mirror of
https://github.com/aaru-dps/Aaru.git
synced 2026-07-08 18:16:24 +00:00
[ntfs] Added missing on-disk structures.
This commit is contained in:
627
Aaru.Filesystems/NTFS/Enums.cs
Normal file
627
Aaru.Filesystems/NTFS/Enums.cs
Normal file
@@ -0,0 +1,627 @@
|
||||
// /***************************************************************************
|
||||
// Aaru Data Preservation Suite
|
||||
// ----------------------------------------------------------------------------
|
||||
//
|
||||
// Filename : Enums.cs
|
||||
// Author(s) : Natalia Portillo <claunia@claunia.com>
|
||||
//
|
||||
// Component : Microsoft NT File System plugin.
|
||||
//
|
||||
// --[ Description ] ----------------------------------------------------------
|
||||
//
|
||||
// Enumerations for the Microsoft NT File System.
|
||||
//
|
||||
// --[ License ] --------------------------------------------------------------
|
||||
//
|
||||
// This library is free software; you can redistribute it and/or modify
|
||||
// it under the terms of the GNU Lesser General Public License as
|
||||
// published by the Free Software Foundation; either version 2.1 of the
|
||||
// License, or (at your option) any later version.
|
||||
//
|
||||
// This library is distributed in the hope that it will be useful, but
|
||||
// WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
||||
// Lesser General Public License for more details.
|
||||
//
|
||||
// You should have received a copy of the GNU Lesser General Public
|
||||
// License along with this library; if not, see <http://www.gnu.org/licenses/>.
|
||||
//
|
||||
// ----------------------------------------------------------------------------
|
||||
// Copyright © 2011-2026 Natalia Portillo
|
||||
// ****************************************************************************/
|
||||
|
||||
using System;
|
||||
|
||||
namespace Aaru.Filesystems;
|
||||
|
||||
/// <inheritdoc />
|
||||
public sealed partial class NTFS
|
||||
{
|
||||
#region Nested type: NtfsRecordMagic
|
||||
|
||||
/// <summary>Magic identifiers present at the beginning of all multi-sector protected NTFS records</summary>
|
||||
enum NtfsRecordMagic : uint
|
||||
{
|
||||
/// <summary>MFT entry ("FILE")</summary>
|
||||
File = 0x454c4946,
|
||||
/// <summary>Index buffer ("INDX")</summary>
|
||||
Indx = 0x58444e49,
|
||||
/// <summary>Hole marker ("HOLE")</summary>
|
||||
Hole = 0x454c4f48,
|
||||
/// <summary>Restart page ("RSTR")</summary>
|
||||
Rstr = 0x52545352,
|
||||
/// <summary>Log record page ("RCRD")</summary>
|
||||
Rcrd = 0x44524352,
|
||||
/// <summary>Chkdsk modified ("CHKD")</summary>
|
||||
Chkd = 0x444b4843,
|
||||
/// <summary>Bad record ("BAAD")</summary>
|
||||
Baad = 0x44414142,
|
||||
/// <summary>Empty/uninitialized</summary>
|
||||
Empty = 0xffffffff
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: SystemFileNumber
|
||||
|
||||
/// <summary>System files MFT record numbers</summary>
|
||||
enum SystemFileNumber : uint
|
||||
{
|
||||
/// <summary>Master File Table ($MFT)</summary>
|
||||
Mft = 0,
|
||||
/// <summary>MFT mirror ($MFTMirr)</summary>
|
||||
MftMirr = 1,
|
||||
/// <summary>Journaling log ($LogFile)</summary>
|
||||
LogFile = 2,
|
||||
/// <summary>Volume information ($Volume)</summary>
|
||||
Volume = 3,
|
||||
/// <summary>Attribute definitions ($AttrDef)</summary>
|
||||
AttrDef = 4,
|
||||
/// <summary>Root directory</summary>
|
||||
Root = 5,
|
||||
/// <summary>Cluster allocation bitmap ($Bitmap)</summary>
|
||||
Bitmap = 6,
|
||||
/// <summary>Boot sector ($Boot)</summary>
|
||||
Boot = 7,
|
||||
/// <summary>Bad cluster list ($BadClus)</summary>
|
||||
BadClus = 8,
|
||||
/// <summary>Security descriptors ($Secure)</summary>
|
||||
Secure = 9,
|
||||
/// <summary>Uppercase table ($UpCase)</summary>
|
||||
UpCase = 10,
|
||||
/// <summary>Extended system directory ($Extend)</summary>
|
||||
Extend = 11,
|
||||
/// <summary>First user file record</summary>
|
||||
FirstUser = 16
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: MftRecordFlags
|
||||
|
||||
/// <summary>MFT record flags (16-bit)</summary>
|
||||
[Flags]
|
||||
enum MftRecordFlags : ushort
|
||||
{
|
||||
/// <summary>Record is allocated and in use</summary>
|
||||
InUse = 0x0001,
|
||||
/// <summary>Record represents a directory</summary>
|
||||
IsDirectory = 0x0002,
|
||||
/// <summary>Special record 4 type</summary>
|
||||
Is4 = 0x0004,
|
||||
/// <summary>Used as view index</summary>
|
||||
IsViewIndex = 0x0008
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: AttributeType
|
||||
|
||||
/// <summary>System-defined attribute types (32-bit)</summary>
|
||||
enum AttributeType : uint
|
||||
{
|
||||
/// <summary>Unused</summary>
|
||||
Unused = 0x00,
|
||||
/// <summary>$STANDARD_INFORMATION</summary>
|
||||
StandardInformation = 0x10,
|
||||
/// <summary>$ATTRIBUTE_LIST</summary>
|
||||
AttributeList = 0x20,
|
||||
/// <summary>$FILE_NAME</summary>
|
||||
FileName = 0x30,
|
||||
/// <summary>$OBJECT_ID (NTFS 3.0+) / $VOLUME_VERSION (NTFS 1.2)</summary>
|
||||
ObjectId = 0x40,
|
||||
/// <summary>$SECURITY_DESCRIPTOR</summary>
|
||||
SecurityDescriptor = 0x50,
|
||||
/// <summary>$VOLUME_NAME</summary>
|
||||
VolumeName = 0x60,
|
||||
/// <summary>$VOLUME_INFORMATION</summary>
|
||||
VolumeInformation = 0x70,
|
||||
/// <summary>$DATA</summary>
|
||||
Data = 0x80,
|
||||
/// <summary>$INDEX_ROOT</summary>
|
||||
IndexRoot = 0x90,
|
||||
/// <summary>$INDEX_ALLOCATION</summary>
|
||||
IndexAllocation = 0xa0,
|
||||
/// <summary>$BITMAP</summary>
|
||||
Bitmap = 0xb0,
|
||||
/// <summary>$REPARSE_POINT (NTFS 3.0+) / $SYMBOLIC_LINK (NTFS 1.2)</summary>
|
||||
ReparsePoint = 0xc0,
|
||||
/// <summary>$EA_INFORMATION</summary>
|
||||
EaInformation = 0xd0,
|
||||
/// <summary>$EA</summary>
|
||||
Ea = 0xe0,
|
||||
/// <summary>$PROPERTY_SET</summary>
|
||||
PropertySet = 0xf0,
|
||||
/// <summary>$LOGGED_UTILITY_STREAM (NTFS 3.0+)</summary>
|
||||
LoggedUtilityStream = 0x100,
|
||||
/// <summary>First user-defined attribute</summary>
|
||||
FirstUserDefined = 0x1000,
|
||||
/// <summary>End marker</summary>
|
||||
End = 0xffffffff
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: CollationRule
|
||||
|
||||
/// <summary>Collation rules for sorting views and indexes (32-bit)</summary>
|
||||
enum CollationRule : uint
|
||||
{
|
||||
/// <summary>Binary compare (first byte most significant)</summary>
