Difference between revisions of "Unit NTFSClass"

From Ultibo.org
Jump to: navigation, search
Line 32: Line 32:
  
  
'''NTFS disk table'''
+
'''NTFS specific classes'''
  
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
<code>TNTFSDiskTable = class(TDiskTable)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
|-
+
|colspan="2"|Note: Respresents the $Mft and $MftMirr
+
|-
+
|colspan="2"|&nbsp;  
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FStartSector:Int64;</code>
+
| Absolute starting sector of this table
+
|-
+
| <code>FStartCluster:Int64;</code>
+
| Absolute starting cluster of this table
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FEntry:TNTFSDiskEntry;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property StartSector:Int64 read FStartSector write FStartSector;</code>
+
| &nbsp;
+
|-
+
| <code>property StartCluster:Int64 read FStartCluster write FStartCluster;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
 
|-
 
|-
| <code>property Entry:TNTFSDiskEntry read FEntry write FEntry;</code>
+
| [[TNTFSDiskTable|<code>TNTFSDiskTable = class(TDiskTable)</code>]]
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS disk block'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSDiskBlock = class(TDiskBlock)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
|-
+
|colspan="2"|Note: Represents a block of $Bitmap entries
+
|-
+
|colspan="2"|&nbsp;  
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FBlockCount:LongWord;</code>
+
| Number of cluster entries in this block (Bits in the bitmap)
+
|-
+
| <code>FBlockBuffer:Pointer;</code>
+
| &nbsp;
+
|-
+
| <code>FBlockCluster:Int64;</code>
+
| First cluster represented by this block (BlockNo represents the VCN of the block)
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property BlockCount:LongWord read FBlockCount write FBlockCount;</code>
+
| &nbsp;
+
|-
+
| <code>property BlockBuffer:Pointer read FBlockBuffer write FBlockBuffer;</code>
+
| &nbsp;
+
 
