3 * Copyright (C) 2002, 2014 ReactOS Team
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, write to the Free Software
17 * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301, USA.
19 * COPYRIGHT: See COPYING in the top level directory
20 * PROJECT: ReactOS kernel
21 * FILE: drivers/filesystem/ntfs/mft.c
22 * PURPOSE: NTFS filesystem driver
23 * PROGRAMMERS: Eric Kohl
25 * Pierre Schweitzer (pierre@reactos.org)
26 * Hervé Poussineau (hpoussin@reactos.org)
30 /* INCLUDES *****************************************************************/
38 /* FUNCTIONS ****************************************************************/
41 PrepareAttributeContext(PNTFS_ATTR_RECORD AttrRecord
)
43 PNTFS_ATTR_CONTEXT Context
;
45 Context
= ExAllocatePoolWithTag(NonPagedPool
,
46 FIELD_OFFSET(NTFS_ATTR_CONTEXT
, Record
) + AttrRecord
->Length
,
48 RtlCopyMemory(&Context
->Record
, AttrRecord
, AttrRecord
->Length
);
49 if (AttrRecord
->IsNonResident
)
51 LONGLONG DataRunOffset
;
52 ULONGLONG DataRunLength
;
54 Context
->CacheRun
= (PUCHAR
)&Context
->Record
+ Context
->Record
.NonResident
.MappingPairsOffset
;
55 Context
->CacheRunOffset
= 0;
56 Context
->CacheRun
= DecodeRun(Context
->CacheRun
, &DataRunOffset
, &DataRunLength
);
57 Context
->CacheRunLength
= DataRunLength
;
58 if (DataRunOffset
!= -1)
61 Context
->CacheRunStartLCN
=
62 Context
->CacheRunLastLCN
= DataRunOffset
;
67 Context
->CacheRunStartLCN
= -1;
68 Context
->CacheRunLastLCN
= 0;
70 Context
->CacheRunCurrentOffset
= 0;
78 ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context
)
80 ExFreePoolWithTag(Context
, TAG_NTFS
);
88 * Searches a file record for an attribute matching the given type and name.
91 * Optional pointer to a ULONG that will receive the offset of the found attribute
92 * from the beginning of the record. Can be set to NULL.
95 FindAttribute(PDEVICE_EXTENSION Vcb
,
96 PFILE_RECORD_HEADER MftRecord
,
100 PNTFS_ATTR_CONTEXT
* AttrCtx
,
105 FIND_ATTR_CONTXT Context
;
106 PNTFS_ATTR_RECORD Attribute
;
108 DPRINT("FindAttribute(%p, %p, 0x%x, %S, %u, %p)\n", Vcb
, MftRecord
, Type
, Name
, NameLength
, AttrCtx
);
111 Status
= FindFirstAttribute(&Context
, Vcb
, MftRecord
, FALSE
, &Attribute
);
112 while (NT_SUCCESS(Status
))
114 if (Attribute
->Type
== Type
&& Attribute
->NameLength
== NameLength
)
120 AttrName
= (PWCHAR
)((PCHAR
)Attribute
+ Attribute
->NameOffset
);
121 DPRINT("%.*S, %.*S\n", Attribute
->NameLength
, AttrName
, NameLength
, Name
);
122 if (RtlCompareMemory(AttrName
, Name
, NameLength
<< 1) == (NameLength
<< 1))
134 /* Found it, fill up the context and return. */
135 DPRINT("Found context\n");
136 *AttrCtx
= PrepareAttributeContext(Attribute
);
139 *Offset
= Context
.Offset
;
141 FindCloseAttribute(&Context
);
142 return STATUS_SUCCESS
;
146 Status
= FindNextAttribute(&Context
, &Attribute
);
149 FindCloseAttribute(&Context
);
150 return STATUS_OBJECT_NAME_NOT_FOUND
;
155 AttributeAllocatedLength(PNTFS_ATTR_RECORD AttrRecord
)
157 if (AttrRecord
->IsNonResident
)
158 return AttrRecord
->NonResident
.AllocatedSize
;
160 return AttrRecord
->Resident
.ValueLength
;
165 AttributeDataLength(PNTFS_ATTR_RECORD AttrRecord
)
167 if (AttrRecord
->IsNonResident
)
168 return AttrRecord
->NonResident
.DataSize
;
170 return AttrRecord
->Resident
.ValueLength
;
175 SetAttributeDataLength(PFILE_OBJECT FileObject
,
177 PNTFS_ATTR_CONTEXT AttrContext
,
179 PFILE_RECORD_HEADER FileRecord
,
180 PDEVICE_EXTENSION DeviceExt
,
181 PLARGE_INTEGER DataSize
)
183 if (AttrContext
->Record
.IsNonResident
)
185 // do we need to increase the allocation size?
186 if (AttrContext
->Record
.NonResident
.AllocatedSize
< DataSize
->QuadPart
)
188 DPRINT1("FixMe: Increasing allocation size is unimplemented!\n");
189 return STATUS_NOT_IMPLEMENTED
;
192 // TODO: is the file compressed, encrypted, or sparse?
194 // NOTE: we need to have acquired the main resource exclusively, as well as(?) the PagingIoResource
196 // TODO: update the allocated size on-disk
197 DPRINT("Allocated Size: %I64u\n", AttrContext
->Record
.NonResident
.AllocatedSize
);
199 AttrContext
->Record
.NonResident
.DataSize
= DataSize
->QuadPart
;
200 AttrContext
->Record
.NonResident
.InitializedSize
= DataSize
->QuadPart
;
202 Fcb
->RFCB
.FileSize
= *DataSize
;
203 Fcb
->RFCB
.ValidDataLength
= *DataSize
;
205 DPRINT("Data Size: %I64u\n", Fcb
->RFCB
.FileSize
.QuadPart
);
207 //NtfsDumpFileAttributes(Fcb->Vcb, FileRecord);
209 // copy the attribute back into the FileRecord
210 RtlCopyMemory((PCHAR
)FileRecord
+ AttrOffset
, &AttrContext
->Record
, AttrContext
->Record
.Length
);
212 //NtfsDumpFileAttributes(Fcb->Vcb, FileRecord);
214 // write the updated file record back to disk
215 UpdateFileRecord(Fcb
->Vcb
, Fcb
->MFTIndex
, FileRecord
);
217 CcSetFileSizes(FileObject
, (PCC_FILE_SIZES
)&Fcb
->RFCB
.AllocationSize
);
221 // we can't yet handle resident attributes
222 DPRINT1("FixMe: Can't handle increasing length of resident attribute\n");
223 return STATUS_NOT_IMPLEMENTED
;
226 return STATUS_SUCCESS
;
230 ReadAttribute(PDEVICE_EXTENSION Vcb
,
231 PNTFS_ATTR_CONTEXT Context
,
238 LONGLONG DataRunOffset
;
239 ULONGLONG DataRunLength
;
240 LONGLONG DataRunStartLCN
;
241 ULONGLONG CurrentOffset
;
246 if (!Context
->Record
.IsNonResident
)
248 if (Offset
> Context
->Record
.Resident
.ValueLength
)
250 if (Offset
+ Length
> Context
->Record
.Resident
.ValueLength
)
251 Length
= (ULONG
)(Context
->Record
.Resident
.ValueLength
- Offset
);
252 RtlCopyMemory(Buffer
, (PCHAR
)&Context
->Record
+ Context
->Record
.Resident
.ValueOffset
+ Offset
, Length
);
257 * Non-resident attribute
261 * I. Find the corresponding start data run.
