#define NTFS_H
#include <ntifs.h>
-#include <ntddk.h>
-#include <ntdddisk.h>
#define CACHEPAGESIZE(pDeviceExt) \
((pDeviceExt)->NtfsInfo.UCHARsPerCluster > PAGE_SIZE ? \
ULARGE_INTEGER MftStart;
ULARGE_INTEGER MftMirrStart;
ULONG BytesPerFileRecord;
+ ULONG BytesPerIndexRecord;
ULONGLONG SerialNumber;
USHORT VolumeLabelLength;
AttributeLoggedUtilityStream = 0x100
} ATTRIBUTE_TYPE, *PATTRIBUTE_TYPE;
+#define COLLATION_BINARY 0x00
+#define COLLATION_FILE_NAME 0x01
+#define COLLATION_UNICODE_STRING 0x02
+#define COLLATION_NTOFS_ULONG 0x10
+#define COLLATION_NTOFS_SID 0x11
+#define COLLATION_NTOFS_SECURITY_HASH 0x12
+#define COLLATION_NTOFS_ULONGS 0x13
+
+#define INDEX_ROOT_SMALL 0x0
+#define INDEX_ROOT_LARGE 0x1
typedef struct
{
WCHAR Name[1];
} FILENAME_ATTRIBUTE, *PFILENAME_ATTRIBUTE;
+typedef struct
+{
+ ULONG FirstEntryOffset;
+ ULONG TotalSizeOfEntries;
+ ULONG AllocatedSize;
+ UCHAR Flags;
+ UCHAR Padding[3];
+} INDEX_HEADER_ATTRIBUTE, *PINDEX_HEADER_ATTRIBUTE;
+
+typedef struct
+{
+ ULONG AttributeType;
+ ULONG CollationRule;
+ ULONG SizeOfEntry;
+ UCHAR ClustersPerIndexRecord;
+ UCHAR Padding[3];
+ INDEX_HEADER_ATTRIBUTE Header;
+} INDEX_ROOT_ATTRIBUTE, *PINDEX_ROOT_ATTRIBUTE;
+
typedef struct
{
ULONGLONG Unknown1;