@@ -95,11 +95,10 @@ enum RECORD_NUM {
9595 MFT_REC_BITMAP = 6 ,
9696 MFT_REC_BOOT = 7 ,
9797 MFT_REC_BADCLUST = 8 ,
98- //MFT_REC_QUOTA = 9,
99- MFT_REC_SECURE = 9 , // NTFS 3.0
98+ MFT_REC_SECURE = 9 ,
10099 MFT_REC_UPCASE = 10 ,
101- MFT_REC_EXTEND = 11 , // NTFS 3.0
102- MFT_REC_RESERVED = 11 ,
100+ MFT_REC_EXTEND = 11 ,
101+ MFT_REC_RESERVED = 12 ,
103102 MFT_REC_FREE = 16 ,
104103 MFT_REC_USER = 24 ,
105104};
@@ -109,7 +108,6 @@ enum ATTR_TYPE {
109108 ATTR_STD = cpu_to_le32 (0x10 ),
110109 ATTR_LIST = cpu_to_le32 (0x20 ),
111110 ATTR_NAME = cpu_to_le32 (0x30 ),
112- // ATTR_VOLUME_VERSION on Nt4
113111 ATTR_ID = cpu_to_le32 (0x40 ),
114112 ATTR_SECURE = cpu_to_le32 (0x50 ),
115113 ATTR_LABEL = cpu_to_le32 (0x60 ),
@@ -118,7 +116,6 @@ enum ATTR_TYPE {
118116 ATTR_ROOT = cpu_to_le32 (0x90 ),
119117 ATTR_ALLOC = cpu_to_le32 (0xA0 ),
120118 ATTR_BITMAP = cpu_to_le32 (0xB0 ),
121- // ATTR_SYMLINK on Nt4
122119 ATTR_REPARSE = cpu_to_le32 (0xC0 ),
123120 ATTR_EA_INFO = cpu_to_le32 (0xD0 ),
124121 ATTR_EA = cpu_to_le32 (0xE0 ),
@@ -144,6 +141,7 @@ enum FILE_ATTRIBUTE {
144141 FILE_ATTRIBUTE_ENCRYPTED = cpu_to_le32 (0x00004000 ),
145142 FILE_ATTRIBUTE_VALID_FLAGS = cpu_to_le32 (0x00007fb7 ),
146143 FILE_ATTRIBUTE_DIRECTORY = cpu_to_le32 (0x10000000 ),
144+ FILE_ATTRIBUTE_INDEX = cpu_to_le32 (0x20000000 )
147145};
148146
149147static_assert (sizeof (enum FILE_ATTRIBUTE ) == 4 );
@@ -266,7 +264,7 @@ enum RECORD_FLAG {
266264 RECORD_FLAG_IN_USE = cpu_to_le16 (0x0001 ),
267265 RECORD_FLAG_DIR = cpu_to_le16 (0x0002 ),
268266 RECORD_FLAG_SYSTEM = cpu_to_le16 (0x0004 ),
269- RECORD_FLAG_UNKNOWN = cpu_to_le16 (0x0008 ),
267+ RECORD_FLAG_INDEX = cpu_to_le16 (0x0008 ),
270268};
271269
272270/* MFT Record structure. */
@@ -331,18 +329,18 @@ struct ATTR_NONRESIDENT {
331329 __le64 svcn ; // 0x10: Starting VCN of this segment.
332330 __le64 evcn ; // 0x18: End VCN of this segment.
333331 __le16 run_off ; // 0x20: Offset to packed runs.
334- // Unit of Compression size for this stream, expressed
335- // as a log of the cluster size.
332+ // Unit of Compression size for this stream, expressed
333+ // as a log of the cluster size.
336334 //
337- // 0 means file is not compressed
338- // 1, 2, 3, and 4 are potentially legal values if the
339- // stream is compressed, however the implementation
340- // may only choose to use 4, or possibly 3. Note
341- // that 4 means cluster size time 16. If convenient
342- // the implementation may wish to accept a
343- // reasonable range of legal values here (1-5?),
344- // even if the implementation only generates
345- // a smaller set of values itself.
335+ // 0 means file is not compressed
336+ // 1, 2, 3, and 4 are potentially legal values if the
337+ // stream is compressed, however the implementation
338+ // may only choose to use 4, or possibly 3.
339+ // Note that 4 means cluster size time 16.
340+ // If convenient the implementation may wish to accept a
341+ // reasonable range of legal values here (1-5?),
342+ // even if the implementation only generates
343+ // a smaller set of values itself.
346344 u8 c_unit ; // 0x22:
347345 u8 res1 [5 ]; // 0x23:
348346 __le64 alloc_size ; // 0x28: The allocated size of attribute in bytes.
@@ -836,16 +834,22 @@ static_assert(sizeof(struct ATTR_DEF_ENTRY) == 0xa0);
836834/* Object ID (0x40) */
837835struct OBJECT_ID {
838836 struct GUID ObjId ; // 0x00: Unique Id assigned to file.
839- struct GUID BirthVolumeId ; // 0x10: Birth Volume Id is the Object Id of the Volume on.
840- // which the Object Id was allocated. It never changes.
841- struct GUID BirthObjectId ; // 0x20: Birth Object Id is the first Object Id that was
842- // ever assigned to this MFT Record. I.e. If the Object Id
843- // is changed for some reason, this field will reflect the
844- // original value of the Object Id.
845- struct GUID DomainId ; // 0x30: Domain Id is currently unused but it is intended to be
846- // used in a network environment where the local machine is
847- // part of a Windows 2000 Domain. This may be used in a Windows
848- // 2000 Advanced Server managed domain.
