Main Page | Class Hierarchy | Class List | File List | Class Members | File Members

ntfs_rec.h

Go to the documentation of this file.
00001 /*++ 00002 00003 Copyright (c) 1992 Microsoft Corporation 00004 00005 Module Name: 00006 00007 ntfs_rec.h 00008 00009 Abstract: 00010 00011 This module contains the mini-file system recognizer for NTFS. 00012 00013 Author: 00014 00015 Darryl E. Havens (darrylh) 8-dec-1992 00016 00017 Environment: 00018 00019 Kernel mode, local to I/O system 00020 00021 Revision History: 00022 00023 00024 --*/ 00025 00026 // 00027 // The fundamental unit of allocation on an Ntfs volume is the 00028 // cluster. Format guarantees that the cluster size is an integral 00029 // power of two times the physical sector size of the device. Ntfs 00030 // reserves 64-bits to describe a cluster, in order to support 00031 // large disks. The LCN represents a physical cluster number on 00032 // the disk, and the VCN represents a virtual cluster number within 00033 // an attribute. 00034 // 00035 00036 typedef LARGE_INTEGER LCN; 00037 typedef LCN *PLCN; 00038 00039 typedef LARGE_INTEGER VCN; 00040 typedef VCN *PVCN; 00041 00042 typedef LARGE_INTEGER LBO; 00043 typedef LBO *PLBO; 00044 00045 typedef LARGE_INTEGER VBO; 00046 typedef VBO *PVBO; 00047 00048 // 00049 // The boot sector is duplicated on the partition. The first copy 00050 // is on the first physical sector (LBN == 0) of the partition, and 00051 // the second copy is at <number sectors on partition> / 2. If the 00052 // first copy can not be read when trying to mount the disk, the 00053 // second copy may be read and has the identical contents. Format 00054 // must figure out which cluster the second boot record belongs in, 00055 // and it must zero all of the other sectors that happen to be in 00056 // the same cluster. The boot file minimally contains with two 00057 // clusters, which are the two clusters which contain the copies of 00058 // the boot record. If format knows that some system likes to put 00059 // code somewhere, then it should also align this requirement to 00060 // even clusters, and add that to the boot file as well. 00061 // 00062 // Part of the sector contains a BIOS Parameter Block. The BIOS in 00063 // the sector is packed (i.e., unaligned) so we'll supply an 00064 // unpacking macro to translate a packed BIOS into its unpacked 00065 // equivalent. The unpacked BIOS structure is already defined in 00066 // ntioapi.h so we only need to define the packed BIOS. 00067 // 00068 00069 // 00070 // Define the Packed and Unpacked BIOS Parameter Block 00071 // 00072 00073 typedef struct _PACKED_BIOS_PARAMETER_BLOCK { 00074 00075 UCHAR BytesPerSector[2]; // offset = 0x000 00076 UCHAR SectorsPerCluster[1]; // offset = 0x002 00077 UCHAR ReservedSectors[2]; // offset = 0x003 (zero) 00078 UCHAR Fats[1]; // offset = 0x005 (zero) 00079 UCHAR RootEntries[2]; // offset = 0x006 (zero) 00080 UCHAR Sectors[2]; // offset = 0x008 (zero) 00081 UCHAR Media[1]; // offset = 0x00A 00082 UCHAR SectorsPerFat[2]; // offset = 0x00B (zero) 00083 UCHAR SectorsPerTrack[2]; // offset = 0x00D 00084 UCHAR Heads[2]; // offset = 0x00F 00085 UCHAR HiddenSectors[4]; // offset = 0x011 (zero) 00086 UCHAR LargeSectors[4]; // offset = 0x015 (zero) 00087 00088 } PACKED_BIOS_PARAMETER_BLOCK; // sizeof = 0x019 00089 00090 typedef PACKED_BIOS_PARAMETER_BLOCK *PPACKED_BIOS_PARAMETER_BLOCK; 00091 00092 // 00093 // Define the boot sector. Note that MFT2 is exactly three file 00094 // record segments long, and it mirrors the first three file record 00095 // segments from the MFT, which are MFT, MFT2 and the Log File. 00096 // 00097 // The Oem field contains the ASCII characters "NTFS ". 00098 // 00099 // The Checksum field is a simple additive checksum of all of the 00100 // ULONGs which precede the Checksum ULONG. The rest of the sector 00101 // is not included in this Checksum. 00102 // 00103 00104 typedef struct _PACKED_BOOT_SECTOR { 00105 00106 UCHAR Jump[3]; // offset = 0x000 00107 UCHAR Oem[8]; // offset = 0x003 00108 PACKED_BIOS_PARAMETER_BLOCK PackedBpb; // offset = 0x00B 00109 UCHAR Unused[4]; // offset = 0x024 00110 LARGE_INTEGER NumberSectors; // offset = 0x028 00111 LCN MftStartLcn; // offset = 0x030 00112 LCN Mft2StartLcn; // offset = 0x038 00113 CHAR ClustersPerFileRecordSegment; // offset = 0x040 00114 UCHAR Reserved0[3]; 00115 CHAR DefaultClustersPerIndexAllocationBuffer; // offset = 0x044 00116 UCHAR Reserved1[3]; 00117 LARGE_INTEGER SerialNumber; // offset = 0x048 00118 ULONG Checksum; // offset = 0x050 00119 UCHAR BootStrap[0x200-0x054]; // offset = 0x054 00120 00121 } PACKED_BOOT_SECTOR; // sizeof = 0x200 00122 00123 typedef PACKED_BOOT_SECTOR *PPACKED_BOOT_SECTOR; 00124 00125 // 00126 // Define the functions provided by this driver. 00127 // 00128 00129 BOOLEAN 00130 IsNtfsVolume( 00131 IN PPACKED_BOOT_SECTOR BootSector, 00132 IN ULONG BytesPerSector, 00133 IN PLARGE_INTEGER NumberOfSectors 00134 ); 00135

Generated on Sat May 15 19:41:00 2004 for test by doxygen 1.3.7