|-
 
|-
| <code>property BlockCluster:Int64 read FBlockCluster write FBlockCluster;</code>
+
| [[TNTFSDiskBlock|<code>TNTFSDiskBlock = class(TDiskBlock)</code>]]
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS disk entry'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSDiskEntry = class(TDiskEntry)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|Note: Represents a file entry.
+
| [[TNTFSDiskEntry|<code>TNTFSDiskEntry = class(TDiskEntry)</code>]]
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle; AOrigin:TNTFSDiskRecord; AAttribute:TNTFSDiskAttribute);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FPrevEntry:TNTFSDiskEntry;</code>
+
| &nbsp;
+
|-
+
| <code>FNextEntry:TNTFSDiskEntry;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FUsed:Int64;</code>
+
| Used size of the file
+
|-
+
| <code>FAllocated:Int64;</code>
+
| Allocated size of file
+
|-
+
| <code>FChangeTime:TFileTime;</code>
+
| MFT record change time
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FOrigin:TNTFSDiskRecord;</code>
+
| Entry origin record
+
|-
+
| <code>FAttribute:TNTFSDiskAttribute;</code>
+
| Entry naming attribute
+
|-
+
| <code>FAlternate:TNTFSDiskAttribute;</code>
+
| Alternate name attribute
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>procedure SetOrigin(AOrigin:TNTFSDiskRecord);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property LocalLock:TMutexHandle read FLocalLock write FLocalLock;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property PrevEntry:TNTFSDiskEntry read FPrevEntry write FPrevEntry;</code>
+
| &nbsp;
+
|-
+
| <code>property NextEntry:TNTFSDiskEntry read FNextEntry write FNextEntry;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Used:Int64 read FUsed write FUsed;</code>
+
| &nbsp;
+
|-
+
| <code>property Allocated:Int64 read FAllocated write FAllocated;</code>
+
| &nbsp;
+
|-
+
| <code>property ChangeTime:TFileTime read FChangeTime write FChangeTime;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Origin:TNTFSDiskRecord read FOrigin write SetOrigin;</code>
+
| &nbsp;
+
|-
+
| <code>property Attribute:TNTFSDiskAttribute read FAttribute write FAttribute;</code>
+
| &nbsp;
+
|-
+
| <code>property Alternate:TNTFSDiskAttribute read FAlternate write FAlternate;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetDot:TNTFSDiskEntry;</code>
+
| &nbsp;
+
|-
+
| <code>function GetDotDot:TNTFSDiskEntry;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CreateDot:TNTFSDiskEntry;</code>
+
| &nbsp;
+
|-
+
| <code>function CreateDotDot:TNTFSDiskEntry;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function UpdateDot:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function UpdateDotDot(AEntry:TNTFSDiskEntry):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function RecordNumber:Int64;</code>
+
| &nbsp;
+
|-
+
| <code>function FileReference:Int64;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function UpdateEntry:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function UpdateRecord:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function FindFirstName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;</code>
+
| &nbsp;
+
|-
+
| <code>function FindPrevName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;</code>
+
| &nbsp;
+
|-
+
| <code>function FindNextName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;</code>
+
| &nbsp;
+
|-
+
| <code>function FindLastName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS disk access contol list'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSDiskAcl = class(TDiskAcl)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|Note: Data of attribute $SECURITY_DESCRIPTOR
+
| [[TNTFSDiskAcl|<code>TNTFSDiskAcl = class(TDiskAcl)</code>]]
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
|colspan="2"|&nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS disk access control entry'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSDiskAce = class(TDiskAce)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|Note: Data of attribute $SECURITY_DESCRIPTOR
+
| [[TNTFSDiskAce|<code>TNTFSDiskAce = class(TDiskAce)</code>]]
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
|colspan="2"|&nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS entry list'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSEntryList = class(TObject)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create;</code>
+
| [[TNTFSEntryList|<code>TNTFSEntryList = class(TObject)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FEntryCount:Integer;</code>
+
| &nbsp;
+
|-
+
| <code>FFirstEntry:TNTFSDiskEntry;</code>
+
| &nbsp;
+
|-
+
| <code>FLastEntry:TNTFSDiskEntry;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function Link(AEntry:TNTFSDiskEntry):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function Unlink(AEntry:TNTFSDiskEntry):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property EntryCount:Integer read FEntryCount;</code>
+
| &nbsp;
+
|-
+
| <code>property FirstEntry:TNTFSDiskEntry read FFirstEntry;</code>
+
| &nbsp;
+
|-
+
| <code>property LastEntry:TNTFSDiskEntry read FLastEntry;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function Add(AEntry:TNTFSDiskEntry):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function Remove(AEntry:TNTFSDiskEntry):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>procedure ClearList; virtual;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS record list'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSRecordList = class(TObject)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create;</code>
+
| [[TNTFSRecordList|<code>TNTFSRecordList = class(TObject)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FRecordCount:Integer;</code>
+
| &nbsp;
+
|-
+
| <code>FFirstRecord:TNTFSDiskRecord;</code>
+
| &nbsp;
+
|-
+
| <code>FLastRecord:TNTFSDiskRecord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function Link(ARecord:TNTFSDiskRecord):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function Unlink(ARecord:TNTFSDiskRecord):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property RecordCount:Integer read FRecordCount;</code>
+
| &nbsp;
+
|-
+
| <code>property FirstRecord:TNTFSDiskRecord read FFirstRecord;</code>
+
| &nbsp;
+
|-
+
| <code>property LastRecord:TNTFSDiskRecord read FLastRecord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function Add(ARecord:TNTFSDiskRecord):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function Remove(ARecord:TNTFSDiskRecord):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>procedure ClearList; virtual;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS record index'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSRecordIndex = class(TLinkedObjBtree)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|Note: Index of FILE records.
+
| [[TNTFSRecordIndex|<code>TNTFSRecordIndex = class(TLinkedObjBtree)</code>]]
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>constructor Create;</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FRecordLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FRunsLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FItemsLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FNodesLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FIndexLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FExtendedsLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FAttributesLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FRunLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FItemLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FKeyLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FNodeLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FExtendedLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FAttributeLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function Find(const ARecordNumber:Int64; ACurrent:TNTFSDiskRecord):TNTFSDiskRecord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
+
|-
+
| <code>function CreateBlank:TBtreeObject; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function Compare(AEntry1,AEntry2:TBtreeObject):Integer; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>function CreateRecord(ABase:TNTFSDiskRecord; const ARecordNumber:Int64; AVersion:Word):TNTFSDiskRecord;</code>
+
| &nbsp;
+
|-
+
| <code>function DestroyRecord(ARecord:TNTFSDiskRecord):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function NewRecord(ABase:TNTFSDiskRecord; const ARecordNumber:Int64; AVersion:Word):TNTFSDiskRecord;</code>
+
| &nbsp;
+
|-
+
| <code>function InsertRecord(ARecord:TNTFSDiskRecord):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function DeleteRecord(ARecord:TNTFSDiskRecord):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function RemoveRecord(ARecord:TNTFSDiskRecord):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function FindRecord(const ARecordNumber:Int64):TNTFSDiskRecord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReaderLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function ReaderUnlock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function ReaderConvert:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriterLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriterUnlock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriterConvert:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function RunsReaderLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function RunsReaderUnlock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function RunsWriterLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function RunsWriterUnlock:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ItemsReaderLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function ItemsReaderUnlock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function ItemsWriterLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function ItemsWriterUnlock:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function NodesReaderLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function NodesReaderUnlock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function NodesWriterLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function NodesWriterUnlock:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function IndexReaderLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function IndexReaderUnlock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function IndexWriterLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function IndexWriterUnlock:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ExtendedsReaderLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function ExtendedsReaderUnlock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function ExtendedsWriterLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function ExtendedsWriterUnlock:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function AttributesReaderLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function AttributesReaderUnlock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function AttributesWriterLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function AttributesWriterUnlock:Boolean;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS disk record'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSDiskRecord = class(TBtreeObject)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|Note: Represents a FILE record entry.
+
| [[TNTFSDiskRecord|<code>TNTFSDiskRecord = class(TBtreeObject)</code>]]
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle; ABase:TNTFSDiskRecord);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FLocalLock:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FRunsLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FItemsLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FNodesLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FIndexLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FExtendedsLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FAttributesLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FRunLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FItemLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FKeyLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FNodeLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FExtendedLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FAttributeLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FStatus:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FPrevRecord:TNTFSDiskRecord;</code>
+
| &nbsp;
+
|-
+
| <code>FNextRecord:TNTFSDiskRecord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FRecordFlags:Word;</code>
+
| Flags (See Consts)
+
|-
+
| <code>FHardLinkCount:Word;</code>
+
| Hard link count
+
|-
+
| <code>FSequenceNumber:Word;</code>
+
| Sequence number
+
|-
+
| <code>FNextAttributeId:Word;</code>
+
| Next Attribute Id
+
|-
+
| <code>FRecordNumber:Int64;</code>
+
| Number of this MFT Record
+
|-
+
| <code>FRecordSize:LongWord;</code>
+
| Actual size of the FILE record
+
|-
+
| <code>FRecordAllocated:LongWord;</code>
+
| Allocated size of the FILE record
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FAttributeOffset:Word;</code>
+
| Offset to the first Attribute
+
|-
+
| <code>FUpdateSequenceOffset:Word;</code>
+
| Offset to the Update Sequence Record
+
|-
+
| <code>FUpdateSequenceLength:Word;</code>
+
| Size in words of the Update Sequence Record
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FUpdateSequenceNumber:Word;</code>
+
| Update Sequence Number
+
|-
+
| <code>FLogFileSequenceNumber:Int64;</code>
+
| LogFile Sequence Number (LSN)
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FBase:TNTFSDiskRecord;</code>
+
| Base file record
+
|-
+
| <code>FLinks:TNTFSEntryList;</code>
+
| List of record links
+
|-
+
| <code>FStreams:TNTFSEntryList;</code>
+
| List of record streams
+
|-
+
| <code>FRecords:TNTFSRecordList;</code>
+
| List of child records
+
|-
+
| <code>FAttributes:TNTFSDiskAttributes;</code>
+
| List of record attributes
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function AcquireLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function ReleaseLock:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetResizing:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetResizing(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
| <code>function GetRemoving:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetRemoving(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetMirrored:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetMirrored(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
| <code>function GetMetafile:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetMetafile(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
| <code>function GetReserved:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetReserved(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
| <code>function GetExpansion:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetExpansion(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetOverflow:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetOverflow(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
| <code>function GetExtension:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetExtension(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetIsUsed:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetIsUsed(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
| <code>function GetIsFolder:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetIsFolder(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
| <code>function GetIsUnknown1:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetIsUnknown1(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
| <code>function GetIsIndexView:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetIsIndexView(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetOrigin:TNTFSDiskRecord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CreateLinks(ANew:Boolean):TNTFSEntryList;</code>
+
| &nbsp;
+
|-
+
| <code>function CreateStreams(ANew:Boolean):TNTFSEntryList;</code>
+
| &nbsp;
+
|-
+
| <code>function CreateRecords(ANew:Boolean):TNTFSRecordList;</code>
+
| &nbsp;
+
|-
+
| <code>function CreateAttributes(AVersion:Word; ANew:Boolean):TNTFSDiskAttributes;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property Resizing:Boolean read GetResizing write SetResizing;</code>
+
| Record is being Resized
+
|-
+
| <code>property Removing:Boolean read GetRemoving write SetRemoving;</code>
+
| Record is being Removed
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Mirrored:Boolean read GetMirrored write SetMirrored;</code>
+
| Record is in $MftMirr file
+
|-
+
| <code>property Metafile:Boolean read GetMetafile write SetMetafile;</code>
+
| Record is an NTFS metafile
+
|-
+
| <code>property Reserved:Boolean read GetReserved write SetReserved;</code>
+
| Record is an Mft reserved record
+
|-
+
| <code>property Expansion:Boolean read GetExpansion write SetExpansion;</code>
+
| Record is an Mft expansion record
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Overflow:Boolean read GetOverflow write SetOverflow;</code>
+
| Record has an attribute list attribute
+
|-
+
| <code>property Extension:Boolean read GetExtension write SetExtension;</code>
+
| Record is an extension of the base record
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property PrevRecord:TNTFSDiskRecord read FPrevRecord write FPrevRecord;</code>
+
| &nbsp;
+
|-
+
| <code>property NextRecord:TNTFSDiskRecord read FNextRecord write FNextRecord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property IsUsed:Boolean read GetIsUsed write SetIsUsed;</code>
+
| Record is in use
+
|-
+
| <code>property IsFolder:Boolean read GetIsFolder write SetIsFolder;</code>
+
| Record is a folder
+
|-
+
| <code>property IsUnknown1:Boolean read GetIsUnknown1 write SetIsUnknown1;</code>
+
|-
+
| <code>property IsIndexView:Boolean read GetIsIndexView write SetIsIndexView;</code>
+
| Record is an index view
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property RecordFlags:Word read FRecordFlags write FRecordFlags;</code>
+
| &nbsp;
+
|-
+
| <code>property HardLinkCount:Word read FHardLinkCount write FHardLinkCount;</code>
+
| &nbsp;
+
|-
+
| <code>property SequenceNumber:Word read FSequenceNumber write FSequenceNumber;</code>
+
| &nbsp;
+
|-
+
| <code>property NextAttributeId:Word read FNextAttributeId write FNextAttributeId;</code>
+
| &nbsp;
+
|-
+
| <code>property RecordNumber:Int64 read FRecordNumber write FRecordNumber;</code>
+
| &nbsp;
+
|-
+
| <code>property RecordSize:LongWord read FRecordSize write FRecordSize;</code>
+
| &nbsp;
+
|-
+
| <code>property RecordAllocated:LongWord read FRecordAllocated write FRecordAllocated;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property AttributeOffset:Word read FAttributeOffset write FAttributeOffset;</code>
+
| &nbsp;
+
|-
+
| <code>property UpdateSequenceOffset:Word read FUpdateSequenceOffset write FUpdateSequenceOffset;</code>
+
| &nbsp;
+
|-
+
| <code>property UpdateSequenceLength:Word read FUpdateSequenceLength write FUpdateSequenceLength;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property UpdateSequenceNumber:Word read FUpdateSequenceNumber write FUpdateSequenceNumber;</code>
+
| &nbsp;
+
|-
+
| <code>property LogFileSequenceNumber:Int64 read FLogFileSequenceNumber write FLogFileSequenceNumber;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Base:TNTFSDiskRecord read FBase write FBase;</code>
+
| &nbsp;
+
|-
+
| <code>property Links:TNTFSEntryList read FLinks;</code>
+
| &nbsp;
+
|-
+
| <code>property Streams:TNTFSEntryList read FStreams;</code>
+
| &nbsp;
+
|-
+
| <code>property Records:TNTFSRecordList read FRecords;</code>
+
| &nbsp;
+
|-
+
| <code>property Attributes:TNTFSDiskAttributes read FAttributes;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Origin:TNTFSDiskRecord read GetOrigin;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CreateLink(AAttribute,AAlternate:TNTFSDiskAttribute; ANew:Boolean):TNTFSDiskEntry;</code>
+
| &nbsp;
+
|-
+
| <code>function DestroyLink(ALink:TNTFSDiskEntry):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function NewLink(AAttribute,AAlternate:TNTFSDiskAttribute):TNTFSDiskEntry;</code>
+
| &nbsp;
+
|-
+
| <code>function GetLink(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;</code>
+
| &nbsp;
+
|-
+
| <code>function DeleteLink(ALink:TNTFSDiskEntry):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function RenameLink(ALink:TNTFSDiskEntry; AAttribute,AAlternate:TNTFSDiskAttribute):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CreateStream(AAttribute:TNTFSDiskAttribute; ANew:Boolean):TNTFSDiskEntry;</code>
+
| &nbsp;
+
|-
+
| <code>function DestroyStream(AStream:TNTFSDiskEntry):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function NewStream(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;</code>
+
| &nbsp;
+
|-
+
| <code>function GetStream(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;</code>
+
| &nbsp;
+
|-
+
| <code>function DeleteStream(AStream:TNTFSDiskEntry):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetFileNameByKey(AKey:TNTFSAttributeKey):TNTFSDiskAttribute;</code>
+
| &nbsp;
+
|-
+
| <code>function GetFileNameByName(const AName:String; AInstance:Integer):TNTFSDiskAttribute;</code>
+
| &nbsp;
+
|-
+
| <code>function GetFileNameByParent(const AName:String; const AParent:Int64; AInstance:Integer):TNTFSDiskAttribute;</code>
+
| &nbsp;
+
|-
+
| <code>function GetFileNameByNameSpace(const AName:String; const AParent:Int64; ANameSpace:Byte; AInstance:Integer):TNTFSDiskAttribute;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetRecord(AInstance:Integer):TNTFSDiskRecord;</code>
+
| &nbsp;
+
|-
+
| <code>function GetRecordByFree(AFree:LongWord; AExclude:Boolean):TNTFSDiskRecord;</code>
+
| &nbsp;
+
|-
+
| <code>function GetRecordByReference(const AFileReference:Int64):TNTFSDiskRecord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function AddRecord(ARecord:TNTFSDiskRecord):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function RemoveRecord(ARecord:TNTFSDiskRecord):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetAttributeByItem(AItem:TNTFSDiskItem):TNTFSDiskAttribute;</code>
+
| &nbsp;
+
|-
+
| <code>function GetAttributeByStatus(AInclude,AExclude:Word; AInstance:Integer):TNTFSDiskAttribute;</code>
+
| &nbsp;
+
|-
+
| <code>function GetAttributeByVCN(AAttribute:TNTFSDiskAttribute; const AVCN:Int64; var AInstance:LongWord):TNTFSDiskAttribute;</code>
+
| &nbsp;
+
|-
+
| <code>function GetAttributeByUnit(AAttribute:TNTFSDiskAttribute; const AUnit:Int64; var AInstance:LongWord):TNTFSDiskAttribute;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CreateAttribute(AType:LongWord; AVersion:Word; ANew:Boolean):TNTFSDiskAttribute;</code>
+
| &nbsp;
+
|-
+
| <code>function DestroyAttribute(AAttribute:TNTFSDiskAttribute):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function NewAttribute(APrevious:TNTFSDiskAttribute; AType:LongWord; const AName:String; AVersion:Word):TNTFSDiskAttribute;</code>
