Structs

struct ACCESS_DENIED_ACE -

struct ACCESS_ALLOWED_OBJECT_ACE -

struct ACE_HEADER -

struct ACL - An ACL is an access-control list (ACL).

struct ATTR_DEF -

struct ATTR_LIST_ENTRY - Attribute: Attribute list (0x20).

struct ATTR - Attribute record.

struct ATTR_RECORD - Attribute record header.

struct BIOS_PARAMETER_BLOCK - BIOS parameter block (bpb) structure.

struct BITMAP_ACTION - Bitmap change being logged

struct BITMAP_ATTR - Attribute: Bitmap (0xb0).

struct DATA_ATTR - Attribute: Data attribute (0x80).

struct EA_ATTR - Attribute: Extended attribute (EA) (0xe0).

struct EA_INFORMATION - Attribute: Extended attribute information (0xd0).

struct EFS_ATTR_HEADER - “$EFS” header.

struct EFS_DF_ARRAY_HEADER -

struct EFS_DF_CERTIFICATE_THUMBPRINT_HEADER -

struct EFS_DF_CREDENTIAL_HEADER -

struct EFS_DF_HEADER -

struct FILE_NAME_ATTR - Attribute: Filename (0x30).

struct GENERIC_MAPPING -

struct GUID - GUID structures store globally unique identifiers (GUID).

struct INDEX_BLOCK - Attribute: Index allocation (0xa0).

struct INDEX_ENTRY - This is an index entry.

struct INDEX_ENTRY_HEADER - This the index entry header (see below).

struct INDEX_HEADER -

struct INDEX_ROOT - Attribute: Index root (0x90).

struct LOGGED_UTILITY_STREAM - Attribute: Logged utility stream (0x100).

struct LOG_CLIENT_ID - The log client id structure identifying a log client.

struct LOG_CLIENT_RECORD - Log client record.

struct LOG_RECORD - Log record header.

struct MFT_RECORD - An MFT record layout (NTFS 3.1+)

struct MFT_RECORD_OLD - An MFT record layout (NTFS <=3.0)

struct NTFS_BOOT_SECTOR - NTFS boot sector structure.

struct NTFS_RECORD -

struct OBJECT_ID_ATTR - Attribute: Object id (NTFS 3.0+) (0x40).

struct OBJ_ID_INDEX_DATA - FILE_Extend/$ObjId contains an index named $O.

struct PROPERTY_SET - Attribute: Property set (0xf0).

struct QUOTA_CONTROL_ENTRY -

struct QUOTA_O_INDEX_DATA -

struct RECORD_PAGE_HEADER - Log page record page header.

struct REPARSE_INDEX_KEY -

struct REPARSE_POINT - Attribute: Reparse point (0xc0).

struct RESTART_AREA - Log file restart area record.

struct RESTART_PAGE_HEADER - Log file restart page header.

struct SDH_INDEX_DATA -

struct SDH_INDEX_KEY - The index entry key used in the $SDH index.

struct SDS_ENTRY -

struct SECURITY_DESCRIPTOR - Absolute security descriptor.

struct SECURITY_DESCRIPTOR_HEADER -

struct SECURITY_DESCRIPTOR_RELATIVE -

struct SID -

struct SII_INDEX_KEY - The index entry key used in the $SII index.

struct STANDARD_INFORMATION - Attribute: Standard information (0x10).

struct VOLUME_INFORMATION - Attribute: Volume information (0x70).

struct VOLUME_NAME - Attribute: Volume name (0x60).

struct ntfs_attr - ntfs in memory non-resident attribute structure @rl: if not NULL, the decompressed runlist @ni: base ntfs inode to which this attribute belongs @type: attribute type @name: Unicode name of the attribute @name_len: length of @name in Unicode characters @state: NTFS attribute specific flags describing this attribute @allocated_size: copy from the attribute record @data_size: copy from the attribute record @initialized_size: copy from the attribute record @compressed_size: copy from the attribute record @compression_block_size: size of a compression block (cb) @compression_block_size_bits: log2 of the size of a cb @compression_block_clusters: number of clusters per cb

struct ntfs_attr_search_ctx - search context used in attribute search functions @mrec: buffer containing mft record to search @attr: attribute record in @mrec where to begin/continue search @is_first: if true lookup_attr() begins search with @attr, else after @attr

struct _ntfs_inode - The NTFS in-memory inode structure.

struct _ntfs_volume - structure describing an open volume in memory.