|
||||
Binary = 0x00,
|
||||
/// <summary>File name collation</summary>
|
||||
FileName = 0x01,
|
||||
/// <summary>Unicode string collation</summary>
|
||||
UnicodeString = 0x02,
|
||||
/// <summary>Ascending unsigned 32-bit values</summary>
|
||||
NtofsUlong = 0x10,
|
||||
/// <summary>Ascending SID values</summary>
|
||||
NtofsSid = 0x11,
|
||||
/// <summary>First by hash then by security_id</summary>
|
||||
NtofsSecurityHash = 0x12,
|
||||
/// <summary>Sequence of ascending unsigned 32-bit values</summary>
|
||||
NtofsUlongs = 0x13
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: AttrDefFlags
|
||||
|
||||
/// <summary>Attribute definition flags (32-bit)</summary>
|
||||
[Flags]
|
||||
enum AttrDefFlags : uint
|
||||
{
|
||||
/// <summary>Attribute can be indexed</summary>
|
||||
Indexable = 0x02,
|
||||
/// <summary>Attribute can be present multiple times</summary>
|
||||
Multiple = 0x04,
|
||||
/// <summary>Attribute value must contain at least one non-zero byte</summary>
|
||||
NotZero = 0x08,
|
||||
/// <summary>Attribute must be indexed and the value must be unique</summary>
|
||||
IndexedUnique = 0x10,
|
||||
/// <summary>Attribute must be named and the name must be unique</summary>
|
||||
NamedUnique = 0x20,
|
||||
/// <summary>Attribute must be resident</summary>
|
||||
Resident = 0x40,
|
||||
/// <summary>Always log modifications to this attribute</summary>
|
||||
AlwaysLog = 0x80
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: AttributeFlags
|
||||
|
||||
/// <summary>Attribute flags (16-bit)</summary>
|
||||
[Flags]
|
||||
enum AttributeFlags : ushort
|
||||
{
|
||||
/// <summary>Attribute is compressed</summary>
|
||||
Compressed = 0x0001,
|
||||
/// <summary>Compression method mask</summary>
|
||||
CompressionMask = 0x00ff,
|
||||
/// <summary>Attribute is encrypted</summary>
|
||||
Encrypted = 0x4000,
|
||||
/// <summary>Attribute is sparse</summary>
|
||||
Sparse = 0x8000
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: ResidentAttributeFlags
|
||||
|
||||
/// <summary>Resident attribute flags (8-bit)</summary>
|
||||
[Flags]
|
||||
enum ResidentAttributeFlags : byte
|
||||
{
|
||||
/// <summary>Attribute is referenced in an index</summary>
|
||||
Indexed = 0x01
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: FileAttributeFlags
|
||||
|
||||
/// <summary>File attribute flags (32-bit)</summary>
|
||||
[Flags]
|
||||
enum FileAttributeFlags : uint
|
||||
{
|
||||
/// <summary>File is read-only</summary>
|
||||
ReadOnly = 0x00000001,
|
||||
/// <summary>File is hidden</summary>
|
||||
Hidden = 0x00000002,
|
||||
/// <summary>System file</summary>
|
||||
System = 0x00000004,
|
||||
/// <summary>Directory</summary>
|
||||
Directory = 0x00000010,
|
||||
/// <summary>File needs archiving</summary>
|
||||
Archive = 0x00000020,
|
||||
/// <summary>Device file</summary>
|
||||
Device = 0x00000040,
|
||||
/// <summary>Normal file (no special attributes)</summary>
|
||||
Normal = 0x00000080,
|
||||
/// <summary>Temporary file</summary>
|
||||
Temporary = 0x00000100,
|
||||
/// <summary>Sparse file</summary>
|
||||
SparseFile = 0x00000200,
|
||||
/// <summary>Reparse point</summary>
|
||||
ReparsePoint = 0x00000400,
|
||||
/// <summary>File is compressed</summary>
|
||||
Compressed = 0x00000800,
|
||||
/// <summary>File data is offline</summary>
|
||||
Offline = 0x00001000,
|
||||
/// <summary>File is excluded from content indexing</summary>
|
||||
NotContentIndexed = 0x00002000,
|
||||
/// <summary>File is encrypted</summary>
|
||||
Encrypted = 0x00004000,
|
||||
/// <summary>Recall data on open (cloud/HSM)</summary>
|
||||
RecallOnOpen = 0x00040000,
|
||||
/// <summary>Duplicate file name index present</summary>
|
||||
DupFileNameIndexPresent = 0x10000000,
|
||||
/// <summary>Duplicate view index present</summary>
|
||||
DupViewIndexPresent = 0x20000000
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: FileNameNamespace
|
||||
|
||||
/// <summary>Possible namespaces for file names in NTFS (8-bit)</summary>
|
||||
enum FileNameNamespace : byte
|
||||
{
|
||||
/// <summary>POSIX namespace (case sensitive, most permissive)</summary>
|
||||
Posix = 0x00,
|
||||
/// <summary>Win32 namespace (case insensitive)</summary>
|
||||
Win32 = 0x01,
|
||||
/// <summary>DOS 8.3 namespace</summary>
|
||||
Dos = 0x02,
|
||||
/// <summary>Win32 and DOS names are identical</summary>
|
||||
Win32AndDos = 0x03
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: VolumeFlags
|
||||
|
||||
/// <summary>NTFS volume flags (16-bit)</summary>
|
||||
[Flags]
|
||||
enum VolumeFlags : ushort
|
||||
{
|
||||
/// <summary>Volume is dirty (needs chkdsk)</summary>
|
||||
IsDirty = 0x0001,
|
||||
/// <summary>Resize LogFile on next mount</summary>
|
||||
ResizeLogFile = 0x0002,
|
||||
/// <summary>Upgrade volume on mount</summary>
|
||||
UpgradeOnMount = 0x0004,
|
||||
/// <summary>Mounted on NT4</summary>
|
||||
MountedOnNt4 = 0x0008,
|
||||
/// <summary>USN journal deletion in progress</summary>
|
||||
DeleteUsnUnderway = 0x0010,
|
||||
/// <summary>Repair $ObjId on next mount</summary>
|
||||
RepairObjectId = 0x0020,
|
||||
/// <summary>Chkdsk is running</summary>
|
||||
ChkdskUnderway = 0x4000,
|
||||
/// <summary>Volume modified by chkdsk</summary>
|
||||
ModifiedByChkdsk = 0x8000
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: IndexHeaderFlags
|
||||
|
||||
/// <summary>Index header flags (8-bit)</summary>
|
||||
[Flags]
|
||||
enum IndexHeaderFlags : byte
|
||||
{
|
||||
/// <summary>Small index / leaf node</summary>
|
||||
SmallIndex = 0,
|
||||
/// <summary>Large index / internal node with sub-nodes</summary>
|
||||
LargeIndex = 1
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: IndexEntryFlags
|
||||
|
||||
/// <summary>Index entry flags (16-bit)</summary>
|
||||
[Flags]
|
||||
enum IndexEntryFlags : ushort
|
||||
{
|
||||
/// <summary>Entry points to a sub-node (index block VCN)</summary>
|
||||
Node = 0x0001,
|
||||
/// <summary>Last entry in index block/root</summary>
|
||||
End = 0x0002
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: SecurityDescriptorControl
|
||||
|
||||
/// <summary>Security descriptor control flags (16-bit)</summary>
|
||||
[Flags]
|
||||
enum SecurityDescriptorControl : ushort
|
||||
{
|
||||
/// <summary>Owner was defaulted</summary>
|
||||
OwnerDefaulted = 0x0001,
|
||||
