From 94ac119fb43f5885c947d51a55486b12afbde1d7 Mon Sep 17 00:00:00 2001 From: !flatcap Date: Thu, 22 Aug 2002 18:09:47 +0000 Subject: [PATCH] AT_NONAME -> AT_UNNAMED 2002/07/11 23:44:14-00:00 !flatcap new function headers and a few function moves 2002/07/11 16:20:34-00:00 !flatcap whitespace and include guards 2002/07/08 23:27:17-00:00 !flatcap added AT_NONAME so we can search for a (un)named attribute or just iterate through all attributes 2002/07/08 00:09:41-00:00 !antona Implement attrib.[hc]::ntfs_rl_pwrite(). Fix a dumb bug in ntfs_attr_pwrite(). 2002/07/02 23:47:11-00:00 !antona Global replacement of __[su]{8,16,32,64} with [su]{8,16,32,64} and layout.h define it. 2002/07/01 23:18:37-00:00 !mattjf ntfsinfo update 2002/06/30 21:22:52-00:00 !flatcap a working undelete program, still very alpha 2002/06/25 23:35:49-00:00 !flatcap put back locale line, accidentally deleted put in extra check for inode 2002/06/25 15:17:13-00:00 !flatcap minor bugfix, free used vars, remove duplicated code 2002/06/02 13:57:59-00:00 !antona Fix detection of read-only mounts in volume.c::ntfs_check_mnteent(). 2002/05/14 01:02:04-00:00 !mattjf Bugfix and code cleanup. ntfsinfo now returns the filename 2002/05/13 03:44:10-00:00 !mattjf Update code 2002/05/11 21:43:56-00:00 !mattjf Added new code to ntfsinfo 2002/05/08 05:55:15-00:00 !mattjf started work on ntfsinfo (Logical change 1.5) --- ntfstools/ntfsinfo.c | 195 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 195 insertions(+) diff --git a/ntfstools/ntfsinfo.c b/ntfstools/ntfsinfo.c index e69de29b..45b6d1bb 100644 --- a/ntfstools/ntfsinfo.c +++ b/ntfstools/ntfsinfo.c @@ -0,0 +1,195 @@ +/*z + * $Id$ + * + * ntfsinfo - Part of the Linux-NTFS project. + * + * Copyright (c) 2002 Matthew J. Fanto + * Copyright (c) 2002 Anton Altaparmakov + * Copyright (c) 2002 Richard Russon + * + * This utility will dump a file's attributes. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program (in the main directory of the Linux-NTFS + * distribution in the file COPYING); if not, write to the Free Software + * Foundation,Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA + */ +#include "config.h" + +#include +#include +#include +#include +#include +#include +#include "mft.h" +#include "attrib.h" +#include "layout.h" +#include "inode.h" + +void get_file_attribute_value(const char *dev, long int i); +void print_standard_information_attr(ntfs_attr_search_ctx * ctx); +void print_file_name_attr(ntfs_attr_search_ctx * ctx); + + +#define NTFS_TIME_OFFSET ((u64)(369*365 + 89) * 24 * 3600 * 10000000) + +int main(int argc, char **argv) +{ + const char *AUTHOR = "Matthew J. Fanto"; + const char *EXEC_NAME = "ntfsinfo"; + const char *locale; + long i; + + locale = setlocale(LC_ALL, ""); + if (!locale) { + char *locale; + + locale = setlocale(LC_ALL, NULL); + printf("Failed to set locale, using default (%s).\n", locale); + } else + printf("Using locale %s.