Difference between revisions of "Unit NTFSClass"

From Ultibo.org
Jump to: navigation, search
Line 31: Line 31:
 
----
 
----
  
−
''To be documented''
+
 
 +
'''NTFS disk table'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskTable = class(TDiskTable)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Respresents the $Mft and $MftMirr
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FStartSector:Int64;</code>
 +
| Absolute starting sector of this table
 +
|-
 +
| <code>FStartCluster:Int64;</code>
 +
| Absolute starting cluster of this table
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FEntry:TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property StartSector:Int64 read FStartSector write FStartSector;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property StartCluster:Int64 read FStartCluster write FStartCluster;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Entry:TNTFSDiskEntry read FEntry write FEntry;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk block'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskBlock = class(TDiskBlock)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Represents a block of $Bitmap entries
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FBlockCount:LongWord;</code>
 +
| Number of cluster entries in this block (Bits in the bitmap)
 +
|-
 +
| <code>FBlockBuffer:Pointer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FBlockCluster:Int64;</code>
 +
| First cluster represented by this block (BlockNo represents the VCN of the block)
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property BlockCount:LongWord read FBlockCount write FBlockCount;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property BlockBuffer:Pointer read FBlockBuffer write FBlockBuffer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property BlockCluster:Int64 read FBlockCluster write FBlockCluster;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk entry'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskEntry = class(TDiskEntry)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Represents a file entry.
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AOrigin:TNTFSDiskRecord; AAttribute:TNTFSDiskAttribute);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FPrevEntry:TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FNextEntry:TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FUsed:Int64;</code>
 +
| Used size of the file
 +
|-
 +
| <code>FAllocated:Int64;</code>
 +
| Allocated size of file
 +
|-
 +
| <code>FChangeTime:TFileTime;</code>
 +
| MFT record change time
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FOrigin:TNTFSDiskRecord;</code>
 +
| Entry origin record
 +
|-
 +
| <code>FAttribute:TNTFSDiskAttribute;</code>
 +
| Entry naming attribute
 +
|-
 +
| <code>FAlternate:TNTFSDiskAttribute;</code>
 +
| Alternate name attribute
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetOrigin(AOrigin:TNTFSDiskRecord);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property LocalLock:TMutexHandle read FLocalLock write FLocalLock;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property PrevEntry:TNTFSDiskEntry read FPrevEntry write FPrevEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property NextEntry:TNTFSDiskEntry read FNextEntry write FNextEntry;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Used:Int64 read FUsed write FUsed;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Allocated:Int64 read FAllocated write FAllocated;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ChangeTime:TFileTime read FChangeTime write FChangeTime;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Origin:TNTFSDiskRecord read FOrigin write SetOrigin;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Attribute:TNTFSDiskAttribute read FAttribute write FAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Alternate:TNTFSDiskAttribute read FAlternate write FAlternate;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetDot:TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetDotDot:TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateDot:TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CreateDotDot:TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateDot:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateDotDot(AEntry:TNTFSDiskEntry):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RecordNumber:Int64;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function FileReference:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateEntry:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateRecord:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function FindFirstName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function FindPrevName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function FindNextName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function FindLastName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk access contol list'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskAcl = class(TDiskAcl)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of attribute $SECURITY_DESCRIPTOR
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk access control entry'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskAce = class(TDiskAce)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of attribute $SECURITY_DESCRIPTOR
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS entry list'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSEntryList = class(TObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FEntryCount:Integer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FFirstEntry:TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FLastEntry:TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Link(AEntry:TNTFSDiskEntry):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function Unlink(AEntry:TNTFSDiskEntry):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property EntryCount:Integer read FEntryCount;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property FirstEntry:TNTFSDiskEntry read FFirstEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property LastEntry:TNTFSDiskEntry read FLastEntry;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Add(AEntry:TNTFSDiskEntry):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function Remove(AEntry:TNTFSDiskEntry):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure ClearList; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS record list'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSRecordList = class(TObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FRecordCount:Integer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FFirstRecord:TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FLastRecord:TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Link(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function Unlink(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property RecordCount:Integer read FRecordCount;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property FirstRecord:TNTFSDiskRecord read FFirstRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property LastRecord:TNTFSDiskRecord read FLastRecord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Add(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function Remove(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure ClearList; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS record index'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSRecordIndex = class(TLinkedObjBtree)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Index of FILE records.
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FRecordLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FRunsLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FItemsLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FNodesLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FIndexLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FExtendedsLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FAttributesLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FRunLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FItemLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FKeyLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FNodeLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FExtendedLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FAttributeLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Find(const ARecordNumber:Int64; ACurrent:TNTFSDiskRecord):TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>function CreateBlank:TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Compare(AEntry1,AEntry2:TBtreeObject):Integer; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function CreateRecord(ABase:TNTFSDiskRecord; const ARecordNumber:Int64; AVersion:Word):TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyRecord(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewRecord(ABase:TNTFSDiskRecord; const ARecordNumber:Int64; AVersion:Word):TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function InsertRecord(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DeleteRecord(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveRecord(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function FindRecord(const ARecordNumber:Int64):TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReaderLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReaderUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReaderConvert:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriterLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriterUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriterConvert:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RunsReaderLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RunsReaderUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RunsWriterLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RunsWriterUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ItemsReaderLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ItemsReaderUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ItemsWriterLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ItemsWriterUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function NodesReaderLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NodesReaderUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NodesWriterLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NodesWriterUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function IndexReaderLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function IndexReaderUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function IndexWriterLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function IndexWriterUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ExtendedsReaderLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ExtendedsReaderUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ExtendedsWriterLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ExtendedsWriterUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AttributesReaderLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function AttributesReaderUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function AttributesWriterLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function AttributesWriterUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk record'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskRecord = class(TBtreeObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Represents a FILE record entry.