/// <summary>Group was defaulted</summary>
|
||||
GroupDefaulted = 0x0002,
|
||||
/// <summary>DACL present</summary>
|
||||
DaclPresent = 0x0004,
|
||||
/// <summary>DACL was defaulted</summary>
|
||||
DaclDefaulted = 0x0008,
|
||||
/// <summary>SACL present</summary>
|
||||
SaclPresent = 0x0010,
|
||||
/// <summary>SACL was defaulted</summary>
|
||||
SaclDefaulted = 0x0020,
|
||||
/// <summary>DACL auto-inherit requested</summary>
|
||||
DaclAutoInheritReq = 0x0100,
|
||||
/// <summary>SACL auto-inherit requested</summary>
|
||||
SaclAutoInheritReq = 0x0200,
|
||||
/// <summary>DACL was auto-inherited</summary>
|
||||
DaclAutoInherited = 0x0400,
|
||||
/// <summary>SACL was auto-inherited</summary>
|
||||
SaclAutoInherited = 0x0800,
|
||||
/// <summary>DACL is protected from inheritance</summary>
|
||||
DaclProtected = 0x1000,
|
||||
/// <summary>SACL is protected from inheritance</summary>
|
||||
SaclProtected = 0x2000,
|
||||
/// <summary>RM control valid</summary>
|
||||
RmControlValid = 0x4000,
|
||||
/// <summary>Self-relative format</summary>
|
||||
SelfRelative = 0x8000
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: AceType
|
||||
|
||||
/// <summary>ACE types (8-bit)</summary>
|
||||
enum AceType : byte
|
||||
{
|
||||
/// <summary>Allow access</summary>
|
||||
AccessAllowed = 0,
|
||||
/// <summary>Deny access</summary>
|
||||
AccessDenied = 1,
|
||||
/// <summary>Audit access</summary>
|
||||
SystemAudit = 2,
|
||||
/// <summary>Alarm on access</summary>
|
||||
SystemAlarm = 3,
|
||||
/// <summary>Compound ACE (legacy)</summary>
|
||||
AccessAllowedCompound = 4,
|
||||
/// <summary>Allow with object-specific rights</summary>
|
||||
AccessAllowedObject = 5,
|
||||
/// <summary>Deny with object-specific rights</summary>
|
||||
AccessDeniedObject = 6,
|
||||
/// <summary>Audit with object-specific rights</summary>
|
||||
SystemAuditObject = 7,
|
||||
/// <summary>Alarm with object-specific rights</summary>
|
||||
SystemAlarmObject = 8
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: AceFlags
|
||||
|
||||
/// <summary>ACE inheritance and audit flags (8-bit)</summary>
|
||||
[Flags]
|
||||
enum AceFlags : byte
|
||||
{
|
||||
/// <summary>Files inherit this ACE</summary>
|
||||
ObjectInherit = 0x01,
|
||||
/// <summary>Subdirectories inherit this ACE</summary>
|
||||
ContainerInherit = 0x02,
|
||||
/// <summary>Stop inheritance after this level</summary>
|
||||
NoPropagateInherit = 0x04,
|
||||
/// <summary>Inherit only (not applied to current object)</summary>
|
||||
InheritOnly = 0x08,
|
||||
/// <summary>ACE was inherited</summary>
|
||||
Inherited = 0x10,
|
||||
/// <summary>Audit successful access</summary>
|
||||
SuccessfulAccess = 0x40,
|
||||
/// <summary>Audit failed access</summary>
|
||||
FailedAccess = 0x80
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: AccessRights
|
||||
|
||||
/// <summary>NTFS access rights masks (32-bit)</summary>
|
||||
[Flags]
|
||||
enum AccessRights : uint
|
||||
{
|
||||
/// <summary>Read file data / list directory contents</summary>
|
||||
ReadData = 0x00000001,
|
||||
/// <summary>Write file data / create file in directory</summary>
|
||||
WriteData = 0x00000002,
|
||||
/// <summary>Append data / create subdirectory</summary>
|
||||
AppendData = 0x00000004,
|
||||
/// <summary>Read extended attributes</summary>
|
||||
ReadEa = 0x00000008,
|
||||
/// <summary>Write extended attributes</summary>
|
||||
WriteEa = 0x00000010,
|
||||
/// <summary>Execute file / traverse directory</summary>
|
||||
Execute = 0x00000020,
|
||||
/// <summary>Delete children in directory</summary>
|
||||
DeleteChild = 0x00000040,
|
||||
/// <summary>Read attributes</summary>
|
||||
ReadAttributes = 0x00000080,
|
||||
/// <summary>Write attributes</summary>
|
||||
WriteAttributes = 0x00000100,
|
||||
/// <summary>Delete object</summary>
|
||||
Delete = 0x00010000,
|
||||
/// <summary>Read security descriptor / owner</summary>
|
||||
ReadControl = 0x00020000,
|
||||
/// <summary>Modify DACL</summary>
|
||||
WriteDac = 0x00040000,
|
||||
/// <summary>Change owner</summary>
|
||||
WriteOwner = 0x00080000,
|
||||
/// <summary>Synchronize</summary>
|
||||
Synchronize = 0x00100000,
|
||||
/// <summary>Access system ACL</summary>
|
||||
AccessSystemSecurity = 0x01000000,
|
||||
/// <summary>Maximum allowed access</summary>
|
||||
MaximumAllowed = 0x02000000,
|
||||
/// <summary>Full access</summary>
|
||||
GenericAll = 0x10000000,
|
||||
/// <summary>Generic execute</summary>
|
||||
GenericExecute = 0x20000000,
|
||||
/// <summary>Generic write</summary>
|
||||
GenericWrite = 0x40000000,
|
||||
/// <summary>Generic read</summary>
|
||||
GenericRead = 0x80000000
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: ObjectAceFlags
|
||||
|
||||
/// <summary>Object ACE flags (32-bit)</summary>
|
||||
[Flags]
|
||||
enum ObjectAceFlags : uint
|
||||
{
|
||||
/// <summary>Object type GUID present</summary>
|
||||
ObjectTypePresent = 1,
|
||||
/// <summary>Inherited object type GUID present</summary>
|
||||
InheritedObjectTypePresent = 2
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: ReparseTag
|
||||
|
||||
/// <summary>Reparse point tag values (32-bit)</summary>
|
||||
[Flags]
|
||||
enum ReparseTag : uint
|
||||
{
|
||||
/// <summary>Directory bit</summary>
|
||||
Directory = 0x10000000,
|
||||
/// <summary>Name surrogate bit (alias)</summary>
|
||||
IsAlias = 0x20000000,
|
||||
/// <summary>High-latency bit</summary>
|
||||
IsHighLatency = 0x40000000,
|
||||
/// <summary>Microsoft-owned tag</summary>
|
||||
IsMicrosoft = 0x80000000,
|
||||
/// <summary>CSV</summary>
|
||||
Csv = 0x80000009,
|
||||
/// <summary>Dedup</summary>
|
||||
Dedup = 0x80000013,
|
||||
/// <summary>DFS</summary>
|
||||
Dfs = 0x8000000A,
|
||||
/// <summary>DFSR</summary>
|
||||
Dfsr = 0x80000012,
|
||||
/// <summary>HSM</summary>
|
||||
Hsm = 0xC0000004,
|
||||
/// <summary>HSM2</summary>
|
||||
Hsm2 = 0x80000006,
|
||||
/// <summary>Junction / mount point</summary>
|
||||
MountPoint = 0xA0000003,
|
||||
/// <summary>NFS</summary>
|
||||
Nfs = 0x80000014,
|
||||
/// <summary>SIS</summary>
|
||||
Sis = 0x80000007,
|
||||
/// <summary>Symbolic link</summary>
|
||||
Symlink = 0xA000000C,
|
||||
/// <summary>WIM</summary>
|
||||
Wim = 0x80000008,
|
||||
/// <summary>DFM</summary>
|
||||
Dfm = 0x80000016,
|
||||
/// <summary>Windows Overlay Filter</summary>
|
||||
