# ntfs.h

    00001 /*
    00002 ** The Sleuth Kit
    00003 **
    00004 ** $Date: 2007/04/19 19:01:35 $
    00005 **
    00006 ** Brian Carrier [carrier@sleuthkit.org]
    00007 ** Copyright (c) 2003-2005 Brian Carrier.  All rights reserved
    00008 **
    00009 ** TASK
    00010 ** Copyright (c) 2002 @stake Inc.  All rights reserved
    00011 */
    00012
    00013 #ifndef _NTFS_H
    00014 #define _NTFS_H
    00015
    00016 #ifdef __cplusplus
    00017 extern "C" {
    00018 #endif
    00019
    00020 //#define NTFS_FS_MAGIC 0x5346544E      /* "NTFS" in little endian */
    00021 #define NTFS_FS_MAGIC   0xAA55
    00022 #define NTFS_DEV_BSIZE  512
    00023
    00024 #define NTFS_MAXNAMLEN  256
    00025 #define NTFS_MAXNAMLEN_UTF8     4 * NTFS_MAXNAMLEN
    00026
    00027 /* location of the Root Directory inode */
    00028 #define NTFS_ROOTINO    NTFS_MFT_ROOT
    00029 #define NTFS_FIRSTINO   0       /* location of the $Mft Record */
    00030 #define NTFS_LAST_DEFAULT_INO   16      /* A guess for right now */
    00031
    00032 #define NTFS_NDADDR                     0
    00033 #define NTFS_NIADDR                     0
    00034
    00035 /* uncompression values */
    00036 #define NTFS_TOKEN_MASK   1
    00037 #define NTFS_SYMBOL_TOKEN 0
    00038 #define NTFS_TOKEN_LENGTH 8
    00039 /* (64 * 1024) = 65536 */
    00040 #define NTFS_MAX_UNCOMPRESSION_BUFFER_SIZE 65536
    00041
    00042
    00043
    00044 /************************************************************************
    00045  * Update sequence structure.  This is located at upd_off from the
    00046  * begining of the original structure
    00047  */
    00048     typedef struct {
    00049         uint8_t upd_val[2];     // what they should be
    00050         uint8_t upd_seq;        // array of size 2*(upd_cnt-1) w/orig vals
    00051     } ntfs_upd;
    00052
    00053
    00054 /************************************************************************
    00055  * bootsector
    00056  *
    00057  * located in sector 0 in $Boot
    00058  */
    00059     typedef struct {
    00060         uint8_t f1[3];          // 0
    00061         char oemname[8];        // 3
    00062         uint8_t ssize[2];       // 11   /* sector size in bytes */
    00063         uint8_t csize;          // 13  /* sectors per cluster */
    00064         uint8_t f2[26];         // 14
    00065         uint8_t vol_size_s[8];  // 40   /*size of volume in sectors */
    00066         uint8_t mft_clust[8];   // 48   /* location of MFT */
    00067         uint8_t mftm_clust[8];  // 56    /* location of MFT mirror */
    00068         int8_t mft_rsize_c;     // 64      /* number of clusters per mft record */
    00069         uint8_t f3[3];
    00070         int8_t idx_rsize_c;     // 68      /* number of clus per idx rec */
    00071         uint8_t f4[3];
    00072         uint8_t serial[8];      // 72   /* serial number */
    00073         uint8_t f5[430];        //80
    00074         uint8_t magic[2];
    00075     } ntfs_sb;
    00076
    00077
    00078
    00079 /************************************************************************
    00080  * MFT Entry
    00081  *
    00082  * One entry in the MFT - there exists one for each file
    00083  */
    00084     typedef struct {
    00085         uint8_t magic[4];
    00086         uint8_t upd_off[2];     // 4
    00087         uint8_t upd_cnt[2];     // 6  size+1
    00088         uint8_t lsn[8];         // 8  $LogFile Sequence Number
    00089         uint8_t seq[2];         // 16
    00090         uint8_t link[2];        // 18
    00091         uint8_t attr_off[2];    // 20
    00092         uint8_t flags[2];       // 22