266 // FIXME: Cache seems to be non-working. Disable it for now
267 //if(Context->CacheRunOffset <= Offset && Offset < Context->CacheRunOffset + Context->CacheRunLength * Volume->ClusterSize)
270 DataRun
= Context
->CacheRun
;
271 LastLCN
= Context
->CacheRunLastLCN
;
272 DataRunStartLCN
= Context
->CacheRunStartLCN
;
273 DataRunLength
= Context
->CacheRunLength
;
274 CurrentOffset
= Context
->CacheRunCurrentOffset
;
279 DataRun
= (PUCHAR
)&Context
->Record
+ Context
->Record
.NonResident
.MappingPairsOffset
;
284 DataRun
= DecodeRun(DataRun
, &DataRunOffset
, &DataRunLength
);
285 if (DataRunOffset
!= -1)
287 /* Normal data run. */
288 DataRunStartLCN
= LastLCN
+ DataRunOffset
;
289 LastLCN
= DataRunStartLCN
;
293 /* Sparse data run. */
294 DataRunStartLCN
= -1;
297 if (Offset
>= CurrentOffset
&&
298 Offset
< CurrentOffset
+ (DataRunLength
* Vcb
->NtfsInfo
.BytesPerCluster
))
308 CurrentOffset
+= DataRunLength
* Vcb
->NtfsInfo
.BytesPerCluster
;
313 * II. Go through the run list and read the data
316 ReadLength
= (ULONG
)min(DataRunLength
* Vcb
->NtfsInfo
.BytesPerCluster
- (Offset
- CurrentOffset
), Length
);
317 if (DataRunStartLCN
== -1)
319 RtlZeroMemory(Buffer
, ReadLength
);
320 Status
= STATUS_SUCCESS
;
324 Status
= NtfsReadDisk(Vcb
->StorageDevice
,
325 DataRunStartLCN
* Vcb
->NtfsInfo
.BytesPerCluster
+ Offset
- CurrentOffset
,
327 Vcb
->NtfsInfo
.BytesPerSector
,
331 if (NT_SUCCESS(Status
))
333 Length
-= ReadLength
;
334 Buffer
+= ReadLength
;
335 AlreadyRead
+= ReadLength
;
337 if (ReadLength
== DataRunLength
* Vcb
->NtfsInfo
.BytesPerCluster
- (Offset
- CurrentOffset
))
339 CurrentOffset
+= DataRunLength
* Vcb
->NtfsInfo
.BytesPerCluster
;
340 DataRun
= DecodeRun(DataRun
, &DataRunOffset
, &DataRunLength
);
341 if (DataRunOffset
!= (ULONGLONG
)-1)
343 DataRunStartLCN
= LastLCN
+ DataRunOffset
;
344 LastLCN
= DataRunStartLCN
;
347 DataRunStartLCN
= -1;
352 ReadLength
= (ULONG
)min(DataRunLength
* Vcb
->NtfsInfo
.BytesPerCluster
, Length
);
353 if (DataRunStartLCN
== -1)
354 RtlZeroMemory(Buffer
, ReadLength
);
357 Status
= NtfsReadDisk(Vcb
->StorageDevice
,
358 DataRunStartLCN
* Vcb
->NtfsInfo
.BytesPerCluster
,
360 Vcb
->NtfsInfo
.BytesPerSector
,
363 if (!NT_SUCCESS(Status
))
367 Length
-= ReadLength
;
368 Buffer
+= ReadLength
;
369 AlreadyRead
+= ReadLength
;
371 /* We finished this request, but there still data in this data run. */
372 if (Length
== 0 && ReadLength
!= DataRunLength
* Vcb
->NtfsInfo
.BytesPerCluster
)
376 * Go to next run in the list.
381 CurrentOffset
+= DataRunLength
* Vcb
->NtfsInfo
.BytesPerCluster
;
382 DataRun
= DecodeRun(DataRun
, &DataRunOffset
, &DataRunLength
);
383 if (DataRunOffset
!= -1)
385 /* Normal data run. */
386 DataRunStartLCN
= LastLCN
+ DataRunOffset
;
387 LastLCN
= DataRunStartLCN
;
391 /* Sparse data run. */
392 DataRunStartLCN
= -1;
398 Context
->CacheRun
= DataRun
;
399 Context
->CacheRunOffset
= Offset
+ AlreadyRead
;
400 Context
->CacheRunStartLCN
= DataRunStartLCN
;
401 Context
->CacheRunLength
= DataRunLength
;
402 Context
->CacheRunLastLCN
= LastLCN
;
403 Context
->CacheRunCurrentOffset
= CurrentOffset
;
410 * @name WriteAttribute
413 * Writes an NTFS attribute to the disk. It presently borrows a lot of code from ReadAttribute(),
414 * and it still needs more documentation / cleaning up.
417 * Volume Control Block indicating which volume to write the attribute to
420 * Pointer to an NTFS_ATTR_CONTEXT that has information about the attribute
423 * Offset, in bytes, from the beginning of the attribute indicating where to start
427 * The data that's being written to the device
430 * How much data will be written, in bytes
432 * @param RealLengthWritten
433 * Pointer to a ULONG which will receive how much data was written, in bytes
436 * STATUS_SUCCESS if successful, an error code otherwise. STATUS_NOT_IMPLEMENTED if
437 * writing to a sparse file.
