389 lines
7.5 KiB
C++
389 lines
7.5 KiB
C++
/*++
|
|
|
|
Copyright (c) 1999-2001 Microsoft Corporation
|
|
|
|
Module Name:
|
|
|
|
mftinfo.hxx
|
|
|
|
Abstract:
|
|
|
|
This module contains the declarations for the NTFS_MFT_INFO
|
|
class, which stores extracted information from the NTFS MFT.
|
|
|
|
Author:
|
|
|
|
Daniel Chan (danielch) Oct 18, 1999
|
|
|
|
Environment:
|
|
|
|
ULIB, User Mode
|
|
|
|
--*/
|
|
|
|
#if !defined( _NTFS_MFT_INFO_DEFN_ )
|
|
|
|
#define _NTFS_MFT_INFO_DEFN_
|
|
|
|
#include "membmgr2.hxx"
|
|
|
|
DECLARE_CLASS( NTFS_UPCASE_TABLE );
|
|
|
|
typedef UCHAR FILE_NAME_SIGNATURE[4];
|
|
typedef UCHAR DUP_INFO_SIGNATURE[4];
|
|
|
|
DEFINE_POINTER_AND_REFERENCE_TYPES( FILE_NAME_SIGNATURE );
|
|
DEFINE_POINTER_AND_REFERENCE_TYPES( DUP_INFO_SIGNATURE );
|
|
|
|
struct _NTFS_FILE_NAME_INFO {
|
|
FILE_NAME_SIGNATURE Signature;
|
|
UCHAR Flags;
|
|
UCHAR Reserved[3];
|
|
};
|
|
|
|
struct _NTFS_FRS_INFO {
|
|
MFT_SEGMENT_REFERENCE SegmentReference;
|
|
DUP_INFO_SIGNATURE DupInfoSignature;
|
|
USHORT NumberOfFileNames;
|
|
USHORT Reserved;
|
|
struct _NTFS_FILE_NAME_INFO FileNameInfo[1];
|
|
};
|
|
|
|
DEFINE_TYPE( _NTFS_FRS_INFO, NTFS_FRS_INFO );
|
|
|
|
class NTFS_MFT_INFO : public OBJECT {
|
|
|
|
public:
|
|
|
|
UNTFS_EXPORT
|
|
DECLARE_CONSTRUCTOR( NTFS_MFT_INFO );
|
|
|
|
VIRTUAL
|
|
UNTFS_EXPORT
|
|
~NTFS_MFT_INFO(
|
|
);
|
|
|
|
NONVIRTUAL
|
|
UNTFS_EXPORT
|
|
BOOLEAN
|
|
Initialize(
|
|
IN BIG_INT NumOfFrs,
|
|
IN PNTFS_UPCASE_TABLE UpcaseTable,
|
|
IN UCHAR Major,
|
|
IN UCHAR Minor,
|
|
IN ULONG64 MaxMemUse
|
|
);
|
|
|
|
NONVIRTUAL
|
|
UNTFS_EXPORT
|
|
BOOLEAN
|
|
Initialize(
|
|
);
|
|
|
|
NONVIRTUAL
|
|
BOOLEAN
|
|
IsInRange(
|
|
IN VCN FileNumber
|
|
);
|
|
|
|
NONVIRTUAL
|
|
VOID
|
|
UpdateRange(
|
|
IN VCN FileNumber
|
|
);
|
|
|
|
NONVIRTUAL
|
|
VCN
|
|
QueryMinFileNumber(
|
|
);
|
|
|
|
NONVIRTUAL
|
|
VCN
|
|
QueryMaxFileNumber(
|
|
);
|
|
|
|
NONVIRTUAL
|
|
PVOID
|
|
QueryIndexEntryInfo(
|
|
IN VCN FileNumber
|
|
);
|
|
|
|
STATIC
|
|
NONVIRTUAL
|
|
UNTFS_EXPORT
|
|
MFT_SEGMENT_REFERENCE
|
|
QuerySegmentReference(
|
|
IN PVOID FrsInfo
|
|
);
|
|
|
|
STATIC
|
|
NONVIRTUAL
|
|
UNTFS_EXPORT
|
|
BOOLEAN
|
|
CompareFileName(
|
|
IN PVOID FrsInfo,
|
|
IN ULONG ValueLength,
|
|
IN PFILE_NAME FileName,
|
|
OUT PUSHORT FileNameIndex
|
|
);
|
|
|
|
STATIC
|
|
NONVIRTUAL
|
|
UNTFS_EXPORT
|
|
BOOLEAN
|
|
CompareDupInfo(
|
|
IN PVOID FrsInfo,
|
|
IN PFILE_NAME FileName
|
|
);
|
|
|
|
STATIC
|
|
NONVIRTUAL
|
|
UNTFS_EXPORT
|
|
UCHAR
|
|
QueryFlags(
|
|
IN PVOID FrsInfo,
|
|
IN USHORT FileNameIndex
|
|
);
|
|
|
|
NONVIRTUAL
|
|
BOOLEAN
|
|
ExtractIndexEntryInfo(
|
|
IN PNTFS_FILE_RECORD_SEGMENT Frs,
|
|
IN PMESSAGE Message,
|
|
IN BOOLEAN IgnoreFileName,
|
|
OUT PBOOLEAN OutOfMemory
|
|
);
|
|
|
|
private:
|
|
|
|
NONVIRTUAL
|
|
VOID
|
|
Construct(
|
|
);
|
|
|
|
NONVIRTUAL
|
|
VOID
|
|
Destroy(
|
|
);
|
|
|
|
STATIC
|
|
NONVIRTUAL
|
|
UNTFS_EXPORT
|
|
VOID
|
|
ComputeFileNameSignature(
|
|
IN ULONG ValueLength,
|
|
IN PFILE_NAME FileName,
|
|
OUT FILE_NAME_SIGNATURE Signature
|
|
);
|
|
|
|
STATIC
|
|
NONVIRTUAL
|
|
UNTFS_EXPORT
|
|
VOID
|
|
ComputeDupInfoSignature(
|
|
IN PDUPLICATED_INFORMATION DupInfo,
|
|
OUT DUP_INFO_SIGNATURE Signature
|
|
);
|
|
|
|
VCN _min_file_number;
|
|
VCN _max_file_number;
|
|
|
|
PVOID *_mft_info;
|
|
STATIC PNTFS_UPCASE_TABLE _upcase_table;
|
|
STATIC UCHAR _major;
|
|
STATIC UCHAR _minor;
|
|
MEM_ALLOCATOR _mem_mgr;
|
|
ULONG64 _max_mem_use;
|
|
ULONG _num_of_files;
|
|
};
|
|
|
|
INLINE
|
|
VCN
|
|
NTFS_MFT_INFO::QueryMinFileNumber(
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine returns the minimum file number captured so far.