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; ABase:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLocalLock:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FRunsLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FItemsLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FNodesLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FIndexLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FExtendedsLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FAttributesLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FRunLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FItemLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FKeyLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FNodeLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FExtendedLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FAttributeLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FStatus:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FPrevRecord:TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FNextRecord:TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FRecordFlags:Word;</code>
 +
| Flags (See Consts)
 +
|-
 +
| <code>FHardLinkCount:Word;</code>
 +
| Hard link count
 +
|-
 +
| <code>FSequenceNumber:Word;</code>
 +
| Sequence number
 +
|-
 +
| <code>FNextAttributeId:Word;</code>
 +
| Next Attribute Id
 +
|-
 +
| <code>FRecordNumber:Int64;</code>
 +
| Number of this MFT Record
 +
|-
 +
| <code>FRecordSize:LongWord;</code>
 +
| Actual size of the FILE record
 +
|-
 +
| <code>FRecordAllocated:LongWord;</code>
 +
| Allocated size of the FILE record
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FAttributeOffset:Word;</code>
 +
| Offset to the first Attribute
 +
|-
 +
| <code>FUpdateSequenceOffset:Word;</code>
 +
| Offset to the Update Sequence Record
 +
|-
 +
| <code>FUpdateSequenceLength:Word;</code>
 +
| Size in words of the Update Sequence Record
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FUpdateSequenceNumber:Word;</code>
 +
| Update Sequence Number
 +
|-
 +
| <code>FLogFileSequenceNumber:Int64;</code>
 +
| LogFile Sequence Number (LSN)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FBase:TNTFSDiskRecord;</code>
 +
| Base file record
 +
|-
 +
| <code>FLinks:TNTFSEntryList;</code>
 +
| List of record links
 +
|-
 +
| <code>FStreams:TNTFSEntryList;</code>
 +
| List of record streams
 +
|-
 +
| <code>FRecords:TNTFSRecordList;</code>
 +
| List of child records
 +
|-
 +
| <code>FAttributes:TNTFSDiskAttributes;</code>
 +
| List of record attributes
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AcquireLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetResizing:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetResizing(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetRemoving:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetRemoving(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetMirrored:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetMirrored(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetMetafile:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetMetafile(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetReserved:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetReserved(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetExpansion:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetExpansion(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetOverflow:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetOverflow(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetExtension:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetExtension(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetIsUsed:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsUsed(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsFolder:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsFolder(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsUnknown1:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsUnknown1(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsIndexView:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsIndexView(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetOrigin:TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateLinks(ANew:Boolean):TNTFSEntryList;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CreateStreams(ANew:Boolean):TNTFSEntryList;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CreateRecords(ANew:Boolean):TNTFSRecordList;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CreateAttributes(AVersion:Word; ANew:Boolean):TNTFSDiskAttributes;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Resizing:Boolean read GetResizing write SetResizing;</code>
 +
| Record is being Resized
 +
|-
 +
| <code>property Removing:Boolean read GetRemoving write SetRemoving;</code>
 +
| Record is being Removed
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Mirrored:Boolean read GetMirrored write SetMirrored;</code>
 +
| Record is in $MftMirr file
 +
|-
 +
| <code>property Metafile:Boolean read GetMetafile write SetMetafile;</code>
 +
| Record is an NTFS metafile
 +
|-
 +
| <code>property Reserved:Boolean read GetReserved write SetReserved;</code>
 +
| Record is an Mft reserved record
 +
|-
 +
| <code>property Expansion:Boolean read GetExpansion write SetExpansion;</code>
 +
| Record is an Mft expansion record
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Overflow:Boolean read GetOverflow write SetOverflow;</code>
 +
| Record has an attribute list attribute
 +
|-
 +
| <code>property Extension:Boolean read GetExtension write SetExtension;</code>
 +
| Record is an extension of the base record
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property PrevRecord:TNTFSDiskRecord read FPrevRecord write FPrevRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property NextRecord:TNTFSDiskRecord read FNextRecord write FNextRecord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property IsUsed:Boolean read GetIsUsed write SetIsUsed;</code>
 +
| Record is in use
 +
|-
 +
| <code>property IsFolder:Boolean read GetIsFolder write SetIsFolder;</code>
 +
| Record is a folder
 +
|-
 +
| <code>property IsUnknown1:Boolean read GetIsUnknown1 write SetIsUnknown1;</code>
 +
|-
 +
| <code>property IsIndexView:Boolean read GetIsIndexView write SetIsIndexView;</code>
 +
| Record is an index view
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property RecordFlags:Word read FRecordFlags write FRecordFlags;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property HardLinkCount:Word read FHardLinkCount write FHardLinkCount;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property SequenceNumber:Word read FSequenceNumber write FSequenceNumber;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property NextAttributeId:Word read FNextAttributeId write FNextAttributeId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property RecordNumber:Int64 read FRecordNumber write FRecordNumber;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property RecordSize:LongWord read FRecordSize write FRecordSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property RecordAllocated:LongWord read FRecordAllocated write FRecordAllocated;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property AttributeOffset:Word read FAttributeOffset write FAttributeOffset;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property UpdateSequenceOffset:Word read FUpdateSequenceOffset write FUpdateSequenceOffset;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property UpdateSequenceLength:Word read FUpdateSequenceLength write FUpdateSequenceLength;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property UpdateSequenceNumber:Word read FUpdateSequenceNumber write FUpdateSequenceNumber;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property LogFileSequenceNumber:Int64 read FLogFileSequenceNumber write FLogFileSequenceNumber;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Base:TNTFSDiskRecord read FBase write FBase;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Links:TNTFSEntryList read FLinks;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Streams:TNTFSEntryList read FStreams;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Records:TNTFSRecordList read FRecords;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Attributes:TNTFSDiskAttributes read FAttributes;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Origin:TNTFSDiskRecord read GetOrigin;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateLink(AAttribute,AAlternate:TNTFSDiskAttribute; ANew:Boolean):TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyLink(ALink:TNTFSDiskEntry):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewLink(AAttribute,AAlternate:TNTFSDiskAttribute):TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetLink(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DeleteLink(ALink:TNTFSDiskEntry):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RenameLink(ALink:TNTFSDiskEntry; AAttribute,AAlternate:TNTFSDiskAttribute):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateStream(AAttribute:TNTFSDiskAttribute; ANew:Boolean):TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyStream(AStream:TNTFSDiskEntry):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewStream(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetStream(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DeleteStream(AStream:TNTFSDiskEntry):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetFileNameByKey(AKey:TNTFSAttributeKey):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetFileNameByName(const AName:String; AInstance:Integer):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetFileNameByParent(const AName:String; const AParent:Int64; AInstance:Integer):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetFileNameByNameSpace(const AName:String; const AParent:Int64; ANameSpace:Byte; AInstance:Integer):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetRecord(AInstance:Integer):TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetRecordByFree(AFree:LongWord; AExclude:Boolean):TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetRecordByReference(const AFileReference:Int64):TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AddRecord(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveRecord(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetAttributeByItem(AItem:TNTFSDiskItem):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetAttributeByStatus(AInclude,AExclude:Word; AInstance:Integer):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetAttributeByVCN(AAttribute:TNTFSDiskAttribute; const AVCN:Int64; var AInstance:LongWord):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetAttributeByUnit(AAttribute:TNTFSDiskAttribute; const AUnit:Int64; var AInstance:LongWord):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateAttribute(AType:LongWord; AVersion:Word; ANew:Boolean):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyAttribute(AAttribute:TNTFSDiskAttribute):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewAttribute(APrevious:TNTFSDiskAttribute; AType:LongWord; const AName:String; AVersion:Word):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetAttribute(AType:LongWord; const AName:String; AInstance:Integer):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveAttribute(AAttribute:TNTFSDiskAttribute):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function MoveAttribute(ADest:TNTFSDiskRecord; AAttribute:TNTFSDiskAttribute):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RenameAttribute(AAttribute:TNTFSDiskAttribute; const AName:String):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function FileReference:Int64;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function BaseReference:Int64;</code>
 +
| File reference to the base FILE record
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function LinkCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function StreamCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RecordCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function AttributeCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RecordFree:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function AttributeSize(AVersion:Word; AType:LongWord):LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedOffset(AVersion:Word):Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedSequenceOffset(AVersion:Word):Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedSequenceLength(ASectorSize:Word):Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedStreamUsed(AVersion:Word; AAttribute:TNTFSDiskAttribute):Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadAttributes(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteAttributes(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word; AFree:Boolean):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk index'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskIndex = class(TLinkedObjBtree)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Index of INDX records.
