Main Page | Data Structures | Directories | File List | Data Fields | Globals

ntfs.h

00001 /*
00002 ** The Sleuth Kit
00003 **
00004 ** $Date: 2007/04/19 19:01:35 $
00005 **
00006 ** Brian Carrier [carrier@sleuthkit.org]
00007 ** Copyright (c) 2003-2005 Brian Carrier.  All rights reserved
00008 **
00009 ** TASK
00010 ** Copyright (c) 2002 @stake Inc.  All rights reserved
00011 */
00012 
00013 #ifndef _NTFS_H
00014 #define _NTFS_H
00015 
00016 #ifdef __cplusplus
00017 extern "C" {
00018 #endif
00019 
00020 //#define NTFS_FS_MAGIC 0x5346544E      /* "NTFS" in little endian */
00021 #define NTFS_FS_MAGIC   0xAA55
00022 #define NTFS_DEV_BSIZE  512
00023 
00024 #define NTFS_MAXNAMLEN  256
00025 #define NTFS_MAXNAMLEN_UTF8     4 * NTFS_MAXNAMLEN
00026 
00027 /* location of the Root Directory inode */
00028 #define NTFS_ROOTINO    NTFS_MFT_ROOT
00029 #define NTFS_FIRSTINO   0       /* location of the $Mft Record */
00030 #define NTFS_LAST_DEFAULT_INO   16      /* A guess for right now */
00031 
00032 #define NTFS_NDADDR                     0
00033 #define NTFS_NIADDR                     0
00034 
00035 /* uncompression values */
00036 #define NTFS_TOKEN_MASK   1
00037 #define NTFS_SYMBOL_TOKEN 0
00038 #define NTFS_TOKEN_LENGTH 8
00039 /* (64 * 1024) = 65536 */
00040 #define NTFS_MAX_UNCOMPRESSION_BUFFER_SIZE 65536
00041 
00042 
00043 
00044 /************************************************************************
00045  * Update sequence structure.  This is located at upd_off from the
00046  * begining of the original structure
00047  */
00048     typedef struct {
00049         uint8_t upd_val[2];     // what they should be 
00050         uint8_t upd_seq;        // array of size 2*(upd_cnt-1) w/orig vals
00051     } ntfs_upd;
00052 
00053 
00054 /************************************************************************
00055  * bootsector
00056  *
00057  * located in sector 0 in $Boot
00058  */
00059     typedef struct {
00060         uint8_t f1[3];          // 0
00061         char oemname[8];        // 3
00062         uint8_t ssize[2];       // 11   /* sector size in bytes */
00063         uint8_t csize;          // 13  /* sectors per cluster */
00064         uint8_t f2[26];         // 14
00065         uint8_t vol_size_s[8];  // 40   /*size of volume in sectors */
00066         uint8_t mft_clust[8];   // 48   /* location of MFT */
00067         uint8_t mftm_clust[8];  // 56    /* location of MFT mirror */
00068         int8_t mft_rsize_c;     // 64      /* number of clusters per mft record */
00069         uint8_t f3[3];
00070         int8_t idx_rsize_c;     // 68      /* number of clus per idx rec */
00071         uint8_t f4[3];
00072         uint8_t serial[8];      // 72   /* serial number */
00073         uint8_t f5[430];        //80
00074         uint8_t magic[2];
00075     } ntfs_sb;
00076 
00077 
00078 
00079 /************************************************************************
00080  * MFT Entry
00081  *
00082  * One entry in the MFT - there exists one for each file
00083  */
00084     typedef struct {
00085         uint8_t magic[4];
00086         uint8_t upd_off[2];     // 4
00087         uint8_t upd_cnt[2];     // 6  size+1
00088         uint8_t lsn[8];         // 8  $LogFile Sequence Number
00089         uint8_t seq[2];         // 16
00090         uint8_t link[2];        // 18
00091         uint8_t attr_off[2];    // 20