+
| &nbsp;
+
|-
+
| <code>function GetAttribute(AType:LongWord; const AName:String; AInstance:Integer):TNTFSDiskAttribute;</code>
+
| &nbsp;
+
|-
+
| <code>function RemoveAttribute(AAttribute:TNTFSDiskAttribute):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function MoveAttribute(ADest:TNTFSDiskRecord; AAttribute:TNTFSDiskAttribute):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function RenameAttribute(AAttribute:TNTFSDiskAttribute; const AName:String):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function FileReference:Int64;</code>
+
| &nbsp;
+
|-
+
| <code>function BaseReference:Int64;</code>
+
| File reference to the base FILE record
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function LinkCount:LongWord;</code>
+
| &nbsp;
+
|-
+
| <code>function StreamCount:LongWord;</code>
+
| &nbsp;
+
|-
+
| <code>function RecordCount:LongWord;</code>
+
| &nbsp;
+
|-
+
| <code>function AttributeCount:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function RecordFree:LongWord;</code>
+
| &nbsp;
+
|-
+
| <code>function AttributeSize(AVersion:Word; AType:LongWord):LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedSize(AVersion:Word):LongWord;</code>
+
| &nbsp;
+
|-
+
| <code>function CalculatedOffset(AVersion:Word):Word;</code>
+
| &nbsp;
+
|-
+
| <code>function CalculatedSequenceOffset(AVersion:Word):Word;</code>
+
| &nbsp;
+
|-
+
| <code>function CalculatedSequenceLength(ASectorSize:Word):Word;</code>
+
| &nbsp;
+
|-
+
| <code>function CalculatedStreamUsed(AVersion:Word; AAttribute:TNTFSDiskAttribute):Int64;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadAttributes(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteAttributes(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word; AFree:Boolean):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS disk index'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSDiskIndex = class(TLinkedObjBtree)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|Note: Index of INDX records.
+
| [[TNTFSDiskIndex|<code>TNTFSDiskIndex = class(TLinkedObjBtree)</code>]]
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>constructor Create(AKeyLocal:TMutexHandle; ALock:TSynchronizerHandle; AVolumeVersion,ASectorSize:Word; AIndexType,ACollateRule:LongWord; AAttribute:TNTFSDiskAttribute);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
| <code>FKeyLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FStatus:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FSectorSize:Word;</code>
+
| &nbsp;
+
|-
+
| <code>FVolumeVersion:Word;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FIndexType:LongWord;</code>
+
| Attribute Type (Or None if Data Index)
+
|-
+
| <code>FCollateRule:LongWord;</code>
+
| Collation Rule
+
|-
+
| <code>FIndexRecordSize:LongWord;</code>
+
| Size of Index Allocation Entry (bytes)
+
|-
+
| <code>FIndexCounterOffset:LongWord;</code>
+
| Index Record Number increment
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FClustersPerIndex:LongWord;</code>
+
| Clusters per INDX Record or 0 if less than cluster size
+
|-
+
| <code>FIndexsPerCluster:LongWord;</code>
+
| INDX Records per Cluster or 0 if more than cluster size
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FIndexCounterShift:Word;</code>
+
| Shift count for Record -> Counter
+
|-
+
| <code>FIndexRecordShiftCount:Word;</code>
+
| Shift count for Record -> VCN
+
|-
+
| <code>FIndexRecordOffsetMask:Int64;</code>
+
| Mask for Record offset calculation
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FTotalIndexRecordCount:Int64;</code>
+
| Total number of index records in index
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FLastFreeIndexRecord:Int64;</code>
+
| Or ntfsUnknownRecordNumber if not known
+
|-
+
| <code>FFreeIndexRecordCount:Int64;</code>
+
| Or ntfsUnknownRecordNumber if not known
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FCompareSecurityDescriptor:TNTFSCompareSecurityDescriptor;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FUpCase:TNTFSUpCase;</code>
+
| Uppercase Conversion Table
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FNodes:TNTFSDiskNodes;</code>
+
| List of index nodes
+
|-
+
| <code>FAttribute:TNTFSDiskAttribute;</code>
+
| Attribute owning this index
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetNodesLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetKeyLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
| <code>function GetNodeLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetLoaded:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetLoaded(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
| <code>function GetChanged:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetUpCase:PNTFSUpCaseData;</code>
+
| &nbsp;
+
|-
+
| <code>function GetRootNode:TNTFSDiskNode;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CreateNodes(ANew:Boolean):TNTFSDiskNodes;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CompareKey(AEntry1,AEntry2:Pointer; ASize1,ASize2:Word):Integer;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CompareBinary(AEntry1,AEntry2:Pointer; ASize1,ASize2:Word):Integer;</code>
+
| &nbsp;
+
|-
+
| <code>function CompareFileName(AEntry1,AEntry2:PWideChar; ASize1,ASize2:Word):Integer;</code>
+
| &nbsp;
+
|-
+
| <code>function CompareUnicode(AEntry1,AEntry2:PWideChar; ASize1,ASize2:Word):Integer;</code>
+
| &nbsp;
+
|-
+
| <code>function CompareLongWord(AEntry1,AEntry2:LongWord; ASize1,ASize2:Word):Integer;</code>
+
| &nbsp;
+
|-
+
| <code>function CompareSID(AEntry1,AEntry2:PSID; ASize1,ASize2:Word):Integer;</code>
+
| &nbsp;
+
|-
+
| <code>function CompareSecurityHash(AEntry1,AEntry2:PNTFSSecurityHashKeyData; ASize1,ASize2:Word):Integer;</code>
+
| &nbsp;
+
|-
+
| <code>function CompareGUID(AEntry1,AEntry2:PGUID; ASize1,ASize2:Word):Integer;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
+
|-
+
| <code>function GetEnd(AEntry:TBtreeObject):TBtreeObject; override;</code>
+
| &nbsp;
+
|-
+
| <code>function GetStart(AEntry:TBtreeObject):TBtreeObject; override;</code>
+
| &nbsp;
+
|-
+
| <code>function GetBlank(AEntry:TBtreeObject):TBtreeObject; override;</code>
+
| &nbsp;
+
|-
+
| <code>function GetMedian(AEntry:TBtreeObject):TBtreeObject; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetDropTest(AEntry:TBtreeObject; var ALeft:Boolean):TBtreeObject;</code>
+
| &nbsp;
+
|-
+
| <code>function GetDrop(AEntry:TBtreeObject; var ALeft:Boolean):TBtreeObject; override;</code>
+
| &nbsp;
+
|-
+
| <code>function GetMerge(AEntry:TBtreeObject):TBtreeObject; override;</code>
+
| &nbsp;
+
|-
+
| <code>function GetBorrow(AEntry:TBtreeObject):TBtreeObject; override;</code>
+
| &nbsp;
+
|-
+
| <code>function GetTarget(ADrop:TBtreeObject; ALeft:Boolean):TBtreeObject; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function PushNode(AEntry:TBtreeObject):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function SplitNode(AEntry:TBtreeObject):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function DropNode(AEntry,ADrop,ATarget:TBtreeObject; ALeft:Boolean):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function DropNodeOld(AEntry,ADrop:TBtreeObject; ALeft:Boolean):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function MergeNode(AEntry,AMerge:TBtreeObject):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function BorrowEntry(AEntry,ABorrow:TBtreeObject):Boolean; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function SwapEntry(AEntry,ASwap:TBtreeObject;ALeft:Boolean):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function SetParentEntry(AEntry,AParent:TBtreeObject):Boolean; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function DeleteBlank(ABlank:TBtreeObject):Boolean; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function AttachBlank(ABlank:TBtreeObject):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function DetachBlank(ABlank:TBtreeObject):Boolean; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function AttachEntry(AEntry:TBtreeObject):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function DetachEntry(AEntry:TBtreeObject):Boolean; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function RequirePush(AEntry:TBtreeObject):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function RequireSplit(AEntry:TBtreeObject):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function RequireDrop(AEntry:TBtreeObject):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function RequireMerge(AEntry:TBtreeObject):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function RequireBorrow(AEntry:TBtreeObject):Boolean; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property Loaded:Boolean read GetLoaded write SetLoaded;</code>
+
| &nbsp;
+
|-
+
| <code>property Changed:Boolean read GetChanged;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property SectorSize:Word read FSectorSize write FSectorSize;</code>
+
| &nbsp;
+
|-
+
| <code>property VolumeVersion:Word read FVolumeVersion;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property IndexType:LongWord read FIndexType write FIndexType;</code>
+
| &nbsp;
+
|-
+
| <code>property CollateRule:LongWord read FCollateRule write FCollateRule;</code>
+
| &nbsp;
+
|-
+
| <code>property IndexRecordSize:LongWord read FIndexRecordSize write FIndexRecordSize;</code>
+
| &nbsp;
+
|-
+
| <code>property IndexCounterOffset:LongWord read FIndexCounterOffset write FIndexCounterOffset;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property ClustersPerIndex:LongWord read FClustersPerIndex write FClustersPerIndex;</code>
+
| &nbsp;
+
|-
+
| <code>property IndexsPerCluster:LongWord read FIndexsPerCluster write FIndexsPerCluster;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property IndexCounterShift:Word read FIndexCounterShift write FIndexCounterShift;</code>
+
| &nbsp;
+
|-
+
| <code>property IndexRecordShiftCount:Word read FIndexRecordShiftCount write FIndexRecordShiftCount;</code>
+
| &nbsp;
+
|-
+
| <code>property IndexRecordOffsetMask:Int64 read FIndexRecordOffsetMask write FIndexRecordOffsetMask;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property TotalIndexRecordCount:Int64 read FTotalIndexRecordCount write FTotalIndexRecordCount;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property LastFreeIndexRecord:Int64 read FLastFreeIndexRecord write FLastFreeIndexRecord;</code>
+
| &nbsp;
+
|-
+
| <code>property FreeIndexRecordCount:Int64 read FFreeIndexRecordCount write FFreeIndexRecordCount;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property CompareSecurityDescriptor:TNTFSCompareSecurityDescriptor read FCompareSecurityDescriptor write FCompareSecurityDescriptor;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property UpCase:TNTFSUpCase read FUpCase write FUpCase;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Nodes:TNTFSDiskNodes read FNodes;</code>
+
| &nbsp;
+
|-
+
| <code>property Attribute:TNTFSDiskAttribute read FAttribute;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property RootNode:TNTFSDiskNode read GetRootNode;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function NodeCount:Integer;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; virtual;</code>
+
| &nbsp;
+
|-
+
| <code>function DestroyKey(AKey:TNTFSDiskKey):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; virtual;</code>
+
| &nbsp;
+
|-
+
| <code>function NewKeyEx(AKey,AData,APadding:Pointer; AKeySize,ADataSize,APaddingSize:Word):TNTFSDiskKey; virtual;</code>
+
| &nbsp;
+
|-
+
| <code>function AddKey(AParent,AKey:TNTFSDiskKey):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function InsertKey(AKey:TNTFSDiskKey):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function RemoveKey(AKey:TNTFSDiskKey):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CreateNode(ANew:Boolean):TNTFSDiskNode;</code>
+
| &nbsp;
+
|-
+
| <code>function DestroyNode(ANode:TNTFSDiskNode):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function NewNode(const ARecordNumber:Int64):TNTFSDiskNode;</code>
+
| &nbsp;
+
|-
+
| <code>function GetNode(const ARecordNumber:Int64):TNTFSDiskNode;</code>
+
| &nbsp;
+
|-
+
| <code>function DeleteNode(ANode:TNTFSDiskNode):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function RemoveNode(ANode:TNTFSDiskNode):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function UpdateNodes(AVersion:Word):Boolean; virtual;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function FindKey(AValue:Pointer; ASize:Word):TNTFSDiskKey; virtual;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadRoot(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteRoot(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadKeys(AParent:TNTFSDiskKey; ANode:TNTFSDiskNode; ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteKeys(AParent:TNTFSDiskKey; ANode:TNTFSDiskNode; ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReaderLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function ReaderUnlock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriterLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriterUnlock:Boolean;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
+
'''NTFS data index'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSDataIndex = class(TNTFSDiskIndex)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
| [[TNTFSDataIndex|<code>TNTFSDataIndex = class(TNTFSDiskIndex)</code>]]
|-
+
| <code>function CompareSecurityDescriptor(AHash1,AHash2,ASecurityId:LongWord; ADescriptor:Pointer; ASize:Word):Integer;</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function Find(AValue:Pointer; ASize:Word; ACurrent:TNTFSDataKey):TNTFSDataKey;</code>
+
| &nbsp;
+
|-
+
| <code>function FindEx(AValue:Pointer; ASize:Word; AHash:LongWord; ACurrent:TNTFSDataKey):TNTFSDataKey;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
+
|-
+
| <code>function CreateBlank:TBtreeObject; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function Compare(AEntry1,AEntry2:TBtreeObject):Integer; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; override;</code>
+
| &nbsp;
+
|-
+
| <code>function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetKeyBySID(ASID:PSID):TNTFSDiskKey;</code>
+
| &nbsp;
+
|-
+
| <code>function GetKeyByOwner(AOwner:LongWord):TNTFSDiskKey;</code>
+
| &nbsp;
+
|-
+
| <code>function GetKeyByObjectId(const AObjectId:TGUID):TNTFSDiskKey;</code>
+
| &nbsp;
+
|-
+
| <code>function GetKeyBySecurity(ASecurity:TNTFSSecurity):TNTFSDiskKey;</code>
+
| &nbsp;
+
|-
+
| <code>function GetKeyByReparse(AReparseTag:LongWord; const AFileReference:Int64):TNTFSDiskKey;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function FindKey(AValue:Pointer;ASize:Word):TNTFSDiskKey; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS padded index'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSPaddedIndex = class(TNTFSDataIndex)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|Note: A DataIndex that allows a block of Padding to be specified.
+
| [[TNTFSPaddedIndex|<code>TNTFSPaddedIndex = class(TNTFSDataIndex)</code>]]
|-
+
|colspan="2"|&nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
+
|-
+
| <code>function CreateBlank:TBtreeObject; override;</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; override;</code>
+
| &nbsp;
+
|-
+
| <code>function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; override;</code>
+
| &nbsp;
+
|-
+
| <code>function NewKeyEx(AKey,AData,APadding:Pointer; AKeySize,ADataSize,APaddingSize:Word):TNTFSDiskKey; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS attribute index'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSAttributeIndex = class(TNTFSDiskIndex)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
| [[TNTFSAttributeIndex|<code>TNTFSAttributeIndex = class(TNTFSDiskIndex)</code>]]
|-
+
| <code>function Find(AValue:Pointer; ASize:Word; ACurrent:TNTFSAttributeKey):TNTFSAttributeKey;</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
+
|-
+
| <code>function CreateBlank:TBtreeObject; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function Compare(AEntry1,AEntry2:TBtreeObject):Integer; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; override;</code>
+
| &nbsp;
+
|-
+
| <code>function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetKeyByFileName(const AFileName:String):TNTFSDiskKey;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function NewKeyByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSDiskKey;</code>
+
| &nbsp;
+
|-
+
| <code>function GetKeyByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSDiskKey;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function FindKey(AValue:Pointer; ASize:Word):TNTFSDiskKey; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS disk nodes'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSDiskNodes = class(TFileSysListEx)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ANodeLocal:TMutexHandle; ALock:TSynchronizerHandle);</code>
+
| [[TNTFSDiskNodes|<code>TNTFSDiskNodes = class(TFileSysListEx)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FNodeLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetModified:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetModified(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property Modified:Boolean read GetModified write SetModified;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function TotalSize:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function NodeCount:LongWord;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS disk node'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSDiskNode = class(TListObject)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
|-
+
|colspan="2"|Note: Represents an INDX record header.
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle; AIndex:TNTFSDiskIndex);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FLocalLock:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FStatus:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FIndexFlags:Word;</code>
+
| Flags (See Consts)
+
|-
+
| <code>FIndexSize:LongWord;</code>
+
| Total size of the Index Entries
+
|-
+
| <code>FIndexAllocated:LongWord;</code>
+
| Allocated size of the Index Entries
+
|-
+
| <code>FEntryOffset:LongWord;</code>
+
| Offset to first Index Entry
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FRecordNumber:Int64;</code>
+
| Number of this INDX record in the Index Allocation
+
|-
+
| <code>FUpdateSequenceOffset:Word;</code>
+
| Offset to the Update Sequence Record
+
|-
+
| <code>FUpdateSequenceLength:Word;</code>
+
| Size in words of the Update Sequence Record
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FUpdateSequenceNumber:Word;</code>
+
| Update Sequence Number
+
|-
+
| <code>FLogFileSequenceNumber:Int64;</code>
+
| LogFile sequence number
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FIndex:TNTFSDiskIndex;</code>
+
| Index owning this node
+
|-
+
| <code>FBlank:TNTFSDiskKey;</code>
+
| Blank key of this node (Blank keys do not move)
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function AcquireLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function ReleaseLock:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetAdded:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetAdded(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
| <code>function GetDeleted:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetDeleted(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
| <code>function GetChanged:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetChanged(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetModified:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetModified(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetIsRoot:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetHasSubNodes:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetHasSubNodes(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetStart:TNTFSDiskKey;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property Added:Boolean read GetAdded write SetAdded;</code>
+
| Index record to be allocated
+
|-
+
| <code>property Deleted:Boolean read GetDeleted write SetDeleted;</code>
+
| Index record to be deallocated
+
|-
+
| <code>property Changed:Boolean read GetChanged write SetChanged;</code>
+
| Index record to be updated
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Modified:Boolean read GetModified write SetModified;</code>
+
| Index record has been added, deleted or changed
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property IsRoot:Boolean read GetIsRoot;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property HasSubNodes:Boolean read GetHasSubNodes write SetHasSubNodes;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property IndexFlags:Word read FIndexFlags write FIndexFlags;</code>
+
| &nbsp;
+
|-
+
| <code>property IndexSize:LongWord read FIndexSize write FIndexSize;</code>
+
| &nbsp;
+
|-
+
| <code>property IndexAllocated:LongWord read FIndexAllocated write FIndexAllocated;</code>
+
| &nbsp;
+
|-
+
| <code>property EntryOffset:LongWord read FEntryOffset write FEntryOffset;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property RecordNumber:Int64 read FRecordNumber write FRecordNumber;</code>
+
| &nbsp;
+
|-
+
| <code>property UpdateSequenceOffset:Word read FUpdateSequenceOffset write FUpdateSequenceOffset;</code>
+
| &nbsp;
+
|-
+
| <code>property UpdateSequenceLength:Word read FUpdateSequenceLength write FUpdateSequenceLength;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property UpdateSequenceNumber:Word read FUpdateSequenceNumber write FUpdateSequenceNumber;</code>
+
| &nbsp;
+
|-
+
| <code>property LogFileSequenceNumber:Int64 read FLogFileSequenceNumber write FLogFileSequenceNumber;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Index:TNTFSDiskIndex read FIndex;</code>
+
| &nbsp;
+
|-
+
| <code>property Blank:TNTFSDiskKey read FBlank write FBlank;</code>
+
| &nbsp;
+
|-
+
| <code>property Start:TNTFSDiskKey read GetStart;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function KeyCount:Integer;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function IndexFree:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function UpdateKeys(AVersion:Word):Boolean; virtual;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedSize(AVersion:Word):LongWord;</code>
+
| &nbsp;
+
|-
+
| <code>function CalculatedOffset(AVersion:Word):LongWord;</code>
+
| &nbsp;
+
|-
+
| <code>function CalculatedAllocated(AVersion:Word):LongWord;</code>
+
| &nbsp;
+
|-
+
| <code>function CalculatedSequenceOffset(AVersion:Word):Word;</code>
+
| &nbsp;
+
|-
+
| <code>function CalculatedSequenceLength(ASectorSize:Word):Word;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function WriteEmpty(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word; var AUpdateSequenceOffset,AUpdateSequenceLength:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadHeader(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
 