    00093         uint8_t size[4];        // 24
    00094         uint8_t alloc_size[4];  //28
    00095         uint8_t base_ref[6];    // 32
    00096         uint8_t base_seq[2];    // 38
    00097         uint8_t next_attrid[2]; // 40 The next id to be assigned
    00098         uint8_t f1[2];          // XP Only
    00099         uint8_t entry[4];       // XP Only - Number of this entry
    00100     } ntfs_mft;
    00101
    00102 /* Magic values for each MFT entry */
    00103 #define NTFS_MFT_MAGIC  0x454c4946
    00104 #define NTFS_MFT_MAGIC_BAAD     0x44414142
    00105 #define NTFS_MFT_MAGIC_ZERO     0x00000000
    00106
    00107 /* MFT entry flags */
    00108 #define NTFS_MFT_INUSE  0x0001
    00109 #define NTFS_MFT_DIR    0x0002
    00110
    00111 /* flags for file_ref */
    00112 #define NTFS_MFT_BASE           0       /* set when the base file record */
    00113 /* Mask when not zero, which indicates the base file record */
    00114 #define NTFS_MFT_FILE_REC       0x00ffffffffffffff
    00115
    00116 /* DEFINED MFT entries - file system metadata files */
    00117 #define NTFS_MFT_MFT    0x0
    00118 #define NTFS_MFT_MFTMIR 0x1
    00119 #define NTFS_MFT_LOG    0x2
    00120 #define NTFS_MFT_VOL    0x3
    00121 #define NTFS_MFT_ATTR   0x4
    00122 #define NTFS_MFT_ROOT   0x5
    00123 #define NTFS_MFT_BMAP   0x6
    00124 #define NTFS_MFT_BOOT   0x7
    00125 #define NTFS_MFT_BAD    0x8
    00126 //#define NTFS_MFT_QUOT 0x9
    00127 #define NTFS_MFT_SECURE 0x9
    00128 #define NTFS_MFT_UPCASE 0xA
    00129
    00130
    00131
    00132 /************************************************************************
    00133  * Attribute Header for resident and non-resident attributes
    00134  */
    00135     typedef struct {
    00136         uint8_t type[4];
    00137         uint8_t len[4];         // 4 - length including header
    00138         uint8_t res;            // 8 - resident flag
    00139         uint8_t nlen;           // 9 - name length
    00140         uint8_t name_off[2];    // 10 - offset to name
    00141         uint8_t flags[2];       // 12
    00142         uint8_t id[2];          // 14 - unique identifier
    00143
    00144         union {
    00145             /* Resident Values */
    00146             struct {
    00147                 uint8_t ssize[4];       // 16 - size of content
    00148                 uint8_t soff[2];        // 20 - offset to content (after name)
    00149                 uint8_t idxflag[2];     // 22 - indexed flag
    00150             } r;
    00151             /* Non-resident Values */
    00152             struct {
    00153                 uint8_t start_vcn[8];   // 16 - starting VCN of this attribute
    00154                 uint8_t last_vcn[8];    // 24
    00155                 uint8_t run_off[2];     // 32 - offset to the data runs (after name)
    00156                 uint8_t compusize[2];   // 34 - compression unit size (2^x)
    00157                 uint8_t f1[4];  // 36
    00158                 uint8_t alen[8];        // 40   allocated size of stream
    00159                 uint8_t ssize[8];       // 48   actual size of stream
    00160                 uint8_t initsize[8];    // 56   initialized steam size
    00161             } nr;
    00162         } c;
    00163     } ntfs_attr;
    00164
    00165 /* values for the res field */
    00166 #define NTFS_MFT_RES    0       /* resident */
    00167 #define NTFS_MFT_NONRES 1       /* non-resident */
    00168
    00169
    00170 /* Values for flag field
    00171  * should only exist for $DATA attributes */
    00172 #define NTFS_ATTR_FLAG_COMP     0x0001  /* compressed */