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(AKeyLocal:TMutexHandle; ALock:TSynchronizerHandle; AVolumeVersion,ASectorSize:Word; AIndexType,ACollateRule:LongWord; AAttribute:TNTFSDiskAttribute);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FKeyLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FStatus:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FSectorSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FVolumeVersion:Word;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FIndexType:LongWord;</code>
 +
| Attribute Type (Or None if Data Index)
 +
|-
 +
| <code>FCollateRule:LongWord;</code>
 +
| Collation Rule
 +
|-
 +
| <code>FIndexRecordSize:LongWord;</code>
 +
| Size of Index Allocation Entry (bytes)
 +
|-
 +
| <code>FIndexCounterOffset:LongWord;</code>
 +
| Index Record Number increment
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FClustersPerIndex:LongWord;</code>
 +
| Clusters per INDX Record or 0 if less than cluster size
 +
|-
 +
| <code>FIndexsPerCluster:LongWord;</code>
 +
| INDX Records per Cluster or 0 if more than cluster size
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FIndexCounterShift:Word;</code>
 +
| Shift count for Record -> Counter
 +
|-
 +
| <code>FIndexRecordShiftCount:Word;</code>
 +
| Shift count for Record -> VCN
 +
|-
 +
| <code>FIndexRecordOffsetMask:Int64;</code>
 +
| Mask for Record offset calculation
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FTotalIndexRecordCount:Int64;</code>
 +
| Total number of index records in index
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FLastFreeIndexRecord:Int64;</code>
 +
| Or ntfsUnknownRecordNumber if not known
 +
|-
 +
| <code>FFreeIndexRecordCount:Int64;</code>
 +
| Or ntfsUnknownRecordNumber if not known
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FCompareSecurityDescriptor:TNTFSCompareSecurityDescriptor;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FUpCase:TNTFSUpCase;</code>
 +
| Uppercase Conversion Table
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FNodes:TNTFSDiskNodes;</code>
 +
| List of index nodes
 +
|-
 +
| <code>FAttribute:TNTFSDiskAttribute;</code>
 +
| Attribute owning this index
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetNodesLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetKeyLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetNodeLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetLoaded:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetLoaded(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetChanged:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetUpCase:PNTFSUpCaseData;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetRootNode:TNTFSDiskNode;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateNodes(ANew:Boolean):TNTFSDiskNodes;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CompareKey(AEntry1,AEntry2:Pointer; ASize1,ASize2:Word):Integer;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CompareBinary(AEntry1,AEntry2:Pointer; ASize1,ASize2:Word):Integer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CompareFileName(AEntry1,AEntry2:PWideChar; ASize1,ASize2:Word):Integer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CompareUnicode(AEntry1,AEntry2:PWideChar; ASize1,ASize2:Word):Integer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CompareLongWord(AEntry1,AEntry2:LongWord; ASize1,ASize2:Word):Integer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CompareSID(AEntry1,AEntry2:PSID; ASize1,ASize2:Word):Integer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CompareSecurityHash(AEntry1,AEntry2:PNTFSSecurityHashKeyData; ASize1,ASize2:Word):Integer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CompareGUID(AEntry1,AEntry2:PGUID; ASize1,ASize2:Word):Integer;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>function GetEnd(AEntry:TBtreeObject):TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetStart(AEntry:TBtreeObject):TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetBlank(AEntry:TBtreeObject):TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetMedian(AEntry:TBtreeObject):TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetDropTest(AEntry:TBtreeObject; var ALeft:Boolean):TBtreeObject;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetDrop(AEntry:TBtreeObject; var ALeft:Boolean):TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetMerge(AEntry:TBtreeObject):TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetBorrow(AEntry:TBtreeObject):TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetTarget(ADrop:TBtreeObject; ALeft:Boolean):TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function PushNode(AEntry:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function SplitNode(AEntry:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DropNode(AEntry,ADrop,ATarget:TBtreeObject; ALeft:Boolean):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DropNodeOld(AEntry,ADrop:TBtreeObject; ALeft:Boolean):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function MergeNode(AEntry,AMerge:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function BorrowEntry(AEntry,ABorrow:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function SwapEntry(AEntry,ASwap:TBtreeObject;ALeft:Boolean):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function SetParentEntry(AEntry,AParent:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function DeleteBlank(ABlank:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AttachBlank(ABlank:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DetachBlank(ABlank:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AttachEntry(AEntry:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DetachEntry(AEntry:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RequirePush(AEntry:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RequireSplit(AEntry:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RequireDrop(AEntry:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RequireMerge(AEntry:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RequireBorrow(AEntry:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Loaded:Boolean read GetLoaded write SetLoaded;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Changed:Boolean read GetChanged;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property SectorSize:Word read FSectorSize write FSectorSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property VolumeVersion:Word read FVolumeVersion;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property IndexType:LongWord read FIndexType write FIndexType;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property CollateRule:LongWord read FCollateRule write FCollateRule;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IndexRecordSize:LongWord read FIndexRecordSize write FIndexRecordSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IndexCounterOffset:LongWord read FIndexCounterOffset write FIndexCounterOffset;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property ClustersPerIndex:LongWord read FClustersPerIndex write FClustersPerIndex;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IndexsPerCluster:LongWord read FIndexsPerCluster write FIndexsPerCluster;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property IndexCounterShift:Word read FIndexCounterShift write FIndexCounterShift;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IndexRecordShiftCount:Word read FIndexRecordShiftCount write FIndexRecordShiftCount;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IndexRecordOffsetMask:Int64 read FIndexRecordOffsetMask write FIndexRecordOffsetMask;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property TotalIndexRecordCount:Int64 read FTotalIndexRecordCount write FTotalIndexRecordCount;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property LastFreeIndexRecord:Int64 read FLastFreeIndexRecord write FLastFreeIndexRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property FreeIndexRecordCount:Int64 read FFreeIndexRecordCount write FFreeIndexRecordCount;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property CompareSecurityDescriptor:TNTFSCompareSecurityDescriptor read FCompareSecurityDescriptor write FCompareSecurityDescriptor;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property UpCase:TNTFSUpCase read FUpCase write FUpCase;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Nodes:TNTFSDiskNodes read FNodes;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Attribute:TNTFSDiskAttribute read FAttribute;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property RootNode:TNTFSDiskNode read GetRootNode;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function NodeCount:Integer;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyKey(AKey:TNTFSDiskKey):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewKeyEx(AKey,AData,APadding:Pointer; AKeySize,ADataSize,APaddingSize:Word):TNTFSDiskKey; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function AddKey(AParent,AKey:TNTFSDiskKey):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function InsertKey(AKey:TNTFSDiskKey):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveKey(AKey:TNTFSDiskKey):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateNode(ANew:Boolean):TNTFSDiskNode;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyNode(ANode:TNTFSDiskNode):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewNode(const ARecordNumber:Int64):TNTFSDiskNode;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetNode(const ARecordNumber:Int64):TNTFSDiskNode;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DeleteNode(ANode:TNTFSDiskNode):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveNode(ANode:TNTFSDiskNode):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateNodes(AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function FindKey(AValue:Pointer; ASize:Word):TNTFSDiskKey; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadRoot(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteRoot(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadKeys(AParent:TNTFSDiskKey; ANode:TNTFSDiskNode; ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteKeys(AParent:TNTFSDiskKey; ANode:TNTFSDiskNode; ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReaderLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReaderUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriterLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriterUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 +
