}
+static
+VOID
+NtfsDumpIndexRootAttribute(PATTRIBUTE Attribute)
+{
+ PRESIDENT_ATTRIBUTE ResAttr;
+ PINDEX_ROOT_ATTRIBUTE IndexRootAttr;
+
+ ResAttr = (PRESIDENT_ATTRIBUTE)Attribute;
+ IndexRootAttr = (PINDEX_ROOT_ATTRIBUTE)((ULONG_PTR)ResAttr + ResAttr->ValueOffset);
+
+ if (IndexRootAttr->AttributeType == AttributeFileName)
+ ASSERT(IndexRootAttr->CollationRule == COLLATION_FILE_NAME);
+
+ DbgPrint(" $INDEX_ROOT (%uB, %u) ", IndexRootAttr->SizeOfEntry, IndexRootAttr->ClustersPerIndexRecord);
+}
+
+
static
VOID
NtfsDumpAttribute (PATTRIBUTE Attribute)
break;
case AttributeIndexRoot:
- DbgPrint(" $INDEX_ROOT ");
+ NtfsDumpIndexRootAttribute(Attribute);
break;
case AttributeIndexAllocation:
AttributeLoggedUtilityStream = 0x100
} ATTRIBUTE_TYPE, *PATTRIBUTE_TYPE;
+#define COLLATION_BINARY 0x00
+#define COLLATION_FILE_NAME 0x01
+#define COLLATION_UNICODE_STRING 0x02
+#define COLLATION_NTOFS_ULONG 0x10
+#define COLLATION_NTOFS_SID 0x11
+#define COLLATION_NTOFS_SECURITY_HASH 0x12
+#define COLLATION_NTOFS_ULONGS 0x13
+
typedef struct
{
WCHAR Name[1];
} FILENAME_ATTRIBUTE, *PFILENAME_ATTRIBUTE;
+typedef struct
+{
+ ULONG AttributeType;
+ ULONG CollationRule;
+ ULONG SizeOfEntry;
+ UCHAR ClustersPerIndexRecord;
+ UCHAR Padding[3];
+} INDEX_ROOT_ATTRIBUTE, *PINDEX_ROOT_ATTRIBUTE;
+
typedef struct
{
ULONGLONG Unknown1;