    00173 #define NTFS_ATTR_FLAG_ENC      0x4000  /* encrypted */
    00174 #define NTFS_ATTR_FLAG_SPAR     0x8000  /* sparse */
    00175
    00176
    00177
    00178 /* values for the type field */
    00179 #define NTFS_ATYPE_SI       0x10        // 16
    00180 #define NTFS_ATYPE_ATTRLIST 0x20        // 32
    00181 #define NTFS_ATYPE_FNAME    0x30        // 48
    00182 #define NTFS_ATYPE_VVER     0x40        // 64 (NT)
    00183 #define NTFS_ATYPE_OBJID    0x40        // 64 (2K)
    00184 #define NTFS_ATYPE_SEC      0x50        // 80
    00185 #define NTFS_ATYPE_VNAME    0x60        // 96
    00186 #define NTFS_ATYPE_VINFO    0x70        // 112
    00187 #define NTFS_ATYPE_DATA     0x80        // 128
    00188 #define NTFS_ATYPE_IDXROOT  0x90        // 144
    00189 #define NTFS_ATYPE_IDXALLOC 0xA0        // 160
    00190 #define NTFS_ATYPE_BITMAP   0xB0        // 176
    00191 #define NTFS_ATYPE_SYMLNK   0xC0        // 192 (NT)
    00192 #define NTFS_ATYPE_REPARSE  0xC0        // 192 (2K)
    00193 #define NTFS_ATYPE_EAINFO   0xD0        // 208
    00194 #define NTFS_ATYPE_EA       0xE0        // 224
    00195 #define NTFS_ATYPE_PROP     0xF0        //  (NT)
    00196 #define NTFS_ATYPE_LOG      0x100       //  (2K)
    00197
    00198
    00199
    00200
    00201 /************************************************************************
    00202  * File Name Attribute
    00203  */
    00204     typedef struct {
    00205         uint8_t par_ref[6];     /* file reference to base File Record of parent */
    00206         uint8_t par_seq[2];     /* seq num to base File Record of parent */
    00207         uint8_t crtime[8];      /* file creation */
    00208         uint8_t mtime[8];       /* file altered */
    00209         uint8_t ctime[8];       /* mod time for FILE record (MFT Entry) */
    00210         uint8_t atime[8];       /* access time */
    00211         uint8_t alloc_fsize[8];
    00212         uint8_t real_fsize[8];
    00213         uint8_t flags[8];
    00214         uint8_t nlen;           /* length of file name */
    00215         uint8_t nspace;
    00216         uint8_t name;           /* in unicode */
    00217     } ntfs_attr_fname;
    00218
    00219 /* values for the flags field of attr_fname */
    00220 #define NTFS_FNAME_FLAGS_RO             0x0000000000000001
    00221 #define NTFS_FNAME_FLAGS_HID    0x0000000000000002
    00222 #define NTFS_FNAME_FLAGS_SYS    0x0000000000000004
    00223 #define NTFS_FNAME_FLAGS_ARCH   0x0000000000000020
    00224 #define NTFS_FNAME_FLAGS_DEV    0x0000000000000040
    00225 #define NTFS_FNAME_FLAGS_NORM   0x0000000000000080
    00226 #define NTFS_FNAME_FLAGS_TEMP   0x0000000000000100
    00227 #define NTFS_FNAME_FLAGS_SPAR   0x0000000000000200
    00228 #define NTFS_FNAME_FLAGS_REP    0x0000000000000400
    00229 #define NTFS_FNAME_FLAGS_COMP   0x0000000000000800
    00230 #define NTFS_FNAME_FLAGS_OFF    0x0000000000001000
    00231 #define NTFS_FNAME_FLAGS_NOIDX  0x0000000000002000
    00232 #define NTFS_FNAME_FLAGS_ENC    0x0000000000004000
    00233 #define NTFS_FNAME_FLAGS_DIR            0x0000000010000000
    00234 #define NTFS_FNAME_FLAGS_IDXVIEW        0x0000000020000000
    00235
    00236
    00237 /* values for the name space values of nspace */
    00238 #define NTFS_FNAME_POSIX        0       /* case sensitive  and any but NULL and \ */
    00239 #define NTFS_FNAME_WIN32        1       // insensitive and restricted
    00240 #define NTFS_FNAME_DOS          2       // 8.3 format of 8-bit chars in uppercase
    00241 #define NTFS_FNAME_WINDOS       3       // name in WIN32 space that is already DOS
    00242
    00243
    00244
