00001
00002
00003
00004
00005
00006
00007
00008
00009
00010
00011
00012
00013 #ifndef _NTFS_H
00014 #define _NTFS_H
00015
00016 #ifdef __cplusplus
00017 extern "C" {
00018 #endif
00019
00020
00021 #define NTFS_FS_MAGIC 0xAA55
00022 #define NTFS_DEV_BSIZE 512
00023
00024 #define NTFS_MAXNAMLEN 256
00025 #define NTFS_MAXNAMLEN_UTF8 4 * NTFS_MAXNAMLEN
00026
00027
00028 #define NTFS_ROOTINO NTFS_MFT_ROOT
00029 #define NTFS_FIRSTINO 0
00030 #define NTFS_LAST_DEFAULT_INO 16
00031
00032 #define NTFS_NDADDR 0
00033 #define NTFS_NIADDR 0
00034
00035
00036 #define NTFS_TOKEN_MASK 1
00037 #define NTFS_SYMBOL_TOKEN 0
00038 #define NTFS_TOKEN_LENGTH 8
00039
00040 #define NTFS_MAX_UNCOMPRESSION_BUFFER_SIZE 65536
00041
00042
00043
00044
00045
00046
00047
00048 typedef struct {
00049 uint8_t upd_val[2];
00050 uint8_t upd_seq;
00051 } ntfs_upd;
00052
00053
00054
00055
00056
00057
00058
00059 typedef struct {
00060 uint8_t f1[3];
00061 char oemname[8];
00062 uint8_t ssize[2];
00063 uint8_t csize;
00064 uint8_t f2[26];
00065 uint8_t vol_size_s[8];
00066 uint8_t mft_clust[8];
00067 uint8_t mftm_clust[8];
00068 int8_t mft_rsize_c;
00069 uint8_t f3[3];
00070 int8_t idx_rsize_c;
00071 uint8_t f4[3];
00072 uint8_t serial[8];
00073 uint8_t f5[430];
00074 uint8_t magic[2];
00075 } ntfs_sb;
00076
00077
00078
00079
00080
00081
00082
00083
00084 typedef struct {
00085 uint8_t magic[4];
00086 uint8_t upd_off[2];
00087 uint8_t upd_cnt[2];
00088 uint8_t lsn[8];
00089 uint8_t seq[2];
00090 uint8_t link[2];
00091 uint8_t attr_off[2];
00092 uint8_t flags[2];
00093 uint8_t size[4];
00094 uint8_t alloc_size[4];
00095 uint8_t base_ref[6];
00096 uint8_t base_seq[2];
00097 uint8_t next_attrid[2];
00098 uint8_t f1[2];
00099 uint8_t entry[4];
00100 } ntfs_mft;
00101
00102
00103 #define NTFS_MFT_MAGIC 0x454c4946
00104 #define NTFS_MFT_MAGIC_BAAD 0x44414142
00105 #define NTFS_MFT_MAGIC_ZERO 0x00000000
00106
00107
00108 #define NTFS_MFT_INUSE 0x0001
00109 #define NTFS_MFT_DIR 0x0002
00110
00111
00112 #define NTFS_MFT_BASE 0
00113
00114 #define NTFS_MFT_FILE_REC 0x00ffffffffffffff
00115
00116
00117 #define NTFS_MFT_MFT 0x0
00118 #define NTFS_MFT_MFTMIR 0x1
00119 #define NTFS_MFT_LOG 0x2
00120 #define NTFS_MFT_VOL 0x3
00121 #define NTFS_MFT_ATTR 0x4
00122 #define NTFS_MFT_ROOT 0x5
00123 #define NTFS_MFT_BMAP 0x6
00124 #define NTFS_MFT_BOOT 0x7
00125 #define NTFS_MFT_BAD 0x8
00126
00127 #define NTFS_MFT_SECURE 0x9
00128 #define NTFS_MFT_UPCASE 0xA
00129
00130
00131
00132
00133
00134
00135 typedef struct {
00136 uint8_t type[4];
00137 uint8_t len[4];
00138 uint8_t res;
00139 uint8_t nlen;
00140 uint8_t name_off[2];
00141 uint8_t flags[2];
00142 uint8_t id[2];
00143
00144 union {
00145
00146 struct {
00147 uint8_t ssize[4];
00148 uint8_t soff[2];