|-
 
|-
| <code>function WriteHeader(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| [[TNTFSDiskNode|<code>TNTFSDiskNode = class(TListObject)</code>]]
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS disk key'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSDiskKey = class(TBtreeObject)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
|-
+
|colspan="2"|Note: Represents an INDX record entry.
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FLocalLock:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FStatus:LongWord;</code>
+
| &nbsp;
+
|-
+
| <code>FKey:Pointer;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FEntryFlags:Word;</code>
+
| Flags (See Consts)
+
|-
+
| <code>FEntrySize:Word;</code>
+
| Length of the index entry
+
|-
+
| <code>FKeySize:Word;</code>
+
| Length of the key entry
+
|-
+
| <code>FSubNodeNumber:Int64;</code>
+
| Number of the sub-node in the index allocation attribute
+
|-
+
|colspan="2"|&nbsp; 
+
|-
+
| <code>FNode:TNTFSDiskNode;</code>
+
| Index node of this key
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function AcquireLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function ReleaseLock:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetChanged:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetChanged(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetHasSubNode:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetHasSubNode(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
| <code>function GetIsLastNode:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetIsLastNode(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>procedure SetKeySize(ASize:Word); virtual;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetSubNodeNumber(const ANodeNumber:Int64);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>procedure SetNode(ANode:TNTFSDiskNode);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property Changed:Boolean read GetChanged write SetChanged;</code>
+
| Index record to be updated
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property HasSubNode:Boolean read GetHasSubNode write SetHasSubNode;</code>
+
| &nbsp;
+
|-
+
| <code>property IsLastNode:Boolean read GetIsLastNode write SetIsLastNode;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Key:Pointer read FKey;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property EntryFlags:Word read FEntryFlags write FEntryFlags;</code>
+
| &nbsp;
+
|-
+
| <code>property EntrySize:Word read FEntrySize write FEntrySize;</code>
+
| &nbsp;
+
|-
+
| <code>property KeySize:Word read FKeySize write SetKeySize;</code>
+
| &nbsp;
+
|-
+
| <code>property SubNodeNumber:Int64 read FSubNodeNumber write SetSubNodeNumber;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Node:TNTFSDiskNode read FNode write SetNode;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedSize(AVersion:Word):Word; virtual;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;</code>
+
| &nbsp;
+
 
|-
 
|-
| <code>function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;</code>
+
| [[TNTFSDiskKey|<code>TNTFSDiskKey = class(TBtreeObject)</code>]]
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS data key'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSDataKey = class(TNTFSDiskKey)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FData:Pointer;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FDataSize:Word;</code>
+
| Size of the data (Only valid when the last entry flag is not set)
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>procedure SetKeySize(ASize:Word); override;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetData(AData:Pointer);</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetDataSize(ASize:Word);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property Data:Pointer read FData write SetData;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property DataSize:Word read FDataSize write SetDataSize;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function DataOffset:Word;</code>
+
| Offset to the data (Only valid when the last entry flag is not set)
+
|-
+
| <code>function CalculatedSize(AVersion:Word):Word; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
 
