Difference between revisions of "Unit NTFSConst"

From Ultibo.org
Jump to: navigation, search
 
(17 intermediate revisions by the same user not shown)
Line 5: Line 5:
 
----
 
----
  
−
''To be documented''
+
'''Ultibo NTFS Constants unit'''
  
 
=== Constants ===
 
=== Constants ===
 
----
 
----
  
−
''To be documented''
+
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS specific constants''' <code> ntfs* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsNTFS12 = 0;</code>
 +
| 4.0 (WinNT)
 +
|-
 +
| <code>ntfsNTFS30 = 1;</code>
 +
| 5.0 (Win2000)
 +
|-
 +
| <code>ntfsNTFS31 = 2;</code>
 +
| 5.1/5.2/6.0/6.1 (WinXP/Win2003/WinVista/Win2008/Win7)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsAnyName = '*';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsDotName = '.';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsDotDotName = '..';</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsAnyNameLength = 1;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsDotNameLength = 1;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsDotDotNameLength = 2;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsBlankNameLength = 0;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsOemName = 'NTFS';</code>
 +
| Padded with spaces to 8 bytes
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsEntryPadding = $20;</code>
 +
| Padded with spaces (32)
 +
|-
 +
|}
 +
</div></div>
 +
<br /> 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS security''' <code> ntfsSecurity* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsSecurityHashPadding = $00490049;</code>
 +
| Unicode string II
 +
|-
 +
| <code>ntfsSecurityHashPaddingSize = 4;</code>
 +
| SizeOf(LongWord)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsSecurityMirrorOffset = $00040000;</code>
 +
| 256K Offset between primary and mirror entries
 +
|-
 +
| <code>ntfsSecuritySectionOffset = $00040000;</code>
 +
| 256K Offset between sections (End of one section to Start of next)
 +
|-
 +
| <code>ntfsSecuritySectionShift = 18;</code>
 +
| Not Used
 +
|-
 +
| <code>ntfsSecurityOffsetMask = $0003FFFF;</code>
 +
| Used to determine the offset within a section from the offset
 +
|-
 +
| <code>ntfsSecuritySectionMask = $FFFC0000;</code>
 +
| Used to determine the start of a section from the offset
 +
|-
 +
| <code>ntfsSecurityMirrorTest = $00040000;</code>
 +
| Mirror blocks will always be 40000 or C0000
 +
|-
 +
|}
 +
</div></div>
 +
<br /> 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS max number''' <code> ntfsMax* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsMaxPath = 260;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsMaxFile = 255;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsMaxAlias = 999999;</code>
 +
| Max number of lfn aliases (ie ~999999)
 +
|-
 +
| <code>ntfsMaxNameAlias = 4;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsMaxHashAlias = 999;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsMaxHashShift = 16;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsMaxVolumeName = 255;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsMaxAttributeName = 255;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br /> 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS cluster size''' <code> ntfs*ClusterSize* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsMinClusterSize = 512;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>ntfs12MaxClusterSize = 4096;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfs30MaxClusterSize = 65536;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br /> 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS sector''' <code> ntfs*Sector </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsBootSector = 0;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsStartSector = 0;</code>
 +
| Int64
 +
|-
 +
| <code>ntfsUnknownSector = -1;</code>
 +
| Int64
 +
|-
 +
|}
 +
</div></div>
 +
<br /> 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS cluster''' <code> ntfs*Cluster </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsStartCluster = 0;</code>
 +
| Int64
 +
|-
 +
| <code>ntfsUnevenCluster = 1;</code>
 +
| Int64
 +
|-
 +
| <code>ntfsUnknownCluster = -1;</code>
 +
| Int64
 +
|-
 +
|}
 +
</div></div>
 +
<br /> 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS status''' <code> ntfsStatus* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsStatusNone = $00000000;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsStatusAdded = $00000001;</code>
 +
| Used by Node
 +
|-
 +
| <code>ntfsStatusDeleted = $00000002;</code>
 +
| Used by Node
 +
|-
 +
| <code>ntfsStatusChanged = $00000004;</code>
 +
| Used by Key, Node, Index
 +
|-
 +
| <code>ntfsStatusLoaded = $00000008;</code>
 +
| Used by Index, List
 +
|-
 +
| <code>ntfsStatusInvalid = $00000010;</code>
 +
| Used by Key, Item
 +
|-
 +
| <code>ntfsStatusResizing = $00000020;</code>
 +
| Used by Record
 +
|-
 +
| <code>ntfsStatusRemoving = $00000040;</code>
 +
| Used by Record
 +
|-
 +
| <code>ntfsStatusUpdating = $00000080;</code>
 +
| Used by Attribute
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsStatusMirrored = $00000100;</code>
 +
| Metafile Records (0 to 3)
 +
|-
 +
| <code>ntfsStatusMetafile = $00000200;</code>
 +
| Metafile Records (0 to 11)
 +
|-
 +
| <code>ntfsStatusReserved = $00000400;</code>
 +
| Reserved MFT Records (12 to 15)(0C to 0F)
 +
|-
 +
| <code>ntfsStatusExpansion = $00000800;</code>
 +
| Expansion MFT Records (16 to 23)(10 to 17)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsStatusOverflow = $00001000;</code>
 +
| Record has an attribute list attribute
 +
|-
 +
| <code>ntfsStatusExtension = $00002000;</code>
 +
| Record is an extension of the base record
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsStatusFixed = $00004000;</code>
 +
| Attribute is a fixed size (can write single item) Not used due to Fixups
 +
|-
 +
| <code>ntfsStatusSingle = $00008000;</code>
 +
| Attribute only allows a single instance (Standard Information, Attribute List, End etc)
 +
|-
 +
| <code>ntfsStatusUnlisted = $00010000;</code>
 +
| Attribute is not listed in an Attribute List (Attribute List, End)
 +
|-
 +
| <code>ntfsStatusUnmovable = $00020000;</code>
 +
| Attribute cannot be moved from the Base Record (Standard Information, Attribute List)
 +
|-
 +
| <code>ntfsStatusManaged = $00040000;</code>
 +
| Attribute is handled as a record or list, data member is not valid (Standard Information, Attribute List, FileName etc)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsStatusAny = $FFFFFFFF;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br /> 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS compare''' <code> ntfsCompare* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsCompareLess = -1;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>ntfsCompareEqual = 0;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsCompareGreater = 1;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br /> 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS instance''' <code> ntfsInstance* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsInstanceFirst = 0;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>ntfsInstanceLast = -1;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br /> 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS attribute definition''' <code> ntfsAttrDefNo* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsAttrDefNoMinimum = 0;</code>
 +
| Int64
 +
|-
 +
| <code>ntfsAttrDefNoMaximum = -1;</code>
 +
| Int64
 +
|-
 +
|}
 +
</div></div>
 +
<br /> 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS file reference''' <code> ntfsFileReference* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsFileReferenceNone = 0;</code>
 +
| Int64
 +
|-
 +
| <code>ntfsRecordNumberMask = $0000FFFFFFFFFFFF;</code>
 +
| Get a record number from a file reference
 +
|-
 +
| <code>ntfsUnknownRecordNumber = -1;</code>
 +
| Int64
 +
|-
 +
|}
 +
</div></div>
 +
<br /> 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS bitmap''' <code> ntfsBitmap* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsBitmapUnknown = LongWord(-1);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br /> 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS block count mask''' <code> ntfsBlockCountMask* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsBlockCountMask8 = $FFFFFFFFFFFFFFF8;</code>
 +
| 0000000000000007
 +
|-
 +
| <code>ntfsBlockCountMask64 = $FFFFFFFFFFFFFFC0;</code>
 +
| 000000000000003F
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS MFT zone''' <code> ntfsMftZone* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem - NtfsMftZoneReservation - DWORD
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsMftZone50percent = 500;</code>
 +
| Registry value 4
 +
|-
 +
| <code>ntfsMftZone37percent = 375;</code>
 +
| Registry value 3
 +
|-
 +
| <code>ntfsMftZone25percent = 250;</code>
 +
| Registry value 2
 +
|-
 +
| <code>ntfsMftZone12percent = 125;</code>
 +
| Registry value 1 (Default)
 +
|-
 +
| <code>ntfsMftZone0percent = 0;</code>
 +
| Registry value 0 (Not allowed)
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS MFT fixed zone''' <code> ntfsMftFixedZone* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Vista/2008
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsMftFixedZone1000MB = 1000;</code>
 +
| Registry value 0 (Not allowed)
 +
|-
 +
| <code>ntfsMftFixedZone800MB = 800;</code>
 +
| Registry value 4
 +
|-
 +
| <code>ntfsMftFixedZone600MB = 600;</code>
 +
| Registry value 3
 +
|-
 +
| <code>ntfsMftFixedZone400MB = 400;</code>
 +
| Registry value 2
 +
|-
 +
| <code>ntfsMftFixedZone200MB = 200;</code>
 +
| Registry value 1 (Default)
 +
|-
 +
| <code>ntfsMftFixedZone0MB = 0;</code>
 +
| Registry value 0 (Not allowed)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsMftFixedZone1000MBSize = 1048576000;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsMftFixedZone800MBSize = 838860800;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsMftFixedZone600MBSize = 629145600;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsMftFixedZone400MBSize = 419430400;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsMftFixedZone200MBSize = 209715200;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsMftFixedZone0MBSize = 0;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS run offset mask''' <code> ntfsRunOffsetMask* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsRunOffsetMask = $F0;</code>
 +
| shr 4
 +
|-
 +
| <code>ntfsRunLengthMask = $0F;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS run encode mask''' <code> ntfsRunEncodeMask* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|(and)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<code>ntfsRunEncodeMasks:array[0..8] of Int64 = (</code>
 +
|-
 +
| <code>$0000000000000000,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$00000000000000FF,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$000000000000FFFF,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$0000000000FFFFFF,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$00000000FFFFFFFF,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$000000FFFFFFFFFF,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$0000FFFFFFFFFFFF,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$00FFFFFFFFFFFFFF,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$FFFFFFFFFFFFFFFF);</code>
 +
| Not Used
 +
|-
 +
|}
 +
</div></div>
 +
<br /> 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS run encode test''' <code> ntfsRunEncodeTest* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|(and)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<code>(*ntfsRunEncodeTests:array[0..8] of Int64 = (</code>
 +
|-
 +
| <code>$FFFFFFFFFFFFFFFF,</code>
 +
| Not Used
 +
|-
 +
| <code>$FFFFFFFFFFFFFF00,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$FFFFFFFFFFFF0000,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$FFFFFFFFFF000000,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$FFFFFFFF00000000,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$FFFFFF0000000000,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$FFFF000000000000,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$FF00000000000000,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$0000000000000000);*)</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<code>ntfsRunEncodeTests:array[0..8] of Int64 = (</code>
 +
|-
 +
| <code>$0000000000000000,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$000000000000007F,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$0000000000007FFF,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$00000000007FFFFF,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$000000007FFFFFFF,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$0000007FFFFFFFFF,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$00007FFFFFFFFFFF,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$007FFFFFFFFFFFFF,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$7FFFFFFFFFFFFFFF);</code>
 +
| Not Used
 +
|-
 +
|}
 +
</div></div>
 +
<br /> 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS run negative test''' <code> ntfsRunNegativeTest* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|<code>ntfsRunNegativeTests:array[0..8] of Int64 = (</code>
 +
|-
 +
| <code>$FFFFFFFFFFFFFFFF,</code>
 +
| Not Used
 +
|-
 +
| <code>$FFFFFFFFFFFFFF80,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$FFFFFFFFFFFF8000,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$FFFFFFFFFF800000,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$FFFFFFFF80000000,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$FFFFFF8000000000,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$FFFF800000000000,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$FF80000000000000,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$8000000000000000);</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS run decode mask''' <code> ntfsRunDecode*Mask </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|(and) (or not)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<code>ntfsRunDecode1Masks:array[1..1] of Byte = (</code>