439 * @remarks Note that in this context the word "attribute" isn't referring read-only, hidden,
440 * etc. - the file's data is actually stored in an attribute in NTFS parlance.
445 WriteAttribute(PDEVICE_EXTENSION Vcb
,
446 PNTFS_ATTR_CONTEXT Context
,
450 PULONG RealLengthWritten
)
454 LONGLONG DataRunOffset
;
455 ULONGLONG DataRunLength
;
456 LONGLONG DataRunStartLCN
;
457 ULONGLONG CurrentOffset
;
460 PUCHAR SourceBuffer
= Buffer
;
461 LONGLONG StartingOffset
;
463 DPRINT("WriteAttribute(%p, %p, %I64U, %p, %lu)\n", Vcb
, Context
, Offset
, Buffer
, Length
);
465 // is this a resident attribute?
466 if (!Context
->Record
.IsNonResident
)
468 DPRINT1("FIXME: Writing to resident NTFS records (small files) is not supported at this time.\n");
469 // (TODO: This should be really easy to implement)
471 /* LeftOver code from ReadAttribute(), may be helpful:
472 if (Offset > Context->Record.Resident.ValueLength)
474 if (Offset + Length > Context->Record.Resident.ValueLength)
475 Length = (ULONG)(Context->Record.Resident.ValueLength - Offset);
476 RtlCopyMemory(Buffer, (PCHAR)&Context->Record + Context->Record.Resident.ValueOffset + Offset, Length);
479 return STATUS_NOT_IMPLEMENTED
; // until we implement it
482 // This is a non-resident attribute.
484 // I. Find the corresponding start data run.
486 *RealLengthWritten
= 0;
488 // FIXME: Cache seems to be non-working. Disable it for now
489 //if(Context->CacheRunOffset <= Offset && Offset < Context->CacheRunOffset + Context->CacheRunLength * Volume->ClusterSize)
492 DataRun = Context->CacheRun;
493 LastLCN = Context->CacheRunLastLCN;
494 DataRunStartLCN = Context->CacheRunStartLCN;
495 DataRunLength = Context->CacheRunLength;
496 CurrentOffset = Context->CacheRunCurrentOffset;
501 DataRun
= (PUCHAR
)&Context
->Record
+ Context
->Record
.NonResident
.MappingPairsOffset
;
506 DataRun
= DecodeRun(DataRun
, &DataRunOffset
, &DataRunLength
);
507 if (DataRunOffset
!= -1)
510 // DPRINT1("Writing to normal data run, LastLCN %I64u DataRunOffset %I64d\n", LastLCN, DataRunOffset);
511 DataRunStartLCN
= LastLCN
+ DataRunOffset
;
512 LastLCN
= DataRunStartLCN
;
516 // Sparse data run. We can't support writing to sparse files yet
517 // (it may require increasing the allocation size).
518 DataRunStartLCN
= -1;
519 DPRINT1("FIXME: Writing to sparse files is not supported yet!\n");
520 return STATUS_NOT_IMPLEMENTED
;
523 // Have we reached the data run we're trying to write to?
524 if (Offset
>= CurrentOffset
&&
525 Offset
< CurrentOffset
+ (DataRunLength
* Vcb
->NtfsInfo
.BytesPerCluster
))
532 // We reached the last assigned cluster
533 // TODO: assign new clusters to the end of the file.
534 // (Presently, this code will never be reached, the write should have already failed by now)
535 return STATUS_END_OF_FILE
;
538 CurrentOffset
+= DataRunLength
* Vcb
->NtfsInfo
.BytesPerCluster
;
542 // II. Go through the run list and write the data
544 /* REVIEWME -- As adapted from NtfsReadAttribute():
545 We seem to be making a special case for the first applicable data run, but I'm not sure why.
546 Does it have something to do with (not) caching? Is this strategy equally applicable to writing? */
548 WriteLength
= (ULONG
)min(DataRunLength
* Vcb
->NtfsInfo
.BytesPerCluster
- (Offset
- CurrentOffset
), Length
);
550 StartingOffset
= DataRunStartLCN
* Vcb
->NtfsInfo
.BytesPerCluster
+ Offset
- CurrentOffset
;
552 // Write the data to the disk
553 Status
= NtfsWriteDisk(Vcb
->StorageDevice
,
556 Vcb
->NtfsInfo
.BytesPerSector
,
557 (PVOID
)SourceBuffer
);
559 // Did the write fail?
560 if (!NT_SUCCESS(Status
))
562 Context
->CacheRun
= DataRun
;
563 Context
->CacheRunOffset
= Offset
;
564 Context
->CacheRunStartLCN
= DataRunStartLCN
;
565 Context
->CacheRunLength
= DataRunLength
;
566 Context
->CacheRunLastLCN
= LastLCN
;
567 Context
->CacheRunCurrentOffset
= CurrentOffset
;
572 Length
-= WriteLength
;
573 SourceBuffer
+= WriteLength
;
574 *RealLengthWritten
+= WriteLength
;
576 // Did we write to the end of the data run?
577 if (WriteLength
== DataRunLength
* Vcb
->NtfsInfo
.BytesPerCluster
- (Offset
- CurrentOffset
))
579 // Advance to the next data run
580 CurrentOffset
+= DataRunLength
* Vcb
->NtfsInfo
.BytesPerCluster
;
581 DataRun
= DecodeRun(DataRun
, &DataRunOffset
, &DataRunLength
);
583 if (DataRunOffset
!= (ULONGLONG
)-1)
585 DataRunStartLCN
= LastLCN
+ DataRunOffset
;
586 LastLCN
= DataRunStartLCN
;
589 DataRunStartLCN
= -1;
592 // Do we have more data to write?
595 // Make sure we don't write past the end of the current data run
596 WriteLength
= (ULONG
)min(DataRunLength
* Vcb
->NtfsInfo
.BytesPerCluster
, Length
);
598 // Are we dealing with a sparse data run?
599 if (DataRunStartLCN
== -1)
601 DPRINT1("FIXME: Don't know how to write to sparse files yet! (DataRunStartLCN == -1)\n");
602 return STATUS_NOT_IMPLEMENTED
;
606 // write the data to the disk
607 Status
= NtfsWriteDisk(Vcb
->StorageDevice
,
608 DataRunStartLCN
* Vcb
->NtfsInfo
.BytesPerCluster
,
610 Vcb
->NtfsInfo
.BytesPerSector
,
611 (PVOID
)SourceBuffer
);
612 if (!NT_SUCCESS(Status
))
616 Length
-= WriteLength
;
617 SourceBuffer
+= WriteLength
;
618 *RealLengthWritten
+= WriteLength
;
620 // We finished this request, but there's still data in this data run.