Wof = 0x80000017,
|
||||
/// <summary>WCI</summary>
|
||||
Wci = 0x80000018,
|
||||
/// <summary>Cloud</summary>
|
||||
Cloud = 0x9000001A,
|
||||
/// <summary>App execution link</summary>
|
||||
AppExecLink = 0x8000001B,
|
||||
/// <summary>GVFS</summary>
|
||||
Gvfs = 0x9000001C,
|
||||
/// <summary>WSL symlink</summary>
|
||||
LxSymlink = 0xA000001D,
|
||||
/// <summary>WSL AF_UNIX socket</summary>
|
||||
AfUnix = 0x80000023,
|
||||
/// <summary>WSL FIFO</summary>
|
||||
LxFifo = 0x80000024,
|
||||
/// <summary>WSL character device</summary>
|
||||
LxChr = 0x80000025,
|
||||
/// <summary>WSL block device</summary>
|
||||
LxBlk = 0x80000026
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: QuotaFlags
|
||||
|
||||
/// <summary>Quota entry flags (32-bit)</summary>
|
||||
[Flags]
|
||||
enum QuotaFlags : uint
|
||||
{
|
||||
/// <summary>Use default limits</summary>
|
||||
DefaultLimits = 0x00000001,
|
||||
/// <summary>Quota limit reached</summary>
|
||||
LimitReached = 0x00000002,
|
||||
/// <summary>Quota ID deleted</summary>
|
||||
IdDeleted = 0x00000004,
|
||||
/// <summary>Quota tracking enabled</summary>
|
||||
TrackingEnabled = 0x00000010,
|
||||
/// <summary>Quota enforcement enabled</summary>
|
||||
EnforcementEnabled = 0x00000020,
|
||||
/// <summary>Tracking requested</summary>
|
||||
TrackingRequested = 0x00000040,
|
||||
/// <summary>Log when threshold reached</summary>
|
||||
LogThreshold = 0x00000080,
|
||||
/// <summary>Log when limit reached</summary>
|
||||
LogLimit = 0x00000100,
|
||||
/// <summary>Quota data out of date</summary>
|
||||
OutOfDate = 0x00000200,
|
||||
/// <summary>Quota entry corrupt</summary>
|
||||
Corrupt = 0x00000400,
|
||||
/// <summary>Pending quota deletes</summary>
|
||||
PendingDeletes = 0x00000800
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: EaFlags
|
||||
|
||||
/// <summary>Extended attribute flags (8-bit)</summary>
|
||||
[Flags]
|
||||
enum EaFlags : byte
|
||||
{
|
||||
/// <summary>Critical EA — file cannot be properly interpreted without understanding this EA</summary>
|
||||
NeedEa = 0x80
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: RestartFlags
|
||||
|
||||
/// <summary>LogFile restart area flags (16-bit)</summary>
|
||||
[Flags]
|
||||
enum RestartFlags : ushort
|
||||
{
|
||||
/// <summary>Volume is clean</summary>
|
||||
VolumeIsClean = 0x0002
|
||||
}
|
||||
|
||||
#endregion
|
||||
}
|
||||
@@ -26,11 +26,12 @@
|
||||
// Copyright © 2011-2026 Natalia Portillo
|
||||
// ****************************************************************************/
|
||||
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace Aaru.Filesystems;
|
||||
|
||||
// Information from Inside Windows NT
|
||||
// Information from Inside Windows NT and the Linux kernel NTFS driver (fs/ntfs)
|
||||
/// <inheritdoc />
|
||||
/// <summary>Implements detection of the New Technology File System (NTFS)</summary>
|
||||
public sealed partial class NTFS
|
||||
@@ -111,5 +112,715 @@ public sealed partial class NTFS
|
||||
public readonly ushort signature2;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: NtfsRecordHeader
|
||||
|
||||
/// <summary>Common header for all multi-sector protected NTFS records</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct NtfsRecordHeader
|
||||
{
|
||||
/// <summary>0x000, Magic identifier (FILE, INDX, RSTR, RCRD, etc.)</summary>
|
||||
public readonly NtfsRecordMagic magic;
|
||||
/// <summary>0x004, Offset to Update Sequence Array</summary>
|
||||
public readonly ushort usa_ofs;
|
||||
/// <summary>0x006, Number of USA entries (including USN)</summary>
|
||||
public readonly ushort usa_count;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: MftRecord
|
||||
|
||||
/// <summary>MFT record header (NTFS 3.1+, 48 bytes)</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct MftRecord
|
||||
{
|
||||
/// <summary>0x000, "FILE" magic</summary>
|
||||
public readonly NtfsRecordMagic magic;
|
||||
/// <summary>0x004, Offset to Update Sequence Array</summary>
|
||||
public readonly ushort usa_ofs;
|
||||
/// <summary>0x006, Number of USA entries</summary>
|
||||
public readonly ushort usa_count;
|
||||
/// <summary>0x008, LogFile sequence number</summary>
|
||||
public readonly ulong lsn;
|
||||
/// <summary>0x010, Reuse count for this MFT record slot</summary>
|
||||
public readonly ushort sequence_number;
|
||||
/// <summary>0x012, Number of hard links</summary>
|
||||
public readonly ushort link_count;
|
||||
/// <summary>0x014, Byte offset to first attribute</summary>
|
||||
public readonly ushort attrs_offset;
|
||||
/// <summary>0x016, MFT record flags</summary>
|
||||
public readonly MftRecordFlags flags;
|
||||
/// <summary>0x018, Bytes used in this MFT record</summary>
|
||||
public readonly uint bytes_in_use;
|
||||
/// <summary>0x01C, Total allocated size of this MFT record</summary>
|
||||
public readonly uint bytes_allocated;
|
||||
/// <summary>0x020, MFT reference to base record (0 for base records)</summary>
|
||||
public readonly ulong base_mft_record;
|
||||
/// <summary>0x028, Next attribute instance number</summary>
|
||||
public readonly ushort next_attr_instance;
|
||||
/// <summary>0x02A, Reserved (NTFS 3.1+)</summary>
|
||||
public readonly ushort reserved;
|
||||
/// <summary>0x02C, This record's index in $MFT (NTFS 3.1+)</summary>
|
||||
public readonly uint mft_record_number;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: MftRecordOld
|
||||
|
||||
/// <summary>MFT record header (pre-NTFS 3.1, 42 bytes)</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct MftRecordOld
|
||||
{
|
||||
/// <summary>0x000, "FILE" magic</summary>
|
||||
public readonly NtfsRecordMagic magic;
|
||||
/// <summary>0x004, Offset to Update Sequence Array</summary>
|
||||
public readonly ushort usa_ofs;
|
||||
/// <summary>0x006, Number of USA entries</summary>
|
||||
public readonly ushort usa_count;
|
||||
/// <summary>0x008, LogFile sequence number</summary>
|
||||
public readonly ulong lsn;
|
||||
/// <summary>0x010, Reuse count for this MFT record slot</summary>
|
||||
public readonly ushort sequence_number;
|
||||
/// <summary>0x012, Number of hard links</summary>
|
||||
public readonly ushort link_count;
|
||||
/// <summary>0x014, Byte offset to first attribute</summary>
|
||||
public readonly ushort attrs_offset;
|
||||
/// <summary>0x016, MFT record flags</summary>