    00245
    00246 /************************************************************************
    00247  * Standard Information Attribute
    00248  */
    00249     typedef struct {
    00250         uint8_t crtime[8];      /* creation date */
    00251         uint8_t mtime[8];       /* file altered */
    00252         uint8_t ctime[8];       /* MFT Changed */
    00253         uint8_t atime[8];       /* last access (read) */
    00254         uint8_t dos[4];         /* permissions in DOS Format */
    00255         uint8_t maxver[4];
    00256         uint8_t ver[4];
    00257         uint8_t class_id[4];
    00258         uint8_t own_id[4];
    00259         uint8_t sec_id[4];
    00260         uint8_t quota[8];
    00261         uint8_t usn[8];
    00262     } ntfs_attr_si;
    00263
    00264
    00265 /* DOS Flags values */
    00266 #define NTFS_SI_RO              0x0001
    00267 #define NTFS_SI_HID             0x0002
    00268 #define NTFS_SI_SYS             0x0004
    00269 #define NTFS_SI_ARCH    0x0020
    00270 #define NTFS_SI_DEV             0x0040
    00271 #define NTFS_SI_NORM    0x0080
    00272 #define NTFS_SI_TEMP    0x0100
    00273 #define NTFS_SI_SPAR    0x0200
    00274 #define NTFS_SI_REP             0x0400
    00275 #define NTFS_SI_COMP    0x0800
    00276 #define NTFS_SI_OFF             0x1000
    00277 #define NTFS_SI_NOIDX   0x2000
    00278 #define NTFS_SI_ENC             0x4000
    00279
    00280
    00281
    00282 /************************************************************************
    00283  * Volume Info Attribute
    00284  */
    00285     typedef struct {
    00286         uint8_t f1[8];
    00287         uint8_t maj_ver;
    00288         uint8_t min_ver;
    00289         uint8_t flags[2];
    00290         uint8_t f2[4];
    00291     } ntfs_attr_vinfo;
    00292
    00293 #define NTFS_VINFO_DIRTY        0x0001  // Dirty
    00294 #define NTFS_VINFO_RESLOG       0x0002  // Resize LogFile
    00295 #define NTFS_VINFO_UPGRAD       0x0004  // Upgrade on Mount
    00296 #define NTFS_VINFO_MNTNT4       0x0008  // Mounted on NT4
    00297 #define NTFS_VINFO_DELUSN       0x0010  // Delete USN Underway
    00298 #define NTFS_VINFO_REPOBJ       0x0020  // Repair Object Ids
    00299 #define NTFS_VINFO_MODCHK       0x8000  // Modified by chkdsk
    00300
    00301 /* versions
    00302  * NT = Maj=1 Min=2
    00303  * 2k = Maj=3 Min=0
    00304  * xp = Maj=3 Min=1
    00305  */
    00306
    00307 #define NTFS_VINFO_NT           0x21
    00308 #define NTFS_VINFO_2K           0x03
    00309 #define NTFS_VINFO_XP           0x13
    00310
    00311
    00312
    00313
    00314 /************************************************************************
    00315  * attribute list
    00316  */
    00317     typedef struct {
    00318         uint8_t type[4];        // Attribute Type
    00319         uint8_t len[2];         // length of entry
    00320         uint8_t nlen;           // number of chars in name
    00321         uint8_t f1;             // 7
    00322         uint8_t start_vcn[8];   // starting VCN or NTFS_ATTRL_RES
    00323         uint8_t file_ref[6];    // file reference to new MFT entry
    00324         uint8_t seq[2];         // 22
    00325         uint8_t id[2];          // id (also in the attribute header)
    00326         uint8_t name;           // 26  name in unicode
    00327     } ntfs_attrlist;
    00328
    00329 #define NTFS_ATTRL_RES  0
    00330
    00331
    00332
    00333
    00334 /************************************************************************
    00335  * runlist
    00336  *
    00337  * Used to store the non-resident runs for an attribute.