00149 uint8_t idxflag[2];
00150 } r;
00151
00152 struct {
00153 uint8_t start_vcn[8];
00154 uint8_t last_vcn[8];
00155 uint8_t run_off[2];
00156 uint8_t compusize[2];
00157 uint8_t f1[4];
00158 uint8_t alen[8];
00159 uint8_t ssize[8];
00160 uint8_t initsize[8];
00161 } nr;
00162 } c;
00163 } ntfs_attr;
00164
00165
00166 #define NTFS_MFT_RES 0
00167 #define NTFS_MFT_NONRES 1
00168
00169
00170
00171
00172 #define NTFS_ATTR_FLAG_COMP 0x0001
00173 #define NTFS_ATTR_FLAG_ENC 0x4000
00174 #define NTFS_ATTR_FLAG_SPAR 0x8000
00175
00176
00177
00178
00179 #define NTFS_ATYPE_SI 0x10 // 16
00180 #define NTFS_ATYPE_ATTRLIST 0x20 // 32
00181 #define NTFS_ATYPE_FNAME 0x30 // 48
00182 #define NTFS_ATYPE_VVER 0x40 // 64 (NT)
00183 #define NTFS_ATYPE_OBJID 0x40 // 64 (2K)
00184 #define NTFS_ATYPE_SEC 0x50 // 80
00185 #define NTFS_ATYPE_VNAME 0x60 // 96
00186 #define NTFS_ATYPE_VINFO 0x70 // 112
00187 #define NTFS_ATYPE_DATA 0x80 // 128
00188 #define NTFS_ATYPE_IDXROOT 0x90 // 144
00189 #define NTFS_ATYPE_IDXALLOC 0xA0 // 160
00190 #define NTFS_ATYPE_BITMAP 0xB0 // 176
00191 #define NTFS_ATYPE_SYMLNK 0xC0 // 192 (NT)
00192 #define NTFS_ATYPE_REPARSE 0xC0 // 192 (2K)
00193 #define NTFS_ATYPE_EAINFO 0xD0 // 208
00194 #define NTFS_ATYPE_EA 0xE0 // 224
00195 #define NTFS_ATYPE_PROP 0xF0 // (NT)
00196 #define NTFS_ATYPE_LOG 0x100 // (2K)
00197
00198
00199
00200
00201
00202
00203
00204 typedef struct {
00205 uint8_t par_ref[6];
00206 uint8_t par_seq[2];
00207 uint8_t crtime[8];
00208 uint8_t mtime[8];
00209 uint8_t ctime[8];
00210 uint8_t atime[8];
00211 uint8_t alloc_fsize[8];
00212 uint8_t real_fsize[8];
00213 uint8_t flags[8];
00214 uint8_t nlen;
00215 uint8_t nspace;
00216 uint8_t name;
00217 } ntfs_attr_fname;
00218
00219
00220 #define NTFS_FNAME_FLAGS_RO 0x0000000000000001
00221 #define NTFS_FNAME_FLAGS_HID 0x0000000000000002
00222 #define NTFS_FNAME_FLAGS_SYS 0x0000000000000004
00223 #define NTFS_FNAME_FLAGS_ARCH 0x0000000000000020
00224 #define NTFS_FNAME_FLAGS_DEV 0x0000000000000040
00225 #define NTFS_FNAME_FLAGS_NORM 0x0000000000000080
00226 #define NTFS_FNAME_FLAGS_TEMP 0x0000000000000100
00227 #define NTFS_FNAME_FLAGS_SPAR 0x0000000000000200
00228 #define NTFS_FNAME_FLAGS_REP 0x0000000000000400
00229 #define NTFS_FNAME_FLAGS_COMP 0x0000000000000800
00230 #define NTFS_FNAME_FLAGS_OFF 0x0000000000001000
00231 #define NTFS_FNAME_FLAGS_NOIDX 0x0000000000002000
00232 #define NTFS_FNAME_FLAGS_ENC 0x0000000000004000
00233 #define NTFS_FNAME_FLAGS_DIR 0x0000000010000000
00234 #define NTFS_FNAME_FLAGS_IDXVIEW 0x0000000020000000
00235
00236
00237
00238 #define NTFS_FNAME_POSIX 0
00239 #define NTFS_FNAME_WIN32 1 // insensitive and restricted
00240 #define NTFS_FNAME_DOS 2 // 8.3 format of 8-bit chars in uppercase