'''NTFS data index'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDataIndex = class(TNTFSDiskIndex)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>function CompareSecurityDescriptor(AHash1,AHash2,ASecurityId:LongWord; ADescriptor:Pointer; ASize:Word):Integer;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Find(AValue:Pointer; ASize:Word; ACurrent:TNTFSDataKey):TNTFSDataKey;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function FindEx(AValue:Pointer; ASize:Word; AHash:LongWord; ACurrent:TNTFSDataKey):TNTFSDataKey;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>function CreateBlank:TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Compare(AEntry1,AEntry2:TBtreeObject):Integer; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetKeyBySID(ASID:PSID):TNTFSDiskKey;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetKeyByOwner(AOwner:LongWord):TNTFSDiskKey;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetKeyByObjectId(const AObjectId:TGUID):TNTFSDiskKey;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetKeyBySecurity(ASecurity:TNTFSSecurity):TNTFSDiskKey;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetKeyByReparse(AReparseTag:LongWord; const AFileReference:Int64):TNTFSDiskKey;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function FindKey(AValue:Pointer;ASize:Word):TNTFSDiskKey; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS padded index'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSPaddedIndex = class(TNTFSDataIndex)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: A DataIndex that allows a block of Padding to be specified.
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>function CreateBlank:TBtreeObject; override;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>function CreateBlank:TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewKeyEx(AKey,AData,APadding:Pointer; AKeySize,ADataSize,APaddingSize:Word):TNTFSDiskKey; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS attribute index'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSAttributeIndex = class(TNTFSDiskIndex)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>function Find(AValue:Pointer; ASize:Word; ACurrent:TNTFSAttributeKey):TNTFSAttributeKey;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>function CreateBlank:TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Compare(AEntry1,AEntry2:TBtreeObject):Integer; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetKeyByFileName(const AFileName:String):TNTFSDiskKey;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function NewKeyByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSDiskKey;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetKeyByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSDiskKey;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function FindKey(AValue:Pointer; ASize:Word):TNTFSDiskKey; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk nodes'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskNodes = class(TFileSysListEx)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ANodeLocal:TMutexHandle; ALock:TSynchronizerHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FNodeLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetModified:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetModified(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Modified:Boolean read GetModified write SetModified;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function TotalSize:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function NodeCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk node'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskNode = class(TListObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Represents an INDX record header.
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AIndex:TNTFSDiskIndex);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLocalLock:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FStatus:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FIndexFlags:Word;</code>
 +
| Flags (See Consts)
 +
|-
 +
| <code>FIndexSize:LongWord;</code>
 +
| Total size of the Index Entries
 +
|-
 +
| <code>FIndexAllocated:LongWord;</code>
 +
| Allocated size of the Index Entries
 +
|-
 +
| <code>FEntryOffset:LongWord;</code>
 +
| Offset to first Index Entry
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FRecordNumber:Int64;</code>
 +
| Number of this INDX record in the Index Allocation
 +
|-
 +
| <code>FUpdateSequenceOffset:Word;</code>
 +
| Offset to the Update Sequence Record
 +
|-
 +
| <code>FUpdateSequenceLength:Word;</code>
 +
| Size in words of the Update Sequence Record
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FUpdateSequenceNumber:Word;</code>
 +
| Update Sequence Number
 +
|-
 +
| <code>FLogFileSequenceNumber:Int64;</code>
 +
| LogFile sequence number
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FIndex:TNTFSDiskIndex;</code>
 +
| Index owning this node
 +
|-
 +
| <code>FBlank:TNTFSDiskKey;</code>
 +
| Blank key of this node (Blank keys do not move)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AcquireLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetAdded:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetAdded(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetDeleted:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetDeleted(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetChanged:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetChanged(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetModified:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetModified(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetIsRoot:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetHasSubNodes:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetHasSubNodes(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetStart:TNTFSDiskKey;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Added:Boolean read GetAdded write SetAdded;</code>
 +
| Index record to be allocated
 +
|-
 +
| <code>property Deleted:Boolean read GetDeleted write SetDeleted;</code>
 +
| Index record to be deallocated
 +
|-
 +
| <code>property Changed:Boolean read GetChanged write SetChanged;</code>
 +
| Index record to be updated
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Modified:Boolean read GetModified write SetModified;</code>
 +
| Index record has been added, deleted or changed
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property IsRoot:Boolean read GetIsRoot;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property HasSubNodes:Boolean read GetHasSubNodes write SetHasSubNodes;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property IndexFlags:Word read FIndexFlags write FIndexFlags;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IndexSize:LongWord read FIndexSize write FIndexSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IndexAllocated:LongWord read FIndexAllocated write FIndexAllocated;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property EntryOffset:LongWord read FEntryOffset write FEntryOffset;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property RecordNumber:Int64 read FRecordNumber write FRecordNumber;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property UpdateSequenceOffset:Word read FUpdateSequenceOffset write FUpdateSequenceOffset;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property UpdateSequenceLength:Word read FUpdateSequenceLength write FUpdateSequenceLength;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property UpdateSequenceNumber:Word read FUpdateSequenceNumber write FUpdateSequenceNumber;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property LogFileSequenceNumber:Int64 read FLogFileSequenceNumber write FLogFileSequenceNumber;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Index:TNTFSDiskIndex read FIndex;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Blank:TNTFSDiskKey read FBlank write FBlank;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Start:TNTFSDiskKey read GetStart;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function KeyCount:Integer;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function IndexFree:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateKeys(AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedOffset(AVersion:Word):LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedAllocated(AVersion:Word):LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedSequenceOffset(AVersion:Word):Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedSequenceLength(ASectorSize:Word):Word;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function WriteEmpty(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word; var AUpdateSequenceOffset,AUpdateSequenceLength:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadHeader(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteHeader(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk key'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskKey = class(TBtreeObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Represents an INDX record entry.
