Go to the source code of this file.
Data Structures | |
struct | ntfs_upd |
struct | ntfs_sb |
struct | ntfs_mft |
struct | ntfs_attr |
struct | ntfs_attr_fname |
struct | ntfs_attr_si |
struct | ntfs_attr_vinfo |
struct | ntfs_attrlist |
struct | ntfs_runlist |
struct | ntfs_idxelist |
struct | ntfs_idxroot |
struct | ntfs_idxrec |
struct | ntfs_idxentry |
struct | ntfs_attrdef |
struct | ntfs_attr_objid |
struct | NTFS_INFO |
Defines | |
#define | TSK_USE_SID 0 |
#define | NTFS_FS_MAGIC 0xAA55 |
#define | NTFS_DEV_BSIZE 512 |
#define | NTFS_MAXNAMLEN 256 |
#define | NTFS_MAXNAMLEN_UTF8 4 * NTFS_MAXNAMLEN |
#define | NTFS_ROOTINO NTFS_MFT_ROOT |
#define | NTFS_FIRSTINO 0 |
#define | NTFS_LAST_DEFAULT_INO 16 |
#define | NTFS_NDADDR 0 |
#define | NTFS_NIADDR 0 |
#define | NTFS_TOKEN_MASK 1 |
#define | NTFS_SYMBOL_TOKEN 0 |
#define | NTFS_TOKEN_LENGTH 8 |
#define | NTFS_MAX_UNCOMPRESSION_BUFFER_SIZE 65536 |
#define | NTFS_MFT_MAGIC 0x454c4946 |
#define | NTFS_MFT_MAGIC_BAAD 0x44414142 |
#define | NTFS_MFT_MAGIC_ZERO 0x00000000 |
#define | NTFS_MFT_INUSE 0x0001 |
#define | NTFS_MFT_DIR 0x0002 |
#define | NTFS_MFT_BASE 0 |
#define | NTFS_MFT_FILE_REC 0x00ffffffffffffff |
#define | NTFS_MFT_MFT 0x0 |
#define | NTFS_MFT_MFTMIR 0x1 |
#define | NTFS_MFT_LOG 0x2 |
#define | NTFS_MFT_VOL 0x3 |
#define | NTFS_MFT_ATTR 0x4 |
#define | NTFS_MFT_ROOT 0x5 |
#define | NTFS_MFT_BMAP 0x6 |
#define | NTFS_MFT_BOOT 0x7 |
#define | NTFS_MFT_BAD 0x8 |
#define | NTFS_MFT_SECURE 0x9 |
#define | NTFS_MFT_UPCASE 0xA |
#define | NTFS_MFT_RES 0 |
#define | NTFS_MFT_NONRES 1 |
#define | NTFS_ATTR_FLAG_COMP 0x0001 |
#define | NTFS_ATTR_FLAG_ENC 0x4000 |
#define | NTFS_ATTR_FLAG_SPAR 0x8000 |
#define | NTFS_ATYPE_SI 0x10 |
#define | NTFS_ATYPE_ATTRLIST 0x20 |
#define | NTFS_ATYPE_FNAME 0x30 |
#define | NTFS_ATYPE_VVER 0x40 |
#define | NTFS_ATYPE_OBJID 0x40 |
#define | NTFS_ATYPE_SEC 0x50 |
#define | NTFS_ATYPE_VNAME 0x60 |
#define | NTFS_ATYPE_VINFO 0x70 |
#define | NTFS_ATYPE_DATA 0x80 |
#define | NTFS_ATYPE_IDXROOT 0x90 |
#define | NTFS_ATYPE_IDXALLOC 0xA0 |
#define | NTFS_ATYPE_BITMAP 0xB0 |
#define | NTFS_ATYPE_SYMLNK 0xC0 |
#define | NTFS_ATYPE_REPARSE 0xC0 |
#define | NTFS_ATYPE_EAINFO 0xD0 |
#define | NTFS_ATYPE_EA 0xE0 |
#define | NTFS_ATYPE_PROP 0xF0 |
#define | NTFS_ATYPE_LOG 0x100 |
#define | NTFS_FNAME_FLAGS_RO 0x0000000000000001 |
#define | NTFS_FNAME_FLAGS_HID 0x0000000000000002 |
#define | NTFS_FNAME_FLAGS_SYS 0x0000000000000004 |
#define | NTFS_FNAME_FLAGS_ARCH 0x0000000000000020 |
#define | NTFS_FNAME_FLAGS_DEV 0x0000000000000040 |
#define | NTFS_FNAME_FLAGS_NORM 0x0000000000000080 |
#define | NTFS_FNAME_FLAGS_TEMP 0x0000000000000100 |
#define | NTFS_FNAME_FLAGS_SPAR 0x0000000000000200 |