00241 #define NTFS_FNAME_WINDOS 3 // name in WIN32 space that is already DOS
00242
00243
00244
00245
00246
00247
00248
00249 typedef struct {
00250 uint8_t crtime[8];
00251 uint8_t mtime[8];
00252 uint8_t ctime[8];
00253 uint8_t atime[8];
00254 uint8_t dos[4];
00255 uint8_t maxver[4];
00256 uint8_t ver[4];
00257 uint8_t class_id[4];
00258 uint8_t own_id[4];
00259 uint8_t sec_id[4];
00260 uint8_t quota[8];
00261 uint8_t usn[8];
00262 } ntfs_attr_si;
00263
00264
00265
00266 #define NTFS_SI_RO 0x0001
00267 #define NTFS_SI_HID 0x0002
00268 #define NTFS_SI_SYS 0x0004
00269 #define NTFS_SI_ARCH 0x0020
00270 #define NTFS_SI_DEV 0x0040
00271 #define NTFS_SI_NORM 0x0080
00272 #define NTFS_SI_TEMP 0x0100
00273 #define NTFS_SI_SPAR 0x0200
00274 #define NTFS_SI_REP 0x0400
00275 #define NTFS_SI_COMP 0x0800
00276 #define NTFS_SI_OFF 0x1000
00277 #define NTFS_SI_NOIDX 0x2000
00278 #define NTFS_SI_ENC 0x4000
00279
00280
00281
00282
00283
00284
00285 typedef struct {
00286 uint8_t f1[8];
00287 uint8_t maj_ver;
00288 uint8_t min_ver;
00289 uint8_t flags[2];
00290 uint8_t f2[4];
00291 } ntfs_attr_vinfo;
00292
00293 #define NTFS_VINFO_DIRTY 0x0001 // Dirty
00294 #define NTFS_VINFO_RESLOG 0x0002 // Resize LogFile
00295 #define NTFS_VINFO_UPGRAD 0x0004 // Upgrade on Mount
00296 #define NTFS_VINFO_MNTNT4 0x0008 // Mounted on NT4
00297 #define NTFS_VINFO_DELUSN 0x0010 // Delete USN Underway
00298 #define NTFS_VINFO_REPOBJ 0x0020 // Repair Object Ids
00299 #define NTFS_VINFO_MODCHK 0x8000 // Modified by chkdsk
00300
00301
00302
00303
00304
00305
00306
00307 #define NTFS_VINFO_NT 0x21
00308 #define NTFS_VINFO_2K 0x03
00309 #define NTFS_VINFO_XP 0x13
00310
00311
00312
00313
00314
00315
00316
00317 typedef struct {
00318 uint8_t type[4];
00319 uint8_t len[2];
00320 uint8_t nlen;
00321 uint8_t f1;
00322 uint8_t start_vcn[8];
00323 uint8_t file_ref[6];
00324 uint8_t seq[2];
00325 uint8_t id[2];
00326 uint8_t name;
00327 } ntfs_attrlist;
00328
00329 #define NTFS_ATTRL_RES 0
00330
00331
00332
00333
00334
00335
00336
00337
00338
00339
00340
00341 typedef struct {
00342
00343
00344
00345 uint8_t len;
00346 uint8_t buf[32];
00347 } ntfs_runlist;
00348
00349 #define NTFS_RUNL_LENSZ(runl) \
00350 (uint8_t)(runl->len & 0x0f)
00351
00352 #define NTFS_RUNL_OFFSZ(runl) \
00353 (uint8_t)((runl->len & 0xf0) >> 4)
00354
00355
00356
00357
00358
00359
00360
00361
00362
00363
00364
00365
00366
00367
00368 typedef struct {
00369 uint8_t begin_off[4];
00370 uint8_t end_off[4];
00371 uint8_t buf_off[4];
00372 uint8_t flags[4];
00373 } ntfs_idxelist;
00374
00375
00376 #define NTFS_IDXELIST_CHILD 0x1
00377
00378
00379
00380
00381 typedef struct {
00382 uint8_t type[4];
00383 uint8_t collation_rule[4];
00384 uint8_t idxalloc_size_b[4];
00385 uint8_t idx_size_c;