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLocalLock:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FStatus:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FKey:Pointer;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FEntryFlags:Word;</code>
 +
| Flags (See Consts)
 +
|-
 +
| <code>FEntrySize:Word;</code>
 +
| Length of the index entry
 +
|-
 +
| <code>FKeySize:Word;</code>
 +
| Length of the key entry
 +
|-
 +
| <code>FSubNodeNumber:Int64;</code>
 +
| Number of the sub-node in the index allocation attribute
 +
|-
 +
|colspan="2"|&nbsp; 
 +
|-
 +
| <code>FNode:TNTFSDiskNode;</code>
 +
| Index node of this key
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AcquireLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetChanged:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetChanged(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetHasSubNode:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetHasSubNode(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsLastNode:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsLastNode(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetKeySize(ASize:Word); virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetSubNodeNumber(const ANodeNumber:Int64);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetNode(ANode:TNTFSDiskNode);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Changed:Boolean read GetChanged write SetChanged;</code>
 +
| Index record to be updated
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property HasSubNode:Boolean read GetHasSubNode write SetHasSubNode;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsLastNode:Boolean read GetIsLastNode write SetIsLastNode;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Key:Pointer read FKey;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property EntryFlags:Word read FEntryFlags write FEntryFlags;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property EntrySize:Word read FEntrySize write FEntrySize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property KeySize:Word read FKeySize write SetKeySize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property SubNodeNumber:Int64 read FSubNodeNumber write SetSubNodeNumber;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Node:TNTFSDiskNode read FNode write SetNode;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):Word; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS data key'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDataKey = class(TNTFSDiskKey)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FData:Pointer;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FDataSize:Word;</code>
 +
| Size of the data (Only valid when the last entry flag is not set)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetKeySize(ASize:Word); override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetData(AData:Pointer);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetDataSize(ASize:Word);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Data:Pointer read FData write SetData;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property DataSize:Word read FDataSize write SetDataSize;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function DataOffset:Word;</code>
 +
| Offset to the data (Only valid when the last entry flag is not set)
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):Word; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 +
'''NTFS padded key'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSPaddedKey = class(TNTFSDataKey)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FPadding:Pointer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FPaddingSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetPadding(APadding:Pointer);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetPaddingSize(ASize:Word);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Padding:Pointer read FPadding write SetPadding;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property PaddingSize:Word read FPaddingSize write SetPaddingSize;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS attribute key'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSAttributeKey = class(TNTFSDiskKey)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FFileReference:Int64;</code>
 +
| File reference (Only valid when the last entry flag is not set)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FAttribute:TNTFSDiskAttribute;</code>
 +
| Indexed attribute of this key
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetInvalid:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetInvalid(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetKeySize(ASize:Word); override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetAttribute(AAttribute:TNTFSDiskAttribute);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Invalid:Boolean read GetInvalid write SetInvalid;</code>
 +
| Key points to invalid file record or attribute
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property FileReference:Int64 read FFileReference write FFileReference;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Attribute:TNTFSDiskAttribute read FAttribute write SetAttribute;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateKey:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RecordNumber:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):Word; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk runs'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskRuns = class(TFileSysListEx)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ARunLocal:TMutexHandle; ALock:TSynchronizerHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FRunLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FRecent:TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FRecentVCN:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetStart:TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetFinal:TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Recent:TNTFSDiskRun read FRecent write FRecent;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property RecentVCN:Int64 read FRecentVCN write FRecentVCN;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function SparseCount:Int64;</code>
 +
| Count of sparse runs in list
 +
|-
 +
| <code>function ClusterCount:Int64;</code>
 +
| Count of normal runs in list
 +
|-
 +
| <code>function AllocatedCount:Int64;</code>
 +
| Count of allocated runs in list
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function TotalSize:LongWord;</code>
 +
| Total size of the encoded data runs
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RunCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk run'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskRun = class(TListObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLocalLock:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FStart:Int64;</code>
 +
| Run start logical cluster
 +
|-
 +
| <code>FOffset:Int64;</code>
 +
| Run start cluster offset
 +
|-
 +
| <code>FLength:Int64;</code>
 +
| Run length in clusters
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FAttribute:TNTFSDiskAttribute;</code>
 +
| Attribute owning this run
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AcquireLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetIsLast:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsSparse:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetOffsetSize:Byte;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetLengthSize:Byte;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetStart(const AStart:Int64);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetOffset(const AOffset:Int64);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetSuccessor:TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetPredecessor:TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property IsLast:Boolean read GetIsLast;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsSparse:Boolean read GetIsSparse;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Start:Int64 read FStart write SetStart;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Offset:Int64 read FOffset write SetOffset;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Length:Int64 read FLength write FLength;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Attribute:TNTFSDiskAttribute read FAttribute;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RunSize:LongWord; </code>
 +
| Size of the encoded data run
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateRun:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadRun(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteRun(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk items'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskItems = class(TFileSysListEx)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(AItemLocal:TMutexHandle; ALock:TSynchronizerHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FItemLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FStatus:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetLoaded:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetLoaded(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetPrevious(AItem:TNTFSDiskItem):TNTFSDiskItem;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Loaded:Boolean read GetLoaded write SetLoaded;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function TotalSize:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ItemCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk item'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskItem = class(TListObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of attribute $ATTRIBUTE_LIST