 +
|-
 +
| <code>$FF);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<code>ntfsRunDecode2Masks:array[2..2] of Word = (</code>
 +
|-
 +
| <code>$FFFF);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<code>ntfsRunDecode4Masks:array[3..4] of LongWord = (</code>
 +
|-
 +
| <code>$00FFFFFF,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$FFFFFFFF);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<code>ntfsRunDecode8Masks:array[5..8] of Int64 = (</code>
 +
|-
 +
| <code>$000000FFFFFFFFFF,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$0000FFFFFFFFFFFF,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$00FFFFFFFFFFFFFF,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$FFFFFFFFFFFFFFFF);</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br /> 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS run decode test''' <code> ntfsRunDecode*Test </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|(>=)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<code>ntfsRunDecode1Tests:array[1..1] of Byte = (</code>
 +
|-
 +
| <code>$80);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<code>ntfsRunDecode2Tests:array[2..2] of Word = (</code>
 +
|-
 +
| <code>$8000);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<code>ntfsRunDecode4Tests:array[3..4] of LongWord = (</code>
 +
|-
 +
| <code>$00800000,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$80000000);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<code>ntfsRunDecode8Tests:array[5..8] of Int64 = (</code>
 +
|-
 +
| <code>$0000008000000000,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$0000800000000000,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$0080000000000000,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$8000000000000000);</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br /> 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS compression tag''' <code> ntfsCompression* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|<code>ntfsCompressionTags:array[1..8] of Byte = (</code>
 +
|-
 +
| <code>$01,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$02,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$04,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$08,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$10,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$20,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$40,</code>
 +
| &nbsp;
 +
|-
 +
| <code>$80);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsCompressionTagMask = $0FFF;</code>
 +
| The default mask for encoding and decoding the offset and length of a tag
 +
|-
 +
| <code>ntfsCompressionTagShift = 12;</code>
 +
| The default shift for encoding and decoding the offset and length of a tag.
 +
Tag is encoded as Offset:Length by varying the mask and shift based on the position.
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsCompressionUnitSize = 4;</code>
 +
| The default shift count for compression unit to cluster conversion
 +
|-
 +
| <code>ntfsCompressionBlockSize = 4096;</code>
 +
| The fixed size of a compression block inside the variable compression unit
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsCompressionLengthMask = $0FFF;</code>
 +
| The mask for the maximum length of a compressed block
 +
|-
 +
| <code>ntfsCompressionMarkerMask = $B000;</code>
 +
| The mask for the marker of a compressed block
 +
|-
 +
| <code>ntfsCompressionMarkerTest = $8000;</code>
 +
| The test for the marker of a compressed block
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsCompressionTableInit = $FF;</code>
 +
| The initialization value for the compression table
 +
|-
 +
| <code>ntfsCompressionTableUnused = $FFFF;</code>
 +
| The unused or unseen value for the compression table
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS bitmap mask''' <code> ntfsBitmapMask* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsBitmapMaskBits = 64;</code>
 +
| Int64 Bitmap Masks
 +
|-
 +
| <code>ntfsBitmapMaskNone = $0000000000000000;</code>
 +
| Int64 (Used for fast counting of free blocks)
 +
|-
 +
| <code>ntfsBitmapMaskAll = $FFFFFFFFFFFFFFFF;</code>
 +
| Int64 (Used for fast counting of used blocks)
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS signature''' <code> ntfs*Signature </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsFileSignature = $454C4946;</code>
 +
| FILE
 +
|-
 +
| <code>ntfsIndexSignature = $58444E49;</code>
 +
| INDX
 +
|-
 +
| <code>ntfsRecordSignature = $44524352;</code>
 +
| RCRD
 +
|-
 +
| <code>ntfsRestartSignature = $52545352;</code>
 +
| RSTR
 +
|-
 +
| <code>ntfsCheckedSignature = $00000000;</code>
 +
| CHKD
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsNullGUID:TGUID = (D1:$00000000;D2:$0000;D3:$0000;D4:($00,$00,$00,$00,$00,$00,$00,$00));</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsNullFileTime:TFileTime = (dwLowDateTime:$00000000;dwHighDateTime:$00000000);</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS table type''' <code> ntfsTableType* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsTableTypeMft = $00000000;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>ntfsTableTypeMftMirr = $00000001;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS file type''' <code> ntfsFileType* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsFileTypeMft = $00000000;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileTypeMftMirr = $00000001;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileTypeLogFile = $00000002;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileTypeVolume = $00000003;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileTypeAttrDef = $00000004;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileTypeRoot = $00000005;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileTypeBitmap = $00000006;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileTypeBoot = $00000007;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileTypeBadClus = $00000008;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileTypeSecure = $00000009;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfs12FileTypeQuota = $00000009;</code>
 +
| Version 1.2 only
 +
|-
 +
| <code>ntfsFileTypeUpCase = $0000000A;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileTypeExtend = $0000000B;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsFileTypeObjId = $10000000;</code>
 +
| Any record number
 +
|-
 +
| <code>ntfsFileTypeQuota = $20000000;</code>
 +
| Any record number
 +
|-
 +
| <code>ntfsFileTypeReparse = $30000000;</code>
 +
| Any record number
 +
|-
 +
| <code>ntfsFileTypeUsnJrnl = $40000000;</code>
 +
| Any record number
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsFileTypeFile = $50000000;</code>
 +
| Any record number (Not Used)
 +
|-
 +
| <code>ntfsFileTypeDirectory = $60000000;</code>
 +
| Any record number (Not Used)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsFileTypeReserved1 = $0000000C;</code>
 +
| Reserved Records
 +
|-
 +
| <code>ntfsFileTypeReserved2 = $0000000D;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileTypeReserved3 = $0000000E;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileTypeReserved4 = $0000000F;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsFileTypeExpansion1 = $00000010;</code>
 +
| Expansion Records
 +
|-
 +
| <code>ntfsFileTypeExpansion2 = $00000011;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileTypeExpansion3 = $00000012;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileTypeExpansion4 = $00000013;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileTypeExpansion5 = $00000014;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileTypeExpansion6 = $00000015;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileTypeExpansion7 = $00000016;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileTypeExpansion8 = $00000017;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS record number''' <code> ntfs*RecordNumber </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsQuotaRecordNumber = $00000018;</code>
 +
| Only used during Format
 +
|-
 +
| <code>ntfsObjIdRecordNumber = $00000019;</code>
 +
| Only used during Format
 +
|-
 +
| <code>ntfsReparseRecordNumber = $0000001A;</code>
 +
| Only used during Format
 +
|-
 +
| <code>ntfsUsnJrnlRecordNumber = $0000001B;</code>
 +
| Not Used
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsDefaultRecordCount = $0000001B;</code>
 +
| Files up to $Reparse
 +
|-
 +
| <code>ntfsDefaultMirrorCount = $00000004;</code>
 +
| Files up to $Volume
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS file reference''' <code> ntfs*FileReference </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsRootFileReference = $0005000000000005;</code>
 +
| Only used during Format
 +
|-
 +
| <code>ntfsExtendFileReference = $000B00000000000B;</code>
 +
| Only used during Format
 +
|-
 +
| <code>ntfsVolumeFileReference = $0003000000000003;</code>
 +
| Only used during Format
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS file name''' <code> ntfsFileName* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsFileNameMft = '$MFT';</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>ntfsFileNameMftMirr = '$MFTMirr';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileNameLogFile = '$LogFile';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileNameVolume = '$Volume';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileNameAttrDef = '$AttrDef';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileNameRoot = '.';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileNameBitmap = '$Bitmap';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileNameBoot = '$Boot';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileNameBadClus = '$BadClus';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileNameSecure = '$Secure';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileNameUpCase = '$UpCase';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileNameExtend = '$Extend';</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsFileNameObjId = '$ObjId';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileNameQuota = '$Quota';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileNameReparse = '$Reparse';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileNameUsnJrnl = '$UsnJrnl';</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS attribute type''' <code> ntfsAttrType* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsAttrTypeNone = $00000000;</code>
 +
| Marker only
 +
|-
 +
| <code>ntfsAttrTypeStandardInformation = $00000010;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrTypeAttributeList = $00000020;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrTypeFileName = $00000030;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrTypeObjectId = $00000040;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrTypeVolumeVersion = $00000040;</code>
 +
| Version 1.2 only
 +
|-
 +
| <code>ntfsAttrTypeSecurityDescriptor = $00000050;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrTypeVolumeName = $00000060;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrTypeVolumeInformation = $00000070;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrTypeData = $00000080;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrTypeIndexRoot = $00000090;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrTypeIndexAllocation = $000000A0;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrTypeBitmap = $000000B0;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrTypeReparsePoint = $000000C0;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrTypeSymbolicLink = $000000C0;</code>
 +
| Version 1.2 only
 +
|-
 +
| <code>ntfsAttrTypeExtendedAttrInformation = $000000D0;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrTypeExtendedAttr = $000000E0;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrTypePropertySet = $000000F0;</code>
 +
| Version 3.0 only
 +
|-
 +
| <code>ntfsAttrTypeLoggedUtilityStream = $00000100;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrTypeEnd = $FFFFFFFF;</code>
 +
| Marker only
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsAttrTypeAny = $00000000;</code>
 +
| Used to return all attributes
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS attribute name''' <code> ntfsAttrName* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsAttrNameNone = '$NONE';</code>
 +
| Marker only
 +
|-
 +
| <code>ntfsAttrNameStandardInformation = '$STANDARD_INFORMATION';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrNameAttributeList = '$ATTRIBUTE_LIST';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrNameFileName = '$FILE_NAME';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrNameObjectId = '$OBJECT_ID';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrNameVolumeVersion = '$VOLUME_VERSION';</code>
 +
| Version 1.2 only
 +
|-
 +
| <code>ntfsAttrNameSecurityDescriptor = '$SECURITY_DESCRIPTOR';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrNameVolumeName = '$VOLUME_NAME';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrNameVolumeInformation = '$VOLUME_INFORMATION';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrNameData = '$DATA';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrNameIndexRoot = '$INDEX_ROOT';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrNameIndexAllocation = '$INDEX_ALLOCATION';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrNameBitmap = '$BITMAP';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrNameReparsePoint = '$REPARSE_POINT';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrNameSymbolicLink = '$SYMBOLIC_LINK';</code>
 +
| Version 1.2 only
 +
|-
 +
| <code>ntfsAttrNameExtendedAttrInformation = '$EA_INFORMATION';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrNameExtendedAttr = '$EA';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrNamePropertySet = '$PROPERTY_SET';</code>
 +
| Version 3.0 only