00386 uint8_t pad[3];
00387 ntfs_idxelist list;
00388 } ntfs_idxroot;
00389
00390
00391
00392
00393
00394
00395
00396
00397
00398
00399
00400
00401
00402 typedef struct {
00403 uint8_t magic[4];
00404 uint8_t upd_off[2];
00405 uint8_t upd_cnt[2];
00406 uint8_t lsn[8];
00407 uint8_t idx_vcn[8];
00408 ntfs_idxelist list;
00409 } ntfs_idxrec;
00410
00411
00412 #define NTFS_IDXREC_MAGIC 0x58444e49
00413
00414
00415
00416
00417
00418 typedef struct {
00419 uint8_t file_ref[6];
00420 uint8_t seq_num[2];
00421 uint8_t idxlen[2];
00422 uint8_t strlen[2];
00423 uint8_t flags;
00424 uint8_t f1[3];
00425 uint8_t stream;
00426
00427
00428
00429 } ntfs_idxentry;
00430
00431 #define NTFS_IDX_SUB 0x01
00432 #define NTFS_IDX_LAST 0x02
00433
00434
00435
00436
00437 #define GET_IDXENTRY_SUB(fs, e) \
00438 (tsk_getu64(fs->endian, (int)e + tsk_getu16(fs->endian, e->idxlen) - 8))
00439
00440
00441
00442
00443
00444
00445 typedef struct {
00446 char label[128];
00447 uint8_t type[4];
00448 uint8_t disp[4];
00449 uint8_t coll[4];
00450 uint8_t flags[4];
00451 uint8_t minsize[8];
00452 uint8_t maxsize[8];
00453 } ntfs_attrdef;
00454
00455 #define NTFS_ATTRDEF_FLAGS_IDX 0x02
00456 #define NTFS_ATTRDEF_FLAGS_RES 0x40
00457 #define NTFS_ATTRDEF_FLAGS_NONRES 0x80
00458
00459
00460
00461
00462
00463
00464
00465 typedef struct {
00466 uint8_t objid1[8];
00467 uint8_t objid2[8];
00468 uint8_t orig_volid1[8];
00469 uint8_t orig_volid2[8];
00470 uint8_t orig_objid1[8];
00471 uint8_t orig_objid2[8];
00472 uint8_t orig_domid1[8];
00473 uint8_t orig_domid2[8];
00474 } ntfs_attr_objid;
00475
00476
00477
00478
00479
00480
00481 typedef struct {
00482 uint8_t revision;
00483 uint8_t pad;
00484 uint8_t control[2];
00485
00486
00487 uint8_t owner[4];
00488
00489
00490
00491 uint8_t group[4];
00492
00493
00494
00495 uint8_t sacl[4];
00496
00497
00498
00499
00500 uint8_t dacl[4];
00501
00502
00503
00504
00505 } ntfs_self_relative_security_descriptor;
00506
00507
00508
00509
00510
00511
00512
00513 typedef struct {
00514 char *buffer;
00515 size_t size;
00516 size_t used;
00517 } NTFS_SXX_BUFFER;
00518
00519
00520
00521
00522
00523
00524
00525 typedef struct {
00526 uint8_t revision;
00527 uint8_t sub_auth_count;
00528 uint8_t ident_auth[6];
00529 uint32_t sub_auth[1];
00530 } ntfs_sid;
00531
00532 void ntfs_print_sid(TSK_FS_INFO * fs, FILE * hFile);
00533
00534 char *ntfs_get_sid_as_string(TSK_FS_INFO * fs, uint32_t security_id);
00535
00536
00537
00538 #define NTFS_ACE_SIZE 16
00539
00540
00541
00542
00543
00544
00545
00546 typedef struct NTFS_SID_ENTRY NTFS_SID_ENTRY;
00547
00548 struct NTFS_SID_ENTRY {
00549 NTFS_SID_ENTRY *next;
00550 ntfs_sid *data;
00551 uint32_t sec_id;
00552 char *sid_str;
00553 };
00554
00555
00556
00557
00558
00559
00560