|-
 
|-
| <code>function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
+
| [[TNTFSDataKey|<code>TNTFSDataKey = class(TNTFSDiskKey)</code>]]
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
+
'''NTFS padded key'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSPaddedKey = class(TNTFSDataKey)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
+
| [[TNTFSPaddedKey|<code>TNTFSPaddedKey = class(TNTFSDataKey)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FPadding:Pointer;</code>
+
| &nbsp;
+
|-
+
| <code>FPaddingSize:Word;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>procedure SetPadding(APadding:Pointer);</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetPaddingSize(ASize:Word);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property Padding:Pointer read FPadding write SetPadding;</code>
+
| &nbsp;
+
|-
+
| <code>property PaddingSize:Word read FPaddingSize write SetPaddingSize;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS attribute key'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSAttributeKey = class(TNTFSDiskKey)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
+
| [[TNTFSAttributeKey|<code>TNTFSAttributeKey = class(TNTFSDiskKey)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FFileReference:Int64;</code>
+
| File reference (Only valid when the last entry flag is not set)
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FAttribute:TNTFSDiskAttribute;</code>
+
| Indexed attribute of this key
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetInvalid:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetInvalid(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>procedure SetKeySize(ASize:Word); override;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetAttribute(AAttribute:TNTFSDiskAttribute);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property Invalid:Boolean read GetInvalid write SetInvalid;</code>
+
| Key points to invalid file record or attribute
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property FileReference:Int64 read FFileReference write FFileReference;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Attribute:TNTFSDiskAttribute read FAttribute write SetAttribute;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function UpdateKey:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function RecordNumber:Int64;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedSize(AVersion:Word):Word; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS disk runs'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSDiskRuns = class(TFileSysListEx)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ARunLocal:TMutexHandle; ALock:TSynchronizerHandle);</code>
+
| [[TNTFSDiskRuns|<code>TNTFSDiskRuns = class(TFileSysListEx)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FRunLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FRecent:TNTFSDiskRun;</code>
+
| &nbsp;
+
|-
+
| <code>FRecentVCN:Int64;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetStart:TNTFSDiskRun;</code>
+
| &nbsp;
+
|-
+
| <code>function GetFinal:TNTFSDiskRun;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property Recent:TNTFSDiskRun read FRecent write FRecent;</code>
+
| &nbsp;
+
|-
+
| <code>property RecentVCN:Int64 read FRecentVCN write FRecentVCN;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function SparseCount:Int64;</code>
+
| Count of sparse runs in list
+
|-
+
| <code>function ClusterCount:Int64;</code>
+
| Count of normal runs in list
+
|-
+
| <code>function AllocatedCount:Int64;</code>
+
| Count of allocated runs in list
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function TotalSize:LongWord;</code>
+
| Total size of the encoded data runs
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function RunCount:LongWord;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS disk run'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSDiskRun = class(TListObject)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);</code>
+
| [[TNTFSDiskRun|<code>TNTFSDiskRun = class(TListObject)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FLocalLock:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FStart:Int64;</code>
+
| Run start logical cluster
+
|-
+
| <code>FOffset:Int64;</code>
+
| Run start cluster offset
+
|-
+
| <code>FLength:Int64;</code>
+
| Run length in clusters
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FAttribute:TNTFSDiskAttribute;</code>
+
| Attribute owning this run
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function AcquireLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function ReleaseLock:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetIsLast:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function GetIsSparse:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetOffsetSize:Byte;</code>
+
| &nbsp;
+
|-
+
| <code>function GetLengthSize:Byte;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>procedure SetStart(const AStart:Int64);</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetOffset(const AOffset:Int64);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetSuccessor:TNTFSDiskRun;</code>
+
| &nbsp;
+
|-
+
| <code>function GetPredecessor:TNTFSDiskRun;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property IsLast:Boolean read GetIsLast;</code>
+
| &nbsp;
+
|-
+
| <code>property IsSparse:Boolean read GetIsSparse;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Start:Int64 read FStart write SetStart;</code>
+
| &nbsp;
+
|-
+
| <code>property Offset:Int64 read FOffset write SetOffset;</code>
+
| &nbsp;
+
|-
+
| <code>property Length:Int64 read FLength write FLength;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Attribute:TNTFSDiskAttribute read FAttribute;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function RunSize:LongWord; </code>
+
| Size of the encoded data run
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function UpdateRun:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadRun(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteRun(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS disk items'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSDiskItems = class(TFileSysListEx)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(AItemLocal:TMutexHandle; ALock:TSynchronizerHandle);</code>
+
| [[TNTFSDiskItems|<code>TNTFSDiskItems = class(TFileSysListEx)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FItemLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FStatus:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetLoaded:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetLoaded(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetPrevious(AItem:TNTFSDiskItem):TNTFSDiskItem;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property Loaded:Boolean read GetLoaded write SetLoaded;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function TotalSize:Int64;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ItemCount:LongWord;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS disk item'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSDiskItem = class(TListObject)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|Note: Data of attribute $ATTRIBUTE_LIST
+
| [[TNTFSDiskItem|<code>TNTFSDiskItem = class(TListObject)</code>]]
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskAttribute);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FLocalLock:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FStatus:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FItemSize:Word;</code>
+
| Record length
+
|-
+
| <code>FStartVCN:Int64;</code>
+
| Starting VCN if non resident
+
|-
+
| <code>FFileReference:Int64;</code>
+
| File Reference of the attribute
+
|-
+
| <code>FAttributeType:LongWord;</code>
+
| Attribute Type
+
|-
+
| <code>FAttributeId:Word;</code>
+
| Attribute Id
+
|-
+
| <code>FAttributeName:String;</code>
+
| Name in Unicode (if NameLength > 0)
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FParent:TNTFSDiskAttribute;</code>
+
| Attribute list owning this item
+
|-
+
| <code>FAttribute:TNTFSDiskAttribute;</code>
+
| Attribute pointed to by this item
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FAttributeHash:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function AcquireLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function ReleaseLock:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetInvalid:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetInvalid(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetAttributeName:String;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetAttributeName(const AAttributeName:String);</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetAttribute(AAttribute:TNTFSDiskAttribute);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function Compare(AItem:TNTFSDiskItem):Integer; virtual;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property Invalid:Boolean read GetInvalid write SetInvalid;</code>
+
| Item points to invalid file record or attribute
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property ItemSize:Word read FItemSize write FItemSize;</code>
+
| &nbsp;
+
|-
+
| <code>property StartVCN:Int64 read FStartVCN write FStartVCN;</code>
+
| &nbsp;
+
|-
+
| <code>property FileReference:Int64 read FFileReference write FFileReference;</code>
+
| &nbsp;
+
|-
+
| <code>property AttributeType:LongWord read FAttributeType write FAttributeType;</code>
+
| &nbsp;
+
|-
+
| <code>property AttributeId:Word read FAttributeId write FAttributeId;</code>
+
| &nbsp;
+
|-
+
| <code>property AttributeName:String read GetAttributeName write SetAttributeName;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Parent:TNTFSDiskAttribute read FParent;</code>
+
| &nbsp;
+
|-
+
| <code>property Attribute:TNTFSDiskAttribute read FAttribute write SetAttribute;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property AttributeHash:LongWord read FAttributeHash;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function RecordNumber:Int64;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function AttributeNameSize:Word;</code>
+
| &nbsp;
+
|-
+
| <code>function AttributeNameLength:Byte;</code>
+
| Name length
+
|-
+
| <code>function AttributeNameOffset:Byte;</code>
+
| Offset to Name
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function UpdateItem:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedSize(AVersion:Word):Word;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS disk attributes'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSDiskAttributes = class(TFileSysListEx)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(AAttributeLocal:TMutexHandle; ALock:TSynchronizerHandle);</code>
+
| [[TNTFSDiskAttributes|<code>TNTFSDiskAttributes = class(TFileSysListEx)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FAttributeLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetPrevious(AAttribute:TNTFSDiskAttribute):TNTFSDiskAttribute;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>function TotalSize:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function AttributeCount:LongWord;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
+
'''NTFS disk attribute'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSDiskAttribute = class(TListObject)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| [[TNTFSDiskAttribute|<code>TNTFSDiskAttribute = class(TListObject)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FLocalLock:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
+
|-
+
| <code>FStatus:LongWord;</code>
+
| &nbsp;
+
|-
+
| <code>FData:Pointer;</code>
+
| Only applicable if attribute is resident
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FAttributeType:LongWord;</code>
+
| Attribute Type (e.g. 0x80, 0xA0)
+
|-
+
| <code>FAttributeSize:LongWord;</code>
+
| Length of the Attribute (including header)
+
|-
+
| <code>FAttributeFlags:Word;</code>
+
| Attribute Flags
+
|-
+
| <code>FAttributeId:Word;</code>
+
| Attribute Id
+
|-
+
| <code>FAttributeName:String;</code>
+
| Attribute Name
+
|-
+
| <code>FNonResident:Byte;</code>
+
| Non-resident flag
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FIndexed:Byte;</code>
+
| Indexed flag
+
|-
+
| <code>FDataSize:LongWord;</code>
+
| Length of the Attribute Data
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FStartVCN:Int64;</code>
+
| Starting VCN
+
|-
+
| <code>FLastVCN:Int64;</code>
+
| Last VCN
+
|-
+
| <code>FStreamSize:Int64;</code>
+
| Real size of the attribute
+
|-
+
| <code>FStreamUsed:Int64;</code>
+
| The actual Allocated size of the attribute (Only present when compressed and only in the first instance)
+
|-
+
| <code>FStreamAllocated:Int64;</code>
+
| Allocated size of the attribute
+
|-
+
| <code>FInitializedSize:Int64;</code>
+
| Initialized data size of the stream (Portion which has been Written)
+
|-
+
| <code>FCompressionUnit:Word;</code>
+
| Compression Unit Size
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FRuns:TNTFSDiskRuns;</code>
+
| List of runs of this attribute
+
|-
+
| <code>FItems:TNTFSDiskItems;</code>
+
| List of items of this attribute
+
|-
+
| <code>FIndex:TNTFSDiskIndex;</code>
+
| Index of this attribute if applicable
+
|-
+
| <code>FParent:TNTFSDiskRecord;</code>
+
| Record owning this attribute
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FAttributeHash:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function AcquireLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function ReleaseLock:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetRunsLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
| <code>function GetItemsLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
| <code>function GetIndexLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
| <code>function GetExtendedsLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetRunLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
| <code>function GetItemLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
| <code>function GetKeyLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
| <code>function GetExtendedLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetUpdating:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetUpdating(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetIsFixed:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function GetIsSingle:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function GetIsUnlisted:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function GetIsUnmovable:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function GetIsManaged:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetIsSparse:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetIsSparse(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
| <code>function GetIsEncrypted:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetIsEncrypted(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
| <code>function GetIsCompressed:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetIsCompressed(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetAttributeName:String;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetAttributeName(const AAttributeName:String);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetDataSize:LongWord; virtual;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetDataSize(AValue:LongWord); virtual;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function Compare(AAttribute:TNTFSDiskAttribute):Integer; virtual;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CreateRuns(ANew:Boolean):TNTFSDiskRuns;</code>
+
| &nbsp;
+
|-
+
| <code>function CreateItems(ANew:Boolean):TNTFSDiskItems;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetRecord(AInstance:Integer):TNTFSDiskRecord;</code>
+
| &nbsp;
+
|-
+
| <code>function GetAttribute(AType:LongWord; const AName:String; AInstance:Integer):TNTFSDiskAttribute;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property Updating:Boolean read GetUpdating write SetUpdating;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property IsFixed:Boolean read GetIsFixed;</code>
+
| &nbsp;
+
|-
+
| <code>property IsSingle:Boolean read GetIsSingle;</code>
+
| &nbsp;
+
|-
+
| <code>property IsUnlisted:Boolean read GetIsUnlisted;</code>
+
| &nbsp;
+
|-
+
| <code>property IsUnmovable:Boolean read GetIsUnmovable;</code>
+
| &nbsp;
+
|-
+
| <code>property IsManaged:Boolean read GetIsManaged;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property IsSparse:Boolean read GetIsSparse write SetIsSparse;</code>
+
| &nbsp;
+
|-
+
| <code>property IsEncrypted:Boolean read GetIsEncrypted write SetIsEncrypted;</code>
+
| &nbsp;
+
|-
+
| <code>property IsCompressed:Boolean read GetIsCompressed write SetIsCompressed;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Data:Pointer read FData;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property AttributeType:LongWord read FAttributeType;</code>
+
| &nbsp;
+
|-
+
| <code>property AttributeSize:LongWord read FAttributeSize write FAttributeSize;</code>
+
| &nbsp;
+
|-
+
| <code>property AttributeFlags:Word read FAttributeFlags write FAttributeFlags;</code>
+
| &nbsp;
+
|-
+
| <code>property AttributeId:Word read FAttributeId write FAttributeId;</code>
+
| &nbsp;
+
|-
+
| <code>property AttributeName:String read GetAttributeName write SetAttributeName;</code>
+
| &nbsp;
+
|-
+
| <code>property NonResident:Byte read FNonResident write FNonResident;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Indexed:Byte read FIndexed write FIndexed;</code>
+
| &nbsp;
+
|-
+
| <code>property DataSize:LongWord read GetDataSize write SetDataSize;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property StartVCN:Int64 read FStartVCN write FStartVCN;</code>
+
| &nbsp;
+
|-
+
| <code>property LastVCN:Int64 read FLastVCN write FLastVCN;</code>
+
| &nbsp;
+
|-
+
| <code>property StreamSize:Int64 read FStreamSize write FStreamSize;</code>
+
| &nbsp;
+
|-
+
| <code>property StreamUsed:Int64 read FStreamUsed write FStreamUsed;</code>
+
| &nbsp;
+
|-
+
| <code>property StreamAllocated:Int64 read FStreamAllocated write FStreamAllocated;</code>
+
| &nbsp;
+
|-
+
| <code>property InitializedSize:Int64 read FInitializedSize write FInitializedSize;</code>
+
| &nbsp;
+
|-
+
| <code>property CompressionUnit:Word read FCompressionUnit write FCompressionUnit;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Runs:TNTFSDiskRuns read FRuns;</code>
+
| &nbsp;
+
|-
+
| <code>property Items:TNTFSDiskItems read FItems;</code>
+
| &nbsp;
+
|-
+
| <code>property Index:TNTFSDiskIndex read FIndex;</code>
+
| &nbsp;
+
|-
+
| <code>property Parent:TNTFSDiskRecord read FParent write FParent;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property AttributeHash:LongWord read FAttributeHash;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetRunCount(const AVCN:Int64; var AStartVCN,ACount:Int64):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function GetRunLength(const AVCN:Int64; var AStartVCN,ALength:Int64):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function GetRunByUnit(const AUnit:Int64; var AStartVCN:Int64):TNTFSDiskRun;</code>
+
| &nbsp;
+
|-
+
| <code>function GetRunByCluster(const ACluster:Int64; var AStartVCN:Int64):TNTFSDiskRun;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CreateRun(ANew:Boolean):TNTFSDiskRun;</code>
+
| &nbsp;
+
|-
+
| <code>function DestroyRun(ARun:TNTFSDiskRun):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function NewRun(const AStart,ALength:Int64):TNTFSDiskRun;</code>
+
| &nbsp;
+
|-
+
| <code>function InsertRun(APrev:TNTFSDiskRun; const AStart,ALength:Int64):TNTFSDiskRun;</code>
+
| &nbsp;
+
|-
+
| <code>function GetRun(const AVCN:Int64; var AStartVCN:Int64):TNTFSDiskRun;</code>
+
| &nbsp;
+
|-
+
| <code>function GetRunOld(const AVCN:Int64; var AStartVCN:Int64):TNTFSDiskRun;</code>
+
| &nbsp;
+
|-
+
| <code>function MergeRun(ARun:TNTFSDiskRun):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function SplitRun(ARun:TNTFSDiskRun; const ALength:Int64):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function RemoveRun(ARun:TNTFSDiskRun):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function MoveRun(ADest:TNTFSDiskAttribute; ARun:TNTFSDiskRun):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetItemByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSDiskItem;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CreateItem(ANew:Boolean):TNTFSDiskItem;</code>
+
| &nbsp;
+
|-
+
| <code>function DestroyItem(AItem:TNTFSDiskItem):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function NewItem(AAttribute:TNTFSDiskAttribute):TNTFSDiskItem;</code>
+
| &nbsp;
+
|-
+
| <code>function GetItem(AType:LongWord; const AName:String; AInstance:Integer):TNTFSDiskItem;</code>
+
| &nbsp;
+
|-
+
| <code>function RemoveItem(AItem:TNTFSDiskItem):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function MoveItem(AItem:TNTFSDiskItem; AAttribute:TNTFSDiskAttribute):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function RenameItem(AItem:TNTFSDiskItem; AAttribute:TNTFSDiskAttribute):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CreateIndex(AVersion,ASector:Word):Boolean; virtual;</code>
+
| &nbsp;
+
|-
+
| <code>function NewIndex(AVersion,ASector:Word; AType,ARule,ASize,AOffset:LongWord):Boolean; virtual;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function RecordNumber:Int64;</code>
+
| &nbsp;
+
|-
+
| <code>function FileReference:Int64;</code>
+
| &nbsp;
+
|-
+
| <code>function BaseReference:Int64;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function RunOffset:Word;</code>
+
| Offset to the Data Run
+
|-
+
| <code>function DataOffset:Word;</code>
+
| Offset to the Attribute Data
+
|-
+
| <code>function AttributeNameSize:Word;</code>
+
| &nbsp;
+
|-
+
| <code>function AttributeNameLength:Byte;</code>
+
| Name length
+
|-
+
| <code>function AttributeNameOffset:Word;</code>
+
| Offset to the Name
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function RunCount:LongWord;</code>
+
| &nbsp;
+
|-
+
| <code>function ItemCount:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedSize(AVersion:Word):LongWord; virtual;</code>
+
| &nbsp;
+
|-
+
| <code>function CalculatedDataSize(AVersion:Word):LongWord; virtual;</code>
+
| &nbsp;
+
|-
+
| <code>function CalculatedStreamSize(AVersion:Word):Int64; virtual;</code>
+
| &nbsp;
+
|-
+
| <code>function CalculatedStreamUsed(AVersion:Word):Int64; virtual;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CoalesceRun(ARun:TNTFSDiskRun):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function UpdateRun(ARun:TNTFSDiskRun):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function UpdateKey(AKey:TNTFSDiskKey):Boolean; virtual;</code>
+
| &nbsp;
+
|-
+
| <code>function UpdateItem(AItem:TNTFSDiskItem):Boolean; virtual;</code>
+
| &nbsp;
+
|-
+
| <code>function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; virtual;</code>
+
| &nbsp;
+
|-
+
| <code>function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; virtual;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadRuns(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteRuns(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; virtual;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; virtual;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
+
'''NTFS standard information attribute'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSStandardInformationAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| [[TNTFSStandardInformationAttribute|<code>TNTFSStandardInformationAttribute = class(TNTFSDiskAttribute)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FCreateTime:TFileTime;</code>
+
| File Creation
+
|-
+
| <code>FWriteTime:TFileTime;</code>
+
| File Altered
+
|-
+
| <code>FChangeTime:TFileTime;</code>
+
| MFT Changed
+
|-
+
| <code>FAccessTime:TFileTime;</code>
+
| File Read
+
|-
+
| <code>FAttributes:LongWord;</code>
+
| DOS File Permissions
+
|-
+
| <code>FMaxVersions:LongWord;</code>
+
| Maximum Number of Versions
+
|-
+
| <code>FVersionNo:LongWord;</code>
+
| Version Number
+
|-
+
| <code>FClassId:LongWord;</code>
+
| Class Id
+
|-
+
| <code>FOwnerId:LongWord;</code>
+
| Owner Id
+
|-
+
| <code>FSecurityId:LongWord;</code>
+
| Security Id
+
|-
+
| <code>FQuotaCharge:Int64;</code>
+
| Quota Charged
+
|-
+
| <code>FUpdateSequenceNumber:Int64;</code>
+
| Update Sequence Number
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property CreateTime:TFileTime read FCreateTime write FCreateTime;</code>
+
| &nbsp;
+
|-
+
| <code>property WriteTime:TFileTime read FWriteTime write FWriteTime;</code>
+
| &nbsp;
+
|-
+
| <code>property ChangeTime:TFileTime read FChangeTime write FChangeTime;</code>
+
| &nbsp;
+
|-
+
| <code>property AccessTime:TFileTime read FAccessTime write FAccessTime;</code>
+
| &nbsp;
+
|-
+
| <code>property Attributes:LongWord read FAttributes write FAttributes;</code>
+
| &nbsp;
+
|-
+
| <code>property MaxVersions:LongWord read FMaxVersions write FMaxVersions;</code>
+
| &nbsp;
+
|-
+
| <code>property VersionNo:LongWord read FVersionNo write FVersionNo;</code>
+
| &nbsp;
+
|-
+
| <code>property ClassId:LongWord read FClassId write FClassId;</code>
+
| &nbsp;
+
|-
+
| <code>property OwnerId:LongWord read FOwnerId write FOwnerId;</code>
+
| &nbsp;
+
|-
+
| <code>property SecurityId:LongWord read FSecurityId write FSecurityId;</code>
+
| &nbsp;
+
|-
+
| <code>property QuotaCharge:Int64 read FQuotaCharge write FQuotaCharge;</code>
+
| &nbsp;
+
|-
+
| <code>property UpdateSequenceNumber:Int64 read FUpdateSequenceNumber write FUpdateSequenceNumber;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS attribute list'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSAttributeListAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| [[TNTFSAttributeListAttribute|<code>TNTFSAttributeListAttribute = class(TNTFSDiskAttribute)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS file name attribute'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSFileNameAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| [[TNTFSFileNameAttribute|<code>TNTFSFileNameAttribute = class(TNTFSDiskAttribute)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FParentReference:Int64;</code>
+
| File reference to the parent directory
+
|-
+
| <code>FCreateTime:TFileTime;</code>
+
| C Time - File Creation
+
Note: These fields are only updated when the filename is changed (See Standard Information instead)
+
|-
+
| <code>FWriteTime:TFileTime;</code>
+
| A Time - File Altered
+
Note: These fields are only updated when the filename is changed (See Standard Information instead)
+
|-
+
| <code>FChangeTime:TFileTime;</code>
+
| M Time - MFT Changed
+
Note: These fields are only updated when the filename is changed (See Standard Information instead)
+
|-
+
| <code>FAccessTime:TFileTime;</code>
+
| R Time - File Read
+
Note: These fields are only updated when the filename is changed (See Standard Information instead)
+
|-
+
| <code>FFileAllocated:Int64;</code>
+
| Allocated size of the file (As for CreateTime/WriteTime/ChangeTime etc)
+
|-
+
| <code>FFileSize:Int64;</code>
+
| Real size of the file (As for CreateTime/WriteTime/ChangeTime etc)
+
|-
+
| <code>FFileFlags:LongWord;</code>
+
| Flags, e.g. Directory, compressed, hidden (As for CreateTime/WriteTime/ChangeTime etc)
+
|-
+
| <code>FReparseTag:LongWord;</code>
+
| Used by EAs and Reparse
+
|-
+
| <code>FNameSpace:Byte;</code>
+
| Filename namespace
+
|-
+
| <code>FFileName:String;</code>
+
| File name
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FFileHash:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetFileName:String;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetFileName(const AFileName:String);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property ParentReference:Int64 read FParentReference write FParentReference;</code>
+
| &nbsp;
+
|-
+
| <code>property CreateTime:TFileTime read FCreateTime write FCreateTime;</code>
+
| &nbsp;
+
|-
+
| <code>property WriteTime:TFileTime read FWriteTime write FWriteTime;</code>
+
| &nbsp;
+
|-
+
| <code>property ChangeTime:TFileTime read FChangeTime write FChangeTime;</code>
+
| &nbsp;
+
|-
+
| <code>property AccessTime:TFileTime read FAccessTime write FAccessTime;</code>
+
| &nbsp;
+
|-
+
| <code>property FileAllocated:Int64 read FFileAllocated write FFileAllocated;</code>
+
| &nbsp;
+
|-
+
| <code>property FileSize:Int64 read FFileSize write FFileSize;</code>
+
| &nbsp;
+
|-
+
| <code>property FileFlags:LongWord read FFileFlags write FFileFlags;</code>
+
| &nbsp;
+
|-
+
| <code>property ReparseTag:LongWord read FReparseTag write FReparseTag;</code>
+
| &nbsp;
+
|-
+
| <code>property NameSpace:Byte read FNameSpace write FNameSpace;</code>
+
| &nbsp;
+
|-
+
| <code>property FileName:String read GetFileName write SetFileName;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property FileHash:LongWord read FFileHash;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function FileNameSize:Word;</code>
+
| &nbsp;
+
|-
+
| <code>function FileNameLength:Byte;</code>
+
| Filename length in characters
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ParentRecord:Int64;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS object Id attribute'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSObjectIdAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| [[TNTFSObjectIdAttribute|<code>TNTFSObjectIdAttribute = class(TNTFSDiskAttribute)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FObjectId:TGUID;</code>
+
| GUID Object Id Unique Id assigned to file
+
|-
+
| <code>FBirthVolumeId:TGUID;</code>
+
| GUID Birth Volume Id Volume where file was created
+
|-
+
| <code>FBirthObjectId:TGUID;</code>
+
| GUID Birth Object Id Original Object Id of file
+
|-
+
| <code>FDomainId:TGUID;</code>
+
| GUID Domain Id Domain in which object was created
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property ObjectId:TGUID read FObjectId write FObjectId;</code>
+
| &nbsp;
+
|-
+
| <code>property BirthVolumeId:TGUID read FBirthVolumeId write FBirthVolumeId;</code>
+
| &nbsp;
+
|-
+
| <code>property BirthObjectId:TGUID read FBirthObjectId write FBirthObjectId;</code>
+
| &nbsp;
+
|-
+
| <code>property DomainId:TGUID read FDomainId write FDomainId;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
+
'''NTFS volume version attribute'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSVolumeVersionAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
+
 