00092         uint8_t flags[2];       // 22
00093         uint8_t size[4];        // 24
00094         uint8_t alloc_size[4];  //28
00095         uint8_t base_ref[6];    // 32 
00096         uint8_t base_seq[2];    // 38 
00097         uint8_t next_attrid[2]; // 40 The next id to be assigned
00098         uint8_t f1[2];          // XP Only
00099         uint8_t entry[4];       // XP Only - Number of this entry
00100     } ntfs_mft;
00101 
00102 /* Magic values for each MFT entry */
00103 #define NTFS_MFT_MAGIC  0x454c4946
00104 #define NTFS_MFT_MAGIC_BAAD     0x44414142
00105 #define NTFS_MFT_MAGIC_ZERO     0x00000000
00106 
00107 /* MFT entry flags */
00108 #define NTFS_MFT_INUSE  0x0001
00109 #define NTFS_MFT_DIR    0x0002
00110 
00111 /* flags for file_ref */
00112 #define NTFS_MFT_BASE           0       /* set when the base file record */
00113 /* Mask when not zero, which indicates the base file record */
00114 #define NTFS_MFT_FILE_REC       0x00ffffffffffffff
00115 
00116 /* DEFINED MFT entries - file system metadata files */
00117 #define NTFS_MFT_MFT    0x0
00118 #define NTFS_MFT_MFTMIR 0x1
00119 #define NTFS_MFT_LOG    0x2
00120 #define NTFS_MFT_VOL    0x3
00121 #define NTFS_MFT_ATTR   0x4
00122 #define NTFS_MFT_ROOT   0x5
00123 #define NTFS_MFT_BMAP   0x6
00124 #define NTFS_MFT_BOOT   0x7
00125 #define NTFS_MFT_BAD    0x8
00126 //#define NTFS_MFT_QUOT 0x9
00127 #define NTFS_MFT_SECURE 0x9
00128 #define NTFS_MFT_UPCASE 0xA
00129 
00130 
00131 
00132 /************************************************************************
00133  * Attribute Header for resident and non-resident attributes
00134  */
00135     typedef struct {
00136         uint8_t type[4];
00137         uint8_t len[4];         // 4 - length including header
00138         uint8_t res;            // 8 - resident flag
00139         uint8_t nlen;           // 9 - name length
00140         uint8_t name_off[2];    // 10 - offset to name 
00141         uint8_t flags[2];       // 12  
00142         uint8_t id[2];          // 14 - unique identifier
00143 
00144         union {
00145             /* Resident Values */
00146             struct {
00147                 uint8_t ssize[4];       // 16 - size of content
00148                 uint8_t soff[2];        // 20 - offset to content (after name)
00149                 uint8_t idxflag[2];     // 22 - indexed flag 
00150             } r;
00151             /* Non-resident Values */
00152             struct {
00153                 uint8_t start_vcn[8];   // 16 - starting VCN of this attribute
00154                 uint8_t last_vcn[8];    // 24
00155                 uint8_t run_off[2];     // 32 - offset to the data runs (after name)
00156                 uint8_t compusize[2];   // 34 - compression unit size (2^x)
00157                 uint8_t f1[4];  // 36
00158                 uint8_t alen[8];        // 40   allocated size of stream
00159                 uint8_t ssize[8];       // 48   actual size of stream
00160                 uint8_t initsize[8];    // 56   initialized steam size
00161             } nr;
00162         } c;
00163     } ntfs_attr;
00164 
00165 /* values for the res field */
00166 #define NTFS_MFT_RES    0       /* resident */
00167 #define NTFS_MFT_NONRES 1       /* non-resident */
00168 
00169 
00170 /* Values for flag field 
00171  * should only exist for $DATA attributes */