 +
|-
 +
| <code>ntfsAttrNameLoggedUtilityStream = '$LOGGED_UTILITY_STREAM';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrNameEnd = '$END';</code>
 +
| Marker only
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS owner Id''' <code> ntfsOwnerId* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsOwnerIdNull = $00000001;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>ntfsOwnerIdFirst = $00000100;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsOwnerIdUnknown = $FFFFFFFF;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS default owner Id''' <code> ntfsDefaultOwnerId* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsDefaultOwnerId1 = $00000001;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>ntfsDefaultOwnerId100 = $00000100;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS default sid''' <code> ntfsDefaultSid* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsMaxDefaultSid = 1;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsDefaultSidNone = 0;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsDefaultSid100 = 1;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<code>ntfsDefaultSids:array[1..ntfsMaxDefaultSid] of TNTFSDefaultSid = (</code>
 +
|-
 +
| <code>(Sid:WinBuiltinAdministratorsSid));</code>
 +
| 100
 +
|-
 +
|}
 +
</div></div>
 +
<br /> 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS security Id''' <code> ntfsSecurityId* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsSecurityIdNull = $00000001;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>ntfsSecurityIdFirst = $00000100;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsSecurityIdUnknown = $FFFFFFFF;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS default security Id''' <code> ntfsDefaultSecurityId* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsDefaultSecurityId100 = $00000100;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>ntfsDefaultSecurityId101 = $00000101;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsDefaultSecurityId102 = $00000102;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsDefaultSecurityId103 = $00000103;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS default descriptor''' <code> ntfsDefaultDescriptor* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsMaxDefaultDescriptor = 7;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsDefaultDescriptorNone = 0;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsDefaultDescriptorVolume = 1;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsDefaultDescriptorAttrDef = 2;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsDefaultDescriptorRoot = 3;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsDefaultDescriptor102 = 4;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsDefaultDescriptor103 = 5;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsDefaultDescriptorFile = 6;</code>
 +
| Used by NTFSDefaultSecurity option
 +
|-
 +
| <code>ntfsDefaultDescriptorFolder = 7;</code>
 +
| Used by NTFSDefaultSecurity option
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsDefaultDescriptorBoot = 2;</code>
 +
| Same as ntfsDefaultDescriptorAttrDef
 +
|-
 +
| <code>ntfsDefaultDescriptor100 = 2;</code>
 +
| Same as ntfsDefaultDescriptorAttrDef
 +
|-
 +
| <code>ntfsDefaultDescriptor101 = 1;</code>
 +
| Same as ntfsDefaultDescriptorVolume
 +
|-
 +
| <code>ntfsDefaultDescriptorReserved = 1;</code>
 +
| Same as ntfsDefaultDescriptorVolume
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS security offset''' <code> ntfsSecurityOffset* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsSecurityOffsetFirst = 0;</code>
 +
| Int64
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsSecurityOffsetUnknown = -1;</code>
 +
| Int64
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS index name''' <code> ntfsIndexName* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsIndexNameFileName = '$I30';</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>ntfsIndexNameSecurityId = '$SII';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsIndexNameSecurityHash = '$SDH';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsIndexNameObjectId = '$O';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsIndexNameOwnerId = '$O';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsIndexNameQuota = '$Q';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsIndexNameReparse = '$R';</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS index order''' <code> ntfsIndexOrder* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsIndexOrderFileName = 38;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>ntfsIndexOrderSecurityId = 100;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsIndexOrderSecurityHash = 100;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsIndexOrderObjectId = 100;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsIndexOrderOwnerId  = 100;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsIndexOrderQuota = 100;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsIndexOrderReparse = 100;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS stream name''' <code> ntfsStreamName* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsStreamNameSecurity = '$SDS';</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>ntfsStreamNameBadClus = '$Bad';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsStreamNameMountMgr = '$MountMgrDatabase';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsStreamNameJournal = '$J';</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsStreamNameJrnlMax = '$Max';</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS file namespace''' <code> ntfsNameSpace* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsNameSpacePosix = $00;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>ntfsNameSpaceWin32 = $01;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsNameSpaceDos = $02;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsNameSpaceBoth = ntfsNamespaceWin32 or ntfsNamespaceDos;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS display type''' <code> ntfsDisplayType* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsDisplayTypeNone = $00000000;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS collate type''' <code> ntfsCollateType* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsCollateTypeBinary = $00000000;</code>
 +
| Binary, where the first byte is most significant
 +
|-
 +
| <code>ntfsCollateTypeFileName = $00000001;</code>
 +
| Filename Unicode strings (This is a case insensitive compare)
 +
|-
 +
| <code>ntfsCollateTypeUnicode = $00000002;</code>
 +
|  Unicode strings, except that upper case letters should come first (This is a case sensitive compare)
 +
|-
 +
| <code>ntfsCollateTypeLongWord = $00000010;</code>
 +
| An unsigned long (32 bits, little endian)
 +
|-
 +
| <code>ntfsCollateTypeSID = $00000011;</code>
 +
| A Security Identifier
 +
|-
 +
| <code>ntfsCollateTypeSecurityHash = $00000012;</code>
 +
| First compare by the Security Hash, then by Security Descriptor (Sorting is by Security Hash then Security Id)
 +
|-
 +
| <code>ntfsCollateTypeGUID = $00000013;</code>
 +
| Object GUIDs
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS volume flag''' <code> ntfsVolumeFlag* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsVolumeFlagNone = $0000;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>ntfsVolumeFlagDirty = $0001;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsVolumeFlagResizeLogFile = $0002;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsVolumeFlagUpgradeMount = $0004;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsVolumeFlagMountedNT4 = $0008;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsVolumeFlagDeleteUSN = $0010;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsVolumeFlagRepairObjectIds = $0020;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsVolumeFlagModifiedChkdsk = $8000;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS file record flag''' <code> ntfsFileRecordFlag* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsFileRecordFlagNone = $0000;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileRecordFlagInUse = $0001;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileRecordFlagDirectory = $0002;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsFileRecordFlagUnknown1 = $0004;</code>
 +
| Used by $Quota,$ObjId,$Reparse
 +
|-
 +
| <code>ntfsFileRecordFlagIndexView = $0008;</code>
 +
| Used by $Secure,$Quota,$ObjId,$Reparse
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS attribute flag''' <code> ntfsAttrDefFlag* ntfsAttributeFlag* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsAttrDefFlagNone = $00000000;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrDefFlagIndexed = $00000002;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttrDefFlagResident = $00000040;</code>
 +
| Always resident
 +
|-
 +
| <code>ntfsAttrDefFlagUncompressed = $00000080;</code>
 +
| Cannot Compress (Note: Resident Attributes cannot be compressed anyway)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsAttrDefFlagResidentIndex = $00000042;</code>
 +
| Used by FileName (Resident and Indexed)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsAttributeFlagNone = $0000;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttributeFlagCompressed = $0001;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttributeFlagEncrypted = $4000;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttributeFlagSparse = $8000;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS attribute''' <code> ntfsAttribute* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsAttributeIndexed = $01;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>ntfsAttributeNonIndexed = $00;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttributeResident = $00;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsAttributeNonResident = $01;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS index header flag''' <code> ntfsIndexHeaderFlag* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsIndexHeaderFlagNone = $0000;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsIndexHeaderFlagSubNodes = $0001;</code>
 +
| Index has Sub Nodes
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS index entry flag''' <code> ntfsIndexEntryFlag* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsIndexEntryFlagNone = $0000;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsIndexEntryFlagSubNode = $0001;</code>
 +
| Entry has Sub Node
 +
|-
 +
| <code>ntfsIndexEntryFlagLastNode = $0002;</code>
 +
| Entry is Last Node (Always the Blank Node)
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS quota flag''' <code> ntfsQuotaFlag* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsQuotaFlagNone = $0000;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>ntfsQuotaFlagDefaultLimits = $0001;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsQuotaFlagLimitReached = $0002;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsQuotaFlagIdDeleted = $0004;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsQuotaFlagTrackingEnabled = $0010;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsQuotaFlagEnforcementEnabled = $0020;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsQuotaFlagTrackingRequested = $0040;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsQuotaFlagLogThreshold = $0080;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsQuotaFlagLogLimit = $0100;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsQuotaFlagOutOfDate = $0200;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsQuotaFlagCorrupt = $0400;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsQuotaFlagPendingDeletes = $0800;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS reparse tag''' <code> ntfsReparseTag* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsReparseTagNone = $00000000;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsReparseTagMountPoint = $A0000003;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsReparseTagHSM = $C0000004;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsReparseTagNSS = $80000005;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsReparseTagNSSRecover = $80000006;</code>
 +
| ntfsReparseTagHSM2
 +
|-
 +
| <code>ntfsReparseTagSIS = $80000007;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsReparseTagDFS = $80000008;</code>
 +
| Shown in some documentation
 +
|-
 +
| <code>ntfsReparseTagDFS = $8000000A;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsReparseTagFilterManager = $8000000B;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsReparseTagSymbolicLink = $A000000C;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsReparseTagDFSR = $80000012;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS reparse tag flag''' <code> ntfsReparseTagFlag* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsReparseTagFlagNone = $00000000;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsReparseTagFlagIsAlias = $20000000;</code>
 +
| ntfsReparseTagFlagIsNameSurrogate
 +
|-
 +
| <code>ntfsReparseTagFlagIsHighLatency = $40000000;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsReparseTagFlagIsMicrosoft = $80000000;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS reparse tag type''' <code> ntfsReparseTagType* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsReparseTagTypeNone = $00000000;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsReparseTagTypeMountPoint = $00000003;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsReparseTagTypeHSM = $00000004;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsReparseTagTypeNSS = $00000005;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsReparseTagTypeNSSRecover = $00000006;</code>
 +
| ntfsReparseTagHSM2
 +
|-
 +
| <code>ntfsReparseTagTypeSIS = $00000007;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsReparseTagTypeDFS = $00000008;</code>
 +
| Shown in some documentation
 +
|-
 +