|-
 
|-
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
+
| [[TNTFSVolumeVersionAttribute|<code>TNTFSVolumeVersionAttribute = class(TNTFSDiskAttribute)</code>]]
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS security descriptor attribute'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSSecurityDescriptorAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
|-
+
|colspan="2"|Note: This is the same structure that is used for all security in Windows (File/Kernel/Registry etc). See TSecurityDescriptor and associated values in Security unit for more information.
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FSecurity:TNTFSSecurity;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property Security:TNTFSSecurity read FSecurity;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CreateSecurity:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function NewSecurity(ASecurity:TNTFSSecurity):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
 
|-
 
|-
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| [[TNTFSSecurityDescriptorAttribute|<code>TNTFSSecurityDescriptorAttribute = class(TNTFSDiskAttribute)</code>]]
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS volume name attribute'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSVolumeNameAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FVolumeName:String;</code>
+
| Volume name
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetVolumeName:String;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetVolumeName(const AVolumeName:String);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property VolumeName:String read GetVolumeName write SetVolumeName;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
 
|-
 
|-
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| [[TNTFSVolumeNameAttribute|<code>TNTFSVolumeNameAttribute = class(TNTFSDiskAttribute)</code>]]
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS volume information attribute'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSVolumeInformationAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| [[TNTFSVolumeInformationAttribute|<code>TNTFSVolumeInformationAttribute = class(TNTFSDiskAttribute)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FMajorVersion:Byte;</code>
+
| Major version number
+
|-
+
| <code>FMinorVersion:Byte;</code>
+
| Minor version number
+
|-
+
| <code>FVolumeFlags:Word;</code>
+
| Flags
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property MajorVersion:Byte read FMajorVersion write FMajorVersion;</code>
+
| &nbsp;
+
|-
+
| <code>property MinorVersion:Byte read FMinorVersion write FMinorVersion;</code>
+
| &nbsp;
+
|-
+
| <code>property VolumeFlags:Word read FVolumeFlags write FVolumeFlags;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS data attribute'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSDataAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| [[TNTFSDataAttribute|<code>TNTFSDataAttribute = class(TNTFSDiskAttribute)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
+
|-
+
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS index root attribute'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSIndexRootAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| [[TNTFSIndexRootAttribute|<code>TNTFSIndexRootAttribute = class(TNTFSDiskAttribute)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FIndexType:LongWord;</code>
+
| Attribute Type
+
|-
+
| <code>FCollateRule:LongWord;</code>
+
| Collation Rule
+
|-
+
| <code>FIndexRecordSize:LongWord;</code>
+
| Size of Index Allocation Entry (bytes)
+
|-
+
| <code>FIndexCounterOffset:LongWord;</code>
+
| Index Record Number increment
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property IndexType:LongWord read FIndexType write FIndexType;</code>
+
| &nbsp;
+
|-
+
| <code>property CollateRule:LongWord read FCollateRule write FCollateRule;</code>
+
| &nbsp;
+
|-
+
| <code>property IndexRecordSize:LongWord read FIndexRecordSize write FIndexRecordSize;</code>
+
| &nbsp;
+
|-
+
| <code>property IndexCounterOffset:LongWord read FIndexCounterOffset write FIndexCounterOffset;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CreateIndex(AVersion,ASector:Word):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function NewIndex(AVersion,ASector:Word; AType,ARule,ASize,AOffset:LongWord):Boolean; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS index allocation attribute'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSIndexAllocationAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| [[TNTFSIndexAllocationAttribute|<code>TNTFSIndexAllocationAttribute = class(TNTFSDiskAttribute)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
+
|-
+
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS bitmap attribute'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSBitmapAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| [[TNTFSBitmapAttribute|<code>TNTFSBitmapAttribute = class(TNTFSDiskAttribute)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FBitmap:Pointer;</code>
+
| &nbsp;
+
|-
+
| <code>FBitmapSize:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
+
|-
+
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetBitmapSize(AValue:LongWord);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property Bitmap:Pointer read FBitmap;</code>
+
| &nbsp;
+
|-
+
| <code>property BitmapSize:LongWord read FBitmapSize write SetBitmapSize;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
+
'''NTFS reparse point attribute'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSReparsePointAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| [[TNTFSReparsePointAttribute|<code>TNTFSReparsePointAttribute = class(TNTFSDiskAttribute)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FReparseTag:LongWord;</code>
+
| Reparse Type (and Flags)
+
|-
+
| <code>FReparseSize:Word;</code>
+
| Reparse Data Length
+
|-
+
| <code>FReparseGUID:TGUID;</code>
+
| Reparse GUID
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FReparse:TNTFSReparse;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetIsAlias:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetIsAlias(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
| <code>function GetIsHighLatency:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetIsHighLatency(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
| <code>function GetIsMicrosoft:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetIsMicrosoft(AValue:Boolean);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property IsAlias:Boolean read GetIsAlias write SetIsAlias;</code>
+
| &nbsp;
+
|-
+
| <code>property IsHighLatency:Boolean read GetIsHighLatency write SetIsHighLatency;</code>
+
| &nbsp;
+
|-
+
| <code>property IsMicrosoft:Boolean read GetIsMicrosoft write SetIsMicrosoft;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property ReparseTag:LongWord read FReparseTag write FReparseTag;</code>
+
| &nbsp;
+
|-
+
| <code>property ReparseSize:Word read FReparseSize write FReparseSize;</code>
+
| &nbsp;
+
|-
+
| <code>property ReparseGUID:TGUID read FReparseGUID write FReparseGUID;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Reparse:TNTFSReparse read FReparse;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CreateReparse:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function NewReparse(AReparseTag:LongWord):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS symbolic link attribute'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSSymbolicLinkAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| [[TNTFSSymbolicLinkAttribute|<code>TNTFSSymbolicLinkAttribute = class(TNTFSDiskAttribute)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
+
|-
+
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS extended attribute information'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSExtendedAttrInformationAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| [[TNTFSExtendedAttrInformationAttribute|<code>TNTFSExtendedAttrInformationAttribute = class(TNTFSDiskAttribute)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FPackedSize:Word;</code>
+
| Size of the packed Extended Attributes
+
|-
+
| <code>FFlagCount:Word;</code>
+
| Number of Extended Attributes with NEED_EA
+
|-
+
| <code>FUnpackedSize:LongWord;</code>
+
| Size of the unpacked Extended Attributes
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property PackedSize:Word read FPackedSize write FPackedSize;</code>
+
| &nbsp;
+
|-
+
| <code>property FlagCount:Word read FFlagCount write FFlagCount;</code>
+
| &nbsp;
+
|-
+
| <code>property UnpackedSize:LongWord read FUnpackedSize write FUnpackedSize;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS extended attribute'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSExtendedAttrAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| [[TNTFSExtendedAttrAttribute|<code>TNTFSExtendedAttrAttribute = class(TNTFSDiskAttribute)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FExtendeds:TNTFSExtendeds;</code>
+
| List of attributes of this attribute
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property Extendeds:TNTFSExtendeds read FExtendeds;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CreateExtended:TNTFSExtended;</code>
+
| &nbsp;
+
|-
+
| <code>function DestroyExtended(AExtended:TNTFSExtended):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function NewExtended(const AName:String):TNTFSExtended;</code>
+
| &nbsp;
+
|-
+
| <code>function GetExtended(const AName:String):TNTFSExtended;</code>
+
| &nbsp;
+
|-
+
| <code>function RemoveExtended(AExtended:TNTFSExtended):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ExtendedCount:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadExtendeds(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteExtendeds(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS property set attribute'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSPropertySetAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| [[TNTFSPropertySetAttribute|<code>TNTFSPropertySetAttribute = class(TNTFSDiskAttribute)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
+
|-
+
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS logged utility stream attribute'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSLoggedUtilityStreamAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| [[TNTFSLoggedUtilityStreamAttribute|<code>TNTFSLoggedUtilityStreamAttribute = class(TNTFSDiskAttribute)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
+
|-
+
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS end attribute'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSEndAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| [[TNTFSEndAttribute|<code>TNTFSEndAttribute = class(TNTFSDiskAttribute)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>function CalculatedSize(AVersion:Word):LongWord; override;</code>
+
| &nbsp;
+
|-
+
| <code>function CalculatedDataSize(AVersion:Word):LongWord; override;</code>
+
| &nbsp;
+
|-
+
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS unknown attribute'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSUnknownAttribute = class(TNTFSDiskAttribute)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
+
 