00172 #define NTFS_ATTR_FLAG_COMP     0x0001  /* compressed */
00173 #define NTFS_ATTR_FLAG_ENC      0x4000  /* encrypted */
00174 #define NTFS_ATTR_FLAG_SPAR     0x8000  /* sparse */
00175 
00176 
00177 
00178 /* values for the type field */
00179 #define NTFS_ATYPE_SI       0x10        // 16
00180 #define NTFS_ATYPE_ATTRLIST 0x20        // 32
00181 #define NTFS_ATYPE_FNAME    0x30        // 48
00182 #define NTFS_ATYPE_VVER     0x40        // 64 (NT)
00183 #define NTFS_ATYPE_OBJID    0x40        // 64 (2K)
00184 #define NTFS_ATYPE_SEC      0x50        // 80
00185 #define NTFS_ATYPE_VNAME    0x60        // 96
00186 #define NTFS_ATYPE_VINFO    0x70        // 112
00187 #define NTFS_ATYPE_DATA     0x80        // 128
00188 #define NTFS_ATYPE_IDXROOT  0x90        // 144
00189 #define NTFS_ATYPE_IDXALLOC 0xA0        // 160
00190 #define NTFS_ATYPE_BITMAP   0xB0        // 176
00191 #define NTFS_ATYPE_SYMLNK   0xC0        // 192 (NT)
00192 #define NTFS_ATYPE_REPARSE  0xC0        // 192 (2K)
00193 #define NTFS_ATYPE_EAINFO   0xD0        // 208
00194 #define NTFS_ATYPE_EA       0xE0        // 224
00195 #define NTFS_ATYPE_PROP     0xF0        //  (NT)
00196 #define NTFS_ATYPE_LOG      0x100       //  (2K)
00197 
00198 
00199 
00200 
00201 /************************************************************************
00202  * File Name Attribute
00203  */
00204     typedef struct {
00205         uint8_t par_ref[6];     /* file reference to base File Record of parent */
00206         uint8_t par_seq[2];     /* seq num to base File Record of parent */
00207         uint8_t crtime[8];      /* file creation */
00208         uint8_t mtime[8];       /* file altered */
00209         uint8_t ctime[8];       /* mod time for FILE record (MFT Entry) */
00210         uint8_t atime[8];       /* access time */
00211         uint8_t alloc_fsize[8];
00212         uint8_t real_fsize[8];
00213         uint8_t flags[8];
00214         uint8_t nlen;           /* length of file name */
00215         uint8_t nspace;
00216         uint8_t name;           /* in unicode */
00217     } ntfs_attr_fname;
00218 
00219 /* values for the flags field of attr_fname */
00220 #define NTFS_FNAME_FLAGS_RO             0x0000000000000001
00221 #define NTFS_FNAME_FLAGS_HID    0x0000000000000002
00222 #define NTFS_FNAME_FLAGS_SYS    0x0000000000000004
00223 #define NTFS_FNAME_FLAGS_ARCH   0x0000000000000020
00224 #define NTFS_FNAME_FLAGS_DEV    0x0000000000000040
00225 #define NTFS_FNAME_FLAGS_NORM   0x0000000000000080
00226 #define NTFS_FNAME_FLAGS_TEMP   0x0000000000000100
00227 #define NTFS_FNAME_FLAGS_SPAR   0x0000000000000200
00228 #define NTFS_FNAME_FLAGS_REP    0x0000000000000400
00229 #define NTFS_FNAME_FLAGS_COMP   0x0000000000000800
00230 #define NTFS_FNAME_FLAGS_OFF    0x0000000000001000
00231 #define NTFS_FNAME_FLAGS_NOIDX  0x0000000000002000
00232 #define NTFS_FNAME_FLAGS_ENC    0x0000000000004000
00233 #define NTFS_FNAME_FLAGS_DIR            0x0000000010000000
00234 #define NTFS_FNAME_FLAGS_IDXVIEW        0x0000000020000000
00235 
00236 
00237 /* values for the name space values of nspace */
00238 #define NTFS_FNAME_POSIX        0       /* case sensitive  and any but NULL and \ */
00239 #define NTFS_FNAME_WIN32        1       // insensitive and restricted
00240 #define NTFS_FNAME_DOS          2       // 8.3 format of 8-bit chars in uppercase
00241 #define NTFS_FNAME_WINDOS       3       // name in WIN32 space that is already DOS