| <code>ntfsReparseTagTypeDFS = $0000000A;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsReparseTagTypeFilterManager = $0000000B;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsReparseTagTypeSymbolicLink = $0000000C;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsReparseTagTypeDFSR = $00000012;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsReparsePointPrefix = '\??\';</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS extended attribute flag''' <code> ntfsExtendedAttributeFlag* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsExtendedAttributeFlagNone = $00;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>ntfsExtendedAttributeFlagNeedEA = $80;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS default size''' <code> ntfsDefault*Size </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsDefaultBootRecordSize = 8192;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsDefaultFileRecordSize = 1024;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsDefaultIndexRecordSize = 4096;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsDefaultSecureSdsSize = 262396;</code>
 +
| 262616 if including Id 102 and 103
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS log file''' <code> ntfsLogFile* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsRestartPageSize = $1000;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsLogFileClientFirst = $0000;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsLogFileClientUnknown = $FFFF;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsLogFileRestartFlagClean = $0002;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS old log file size''' <code> ntfs*OldLogSize </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsMaxOldLogSize = 10;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<code>ntfsOldLogSizes:array[0..ntfsMaxOldLogSize] of TNTFSLogSize = (</code>
 +
|-
 +
|colspan="2"|''DiskSize,LogSize''
 +
|-
 +
| <code>(DiskSize:8388608;LogSize:262144),</code>
 +
| greater than 8MB, 256KB log
 +
|-
 +
| <code>(DiskSize:16777216;LogSize:262144),</code>
 +
| greater than 16MB, 256KB log
 +
|-
 +
| <code>(DiskSize:33554432;LogSize:524288),</code>
 +
| greater than 32MB, 512KB log (Previously 262144)
 +
|-
 +
| <code>(DiskSize:67108864;LogSize:1048576),</code>
 +
| greater than 64MB, 1MB log (Previously 524288)
 +
|-
 +
| <code>(DiskSize:134217728;LogSize:2097152),</code>
 +
| greater than 128MB, 2MB log (Previously 1048576)
 +
|-
 +
| <code>(DiskSize:268435456;LogSize:2097152),</code>
 +
| greater than 256MB, 2MB log
 +
|-
 +
| <code>(DiskSize:536870912;LogSize:4194304),</code>
 +
| greater than 512MB, 4MB log
 +
|-
 +
| <code>(DiskSize:1073741824;LogSize:8388608),</code>
 +
| greater than 1GB, 8MB log
 +
|-
 +
| <code>(DiskSize:2147483648;LogSize:16777216),</code>
 +
| greater than 2GB, 16MB log
 +
|-
 +
| <code>(DiskSize:4294967296;LogSize:33554432),</code>
 +
| greater than 4GB, 32MB log
 +
|-
 +
| <code>(DiskSize:8589934592;LogSize:67108864));</code>
 +
| greater than 8GB, 64MB log
 +
|-
 +
|}
 +
</div></div>
 +
<br /> 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS log file size''' <code> ntfs*LogSize </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsMaxLogSize = 8;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<code>ntfsLogSizes:array[0..ntfsMaxLogSize] of TNTFSLogSize = (</code>
 +
|-
 +
|colspan="2"|''DiskSize,LogSize''
 +
|-
 +
| <code>(DiskSize:0;LogSize:2097152),</code>
 +
| less than 128MB, 2MB log
 +
|-
 +
| <code>(DiskSize:134217728;LogSize:4194304),</code>
 +
| greater than 128MB, 4MB log
 +
|-
 +
| <code>(DiskSize:268435456;LogSize:5242880),</code>
 +
| greater than 256MB, 5MB log
 +
|-
 +
| <code>(DiskSize:536870912;LogSize:6291456),</code>
 +
| greater than 512MB, 6MB log
 +
|-
 +
| <code>(DiskSize:805306368;LogSize:7340032),</code>
 +
| greater than 768MB, 7MB log
 +
|-
 +
| <code>(DiskSize:1073741824;LogSize:8388608),</code>
 +
| greater than 1GB, 8MB log
 +
|-
 +
| <code>(DiskSize:2147483648;LogSize:16777216),</code>
 +
| greater than 2GB, 16MB log
 +
|-
 +
| <code>(DiskSize:4294967296;LogSize:33554432),</code>
 +
| greater than 4GB, 32MB log
 +
|-
 +
| <code>(DiskSize:8589934592;LogSize:67108864));</code>
 +
| greater than 8GB, 64MB log
 +
|-
 +
|}
 +
</div></div>
 +
<br /> 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS MFT/MFTMirr start''' <code> ntfsMftStart* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsMftStartCluster = 786432;</code>
 +
| &nbsp;
 +
|-
 +
| <code>ntfsMftCutoverCount = 4194304;</code>
 +
| 4194304 * 4096 = 16GB (The point at which the MFT becomes fixed in location)
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS file size''' <code> ntfsFileSize* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsFileSizeMft = ntfsUnknownCluster;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsFileSizeMftMirr = ntfsUnknownCluster;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsFileSizeLogFile = ntfsUnknownCluster;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsFileSizeVolume = 0;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsFileSize12AttrDef = 36864;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsFileSize30AttrDef = 2560;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsFileSize31AttrDef = 2560;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsFileSizeRoot = ntfsUnknownCluster;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsFileSizeBitmap = ntfsUnknownCluster;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsFileSizeBoot = 8192;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsFileSizeBadClus = 0;</code>
 +
| Starting size
 +
|-
 +
| <code>ntfsFileSizeSecure = 0;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsFileSizeUpCase = 131072;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsFileSizeExtend = 0;</code>
 +
| Constant size
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsFileSizeObjId = 0;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsFileSizeQuota = 0;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsFileSizeReparse = 0;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsFileSizeUsnJrnl = ntfsUnknownCluster;</code>
 +
| Variable size
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS stream size''' <code> ntfsStreamSize* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsStreamSizeSecurity = ntfsUnknownCluster;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsStreamSizeBadClus = ntfsUnknownCluster;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsStreamSizeMountMgr = ntfsUnknownCluster;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsStreamSizeJournal = ntfsUnknownCluster;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsStreamSizeJrnlMax = ntfsUnknownCluster;</code>
 +
| Variable size
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS header size''' <code> ntfs*HeaderSize* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsFileRecord12Size = 42;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsFileRecord31Size = 48;</code>
 +
| Constant size
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsIndexRecordSize = 24;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsIndexHeaderSize = 16;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsIndexEntrySize = 16;</code>
 +
| Minimum size
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsAttributeTypeSize = 4;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsAttributeHeaderSize = 16;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsResidentHeaderSize = 24;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsNonResidentHeaderSize = 64;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsCompressedHeaderSize = 72;</code>
 +
| Minimum size
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS attribute size''' <code> ntfsAttribute*Size </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Minimum sizes
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsStandardInformation12Size = 48;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsStandardInformation30Size = 72;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsAttributeListSize = 0;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsFileNameSize = 66;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsObjectIdSize = 16;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsObjectIdSize2 = 32;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsObjectIdSize3 = 48;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsObjectIdSize4 = 64;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsVolumeVersionSize = 8;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsSecurityDescriptorSize = 0;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsVolumeNameSize = 0;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsVolumeInformationSize = 12;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsDataSize = 0;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsIndexRootSize = 16;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsIndexAllocationSize = 0;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsBitmapSize = 0;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsReparsePointSize = 8;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsReparsePointMicrosoftSize = 8;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsReparsePointOtherSize = 24;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsSymbolicLinkSize = 0;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsExtendedAttrInformationSize = 8;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsExtendedAttrSize = 0;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsPropertySetSize = 0;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsLoggedUtilityStreamSize = 0;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsUnknownSize = 0;</code>
 +
| Variable size
 +
|-
 +
| <code>ntfsEndSize = 4;</code>
 +
| Constant size
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS data size''' <code> ntfs*Size </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Minimum sizes
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsRunSize = 1;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsItemSize = 26;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsObjIdSize = 56;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsQuotaSize = 48;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsOwnerSize = 4;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsUpCaseSize = 131072;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsAttrDefSize = 160;</code>
 +
| Constant size
 +
|-
 +
| <code>ntfsReparseSize = 12;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsExtendedSize = 8;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsSecuritySize = 20;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsSidSize = 8;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsAclSize = 8;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsAceSize = 8;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsSecurityItemSize = 40;</code>
 +
| Minimum size (Includes ntfsSecuritySize)
 +
|-
 +
| <code>ntfsSecurityIdSize = 20;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsSecurityHashSize = 20;</code>
 +
| Minimum size (Previously 24 - Modified to remove Padding)
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS key size''' <code> ntfs*KeySize </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Minimum sizes
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfsObjIdKeySize = 16;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsQuotaKeySize = 4;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsOwnerKeySize = 8;</code>
 +
| Minimum size (Includes ntfsSidSize)
 +
|-
 +
| <code>ntfsSecurityIdKeySize = 4;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsSecurityHashKeySize = 8;</code>
 +
| Minimum size
 +
|-
 +
| <code>ntfsReparseKeySize = 12;</code>
 +
| Constant size (Not 16 even though CollateType is GUID)
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS update sequence size''' <code> ntfsUpdateSequenceSize* </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>ntfsUpdateSequenceSize = 512;</code>
 +
| Constant size (Always 512 regardless of the sector size)
 +
|-
 +
|}
 +
</div></div>
 +
<br />
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial; padding-top: 20px; padding-bottom: 15px;">
 +
<div style="font-size: 14px; padding-left: 12px;">'''NTFS sector count''' <code> ntfs*SectorCount </code></div>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Used for NTFS formatting (Fixed Disk only)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfs12MaxSectorCount = 4;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<code>ntfs12SectorCounts:array[0..ntfs12MaxSectorCount] of TNTFSSectorCount = (</code>
 +
|-
 +
|colspan="2"|''SectorCount,SectorsPerCluster''
 +
|-
 +
| <code>(SectorCount:16384;SectorsPerCluster:0),</code>
 +
| up to 8 MB, the 0 value for SectorsPerCluster trips an error
 +
|-
 +
| <code>(SectorCount:1048576;SectorsPerCluster:1),</code>
 +
| up to 512 MB, sector size cluster
 +
|-
 +
| <code>(SectorCount:2097152;SectorsPerCluster:2),</code>
 +
| up to 1 GB, 1k cluster
 +
|-
 +
| <code>(SectorCount:4194304;SectorsPerCluster:4),</code>
 +
| up to 2 GB, 2k cluster
 +
|-
 +
| <code>(SectorCount:$FFFFFFFF;SectorsPerCluster:8));</code>
 +
| greater than 2 GB, 4k cluster
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>ntfs30MaxSectorCount = 4;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<code>ntfs30SectorCounts:array[0..ntfs30MaxSectorCount] of TNTFSSectorCount = (</code>
 +
|-''
 +
|colspan="2"|''SectorCount,SectorsPerCluster''
 +
|-
 +
| <code>(SectorCount:16384;SectorsPerCluster:0),</code>
 +
| up to 8 MB, the 0 value for SectorsPerCluster trips an error
 +
|-
 +
| <code>(SectorCount:1048576;SectorsPerCluster:1),</code>
 +
| up to 512 MB, sector size cluster
 +
|-
 +
| <code>(SectorCount:2097152;SectorsPerCluster:2),</code>
 +
| up to 1 GB, 1k cluster
 +
|-
 +
| <code>(SectorCount:4194304;SectorsPerCluster:4),</code>
 +
| up to 2 GB, 2k cluster
 +
|-
 +
| <code>(SectorCount:$FFFFFFFF;SectorsPerCluster:8));</code>
 +
| greater than 2 GB, 4k cluster
 +
|-
 +
|}
 +
</div></div>
 +
<br />
  
