# ntfs.c File Reference

## Detailed Description

Contains the general NTFS processing code.

`#include "fs_tools_i.h"`
`#include "ntfs.h"`
`#include <ctype.h>`

## Defines

#define | NSEC_BTWN_1601_1970 (uint64_t)(116444736000000000ULL)
#define | NTFS_PRINT_WIDTH 8

## Functions

uint32_t | nt2unixtime (uint64_t ntdate)
uint8_t | ntfs_data_walk (NTFS_INFO *ntfs, INUM_T inum, TSK_FS_DATA *fs_data, int flags, TSK_FS_FILE_WALK_CB action, void *ptr)
uint8_t | ntfs_dinode_load (NTFS_INFO *ntfs, INUM_T mftnum)
uint8_t | ntfs_attrname_lookup (TSK_FS_INFO *fs, uint16_t type, char *name, int len)
uint8_t | ntfs_load_sxx_buffer (TSK_FS_INFO *fs, DADDR_T addr, char *buf, size_t size, TSK_FS_BLOCK_FLAG_ENUM flags, void *ptr)
uint8_t | ntfs_file_walk (TSK_FS_INFO *fs, TSK_FS_INODE *fs_inode, uint32_t type, uint16_t id, TSK_FS_FILE_FLAG_ENUM flags, TSK_FS_FILE_WALK_CB action, void *ptr)
| Walk the contents of a file and use the callback for each cluster.
uint8_t | ntfs_block_walk (TSK_FS_INFO *fs, DADDR_T start_blk, DADDR_T end_blk, TSK_FS_BLOCK_FLAG_ENUM flags, TSK_FS_BLOCK_WALK_CB action, void *ptr)
uint8_t | ntfs_inode_walk (TSK_FS_INFO *fs, INUM_T start_inum, INUM_T end_inum, TSK_FS_INODE_FLAG_ENUM flags, TSK_FS_INODE_WALK_CB action, void *ptr)
char * | ntfs_get_sid_as_string (TSK_FS_INFO *fs, uint32_t security_id)
uint8_t | ntfs_jopen (TSK_FS_INFO *fs, INUM_T inum)
uint8_t | ntfs_jentry_walk (TSK_FS_INFO *fs, int flags, TSK_FS_JENTRY_WALK_CB action, void *ptr)
uint8_t | ntfs_jblk_walk (TSK_FS_INFO *fs, DADDR_T start, DADDR_T end, int flags, TSK_FS_JBLK_WALK_CB action, void *ptr)
TSK_FS_INFO * | ntfs_open (TSK_IMG_INFO *img_info, SSIZE_T offset, TSK_FS_INFO_TYPE_ENUM ftype, uint8_t test)

## Function Documentation

uint8_t ntfs_file_walk | ( | TSK_FS_INFO * | fs,
|  | TSK_FS_INODE * | fs_inode,
|  | uint32_t | type,
|  | uint16_t | id,
|  | TSK_FS_FILE_FLAG_ENUM | flags,
|  | TSK_FS_FILE_WALK_CB | action,
|  | void * | ptr
| ) |

Walk the contents of a file and use the callback for each cluster.

This actually just finds the specific attribute and then calls data_walk.

If TSK_FS_FILE_FLAG_RECOVER is set, then error codes are set to _RECOVER so that errors can be more easily suppressed. No special recovery logic exists in this code.

action uses: TSK_FS_BLOCK_FLAG_CONT

No notion of meta with NTFS

Parameters:

  | fs | File system to analyze
  | fs_inode | Inode of file to analyze
  | type | Type id of attribute in file to walk (use 0 to use default for files and directories -- if default is not found then no error is generated!).
  | id | Id of attribute in file to walk (use flag of _NOID if this value is 0 because it is not specified -- in which case first entry is used).
  | flags | Flags to determine how walk should occur. Uses (TSK_FS_FILE_FLAG_AONLY, TSK_FS_FILE_FLAG_SLACK, TSK_FS_FILE_FLAG_NOSPARSE TSK_FS_FILE_FLAG_NOID, TSK_FS_FILE_FLAG_RECOVER).
  | action | Callback that is called for each cluster
  | ptr | Pointer to data that will be passed to callback.

Returns:
  0 on success and 1 on error