621 if (Length
== 0 && WriteLength
!= DataRunLength
* Vcb
->NtfsInfo
.BytesPerCluster
)
624 // Go to next run in the list.
628 // that was the last run
631 // Failed sanity check.
632 DPRINT1("Encountered EOF before expected!\n");
633 return STATUS_END_OF_FILE
;
639 // Advance to the next data run
640 CurrentOffset
+= DataRunLength
* Vcb
->NtfsInfo
.BytesPerCluster
;
641 DataRun
= DecodeRun(DataRun
, &DataRunOffset
, &DataRunLength
);
642 if (DataRunOffset
!= -1)
645 DataRunStartLCN
= LastLCN
+ DataRunOffset
;
646 LastLCN
= DataRunStartLCN
;
651 DataRunStartLCN
= -1;
653 } // end while (Length > 0) [more data to write]
655 Context
->CacheRun
= DataRun
;
656 Context
->CacheRunOffset
= Offset
+ *RealLengthWritten
;
657 Context
->CacheRunStartLCN
= DataRunStartLCN
;
658 Context
->CacheRunLength
= DataRunLength
;
659 Context
->CacheRunLastLCN
= LastLCN
;
660 Context
->CacheRunCurrentOffset
= CurrentOffset
;
666 ReadFileRecord(PDEVICE_EXTENSION Vcb
,
668 PFILE_RECORD_HEADER file
)
672 DPRINT("ReadFileRecord(%p, %I64x, %p)\n", Vcb
, index
, file
);
674 BytesRead
= ReadAttribute(Vcb
, Vcb
->MFTContext
, index
* Vcb
->NtfsInfo
.BytesPerFileRecord
, (PCHAR
)file
, Vcb
->NtfsInfo
.BytesPerFileRecord
);
675 if (BytesRead
!= Vcb
->NtfsInfo
.BytesPerFileRecord
)
677 DPRINT1("ReadFileRecord failed: %I64u read, %u expected\n", BytesRead
, Vcb
->NtfsInfo
.BytesPerFileRecord
);
678 return STATUS_PARTIAL_COPY
;
681 /* Apply update sequence array fixups. */
682 return FixupUpdateSequenceArray(Vcb
, &file
->Ntfs
);
687 * Searches a file's parent directory (given the parent's index in the mft)
688 * for the given file. Upon finding an index entry for that file, updates
689 * Data Size and Allocated Size values in the $FILE_NAME attribute of that entry.
691 * (Most of this code was copied from NtfsFindMftRecord)
694 UpdateFileNameRecord(PDEVICE_EXTENSION Vcb
,
695 ULONGLONG ParentMFTIndex
,
696 PUNICODE_STRING FileName
,
698 ULONGLONG NewDataSize
,
699 ULONGLONG NewAllocationSize
)
701 PFILE_RECORD_HEADER MftRecord
;
702 PNTFS_ATTR_CONTEXT IndexRootCtx
;
703 PINDEX_ROOT_ATTRIBUTE IndexRoot
;
705 PINDEX_ENTRY_ATTRIBUTE IndexEntry
, IndexEntryEnd
;
707 ULONG CurrentEntry
= 0;
709 DPRINT("UpdateFileNameRecord(%p, %I64d, %wZ, %u, %I64u, %I64u)\n", Vcb
, ParentMFTIndex
, FileName
, DirSearch
, NewDataSize
, NewAllocationSize
);
711 MftRecord
= ExAllocatePoolWithTag(NonPagedPool
,
712 Vcb
->NtfsInfo
.BytesPerFileRecord
,
714 if (MftRecord
== NULL
)
716 return STATUS_INSUFFICIENT_RESOURCES
;
719 Status
= ReadFileRecord(Vcb
, ParentMFTIndex
, MftRecord
);
720 if (!NT_SUCCESS(Status
))
722 ExFreePoolWithTag(MftRecord
, TAG_NTFS
);
726 ASSERT(MftRecord
->Ntfs
.Type
== NRH_FILE_TYPE
);
727 Status
= FindAttribute(Vcb
, MftRecord
, AttributeIndexRoot
, L
"$I30", 4, &IndexRootCtx
, NULL
);
728 if (!NT_SUCCESS(Status
))
730 ExFreePoolWithTag(MftRecord
, TAG_NTFS
);
734 IndexRecord
= ExAllocatePoolWithTag(NonPagedPool
, Vcb
->NtfsInfo
.BytesPerIndexRecord
, TAG_NTFS
);
735 if (IndexRecord
== NULL
)
737 ReleaseAttributeContext(IndexRootCtx
);
738 ExFreePoolWithTag(MftRecord
, TAG_NTFS
);
739 return STATUS_INSUFFICIENT_RESOURCES
;
742 ReadAttribute(Vcb
, IndexRootCtx
, 0, IndexRecord
, Vcb
->NtfsInfo
.BytesPerIndexRecord
);
743 IndexRoot
= (PINDEX_ROOT_ATTRIBUTE
)IndexRecord
;
744 IndexEntry
= (PINDEX_ENTRY_ATTRIBUTE
)((PCHAR
)&IndexRoot
->Header
+ IndexRoot
->Header
.FirstEntryOffset
);
745 // Index root is always resident.
746 IndexEntryEnd
= (PINDEX_ENTRY_ATTRIBUTE
)(IndexRecord
+ IndexRoot
->Header
.TotalSizeOfEntries
);
748 DPRINT("IndexRecordSize: %x IndexBlockSize: %x\n", Vcb
->NtfsInfo
.BytesPerIndexRecord
, IndexRoot
->SizeOfEntry
);
750 Status
= UpdateIndexEntryFileNameSize(Vcb
,
753 IndexRoot
->SizeOfEntry
,
763 ReleaseAttributeContext(IndexRootCtx
);
764 ExFreePoolWithTag(IndexRecord
, TAG_NTFS
);
765 ExFreePoolWithTag(MftRecord
, TAG_NTFS
);
771 * Recursively searches directory index and applies the size update to the $FILE_NAME attribute of the
772 * proper index entry.