 
=== Type definitions ===
 
=== Type definitions ===
 
----
 
----
  
−
''To be documented''
+
 
 +
'''NTFS attribute definition'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSAttrDefine = record</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Not Packed
 +
|-
 +
| <code>AttributeType:LongWord;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>AttributeName:String;</code>
 +
| &nbsp;
 +
|-
 +
| <code>AttrDefFlags:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>MinimumSize:Int64;</code>
 +
| &nbsp;
 +
|-
 +
| <code>MaximumSize:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div> 
 +
 +
'''NTFS uppercase conversion'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSUpcaseConvert = record</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Not Packed
 +
|-
 +
| <code>Count:Word;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>Value:Word;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div> 
 +
 +
'''NTFS sector count'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSSectorCount = record</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Not Packed (Fixed Disk only)
 +
|-
 +
| <code>SectorCount:LongWord;</code>
 +
| Based on 512 bytes per sector only
 +
|-
 +
| <code>SectorsPerCluster:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div> 
 +
 
 +
'''NTFS log size'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSLogSize = record</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Not Packed
 +
|-
 +
| <code>DiskSize:Int64;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>LogSize:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div> 
 +
 +
'''NTFS default SID'''
 +
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
<code>PNTFSDefaultSid = ^TNTFSDefaultSid;</code>
 +
 
 +
<code>TNTFSDefaultSid = record</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Not Packed
 +
|-
 +
| <code>Sid:TWellKnownSidType;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
|}
 +
</div></div> 
 +
 
 +
'''NTFS default access control entry'''
 +
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDefaultAce = record</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Not Packed
 +
|-
 +
| <code>AceType:Byte;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>AceFlags:Byte;</code>
 +
| &nbsp;
 +
|-
 +
| <code>AceSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>Mask:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>Sid:TWellKnownSidType;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div> 
 +
 +
'''NTFS default access control list'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDefaultAcl = record</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Not Packed
 +
|-
 +
| <code>AclRevision:Byte;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>AclSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>AceCount:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>Aces:array[0..7] of TNTFSDefaultAce;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div> 
 +
 
 +
'''NTFS default descriptor'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
<code>PNTFSDefaultDescriptor = ^TNTFSDefaultDescriptor;</code>
 +
 
 +
<code>TNTFSDefaultDescriptor = record</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Not Packed
 +
|-
 +
| <code>Size:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>Revision:Byte;</code>
 +
| Revision
 +
|-
 +
| <code>Control:Word;</code>
 +
| Control Flags
 +
|-
 +
| <code>OwnerOffset:LongWord;</code>
 +
| Offset to Owner SID
 +
|-
 +
| <code>GroupOffset:LongWord;</code>
 +
| Offset to Group SID
 +
|-
 +
| <code>SaclOffset:LongWord;</code>
 +
| Offset to SACL
 +
|-
 +
| <code>DaclOffset:LongWord;</code>
 +
| Offset to DACL
 +
|-
 +
| <code>Owner:TWellKnownSidType;</code>
 +
| &nbsp;
 +
|-
 +
| <code>Group:TWellKnownSidType;</code>
 +
| &nbsp;
 +
|-
 +
| <code>Sacl:TNTFSDefaultAcl;</code>
 +
| &nbsp;
 +
|-
 +
| <code>Dacl:TNTFSDefaultAcl;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div> 
 +
<br />
  
 
=== Public variables ===
 
=== Public variables ===
 
----
 
----
  
−
''To be documented''
+
 
 +
'''NTFS specific variables'''
 +
 
 +
{| class="wikitable" style="font-size: 14px; text-align: left; width: 100%; height: 50px;"
 +
|-
 +
| <code>SecurityHashPadding:LongWord = ntfsSecurityHashPadding;</code>
 +
| style="width: 40%;"|
 +
|-
 +
|}
 +
<br />
  
 
=== Function declarations ===
 
=== Function declarations ===

Latest revision as of 05:38, 31 August 2021

Return to Unit Reference


Description

Ultibo NTFS Constants unit

Constants


NTFS specific constants ntfs*
ntfsNTFS12 = 0; 4.0 (WinNT)
ntfsNTFS30 = 1; 5.0 (Win2000)
ntfsNTFS31 = 2; 5.1/5.2/6.0/6.1 (WinXP/Win2003/WinVista/Win2008/Win7)
 
ntfsAnyName = '*';  
ntfsDotName = '.';  
ntfsDotDotName = '..';  
 
ntfsAnyNameLength = 1;  
ntfsDotNameLength = 1;  
ntfsDotDotNameLength = 2;  
ntfsBlankNameLength = 0;  
 
ntfsOemName = 'NTFS'; Padded with spaces to 8 bytes
 
ntfsEntryPadding = $20; Padded with spaces (32)


NTFS security ntfsSecurity*
ntfsSecurityHashPadding = $00490049; Unicode string II
ntfsSecurityHashPaddingSize = 4; SizeOf(LongWord)
 
ntfsSecurityMirrorOffset = $00040000; 256K Offset between primary and mirror entries
ntfsSecuritySectionOffset = $00040000; 256K Offset between sections (End of one section to Start of next)
ntfsSecuritySectionShift = 18; Not Used
ntfsSecurityOffsetMask = $0003FFFF; Used to determine the offset within a section from the offset
ntfsSecuritySectionMask = $FFFC0000; Used to determine the start of a section from the offset
ntfsSecurityMirrorTest = $00040000; Mirror blocks will always be 40000 or C0000


NTFS max number ntfsMax*
ntfsMaxPath = 260;  
ntfsMaxFile = 255;  
 
ntfsMaxAlias = 999999; Max number of lfn aliases (ie ~999999)
ntfsMaxNameAlias = 4;  
ntfsMaxHashAlias = 999;  
ntfsMaxHashShift = 16;  
 
ntfsMaxVolumeName = 255;  
ntfsMaxAttributeName = 255;  


NTFS cluster size ntfs*ClusterSize*
ntfsMinClusterSize = 512;  
ntfs12MaxClusterSize = 4096;  
ntfs30MaxClusterSize = 65536;  


NTFS sector ntfs*Sector
ntfsBootSector = 0;  
ntfsStartSector = 0; Int64
ntfsUnknownSector = -1; Int64


NTFS cluster ntfs*Cluster
ntfsStartCluster = 0; Int64
ntfsUnevenCluster = 1; Int64
ntfsUnknownCluster = -1; Int64


NTFS status ntfsStatus*
ntfsStatusNone = $00000000;  
ntfsStatusAdded = $00000001; Used by Node
ntfsStatusDeleted = $00000002; Used by Node
ntfsStatusChanged = $00000004; Used by Key, Node, Index
ntfsStatusLoaded = $00000008; Used by Index, List
ntfsStatusInvalid = $00000010; Used by Key, Item
ntfsStatusResizing = $00000020; Used by Record
ntfsStatusRemoving = $00000040; Used by Record
ntfsStatusUpdating = $00000080; Used by Attribute
 
ntfsStatusMirrored = $00000100; Metafile Records (0 to 3)
ntfsStatusMetafile = $00000200; Metafile Records (0 to 11)
ntfsStatusReserved = $00000400; Reserved MFT Records (12 to 15)(0C to 0F)
ntfsStatusExpansion = $00000800; Expansion MFT Records (16 to 23)(10 to 17)
 
ntfsStatusOverflow = $00001000; Record has an attribute list attribute
ntfsStatusExtension = $00002000; Record is an extension of the base record
 
ntfsStatusFixed = $00004000; Attribute is a fixed size (can write single item) Not used due to Fixups
ntfsStatusSingle = $00008000; Attribute only allows a single instance (Standard Information, Attribute List, End etc)
ntfsStatusUnlisted = $00010000; Attribute is not listed in an Attribute List (Attribute List, End)
ntfsStatusUnmovable = $00020000; Attribute cannot be moved from the Base Record (Standard Information, Attribute List)
ntfsStatusManaged = $00040000; Attribute is handled as a record or list, data member is not valid (Standard Information, Attribute List, FileName etc)
 
ntfsStatusAny = $FFFFFFFF;  


NTFS compare ntfsCompare*
ntfsCompareLess = -1;  
ntfsCompareEqual = 0;  
ntfsCompareGreater = 1;  


NTFS instance ntfsInstance*
ntfsInstanceFirst = 0;  
ntfsInstanceLast = -1;  


NTFS attribute definition ntfsAttrDefNo*
ntfsAttrDefNoMinimum = 0; Int64
ntfsAttrDefNoMaximum = -1; Int64


NTFS file reference ntfsFileReference*
ntfsFileReferenceNone = 0; Int64
ntfsRecordNumberMask = $0000FFFFFFFFFFFF; Get a record number from a file reference
ntfsUnknownRecordNumber = -1; Int64


NTFS bitmap ntfsBitmap*
ntfsBitmapUnknown = LongWord(-1);  


NTFS block count mask ntfsBlockCountMask*
ntfsBlockCountMask8 = $FFFFFFFFFFFFFFF8; 0000000000000007
ntfsBlockCountMask64 = $FFFFFFFFFFFFFFC0; 000000000000003F


NTFS MFT zone ntfsMftZone*
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem - NtfsMftZoneReservation - DWORD
 
ntfsMftZone50percent = 500; Registry value 4
ntfsMftZone37percent = 375; Registry value 3
ntfsMftZone25percent = 250; Registry value 2
ntfsMftZone12percent = 125; Registry value 1 (Default)
ntfsMftZone0percent = 0; Registry value 0 (Not allowed)


NTFS MFT fixed zone ntfsMftFixedZone*
Vista/2008
 
ntfsMftFixedZone1000MB = 1000; Registry value 0 (Not allowed)
ntfsMftFixedZone800MB = 800; Registry value 4
ntfsMftFixedZone600MB = 600; Registry value 3
ntfsMftFixedZone400MB = 400; Registry value 2
ntfsMftFixedZone200MB = 200; Registry value 1 (Default)
ntfsMftFixedZone0MB = 0; Registry value 0 (Not allowed)
 
ntfsMftFixedZone1000MBSize = 1048576000;  
ntfsMftFixedZone800MBSize = 838860800;  
ntfsMftFixedZone600MBSize = 629145600;  
ntfsMftFixedZone400MBSize = 419430400;  
ntfsMftFixedZone200MBSize = 209715200;  
ntfsMftFixedZone0MBSize = 0;  


NTFS run offset mask ntfsRunOffsetMask*
ntfsRunOffsetMask = $F0; shr 4
ntfsRunLengthMask = $0F;  


NTFS run encode mask ntfsRunEncodeMask*
(and)
 
ntfsRunEncodeMasks:array[0..8] of Int64 = (
$0000000000000000,  
$00000000000000FF,  
$000000000000FFFF,  
$0000000000FFFFFF,  
$00000000FFFFFFFF,  
$000000FFFFFFFFFF,  
$0000FFFFFFFFFFFF,  
$00FFFFFFFFFFFFFF,  
$FFFFFFFFFFFFFFFF); Not Used