    00338  * It is located in the MFT and pointed to by the run_off in the header
    00339  */
    00340
    00341     typedef struct {
    00342         /* lsb 4 bits: num of bytes in run length field
    00343          * msb 4 bits: num of bytes in run offset field - (LCN)
    00344          */
    00345         uint8_t len;
    00346         uint8_t buf[32];
    00347     } ntfs_runlist;
    00348
    00349 #define NTFS_RUNL_LENSZ(runl)   \
    00350         (uint8_t)(runl->len & 0x0f)
    00351
    00352 #define NTFS_RUNL_OFFSZ(runl)   \
    00353         (uint8_t)((runl->len & 0xf0) >> 4)
    00354
    00355
    00356 /************************************************************************
    00357  * Index root for directories
    00358  *
    00359  * the attribute has two parts.  The header is general to all index entries
    00360  * and applies to $IDX_ALLOC as well. The buffer part contains the
    00361  * index entries that are allocated to $IDX_ROOT.
    00362  *
    00363  */
    00364
    00365 /*
    00366  * Starting at begin_off is a stream of ntfs_idxentry structures
    00367  */
    00368     typedef struct {
    00369         uint8_t begin_off[4];   /* offset to seq of idx entries */
    00370         uint8_t end_off[4];     /* offset to end of seq of idx entries */
    00371         uint8_t buf_off[4];     /* offset to end of idx buffer */
    00372         uint8_t flags[4];
    00373     } ntfs_idxelist;
    00374
    00375 /* value for flags */
    00376 #define NTFS_IDXELIST_CHILD     0x1     /* children exist below this node */
    00377
    00378
    00379
    00380 /* This is general index information and applies to $IDX_ALLOC as well */
    00381     typedef struct {
    00382         uint8_t type[4];        /* ATYPE that tree is sorted by */
    00383         uint8_t collation_rule[4];
    00384         uint8_t idxalloc_size_b[4];     /* index alloc size in bytes */
    00385         uint8_t idx_size_c;     /* index alloc size in clusters */
    00386         uint8_t pad[3];
    00387         ntfs_idxelist list;
    00388     } ntfs_idxroot;
    00389
    00390
    00391
    00392 /************************************************************************
    00393  * idxrec
    00394  *
    00395  * this is structure for the nodes of the B+ index trees
    00396  * It contains a list of index entry data structures.  Each
    00397  * buffer corresponds to one node.  The $IDX_ALLOC attribute
    00398  * is an array of these data structures
    00399  */
    00400
    00401
    00402     typedef struct {
    00403         uint8_t magic[4];       /* INDX */
    00404         uint8_t upd_off[2];
    00405         uint8_t upd_cnt[2];     /* size + 1 */
    00406         uint8_t lsn[8];         /*  $LogFile Sequence Number */
    00407         uint8_t idx_vcn[8];     /* vcn in idx alloc attr */
    00408         ntfs_idxelist list;
    00409     } ntfs_idxrec;
    00410
    00411
    00412 #define NTFS_IDXREC_MAGIC       0x58444e49      /* INDX */
    00413
    00414
    00415
    00416 /************************************************************************
    00417  * This structure exists for each file and directory in the tree */
    00418     typedef struct {
    00419         uint8_t file_ref[6];    /* file reference (invalid for last entry) */
    00420         uint8_t seq_num[2];     /* file reference (invalid for last entry) */
    00421         uint8_t idxlen[2];      /* length of the index entry */
    00422         uint8_t strlen[2];      /* length of stream */
    00423         uint8_t flags;
    00424         uint8_t f1[3];
    00425         uint8_t stream;         /* length of strlen - invalid for last entry */
    00426         /* loc of subnode is found in last 8-bytes
    00427          * of idx entry (idxlen - 8).  use macro
    00428          */
    00429     } ntfs_idxentry;
    00430
