test: ntfs_rec.h File Reference

00198 : 00199 00200 This routine looks at the buffer passed in which contains the NTFS boot 00201 sector and determines whether or not it represents an NTFS volume. 00202 00203 Arguments: 00204 00205 BootSector - Pointer to buffer containing a potential NTFS boot sector. 00206 00207 BytesPerSector - Supplies the number of bytes per sector for the drive. 00208 00209 NumberOfSectors - Supplies the number of sectors on the partition. 00210 00211 Return Value: 00212 00213 The function returns TRUE if the buffer contains a recognizable NTFS boot 00214 sector, otherwise it returns FALSE. 00215 00216 --*/ 00217 00218 { 00219 PAGED_CODE(); 00220 00221 // 00222 // Now perform all the checks, starting with the Name and Checksum. 00223 // The remaining checks should be obvious, including some fields which 00224 // must be 0 and other fields which must be a small power of 2. 00225 // 00226 00227 if (BootSector->Oem[0] == 'N' && 00228 BootSector->Oem[1] == 'T' && 00229 BootSector->Oem[2] == 'F' && 00230 BootSector->Oem[3] == 'S' && 00231 BootSector->Oem[4] == ' ' && 00232 BootSector->Oem[5] == ' ' && 00233 BootSector->Oem[6] == ' ' && 00234 BootSector->Oem[7] == ' ' 00235 00236 && 00237 00238 // 00239 // Check number of bytes per sector. The low order byte of this 00240 // number must be zero (smallest sector size = 0x100) and the 00241 // high order byte shifted must equal the bytes per sector gotten 00242 // from the device and stored in the Vcb. And just to be sure, 00243 // sector size must be less than page size. 00244 // 00245 00246 BootSector->PackedBpb.BytesPerSector[0] == 0 00247 00248 && 00249 00250 ((ULONG) (BootSector->PackedBpb.BytesPerSector[1] << 8) == BytesPerSector) 00251 00252 && 00253 00254 BootSector->PackedBpb.BytesPerSector[1] << 8 <= PAGE_SIZE 00255 00256 && 00257 00258 // 00259 // Sectors per cluster must be a power of 2. 00260 // 00261 00262 (BootSector->PackedBpb.SectorsPerCluster[0] == 0x1 || 00263 BootSector->PackedBpb.SectorsPerCluster[0] == 0x2 || 00264 BootSector->PackedBpb.SectorsPerCluster[0] == 0x4 || 00265 BootSector->PackedBpb.SectorsPerCluster[0] == 0x8 || 00266 BootSector->PackedBpb.SectorsPerCluster[0] == 0x10 || 00267 BootSector->PackedBpb.SectorsPerCluster[0] == 0x20 || 00268 BootSector->PackedBpb.SectorsPerCluster[0] == 0x40 || 00269 BootSector->PackedBpb.SectorsPerCluster[0] == 0x80) 00270 00271 && 00272 00273 // 00274 // These fields must all be zero. For both Fat and HPFS, some of 00275 // these fields must be nonzero. 00276 // 00277 00278 BootSector->PackedBpb.ReservedSectors[0] == 0 && 00279 BootSector->PackedBpb.ReservedSectors[1] == 0 && 00280 BootSector->PackedBpb.Fats[0] == 0 && 00281 BootSector->PackedBpb.RootEntries[0] == 0 && 00282 BootSector->PackedBpb.RootEntries[1] == 0 && 00283 BootSector->PackedBpb.Sectors[0] == 0 && 00284 BootSector->PackedBpb.Sectors[1] == 0 && 00285 BootSector->PackedBpb.SectorsPerFat[0] == 0 && 00286 BootSector->PackedBpb.SectorsPerFat[1] == 0 && 00287 BootSector->PackedBpb.LargeSectors[0] == 0 && 00288 BootSector->PackedBpb.LargeSectors[1] == 0 && 00289 BootSector->PackedBpb.LargeSectors[2] == 0 && 00290 BootSector->PackedBpb.LargeSectors[3] == 0 00291 00292 && 00293 00294 // 00295 // Number of Sectors cannot be greater than the number of sectors 00296 // on the partition. 