From 14658c8c43ee2b9e41f86fb8dd5561ef3deb48c3 Mon Sep 17 00:00:00 2001 From: "cantab.net!aia21" Date: Mon, 15 Mar 2004 11:34:30 +0000 Subject: [PATCH] Copy MFT_RECORD typedef to MFT_RECORD_OLD and modify MFT_RECORD to contain the NTFS 3.1+ specific fields. Also, update mkntfs and ntfsclone appropriately. (Logical change 1.333) --- ChangeLog | 3 ++ include/ntfs/layout.h | 74 ++++++++++++++++++++++++++++++++++++++++--- 2 files changed, 73 insertions(+), 4 deletions(-) diff --git a/ChangeLog b/ChangeLog index 9037b8a8..96f61754 100644 --- a/ChangeLog +++ b/ChangeLog @@ -15,6 +15,9 @@ xx/xx/2004 - 1.9.1-WIP and remove relevant FIXME comments. (Yuval Fledel) - Add new API security.[hc]::ntfs_guid_is_zero() and ntfs_guid_to_mbs(). - Implement dumping of object id in ntfsinfo. (Yuval Fledel, me) + - Copy MFT_RECORD typedef to MFT_RECORD_OLD and modify MFT_RECORD to + contain the NTFS 3.1+ specific fields. Also, update mkntfs and + ntfsclone appropriately. 11/04/2004 - 1.9.0 - Added ntfsresize relocation support and a lot of cleanups. - In include/ntfs/*.h Wrap all #include "config.h" by #ifdef diff --git a/include/ntfs/layout.h b/include/ntfs/layout.h index 7467b1e7..178741aa 100644 --- a/include/ntfs/layout.h +++ b/include/ntfs/layout.h @@ -344,10 +344,9 @@ typedef struct { record is reused this number is set to zero. NOTE: The first instance number is always 0. */ -/* sizeof() = 42 bytes */ -/* NTFS 3.1+ (Windows XP and above) introduce the following additions. */ -/* 42*/ //u16 reserved; /* Reserved/alignment. */ -/* 44*/ //u32 mft_record_number; /* Number of this mft record. */ +/* The below fields are specific to NTFS 3.1+ (Windows XP and above): */ +/* 42*/ u16 reserved; /* Reserved/alignment. */ +/* 44*/ u32 mft_record_number; /* Number of this mft record. */ /* sizeof() = 48 bytes */ /* * When (re)using the mft record, we place the update sequence array at this @@ -360,6 +359,73 @@ typedef struct { */ } __attribute__ ((__packed__)) MFT_RECORD; +/* This is the version without the NTFS 3.1+ specific fields. */ +typedef struct { +/*Ofs*/ +/* 0 NTFS_RECORD; -- Unfolded here as gcc doesn't like unnamed structs. */ + NTFS_RECORD_TYPES magic;/* Usually the magic is "FILE". */ + u16 usa_ofs; /* See NTFS_RECORD definition above. */ + u16 usa_count; /* See NTFS_RECORD definition above. */ + +/* 8*/ u64 lsn; /* $LogFile sequence number for this record. + Changed every time the record is modified. */ +/* 16*/ u16 sequence_number; /* Number of times this mft record has been + reused. (See description for MFT_REF + above.) NOTE: The increment (skipping zero) + is done when the file is deleted. NOTE: If + this is zero it is left zero. */ +/* 18*/ u16 link_count; /* Number of hard links, i.e. the number of + directory entries referencing this record. + NOTE: Only used in mft base records. + NOTE: When deleting a directory entry we + check the link_count and if it is 1 we + delete the file. Otherwise we delete the + FILE_NAME_ATTR being referenced by the + directory entry from the mft record and + decrement the link_count. + FIXME: Careful with Win32 + DOS names! */ +/* 20*/ u16 attrs_offset; /* Byte offset to the first attribute in this + mft record from the start of the mft record. + NOTE: Must be aligned to 8-byte boundary. */ +/* 22*/ MFT_RECORD_FLAGS flags; /* Bit array of MFT_RECORD_FLAGS. When a file + is deleted, the MFT_RECORD_IN_USE flag is + set to zero. */ +/* 24*/ u32 bytes_in_use; /* Number of bytes used in this mft record. + NOTE: Must be aligned to 8-byte boundary. */ +/* 28*/ u32 bytes_allocated; /* Number of bytes allocated for this mft + record. This should be equal to the mft + record size. */ +/* 32*/ MFT_REF base_mft_record; /* This is zero for base mft records. + When it is not zero it is a mft reference + pointing to the base mft record to which + this record belongs (this is then used to + locate the attribute list attribute present + in the base record which describes this + extension record and hence might need + modification when the extension record + itself is modified, also locating the + attribute list also means finding the other + potential extents, belonging to the non-base + mft record). */ +/* 40*/ u16 next_attr_instance; /* The instance number that will be + assigned to the next attribute added to this + mft record. NOTE: Incremented each time + after it is used. NOTE: Every time the mft + record is reused this number is set to zero. + NOTE: The first instance number is always 0. + */ +/* sizeof() = 42 bytes */ +/* + * When (re)using the mft record, we place the update sequence array at this + * offset, i.e. before we start with the attributes. This also makes sense, + * otherwise we could run into problems with the update sequence array + * containing in itself the last two bytes of a sector which would mean that + * multi sector transfer protection wouldn't work. As you can't protect data + * by overwriting it since you then can't get it back... + * When reading we obviously use the data from the ntfs record header. + */ +} __attribute__ ((__packed__)) MFT_RECORD_OLD; + /* * System defined attributes (32-bit). Each attribute type has a corresponding * attribute name (Unicode string of maximum 64 character length) as described