    00431 #define NTFS_IDX_SUB    0x01    /* Entry points to a sub-node */
    00432 #define NTFS_IDX_LAST   0x02    /* last indx entry in the node */
    00433
    00434 /* return the address of the subnode entry, it is located in the last
    00435  * 8 bytes of the structure
    00436  */
    00437 #define GET_IDXENTRY_SUB(fs, e) \
    00438         (tsk_getu64(fs->endian, (int)e + tsk_getu16(fs->endian, e->idxlen) - 8))
    00439
    00440
    00441
    00442 /************************************************************************
    00443 */
    00444
    00445     typedef struct {
    00446         char label[128];        /* label in unicode */
    00447         uint8_t type[4];
    00448         uint8_t disp[4];        /* display rule */
    00449         uint8_t coll[4];        /* collation rule */
    00450         uint8_t flags[4];
    00451         uint8_t minsize[8];     /* minimum size */
    00452         uint8_t maxsize[8];     /* maximum size */
    00453     } ntfs_attrdef;
    00454
    00455 #define NTFS_ATTRDEF_FLAGS_IDX  0x02
    00456 #define NTFS_ATTRDEF_FLAGS_RES  0x40    /* always resident */
    00457 #define NTFS_ATTRDEF_FLAGS_NONRES       0x80    /* allowed to be non-resident */
    00458
    00459
    00460
    00461 /************************************************************************
    00462  * OBJECT_ID attribute
    00463 */
    00464
    00465     typedef struct {
    00466         uint8_t objid1[8];      /* object id of file or directory */
    00467         uint8_t objid2[8];
    00468         uint8_t orig_volid1[8]; /* id of "birth" volume */
    00469         uint8_t orig_volid2[8];
    00470         uint8_t orig_objid1[8]; /* original object id */
    00471         uint8_t orig_objid2[8];
    00472         uint8_t orig_domid1[8]; /* id of "birth" domain */
    00473         uint8_t orig_domid2[8];
    00474     } ntfs_attr_objid;
    00475
    00476
    00477 /************************************************************************
    00478  * Self-relative security descriptor
    00479  */
    00480
    00481     typedef struct {
    00482         uint8_t revision;       /* Revision level of the security descriptor. */
    00483         uint8_t pad;
    00484         uint8_t control[2];     /* Flags qualifying the type of
    00485                                    the descriptor as well as the following fields. */
    00486
    00487         uint8_t owner[4];       /* Byte offset to a SID representing an object's
    00488                                    owner. If this is NULL, no owner SID is present in
    00489                                    the descriptor. */
    00490
    00491         uint8_t group[4];       /* Byte offset to a SID representing an object's
    00492                                    primary group. If this is NULL, no primary group
    00493                                    SID is present in the descriptor. */
    00494
    00495         uint8_t sacl[4];        /* Byte offset to a system ACL. Only valid, if
    00496                                    SE_SACL_PRESENT is set in the control field. If
    00497                                    SE_SACL_PRESENT is set but sacl is NULL, a NULL ACL
    00498                                    is specified. */
    00499
    00500         uint8_t dacl[4];        /* Byte offset to a discretionary ACL. Only valid, if
    00501                                    SE_DACL_PRESENT is set in the control field. If
    00502                                    SE_DACL_PRESENT is set but dacl is NULL, a NULL ACL
    00503                                    (unconditionally granting access) is specified. */
    00504
    00505     } ntfs_self_relative_security_descriptor;
    00506
    00507
    00508
    00509
    00510 /************************************************************************
    00511  * Structure used in Security Descriptor lookups
    00512  */