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskAttribute);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLocalLock:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FStatus:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FItemSize:Word;</code>
 +
| Record length
 +
|-
 +
| <code>FStartVCN:Int64;</code>
 +
| Starting VCN if non resident
 +
|-
 +
| <code>FFileReference:Int64;</code>
 +
| File Reference of the attribute
 +
|-
 +
| <code>FAttributeType:LongWord;</code>
 +
| Attribute Type
 +
|-
 +
| <code>FAttributeId:Word;</code>
 +
| Attribute Id
 +
|-
 +
| <code>FAttributeName:String;</code>
 +
| Name in Unicode (if NameLength > 0)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FParent:TNTFSDiskAttribute;</code>
 +
| Attribute list owning this item
 +
|-
 +
| <code>FAttribute:TNTFSDiskAttribute;</code>
 +
| Attribute pointed to by this item
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FAttributeHash:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AcquireLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetInvalid:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetInvalid(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetAttributeName:String;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetAttributeName(const AAttributeName:String);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetAttribute(AAttribute:TNTFSDiskAttribute);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Compare(AItem:TNTFSDiskItem):Integer; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Invalid:Boolean read GetInvalid write SetInvalid;</code>
 +
| Item points to invalid file record or attribute
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property ItemSize:Word read FItemSize write FItemSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property StartVCN:Int64 read FStartVCN write FStartVCN;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property FileReference:Int64 read FFileReference write FFileReference;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AttributeType:LongWord read FAttributeType write FAttributeType;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AttributeId:Word read FAttributeId write FAttributeId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AttributeName:String read GetAttributeName write SetAttributeName;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Parent:TNTFSDiskAttribute read FParent;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Attribute:TNTFSDiskAttribute read FAttribute write SetAttribute;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property AttributeHash:LongWord read FAttributeHash;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RecordNumber:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AttributeNameSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function AttributeNameLength:Byte;</code>
 +
| Name length
 +
|-
 +
| <code>function AttributeNameOffset:Byte;</code>
 +
| Offset to Name
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateItem:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):Word;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk attributes'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskAttributes = class(TFileSysListEx)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(AAttributeLocal:TMutexHandle; ALock:TSynchronizerHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FAttributeLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetPrevious(AAttribute:TNTFSDiskAttribute):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function TotalSize:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AttributeCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 +
'''NTFS disk attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskAttribute = class(TListObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLocalLock:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>FStatus:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FData:Pointer;</code>
 +
| Only applicable if attribute is resident
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FAttributeType:LongWord;</code>
 +
| Attribute Type (e.g. 0x80, 0xA0)
 +
|-
 +
| <code>FAttributeSize:LongWord;</code>
 +
| Length of the Attribute (including header)
 +
|-
 +
| <code>FAttributeFlags:Word;</code>
 +
| Attribute Flags
 +
|-
 +
| <code>FAttributeId:Word;</code>
 +
| Attribute Id
 +
|-
 +
| <code>FAttributeName:String;</code>
 +
| Attribute Name
 +
|-
 +
| <code>FNonResident:Byte;</code>
 +
| Non-resident flag
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FIndexed:Byte;</code>
 +
| Indexed flag
 +
|-
 +
| <code>FDataSize:LongWord;</code>
 +
| Length of the Attribute Data
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FStartVCN:Int64;</code>
 +
| Starting VCN
 +
|-
 +
| <code>FLastVCN:Int64;</code>
 +
| Last VCN
 +
|-
 +
| <code>FStreamSize:Int64;</code>
 +
| Real size of the attribute
 +
|-
 +
| <code>FStreamUsed:Int64;</code>
 +
| The actual Allocated size of the attribute (Only present when compressed and only in the first instance)
 +
|-
 +
| <code>FStreamAllocated:Int64;</code>
 +
| Allocated size of the attribute
 +
|-
 +
| <code>FInitializedSize:Int64;</code>
 +
| Initialized data size of the stream (Portion which has been Written)
 +
|-
 +
| <code>FCompressionUnit:Word;</code>
 +
| Compression Unit Size
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FRuns:TNTFSDiskRuns;</code>
 +
| List of runs of this attribute
 +
|-
 +
| <code>FItems:TNTFSDiskItems;</code>
 +
| List of items of this attribute
 +
|-
 +
| <code>FIndex:TNTFSDiskIndex;</code>
 +
| Index of this attribute if applicable
 +
|-
 +
| <code>FParent:TNTFSDiskRecord;</code>
 +
| Record owning this attribute
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FAttributeHash:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AcquireLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetRunsLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetItemsLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIndexLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetExtendedsLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetRunLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetItemLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetKeyLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetExtendedLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetUpdating:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetUpdating(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetIsFixed:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsSingle:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsUnlisted:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsUnmovable:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsManaged:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetIsSparse:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsSparse(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsEncrypted:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsEncrypted(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsCompressed:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsCompressed(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetAttributeName:String;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetAttributeName(const AAttributeName:String);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetDataSize:LongWord; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetDataSize(AValue:LongWord); virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Compare(AAttribute:TNTFSDiskAttribute):Integer; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateRuns(ANew:Boolean):TNTFSDiskRuns;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CreateItems(ANew:Boolean):TNTFSDiskItems;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetRecord(AInstance:Integer):TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetAttribute(AType:LongWord; const AName:String; AInstance:Integer):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Updating:Boolean read GetUpdating write SetUpdating;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property IsFixed:Boolean read GetIsFixed;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsSingle:Boolean read GetIsSingle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsUnlisted:Boolean read GetIsUnlisted;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsUnmovable:Boolean read GetIsUnmovable;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsManaged:Boolean read GetIsManaged;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property IsSparse:Boolean read GetIsSparse write SetIsSparse;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsEncrypted:Boolean read GetIsEncrypted write SetIsEncrypted;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsCompressed:Boolean read GetIsCompressed write SetIsCompressed;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Data:Pointer read FData;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property AttributeType:LongWord read FAttributeType;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AttributeSize:LongWord read FAttributeSize write FAttributeSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AttributeFlags:Word read FAttributeFlags write