00297 // 00298 00299 !( BootSector->NumberSectors.QuadPart > NumberOfSectors->QuadPart ) 00300 00301 && 00302 00303 // 00304 // Check that both Lcn values are for sectors within the partition. 00305 // 00306 00307 !( BootSector->MftStartLcn.QuadPart * 00308 BootSector->PackedBpb.SectorsPerCluster[0] > 00309 NumberOfSectors->QuadPart ) 00310 00311 && 00312 00313 !( BootSector->Mft2StartLcn.QuadPart * 00314 BootSector->PackedBpb.SectorsPerCluster[0] > 00315 NumberOfSectors->QuadPart ) 00316 00317 && 00318 00319 // 00320 // Clusters per file record segment and default clusters for Index 00321 // Allocation Buffers must be a power of 2. A negative number indicates 00322 // a shift value to get the actual size of the structure. 00323 // 00324 00325 ((BootSector->ClustersPerFileRecordSegment >= -31 && 00326 BootSector->ClustersPerFileRecordSegment <= -9) || 00327 BootSector->ClustersPerFileRecordSegment == 0x1 || 00328 BootSector->ClustersPerFileRecordSegment == 0x2 || 00329 BootSector->ClustersPerFileRecordSegment == 0x4 || 00330 BootSector->ClustersPerFileRecordSegment == 0x8 || 00331 BootSector->ClustersPerFileRecordSegment == 0x10 || 00332 BootSector->ClustersPerFileRecordSegment == 0x20 || 00333 BootSector->ClustersPerFileRecordSegment == 0x40) 00334 00335 && 00336 00337 ((BootSector->DefaultClustersPerIndexAllocationBuffer >= -31 && 00338 BootSector->DefaultClustersPerIndexAllocationBuffer <= -9) || 00339 BootSector->DefaultClustersPerIndexAllocationBuffer == 0x1 || 00340 BootSector->DefaultClustersPerIndexAllocationBuffer == 0x2 || 00341 BootSector->DefaultClustersPerIndexAllocationBuffer == 0x4 || 00342 BootSector->DefaultClustersPerIndexAllocationBuffer == 0x8 || 00343 BootSector->DefaultClustersPerIndexAllocationBuffer == 0x10 || 00344 BootSector->DefaultClustersPerIndexAllocationBuffer == 0x20 || 00345 BootSector->DefaultClustersPerIndexAllocationBuffer == 0x40)) { 00346 00347 return TRUE; 00348 00349 } else { 00350 00351 // 00352 // This does not appear to be an NTFS volume. 00353 // 00354 00355 return FALSE; 00356 } 00357 }


Classes
struct	_PACKED_BIOS_PARAMETER_BLOCK
struct	_PACKED_BOOT_SECTOR
Typedefs
typedef LARGE_INTEGER	LCN
typedef LCN *	PLCN
typedef LARGE_INTEGER	VCN
typedef VCN *	PVCN
typedef LARGE_INTEGER	LBO
typedef LBO *	PLBO
typedef LARGE_INTEGER	VBO
typedef VBO *	PVBO
typedef _PACKED_BIOS_PARAMETER_BLOCK	PACKED_BIOS_PARAMETER_BLOCK
typedef PACKED_BIOS_PARAMETER_BLOCK *	PPACKED_BIOS_PARAMETER_BLOCK
typedef _PACKED_BOOT_SECTOR	PACKED_BOOT_SECTOR
typedef PACKED_BOOT_SECTOR *	PPACKED_BOOT_SECTOR
Functions
BOOLEAN	IsNtfsVolume (IN PPACKED_BOOT_SECTOR BootSector, IN ULONG BytesPerSector, IN PLARGE_INTEGER NumberOfSectors)

ntfs_rec.h File Reference

Classes

Typedefs

Functions

Typedef Documentation

Function Documentation