65 of file ntfs.h.

NTFS_FILE_NAME_POSIX

#define NTFS_FILE_NAME_POSIX   0

Definition at line 63 of file ntfs.h.

NTFS_FILE_NAME_WIN32

#define NTFS_FILE_NAME_WIN32   1

Definition at line 64 of file ntfs.h.

NTFS_FILE_NAME_WIN32_AND_DOS

#define NTFS_FILE_NAME_WIN32_AND_DOS   3

Definition at line 66 of file ntfs.h.

NTFS_FILE_QUOTA

#define NTFS_FILE_QUOTA   9

Definition at line 32 of file ntfs.h.

NTFS_FILE_ROOT

#define NTFS_FILE_ROOT   5

Definition at line 28 of file ntfs.h.

NTFS_FILE_UPCASE

#define NTFS_FILE_UPCASE   10

Definition at line 33 of file ntfs.h.

NTFS_FILE_VOLUME

#define NTFS_FILE_VOLUME   3

Definition at line 26 of file ntfs.h.

NTFS_INDEX_ENTRY_END

#define NTFS_INDEX_ENTRY_END   2

Definition at line 61 of file ntfs.h.

NTFS_INDEX_ENTRY_NODE

#define NTFS_INDEX_ENTRY_NODE   1

Definition at line 60 of file ntfs.h.

NTFS_LARGE_INDEX

#define NTFS_LARGE_INDEX   1

Definition at line 58 of file ntfs.h.

NTFS_MFT_MASK

#define NTFS_MFT_MASK   0x0000FFFFFFFFFFFFULL

Definition at line 76 of file ntfs.h.

NTFS_SMALL_INDEX

#define NTFS_SMALL_INDEX   0

Definition at line 57 of file ntfs.h.

Typedef Documentation

NTFS_FILE_HANDLE

typedef struct _NTFS_FILE_HANDLE NTFS_FILE_HANDLE

PNTFS_ATTR_CONTEXT

typedef struct NTFS_ATTR_CONTEXT * PNTFS_ATTR_CONTEXT

PNTFS_ATTR_LIST_ATTR

typedef struct NTFS_ATTR_LIST_ATTR * PNTFS_ATTR_LIST_ATTR

PNTFS_ATTR_RECORD

typedef struct NTFS_ATTR_RECORD * PNTFS_ATTR_RECORD

PNTFS_BOOTSECTOR

typedef struct NTFS_BOOTSECTOR * PNTFS_BOOTSECTOR

PNTFS_FILE_HANDLE

typedef struct _NTFS_FILE_HANDLE * PNTFS_FILE_HANDLE

PNTFS_FILE_NAME_ATTR

typedef struct NTFS_FILE_NAME_ATTR * PNTFS_FILE_NAME_ATTR

PNTFS_INDEX_ENTRY

typedef struct NTFS_INDEX_ENTRY * PNTFS_INDEX_ENTRY

PNTFS_INDEX_HEADER

typedef struct NTFS_INDEX_HEADER * PNTFS_INDEX_HEADER

PNTFS_INDEX_ROOT

typedef struct NTFS_INDEX_ROOT * PNTFS_INDEX_ROOT

PNTFS_MFT_RECORD

typedef struct NTFS_MFT_RECORD * PNTFS_MFT_RECORD

PNTFS_RECORD

typedef struct NTFS_RECORD * PNTFS_RECORD

PNTFS_VOLUME_INFO

typedef struct _NTFS_VOLUME_INFO* PNTFS_VOLUME_INFO

Definition at line 249 of file ntfs.h.

Function Documentation

NtfsGetVolumeSize()

ULONGLONG NtfsGetVolumeSize

(

_In_ ULONG

DeviceId

)

Returns the size of the NTFS volume laid on the storage media device opened via DeviceId.

Definition at line 919 of file ntfs.c.

{
    PNTFS_VOLUME_INFO Volume = NtfsVolumes[DeviceId];
    ASSERT(Volume);
    return Volume->BootSector.VolumeSectorCount * Volume->BootSector.BytesPerSector;
}

Referenced by FsGetVolumeSize().

NtfsMount()

const DEVVTBL * NtfsMount

(

ULONG

DeviceId

)

Definition at line 938 of file ntfs.c.