00242 
00243 
00244 
00245 
00246 /************************************************************************
00247  * Standard Information Attribute
00248  */
00249     typedef struct {
00250         uint8_t crtime[8];      /* creation date */
00251         uint8_t mtime[8];       /* file altered */
00252         uint8_t ctime[8];       /* MFT Changed */
00253         uint8_t atime[8];       /* last access (read) */
00254         uint8_t dos[4];         /* permissions in DOS Format */
00255         uint8_t maxver[4];
00256         uint8_t ver[4];
00257         uint8_t class_id[4];
00258         uint8_t own_id[4];
00259         uint8_t sec_id[4];
00260         uint8_t quota[8];
00261         uint8_t usn[8];
00262     } ntfs_attr_si;
00263 
00264 
00265 /* DOS Flags values */
00266 #define NTFS_SI_RO              0x0001
00267 #define NTFS_SI_HID             0x0002
00268 #define NTFS_SI_SYS             0x0004
00269 #define NTFS_SI_ARCH    0x0020
00270 #define NTFS_SI_DEV             0x0040
00271 #define NTFS_SI_NORM    0x0080
00272 #define NTFS_SI_TEMP    0x0100
00273 #define NTFS_SI_SPAR    0x0200
00274 #define NTFS_SI_REP             0x0400
00275 #define NTFS_SI_COMP    0x0800
00276 #define NTFS_SI_OFF             0x1000
00277 #define NTFS_SI_NOIDX   0x2000
00278 #define NTFS_SI_ENC             0x4000
00279 
00280 
00281 
00282 /************************************************************************
00283  * Volume Info Attribute
00284  */
00285     typedef struct {
00286         uint8_t f1[8];
00287         uint8_t maj_ver;
00288         uint8_t min_ver;
00289         uint8_t flags[2];
00290         uint8_t f2[4];
00291     } ntfs_attr_vinfo;
00292 
00293 #define NTFS_VINFO_DIRTY        0x0001  // Dirty
00294 #define NTFS_VINFO_RESLOG       0x0002  // Resize LogFile
00295 #define NTFS_VINFO_UPGRAD       0x0004  // Upgrade on Mount
00296 #define NTFS_VINFO_MNTNT4       0x0008  // Mounted on NT4
00297 #define NTFS_VINFO_DELUSN       0x0010  // Delete USN Underway
00298 #define NTFS_VINFO_REPOBJ       0x0020  // Repair Object Ids
00299 #define NTFS_VINFO_MODCHK       0x8000  // Modified by chkdsk
00300 
00301 /* versions 
00302  * NT = Maj=1 Min=2
00303  * 2k = Maj=3 Min=0
00304  * xp = Maj=3 Min=1
00305  */
00306 
00307 #define NTFS_VINFO_NT           0x21
00308 #define NTFS_VINFO_2K           0x03
00309 #define NTFS_VINFO_XP           0x13
00310 
00311 
00312 
00313 
00314 /************************************************************************
00315  * attribute list 
00316  */
00317     typedef struct {
00318         uint8_t type[4];        // Attribute Type
00319         uint8_t len[2];         // length of entry
00320         uint8_t nlen;           // number of chars in name
00321         uint8_t f1;             // 7
00322         uint8_t start_vcn[8];   // starting VCN or NTFS_ATTRL_RES 
00323         uint8_t file_ref[6];    // file reference to new MFT entry
00324         uint8_t seq[2];         // 22
00325         uint8_t id[2];          // id (also in the attribute header)
00326         uint8_t name;           // 26  name in unicode
00327     } ntfs_attrlist;
00328 
00329 #define NTFS_ATTRL_RES  0
00330 
00331 
00332 
00333 
00334 /************************************************************************
00335  * runlist
00336  * 
00337  * Used to store the non-resident runs for an attribute.