    00513     typedef struct {
    00514         char *buffer;
    00515         size_t size;
    00516         size_t used;
    00517     } NTFS_SXX_BUFFER;
    00518
    00519
    00520
    00521 /************************************************************************
    00522  * SID attribute
    00523  */
    00524
    00525     typedef struct {
    00526         uint8_t revision;       /* Revision */
    00527         uint8_t sub_auth_count; /* Sub Authority Count */
    00528         uint8_t ident_auth[6];  /* NT Authority ::NOTE:: big endian number */
    00529         uint32_t sub_auth[1];   /* At least one sub_auth */
    00530     } ntfs_sid;
    00531
    00532     void ntfs_print_sid(TSK_FS_INFO * fs, FILE * hFile);
    00533
    00534     char *ntfs_get_sid_as_string(TSK_FS_INFO * fs, uint32_t security_id);
    00535
    00536
    00537
    00538 #define NTFS_ACE_SIZE   16      /* Size in bytes of ACE information proceeding
    00539
    00540                                    the SID.  Since we don't current require
    00541
    00542                                    the ACE information, we will use this as an
    00543
    00544                                    offset to get to the start of the SID */
    00545
    00546     typedef struct NTFS_SID_ENTRY NTFS_SID_ENTRY;
    00547
    00548     struct NTFS_SID_ENTRY {
    00549         NTFS_SID_ENTRY *next;
    00550         ntfs_sid *data;         /* ntfs_sid record */
    00551         uint32_t sec_id;        /* Security ID */
    00552         char *sid_str;          /* SID string representation */
    00553     };
    00554
    00555
    00556
    00557 /************************************************************************
    00558  * SDS attribute
    00559  */
    00560
    00561     typedef struct {
    00562         uint8_t hash_sec_desc[4];       /* Hash of Security Descriptor */
    00563         uint8_t sec_id[4];      /* Security ID */
    00564         uint8_t file_off[8];    /* Offset of this entry in this file */
    00565         uint8_t ent_size[4];    /* Size of this entry */
    00566         ntfs_self_relative_security_descriptor self_rel_sec_desc;       /* Self-relative Security Descriptor */
    00567     } ntfs_attr_sds;
    00568
    00569
    00570 #define NTFS_SDS_BLOCK_OFFSET   262144  /* Data offset within $SDS (1024x256) */
    00571
    00572     typedef struct NTFS_SDS_ENTRY NTFS_SDS_ENTRY;
    00573
    00574     struct NTFS_SDS_ENTRY {
    00575         NTFS_SDS_ENTRY *next;
    00576         uint32_t len;           /* Length of data */
    00577         uint8_t *data;          /* Raw data */
    00578     };
    00579
    00580
    00581
    00582 /************************************************************************
    00583  * SDH attribute
    00584  */
    00585
    00586
    00587     typedef struct {
    00588         uint8_t data_off[2];    /* Offset to data */
    00589         uint8_t size[2];        /* Size of data */
    00590         uint8_t pad1[4];        /* Padding */
    00591         uint8_t ent_size[2];    /* Size of Index Entry */
    00592         uint8_t key_size[2];    /* Size of Index Key */
    00593         uint8_t flags[2];       /* Flags */
    00594         uint8_t pad2[2];        /* Padding */
    00595         uint8_t key_hash_sec_desc[4];   /* Hash of Security Descriptor */
    00596         uint8_t key_sec_id[4];  /* Security ID */
    00597         uint8_t data_hash_sec_desc[4];  /* Hash of Security Descriptor */
    00598         uint8_t data_sec_id[4]; /* Security ID */
    00599         uint8_t sec_desc_off[8];        /* Offset to Security Descriptor (in $SDS) */
    00600         uint8_t sec_desc_size[4];       /* Size of Security Descriptor (in $SDS) */
    00601         uint8_t pad3[4];        /* Padding */
    00602     } ntfs_attr_sdh;
    00603
    00604     typedef struct NTFS_SDH_ENTRY NTFS_SDH_ENTRY;
