// /*************************************************************************** // Aaru Data Preservation Suite // ---------------------------------------------------------------------------- // // Filename : Structs.cs // Author(s) : Natalia Portillo // // Component : Microsoft NT File System plugin. // // --[ License ] -------------------------------------------------------------- // // This library is free software; you can redistribute it and/or modify // it under the terms of the GNU Lesser General Public License as // published by the Free Software Foundation; either version 2.1 of the // License, or (at your option) any later version. // // This library is distributed in the hope that it will be useful, but // WITHOUT ANY WARRANTY; without even the implied warranty of // MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU // Lesser General Public License for more details. // // You should have received a copy of the GNU Lesser General Public // License along with this library; if not, see . // // ---------------------------------------------------------------------------- // Copyright © 2011-2025 Natalia Portillo // ****************************************************************************/ using System.Runtime.InteropServices; namespace Aaru.Filesystems; // Information from Inside Windows NT /// /// Implements detection of the New Technology File System (NTFS) public sealed partial class NTFS { #region Nested type: BiosParameterBlock /// NTFS $BOOT [StructLayout(LayoutKind.Sequential, Pack = 1)] readonly struct BiosParameterBlock { // Start of BIOS Parameter Block /// 0x000, Jump to boot code [MarshalAs(UnmanagedType.ByValArray, SizeConst = 3)] public readonly byte[] jump; /// 0x003, OEM Name, 8 bytes, space-padded, must be "NTFS " [MarshalAs(UnmanagedType.ByValArray, SizeConst = 8)] public readonly byte[] oem_name; /// 0x00B, Bytes per sector public readonly ushort bps; /// 0x00D, Sectors per cluster public readonly byte spc; /// 0x00E, Reserved sectors, seems 0 public readonly ushort rsectors; /// 0x010, Number of FATs... obviously, 0 public readonly byte fats_no; /// 0x011, Number of entries on root directory... 0 public readonly ushort root_ent; /// 0x013, Sectors in volume... 0 public readonly ushort sml_sectors; /// 0x015, Media descriptor public readonly byte media; /// 0x016, Sectors per FAT... 0 public readonly ushort spfat; /// 0x018, Sectors per track, required to boot public readonly ushort sptrk; /// 0x01A, Heads... required to boot public readonly ushort heads; /// 0x01C, Hidden sectors before BPB public readonly uint hsectors; /// 0x020, Sectors in volume if > 65535... 0 public readonly uint big_sectors; /// 0x024, Drive number public readonly byte drive_no; /// 0x025, 0 public readonly byte nt_flags; /// 0x026, EPB signature, 0x80 public readonly byte signature1; /// 0x027, Alignment public readonly byte dummy; // End of BIOS Parameter Block // Start of NTFS real superblock /// 0x028, Sectors on volume public readonly long sectors; /// 0x030, LSN of $MFT public readonly long mft_lsn; /// 0x038, LSN of $MFTMirror public readonly long mftmirror_lsn; /// 0x040, Clusters per MFT record public readonly sbyte mft_rc_clusters; /// 0x041, Alignment public readonly byte dummy2; /// 0x042, Alignment public readonly ushort dummy3; /// 0x044, Clusters per index block public readonly sbyte index_blk_cts; /// 0x045, Alignment public readonly byte dummy4; /// 0x046, Alignment public readonly ushort dummy5; /// 0x048, Volume serial number public readonly ulong serial_no; /// Boot code. [MarshalAs(UnmanagedType.ByValArray, SizeConst = 430)] public readonly byte[] boot_code; /// 0x1FE, 0xAA55 public readonly ushort signature2; } #endregion }