00338  * It is located in the MFT and pointed to by the run_off in the header
00339  */
00340 
00341     typedef struct {
00342         /* lsb 4 bits: num of bytes in run length field
00343          * msb 4 bits: num of bytes in run offset field - (LCN)
00344          */
00345         uint8_t len;
00346         uint8_t buf[32];
00347     } ntfs_runlist;
00348 
00349 #define NTFS_RUNL_LENSZ(runl)   \
00350         (uint8_t)(runl->len & 0x0f)
00351 
00352 #define NTFS_RUNL_OFFSZ(runl)   \
00353         (uint8_t)((runl->len & 0xf0) >> 4)
00354 
00355 
00356 /************************************************************************
00357  * Index root for directories 
00358  * 
00359  * the attribute has two parts.  The header is general to all index entries
00360  * and applies to $IDX_ALLOC as well. The buffer part contains the
00361  * index entries that are allocated to $IDX_ROOT.
00362  *
00363  */
00364 
00365 /*
00366  * Starting at begin_off is a stream of ntfs_idxentry structures 
00367  */
00368     typedef struct {
00369         uint8_t begin_off[4];   /* offset to seq of idx entries */
00370         uint8_t end_off[4];     /* offset to end of seq of idx entries */
00371         uint8_t buf_off[4];     /* offset to end of idx buffer */
00372         uint8_t flags[4];
00373     } ntfs_idxelist;
00374 
00375 /* value for flags */
00376 #define NTFS_IDXELIST_CHILD     0x1     /* children exist below this node */
00377 
00378 
00379 
00380 /* This is general index information and applies to $IDX_ALLOC as well */
00381     typedef struct {
00382         uint8_t type[4];        /* ATYPE that tree is sorted by */
00383         uint8_t collation_rule[4];
00384         uint8_t idxalloc_size_b[4];     /* index alloc size in bytes */
00385         uint8_t idx_size_c;     /* index alloc size in clusters */
00386         uint8_t pad[3];
00387         ntfs_idxelist list;
00388     } ntfs_idxroot;
00389 
00390 
00391 
00392 /************************************************************************
00393  * idxrec
00394  *
00395  * this is structure for the nodes of the B+ index trees
00396  * It contains a list of index entry data structures.  Each
00397  * buffer corresponds to one node.  The $IDX_ALLOC attribute
00398  * is an array of these data structures 
00399  */
00400 
00401 
00402     typedef struct {
00403         uint8_t magic[4];       /* INDX */
00404         uint8_t upd_off[2];
00405         uint8_t upd_cnt[2];     /* size + 1 */
00406         uint8_t lsn[8];         /*  $LogFile Sequence Number */
00407         uint8_t idx_vcn[8];     /* vcn in idx alloc attr */
00408         ntfs_idxelist list;
00409     } ntfs_idxrec;
00410 
00411 
00412 #define NTFS_IDXREC_MAGIC       0x58444e49      /* INDX */
00413 
00414 
00415 
00416 /************************************************************************
00417  * This structure exists for each file and directory in the tree */
00418     typedef struct {
00419         uint8_t file_ref[6];    /* file reference (invalid for last entry) */
00420         uint8_t seq_num[2];     /* file reference (invalid for last entry) */
00421         uint8_t idxlen[2];      /* length of the index entry */
00422         uint8_t strlen[2];      /* length of stream */
00423         uint8_t flags;
00424         uint8_t f1[3];
00425         uint8_t stream;         /* length of strlen - invalid for last entry */
00426         /* loc of subnode is found in last 8-bytes
00427          * of idx entry (idxlen - 8).  use macro 
00428          */
00429     } ntfs_idxentry;
00430 
00431 #define NTFS_IDX_SUB    0x01    /* Entry points to a sub-node */