\n", locale); + + if (argc < 3 || argc > 4) { + fprintf(stderr, "%s v%s - %s\n", EXEC_NAME, VERSION, AUTHOR); + fprintf(stderr, "Usage: ntfsinfo device inode\n"); + exit(1); + } + + else { + i = atoll(argv[2]); + get_file_attribute_value(argv[1], i); + } + + return 0; +} + +void get_file_attribute_value(const char *dev, long int i) +{ + + MFT_REF mref; + MFT_RECORD *mrec = NULL; + //ATTR_RECORD *attr = NULL; + //FILE_NAME_ATTR *file_name_attr = NULL; + //STANDARD_INFORMATION *standard_information = NULL; + //SECURITY_DESCRIPTOR_RELATIVE *security_descriptor = NULL; + ntfs_attr_search_ctx *ctx = NULL; + ntfs_volume *vol = NULL; + //char *file_name; + ntfs_inode *inode = NULL; + + vol = ntfs_mount(dev, 0); + + mref = (MFT_REF) i; + inode = ntfs_open_inode(vol, mref); + + if (ntfs_read_file_record(vol, mref, &mrec, NULL)) { + perror("Error reading file record!\n"); + exit(1); + } + + ctx = ntfs_get_attr_search_ctx(inode, mrec); + +// print_file_name_attr(ctx); + +// ctx = ntfs_get_attr_search_ctx(inode, mrec); //need to fix this + + print_standard_information_attr(ctx); +} + + +s64 ntfs2time(s64 time) +{ + s64 t; + printf("Original Time: %Li\n",time); + t = time - NTFS_TIME_OFFSET; + t = t / 10000000; + return t; + + +} + +void print_standard_information_attr(ntfs_attr_search_ctx *ctx) +{ + ATTR_RECORD *attr = NULL; + STANDARD_INFORMATION *standard_information_attr = NULL; + + if (ntfs_lookup_attr + (AT_STANDARD_INFORMATION, AT_UNNAMED, 0, 0, 0, NULL, 0, ctx)) { + perror("Error looking up $STANDARD_INFORMATION!\n"); + exit(1); + } + + attr = ctx->attr; + + standard_information_attr = + (STANDARD_INFORMATION *) ((char *) attr + + le16_to_cpu(attr->value_offset)); + + printf("Creation time: %Li\n", + ntfs2time(standard_information_attr->creation_time)); +/* printf("Last Data Change Time: %Li\n", + ntfs2time(standard_information_attr->last_data_change_time)); + printf("Last MFT Change Time: %Li\n", + ntfs2time(standard_information_attr->last_mft_change_time)); + printf("Last Access Time: %Li\n", + ntfs2time(standard_information_attr->last_access_time)); + printf("Maxium Versions: %d\n", + standard_information_attr->maximum_versions); + printf("Version Number: %d\n", + standard_information_attr->version_number); + printf("Class ID: %d\n", + standard_information_attr->class_id); + printf("Owner ID: %d\n", + standard_information_attr->owner_id); + printf("Security ID: %d\n", + standard_information_attr->security_id); + +*/ +} + +void print_file_name_attr(ntfs_attr_search_ctx *ctx) +{ + ATTR_RECORD *attr = NULL; + ntfs_attr_search_ctx *c = ctx; + FILE_NAME_ATTR *file_name_attr = NULL; + char *file_name; + + if (ntfs_lookup_attr(AT_FILE_NAME, AT_UNNAMED, 0, 0, 0, NULL, 0, ctx)) { + perror("Error looking up $FILE_NAME_ATTR!\n"); + exit(1); + } + + attr = ctx->attr; + ctx = c; + + file_name_attr = + (FILE_NAME_ATTR *) ((char *) attr + + le16_to_cpu(attr->value_offset)); + + file_name = malloc(file_name_attr->file_name_length * sizeof (char)); + + ntfs_ucstombs(file_name_attr->file_name, + file_name_attr->file_name_length, &file_name, + file_name_attr->file_name_length); + + printf("File Name: %s\n", file_name); + printf("File Name Length: %d\n", file_name_attr->file_name_length); + printf("Allocated Size: %Li\n",sle64_to_cpu(file_name_attr->allocated_size)); + printf("Data Size: %Li\n",sle64_to_cpu(file_name_attr->data_size)); +} + +/*void print_security_descriptor_attr(SECURITY_DESCRIPTOR_RELATIVE *security_descriptor) +{ + +}*/