1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
|
/*
* AUTHOR
* N. Nielsen
*
* LICENSE
* This software is in the public domain.
*
* The software is provided "as is", without warranty of any kind,
* express or implied, including but not limited to the warranties
* of merchantability, fitness for a particular purpose, and
* noninfringement. In no event shall the author(s) be liable for any
* claim, damages, or other liability, whether in an action of
* contract, tort, or otherwise, arising from, out of, or in connection
* with the software or the use or other dealings in the software.
*
* SUPPORT
* Send bug reports to: <nielsen@memberwebs.com>
*/
#ifndef __NTFSX_H__
#define __NTFSX_H__
#include "drive.h"
#include "ntfs.h"
/* used as a heap based object */
typedef struct _ntfsx_datarun
{
byte* _mem; /* ref counted */
byte* _datarun;
byte* _curpos;
bool sparse;
uint64 cluster;
uint64 length;
}
ntfsx_datarun;
ntfsx_datarun* ntfsx_datarun_alloc(byte* mem, byte* datarun);
void ntfsx_datarun_free(ntfsx_datarun* dr);
bool ntfsx_datarun_first(ntfsx_datarun* dr);
bool ntfsx_datarun_next(ntfsx_datarun* dr);
/* used as a stack based object */
typedef struct _ntfsx_cluster
{
uint32 size;
byte* data; /* ref counted */
}
ntfsx_cluster;
void ntfsx_cluster_reserve(ntfsx_cluster* clus, partitioninfo* info);
bool ntfsx_cluster_read(ntfsx_cluster* clus, partitioninfo* info, uint64 begSector, int dd);
void ntfsx_cluster_release(ntfsx_cluster* clus);
/* used as a heap based object */
typedef struct _ntfsx_attribute
{
ntfs_attribheader* _header;
byte* _mem; /* ref counted */
uint32 _length;
}
ntfsx_attribute;
ntfsx_attribute* ntfsx_attribute_alloc(ntfsx_cluster* clus, ntfs_attribheader* header);
void ntfsx_attribute_free(ntfsx_attribute* attr);
ntfs_attribheader* ntfsx_attribute_header(ntfsx_attribute* attr);
void* ntfsx_attribute_getresidentdata(ntfsx_attribute* attr);
uint32 ntfsx_attribute_getresidentsize(ntfsx_attribute* attr);
ntfsx_datarun* ntfsx_attribute_getdatarun(ntfsx_attribute* attr);
/* used as a heap based object */
typedef struct _ntfsx_record
{
partitioninfo* info;
ntfsx_cluster _clus;
}
ntfsx_record;
ntfsx_record* ntfsx_record_alloc(partitioninfo* info);
ntfsx_cluster* ntfsx_record_cluster(ntfsx_record* record);
void ntfsx_record_free(ntfsx_record* record);
bool ntfsx_record_read(ntfsx_record* record, uint64 begSector, int dd);
ntfs_recordheader* ntfsx_record_header(ntfsx_record* record);
ntfsx_attribute* ntfsx_record_findattribute(ntfsx_record* record, uint32 attrType, int dd);
/* used as a heap based object */
typedef struct _ntfsx_attrib_enum
{
ntfs_attribheader* _attrhead; /* The last attribute examined */
ntfs_attriblistrecord* _listrec; /* The last attr list record examined */
unsigned char _flags; /* Whether to search through the list first */
uint32 type; /* The type we're going for */
}
ntfsx_attrib_enum;
ntfsx_attrib_enum* ntfsx_attrib_enum_alloc(uint32 type, bool normal);
ntfsx_attribute* ntfsx_attrib_enum_all(ntfsx_attrib_enum* attrenum, ntfsx_record* record);
ntfsx_attribute* ntfsx_attrib_enum_inline(ntfsx_attrib_enum* attrenum, ntfsx_record* record);
ntfsx_attribute* ntfsx_attrib_enum_list(ntfsx_attrib_enum* attrenum, ntfsx_record* record);
void ntfsx_attrib_enum_free(ntfsx_attrib_enum* attrenum);
/* used as a stack based object */
struct _ntfsx_mftmap_block;
typedef struct _ntfsx_mftmap
{
partitioninfo* info;
struct _ntfsx_mftmap_block* _blocks;
uint32 _count;
}
ntfsx_mftmap;
void ntfsx_mftmap_init(ntfsx_mftmap* map,partitioninfo* info);
void ntfsx_mftmap_destroy(ntfsx_mftmap* map);
bool ntfsx_mftmap_load(ntfsx_mftmap* map, ntfsx_record* record, int dd);
uint64 ntfsx_mftmap_length(ntfsx_mftmap* map);
uint64 ntfsx_mftmap_sectorforindex(ntfsx_mftmap* map, uint64 index);
#endif
|