|-
 
|-
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
+
| [[TNTFSUnknownAttribute|<code>TNTFSUnknownAttribute = class(TNTFSDiskAttribute)</code>]]
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS object Id'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSObjId = class(TObject)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
|-
+
|colspan="2"|Note: Data of index $O in file $ObjId (Not Used)
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
 
|-
 
|-
|colspan="2"|&nbsp;
+
| [[TNTFSObjId|<code>TNTFSObjId = class(TObject)</code>]]
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS quota'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSQuota = class(TObject)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
|-
+
|colspan="2"|Note: Data of index $Q in file $Quota (Not Used)
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
 
|-
 
|-
|colspan="2"|&nbsp;
+
| [[TNTFSQuota|<code>TNTFSQuota = class(TObject)</code>]]
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS owner'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSOwner = class(TObject)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|Note: Data of index $O in file $Quota (Not Used)
+
| [[TNTFSOwner|<code>TNTFSOwner = class(TObject)</code>]]
|-
+
|colspan="2"|&nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
|colspan="2"|&nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS upper case'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSUpCase = class(TObject)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|Note: Data of file $UpCase
+
| [[TNTFSUpCase|<code>TNTFSUpCase = class(TObject)</code>]]
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>constructor Create;</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FLock:TSynchronizerHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FData:Pointer;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReaderLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function ReaderUnlock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriterLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriterUnlock:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property Data:Pointer read FData;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function Init(AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function Convert(ASource,ADest:Pointer; ASize:LongWord):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadUpCase(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteUpCase(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS attribute definitions'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSAttrDefs = class(TFileSysList)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create;</code>
+
| [[TNTFSAttrDefs|<code>TNTFSAttrDefs = class(TFileSysList)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FAttrDefLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetPrevious(AAttrDef:TNTFSAttrDef):TNTFSAttrDef;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>function CreateAttrDef(AType:LongWord; AVersion:Word; ANew:Boolean):TNTFSAttrDef;</code>
+
| &nbsp;
+
|-
+
| <code>function DestroyAttrDef(AAttrDef:TNTFSAttrDef):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function NewAttrDef(AType:LongWord; const AName:String; AVersion:Word):TNTFSAttrDef;</code>
+
| &nbsp;
+
|-
+
| <code>function GetAttrDef(AType:LongWord; const AName:String):TNTFSAttrDef;</code>
+
| &nbsp;
+
|-
+
| <code>function GetAttrDefByIndex(AIndex:Integer; AVersion:Word):TNTFSAttrDef;</code>
+
| &nbsp;
+
|-
+
| <code>function GetAttrDefByIndexEx(AIndex:Integer; AVersion:Word; AWrite:Boolean):TNTFSAttrDef;</code>
+
| &nbsp;
+
|-
+
| <code>function GetAttrDefByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSAttrDef;</code>
+
| &nbsp;
+
|-
+
| <code>function RemoveAttrDef(AAttrDef:TNTFSAttrDef):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CheckSize(AAttribute:TNTFSDiskAttribute;const ASize:Int64):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function CheckIndexed(AAttribute:TNTFSDiskAttribute):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function CheckResident(AAttribute:TNTFSDiskAttribute):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function CheckUncompressed(AAttribute:TNTFSDiskAttribute):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function TotalSize:Int64;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function AttrDefCount:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function Init(AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadAttrDefs(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteAttrDefs(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS attribute definition'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSAttrDef = class(TListObject)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|Note: Data of file $AttrDef
+
| [[TNTFSAttrDef|<code>TNTFSAttrDef = class(TListObject)</code>]]
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FLocalLock:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FAttributeName:String;</code>
+
| Label in Unicode
+
|-
+
| <code>FAttributeType:LongWord;</code>
+
| Type
+
|-
+
| <code>FDisplayRule:LongWord;</code>
+
| Display rule
+
|-
+
| <code>FCollateRule:LongWord;</code>
+
| Collation rule
+
|-
+
| <code>FAttrDefFlags:LongWord;</code>
+
| Flags (See Consts)
+
|-
+
| <code>FMinimumSize:Int64;</code>
+
| Minimum size
+
|-
+
| <code>FMaximumSize:Int64;</code>
+
| Maximum size
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FAttributeHash:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function AcquireLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function ReleaseLock:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetAttributeName:String;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetAttributeName(const AAttributeName:String);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetIsIndexed:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function GetIsResident:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function GetIsUncompressed:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function Compare(AAttrDef:TNTFSAttrDef):Integer; virtual;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property AttributeName:String read GetAttributeName write SetAttributeName;</code>
+
| &nbsp;
+
|-
+
| <code>property AttributeType:LongWord read FAttributeType write FAttributeType;</code>
+
| &nbsp;
+
|-
+
| <code>property DisplayRule:LongWord read FDisplayRule write FDisplayRule;</code>
+
| &nbsp;
+
|-
+
| <code>property CollateRule:LongWord read FCollateRule write FCollateRule;</code>
+
| &nbsp;
+
|-
+
| <code>property AttrDefFlags:LongWord read FAttrDefFlags write FAttrDefFlags;</code>
+
| &nbsp;
+
|-
+
| <code>property MinimumSize:Int64 read FMinimumSize write FMinimumSize;</code>
+
| &nbsp;
+
|-
+
| <code>property MaximumSize:Int64 read FMaximumSize write FMaximumSize;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property IsIndexed:Boolean read GetIsIndexed;</code>
+
| &nbsp;
+
|-
+
| <code>property IsResident:Boolean read GetIsResident;</code>
+
| &nbsp;
+
|-
+
| <code>property IsUncompressed:Boolean read GetIsUncompressed;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function Init(AIndex:Integer;AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property AttributeHash:LongWord read FAttributeHash;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadAttrDef(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteAttrDef(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS reparse'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSReparse = class(TDiskReparse)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|Note: Data of attribute $REPARSE_POINT
+
| [[TNTFSReparse|<code>TNTFSReparse = class(TDiskReparse)</code>]]
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FData:Pointer;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FDataSize:Word;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FAttribute:TNTFSDiskAttribute;</code>
+
| Attribute owning this index
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>procedure SetData(AData:Pointer); virtual;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetDataSize:Word; virtual;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetDataSize(ASize:Word); virtual;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property Data:Pointer read FData write SetData;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property DataSize:Word read GetDataSize write SetDataSize;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Attribute:TNTFSDiskAttribute read FAttribute;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedSize(AVersion:Word):Word; virtual;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS reparse symbolic link'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSReparseSymLink = class(TNTFSReparse)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|Note: Data of attribute $REPARSE_POINT (Tag 0xA000000C)
+
| [[TNTFSReparseSymLink|<code>TNTFSReparseSymLink = class(TNTFSReparse)</code>]]
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>procedure SetData(AData:Pointer); override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>procedure SetDataSize(ASize:Word); override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
+
|-
+
| <code>FPrintName:String;</code>
+
| Path Buffer
+
|-
+
| <code>FSubstituteName:String;</code>
+
| Path Buffer
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FPrintHash:LongWord;</code>
+
| &nbsp;
+
|-
+
| <code>FSubstituteHash:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetTarget:String; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetPrintName:String;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetPrintName(const APrintName:String);</code>
+
| &nbsp;
+
|-
+
| <code>function GetSubstituteName:String;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetSubstituteName(const ASubstituteName:String);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property PrintName:String read GetPrintName write SetPrintName;</code>
+
| &nbsp;
+
|-
+
| <code>property SubstituteName:String read GetSubstituteName write SetSubstituteName;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property PrintHash:LongWord read FPrintHash;</code>
+
| &nbsp;
+
|-
+
| <code>property SubstituteHash:LongWord read FSubstituteHash;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function PrintNameSize:Word; virtual;</code>
+
| &nbsp;
+
|-
+
| <code>function PrintNameOffset:Word; virtual;</code>
+
| Print Name Offset
+
|-
+
| <code>function PrintNameLength:Word; virtual;</code>
+
| Print Name Length
+
|-
+
| <code>function SubstituteNameSize:Word; virtual;</code>
+
| &nbsp;
+
|-
+
| <code>function SubstituteNameOffset:Word; virtual;</code>
+
| Substitute Name Offset
+
|-
+
| <code>function SubstituteNameLength:Word; virtual;</code>
+
| Substitute Name Length
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedSize(AVersion:Word):Word; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS reparse mount point'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSReparseMountPoint = class(TNTFSReparseSymLink)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|Note: Data of attribute $REPARSE_POINT (Tag 0xA0000003)
+
| [[TNTFSReparseMountPoint|<code>TNTFSReparseMountPoint = class(TNTFSReparseSymLink)</code>]]
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>function PrintNameSize:Word; override;</code>
+
| &nbsp;
+
|-
+
| <code>function PrintNameOffset:Word; override;</code>
+
| Print Name Offset
+
|-
+
| <code>function PrintNameLength:Word; override;</code>
+
| Print Name Length
+
|-
+
| <code>function SubstituteNameSize:Word; override;</code>
+
| &nbsp;
+
|-
+
| <code>function SubstituteNameOffset:Word; override;</code>
+
| Substitute Name Offset
+
|-
+
| <code>function SubstituteNameLength:Word; override;</code>
+
| Substitute Name Length
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CalculatedSize(AVersion:Word):Word; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS extendeds'''
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSExtendeds = class(TFileSysListEx)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create(AExtendedLocal:TMutexHandle; ALock:TSynchronizerHandle);</code>
+
| [[TNTFSExtendeds|<code>TNTFSExtendeds = class(TFileSysListEx)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FExtendedLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>function TotalSize:Int64;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ExtendedCount:LongWord;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS extended'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSExtended = class(TListObject)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|Note: Data of attribute $EA
+
| [[TNTFSExtended|<code>TNTFSExtended = class(TListObject)</code>]]
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FLocalLock:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FExtendedOffset:LongWord;</code>
+
| Offset to next Extended Attribute (Offset to next EA is the size of this EA)
+
|-
+
| <code>FExtendedFlags:Byte;</code>
+
| Flags
+
|-
+
| <code>FExtendedName:String;</code>
+
| Name Note: No offset so always in the same location (Not Unicode)
+
|-
+
| <code>FExtendedData:Pointer;</code>
+
| Value
+
|-
+
| <code>FExtendedDataSize:Word;</code>
+
| Value Length
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FExtendedHash:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function AcquireLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function ReleaseLock:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetExtendedName:String;</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetExtendedName(const AExtendedName:String);</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetExtendedDataSize(ASize:Word);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property ExtendedOffset:LongWord read FExtendedOffset write FExtendedOffset;</code>
+
| &nbsp;
+
|-
+
| <code>property ExtendedFlags:Byte read FExtendedFlags write FExtendedFlags;</code>
+
| &nbsp;
+
|-
+
| <code>property ExtendedName:String read GetExtendedName write SetExtendedName;</code>
+
| &nbsp;
+
|-
+
| <code>property ExtendedData:Pointer read FExtendedData;</code>
+
| &nbsp;
+
|-
+
| <code>property ExtendedDataSize:Word read FExtendedDataSize write SetExtendedDataSize;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property ExtendedHash:LongWord read FExtendedHash;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ExtendedSize:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ExtendedNameSize:Word;</code>
+
| &nbsp;
+
|-
+
| <code>function ExtendedNameLength:Byte;</code>
+
| Name Length
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadExtended(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteExtended(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS security items'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSSecurityItems = class(TFileSysList)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
| <code>constructor Create;</code>
+
| [[TNTFSSecurityItems|<code>TNTFSSecurityItems = class(TFileSysList)</code>]]
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FSecurityLocal:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function GetPrevious(ASecurityItem:TNTFSSecurityItem):TNTFSSecurityItem;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>function CreateSecurityItem(ANew:Boolean):TNTFSSecurityItem;</code>
+
| &nbsp;
+
|-
+
| <code>function DestroySecurityItem(ASecurityItem:TNTFSSecurityItem):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function NewSecurityItem(ASecurityId:LongWord; const ASecurityOffset:Int64; ASecurity:TNTFSSecurity):TNTFSSecurityItem;</code>
+
| &nbsp;
+
|-
+
| <code>function GetSecurityItem(ASecurityId:LongWord):TNTFSSecurityItem;</code>
+
| &nbsp;
+
|-
+
| <code>function GetSecurityItemEx(ASecurityId:LongWord; AWrite:Boolean):TNTFSSecurityItem;</code>
+
| &nbsp;
+
|-
+
| <code>function UpdateSecurityItem(ASecurityItem:TNTFSSecurityItem; ASecurityId:LongWord; ASecurity:TNTFSSecurity):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function DeleteSecurityItem(ASecurityItem:TNTFSSecurityItem):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function RemoveSecurityItem(ASecurityItem:TNTFSSecurityItem; AFree:Boolean):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function TotalSize:Int64;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function SecurityItemCount:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function Init(AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadSecurityItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteSecurityItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS security item'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSSecurityItem = class(TListObject)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|Note: Data of stream $SDS in file $Secure
+
| [[TNTFSSecurityItem|<code>TNTFSSecurityItem = class(TListObject)</code>]]
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FLocalLock:TMutexHandle;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FSecurityHash:LongWord;</code>
+
| Hash of Security Descriptor
+
|-
+
| <code>FSecurityId:LongWord;</code>
+
| Security Id
+
|-
+
| <code>FSecurityOffset:Int64;</code>
+
| Offset of this entry in $SDS
+
|-
+
| <code>FSecuritySize:LongWord;</code>
+
| Size of this entry in $SDS
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FSecurity:TNTFSSecurity;</code>
+
| Self-relative Security Descriptor
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function AcquireLock:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function ReleaseLock:Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function Compare(ASecurityItem:TNTFSSecurityItem):Integer; virtual;</code>
+
| &nbsp;
+
|-
+
| <code>function CompareOld(ASecurityItem:TNTFSSecurityItem):Integer; virtual; </code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property SecurityHash:LongWord read FSecurityHash write FSecurityHash;</code>
+
| &nbsp;
+
|-
+
| <code>property SecurityId:LongWord read FSecurityId write FSecurityId;</code>
+
| &nbsp;
+
|-
+
| <code>property SecurityOffset:Int64 read FSecurityOffset write FSecurityOffset;</code>
+
| &nbsp;
+
|-
+
| <code>property SecuritySize:LongWord read FSecuritySize write FSecuritySize;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Security:TNTFSSecurity read FSecurity;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CreateSecurity:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function NewSecurity(ASecurity:TNTFSSecurity):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function UpdateSecurity(ASecurity:TNTFSSecurity):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function DeleteSecurity:Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function RemoveSecurity(AFree:Boolean):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function MirrorOffset:Int64;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function Init(ASecurityId:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadSecurityItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteSecurityItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS security'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSSecurity = class(TDiskSecurity)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|Note: Data of attribute $SECURITY_DESCRIPTOR and stream $SDS in file $Secure
+
| [[TNTFSSecurity|<code>TNTFSSecurity = class(TDiskSecurity)</code>]]
|-
+
|colspan="2"|Note: This is the same structure that is used for all security in Windows (File/Kernel/Registry etc). See TSecurityDescriptor and associated values in Security unit for more information.
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
+
| style="width: 50%;"|&nbsp;
+
|-
+
| <code>constructor CreateFromSecurity(ALocalLock:TMutexHandle; ASecurity:TDiskSecurity); override;</code>
+
| &nbsp;
+
|-
+
| <code>constructor CreateFromDescriptor(ALocalLock:TMutexHandle; ADescriptor:Pointer); override;</code>
+
| &nbsp;
+
|-
+
| <code>destructor Destroy; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
| <code>FVolumeVersion:Word;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>FRevision:Byte;</code>
+
| Revision
+
|-
+
| <code>FControl:Word;</code>
+
| Control Flags
+
|-
+
| <code>FSacl:PACL;</code>
+
| SACL
+
|-
+
| <code>FDacl:PACL;</code>
+
| DACL
+
|-
+
| <code>FOwner:PSID;</code>
+
| Owner SID
+
|-
+
| <code>FGroup:PSID;</code>
+
| Group SID
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>procedure SetSacl(ASacl:PACL);</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetDacl(ADacl:PACL);</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetOwner(AOwner:PSID);</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetGroup(AGroup:PSID);</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetSaclSize(ASize:Word);</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetDaclSize(ASize:Word);</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetOwnerSize(ASize:Word);</code>
+
| &nbsp;
+
|-
+
| <code>procedure SetGroupSize(ASize:Word);</code>
+
| &nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
| <code>property VolumeVersion:Word read FVolumeVersion;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>property Revision:Byte read FRevision write FRevision;</code>
+
| &nbsp;
+
|-
+
| <code>property Control:Word read FControl write FControl;</code>
+
| &nbsp;
+
|-
+
| <code>property Sacl:PACL read FSacl write SetSacl;</code>
+
| &nbsp;
+
|-
+
| <code>property Dacl:PACL read FDacl write SetDacl;</code>
+
| &nbsp;
+
|-
+
| <code>property Owner:PSID read FOwner write SetOwner;</code>
+
| &nbsp;
+
|-
+
| <code>property Group:PSID read FGroup write SetGroup;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function SaclSize:Word;</code>
+
| &nbsp;
+
|-
+
| <code>function DaclSize:Word;</code>
+
| &nbsp;
+
|-
+
| <code>function OwnerSize:Word;</code>
+
| &nbsp;
+
|-
+
| <code>function GroupSize:Word;</code>
+
| &nbsp;
+
|-
+
| <code>function SaclOffset:LongWord;</code>
+
| Offset to SACL
+
|-
+
| <code>function DaclOffset:LongWord;</code>
+
| Offset to DACL
+
|-
+
| <code>function OwnerOffset:LongWord;</code>
+
| Offset to Owner SID
+
|-
+
| <code>function GroupOffset:LongWord;</code>
+
| Offset to Group SID
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function SaclOffsetEx(ALocal:Boolean):LongWord;</code>
+
| Offset to SACL
+
|-
+
| <code>function DaclOffsetEx(ALocal:Boolean):LongWord;</code>
+
| Offset to DACL
+
|-
+
| <code>function OwnerOffsetEx(ALocal:Boolean):LongWord;</code>
+
| Offset to Owner SID
+
|-
+
| <code>function GroupOffsetEx(ALocal:Boolean):LongWord;</code>
+
| Offset to Group SID
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function SecuritySize:LongWord; override;</code>
+
| &nbsp;
+
|-
+
| <code>function SecurityHash:LongWord;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function SecurityDescriptor:Pointer; override;</code>
+
| &nbsp;
+
|-
+
| <code>function SecurityDescriptorEx(ALocal:Boolean):Pointer; override;</code>
+
| &nbsp;
+
|-
+
| <code>function InheritedDescriptor:Pointer; override;</code>
+
| &nbsp;
+
|-
+
| <code>function MergedDescriptor(AChild:Pointer):Pointer; override;</code>
+
| &nbsp;
+
|-
+
| <code>function ReleaseDescriptor(ADescriptor:Pointer; AInherited,AMerged:Boolean):Boolean; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CopyToSecurity(ASecurity:TDiskSecurity):Boolean; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function CopyToDescriptor(ADescriptor:Pointer; ASize:LongWord):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function CopyToDescriptorEx(ADescriptor:Pointer; ASize:LongWord; ALocal:Boolean):Boolean; override;</code>
+
| &nbsp;
+
|-
+
| <code>function CopyFromDescriptor(ADescriptor:Pointer; ASize:LongWord):Boolean; override;</code>
+
| &nbsp;
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
| <code>function ReadSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
|-
+
| <code>function WriteSecurityEx(ABuffer:Pointer; var AOffset,ASize:LongWord; ALocal:Boolean; AVersion:Word):Boolean;</code>
+
| &nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS security Id'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSSecurityId = class(TObject)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
 