|
||||
public readonly MftRecordFlags flags;
|
||||
/// <summary>0x018, Bytes used in this MFT record</summary>
|
||||
public readonly uint bytes_in_use;
|
||||
/// <summary>0x01C, Total allocated size of this MFT record</summary>
|
||||
public readonly uint bytes_allocated;
|
||||
/// <summary>0x020, MFT reference to base record (0 for base records)</summary>
|
||||
public readonly ulong base_mft_record;
|
||||
/// <summary>0x028, Next attribute instance number</summary>
|
||||
public readonly ushort next_attr_instance;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: AttrDef
|
||||
|
||||
/// <summary>Attribute definition entry ($AttrDef), 160 bytes</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct AttrDef
|
||||
{
|
||||
/// <summary>0x000, Unicode attribute name (UTF-16LE, zero-terminated)</summary>
|
||||
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 0x40)]
|
||||
public readonly ushort[] name;
|
||||
/// <summary>0x080, Attribute type code</summary>
|
||||
public readonly AttributeType type;
|
||||
/// <summary>0x084, Default display rule</summary>
|
||||
public readonly uint display_rule;
|
||||
/// <summary>0x088, Default collation rule</summary>
|
||||
public readonly CollationRule collation_rule;
|
||||
/// <summary>0x08C, ATTR_DEF_* flags</summary>
|
||||
public readonly AttrDefFlags flags;
|
||||
/// <summary>0x090, Minimum attribute value size</summary>
|
||||
public readonly ulong min_size;
|
||||
/// <summary>0x098, Maximum attribute value size</summary>
|
||||
public readonly ulong max_size;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: ResidentAttributeRecord
|
||||
|
||||
/// <summary>Resident attribute record header</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct ResidentAttributeRecord
|
||||
{
|
||||
/// <summary>0x000, Attribute type</summary>
|
||||
public readonly AttributeType type;
|
||||
/// <summary>0x004, Total record length</summary>
|
||||
public readonly uint length;
|
||||
/// <summary>0x008, Always 0 for resident</summary>
|
||||
public readonly byte non_resident;
|
||||
/// <summary>0x009, Name length in Unicode characters</summary>
|
||||
public readonly byte name_length;
|
||||
/// <summary>0x00A, Offset to attribute name</summary>
|
||||
public readonly ushort name_offset;
|
||||
/// <summary>0x00C, Attribute flags</summary>
|
||||
public readonly AttributeFlags flags;
|
||||
/// <summary>0x00E, Unique instance number</summary>
|
||||
public readonly ushort instance;
|
||||
/// <summary>0x010, Attribute value size in bytes</summary>
|
||||
public readonly uint value_length;
|
||||
/// <summary>0x014, Offset to value data</summary>
|
||||
public readonly ushort value_offset;
|
||||
/// <summary>0x016, Resident attribute flags</summary>
|
||||
public readonly ResidentAttributeFlags resident_flags;
|
||||
/// <summary>0x017, Reserved</summary>
|
||||
public readonly sbyte reserved;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: NonResidentAttributeRecord
|
||||
|
||||
/// <summary>Non-resident attribute record header</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct NonResidentAttributeRecord
|
||||
{
|
||||
/// <summary>0x000, Attribute type</summary>
|
||||
public readonly AttributeType type;
|
||||
/// <summary>0x004, Total record length</summary>
|
||||
public readonly uint length;
|
||||
/// <summary>0x008, Always 1 for non-resident</summary>
|
||||
public readonly byte non_resident;
|
||||
/// <summary>0x009, Name length in Unicode characters</summary>
|
||||
public readonly byte name_length;
|
||||
/// <summary>0x00A, Offset to attribute name</summary>
|
||||
public readonly ushort name_offset;
|
||||
/// <summary>0x00C, Attribute flags</summary>
|
||||
public readonly AttributeFlags flags;
|
||||
/// <summary>0x00E, Unique instance number</summary>
|
||||
public readonly ushort instance;
|
||||
/// <summary>0x010, Lowest VCN</summary>
|
||||
public readonly ulong lowest_vcn;
|
||||
/// <summary>0x018, Highest VCN</summary>
|
||||
public readonly ulong highest_vcn;
|
||||
/// <summary>0x020, Offset to mapping pairs array</summary>
|
||||
public readonly ushort mapping_pairs_offset;
|
||||
/// <summary>0x022, Log2(clusters per compression unit), 0 if uncompressed</summary>
|
||||
public readonly byte compression_unit;
|
||||
/// <summary>0x023, Reserved</summary>
|
||||
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 5)]
|
||||
public readonly byte[] reserved;
|
||||
/// <summary>0x028, Allocated disk space in bytes</summary>
|
||||
public readonly ulong allocated_size;
|
||||
/// <summary>0x030, Logical attribute value size in bytes</summary>
|
||||
public readonly ulong data_size;
|
||||
/// <summary>0x038, Initialized portion size in bytes</summary>
|
||||
public readonly ulong initialized_size;
|
||||
/// <summary>0x040, Compressed on-disk size (only if compressed/sparse)</summary>
|
||||
public readonly ulong compressed_size;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: StandardInformationV1
|
||||
|
||||
/// <summary>$STANDARD_INFORMATION attribute (NTFS 1.2)</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct StandardInformationV1
|
||||
{
|
||||
/// <summary>0x000, File creation time</summary>
|
||||
public readonly long creation_time;
|
||||
/// <summary>0x008, Last data modification time</summary>
|
||||
public readonly long last_data_change_time;
|
||||
/// <summary>0x010, Last MFT record change time</summary>
|
||||
public readonly long last_mft_change_time;
|
||||
/// <summary>0x018, Last access time</summary>
|
||||
public readonly long last_access_time;
|
||||
/// <summary>0x020, File attribute flags</summary>
|
||||
public readonly FileAttributeFlags file_attributes;
|
||||
/// <summary>0x024, Reserved (12 bytes)</summary>
|
||||
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 12)]
|
||||
public readonly byte[] reserved;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: StandardInformationV3
|
||||
|
||||
/// <summary>$STANDARD_INFORMATION attribute (NTFS 3.0+)</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct StandardInformationV3
|
||||
{
|
||||
/// <summary>0x000, File creation time</summary>
|
||||
public readonly long creation_time;
|
||||
/// <summary>0x008, Last data modification time</summary>
|
||||
public readonly long last_data_change_time;
|
||||
/// <summary>0x010, Last MFT record change time</summary>
|
||||