773 * (Heavily based on BrowseIndexEntries)
776 UpdateIndexEntryFileNameSize(PDEVICE_EXTENSION Vcb
,
777 PFILE_RECORD_HEADER MftRecord
,
779 ULONG IndexBlockSize
,
780 PINDEX_ENTRY_ATTRIBUTE FirstEntry
,
781 PINDEX_ENTRY_ATTRIBUTE LastEntry
,
782 PUNICODE_STRING FileName
,
786 ULONGLONG NewDataSize
,
787 ULONGLONG NewAllocatedSize
)
791 PINDEX_ENTRY_ATTRIBUTE IndexEntry
;
792 PNTFS_ATTR_CONTEXT IndexAllocationCtx
;
793 ULONGLONG IndexAllocationSize
;
794 PINDEX_BUFFER IndexBuffer
;
796 DPRINT("UpdateIndexEntrySize(%p, %p, %p, %u, %p, %p, %wZ, %u, %u, %u, %I64u, %I64u)\n", Vcb
, MftRecord
, IndexRecord
, IndexBlockSize
, FirstEntry
, LastEntry
, FileName
, *StartEntry
, *CurrentEntry
, DirSearch
, NewDataSize
, NewAllocatedSize
);
798 // find the index entry responsible for the file we're trying to update
799 IndexEntry
= FirstEntry
;
800 while (IndexEntry
< LastEntry
&&
801 !(IndexEntry
->Flags
& NTFS_INDEX_ENTRY_END
))
803 if ((IndexEntry
->Data
.Directory
.IndexedFile
& NTFS_MFT_MASK
) > 0x10 &&
804 *CurrentEntry
>= *StartEntry
&&
805 IndexEntry
->FileName
.NameType
!= NTFS_FILE_NAME_DOS
&&
806 CompareFileName(FileName
, IndexEntry
, DirSearch
))
808 *StartEntry
= *CurrentEntry
;
809 IndexEntry
->FileName
.DataSize
= NewDataSize
;
810 IndexEntry
->FileName
.AllocatedSize
= NewAllocatedSize
;
811 // indicate that the caller will still need to write the structure to the disk
812 return STATUS_PENDING
;
815 (*CurrentEntry
) += 1;
816 ASSERT(IndexEntry
->Length
>= sizeof(INDEX_ENTRY_ATTRIBUTE
));
817 IndexEntry
= (PINDEX_ENTRY_ATTRIBUTE
)((PCHAR
)IndexEntry
+ IndexEntry
->Length
);
820 /* If we're already browsing a subnode */
821 if (IndexRecord
== NULL
)
823 return STATUS_OBJECT_PATH_NOT_FOUND
;
826 /* If there's no subnode */
827 if (!(IndexEntry
->Flags
& NTFS_INDEX_ENTRY_NODE
))
829 return STATUS_OBJECT_PATH_NOT_FOUND
;
832 Status
= FindAttribute(Vcb
, MftRecord
, AttributeIndexAllocation
, L
"$I30", 4, &IndexAllocationCtx
, NULL
);
833 if (!NT_SUCCESS(Status
))
835 DPRINT("Corrupted filesystem!\n");
839 IndexAllocationSize
= AttributeDataLength(&IndexAllocationCtx
->Record
);
840 Status
= STATUS_OBJECT_PATH_NOT_FOUND
;
841 for (RecordOffset
= 0; RecordOffset
< IndexAllocationSize
; RecordOffset
+= IndexBlockSize
)
843 ReadAttribute(Vcb
, IndexAllocationCtx
, RecordOffset
, IndexRecord
, IndexBlockSize
);
844 Status
= FixupUpdateSequenceArray(Vcb
, &((PFILE_RECORD_HEADER
)IndexRecord
)->Ntfs
);
845 if (!NT_SUCCESS(Status
))
850 IndexBuffer
= (PINDEX_BUFFER
)IndexRecord
;
851 ASSERT(IndexBuffer
->Ntfs
.Type
== NRH_INDX_TYPE
);
852 ASSERT(IndexBuffer
->Header
.AllocatedSize
+ FIELD_OFFSET(INDEX_BUFFER
, Header
) == IndexBlockSize
);
853 FirstEntry
= (PINDEX_ENTRY_ATTRIBUTE
)((ULONG_PTR
)&IndexBuffer
->Header
+ IndexBuffer
->Header
.FirstEntryOffset
);
854 LastEntry
= (PINDEX_ENTRY_ATTRIBUTE
)((ULONG_PTR
)&IndexBuffer
->Header
+ IndexBuffer
->Header
.TotalSizeOfEntries
);
855 ASSERT(LastEntry
<= (PINDEX_ENTRY_ATTRIBUTE
)((ULONG_PTR
)IndexBuffer
+ IndexBlockSize
));
857 Status
= UpdateIndexEntryFileNameSize(NULL
, NULL
, NULL
, 0, FirstEntry
, LastEntry
, FileName
, StartEntry
, CurrentEntry
, DirSearch
, NewDataSize
, NewAllocatedSize
);
858 if (Status
== STATUS_PENDING
)
860 // write the index record back to disk
863 // first we need to update the fixup values for the index block
864 Status
= AddFixupArray(Vcb
, &((PFILE_RECORD_HEADER
)IndexRecord
)->Ntfs
);
865 if (!NT_SUCCESS(Status
))
867 DPRINT1("Error: Failed to update fixup sequence array!\n");
871 Status
= WriteAttribute(Vcb
, IndexAllocationCtx
, RecordOffset
, (const PUCHAR
)IndexRecord
, IndexBlockSize
, &Written
);
872 if (!NT_SUCCESS(Status
))
874 DPRINT1("ERROR Performing write!\n");
878 Status
= STATUS_SUCCESS
;
881 if (NT_SUCCESS(Status
))
887 ReleaseAttributeContext(IndexAllocationCtx
);
894 * Writes a file record to the master file table, at a given index.