00432 #define NTFS_IDX_LAST   0x02    /* last indx entry in the node */
00433 
00434 /* return the address of the subnode entry, it is located in the last
00435  * 8 bytes of the structure 
00436  */
00437 #define GET_IDXENTRY_SUB(fs, e) \
00438         (tsk_getu64(fs->endian, (int)e + tsk_getu16(fs->endian, e->idxlen) - 8))
00439 
00440 
00441 
00442 /************************************************************************
00443 */
00444 
00445     typedef struct {
00446         char label[128];        /* label in unicode */
00447         uint8_t type[4];
00448         uint8_t disp[4];        /* display rule */
00449         uint8_t coll[4];        /* collation rule */
00450         uint8_t flags[4];
00451         uint8_t minsize[8];     /* minimum size */
00452         uint8_t maxsize[8];     /* maximum size */
00453     } ntfs_attrdef;
00454 
00455 #define NTFS_ATTRDEF_FLAGS_IDX  0x02
00456 #define NTFS_ATTRDEF_FLAGS_RES  0x40    /* always resident */
00457 #define NTFS_ATTRDEF_FLAGS_NONRES       0x80    /* allowed to be non-resident */
00458 
00459 
00460 
00461 /************************************************************************
00462  * OBJECT_ID attribute
00463 */
00464 
00465     typedef struct {
00466         uint8_t objid1[8];      /* object id of file or directory */
00467         uint8_t objid2[8];
00468         uint8_t orig_volid1[8]; /* id of "birth" volume */
00469         uint8_t orig_volid2[8];
00470         uint8_t orig_objid1[8]; /* original object id */
00471         uint8_t orig_objid2[8];
00472         uint8_t orig_domid1[8]; /* id of "birth" domain */
00473         uint8_t orig_domid2[8];
00474     } ntfs_attr_objid;
00475 
00476 
00477 /************************************************************************
00478  * Self-relative security descriptor
00479  */
00480 
00481     typedef struct {
00482         uint8_t revision;       /* Revision level of the security descriptor. */
00483         uint8_t pad;
00484         uint8_t control[2];     /* Flags qualifying the type of
00485                                    the descriptor as well as the following fields. */
00486 
00487         uint8_t owner[4];       /* Byte offset to a SID representing an object's
00488                                    owner. If this is NULL, no owner SID is present in
00489                                    the descriptor. */
00490 
00491         uint8_t group[4];       /* Byte offset to a SID representing an object's
00492                                    primary group. If this is NULL, no primary group
00493                                    SID is present in the descriptor. */
00494 
00495         uint8_t sacl[4];        /* Byte offset to a system ACL. Only valid, if
00496                                    SE_SACL_PRESENT is set in the control field. If
00497                                    SE_SACL_PRESENT is set but sacl is NULL, a NULL ACL
00498                                    is specified. */
00499 
00500         uint8_t dacl[4];        /* Byte offset to a discretionary ACL. Only valid, if
00501                                    SE_DACL_PRESENT is set in the control field. If
00502                                    SE_DACL_PRESENT is set but dacl is NULL, a NULL ACL
00503                                    (unconditionally granting access) is specified. */
00504 
00505     } ntfs_self_relative_security_descriptor;
00506 
00507 
00508 
00509 
00510 /************************************************************************
00511  * Structure used in Security Descriptor lookups
00512  */
00513     typedef struct {
00514         char *buffer;