|-
 
|-
|colspan="2"|Note: Data of index $SII in file $Secure (Not Used)
+
| [[TNTFSSecurityId|<code>TNTFSSecurityId = class(TObject)</code>]]
|-
+
|colspan="2"|&nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
|-
+
|colspan="2"|&nbsp;
+
 
|-
 
|-
 
|}
 
|}
</div></div>
+
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 
+
'''NTFS security hash'''
+
 
+
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
+
 
+
<code>TNTFSSecurityHash = class(TObject)</code>
+
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
+
{| class="wikitable" style="font-size: 14px; background: white;"
+
|-
+
|colspan="2"|Note: Data of index $SDH in file $Secure (Not Used)
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
+
|-
+
|colspan="2"|&nbsp;
+
|-
+
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
+
 
|-
 
|-
|colspan="2"|&nbsp;
+
| [[TNTFSSecurityHash|<code>TNTFSSecurityHash = class(TObject)</code>]]
 
|-
 
|-
 
|}
 
|}
</div></div> 
 
 
<br />
 
<br />
  

Revision as of 05:36, 24 May 2018

Return to Unit Reference


Description


Ultibo NTFS classes unit

To be documented

Constants


None defined

Type definitions



NTFS compare security descriptor

TNTFSCompareSecurityDescriptor = function(ASecurityId:LongWord; ADescriptor:Pointer; ASize:Word):Boolean of Object;


Class definitions



NTFS specific classes

TNTFSDiskTable = class(TDiskTable)
TNTFSDiskBlock = class(TDiskBlock)
TNTFSDiskEntry = class(TDiskEntry)
TNTFSDiskAcl = class(TDiskAcl)
TNTFSDiskAce = class(TDiskAce)
TNTFSEntryList = class(TObject)
TNTFSRecordList = class(TObject)
TNTFSRecordIndex = class(TLinkedObjBtree)
TNTFSDiskRecord = class(TBtreeObject)
TNTFSDiskIndex = class(TLinkedObjBtree)
TNTFSDataIndex = class(TNTFSDiskIndex)
TNTFSPaddedIndex = class(TNTFSDataIndex)
TNTFSAttributeIndex = class(TNTFSDiskIndex)
TNTFSDiskNodes = class(TFileSysListEx)
TNTFSDiskNode = class(TListObject)
TNTFSDiskKey = class(TBtreeObject)
TNTFSDataKey = class(TNTFSDiskKey)
TNTFSPaddedKey = class(TNTFSDataKey)
TNTFSAttributeKey = class(TNTFSDiskKey)
TNTFSDiskRuns = class(TFileSysListEx)
TNTFSDiskRun = class(TListObject)
TNTFSDiskItems = class(TFileSysListEx)
TNTFSDiskItem = class(TListObject)
TNTFSDiskAttributes = class(TFileSysListEx)
TNTFSDiskAttribute = class(TListObject)
TNTFSStandardInformationAttribute = class(TNTFSDiskAttribute)
TNTFSAttributeListAttribute = class(TNTFSDiskAttribute)
TNTFSFileNameAttribute = class(TNTFSDiskAttribute)
TNTFSObjectIdAttribute = class(TNTFSDiskAttribute)
TNTFSVolumeVersionAttribute = class(TNTFSDiskAttribute)
TNTFSSecurityDescriptorAttribute = class(TNTFSDiskAttribute)
TNTFSVolumeNameAttribute = class(TNTFSDiskAttribute)
TNTFSVolumeInformationAttribute = class(TNTFSDiskAttribute)
TNTFSDataAttribute = class(TNTFSDiskAttribute)
TNTFSIndexRootAttribute = class(TNTFSDiskAttribute)
TNTFSIndexAllocationAttribute = class(TNTFSDiskAttribute)
TNTFSBitmapAttribute = class(TNTFSDiskAttribute)
TNTFSReparsePointAttribute = class(TNTFSDiskAttribute)
TNTFSSymbolicLinkAttribute = class(TNTFSDiskAttribute)
TNTFSExtendedAttrInformationAttribute = class(TNTFSDiskAttribute)
TNTFSExtendedAttrAttribute = class(TNTFSDiskAttribute)
TNTFSPropertySetAttribute = class(TNTFSDiskAttribute)
TNTFSLoggedUtilityStreamAttribute = class(TNTFSDiskAttribute)
TNTFSEndAttribute = class(TNTFSDiskAttribute)
TNTFSUnknownAttribute = class(TNTFSDiskAttribute)
TNTFSObjId = class(TObject)
TNTFSQuota = class(TObject)
TNTFSOwner = class(TObject)
TNTFSUpCase = class(TObject)
TNTFSAttrDefs = class(TFileSysList)
TNTFSAttrDef = class(TListObject)
TNTFSReparse = class(TDiskReparse)
TNTFSReparseSymLink = class(TNTFSReparse)
TNTFSReparseMountPoint = class(TNTFSReparseSymLink)
TNTFSExtendeds = class(TFileSysListEx)
TNTFSExtended = class(TListObject)
TNTFSSecurityItems = class(TFileSysList)
TNTFSSecurityItem = class(TListObject)
TNTFSSecurity = class(TDiskSecurity)
TNTFSSecurityId = class(TObject)
TNTFSSecurityHash = class(TObject)


Public variables


None defined

Function declarations


None defined


Return to Unit Reference