897 UpdateFileRecord(PDEVICE_EXTENSION Vcb
,
899 PFILE_RECORD_HEADER file
)
902 NTSTATUS Status
= STATUS_SUCCESS
;
904 DPRINT("UpdateFileRecord(%p, %I64x, %p)\n", Vcb
, index
, file
);
906 // Add the fixup array to prepare the data for writing to disk
907 AddFixupArray(Vcb
, &file
->Ntfs
);
909 // write the file record to the master file table
910 Status
= WriteAttribute(Vcb
, Vcb
->MFTContext
, index
* Vcb
->NtfsInfo
.BytesPerFileRecord
, (const PUCHAR
)file
, Vcb
->NtfsInfo
.BytesPerFileRecord
, &BytesWritten
);
912 // TODO: Update MFT mirror
914 if (!NT_SUCCESS(Status
))
916 DPRINT1("UpdateFileRecord failed: %I64u written, %u expected\n", BytesWritten
, Vcb
->NtfsInfo
.BytesPerFileRecord
);
924 FixupUpdateSequenceArray(PDEVICE_EXTENSION Vcb
,
925 PNTFS_RECORD_HEADER Record
)
932 USA
= (USHORT
*)((PCHAR
)Record
+ Record
->UsaOffset
);
933 USANumber
= *(USA
++);
934 USACount
= Record
->UsaCount
- 1; /* Exclude the USA Number. */
935 Block
= (USHORT
*)((PCHAR
)Record
+ Vcb
->NtfsInfo
.BytesPerSector
- 2);
937 DPRINT("FixupUpdateSequenceArray(%p, %p)\nUSANumber: %u\tUSACount: %u\n", Vcb
, Record
, USANumber
, USACount
);
941 if (*Block
!= USANumber
)
943 DPRINT1("Mismatch with USA: %u read, %u expected\n" , *Block
, USANumber
);
944 return STATUS_UNSUCCESSFUL
;
947 Block
= (USHORT
*)((PCHAR
)Block
+ Vcb
->NtfsInfo
.BytesPerSector
);
951 return STATUS_SUCCESS
;
955 AddFixupArray(PDEVICE_EXTENSION Vcb
,
956 PNTFS_RECORD_HEADER Record
)
958 USHORT
*pShortToFixUp
;
959 unsigned int ArrayEntryCount
= Record
->UsaCount
- 1;
960 unsigned int Offset
= Vcb
->NtfsInfo
.BytesPerSector
- 2;
963 PFIXUP_ARRAY fixupArray
= (PFIXUP_ARRAY
)((UCHAR
*)Record
+ Record
->UsaOffset
);
965 DPRINT("AddFixupArray(%p, %p)\n fixupArray->USN: %u, ArrayEntryCount: %u\n", Vcb
, Record
, fixupArray
->USN
, ArrayEntryCount
);
969 for (i
= 0; i
< ArrayEntryCount
; i
++)
971 DPRINT("USN: %u\tOffset: %u\n", fixupArray
->USN
, Offset
);
973 pShortToFixUp
= (USHORT
*)((PCHAR
)Record
+ Offset
);
974 fixupArray
->Array
[i
] = *pShortToFixUp
;
975 *pShortToFixUp
= fixupArray
->USN
;
976 Offset
+= Vcb
->NtfsInfo
.BytesPerSector
;
979 return STATUS_SUCCESS
;
983 ReadLCN(PDEVICE_EXTENSION Vcb
,
988 LARGE_INTEGER DiskSector
;
990 DiskSector
.QuadPart
= lcn
;
992 return NtfsReadSectors(Vcb
->StorageDevice
,
993 DiskSector
.u
.LowPart
* Vcb
->NtfsInfo
.SectorsPerCluster
,
994 count
* Vcb
->NtfsInfo
.SectorsPerCluster
,
995 Vcb
->NtfsInfo
.BytesPerSector
,
1002 CompareFileName(PUNICODE_STRING FileName
,
1003 PINDEX_ENTRY_ATTRIBUTE IndexEntry
,
1006 BOOLEAN Ret
, Alloc
= FALSE
;
1007 UNICODE_STRING EntryName
;
1009 EntryName
.Buffer
= IndexEntry
->FileName
.Name
;
1011 EntryName
.MaximumLength
= IndexEntry
->FileName
.NameLength
* sizeof(WCHAR
);
1015 UNICODE_STRING IntFileName
;
1016 if (IndexEntry
->FileName
.NameType
!= NTFS_FILE_NAME_POSIX
)
1018 NT_VERIFY(NT_SUCCESS(RtlUpcaseUnicodeString(&IntFileName
, FileName
, TRUE
)));
1023 IntFileName
= *FileName
;
1026 Ret
= FsRtlIsNameInExpression(&IntFileName
, &EntryName
, (IndexEntry
->FileName
.NameType
!= NTFS_FILE_NAME_POSIX
), NULL
);
1030 RtlFreeUnicodeString(&IntFileName
);
1037 return (RtlCompareUnicodeString(FileName
, &EntryName
, (IndexEntry
->FileName
.NameType
!= NTFS_FILE_NAME_POSIX
)) == 0);
1044 DumpIndexEntry(PINDEX_ENTRY_ATTRIBUTE IndexEntry
)
1046 DPRINT1("Entry: %p\n", IndexEntry
);
1047 DPRINT1("\tData.Directory.IndexedFile: %I64x\n", IndexEntry
->Data
.Directory
.IndexedFile
);
1048 DPRINT1("\tLength: %u\n", IndexEntry
->Length
);
1049 DPRINT1("\tKeyLength: %u\n", IndexEntry
->KeyLength
);
1050 DPRINT1("\tFlags: %x\n", IndexEntry
->Flags
);
1051 DPRINT1("\tReserved: %x\n", IndexEntry
->Reserved
);
1052 DPRINT1("\t\tDirectoryFileReferenceNumber: %I64x\n", IndexEntry
->FileName
.DirectoryFileReferenceNumber
);
1053 DPRINT1("\t\tCreationTime: %I64u\n", IndexEntry
->FileName
.CreationTime
);
1054 DPRINT1("\t\tChangeTime: %I64u\n", IndexEntry
->FileName
.ChangeTime
);
1055 DPRINT1("\t\tLastWriteTime: %I64u\n", IndexEntry
->FileName
.LastWriteTime
);
1056 DPRINT1("\t\tLastAccessTime: %I64u\n", IndexEntry