00515         size_t size;
00516         size_t used;
00517     } NTFS_SXX_BUFFER;
00518 
00519 
00520 
00521 /************************************************************************
00522  * SID attribute
00523  */
00524 
00525     typedef struct {
00526         uint8_t revision;       /* Revision */
00527         uint8_t sub_auth_count; /* Sub Authority Count */
00528         uint8_t ident_auth[6];  /* NT Authority ::NOTE:: big endian number */
00529         uint32_t sub_auth[1];   /* At least one sub_auth */
00530     } ntfs_sid;
00531 
00532     void ntfs_print_sid(TSK_FS_INFO * fs, FILE * hFile);
00533 
00534     char *ntfs_get_sid_as_string(TSK_FS_INFO * fs, uint32_t security_id);
00535 
00536 
00537 
00538 #define NTFS_ACE_SIZE   16      /* Size in bytes of ACE information proceeding
00539 
00540                                    the SID.  Since we don't current require
00541 
00542                                    the ACE information, we will use this as an
00543 
00544                                    offset to get to the start of the SID */
00545 
00546     typedef struct NTFS_SID_ENTRY NTFS_SID_ENTRY;
00547 
00548     struct NTFS_SID_ENTRY {
00549         NTFS_SID_ENTRY *next;
00550         ntfs_sid *data;         /* ntfs_sid record */
00551         uint32_t sec_id;        /* Security ID */
00552         char *sid_str;          /* SID string representation */
00553     };
00554 
00555 
00556 
00557 /************************************************************************
00558  * SDS attribute
00559  */
00560 
00561     typedef struct {
00562         uint8_t hash_sec_desc[4];       /* Hash of Security Descriptor */
00563         uint8_t sec_id[4];      /* Security ID */
00564         uint8_t file_off[8];    /* Offset of this entry in this file */
00565         uint8_t ent_size[4];    /* Size of this entry */
00566         ntfs_self_relative_security_descriptor self_rel_sec_desc;       /* Self-relative Security Descriptor */
00567     } ntfs_attr_sds;
00568 
00569 
00570 #define NTFS_SDS_BLOCK_OFFSET   262144  /* Data offset within $SDS (1024x256) */
00571 
00572     typedef struct NTFS_SDS_ENTRY NTFS_SDS_ENTRY;
00573 
00574     struct NTFS_SDS_ENTRY {
00575         NTFS_SDS_ENTRY *next;
00576         uint32_t len;           /* Length of data */
00577         uint8_t *data;          /* Raw data */
00578     };
00579 
00580 
00581 
00582 /************************************************************************
00583  * SDH attribute
00584  */
00585 
00586 
00587     typedef struct {
00588         uint8_t data_off[2];    /* Offset to data */
00589         uint8_t size[2];        /* Size of data */
00590         uint8_t pad1[4];        /* Padding */
00591         uint8_t ent_size[2];    /* Size of Index Entry */
00592         uint8_t key_size[2];    /* Size of Index Key */
00593         uint8_t flags[2];       /* Flags */
00594         uint8_t pad2[2];        /* Padding */
00595         uint8_t key_hash_sec_desc[4];   /* Hash of Security Descriptor */
00596         uint8_t key_sec_id[4];  /* Security ID */
00597         uint8_t data_hash_sec_desc[4];  /* Hash of Security Descriptor */
00598         uint8_t data_sec_id[4]; /* Security ID */
00599         uint8_t sec_desc_off[8];        /* Offset to Security Descriptor (in $SDS) */
00600         uint8_t sec_desc_size[4];       /* Size of Security Descriptor (in $SDS) */
00601         uint8_t pad3[4];        /* Padding */
00602     } ntfs_attr_sdh;
00603 
00604     typedef struct NTFS_SDH_ENTRY NTFS_SDH_ENTRY;
00605 
00606     struct NTFS_SDH_ENTRY {
00607         NTFS_SDH_ENTRY *next;