837+
838+ // Birth Volume Id is the Object Id of the Volume on.
839+ // which the Object Id was allocated. It never changes.
840+ struct GUID BirthVolumeId ; //0x10:
841+
842+ // Birth Object Id is the first Object Id that was
843+ // ever assigned to this MFT Record. I.e. If the Object Id
844+ // is changed for some reason, this field will reflect the
845+ // original value of the Object Id.
846+ struct GUID BirthObjectId ; // 0x20:
847+
848+ // Domain Id is currently unused but it is intended to be
849+ // used in a network environment where the local machine is
850+ // part of a Windows 2000 Domain. This may be used in a Windows
851+ // 2000 Advanced Server managed domain.
852+ struct GUID DomainId ; // 0x30:
849853};
850854
851855static_assert (sizeof (struct OBJECT_ID ) == 0x40 );
@@ -855,42 +859,45 @@ struct NTFS_DE_O {
855859 struct NTFS_DE de ;
856860 struct GUID ObjId ; // 0x10: Unique Id assigned to file.
857861 struct MFT_REF ref ; // 0x20: MFT record number with this file.
858- struct GUID BirthVolumeId ; // 0x28: Birth Volume Id is the Object Id of the Volume on
859- // which the Object Id was allocated. It never changes.
860- struct GUID BirthObjectId ; // 0x38: Birth Object Id is the first Object Id that was
861- // ever assigned to this MFT Record. I.e. If the Object Id
862- // is changed for some reason, this field will reflect the
863- // original value of the Object Id.
864- // This field is valid if data_size == 0x48.
865- struct GUID BirthDomainId ; // 0x48: Domain Id is currently unused but it is intended
866- // to be used in a network environment where the local
867- // machine is part of a Windows 2000 Domain. This may be
868- // used in a Windows 2000 Advanced Server managed domain.
862+
863+ // Birth Volume Id is the Object Id of the Volume on
864+ // which the Object Id was allocated. It never changes.
865+ struct GUID BirthVolumeId ; // 0x28:
866+
867+ // Birth Object Id is the first Object Id that was
868+ // ever assigned to this MFT Record. I.e. If the Object Id
869+ // is changed for some reason, this field will reflect the
870+ // original value of the Object Id.
871+ // This field is valid if data_size == 0x48.
872+ struct GUID BirthObjectId ; // 0x38:
873+
874+ // Domain Id is currently unused but it is intended
875+ // to be used in a network environment where the local
876+ // machine is part of a Windows 2000 Domain. This may be
877+ // used in a Windows 2000 Advanced Server managed domain.
878+ struct GUID BirthDomainId ; // 0x48:
869879};
870880
871881static_assert (sizeof (struct NTFS_DE_O ) == 0x58 );
872882
873- #define NTFS_OBJECT_ENTRY_DATA_SIZE1 \
874- 0x38 // struct NTFS_DE_O.BirthDomainId is not used
875- #define NTFS_OBJECT_ENTRY_DATA_SIZE2 \
876- 0x48 // struct NTFS_DE_O.BirthDomainId is used
877-
878883/* Q Directory entry structure ( rule = 0x11 ) */
879884struct NTFS_DE_Q {
880885 struct NTFS_DE de ;
881886 __le32 owner_id ; // 0x10: Unique Id assigned to file
887+
888+ /* here is 0x30 bytes of user quota. NOTE: 4 byte aligned! */
882889 __le32 Version ; // 0x14: 0x02
883- __le32 flags2 ; // 0x18: Quota flags, see above
890+ __le32 Flags ; // 0x18: Quota flags, see above
884891 __le64 BytesUsed ; // 0x1C:
885892 __le64 ChangeTime ; // 0x24:
886893 __le64 WarningLimit ; // 0x28:
887894 __le64 HardLimit ; // 0x34:
888895 __le64 ExceededTime ; // 0x3C:
889896
890897 // SID is placed here
891- }; // sizeof() = 0x44
898+ }__packed ; // sizeof() = 0x44
892899
893- #define SIZEOF_NTFS_DE_Q 0x44
900+ static_assert ( sizeof ( struct NTFS_DE_Q ) == 0x44 );
894901
895902#define SecurityDescriptorsBlockSize 0x40000 // 256K
896903#define SecurityDescriptorMaxSize 0x20000 // 128K
@@ -912,7 +919,7 @@ struct SECURITY_HDR {
912919 */
913920} __packed ;
914921
915- #define SIZEOF_SECURITY_HDR 0x14
922+ static_assert ( sizeof ( struct SECURITY_HDR ) == 0x14 );
916923
917924/* SII Directory entry structure */
918925struct NTFS_DE_SII {
@@ -921,7 +928,8 @@ struct NTFS_DE_SII {
921928 struct SECURITY_HDR sec_hdr ; // 0x14:
922929} __packed ;
923930
924- #define SIZEOF_SII_DIRENTRY 0x28
931+ static_assert (offsetof(struct NTFS_DE_SII , sec_hdr ) == 0x14 );
932+ static_assert (sizeof (struct NTFS_DE_SII ) == 0x28 );
925933
926934/* SDH Directory entry structure */
927935struct NTFS_DE_SDH {
@@ -1155,7 +1163,7 @@ struct REPARSE_DATA_BUFFER {
11551163
11561164#define FILE_NEED_EA 0x80 // See ntifs.h
11571165/*
1158- *FILE_NEED_EA, indicates that the file to which the EA belongs cannot be
1166+ * FILE_NEED_EA, indicates that the file to which the EA belongs cannot be
11591167 * interpreted without understanding the associated extended attributes.
11601168 */
11611169struct EA_INFO {
0 commit comments