NTFS run encode test ntfsRunEncodeTest*
(and)
 
(*ntfsRunEncodeTests:array[0..8] of Int64 = (
$FFFFFFFFFFFFFFFF, Not Used
$FFFFFFFFFFFFFF00,  
$FFFFFFFFFFFF0000,  
$FFFFFFFFFF000000,  
$FFFFFFFF00000000,  
$FFFFFF0000000000,  
$FFFF000000000000,  
$FF00000000000000,  
$0000000000000000);*)  
 
ntfsRunEncodeTests:array[0..8] of Int64 = (
$0000000000000000,  
$000000000000007F,  
$0000000000007FFF,  
$00000000007FFFFF,  
$000000007FFFFFFF,  
$0000007FFFFFFFFF,  
$00007FFFFFFFFFFF,  
$007FFFFFFFFFFFFF,  
$7FFFFFFFFFFFFFFF); Not Used


NTFS run negative test ntfsRunNegativeTest*
ntfsRunNegativeTests:array[0..8] of Int64 = (
$FFFFFFFFFFFFFFFF, Not Used
$FFFFFFFFFFFFFF80,  
$FFFFFFFFFFFF8000,  
$FFFFFFFFFF800000,  
$FFFFFFFF80000000,  
$FFFFFF8000000000,  
$FFFF800000000000,  
$FF80000000000000,  
$8000000000000000);  


NTFS run decode mask ntfsRunDecode*Mask
(and) (or not)
 
ntfsRunDecode1Masks:array[1..1] of Byte = (
$FF);  
 
ntfsRunDecode2Masks:array[2..2] of Word = (
$FFFF);  
 
ntfsRunDecode4Masks:array[3..4] of LongWord = (
$00FFFFFF,  
$FFFFFFFF);  
 
ntfsRunDecode8Masks:array[5..8] of Int64 = (
$000000FFFFFFFFFF,  
$0000FFFFFFFFFFFF,  
$00FFFFFFFFFFFFFF,  
$FFFFFFFFFFFFFFFF);  


NTFS run decode test ntfsRunDecode*Test
(>=)
 
ntfsRunDecode1Tests:array[1..1] of Byte = (
$80);  
 
ntfsRunDecode2Tests:array[2..2] of Word = (
$8000);  
 
ntfsRunDecode4Tests:array[3..4] of LongWord = (
$00800000,  
$80000000);  
 
ntfsRunDecode8Tests:array[5..8] of Int64 = (
$0000008000000000,  
$0000800000000000,  
$0080000000000000,  
$8000000000000000);  


NTFS compression tag ntfsCompression*
ntfsCompressionTags:array[1..8] of Byte = (
$01,  
$02,  
$04,  
$08,  
$10,  
$20,  
$40,  
$80);  
 
ntfsCompressionTagMask = $0FFF; The default mask for encoding and decoding the offset and length of a tag
ntfsCompressionTagShift = 12; The default shift for encoding and decoding the offset and length of a tag.

Tag is encoded as Offset:Length by varying the mask and shift based on the position.

 
ntfsCompressionUnitSize = 4; The default shift count for compression unit to cluster conversion
ntfsCompressionBlockSize = 4096; The fixed size of a compression block inside the variable compression unit
 
ntfsCompressionLengthMask = $0FFF; The mask for the maximum length of a compressed block
ntfsCompressionMarkerMask = $B000; The mask for the marker of a compressed block
ntfsCompressionMarkerTest = $8000; The test for the marker of a compressed block
 
ntfsCompressionTableInit = $FF; The initialization value for the compression table
ntfsCompressionTableUnused = $FFFF; The unused or unseen value for the compression table


NTFS bitmap mask ntfsBitmapMask*
ntfsBitmapMaskBits = 64; Int64 Bitmap Masks
ntfsBitmapMaskNone = $0000000000000000; Int64 (Used for fast counting of free blocks)
ntfsBitmapMaskAll = $FFFFFFFFFFFFFFFF; Int64 (Used for fast counting of used blocks)


NTFS signature ntfs*Signature
ntfsFileSignature = $454C4946; FILE
ntfsIndexSignature = $58444E49; INDX
ntfsRecordSignature = $44524352; RCRD
ntfsRestartSignature = $52545352; RSTR
ntfsCheckedSignature = $00000000; CHKD
 
ntfsNullGUID:TGUID = (D1:$00000000;D2:$0000;D3:$0000;D4:($00,$00,$00,$00,$00,$00,$00,$00));  
 
ntfsNullFileTime:TFileTime = (dwLowDateTime:$00000000;dwHighDateTime:$00000000);  


NTFS table type ntfsTableType*
ntfsTableTypeMft = $00000000;  
ntfsTableTypeMftMirr = $00000001;  


NTFS file type ntfsFileType*
ntfsFileTypeMft = $00000000;  
ntfsFileTypeMftMirr = $00000001;  
ntfsFileTypeLogFile = $00000002;  
ntfsFileTypeVolume = $00000003;  
ntfsFileTypeAttrDef = $00000004;  
ntfsFileTypeRoot = $00000005;  
ntfsFileTypeBitmap = $00000006;  
ntfsFileTypeBoot = $00000007;  
ntfsFileTypeBadClus = $00000008;  
ntfsFileTypeSecure = $00000009;  
ntfs12FileTypeQuota = $00000009; Version 1.2 only
ntfsFileTypeUpCase = $0000000A;  
ntfsFileTypeExtend = $0000000B;  
 
ntfsFileTypeObjId = $10000000; Any record number
ntfsFileTypeQuota = $20000000; Any record number
ntfsFileTypeReparse = $30000000; Any record number
ntfsFileTypeUsnJrnl = $40000000; Any record number
 
ntfsFileTypeFile = $50000000; Any record number (Not Used)
ntfsFileTypeDirectory = $60000000; Any record number (Not Used)
 
ntfsFileTypeReserved1 = $0000000C; Reserved Records
ntfsFileTypeReserved2 = $0000000D;  
ntfsFileTypeReserved3 = $0000000E;  
ntfsFileTypeReserved4 = $0000000F;  
 
ntfsFileTypeExpansion1 = $00000010; Expansion Records
ntfsFileTypeExpansion2 = $00000011;  
ntfsFileTypeExpansion3 = $00000012;  
ntfsFileTypeExpansion4 = $00000013;  
ntfsFileTypeExpansion5 = $00000014;  
ntfsFileTypeExpansion6 = $00000015;  
ntfsFileTypeExpansion7 = $00000016;  
ntfsFileTypeExpansion8 = $00000017;  


NTFS record number ntfs*RecordNumber
ntfsQuotaRecordNumber = $00000018; Only used during Format
ntfsObjIdRecordNumber = $00000019; Only used during Format
ntfsReparseRecordNumber = $0000001A; Only used during Format
ntfsUsnJrnlRecordNumber = $0000001B; Not Used
 
ntfsDefaultRecordCount = $0000001B; Files up to $Reparse
ntfsDefaultMirrorCount = $00000004; Files up to $Volume


NTFS file reference ntfs*FileReference
ntfsRootFileReference = $0005000000000005; Only used during Format
ntfsExtendFileReference = $000B00000000000B; Only used during Format
ntfsVolumeFileReference = $0003000000000003; Only used during Format


NTFS file name ntfsFileName*
ntfsFileNameMft = '$MFT';  
ntfsFileNameMftMirr = '$MFTMirr';  
ntfsFileNameLogFile = '$LogFile';  
ntfsFileNameVolume = '$Volume';  
ntfsFileNameAttrDef = '$AttrDef';  
ntfsFileNameRoot = '.';  
ntfsFileNameBitmap = '$Bitmap';  
ntfsFileNameBoot = '$Boot';  
ntfsFileNameBadClus = '$BadClus';  
ntfsFileNameSecure = '$Secure';  
ntfsFileNameUpCase = '$UpCase';  
ntfsFileNameExtend = '$Extend';  
 
ntfsFileNameObjId = '$ObjId';  
ntfsFileNameQuota = '$Quota';  
ntfsFileNameReparse = '$Reparse';  
ntfsFileNameUsnJrnl = '$UsnJrnl';  


NTFS attribute type ntfsAttrType*
ntfsAttrTypeNone = $00000000; Marker only
ntfsAttrTypeStandardInformation = $00000010;  
ntfsAttrTypeAttributeList = $00000020;  
ntfsAttrTypeFileName = $00000030;  
ntfsAttrTypeObjectId = $00000040;  
ntfsAttrTypeVolumeVersion = $00000040; Version 1.2 only
ntfsAttrTypeSecurityDescriptor = $00000050;  
ntfsAttrTypeVolumeName = $00000060;  
ntfsAttrTypeVolumeInformation = $00000070;  
ntfsAttrTypeData = $00000080;  
ntfsAttrTypeIndexRoot = $00000090;  
ntfsAttrTypeIndexAllocation = $000000A0;  
ntfsAttrTypeBitmap = $000000B0;  
ntfsAttrTypeReparsePoint = $000000C0;  
ntfsAttrTypeSymbolicLink = $000000C0; Version 1.2 only
ntfsAttrTypeExtendedAttrInformation = $000000D0;  
ntfsAttrTypeExtendedAttr = $000000E0;  
ntfsAttrTypePropertySet = $000000F0; Version 3.0 only
ntfsAttrTypeLoggedUtilityStream = $00000100;  
ntfsAttrTypeEnd = $FFFFFFFF; Marker only
 
ntfsAttrTypeAny = $00000000; Used to return all attributes


NTFS attribute name ntfsAttrName*
ntfsAttrNameNone = '$NONE'; Marker only
ntfsAttrNameStandardInformation = '$STANDARD_INFORMATION';  
ntfsAttrNameAttributeList = '$ATTRIBUTE_LIST';  
ntfsAttrNameFileName = '$FILE_NAME';  
ntfsAttrNameObjectId = '$OBJECT_ID';  
ntfsAttrNameVolumeVersion = '$VOLUME_VERSION'; Version 1.2 only
ntfsAttrNameSecurityDescriptor = '$SECURITY_DESCRIPTOR';  
ntfsAttrNameVolumeName = '$VOLUME_NAME';  
ntfsAttrNameVolumeInformation = '$VOLUME_INFORMATION';  
ntfsAttrNameData = '$DATA';  
ntfsAttrNameIndexRoot = '$INDEX_ROOT';  
ntfsAttrNameIndexAllocation = '$INDEX_ALLOCATION';  
ntfsAttrNameBitmap = '$BITMAP';  
ntfsAttrNameReparsePoint = '$REPARSE_POINT';  
ntfsAttrNameSymbolicLink = '$SYMBOLIC_LINK'; Version 1.2 only
ntfsAttrNameExtendedAttrInformation = '$EA_INFORMATION';  
ntfsAttrNameExtendedAttr = '$EA';  
ntfsAttrNamePropertySet = '$PROPERTY_SET'; Version 3.0 only
ntfsAttrNameLoggedUtilityStream = '$LOGGED_UTILITY_STREAM';  
ntfsAttrNameEnd = '$END'; Marker only