|
|
|
|
|
|
Arguments:
|
|
|
|
N/A
|
|
|
|
Return Value:
|
|
|
|
Minimum File Number
|
|
|
|
--*/
|
|
{
|
|
return _min_file_number;
|
|
}
|
|
|
|
INLINE
|
|
VCN
|
|
NTFS_MFT_INFO::QueryMaxFileNumber(
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine returns the maximum file number captured so far.
|
|
|
|
|
|
Arguments:
|
|
|
|
N/A
|
|
|
|
Return Value:
|
|
|
|
Maximum File Number
|
|
|
|
--*/
|
|
{
|
|
return _max_file_number;
|
|
}
|
|
|
|
INLINE
|
|
BOOLEAN
|
|
NTFS_MFT_INFO::IsInRange(
|
|
IN VCN FileNumber
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This routine checks the file number to see if it is within range of
|
|
an NTFS_MFT_INFO object.
|
|
|
|
|
|
Arguments:
|
|
|
|
FileNumber - file number to check
|
|
|
|
Return Value:
|
|
|
|
TRUE if FileNumber falls within the range of the NTFS_MFT_INFO object;
|
|
otherwise, FALSE.
|
|
|
|
--*/
|
|
{
|
|
return (_min_file_number <= FileNumber && FileNumber <= _max_file_number);
|
|
}
|
|
|
|
INLINE
|
|
PVOID
|
|
NTFS_MFT_INFO::QueryIndexEntryInfo(
|
|
IN VCN FileNumber
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This method returns a pointer to a frs information.
|
|
|
|
Arguments:
|
|
|
|
FileNumber - file number to check
|
|
|
|
Return Value:
|
|
|
|
Pointer to base frs information.
|
|
|
|
--*/
|
|
{
|
|
ASSERT(IsInRange(FileNumber));
|
|
return _mft_info[FileNumber.GetLowPart()];
|
|
}
|
|
|
|
INLINE
|
|
MFT_SEGMENT_REFERENCE
|
|
NTFS_MFT_INFO::QuerySegmentReference(
|
|
IN PVOID FrsInfo
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This method retrieves the Segment Reference of the frs
|
|
from the FrsInfo pointer.
|
|
|
|
Arguments:
|
|
|
|
FrsInfo -- Pointer to the FRS information block.
|
|
|
|
Returns:
|
|
|
|
Segment Reference of the FRS.
|
|
|
|
--*/
|
|
{
|
|
ASSERT(FrsInfo);
|
|
return ((PNTFS_FRS_INFO)FrsInfo)->SegmentReference;
|
|
}
|
|
|
|
INLINE
|
|
BOOLEAN
|
|
NTFS_MFT_INFO::CompareDupInfo(
|
|
IN PVOID FrsInfo,
|
|
IN PFILE_NAME FileName
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This method compares the given FileName signature to that in FrsInfo.
|
|
|
|
Arguments:
|
|
|
|
FrsInfo -- Pointer to the FRS information block.
|
|
FileName -- Pointer to the file name.
|
|
|
|
Returns:
|
|
|
|
TRUE -- if equals
|
|
FALSE -- if not equal
|
|
|
|
--*/
|
|
{
|
|
DUP_INFO_SIGNATURE dupinfo;
|
|
|
|
ASSERT(FrsInfo);
|
|
NTFS_MFT_INFO::ComputeDupInfoSignature(&(FileName->Info), dupinfo);
|
|
return memcmp(dupinfo,
|
|
((PNTFS_FRS_INFO)FrsInfo)->DupInfoSignature,
|
|
sizeof(DUP_INFO_SIGNATURE)) == 0;
|
|
}
|
|
|
|
INLINE
|
|
UCHAR
|
|
NTFS_MFT_INFO::QueryFlags(
|
|
IN PVOID FrsInfo,
|
|
IN USHORT FileNameIndex
|
|
)
|
|
/*++
|
|
|
|
Routine Description:
|
|
|
|
This method compares the given FileName signature to that in FrsInfo.
|
|
|
|
Arguments:
|
|
|
|
FrsInfo -- Pointer to the FRS information block.
|
|
FileNameIndex -- Supplies the index of the file name
|
|
|
|
Returns:
|
|
|
|
TRUE -- if equals
|
|
FALSE -- if not equal
|
|
|
|
--*/
|
|
{
|
|
ASSERT(FrsInfo);
|
|
ASSERT(((PNTFS_FRS_INFO)FrsInfo)->NumberOfFileNames > FileNameIndex);
|
|
return ((PNTFS_FRS_INFO)FrsInfo)->FileNameInfo[FileNameIndex].Flags;
|
|
}
|
|
|
|
#endif
|