->FileName
.LastAccessTime
);
1057 DPRINT1("\t\tAllocatedSize: %I64u\n", IndexEntry
->FileName
.AllocatedSize
);
1058 DPRINT1("\t\tDataSize: %I64u\n", IndexEntry
->FileName
.DataSize
);
1059 DPRINT1("\t\tFileAttributes: %x\n", IndexEntry
->FileName
.FileAttributes
);
1060 DPRINT1("\t\tNameLength: %u\n", IndexEntry
->FileName
.NameLength
);
1061 DPRINT1("\t\tNameType: %x\n", IndexEntry
->FileName
.NameType
);
1062 DPRINT1("\t\tName: %.*S\n", IndexEntry
->FileName
.NameLength
, IndexEntry
->FileName
.Name
);
1067 BrowseIndexEntries(PDEVICE_EXTENSION Vcb
,
1068 PFILE_RECORD_HEADER MftRecord
,
1070 ULONG IndexBlockSize
,
1071 PINDEX_ENTRY_ATTRIBUTE FirstEntry
,
1072 PINDEX_ENTRY_ATTRIBUTE LastEntry
,
1073 PUNICODE_STRING FileName
,
1075 PULONG CurrentEntry
,
1077 ULONGLONG
*OutMFTIndex
)
1081 PINDEX_ENTRY_ATTRIBUTE IndexEntry
;
1082 PNTFS_ATTR_CONTEXT IndexAllocationCtx
;
1083 ULONGLONG IndexAllocationSize
;
1084 PINDEX_BUFFER IndexBuffer
;
1086 DPRINT("BrowseIndexEntries(%p, %p, %p, %u, %p, %p, %wZ, %u, %u, %u, %p)\n", Vcb
, MftRecord
, IndexRecord
, IndexBlockSize
, FirstEntry
, LastEntry
, FileName
, *StartEntry
, *CurrentEntry
, DirSearch
, OutMFTIndex
);
1088 IndexEntry
= FirstEntry
;
1089 while (IndexEntry
< LastEntry
&&
1090 !(IndexEntry
->Flags
& NTFS_INDEX_ENTRY_END
))
1092 if ((IndexEntry
->Data
.Directory
.IndexedFile
& NTFS_MFT_MASK
) > 0x10 &&
1093 *CurrentEntry
>= *StartEntry
&&
1094 IndexEntry
->FileName
.NameType
!= NTFS_FILE_NAME_DOS
&&
1095 CompareFileName(FileName
, IndexEntry
, DirSearch
))
1097 *StartEntry
= *CurrentEntry
;
1098 *OutMFTIndex
= (IndexEntry
->Data
.Directory
.IndexedFile
& NTFS_MFT_MASK
);
1099 return STATUS_SUCCESS
;
1102 (*CurrentEntry
) += 1;
1103 ASSERT(IndexEntry
->Length
>= sizeof(INDEX_ENTRY_ATTRIBUTE
));
1104 IndexEntry
= (PINDEX_ENTRY_ATTRIBUTE
)((PCHAR
)IndexEntry
+ IndexEntry
->Length
);
1107 /* If we're already browsing a subnode */
1108 if (IndexRecord
== NULL
)
1110 return STATUS_OBJECT_PATH_NOT_FOUND
;
1113 /* If there's no subnode */
1114 if (!(IndexEntry
->Flags
& NTFS_INDEX_ENTRY_NODE
))
1116 return STATUS_OBJECT_PATH_NOT_FOUND
;
1119 Status
= FindAttribute(Vcb
, MftRecord
, AttributeIndexAllocation
, L
"$I30", 4, &IndexAllocationCtx
, NULL
);
1120 if (!NT_SUCCESS(Status
))
1122 DPRINT("Corrupted filesystem!\n");
1126 IndexAllocationSize
= AttributeDataLength(&IndexAllocationCtx
->Record
);
1127 Status
= STATUS_OBJECT_PATH_NOT_FOUND
;
1128 for (RecordOffset
= 0; RecordOffset
< IndexAllocationSize
; RecordOffset
+= IndexBlockSize
)
1130 ReadAttribute(Vcb
, IndexAllocationCtx
, RecordOffset
, IndexRecord
, IndexBlockSize
);
1131 Status
= FixupUpdateSequenceArray(Vcb
, &((PFILE_RECORD_HEADER
)IndexRecord
)->Ntfs
);
1132 if (!NT_SUCCESS(Status
))
1137 IndexBuffer
= (PINDEX_BUFFER
)IndexRecord
;
1138 ASSERT(IndexBuffer
->Ntfs
.Type
== NRH_INDX_TYPE
);
1139 ASSERT(IndexBuffer
->Header
.AllocatedSize
+ FIELD_OFFSET(INDEX_BUFFER
, Header
) == IndexBlockSize
);
1140 FirstEntry
= (PINDEX_ENTRY_ATTRIBUTE
)((ULONG_PTR
)&IndexBuffer
->Header
+ IndexBuffer
->Header
.FirstEntryOffset
);
1141 LastEntry
= (PINDEX_ENTRY_ATTRIBUTE
)((ULONG_PTR
)&IndexBuffer
->Header
+ IndexBuffer
->Header
.TotalSizeOfEntries
);
1142 ASSERT(LastEntry
<= (PINDEX_ENTRY_ATTRIBUTE
)((ULONG_PTR
)IndexBuffer
+ IndexBlockSize
));
1144 Status
= BrowseIndexEntries(NULL
, NULL
, NULL
, 0, FirstEntry
, LastEntry
, FileName
, StartEntry
, CurrentEntry
, DirSearch
, OutMFTIndex
);
1145 if (NT_SUCCESS(Status
))
1151 ReleaseAttributeContext(IndexAllocationCtx
);
1156 NtfsFindMftRecord(PDEVICE_EXTENSION Vcb
,
1158 PUNICODE_STRING FileName
,
1161 ULONGLONG
*OutMFTIndex
)
1163 PFILE_RECORD_HEADER MftRecord
;
1164 PNTFS_ATTR_CONTEXT IndexRootCtx
;
1165 PINDEX_ROOT_ATTRIBUTE IndexRoot
;
1167 PINDEX_ENTRY_ATTRIBUTE IndexEntry
, IndexEntryEnd
;
1169 ULONG CurrentEntry
= 0;
1171 DPRINT("NtfsFindMftRecord(%p, %I64d, %wZ, %u, %u, %p)\n", Vcb
, MFTIndex
, FileName
, *FirstEntry
, DirSearch
, OutMFTIndex
);
1173 MftRecord
= ExAllocatePoolWithTag(NonPagedPool
,
1174 Vcb
->NtfsInfo
.BytesPerFileRecord
,
1176 if (MftRecord