struct _runlist_element - in memory vcn to lcn mapping array element. @vcn: starting vcn of the current array element @lcn: starting lcn of the current array element @length: length in clusters of the current array element

union attr_val - Union of all known attribute values

struct ntfs_device -

struct ntfs_device_operations -

struct ntfs_index_context - @ni: inode containing the @entry described by this context @name: name of the index described by this context @name_len: length of the index name @entry: index entry (points into @ir or @ia) @data: index entry data (points into @entry) @data_len: length in bytes of @data @is_in_root: TRUE if @entry is in @ir or FALSE if it is in @ia @ir: index root if @is_in_root or NULL otherwise @actx: attribute search context if in root or NULL otherwise @ia: index block if @is_in_root is FALSE or NULL otherwise @ia_na: opened INDEX_ALLOCATION attribute @parent_pos: parent entries’ positions in the index block @parent_vcn: entry’s parent node or VCN_INDEX_ROOT_PARENT @new_vcn: new VCN if we need to create a new index block @median: move to the parent if splitting index blocks @ib_dirty: TRUE if index block was changed @block_size: index block size @vcn_size_bits: VCN size bits for this index block

Constants

FILE_ATTR_I30_INDEX_PRESENT - Is it a directory?

FILE_ATTR_VIEW_INDEX_PRESENT - Does have a non-directory index?

Statics

Functions

ntfs_boot_sector_is_ntfs - check a boot sector for describing an ntfs volume @b: buffer containing the boot sector

get_attribute_value - return the attribute value of an attribute @vol: volume on which the attribute is present @a: attribute to get the value of @b: destination buffer for the attribute value

get_attribute_value_length - return the length of the value of an attribute @a: pointer to a buffer containing the attribute record

Type Definitions

struct ACCESS_DENIED_ACE -

struct ACCESS_ALLOWED_OBJECT_ACE -

enum ACCESS_MASK - The access mask (32-bit).

enum ACE_FLAGS - The ACE flags (8-bit) for audit and inheritance.

enum ACE_TYPES - The predefined ACE types (8-bit, see below).

enum ACL_CONSTANTS - Current constants for ACLs.

enum ATTR_DEF_FLAGS -

enum ATTR_FLAGS - Attribute flags (16-bit).

enum ATTR_TYPES - System defined attributes (32-bit).

enum BOOL - These are just to make the code more readable…

enum COLLATION_RULES - The collation rules for sorting views/indexes/etc (32-bit).

enum EA_FLAGS - Extended attribute flags (8-bit).

enum FILE_ATTR_FLAGS - File attribute flags (32-bit).

enum FILE_NAME_TYPE_FLAGS - Possible namespaces for filenames in ntfs. (8-bit).

enum IGNORE_CASE_BOOL -

enum INDEX_ENTRY_FLAGS - Index entry flags (16-bit).

enum INDEX_HEADER_FLAGS - Index header flags (8-bit).

enum LOG_RECORD_FLAGS - Possible 16-bit flags for log records.

enum MFT_RECORD_FLAGS -

enum NTFS_CLUSTER_ALLOCATION_ZONES -

enum NTFS_RECORD_TYPES -

enum NTFS_SYSTEM_FILES - System files mft record numbers.

enum OBJECT_ACE_FLAGS - The object ACE flags (32-bit).

enum PREDEFINED_OWNER_IDS - Predefined owner_id values (32-bit).

enum PREDEFINED_REPARSE_TAGS -

enum QUOTA_FLAGS - Quota flags (32-bit).

enum RELATIVE_IDENTIFIERS -

enum RESIDENT_ATTR_FLAGS - Flags of resident attributes (8-bit).

enum SECURITY_DESCRIPTOR_CONSTANTS -

enum SECURITY_DESCRIPTOR_CONTROL -

enum SID_CONSTANTS - Current constants for SIDs.

struct SII_INDEX_DATA -

struct ACCESS_DENIED_ACE -

struct ACCESS_ALLOWED_OBJECT_ACE -

struct ACCESS_DENIED_ACE -

struct ACCESS_ALLOWED_OBJECT_ACE -

enum VOLUME_FLAGS - Possible flags for the volume (16-bit).

enum ntfs_mount_flags -

enum ntfs_attr_state_bits - bits for the state field in the ntfs_attr structure

enum ntfs_device_state_bits -

enum ntfs_inode_state_bits -

enum ntfs_lcn_special_values - special return values for ntfs_*_vcn_to_lcn()

enum ntfs_mounted_flags -

enum ntfs_volume_state_bits -

Unions