public readonly long last_mft_change_time;
|
||||
/// <summary>0x018, Last access time</summary>
|
||||
public readonly long last_access_time;
|
||||
/// <summary>0x020, File attribute flags</summary>
|
||||
public readonly FileAttributeFlags file_attributes;
|
||||
/// <summary>0x024, Maximum allowed file versions (0 = versioning disabled)</summary>
|
||||
public readonly uint maximum_versions;
|
||||
/// <summary>0x028, Current version number</summary>
|
||||
public readonly uint version_number;
|
||||
/// <summary>0x02C, Class ID</summary>
|
||||
public readonly uint class_id;
|
||||
/// <summary>0x030, Owner ID (maps to $Quota via $Q index)</summary>
|
||||
public readonly uint owner_id;
|
||||
/// <summary>0x034, Security ID (maps to $Secure $SII/$SDS)</summary>
|
||||
public readonly uint security_id;
|
||||
/// <summary>0x038, Quota charge in bytes</summary>
|
||||
public readonly ulong quota_charged;
|
||||
/// <summary>0x040, Last USN from $UsnJrnl</summary>
|
||||
public readonly ulong usn;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: AttributeListEntry
|
||||
|
||||
/// <summary>$ATTRIBUTE_LIST entry</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct AttributeListEntry
|
||||
{
|
||||
/// <summary>0x000, Attribute type code</summary>
|
||||
public readonly AttributeType type;
|
||||
/// <summary>0x004, Entry length (8-byte aligned)</summary>
|
||||
public readonly ushort length;
|
||||
/// <summary>0x006, Attribute name length in Unicode characters</summary>
|
||||
public readonly byte name_length;
|
||||
/// <summary>0x007, Offset to attribute name</summary>
|
||||
public readonly byte name_offset;
|
||||
/// <summary>0x008, Lowest VCN of this attribute extent</summary>
|
||||
public readonly ulong lowest_vcn;
|
||||
/// <summary>0x010, MFT reference to record holding this attribute</summary>
|
||||
public readonly ulong mft_reference;
|
||||
/// <summary>0x018, Attribute instance number</summary>
|
||||
public readonly ushort instance;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: FileNameAttribute
|
||||
|
||||
/// <summary>$FILE_NAME attribute (type 0x30), always resident</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct FileNameAttribute
|
||||
{
|
||||
/// <summary>0x000, MFT reference to parent directory</summary>
|
||||
public readonly ulong parent_directory;
|
||||
/// <summary>0x008, File creation time</summary>
|
||||
public readonly long creation_time;
|
||||
/// <summary>0x010, Last data modification time</summary>
|
||||
public readonly long last_data_change_time;
|
||||
/// <summary>0x018, Last MFT record change time</summary>
|
||||
public readonly long last_mft_change_time;
|
||||
/// <summary>0x020, Last access time</summary>
|
||||
public readonly long last_access_time;
|
||||
/// <summary>0x028, Allocated size of unnamed $DATA</summary>
|
||||
public readonly ulong allocated_size;
|
||||
/// <summary>0x030, Logical size of unnamed $DATA</summary>
|
||||
public readonly ulong data_size;
|
||||
/// <summary>0x038, File attribute flags</summary>
|
||||
public readonly FileAttributeFlags file_attributes;
|
||||
/// <summary>0x03C, EA packed size or reparse point tag</summary>
|
||||
public readonly uint ea_reparse;
|
||||
/// <summary>0x040, File name length in Unicode characters</summary>
|
||||
public readonly byte file_name_length;
|
||||
/// <summary>0x041, File name namespace</summary>
|
||||
public readonly FileNameNamespace file_name_type;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: ObjectIdAttribute
|
||||
|
||||
/// <summary>$OBJECT_ID attribute (NTFS 3.0+), always resident, 16–64 bytes</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct ObjectIdAttribute
|
||||
{
|
||||
/// <summary>0x000, Unique object GUID</summary>
|
||||
public readonly Guid object_id;
|
||||
/// <summary>0x010, Birth volume GUID (optional)</summary>
|
||||
public readonly Guid birth_volume_id;
|
||||
/// <summary>0x020, Birth object GUID (optional)</summary>
|
||||
public readonly Guid birth_object_id;
|
||||
/// <summary>0x030, Domain GUID (optional, usually zero)</summary>
|
||||
public readonly Guid domain_id;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: NtfsSid
|
||||
|
||||
/// <summary>Security Identifier (SID) fixed header</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct NtfsSid
|
||||
{
|
||||
/// <summary>0x000, SID revision level (usually 1)</summary>
|
||||
public readonly byte revision;
|
||||
/// <summary>0x001, Number of sub-authorities</summary>
|
||||
public readonly byte sub_authority_count;
|
||||
/// <summary>0x002, 6-byte identifier authority</summary>
|
||||
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 6)]
|
||||
public readonly byte[] identifier_authority;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: NtfsAce
|
||||
|
||||
/// <summary>Access Control Entry (ACE) fixed header</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct NtfsAce
|
||||
{
|
||||
/// <summary>0x000, ACE type</summary>
|
||||
public readonly AceType type;
|
||||
/// <summary>0x001, Inheritance and audit flags</summary>
|
||||
public readonly AceFlags flags;
|
||||
/// <summary>0x002, Total ACE size in bytes</summary>
|
||||
public readonly ushort size;
|
||||
/// <summary>0x004, Access rights mask</summary>
|
||||
public readonly AccessRights mask;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: NtfsAcl
|
||||
|
||||
/// <summary>Access Control List (ACL) header, 8 bytes</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct NtfsAcl
|
||||
{
|
||||
/// <summary>0x000, ACL revision (2 or 4)</summary>
|
||||
public readonly byte revision;
|
||||
/// <summary>0x001, Padding</summary>
|
||||
public readonly byte alignment1;
|
||||
/// <summary>0x002, Total ACL size in bytes (header + ACEs)</summary>
|
||||
public readonly ushort size;
|
||||
/// <summary>0x004, Number of ACEs</summary>
|
||||
public readonly ushort ace_count;
|
||||
/// <summary>0x006, Padding</summary>
|
||||
public readonly ushort alignment2;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: SecurityDescriptorRelative
|
||||
|
||||
/// <summary>Self-relative security descriptor, 20 bytes</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct SecurityDescriptorRelative
|
||||
{
|
||||
/// <summary>0x000, Revision (usually 1)</summary>
|
||||
public readonly byte revision;
|
||||
/// <summary>0x001, Padding</summary>