== NULL
)
1178 return STATUS_INSUFFICIENT_RESOURCES
;
1181 Status
= ReadFileRecord(Vcb
, MFTIndex
, MftRecord
);
1182 if (!NT_SUCCESS(Status
))
1184 ExFreePoolWithTag(MftRecord
, TAG_NTFS
);
1188 ASSERT(MftRecord
->Ntfs
.Type
== NRH_FILE_TYPE
);
1189 Status
= FindAttribute(Vcb
, MftRecord
, AttributeIndexRoot
, L
"$I30", 4, &IndexRootCtx
, NULL
);
1190 if (!NT_SUCCESS(Status
))
1192 ExFreePoolWithTag(MftRecord
, TAG_NTFS
);
1196 IndexRecord
= ExAllocatePoolWithTag(NonPagedPool
, Vcb
->NtfsInfo
.BytesPerIndexRecord
, TAG_NTFS
);
1197 if (IndexRecord
== NULL
)
1199 ReleaseAttributeContext(IndexRootCtx
);
1200 ExFreePoolWithTag(MftRecord
, TAG_NTFS
);
1201 return STATUS_INSUFFICIENT_RESOURCES
;
1204 ReadAttribute(Vcb
, IndexRootCtx
, 0, IndexRecord
, Vcb
->NtfsInfo
.BytesPerIndexRecord
);
1205 IndexRoot
= (PINDEX_ROOT_ATTRIBUTE
)IndexRecord
;
1206 IndexEntry
= (PINDEX_ENTRY_ATTRIBUTE
)((PCHAR
)&IndexRoot
->Header
+ IndexRoot
->Header
.FirstEntryOffset
);
1207 /* Index root is always resident. */
1208 IndexEntryEnd
= (PINDEX_ENTRY_ATTRIBUTE
)(IndexRecord
+ IndexRoot
->Header
.TotalSizeOfEntries
);
1209 ReleaseAttributeContext(IndexRootCtx
);
1211 DPRINT("IndexRecordSize: %x IndexBlockSize: %x\n", Vcb
->NtfsInfo
.BytesPerIndexRecord
, IndexRoot
->SizeOfEntry
);
1213 Status
= BrowseIndexEntries(Vcb
, MftRecord
, IndexRecord
, IndexRoot
->SizeOfEntry
, IndexEntry
, IndexEntryEnd
, FileName
, FirstEntry
, &CurrentEntry
, DirSearch
, OutMFTIndex
);
1215 ExFreePoolWithTag(IndexRecord
, TAG_NTFS
);
1216 ExFreePoolWithTag(MftRecord
, TAG_NTFS
);
1222 NtfsLookupFileAt(PDEVICE_EXTENSION Vcb
,
1223 PUNICODE_STRING PathName
,
1224 PFILE_RECORD_HEADER
*FileRecord
,
1225 PULONGLONG MFTIndex
,
1226 ULONGLONG CurrentMFTIndex
)
1228 UNICODE_STRING Current
, Remaining
;
1230 ULONG FirstEntry
= 0;
1232 DPRINT("NtfsLookupFileAt(%p, %wZ, %p, %I64x)\n", Vcb
, PathName
, FileRecord
, CurrentMFTIndex
);
1234 FsRtlDissectName(*PathName
, &Current
, &Remaining
);
1236 while (Current
.Length
!= 0)
1238 DPRINT("Current: %wZ\n", &Current
);
1240 Status
= NtfsFindMftRecord(Vcb
, CurrentMFTIndex
, &Current
, &FirstEntry
, FALSE
, &CurrentMFTIndex
);
1241 if (!NT_SUCCESS(Status
))
1246 if (Remaining
.Length
== 0)
1249 FsRtlDissectName(Current
, &Current
, &Remaining
);
1252 *FileRecord
= ExAllocatePoolWithTag(NonPagedPool
, Vcb
->NtfsInfo
.BytesPerFileRecord
, TAG_NTFS
);
1253 if (*FileRecord
== NULL
)
1255 DPRINT("NtfsLookupFileAt: Can't allocate MFT record\n");
1256 return STATUS_INSUFFICIENT_RESOURCES
;
1259 Status
= ReadFileRecord(Vcb
, CurrentMFTIndex
, *FileRecord
);
1260 if (!NT_SUCCESS(Status
))
1262 DPRINT("NtfsLookupFileAt: Can't read MFT record\n");
1263 ExFreePoolWithTag(*FileRecord
, TAG_NTFS
);
1267 *MFTIndex
= CurrentMFTIndex
;
1269 return STATUS_SUCCESS
;
1273 NtfsLookupFile(PDEVICE_EXTENSION Vcb
,
1274 PUNICODE_STRING PathName
,
1275 PFILE_RECORD_HEADER
*FileRecord
,
1276 PULONGLONG MFTIndex
)
1278 return NtfsLookupFileAt(Vcb
, PathName
, FileRecord
, MFTIndex
, NTFS_FILE_ROOT
);
1282 NtfsFindFileAt(PDEVICE_EXTENSION Vcb
,
1283 PUNICODE_STRING SearchPattern
,
1285 PFILE_RECORD_HEADER
*FileRecord
,
1286 PULONGLONG MFTIndex
,
1287 ULONGLONG CurrentMFTIndex
)
1291 DPRINT("NtfsFindFileAt(%p, %wZ, %u, %p, %p, %I64x)\n", Vcb
, SearchPattern
, *FirstEntry
, FileRecord
, MFTIndex
, CurrentMFTIndex
);
1293 Status
= NtfsFindMftRecord(Vcb
, CurrentMFTIndex
, SearchPattern
, FirstEntry
, TRUE
, &CurrentMFTIndex
);
1294 if (!NT_SUCCESS(Status
))
1296 DPRINT("NtfsFindFileAt: NtfsFindMftRecord() failed with status 0x%08lx\n", Status
);
1300 *FileRecord
= ExAllocatePoolWithTag(NonPagedPool
, Vcb
->NtfsInfo
.BytesPerFileRecord
, TAG_NTFS
);
1301 if (*FileRecord
== NULL
)
1303 DPRINT("NtfsFindFileAt: Can't allocate MFT record\n");
1304 return STATUS_INSUFFICIENT_RESOURCES
;
1307 Status
= ReadFileRecord(Vcb
, CurrentMFTIndex
, *FileRecord
);
1308 if (!NT_SUCCESS(Status
))
1310 DPRINT("NtfsFindFileAt: Can't read MFT record\n");
1311 ExFreePoolWithTag(*FileRecord
, TAG_NTFS
);
1315 *MFTIndex
= CurrentMFTIndex
;
1317 return STATUS_SUCCESS
;