00608         ntfs_attr_sdh *data;    /* ntfs_attr_sdh record */
00609     };
00610 
00611 
00612 
00613 /************************************************************************
00614  * SII attribute
00615  */
00616 
00617     typedef struct {
00618         uint8_t data_off[2];    /* Offset to data */
00619         uint8_t size[2];        /* Size of data */
00620         uint8_t pad1[4];        /* Padding */
00621         uint8_t ent_size[2];    /* Size of Index Entry */
00622         uint8_t key_size[2];    /* Size of Index Key */
00623         uint8_t flags[2];       /* Flags */
00624         uint8_t pad2[2];        /* Padding */
00625         uint8_t key_sec_id[4];  /* Security ID */
00626         uint8_t data_hash_sec_desc[4];  /* Hash of Security Descriptor */
00627         uint8_t data_sec_id[4]; /* Security ID */
00628         uint8_t sec_desc_off[8];        /* Offset to Security Descriptor (in $SDS) */
00629         uint8_t sec_desc_size[4];       /* Size of Security Descriptor (in $SDS) */
00630 
00631     } ntfs_attr_sii;
00632 
00633     typedef struct NTFS_SII_ENTRY NTFS_SII_ENTRY;
00634 
00635     struct NTFS_SII_ENTRY {
00636         NTFS_SII_ENTRY *next;
00637         ntfs_attr_sii *data;    /* ntfs_attr_sii record */
00638     };
00639 
00640 
00641 /************************************************************************
00642 */
00643     typedef struct {
00644         TSK_FS_INFO fs_info;    /* super class */
00645         ntfs_sb *fs;
00646         uint8_t ver;            /* version of NTFS - uses the VINFO flag */
00647         TSK_FS_INODE *mft_inode;        /* contains the data for the mft entry for the mft */
00648         TSK_FS_DATA *mft_data;  /* Data run for MFT entry for MFT */
00649         ntfs_mft *mft;          /* cache for on-disk inode */
00650         INUM_T mnum;            /* number of above cached mft */
00651         uint16_t csize_b;       /* number of bytes in a cluster */
00652         uint16_t ssize_b;       /* number of bytes in a sector */
00653         uint16_t mft_rsize_b;   /* number of bytes per mft record */
00654         uint16_t idx_rsize_b;   /* number of bytes per idx record */
00655         DADDR_T root_mft_addr;  /* address of first mft entry */
00656 
00657         uint8_t loading_the_MFT;        /* set to 1 when initializing the setup */
00658 
00659         TSK_FS_DATA_RUN *bmap;  /* Run of bitmap for clusters (linked list) */
00660         TSK_DATA_BUF *bmap_buf; /* buffer to hold cached copy of bitmap */
00661         DADDR_T bmap_buf_off;   /* offset cluster in cached bitmap */
00662         ntfs_attrdef *attrdef;  // buffer of attrdef file contents
00663         SSIZE_T attrdef_len;    // length of addrdef buffer
00664 
00665         NTFS_SDS_ENTRY *sds;    /* Data run of ntfs_attr_sds */
00666         //NTFS_SDH_ENTRY *sdh;  /* Data run of ntfs_attr_sdh */
00667         //NTFS_SII_ENTRY *sii;  /* Data run of ntfs_attr_sii */
00668         NTFS_SID_ENTRY *sid;    /* Data run of ntfs_sid */
00669     } NTFS_INFO;
00670 
00671     extern uint8_t
00672         ntfs_data_walk(NTFS_INFO *, INUM_T, TSK_FS_DATA *, int,
00673         TSK_FS_FILE_WALK_CB, void *);
00674     extern uint8_t
00675         ntfs_dent_walk(TSK_FS_INFO *, INUM_T, TSK_FS_DENT_FLAG_ENUM,
00676         TSK_FS_DENT_TYPE_WALK_CB, void *);
00677     extern uint32_t nt2unixtime(uint64_t ntdate);
00678     extern uint8_t ntfs_attrname_lookup(TSK_FS_INFO *, uint16_t, char *,
00679         int);
00680 
00681 #ifdef __cplusplus
00682 }
00683 #endif
00684 #endif

Generated on Thu Apr 19 14:58:53 2007 for The Sleuth Kit (Incomplete) by  doxygen 1.4.2