|
||||
public readonly byte alignment;
|
||||
/// <summary>0x002, Control flags</summary>
|
||||
public readonly SecurityDescriptorControl control;
|
||||
/// <summary>0x004, Offset to owner SID</summary>
|
||||
public readonly uint owner;
|
||||
/// <summary>0x008, Offset to group SID</summary>
|
||||
public readonly uint group;
|
||||
/// <summary>0x00C, Offset to SACL</summary>
|
||||
public readonly uint sacl;
|
||||
/// <summary>0x010, Offset to DACL</summary>
|
||||
public readonly uint dacl;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: SiiIndexKey
|
||||
|
||||
/// <summary>Key for $SII index in $Secure</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct SiiIndexKey
|
||||
{
|
||||
/// <summary>0x000, Security identifier</summary>
|
||||
public readonly uint security_id;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: SdhIndexKey
|
||||
|
||||
/// <summary>Key for $SDH index in $Secure</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct SdhIndexKey
|
||||
{
|
||||
/// <summary>0x000, Hash of security descriptor</summary>
|
||||
public readonly uint hash;
|
||||
/// <summary>0x004, Security identifier</summary>
|
||||
public readonly uint security_id;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: VolumeInformation
|
||||
|
||||
/// <summary>$VOLUME_INFORMATION attribute (type 0x70), always resident</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct VolumeInformation
|
||||
{
|
||||
/// <summary>0x000, Reserved</summary>
|
||||
public readonly ulong reserved;
|
||||
/// <summary>0x008, NTFS major version number</summary>
|
||||
public readonly byte major_ver;
|
||||
/// <summary>0x009, NTFS minor version number</summary>
|
||||
public readonly byte minor_ver;
|
||||
/// <summary>0x00A, Volume flags</summary>
|
||||
public readonly VolumeFlags flags;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: IndexHeader
|
||||
|
||||
/// <summary>Common header for index entries in index root and index blocks</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct IndexHeader
|
||||
{
|
||||
/// <summary>0x000, Byte offset to first INDEX_ENTRY (relative to this header)</summary>
|
||||
public readonly uint entries_offset;
|
||||
/// <summary>0x004, Bytes used by index entries</summary>
|
||||
public readonly uint index_length;
|
||||
/// <summary>0x008, Total allocated bytes for this index</summary>
|
||||
public readonly uint allocated_size;
|
||||
/// <summary>0x00C, Index flags (SMALL_INDEX / LARGE_INDEX)</summary>
|
||||
public readonly IndexHeaderFlags flags;
|
||||
/// <summary>0x00D, Reserved (3 bytes)</summary>
|
||||
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 3)]
|
||||
public readonly byte[] reserved;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: IndexRoot
|
||||
|
||||
/// <summary>$INDEX_ROOT attribute (type 0x90), always resident</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct IndexRoot
|
||||
{
|
||||
/// <summary>0x000, Attribute type being indexed ($FILE_NAME for directories, 0 for view indexes)</summary>
|
||||
public readonly AttributeType type;
|
||||
/// <summary>0x004, Collation rule for sorting entries</summary>
|
||||
public readonly CollationRule collation_rule;
|
||||
/// <summary>0x008, Size of each index block in bytes</summary>
|
||||
public readonly uint index_block_size;
|
||||
/// <summary>0x00C, Clusters per index block</summary>
|
||||
public readonly byte clusters_per_index_block;
|
||||
/// <summary>0x00D, Reserved (3 bytes)</summary>
|
||||
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 3)]
|
||||
public readonly byte[] reserved;
|
||||
/// <summary>0x010, Index header</summary>
|
||||
public readonly IndexHeader index;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: IndexBlock
|
||||
|
||||
/// <summary>Index allocation block ($INDEX_ALLOCATION, type 0xa0), 40-byte header</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct IndexBlock
|
||||
{
|
||||
/// <summary>0x000, "INDX" magic</summary>
|
||||
public readonly NtfsRecordMagic magic;
|
||||
/// <summary>0x004, Offset to Update Sequence Array</summary>
|
||||
public readonly ushort usa_ofs;
|
||||
/// <summary>0x006, Number of USA entries</summary>
|
||||
public readonly ushort usa_count;
|
||||
/// <summary>0x008, Log sequence number of last modification</summary>
|
||||
public readonly ulong lsn;
|
||||
/// <summary>0x010, VCN of this index block</summary>
|
||||
public readonly ulong index_block_vcn;
|
||||
/// <summary>0x018, Index header</summary>
|
||||
public readonly IndexHeader index;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: IndexEntryHeader
|
||||
|
||||
/// <summary>Index entry header (fixed 16-byte part of every index entry)</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct IndexEntryHeader
|
||||
{
|
||||
/// <summary>0x000, MFT reference of indexed file (directory index) or data offset/length (view index)</summary>
|
||||
public readonly ulong indexed_file_or_data;
|
||||
/// <summary>0x008, Total entry size in bytes</summary>
|
||||
public readonly ushort length;
|
||||
/// <summary>0x00A, Key size in bytes</summary>
|
||||
public readonly ushort key_length;
|
||||
/// <summary>0x00C, Index entry flags</summary>
|
||||
public readonly IndexEntryFlags flags;
|
||||
/// <summary>0x00E, Reserved</summary>
|
||||
public readonly ushort reserved;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: ReparseIndexKey
|
||||
|
||||
/// <summary>Key for $R index in $Extend/$Reparse</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct ReparseIndexKey
|
||||
{
|
||||
/// <summary>0x000, Reparse point tag</summary>
|
||||
public readonly ReparseTag reparse_tag;
|
||||
/// <summary>0x004, MFT record number of the file</summary>
|
||||
public readonly ulong file_id;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: ReparsePointAttribute
|
||||
|
||||
/// <summary>$REPARSE_POINT attribute (type 0xc0)</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct ReparsePointAttribute
|
||||
{
|
||||
/// <summary>0x000, Reparse point type and flags</summary>
|
||||
public readonly ReparseTag reparse_tag;
|
||||
/// <summary>0x004, Size of reparse data in bytes</summary>
|
||||
public readonly ushort reparse_data_length;
|
||||
/// <summary>0x006, Reserved</summary>
|
||||
public readonly ushort reserved;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: EaInformation
|
||||