NTFS owner Id ntfsOwnerId*
ntfsOwnerIdNull = $00000001;  
ntfsOwnerIdFirst = $00000100;  
 
ntfsOwnerIdUnknown = $FFFFFFFF;  


NTFS default owner Id ntfsDefaultOwnerId*
ntfsDefaultOwnerId1 = $00000001;  
ntfsDefaultOwnerId100 = $00000100;  


NTFS default sid ntfsDefaultSid*
ntfsMaxDefaultSid = 1;  
 
ntfsDefaultSidNone = 0;  
ntfsDefaultSid100 = 1;  
 
ntfsDefaultSids:array[1..ntfsMaxDefaultSid] of TNTFSDefaultSid = (
(Sid:WinBuiltinAdministratorsSid)); 100


NTFS security Id ntfsSecurityId*
ntfsSecurityIdNull = $00000001;  
ntfsSecurityIdFirst = $00000100;  
 
ntfsSecurityIdUnknown = $FFFFFFFF;  


NTFS default security Id ntfsDefaultSecurityId*
ntfsDefaultSecurityId100 = $00000100;  
ntfsDefaultSecurityId101 = $00000101;  
ntfsDefaultSecurityId102 = $00000102;  
ntfsDefaultSecurityId103 = $00000103;  


NTFS default descriptor ntfsDefaultDescriptor*
ntfsMaxDefaultDescriptor = 7;  
 
ntfsDefaultDescriptorNone = 0;  
ntfsDefaultDescriptorVolume = 1;  
ntfsDefaultDescriptorAttrDef = 2;  
ntfsDefaultDescriptorRoot = 3;  
ntfsDefaultDescriptor102 = 4;  
ntfsDefaultDescriptor103 = 5;  
ntfsDefaultDescriptorFile = 6; Used by NTFSDefaultSecurity option
ntfsDefaultDescriptorFolder = 7; Used by NTFSDefaultSecurity option
 
ntfsDefaultDescriptorBoot = 2; Same as ntfsDefaultDescriptorAttrDef
ntfsDefaultDescriptor100 = 2; Same as ntfsDefaultDescriptorAttrDef
ntfsDefaultDescriptor101 = 1; Same as ntfsDefaultDescriptorVolume
ntfsDefaultDescriptorReserved = 1; Same as ntfsDefaultDescriptorVolume


NTFS security offset ntfsSecurityOffset*
ntfsSecurityOffsetFirst = 0; Int64
 
ntfsSecurityOffsetUnknown = -1; Int64


NTFS index name ntfsIndexName*
ntfsIndexNameFileName = '$I30';  
ntfsIndexNameSecurityId = '$SII';  
ntfsIndexNameSecurityHash = '$SDH';  
ntfsIndexNameObjectId = '$O';  
ntfsIndexNameOwnerId = '$O';  
ntfsIndexNameQuota = '$Q';  
ntfsIndexNameReparse = '$R';  


NTFS index order ntfsIndexOrder*
ntfsIndexOrderFileName = 38;  
ntfsIndexOrderSecurityId = 100;  
ntfsIndexOrderSecurityHash = 100;  
ntfsIndexOrderObjectId = 100;  
ntfsIndexOrderOwnerId = 100;  
ntfsIndexOrderQuota = 100;  
ntfsIndexOrderReparse = 100;  


NTFS stream name ntfsStreamName*
ntfsStreamNameSecurity = '$SDS';  
ntfsStreamNameBadClus = '$Bad';  
ntfsStreamNameMountMgr = '$MountMgrDatabase';  
ntfsStreamNameJournal = '$J';  
ntfsStreamNameJrnlMax = '$Max';  


NTFS file namespace ntfsNameSpace*
ntfsNameSpacePosix = $00;  
ntfsNameSpaceWin32 = $01;  
ntfsNameSpaceDos = $02;  
ntfsNameSpaceBoth = ntfsNamespaceWin32 or ntfsNamespaceDos;  


NTFS display type ntfsDisplayType*
ntfsDisplayTypeNone = $00000000;  


NTFS collate type ntfsCollateType*
ntfsCollateTypeBinary = $00000000; Binary, where the first byte is most significant
ntfsCollateTypeFileName = $00000001; Filename Unicode strings (This is a case insensitive compare)
ntfsCollateTypeUnicode = $00000002; Unicode strings, except that upper case letters should come first (This is a case sensitive compare)
ntfsCollateTypeLongWord = $00000010; An unsigned long (32 bits, little endian)
ntfsCollateTypeSID = $00000011; A Security Identifier
ntfsCollateTypeSecurityHash = $00000012; First compare by the Security Hash, then by Security Descriptor (Sorting is by Security Hash then Security Id)
ntfsCollateTypeGUID = $00000013; Object GUIDs


NTFS volume flag ntfsVolumeFlag*
ntfsVolumeFlagNone = $0000;  
ntfsVolumeFlagDirty = $0001;  
ntfsVolumeFlagResizeLogFile = $0002;  
ntfsVolumeFlagUpgradeMount = $0004;  
ntfsVolumeFlagMountedNT4 = $0008;  
ntfsVolumeFlagDeleteUSN = $0010;  
ntfsVolumeFlagRepairObjectIds = $0020;  
ntfsVolumeFlagModifiedChkdsk = $8000;  


NTFS file record flag ntfsFileRecordFlag*
ntfsFileRecordFlagNone = $0000;  
ntfsFileRecordFlagInUse = $0001;  
ntfsFileRecordFlagDirectory = $0002;  
ntfsFileRecordFlagUnknown1 = $0004; Used by $Quota,$ObjId,$Reparse
ntfsFileRecordFlagIndexView = $0008; Used by $Secure,$Quota,$ObjId,$Reparse


NTFS attribute flag ntfsAttrDefFlag* ntfsAttributeFlag*
ntfsAttrDefFlagNone = $00000000;  
ntfsAttrDefFlagIndexed = $00000002;  
ntfsAttrDefFlagResident = $00000040; Always resident
ntfsAttrDefFlagUncompressed = $00000080; Cannot Compress (Note: Resident Attributes cannot be compressed anyway)
 
ntfsAttrDefFlagResidentIndex = $00000042; Used by FileName (Resident and Indexed)
 
ntfsAttributeFlagNone = $0000;  
ntfsAttributeFlagCompressed = $0001;  
ntfsAttributeFlagEncrypted = $4000;  
ntfsAttributeFlagSparse = $8000;  


NTFS attribute ntfsAttribute*
ntfsAttributeIndexed = $01;  
ntfsAttributeNonIndexed = $00;  
ntfsAttributeResident = $00;  
ntfsAttributeNonResident = $01;  


NTFS index header flag ntfsIndexHeaderFlag*
ntfsIndexHeaderFlagNone = $0000;  
ntfsIndexHeaderFlagSubNodes = $0001; Index has Sub Nodes


NTFS index entry flag ntfsIndexEntryFlag*
ntfsIndexEntryFlagNone = $0000;  
ntfsIndexEntryFlagSubNode = $0001; Entry has Sub Node
ntfsIndexEntryFlagLastNode = $0002; Entry is Last Node (Always the Blank Node)


NTFS quota flag ntfsQuotaFlag*
ntfsQuotaFlagNone = $0000;  
ntfsQuotaFlagDefaultLimits = $0001;  
ntfsQuotaFlagLimitReached = $0002;  
ntfsQuotaFlagIdDeleted = $0004;  
ntfsQuotaFlagTrackingEnabled = $0010;  
ntfsQuotaFlagEnforcementEnabled = $0020;  
ntfsQuotaFlagTrackingRequested = $0040;  
ntfsQuotaFlagLogThreshold = $0080;  
ntfsQuotaFlagLogLimit = $0100;  
ntfsQuotaFlagOutOfDate = $0200;  
ntfsQuotaFlagCorrupt = $0400;  
ntfsQuotaFlagPendingDeletes = $0800;  


NTFS reparse tag ntfsReparseTag*
ntfsReparseTagNone = $00000000;  
ntfsReparseTagMountPoint = $A0000003;  
ntfsReparseTagHSM = $C0000004;  
ntfsReparseTagNSS = $80000005;  
ntfsReparseTagNSSRecover = $80000006; ntfsReparseTagHSM2
ntfsReparseTagSIS = $80000007;  
ntfsReparseTagDFS = $80000008; Shown in some documentation
ntfsReparseTagDFS = $8000000A;  
ntfsReparseTagFilterManager = $8000000B;  
ntfsReparseTagSymbolicLink = $A000000C;  
ntfsReparseTagDFSR = $80000012;  


NTFS reparse tag flag ntfsReparseTagFlag*
ntfsReparseTagFlagNone = $00000000;  
ntfsReparseTagFlagIsAlias = $20000000; ntfsReparseTagFlagIsNameSurrogate
ntfsReparseTagFlagIsHighLatency = $40000000;  
ntfsReparseTagFlagIsMicrosoft = $80000000;  


NTFS reparse tag type ntfsReparseTagType*
ntfsReparseTagTypeNone = $00000000;  
ntfsReparseTagTypeMountPoint = $00000003;  
ntfsReparseTagTypeHSM = $00000004;  
ntfsReparseTagTypeNSS = $00000005;  
ntfsReparseTagTypeNSSRecover = $00000006; ntfsReparseTagHSM2
ntfsReparseTagTypeSIS = $00000007;  
ntfsReparseTagTypeDFS = $00000008; Shown in some documentation
ntfsReparseTagTypeDFS = $0000000A;  
ntfsReparseTagTypeFilterManager = $0000000B;  
ntfsReparseTagTypeSymbolicLink = $0000000C;  
ntfsReparseTagTypeDFSR = $00000012;  
 
ntfsReparsePointPrefix = '\??\';  


NTFS extended attribute flag ntfsExtendedAttributeFlag*
ntfsExtendedAttributeFlagNone = $00;  
ntfsExtendedAttributeFlagNeedEA = $80;  


NTFS default size ntfsDefault*Size
ntfsDefaultBootRecordSize = 8192;  
ntfsDefaultFileRecordSize = 1024;  
ntfsDefaultIndexRecordSize = 4096;  
 
ntfsDefaultSecureSdsSize = 262396; 262616 if including Id 102 and 103


NTFS log file ntfsLogFile*
ntfsRestartPageSize = $1000;  
 
ntfsLogFileClientFirst = $0000;  
ntfsLogFileClientUnknown = $FFFF;  
 
ntfsLogFileRestartFlagClean = $0002;  