#define | NTFS_FNAME_FLAGS_REP 0x0000000000000400 |
#define | NTFS_FNAME_FLAGS_COMP 0x0000000000000800 |
#define | NTFS_FNAME_FLAGS_OFF 0x0000000000001000 |
#define | NTFS_FNAME_FLAGS_NOIDX 0x0000000000002000 |
#define | NTFS_FNAME_FLAGS_ENC 0x0000000000004000 |
#define | NTFS_FNAME_FLAGS_DIR 0x0000000010000000 |
#define | NTFS_FNAME_FLAGS_IDXVIEW 0x0000000020000000 |
#define | NTFS_FNAME_POSIX 0 |
#define | NTFS_FNAME_WIN32 1 |
#define | NTFS_FNAME_DOS 2 |
#define | NTFS_FNAME_WINDOS 3 |
#define | NTFS_SI_RO 0x0001 |
#define | NTFS_SI_HID 0x0002 |
#define | NTFS_SI_SYS 0x0004 |
#define | NTFS_SI_ARCH 0x0020 |
#define | NTFS_SI_DEV 0x0040 |
#define | NTFS_SI_NORM 0x0080 |
#define | NTFS_SI_TEMP 0x0100 |
#define | NTFS_SI_SPAR 0x0200 |
#define | NTFS_SI_REP 0x0400 |
#define | NTFS_SI_COMP 0x0800 |
#define | NTFS_SI_OFF 0x1000 |
#define | NTFS_SI_NOIDX 0x2000 |
#define | NTFS_SI_ENC 0x4000 |
#define | NTFS_VINFO_DIRTY 0x0001 |
#define | NTFS_VINFO_RESLOG 0x0002 |
#define | NTFS_VINFO_UPGRAD 0x0004 |
#define | NTFS_VINFO_MNTNT4 0x0008 |
#define | NTFS_VINFO_DELUSN 0x0010 |
#define | NTFS_VINFO_REPOBJ 0x0020 |
#define | NTFS_VINFO_MODCHK 0x8000 |
#define | NTFS_VINFO_NT 0x21 |
#define | NTFS_VINFO_2K 0x03 |
#define | NTFS_VINFO_XP 0x13 |
#define | NTFS_ATTRL_RES 0 |
#define | NTFS_RUNL_LENSZ(runl) (uint8_t)(runl->len & 0x0f) |
#define | NTFS_RUNL_OFFSZ(runl) (uint8_t)((runl->len & 0xf0) >> 4) |
#define | NTFS_IDXELIST_CHILD 0x1 |
#define | NTFS_IDXREC_MAGIC 0x58444e49 |
#define | NTFS_IDX_SUB 0x01 |
#define | NTFS_IDX_LAST 0x02 |
#define | GET_IDXENTRY_SUB(fs, e) (tsk_getu64(fs->endian, (int)e + tsk_getu16(fs->endian, e->idxlen) - 8)) |
#define | NTFS_ATTRDEF_FLAGS_IDX 0x02 |
#define | NTFS_ATTRDEF_FLAGS_RES 0x40 |
#define | NTFS_ATTRDEF_FLAGS_NONRES 0x80 |
Functions | |
uint8_t | ntfs_data_walk (NTFS_INFO *, INUM_T, TSK_FS_DATA *, int, TSK_FS_FILE_WALK_CB, void *) |
uint8_t | ntfs_dent_walk (TSK_FS_INFO *, INUM_T, TSK_FS_DENT_FLAG_ENUM, TSK_FS_DENT_TYPE_WALK_CB, void *) |
Process the contents of a directory and pass each file name to a callback function. | |
uint32_t | nt2unixtime (uint64_t ntdate) |
uint8_t | ntfs_attrname_lookup (TSK_FS_INFO *, uint16_t, char *, int) |
uint8_t ntfs_dent_walk | ( | TSK_FS_INFO * | fs, | |
INUM_T | inum, | |||
TSK_FS_DENT_FLAG_ENUM | flags, | |||
TSK_FS_DENT_TYPE_WALK_CB | action, | |||
void * | ptr | |||
) |
Process the contents of a directory and pass each file name to a callback function.
fs | File system to analyze | |
inum | Metadata address of directory to analyze | |
flags | Flags used during analysis | |
action | Callback function that is called for each file name | |
ptr | Pointer to data that is passed to callback |