ntfs.h File Reference


Detailed Description

Contains the structures and function APIs for NTFS file system support.

Go to the source code of this file.

Data Structures

struct  ntfs_upd
struct  ntfs_sb
struct  ntfs_mft
struct  ntfs_attr
struct  ntfs_attr_fname
struct  ntfs_attr_si
struct  ntfs_attr_vinfo
struct  ntfs_attrlist
struct  ntfs_runlist
struct  ntfs_idxelist
struct  ntfs_idxroot
struct  ntfs_idxrec
struct  ntfs_idxentry
struct  ntfs_attrdef
struct  ntfs_attr_objid
struct  NTFS_INFO

Defines

#define TSK_USE_SID   0
#define NTFS_FS_MAGIC   0xAA55
#define NTFS_DEV_BSIZE   512
#define NTFS_MAXNAMLEN   256
#define NTFS_MAXNAMLEN_UTF8   4 * NTFS_MAXNAMLEN
#define NTFS_ROOTINO   NTFS_MFT_ROOT
#define NTFS_FIRSTINO   0
#define NTFS_LAST_DEFAULT_INO   16
#define NTFS_NDADDR   0
#define NTFS_NIADDR   0
#define NTFS_TOKEN_MASK   1
#define NTFS_SYMBOL_TOKEN   0
#define NTFS_TOKEN_LENGTH   8
#define NTFS_MAX_UNCOMPRESSION_BUFFER_SIZE   65536
#define NTFS_MFT_MAGIC   0x454c4946
#define NTFS_MFT_MAGIC_BAAD   0x44414142
#define NTFS_MFT_MAGIC_ZERO   0x00000000
#define NTFS_MFT_INUSE   0x0001
#define NTFS_MFT_DIR   0x0002
#define NTFS_MFT_BASE   0
#define NTFS_MFT_FILE_REC   0x00ffffffffffffff
#define NTFS_MFT_MFT   0x0
#define NTFS_MFT_MFTMIR   0x1
#define NTFS_MFT_LOG   0x2
#define NTFS_MFT_VOL   0x3
#define NTFS_MFT_ATTR   0x4
#define NTFS_MFT_ROOT   0x5
#define NTFS_MFT_BMAP   0x6
#define NTFS_MFT_BOOT   0x7
#define NTFS_MFT_BAD   0x8
#define NTFS_MFT_SECURE   0x9
#define NTFS_MFT_UPCASE   0xA
#define NTFS_MFT_RES   0
#define NTFS_MFT_NONRES   1
#define NTFS_ATTR_FLAG_COMP   0x0001
#define NTFS_ATTR_FLAG_ENC   0x4000
#define NTFS_ATTR_FLAG_SPAR   0x8000
#define NTFS_ATYPE_SI   0x10
#define NTFS_ATYPE_ATTRLIST   0x20
#define NTFS_ATYPE_FNAME   0x30
#define NTFS_ATYPE_VVER   0x40
#define NTFS_ATYPE_OBJID   0x40
#define NTFS_ATYPE_SEC   0x50
#define NTFS_ATYPE_VNAME   0x60
#define NTFS_ATYPE_VINFO   0x70
#define NTFS_ATYPE_DATA   0x80
#define NTFS_ATYPE_IDXROOT   0x90
#define NTFS_ATYPE_IDXALLOC   0xA0
#define NTFS_ATYPE_BITMAP   0xB0
#define NTFS_ATYPE_SYMLNK   0xC0
#define NTFS_ATYPE_REPARSE   0xC0
#define NTFS_ATYPE_EAINFO   0xD0
#define NTFS_ATYPE_EA   0xE0
#define NTFS_ATYPE_PROP   0xF0
#define NTFS_ATYPE_LOG   0x100
#define NTFS_FNAME_FLAGS_RO   0x0000000000000001
#define NTFS_FNAME_FLAGS_HID   0x0000000000000002
#define NTFS_FNAME_FLAGS_SYS   0x0000000000000004
#define NTFS_FNAME_FLAGS_ARCH   0x0000000000000020
#define NTFS_FNAME_FLAGS_DEV   0x0000000000000040
#define NTFS_FNAME_FLAGS_NORM   0x0000000000000080
#define NTFS_FNAME_FLAGS_TEMP   0x0000000000000100
#define NTFS_FNAME_FLAGS_SPAR   0x0000000000000200