{
    PNTFS_VOLUME_INFO Volume;
    LARGE_INTEGER Position;
    ULONG Count;
    ARC_STATUS Status;
 
    TRACE("Enter NtfsMount(%lu)\n", DeviceId);
 
    //
    // Allocate data for volume information
    //
    Volume = FrLdrTempAlloc(sizeof(NTFS_VOLUME_INFO), TAG_NTFS_VOLUME);
    if (!Volume)
        return NULL;
    RtlZeroMemory(Volume, sizeof(NTFS_VOLUME_INFO));
 
    //
    // Read the BootSector
    //
    Position.QuadPart = 0;
    Status = ArcSeek(DeviceId, &Position, SeekAbsolute);
    if (Status != ESUCCESS)
    {
        FrLdrTempFree(Volume, TAG_NTFS_VOLUME);
        return NULL;
    }
    Status = ArcRead(DeviceId, &Volume->BootSector, sizeof(Volume->BootSector), &Count);
    if (Status != ESUCCESS || Count != sizeof(Volume->BootSector))
    {
        FrLdrTempFree(Volume, TAG_NTFS_VOLUME);
        return NULL;
    }
 
    //
    // Check if BootSector is valid. If no, return early
    //
    if (!RtlEqualMemory(Volume->BootSector.SystemId, "NTFS", 4))
    {
        FrLdrTempFree(Volume, TAG_NTFS_VOLUME);
        return NULL;
    }
 
    //
    // Calculate cluster size and MFT record size
    //
    Volume->ClusterSize = Volume->BootSector.SectorsPerCluster * Volume->BootSector.BytesPerSector;
    if (Volume->BootSector.ClustersPerMftRecord > 0)
        Volume->MftRecordSize = Volume->BootSector.ClustersPerMftRecord * Volume->ClusterSize;
    else
        Volume->MftRecordSize = 1 << (-Volume->BootSector.ClustersPerMftRecord);
    if (Volume->BootSector.ClustersPerIndexRecord > 0)
        Volume->IndexRecordSize = Volume->BootSector.ClustersPerIndexRecord * Volume->ClusterSize;
    else
        Volume->IndexRecordSize = 1 << (-Volume->BootSector.ClustersPerIndexRecord);
 
    TRACE("ClusterSize: 0x%x\n", Volume->ClusterSize);
    TRACE("ClustersPerMftRecord: %d\n", Volume->BootSector.ClustersPerMftRecord);
    TRACE("ClustersPerIndexRecord: %d\n", Volume->BootSector.ClustersPerIndexRecord);
    TRACE("MftRecordSize: 0x%x\n", Volume->MftRecordSize);
    TRACE("IndexRecordSize: 0x%x\n", Volume->IndexRecordSize);
 
    //
    // Read MFT index
    //
    TRACE("Reading MFT index...\n");
    Volume->MasterFileTable = FrLdrTempAlloc(Volume->MftRecordSize, TAG_NTFS_MFT);
    if (!Volume->MasterFileTable)
    {
        FrLdrTempFree(Volume, TAG_NTFS_VOLUME);
        return NULL;
    }
    Position.QuadPart = Volume->BootSector.MftLocation * Volume->ClusterSize;
    Status = ArcSeek(DeviceId, &Position, SeekAbsolute);
    if (Status != ESUCCESS)
    {
        FileSystemError("Failed to seek to Master File Table record.");
        FrLdrTempFree(Volume->MasterFileTable, TAG_NTFS_MFT);
        FrLdrTempFree(Volume, TAG_NTFS_VOLUME);
        return NULL;
    }
    Status = ArcRead(DeviceId, Volume->MasterFileTable, Volume->MftRecordSize, &Count);
    if (Status != ESUCCESS || Count != Volume->MftRecordSize)
    {
        FileSystemError("Failed to read the Master File Table record.");
        FrLdrTempFree(Volume->MasterFileTable, TAG_NTFS_MFT);
        FrLdrTempFree(Volume, TAG_NTFS_VOLUME);
        return NULL;
    }
 
    //
    // Keep room to read partial sectors
    //
    Volume->TemporarySector = FrLdrTempAlloc(Volume->BootSector.BytesPerSector, TAG_NTFS_DATA);
    if (!Volume->TemporarySector)
    {
        FileSystemError("Failed to allocate memory.");
        FrLdrTempFree(Volume->MasterFileTable, TAG_NTFS_MFT);
        FrLdrTempFree(Volume, TAG_NTFS_VOLUME);
        return NULL;
    }
 
    //
    // Keep device id
    //
    Volume->DeviceId = DeviceId;
 
    //
    // Search DATA attribute
    //
    TRACE("Searching for DATA attribute...\n");
    Volume->MFTContext = NtfsFindAttribute(Volume, Volume->MasterFileTable, NTFS_ATTR_TYPE_DATA, L"");
    if (!Volume->MFTContext)
    {
        FileSystemError("Can't find data attribute for Master File Table.");
        FrLdrTempFree(Volume->MasterFileTable, TAG_NTFS_MFT);
        FrLdrTempFree(Volume, TAG_NTFS_VOLUME);
        return NULL;
    }
 
    //
    // Remember NTFS volume information
    //
    NtfsVolumes[DeviceId] = Volume;
 
    //
    // Return success
    //
    TRACE("NtfsMount(%lu) success\n", DeviceId);
    return &NtfsFuncTable;
}