NTFS old log file size ntfs*OldLogSize
ntfsMaxOldLogSize = 10;  
ntfsOldLogSizes:array[0..ntfsMaxOldLogSize] of TNTFSLogSize = (
DiskSize,LogSize
(DiskSize:8388608;LogSize:262144), greater than 8MB, 256KB log
(DiskSize:16777216;LogSize:262144), greater than 16MB, 256KB log
(DiskSize:33554432;LogSize:524288), greater than 32MB, 512KB log (Previously 262144)
(DiskSize:67108864;LogSize:1048576), greater than 64MB, 1MB log (Previously 524288)
(DiskSize:134217728;LogSize:2097152), greater than 128MB, 2MB log (Previously 1048576)
(DiskSize:268435456;LogSize:2097152), greater than 256MB, 2MB log
(DiskSize:536870912;LogSize:4194304), greater than 512MB, 4MB log
(DiskSize:1073741824;LogSize:8388608), greater than 1GB, 8MB log
(DiskSize:2147483648;LogSize:16777216), greater than 2GB, 16MB log
(DiskSize:4294967296;LogSize:33554432), greater than 4GB, 32MB log
(DiskSize:8589934592;LogSize:67108864)); greater than 8GB, 64MB log


NTFS log file size ntfs*LogSize
ntfsMaxLogSize = 8;  
ntfsLogSizes:array[0..ntfsMaxLogSize] of TNTFSLogSize = (
DiskSize,LogSize
(DiskSize:0;LogSize:2097152), less than 128MB, 2MB log
(DiskSize:134217728;LogSize:4194304), greater than 128MB, 4MB log
(DiskSize:268435456;LogSize:5242880), greater than 256MB, 5MB log
(DiskSize:536870912;LogSize:6291456), greater than 512MB, 6MB log
(DiskSize:805306368;LogSize:7340032), greater than 768MB, 7MB log
(DiskSize:1073741824;LogSize:8388608), greater than 1GB, 8MB log
(DiskSize:2147483648;LogSize:16777216), greater than 2GB, 16MB log
(DiskSize:4294967296;LogSize:33554432), greater than 4GB, 32MB log
(DiskSize:8589934592;LogSize:67108864)); greater than 8GB, 64MB log


NTFS MFT/MFTMirr start ntfsMftStart*
ntfsMftStartCluster = 786432;  
ntfsMftCutoverCount = 4194304; 4194304 * 4096 = 16GB (The point at which the MFT becomes fixed in location)


NTFS file size ntfsFileSize*
ntfsFileSizeMft = ntfsUnknownCluster; Variable size
ntfsFileSizeMftMirr = ntfsUnknownCluster; Variable size
ntfsFileSizeLogFile = ntfsUnknownCluster; Variable size
ntfsFileSizeVolume = 0; Constant size
ntfsFileSize12AttrDef = 36864; Constant size
ntfsFileSize30AttrDef = 2560; Constant size
ntfsFileSize31AttrDef = 2560; Constant size
ntfsFileSizeRoot = ntfsUnknownCluster; Variable size
ntfsFileSizeBitmap = ntfsUnknownCluster; Variable size
ntfsFileSizeBoot = 8192; Constant size
ntfsFileSizeBadClus = 0; Starting size
ntfsFileSizeSecure = 0; Constant size
ntfsFileSizeUpCase = 131072; Constant size
ntfsFileSizeExtend = 0; Constant size
 
ntfsFileSizeObjId = 0; Constant size
ntfsFileSizeQuota = 0; Constant size
ntfsFileSizeReparse = 0; Constant size
ntfsFileSizeUsnJrnl = ntfsUnknownCluster; Variable size


NTFS stream size ntfsStreamSize*
ntfsStreamSizeSecurity = ntfsUnknownCluster; Variable size
ntfsStreamSizeBadClus = ntfsUnknownCluster; Variable size
ntfsStreamSizeMountMgr = ntfsUnknownCluster; Variable size
ntfsStreamSizeJournal = ntfsUnknownCluster; Variable size
ntfsStreamSizeJrnlMax = ntfsUnknownCluster; Variable size


NTFS header size ntfs*HeaderSize*
ntfsFileRecord12Size = 42; Constant size
ntfsFileRecord31Size = 48; Constant size
 
ntfsIndexRecordSize = 24; Constant size
ntfsIndexHeaderSize = 16; Constant size
ntfsIndexEntrySize = 16; Minimum size
 
ntfsAttributeTypeSize = 4; Constant size
ntfsAttributeHeaderSize = 16; Minimum size
ntfsResidentHeaderSize = 24; Minimum size
ntfsNonResidentHeaderSize = 64; Minimum size
ntfsCompressedHeaderSize = 72; Minimum size


NTFS attribute size ntfsAttribute*Size
Minimum sizes
 
ntfsStandardInformation12Size = 48; Constant size
ntfsStandardInformation30Size = 72; Constant size
ntfsAttributeListSize = 0; Variable size
ntfsFileNameSize = 66; Minimum size
ntfsObjectIdSize = 16; Minimum size
ntfsObjectIdSize2 = 32; Minimum size
ntfsObjectIdSize3 = 48; Minimum size
ntfsObjectIdSize4 = 64; Minimum size
ntfsVolumeVersionSize = 8; Constant size
ntfsSecurityDescriptorSize = 0; Variable size
ntfsVolumeNameSize = 0; Variable size
ntfsVolumeInformationSize = 12; Constant size
ntfsDataSize = 0; Variable size
ntfsIndexRootSize = 16; Constant size
ntfsIndexAllocationSize = 0; Variable size
ntfsBitmapSize = 0; Variable size
ntfsReparsePointSize = 8; Minimum size
ntfsReparsePointMicrosoftSize = 8; Minimum size
ntfsReparsePointOtherSize = 24; Minimum size
ntfsSymbolicLinkSize = 0; Variable size
ntfsExtendedAttrInformationSize = 8; Constant size
ntfsExtendedAttrSize = 0; Variable size
ntfsPropertySetSize = 0; Variable size
ntfsLoggedUtilityStreamSize = 0; Variable size
ntfsUnknownSize = 0; Variable size
ntfsEndSize = 4; Constant size


NTFS data size ntfs*Size
Minimum sizes
 
ntfsRunSize = 1; Minimum size
ntfsItemSize = 26; Minimum size
ntfsObjIdSize = 56; Constant size
ntfsQuotaSize = 48; Minimum size
ntfsOwnerSize = 4; Constant size
ntfsUpCaseSize = 131072; Constant size
ntfsAttrDefSize = 160; Constant size
ntfsReparseSize = 12; Minimum size
ntfsExtendedSize = 8; Minimum size
ntfsSecuritySize = 20; Minimum size
ntfsSidSize = 8; Minimum size
ntfsAclSize = 8; Minimum size
ntfsAceSize = 8; Minimum size
ntfsSecurityItemSize = 40; Minimum size (Includes ntfsSecuritySize)
ntfsSecurityIdSize = 20; Minimum size
ntfsSecurityHashSize = 20; Minimum size (Previously 24 - Modified to remove Padding)


NTFS key size ntfs*KeySize
Minimum sizes
 
ntfsObjIdKeySize = 16; Minimum size
ntfsQuotaKeySize = 4; Minimum size
ntfsOwnerKeySize = 8; Minimum size (Includes ntfsSidSize)
ntfsSecurityIdKeySize = 4; Minimum size
ntfsSecurityHashKeySize = 8; Minimum size
ntfsReparseKeySize = 12; Constant size (Not 16 even though CollateType is GUID)


NTFS update sequence size ntfsUpdateSequenceSize*
ntfsUpdateSequenceSize = 512; Constant size (Always 512 regardless of the sector size)


NTFS sector count ntfs*SectorCount
Used for NTFS formatting (Fixed Disk only)
 
ntfs12MaxSectorCount = 4;  
ntfs12SectorCounts:array[0..ntfs12MaxSectorCount] of TNTFSSectorCount = (
SectorCount,SectorsPerCluster
(SectorCount:16384;SectorsPerCluster:0), up to 8 MB, the 0 value for SectorsPerCluster trips an error
(SectorCount:1048576;SectorsPerCluster:1), up to 512 MB, sector size cluster
(SectorCount:2097152;SectorsPerCluster:2), up to 1 GB, 1k cluster
(SectorCount:4194304;SectorsPerCluster:4), up to 2 GB, 2k cluster
(SectorCount:$FFFFFFFF;SectorsPerCluster:8)); greater than 2 GB, 4k cluster
 
ntfs30MaxSectorCount = 4;  
ntfs30SectorCounts:array[0..ntfs30MaxSectorCount] of TNTFSSectorCount = (
SectorCount,SectorsPerCluster
(SectorCount:16384;SectorsPerCluster:0), up to 8 MB, the 0 value for SectorsPerCluster trips an error
(SectorCount:1048576;SectorsPerCluster:1), up to 512 MB, sector size cluster
(SectorCount:2097152;SectorsPerCluster:2), up to 1 GB, 1k cluster
(SectorCount:4194304;SectorsPerCluster:4), up to 2 GB, 2k cluster
(SectorCount:$FFFFFFFF;SectorsPerCluster:8)); greater than 2 GB, 4k cluster


Type definitions


NTFS attribute definition

TNTFSAttrDefine = record

Note: Not Packed
AttributeType:LongWord;  
AttributeName:String;  
AttrDefFlags:LongWord;  
MinimumSize:Int64;  
MaximumSize:Int64;  

NTFS uppercase conversion

TNTFSUpcaseConvert = record

Note: Not Packed
Count:Word;  
Value:Word;  

NTFS sector count

TNTFSSectorCount = record

Note: Not Packed (Fixed Disk only)
SectorCount:LongWord; Based on 512 bytes per sector only
SectorsPerCluster:LongWord;  

NTFS log size

TNTFSLogSize = record

Note: Not Packed
DiskSize:Int64;  
LogSize:Int64;  

NTFS default SID

PNTFSDefaultSid = ^TNTFSDefaultSid;

TNTFSDefaultSid = record

Note: Not Packed
Sid:TWellKnownSidType;  

NTFS default access control entry

TNTFSDefaultAce = record

Note: Not Packed
AceType:Byte;  
AceFlags:Byte;  
AceSize:Word;  
Mask:LongWord;  
Sid:TWellKnownSidType;  

NTFS default access control list

TNTFSDefaultAcl = record

Note: Not Packed
AclRevision:Byte;  
AclSize:Word;  
AceCount:Word;  
Aces:array[0..7] of TNTFSDefaultAce;  

NTFS default descriptor

PNTFSDefaultDescriptor = ^TNTFSDefaultDescriptor;

TNTFSDefaultDescriptor = record

Note: Not Packed
Size:LongWord;  
Revision:Byte; Revision
Control:Word; Control Flags
OwnerOffset:LongWord; Offset to Owner SID
GroupOffset:LongWord; Offset to Group SID
SaclOffset:LongWord; Offset to SACL
DaclOffset:LongWord; Offset to DACL
Owner:TWellKnownSidType;  
Group:TWellKnownSidType;  
Sacl:TNTFSDefaultAcl;  
Dacl:TNTFSDefaultAcl;  


Public variables


NTFS specific variables

SecurityHashPadding:LongWord = ntfsSecurityHashPadding;


Function declarations

None defined


Return to Unit Reference

Retrieved from "https://ultibo.org/mediawiki_ultibo_org/index.php?title=Unit_NTFSConst&oldid=5139"