FAttributeFlags;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AttributeId:Word read FAttributeId write FAttributeId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AttributeName:String read GetAttributeName write SetAttributeName;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property NonResident:Byte read FNonResident write FNonResident;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Indexed:Byte read FIndexed write FIndexed;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property DataSize:LongWord read GetDataSize write SetDataSize;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property StartVCN:Int64 read FStartVCN write FStartVCN;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property LastVCN:Int64 read FLastVCN write FLastVCN;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property StreamSize:Int64 read FStreamSize write FStreamSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property StreamUsed:Int64 read FStreamUsed write FStreamUsed;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property StreamAllocated:Int64 read FStreamAllocated write FStreamAllocated;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property InitializedSize:Int64 read FInitializedSize write FInitializedSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property CompressionUnit:Word read FCompressionUnit write FCompressionUnit;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Runs:TNTFSDiskRuns read FRuns;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Items:TNTFSDiskItems read FItems;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Index:TNTFSDiskIndex read FIndex;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Parent:TNTFSDiskRecord read FParent write FParent;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property AttributeHash:LongWord read FAttributeHash;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetRunCount(const AVCN:Int64; var AStartVCN,ACount:Int64):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetRunLength(const AVCN:Int64; var AStartVCN,ALength:Int64):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetRunByUnit(const AUnit:Int64; var AStartVCN:Int64):TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetRunByCluster(const ACluster:Int64; var AStartVCN:Int64):TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateRun(ANew:Boolean):TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyRun(ARun:TNTFSDiskRun):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewRun(const AStart,ALength:Int64):TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function InsertRun(APrev:TNTFSDiskRun; const AStart,ALength:Int64):TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetRun(const AVCN:Int64; var AStartVCN:Int64):TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetRunOld(const AVCN:Int64; var AStartVCN:Int64):TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function MergeRun(ARun:TNTFSDiskRun):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function SplitRun(ARun:TNTFSDiskRun; const ALength:Int64):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveRun(ARun:TNTFSDiskRun):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function MoveRun(ADest:TNTFSDiskAttribute; ARun:TNTFSDiskRun):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetItemByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSDiskItem;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateItem(ANew:Boolean):TNTFSDiskItem;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyItem(AItem:TNTFSDiskItem):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewItem(AAttribute:TNTFSDiskAttribute):TNTFSDiskItem;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetItem(AType:LongWord; const AName:String; AInstance:Integer):TNTFSDiskItem;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveItem(AItem:TNTFSDiskItem):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function MoveItem(AItem:TNTFSDiskItem; AAttribute:TNTFSDiskAttribute):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RenameItem(AItem:TNTFSDiskItem; AAttribute:TNTFSDiskAttribute):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateIndex(AVersion,ASector:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewIndex(AVersion,ASector:Word; AType,ARule,ASize,AOffset:LongWord):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RecordNumber:Int64;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function FileReference:Int64;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function BaseReference:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RunOffset:Word;</code>
 +
| Offset to the Data Run
 +
|-
 +
| <code>function DataOffset:Word;</code>
 +
| Offset to the Attribute Data
 +
|-
 +
| <code>function AttributeNameSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function AttributeNameLength:Byte;</code>
 +
| Name length
 +
|-
 +
| <code>function AttributeNameOffset:Word;</code>
 +
| Offset to the Name
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RunCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ItemCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):LongWord; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedDataSize(AVersion:Word):LongWord; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedStreamUsed(AVersion:Word):Int64; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CoalesceRun(ARun:TNTFSDiskRun):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateRun(ARun:TNTFSDiskRun):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateKey(AKey:TNTFSDiskKey):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateItem(AItem:TNTFSDiskItem):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadRuns(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteRuns(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 +
'''NTFS standard information attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSStandardInformationAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FCreateTime:TFileTime;</code>
 +
| File Creation
 +
|-
 +
| <code>FWriteTime:TFileTime;</code>
 +
| File Altered
 +
|-
 +
| <code>FChangeTime:TFileTime;</code>
 +
| MFT Changed
 +
|-
 +
| <code>FAccessTime:TFileTime;</code>
 +
| File Read
 +
|-
 +
| <code>FAttributes:LongWord;</code>
 +
| DOS File Permissions
 +
|-
 +
| <code>FMaxVersions:LongWord;</code>
 +
| Maximum Number of Versions
 +
|-
 +
| <code>FVersionNo:LongWord;</code>
 +
| Version Number
 +
|-
 +
| <code>FClassId:LongWord;</code>
 +
| Class Id
 +
|-
 +
| <code>FOwnerId:LongWord;</code>
 +
| Owner Id
 +
|-
 +
| <code>FSecurityId:LongWord;</code>
 +
| Security Id
 +
|-
 +
| <code>FQuotaCharge:Int64;</code>
 +
| Quota Charged
 +
|-
 +
| <code>FUpdateSequenceNumber:Int64;</code>
 +
| Update Sequence Number
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property CreateTime:TFileTime read FCreateTime write FCreateTime;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property WriteTime:TFileTime read FWriteTime write FWriteTime;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ChangeTime:TFileTime read FChangeTime write FChangeTime;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AccessTime:TFileTime read FAccessTime write FAccessTime;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Attributes:LongWord read FAttributes write FAttributes;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property MaxVersions:LongWord read FMaxVersions write FMaxVersions;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property VersionNo:LongWord read FVersionNo write FVersionNo;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ClassId:LongWord read FClassId write FClassId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property OwnerId:LongWord read FOwnerId write FOwnerId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property SecurityId:LongWord read FSecurityId write FSecurityId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property QuotaCharge:Int64 read FQuotaCharge write FQuotaCharge;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property UpdateSequenceNumber:Int64 read FUpdateSequenceNumber write FUpdateSequenceNumber;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS attribute list'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSAttributeListAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS file name attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSFileNameAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FParentReference:Int64;</code>
 +
| File reference to the parent directory
 +
|-
 +
| <code>FCreateTime:TFileTime;</code>
 +
| C Time - File Creation
 +
Note: These fields are only updated when the filename is changed (See Standard Information instead)
 +
|-
 +
| <code>FWriteTime:TFileTime;</code>
 +
| A Time - File Altered
 +
Note: These fields are only updated when the filename is changed (See Standard Information instead)
 +
|-
 +
| <code>FChangeTime:TFileTime;</code>
 +
| M Time - MFT Changed
 +
Note: These fields are only updated when the filename is changed (See Standard Information instead)
 +
|-
 +
| <code>FAccessTime:TFileTime;</code>
 +
| R Time - File Read
 +
Note: These fields are only updated when the filename is changed (See Standard Information instead)
 +
|-
 +
| <code>FFileAllocated:Int64;</code>
 +
| Allocated size of the file (As for CreateTime/WriteTime/ChangeTime etc)
 +
|-
 +
| <code>FFileSize:Int64;</code>
 +
| Real size of the file (As for CreateTime/WriteTime/ChangeTime etc)
 +
|-
 +
| <code>FFileFlags:LongWord;</code>
 +
