From 290baa4af25562829a3501889fb1b04b88703286 Mon Sep 17 00:00:00 2001
From: !flatcap <!flatcap>
Date: Thu, 22 Aug 2002 18:09:47 +0000
Subject: [PATCH] a couple of new bits, nothing original

2002/07/16 23:41:43-00:00 !flatcap
sort out the output and some of the return values

2002/07/15 16:30:41-00:00 !flatcap
more tidying, more comments

2002/07/14 15:53:03-00:00 !flatcap
perform some checks on the device we're opening

2002/07/14 14:49:22-00:00 !flatcap
open vol read-only, filter by last mod time

2002/07/14 11:20:20-00:00 !flatcap
filename regex matching works, default to case insensitive matching

2002/07/13 16:33:00-00:00 !flatcap
start to fill in the options

2002/07/11 13:18:12-00:00 !flatcap
start to break up the dependency loops in the header files

2002/07/01 13:30:28-00:00 !flatcap
lots of comments

2002/06/30 22:46:51-00:00 !flatcap
undelete -> ntfsundelete

(Logical change 1.5)
---
 ntfstools/ntfsundelete.h | 104 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 104 insertions(+)

diff --git a/ntfstools/ntfsundelete.h b/ntfstools/ntfsundelete.h
index e69de29b..21a63d8b 100644
--- a/ntfstools/ntfsundelete.h
+++ b/ntfstools/ntfsundelete.h
@@ -0,0 +1,104 @@
+/*
+ * ntfsundelete - Part of the Linux-NTFS project.
+ *
+ * Copyright (c) 2002 Richard Russon <ntfs@flatcap.org>
+ *
+ * This utility will recover deleted files from an NTFS volume.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program (in the main directory of the Linux-NTFS
+ * distribution in the file COPYING); if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ */
+
+#ifndef _NTFSUNDELETE_H_
+#define _NTFSUNDELETE_H_
+
+#include "types.h"
+#include "list.h"
+#include "runlist.h"
+
+enum optmode {
+	MODE_NONE = 0,
+	MODE_SCAN,
+	MODE_UNDELETE,
+	MODE_COPY,
+	MODE_ERROR
+};
+
+struct options {
+	char		*device;	/* Device/File to work with */
+	enum optmode	 mode;		/* Scan / Undelete / Copy */
+	int		 percent;	/* Minimum recoverability */
+	int		 uinode;	/* Undelete this inode */
+	char		*dest;		/* Save file to this directory */
+	char		*output;	/* With this filename */
+	char		 fillbyte;	/* Use for unrecoverable sections */
+	char		*match;		/* Pattern for filename matching */
+	int		 match_case;	/* Case sensitive matching */
+	int		 quiet;		/* Less output */
+	int		 verbose;	/* Extra output */
+	int		 force;		/* Override common sense */
+	time_t		 since;		/* Since this time */
+	long long	 size_begin;	/* Range for file size */
+	long long	 size_end;
+	long long	 mft_begin;	/* Range for mft copy */
+	long long	 mft_end;
+};
+
+struct filename {
+	struct list_head list;		/* Previous/Next links */
+	char		*name;		/* Filename in current locale */
+	FILE_NAME_TYPE_FLAGS name_space;
+	uchar_t		*uname;		/* Filename in unicode */
+	int		 uname_len;	/* and its length */
+	long long	 size_alloc;	/* Allocated size (multiple of cluster size) */
+	long long	 size_data;	/* Actual size of data */
+	FILE_ATTR_FLAGS	 flags;
+	time_t		 date_c;
+	time_t		 date_a;
+	time_t		 date_m;
+	time_t		 date_r;
+};
+
+struct data {
+	struct list_head list;		/* Previous/Next links */
+	char		*name;		/* Stream name in current locale */
+	uchar_t		*uname;		/* Unicode stream name */
+	int		 uname_len;	/* and its length */
+	int		 resident;	/* Stream is resident */
+	int		 compressed;	/* Stream is compressed */
+	int		 encrypted;	/* Stream is encrypted */
+	long long	 size_alloc;	/* Allocated size (multiple of cluster size) */
+	long long	 size_data;	/* Actual size of data */
+	long long	 size_init;	/* Initialised size, may be less than data size */
+	long long	 size_vcn;	/* Highest VCN in the data runs */
+	run_list_element*run_list;	/* Decoded data runs */
+	int		 percent;	/* Amont potentially recoverable */
+	void		*data;		/* If resident, a pointer to the data */
+};
+
+struct ufile {
+	long long	 inode;		/* MFT record number */
+	time_t		 date;		/* Last modification date/time */
+	struct list_head name;		/* A list of filenames */
+	struct list_head data;		/* A list of data streams */
+	char		*pref_name;	/* Preferred filename */
+	long long	 max_size;	/* Largest size we find */
+	int		 attr_list;	/* MFT record may be one of many */
+	int		 directory;	/* MFT record represents a directory */
+	MFT_RECORD	*mft;		/* Raw MFT record */
+};
+
+#endif /* _NTFSUNDELETE_H_ */
+