45 |
uint8_t reserved2[3]; |
uint8_t reserved2[3]; |
46 |
uint8_t volume_serial[8]; |
uint8_t volume_serial[8]; |
47 |
uint16_t checksum; |
uint16_t checksum; |
48 |
} __attribute__((__packed__)); |
} PACKED; |
49 |
|
|
50 |
struct master_file_table_record { |
struct master_file_table_record { |
51 |
uint8_t magic[4]; |
uint8_t magic[4]; |
58 |
uint16_t flags; |
uint16_t flags; |
59 |
uint32_t bytes_in_use; |
uint32_t bytes_in_use; |
60 |
uint32_t bytes_allocated; |
uint32_t bytes_allocated; |
61 |
} __attribute__((__packed__)); |
} PACKED; |
62 |
|
|
63 |
struct file_attribute { |
struct file_attribute { |
64 |
uint32_t type; |
uint32_t type; |
70 |
uint16_t instance; |
uint16_t instance; |
71 |
uint32_t value_len; |
uint32_t value_len; |
72 |
uint16_t value_offset; |
uint16_t value_offset; |
73 |
} __attribute__((__packed__)); |
} PACKED; |
74 |
|
|
75 |
struct volume_info { |
struct volume_info { |
76 |
uint64_t reserved; |
uint64_t reserved; |
77 |
uint8_t major_ver; |
uint8_t major_ver; |
78 |
uint8_t minor_ver; |
uint8_t minor_ver; |
79 |
} __attribute__((__packed__)); |
} PACKED; |
80 |
|
|
81 |
#define MFT_RECORD_VOLUME 3 |
#define MFT_RECORD_VOLUME 3 |
82 |
#define MFT_RECORD_ATTR_VOLUME_NAME 0x60 |
#define MFT_RECORD_ATTR_VOLUME_NAME 0x60 |
84 |
#define MFT_RECORD_ATTR_OBJECT_ID 0x40 |
#define MFT_RECORD_ATTR_OBJECT_ID 0x40 |
85 |
#define MFT_RECORD_ATTR_END 0xffffffffu |
#define MFT_RECORD_ATTR_END 0xffffffffu |
86 |
|
|
87 |
int volume_id_probe_ntfs(struct volume_id *id, uint64_t off) |
int FAST_FUNC volume_id_probe_ntfs(struct volume_id *id /*,uint64_t off*/) |
88 |
{ |
{ |
89 |
|
#define off ((uint64_t)0) |
90 |
unsigned sector_size; |
unsigned sector_size; |
91 |
unsigned cluster_size; |
unsigned cluster_size; |
92 |
uint64_t mft_cluster; |
uint64_t mft_cluster; |