#define NTFS_FNAME_FLAGS_REP   0x0000000000000400
#define NTFS_FNAME_FLAGS_COMP   0x0000000000000800
#define NTFS_FNAME_FLAGS_OFF   0x0000000000001000
#define NTFS_FNAME_FLAGS_NOIDX   0x0000000000002000
#define NTFS_FNAME_FLAGS_ENC   0x0000000000004000
#define NTFS_FNAME_FLAGS_DIR   0x0000000010000000
#define NTFS_FNAME_FLAGS_IDXVIEW   0x0000000020000000
#define NTFS_FNAME_POSIX   0
#define NTFS_FNAME_WIN32   1
#define NTFS_FNAME_DOS   2
#define NTFS_FNAME_WINDOS   3
#define NTFS_SI_RO   0x0001
#define NTFS_SI_HID   0x0002
#define NTFS_SI_SYS   0x0004
#define NTFS_SI_ARCH   0x0020
#define NTFS_SI_DEV   0x0040
#define NTFS_SI_NORM   0x0080
#define NTFS_SI_TEMP   0x0100
#define NTFS_SI_SPAR   0x0200
#define NTFS_SI_REP   0x0400
#define NTFS_SI_COMP   0x0800
#define NTFS_SI_OFF   0x1000
#define NTFS_SI_NOIDX   0x2000
#define NTFS_SI_ENC   0x4000
#define NTFS_VINFO_DIRTY   0x0001
#define NTFS_VINFO_RESLOG   0x0002
#define NTFS_VINFO_UPGRAD   0x0004
#define NTFS_VINFO_MNTNT4   0x0008
#define NTFS_VINFO_DELUSN   0x0010
#define NTFS_VINFO_REPOBJ   0x0020
#define NTFS_VINFO_MODCHK   0x8000
#define NTFS_VINFO_NT   0x21
#define NTFS_VINFO_2K   0x03
#define NTFS_VINFO_XP   0x13
#define NTFS_ATTRL_RES   0
#define NTFS_RUNL_LENSZ(runl)   (uint8_t)(runl->len & 0x0f)
#define NTFS_RUNL_OFFSZ(runl)   (uint8_t)((runl->len & 0xf0) >> 4)
#define NTFS_IDXELIST_CHILD   0x1
#define NTFS_IDXREC_MAGIC   0x58444e49
#define NTFS_IDX_SUB   0x01
#define NTFS_IDX_LAST   0x02
#define GET_IDXENTRY_SUB(fs, e)   (tsk_getu64(fs->endian, (int)e + tsk_getu16(fs->endian, e->idxlen) - 8))
#define NTFS_ATTRDEF_FLAGS_IDX   0x02
#define NTFS_ATTRDEF_FLAGS_RES   0x40
#define NTFS_ATTRDEF_FLAGS_NONRES   0x80

Functions

uint8_t ntfs_data_walk (NTFS_INFO *, INUM_T, TSK_FS_DATA *, int, TSK_FS_FILE_WALK_CB, void *)
uint8_t ntfs_dent_walk (TSK_FS_INFO *, INUM_T, TSK_FS_DENT_FLAG_ENUM, TSK_FS_DENT_TYPE_WALK_CB, void *)
 Process the contents of a directory and pass each file name to a callback function.
uint32_t nt2unixtime (uint64_t ntdate)
uint8_t ntfs_attrname_lookup (TSK_FS_INFO *, uint16_t, char *, int)


Function Documentation

uint8_t ntfs_dent_walk ( TSK_FS_INFO fs,
INUM_T  inum,
TSK_FS_DENT_FLAG_ENUM  flags,
TSK_FS_DENT_TYPE_WALK_CB  action,
void *  ptr 
)

Process the contents of a directory and pass each file name to a callback function.

Parameters:
fs File system to analyze
inum Metadata address of directory to analyze
flags Flags used during analysis
action Callback function that is called for each file name
ptr Pointer to data that is passed to callback
Returns:
1 on error and 0 on success


Generated on Wed Nov 28 16:11:17 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.5.1