#define TAG_NTFS 'SFTN'
#define ROUND_UP(N, S) ((((N) + (S) - 1) / (S)) * (S))
+#define ROUND_DOWN(N, S) ((N) - ((N) % (S)))
#define DEVICE_NAME L"\\Ntfs"
#define NTFS_FILE_TYPE_HIDDEN 0x2
#define NTFS_FILE_TYPE_SYSTEM 0x4
#define NTFS_FILE_TYPE_ARCHIVE 0x20
+#define NTFS_FILE_TYPE_REPARSE 0x400
#define NTFS_FILE_TYPE_COMPRESSED 0x800
#define NTFS_FILE_TYPE_DIRECTORY 0x10000000
/* NTFS_RECORD_HEADER.Type */
#define NRH_FILE_TYPE 0x454C4946 /* 'FILE' */
+#define NRH_INDX_TYPE 0x58444E49 /* 'INDX' */
typedef struct _FILE_RECORD_HEADER
ULONGLONG AllocatedSize;
ULONGLONG DataSize;
ULONG FileAttributes;
- ULONG AlignmentOrReserved;
+ union
+ {
+ struct
+ {
+ USHORT PackedEaSize;
+ USHORT AlignmentOrReserved;
+ } EaInfo;
+ ULONG ReparseTag;
+ } Extended;
UCHAR NameLength;
UCHAR NameType;
WCHAR Name[1];
NtfsDumpFileAttributes(PFILE_RECORD_HEADER FileRecord);
PFILENAME_ATTRIBUTE
-GetFileNameFromRecord(PFILE_RECORD_HEADER FileRecord);
+GetFileNameFromRecord(PFILE_RECORD_HEADER FileRecord, UCHAR NameType);
+
+PFILENAME_ATTRIBUTE
+GetBestFileNameFromRecord(PFILE_RECORD_HEADER FileRecord);
/* blockdev.c */
NtfsReadDisk(IN PDEVICE_OBJECT DeviceObject,
IN LONGLONG StartingOffset,
IN ULONG Length,
+ IN ULONG SectorSize,
IN OUT PUCHAR Buffer,
IN BOOLEAN Override);
/* mft.c */
+VOID
+ReleaseAttributeContext(PNTFS_ATTR_CONTEXT Context);
+
ULONG
ReadAttribute(PDEVICE_EXTENSION Vcb,
PNTFS_ATTR_CONTEXT Context,
ULONG Count);
#endif
-VOID
-NtfsDateTimeToFileTime(ULONGLONG NtfsTime,
- PLARGE_INTEGER SystemTime);
-
VOID
NtfsFileFlagsToAttributes(ULONG NtfsAttributes,
PULONG FileAttributes);
/* volinfo.c */
+ULONGLONG
+NtfsGetFreeClusters(PDEVICE_EXTENSION DeviceExt);
+
NTSTATUS
NtfsQueryVolumeInformation(PNTFS_IRP_CONTEXT IrpContext);