    00605
    00606     struct NTFS_SDH_ENTRY {
    00607         NTFS_SDH_ENTRY *next;
    00608         ntfs_attr_sdh *data;    /* ntfs_attr_sdh record */
    00609     };
    00610
    00611
    00612
    00613 /************************************************************************
    00614  * SII attribute
    00615  */
    00616
    00617     typedef struct {
    00618         uint8_t data_off[2];    /* Offset to data */
    00619         uint8_t size[2];        /* Size of data */
    00620         uint8_t pad1[4];        /* Padding */
    00621         uint8_t ent_size[2];    /* Size of Index Entry */
    00622         uint8_t key_size[2];    /* Size of Index Key */
    00623         uint8_t flags[2];       /* Flags */
    00624         uint8_t pad2[2];        /* Padding */
    00625         uint8_t key_sec_id[4];  /* Security ID */
    00626         uint8_t data_hash_sec_desc[4];  /* Hash of Security Descriptor */
    00627         uint8_t data_sec_id[4]; /* Security ID */
    00628         uint8_t sec_desc_off[8];        /* Offset to Security Descriptor (in $SDS) */
    00629         uint8_t sec_desc_size[4];       /* Size of Security Descriptor (in $SDS) */
    00630
    00631     } ntfs_attr_sii;
    00632
    00633     typedef struct NTFS_SII_ENTRY NTFS_SII_ENTRY;
    00634
    00635     struct NTFS_SII_ENTRY {
    00636         NTFS_SII_ENTRY *next;
    00637         ntfs_attr_sii *data;    /* ntfs_attr_sii record */
    00638     };
    00639
    00640
    00641 /************************************************************************
    00642 */
    00643     typedef struct {
    00644         TSK_FS_INFO fs_info;    /* super class */
    00645         ntfs_sb *fs;
    00646         uint8_t ver;            /* version of NTFS - uses the VINFO flag */
    00647         TSK_FS_INODE *mft_inode;        /* contains the data for the mft entry for the mft */
    00648         TSK_FS_DATA *mft_data;  /* Data run for MFT entry for MFT */
    00649         ntfs_mft *mft;          /* cache for on-disk inode */
    00650         INUM_T mnum;            /* number of above cached mft */
    00651         uint16_t csize_b;       /* number of bytes in a cluster */
    00652         uint16_t ssize_b;       /* number of bytes in a sector */
    00653         uint16_t mft_rsize_b;   /* number of bytes per mft record */
    00654         uint16_t idx_rsize_b;   /* number of bytes per idx record */
    00655         DADDR_T root_mft_addr;  /* address of first mft entry */
    00656
    00657         uint8_t loading_the_MFT;        /* set to 1 when initializing the setup */
    00658
    00659         TSK_FS_DATA_RUN *bmap;  /* Run of bitmap for clusters (linked list) */
    00660         TSK_DATA_BUF *bmap_buf; /* buffer to hold cached copy of bitmap */
    00661         DADDR_T bmap_buf_off;   /* offset cluster in cached bitmap */
    00662         ntfs_attrdef *attrdef;  // buffer of attrdef file contents
    00663         SSIZE_T attrdef_len;    // length of addrdef buffer
    00664
    00665         NTFS_SDS_ENTRY *sds;    /* Data run of ntfs_attr_sds */
    00666         //NTFS_SDH_ENTRY *sdh;  /* Data run of ntfs_attr_sdh */
    00667         //NTFS_SII_ENTRY *sii;  /* Data run of ntfs_attr_sii */
    00668         NTFS_SID_ENTRY *sid;    /* Data run of ntfs_sid */
    00669     } NTFS_INFO;
    00670
    00671     extern uint8_t
    00672         ntfs_data_walk(NTFS_INFO *, INUM_T, TSK_FS_DATA *, int,
    00673         TSK_FS_FILE_WALK_CB, void *);
    00674     extern uint8_t
    00675         ntfs_dent_walk(TSK_FS_INFO *, INUM_T, TSK_FS_DENT_FLAG_ENUM,
    00676         TSK_FS_DENT_TYPE_WALK_CB, void *);
    00677     extern uint32_t nt2unixtime(uint64_t ntdate);
    00678     extern uint8_t ntfs_attrname_lookup(TSK_FS_INFO *, uint16_t, char *,
    00679         int);
    00680
    00681 #ifdef __cplusplus
    00682 }
    00683 #endif
    00684 #endif