test: ntfs_rec.h Source File

Main Page | Class Hierarchy | Class List | File List | Class Members | File Members

# ntfs_rec.h

Go to the documentation of this file.

    00001 /*++
    00002
    00003 Copyright (c) 1992  Microsoft Corporation
    00004
    00005 Module Name:
    00006
    00007     ntfs_rec.h
    00008
    00009 Abstract:
    00010
    00011     This module contains the mini-file system recognizer for NTFS.
    00012
    00013 Author:
    00014
    00015     Darryl E. Havens (darrylh) 8-dec-1992
    00016
    00017 Environment:
    00018
    00019     Kernel mode, local to I/O system
    00020
    00021 Revision History:
    00022
    00023
    00024 --*/
    00025
    00026 //
    00027 //  The fundamental unit of allocation on an Ntfs volume is the
    00028 //  cluster.  Format guarantees that the cluster size is an integral
    00029 //  power of two times the physical sector size of the device.  Ntfs
    00030 //  reserves 64-bits to describe a cluster, in order to support
    00031 //  large disks.  The LCN represents a physical cluster number on
    00032 //  the disk, and the VCN represents a virtual cluster number within
    00033 //  an attribute.
    00034 //
    00035
    00036 typedef LARGE_INTEGER LCN;
    00037 typedef LCN *PLCN;
    00038
    00039 typedef LARGE_INTEGER VCN;
    00040 typedef VCN *PVCN;
    00041
    00042 typedef LARGE_INTEGER LBO;
    00043 typedef LBO *PLBO;
    00044
    00045 typedef LARGE_INTEGER VBO;
    00046 typedef VBO *PVBO;
    00047
    00048 //
    00049 //  The boot sector is duplicated on the partition.  The first copy
    00050 //  is on the first physical sector (LBN == 0) of the partition, and
    00051 //  the second copy is at <number sectors on partition> / 2.  If the
    00052 //  first copy can not be read when trying to mount the disk, the
    00053 //  second copy may be read and has the identical contents.  Format
    00054 //  must figure out which cluster the second boot record belongs in,
    00055 //  and it must zero all of the other sectors that happen to be in
    00056 //  the same cluster.  The boot file minimally contains with two
    00057 //  clusters, which are the two clusters which contain the copies of
    00058 //  the boot record.  If format knows that some system likes to put
    00059 //  code somewhere, then it should also align this requirement to
    00060 //  even clusters, and add that to the boot file as well.
    00061 //
    00062 //  Part of the sector contains a BIOS Parameter Block.  The BIOS in
    00063 //  the sector is packed (i.e., unaligned) so we'll supply an
    00064 //  unpacking macro to translate a packed BIOS into its unpacked
    00065 //  equivalent.  The unpacked BIOS structure is already defined in
    00066 //  ntioapi.h so we only need to define the packed BIOS.
    00067 //
    00068
    00069 //
    00070 //  Define the Packed and Unpacked BIOS Parameter Block
    00071 //
    00072
    00073 typedef struct _PACKED_BIOS_PARAMETER_BLOCK {
    00074
    00075     UCHAR  BytesPerSector[2];                               //  offset = 0x000
    00076     UCHAR  SectorsPerCluster[1];                            //  offset = 0x002
    00077     UCHAR  ReservedSectors[2];                              //  offset = 0x003 (zero)
    00078     UCHAR  Fats[1];                                         //  offset = 0x005 (zero)
    00079     UCHAR  RootEntries[2];                                  //  offset = 0x006 (zero)
    00080     UCHAR  Sectors[2];                                      //  offset = 0x008 (zero)
    00081     UCHAR  Media[1];                                        //  offset = 0x00A
    00082     UCHAR  SectorsPerFat[2];                                //  offset = 0x00B (zero)
    00083     UCHAR  SectorsPerTrack[2];                              //  offset = 0x00D
    00084     UCHAR  Heads[2];                                        //  offset = 0x00F
    00085     UCHAR  HiddenSectors[4];                                //  offset = 0x011 (zero)
    00086     UCHAR  LargeSectors[4];                                 //  offset = 0x015 (zero)
    00087
    00088 } PACKED_BIOS_PARAMETER_BLOCK;                              //  sizeof = 0x019
    00089
    00090 typedef PACKED_BIOS_PARAMETER_BLOCK *PPACKED_BIOS_PARAMETER_BLOCK;
    00091
    00092 //
    00093 //  Define the boot sector.  Note that MFT2 is exactly three file
    00094 //  record segments long, and it mirrors the first three file record
    00095 //  segments from the MFT, which are MFT, MFT2 and the Log File.
    00096 //
    00097 //  The Oem field contains the ASCII characters "NTFS    ".
    00098 //
    00099 //  The Checksum field is a simple additive checksum of all of the
    00100 //  ULONGs which precede the Checksum ULONG.  The rest of the sector
    00101 //  is not included in this Checksum.
    00102 //
    00103
    00104 typedef struct _PACKED_BOOT_SECTOR {
    00105
    00106     UCHAR Jump[3];                                                  //  offset = 0x000
    00107     UCHAR Oem[8];                                                   //  offset = 0x003
    00108     PACKED_BIOS_PARAMETER_BLOCK PackedBpb;                          //  offset = 0x00B
    00109     UCHAR Unused[4];                                                //  offset = 0x024
    00110     LARGE_INTEGER NumberSectors;                                    //  offset = 0x028
    00111     LCN MftStartLcn;                                                //  offset = 0x030
    00112     LCN Mft2StartLcn;                                               //  offset = 0x038
    00113     CHAR ClustersPerFileRecordSegment;                              //  offset = 0x040
    00114     UCHAR Reserved0[3];
    00115     CHAR DefaultClustersPerIndexAllocationBuffer;                   //  offset = 0x044
    00116     UCHAR Reserved1[3];
    00117     LARGE_INTEGER SerialNumber;                                     //  offset = 0x048
    00118     ULONG Checksum;                                                 //  offset = 0x050
    00119     UCHAR BootStrap[0x200-0x054];                                   //  offset = 0x054
    00120
    00121 } PACKED_BOOT_SECTOR;                                               //  sizeof = 0x200
    00122
    00123 typedef PACKED_BOOT_SECTOR *PPACKED_BOOT_SECTOR;
    00124
    00125 //
    00126 // Define the functions provided by this driver.
    00127 //
    00128
    00129 BOOLEAN
    00130 IsNtfsVolume(
    00131     IN PPACKED_BOOT_SECTOR BootSector,
    00132     IN ULONG BytesPerSector,
    00133     IN PLARGE_INTEGER NumberOfSectors
    00134     );
    00135