|
||||
/// <summary>$EA_INFORMATION attribute (type 0xd0), always resident</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct EaInformation
|
||||
{
|
||||
/// <summary>0x000, Packed EA size in bytes</summary>
|
||||
public readonly ushort ea_length;
|
||||
/// <summary>0x002, Number of EAs with NEED_EA flag set</summary>
|
||||
public readonly ushort need_ea_count;
|
||||
/// <summary>0x004, Unpacked EA query size in bytes</summary>
|
||||
public readonly uint ea_query_length;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: EaAttribute
|
||||
|
||||
/// <summary>Extended attribute entry ($EA, type 0xe0) fixed header</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct EaAttribute
|
||||
{
|
||||
/// <summary>0x000, Offset to next EA entry</summary>
|
||||
public readonly uint next_entry_offset;
|
||||
/// <summary>0x004, EA flags (NEED_EA = 0x80)</summary>
|
||||
public readonly EaFlags flags;
|
||||
/// <summary>0x005, EA name length in bytes (excluding NUL terminator)</summary>
|
||||
public readonly byte ea_name_length;
|
||||
/// <summary>0x006, EA value length in bytes</summary>
|
||||
public readonly ushort ea_value_length;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: QuotaControlEntry
|
||||
|
||||
/// <summary>Quota control entry in $Quota/$Q (fixed part)</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct QuotaControlEntry
|
||||
{
|
||||
/// <summary>0x000, Version (currently 2)</summary>
|
||||
public readonly uint version;
|
||||
/// <summary>0x004, Quota flags</summary>
|
||||
public readonly QuotaFlags flags;
|
||||
/// <summary>0x008, Current quota usage in bytes</summary>
|
||||
public readonly ulong bytes_used;
|
||||
/// <summary>0x010, Last modification time</summary>
|
||||
public readonly long change_time;
|
||||
/// <summary>0x018, Soft quota limit (-1 = unlimited)</summary>
|
||||
public readonly long threshold;
|
||||
/// <summary>0x020, Hard quota limit (-1 = unlimited)</summary>
|
||||
public readonly long limit;
|
||||
/// <summary>0x028, Time when soft quota was exceeded</summary>
|
||||
public readonly long exceeded_time;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: RestartPageHeader
|
||||
|
||||
/// <summary>LogFile restart page header ($LogFile, magic "RSTR")</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct RestartPageHeader
|
||||
{
|
||||
/// <summary>0x000, "RSTR" magic</summary>
|
||||
public readonly NtfsRecordMagic magic;
|
||||
/// <summary>0x004, Offset to Update Sequence Array</summary>
|
||||
public readonly ushort usa_ofs;
|
||||
/// <summary>0x006, Number of USA entries</summary>
|
||||
public readonly ushort usa_count;
|
||||
/// <summary>0x008, Last LSN found by chkdsk</summary>
|
||||
public readonly ulong chkdsk_lsn;
|
||||
/// <summary>0x010, System page size in bytes</summary>
|
||||
public readonly uint system_page_size;
|
||||
/// <summary>0x014, Log page size in bytes</summary>
|
||||
public readonly uint log_page_size;
|
||||
/// <summary>0x018, Byte offset to restart area</summary>
|
||||
public readonly ushort restart_area_offset;
|
||||
/// <summary>0x01A, Log file minor version</summary>
|
||||
public readonly ushort minor_ver;
|
||||
/// <summary>0x01C, Log file major version</summary>
|
||||
public readonly ushort major_ver;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: RestartArea
|
||||
|
||||
/// <summary>LogFile restart area record</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct RestartArea
|
||||
{
|
||||
/// <summary>0x000, Current/last LSN</summary>
|
||||
public readonly ulong current_lsn;
|
||||
/// <summary>0x008, Number of log client records</summary>
|
||||
public readonly ushort log_clients;
|
||||
/// <summary>0x00A, Index of first free client record</summary>
|
||||
public readonly ushort client_free_list;
|
||||
/// <summary>0x00C, Index of first in-use client record</summary>
|
||||
public readonly ushort client_in_use_list;
|
||||
/// <summary>0x00E, Restart area flags</summary>
|
||||
public readonly RestartFlags flags;
|
||||
/// <summary>0x010, Bits used for sequence number</summary>
|
||||
public readonly uint seq_number_bits;
|
||||
/// <summary>0x014, Length of restart area including client array</summary>
|
||||
public readonly ushort restart_area_length;
|
||||
/// <summary>0x016, Offset to first log client record</summary>
|
||||
public readonly ushort client_array_offset;
|
||||
/// <summary>0x018, Usable log file size in bytes</summary>
|
||||
public readonly ulong file_size;
|
||||
/// <summary>0x020, Last LSN data length</summary>
|
||||
public readonly uint last_lsn_data_length;
|
||||
/// <summary>0x024, Log record header size</summary>
|
||||
public readonly ushort log_record_header_length;
|
||||
/// <summary>0x026, Offset to data in log page</summary>
|
||||
public readonly ushort log_page_data_offset;
|
||||
/// <summary>0x028, Log open count (incremented each mount)</summary>
|
||||
public readonly uint restart_log_open_count;
|
||||
/// <summary>0x02C, Reserved</summary>
|
||||
public readonly uint reserved;
|
||||
}
|
||||
|
||||
#endregion
|
||||
|
||||
#region Nested type: LogClientRecord
|
||||
|
||||
/// <summary>LogFile client record</summary>
|
||||
[StructLayout(LayoutKind.Sequential, Pack = 1)]
|
||||
readonly struct LogClientRecord
|
||||
{
|
||||
/// <summary>0x000, Oldest LSN needed by this client</summary>
|
||||
public readonly ulong oldest_lsn;
|
||||
/// <summary>0x008, Client restart position LSN</summary>
|
||||
public readonly ulong client_restart_lsn;
|
||||
/// <summary>0x010, Previous client record index</summary>
|
||||
public readonly ushort prev_client;
|
||||
/// <summary>0x012, Next client record index</summary>
|
||||
public readonly ushort next_client;
|
||||
/// <summary>0x014, Sequence number</summary>
|
||||
public readonly ushort seq_number;
|
||||
/// <summary>0x016, Reserved (6 bytes)</summary>
|
||||
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 6)]
|
||||
public readonly byte[] reserved;
|
||||
/// <summary>0x01C, Client name length in bytes</summary>
|
||||
public readonly uint client_name_length;
|
||||
/// <summary>0x020, Client name in Unicode (usually "NTFS")</summary>
|
||||
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 64)]
|
||||
public readonly ushort[] client_name;
|
||||
}
|
||||
|
||||
#endregion
|
||||
}
|
||||
Reference in New Issue
Block a user