00561 typedef struct {
00562 uint8_t hash_sec_desc[4];
00563 uint8_t sec_id[4];
00564 uint8_t file_off[8];
00565 uint8_t ent_size[4];
00566 ntfs_self_relative_security_descriptor self_rel_sec_desc;
00567 } ntfs_attr_sds;
00568
00569
00570 #define NTFS_SDS_BLOCK_OFFSET 262144
00571
00572 typedef struct NTFS_SDS_ENTRY NTFS_SDS_ENTRY;
00573
00574 struct NTFS_SDS_ENTRY {
00575 NTFS_SDS_ENTRY *next;
00576 uint32_t len;
00577 uint8_t *data;
00578 };
00579
00580
00581
00582
00583
00584
00585
00586
00587 typedef struct {
00588 uint8_t data_off[2];
00589 uint8_t size[2];
00590 uint8_t pad1[4];
00591 uint8_t ent_size[2];
00592 uint8_t key_size[2];
00593 uint8_t flags[2];
00594 uint8_t pad2[2];
00595 uint8_t key_hash_sec_desc[4];
00596 uint8_t key_sec_id[4];
00597 uint8_t data_hash_sec_desc[4];
00598 uint8_t data_sec_id[4];
00599 uint8_t sec_desc_off[8];
00600 uint8_t sec_desc_size[4];
00601 uint8_t pad3[4];
00602 } ntfs_attr_sdh;
00603
00604 typedef struct NTFS_SDH_ENTRY NTFS_SDH_ENTRY;
00605
00606 struct NTFS_SDH_ENTRY {
00607 NTFS_SDH_ENTRY *next;
00608 ntfs_attr_sdh *data;
00609 };
00610
00611
00612
00613
00614
00615
00616
00617 typedef struct {
00618 uint8_t data_off[2];
00619 uint8_t size[2];
00620 uint8_t pad1[4];
00621 uint8_t ent_size[2];
00622 uint8_t key_size[2];
00623 uint8_t flags[2];
00624 uint8_t pad2[2];
00625 uint8_t key_sec_id[4];
00626 uint8_t data_hash_sec_desc[4];
00627 uint8_t data_sec_id[4];
00628 uint8_t sec_desc_off[8];
00629 uint8_t sec_desc_size[4];
00630
00631 } ntfs_attr_sii;
00632
00633 typedef struct NTFS_SII_ENTRY NTFS_SII_ENTRY;
00634
00635 struct NTFS_SII_ENTRY {
00636 NTFS_SII_ENTRY *next;
00637 ntfs_attr_sii *data;
00638 };
00639
00640
00641
00642
00643 typedef struct {
00644 TSK_FS_INFO fs_info;
00645 ntfs_sb *fs;
00646 uint8_t ver;
00647 TSK_FS_INODE *mft_inode;
00648 TSK_FS_DATA *mft_data;
00649 ntfs_mft *mft;
00650 INUM_T mnum;
00651 uint16_t csize_b;
00652 uint16_t ssize_b;
00653 uint16_t mft_rsize_b;
00654 uint16_t idx_rsize_b;
00655 DADDR_T root_mft_addr;
00656
00657 uint8_t loading_the_MFT;
00658
00659 TSK_FS_DATA_RUN *bmap;
00660 TSK_DATA_BUF *bmap_buf;
00661 DADDR_T bmap_buf_off;
00662 ntfs_attrdef *attrdef;
00663 SSIZE_T attrdef_len;
00664
00665 NTFS_SDS_ENTRY *sds;
00666
00667
00668 NTFS_SID_ENTRY *sid;
00669 } NTFS_INFO;
00670
00671 extern uint8_t
00672 ntfs_data_walk(NTFS_INFO *, INUM_T, TSK_FS_DATA *, int,
00673 TSK_FS_FILE_WALK_CB, void *);
00674 extern uint8_t
00675 ntfs_dent_walk(TSK_FS_INFO *, INUM_T, TSK_FS_DENT_FLAG_ENUM,
00676 TSK_FS_DENT_TYPE_WALK_CB, void *);
00677 extern uint32_t nt2unixtime(uint64_t ntdate);
00678 extern uint8_t ntfs_attrname_lookup(TSK_FS_INFO *, uint16_t, char *,
00679 int);
00680
00681 #ifdef __cplusplus
00682 }
00683 #endif
00684 #endif