| Flags, e.g. Directory, compressed, hidden (As for CreateTime/WriteTime/ChangeTime etc)
 +
|-
 +
| <code>FReparseTag:LongWord;</code>
 +
| Used by EAs and Reparse
 +
|-
 +
| <code>FNameSpace:Byte;</code>
 +
| Filename namespace
 +
|-
 +
| <code>FFileName:String;</code>
 +
| File name
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FFileHash:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetFileName:String;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetFileName(const AFileName:String);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property ParentReference:Int64 read FParentReference write FParentReference;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property CreateTime:TFileTime read FCreateTime write FCreateTime;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property WriteTime:TFileTime read FWriteTime write FWriteTime;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ChangeTime:TFileTime read FChangeTime write FChangeTime;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AccessTime:TFileTime read FAccessTime write FAccessTime;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property FileAllocated:Int64 read FFileAllocated write FFileAllocated;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property FileSize:Int64 read FFileSize write FFileSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property FileFlags:LongWord read FFileFlags write FFileFlags;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ReparseTag:LongWord read FReparseTag write FReparseTag;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property NameSpace:Byte read FNameSpace write FNameSpace;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property FileName:String read GetFileName write SetFileName;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property FileHash:LongWord read FFileHash;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function FileNameSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function FileNameLength:Byte;</code>
 +
| Filename length in characters
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ParentRecord:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS object Id attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSObjectIdAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FObjectId:TGUID;</code>
 +
| GUID Object Id Unique Id assigned to file
 +
|-
 +
| <code>FBirthVolumeId:TGUID;</code>
 +
| GUID Birth Volume Id Volume where file was created
 +
|-
 +
| <code>FBirthObjectId:TGUID;</code>
 +
| GUID Birth Object Id Original Object Id of file
 +
|-
 +
| <code>FDomainId:TGUID;</code>
 +
| GUID Domain Id Domain in which object was created
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property ObjectId:TGUID read FObjectId write FObjectId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property BirthVolumeId:TGUID read FBirthVolumeId write FBirthVolumeId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property BirthObjectId:TGUID read FBirthObjectId write FBirthObjectId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property DomainId:TGUID read FDomainId write FDomainId;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 +
'''NTFS volume version attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSVolumeVersionAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS security descriptor attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSSecurityDescriptorAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: This is the same structure that is used for all security in Windows (File/Kernel/Registry etc). See TSecurityDescriptor and associated values in Security unit for more information.
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FSecurity:TNTFSSecurity;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Security:TNTFSSecurity read FSecurity;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateSecurity:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewSecurity(ASecurity:TNTFSSecurity):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS volume name attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSVolumeNameAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FVolumeName:String;</code>
 +
| Volume name
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetVolumeName:String;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetVolumeName(const AVolumeName:String);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property VolumeName:String read GetVolumeName write SetVolumeName;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS volume information attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSVolumeInformationAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FMajorVersion:Byte;</code>
 +
| Major version number
 +
|-
 +
| <code>FMinorVersion:Byte;</code>
 +
| Minor version number
 +
|-
 +
| <code>FVolumeFlags:Word;</code>
 +
| Flags
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property MajorVersion:Byte read FMajorVersion write FMajorVersion;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property MinorVersion:Byte read FMinorVersion write FMinorVersion;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property VolumeFlags:Word read FVolumeFlags write FVolumeFlags;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS data attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDataAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS index root attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSIndexRootAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FIndexType:LongWord;</code>
 +
| Attribute Type
 +
|-
 +
| <code>FCollateRule:LongWord;</code>
 +
| Collation Rule
 +
|-
 +
| <code>FIndexRecordSize:LongWord;</code>
 +
| Size of Index Allocation Entry (bytes)
 +
|-
 +
| <code>FIndexCounterOffset:LongWord;</code>
 +
| Index Record Number increment
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property IndexType:LongWord read FIndexType write FIndexType;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property CollateRule:LongWord read FCollateRule write FCollateRule;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IndexRecordSize:LongWord read FIndexRecordSize write FIndexRecordSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IndexCounterOffset:LongWord read FIndexCounterOffset write FIndexCounterOffset;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateIndex(AVersion,ASector:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewIndex(AVersion,ASector:Word; AType,ARule,ASize,AOffset:LongWord):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS index allocation attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSIndexAllocationAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS bitmap attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSBitmapAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FBitmap:Pointer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FBitmapSize:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetBitmapSize(AValue:LongWord);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Bitmap:Pointer read FBitmap;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property BitmapSize:LongWord read FBitmapSize write SetBitmapSize;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 +
'''NTFS reparse point attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSReparsePointAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FReparseTag:LongWord;</code>
 +
| Reparse Type (and Flags)
 +
|-
 +
| <code>FReparseSize:Word;</code>
 +
| Reparse Data Length
 +
|-
 +
| <code>FReparseGUID:TGUID;</code>
 +
| Reparse GUID
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FReparse:TNTFSReparse;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetIsAlias:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsAlias(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsHighLatency:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsHighLatency(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsMicrosoft:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsMicrosoft(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property IsAlias:Boolean read GetIsAlias write SetIsAlias;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsHighLatency:Boolean read GetIsHighLatency write SetIsHighLatency;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsMicrosoft:Boolean read GetIsMicrosoft write SetIsMicrosoft;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property ReparseTag:LongWord read FReparseTag write FReparseTag;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ReparseSize:Word read FReparseSize write FReparseSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ReparseGUID:TGUID read FReparseGUID write FReparseGUID;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Reparse:TNTFSReparse read FReparse;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateReparse:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewReparse(AReparseTag:LongWord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS symbolic link attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSSymbolicLinkAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS extended attribute information'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSExtendedAttrInformationAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FPackedSize:Word;</code>
 +
| Size of the packed Extended Attributes
 +
|-
 +
| <code>FFlagCount:Word;</code>
 +
| Number of Extended Attributes with NEED_EA
 +
|-
 +
| <code>FUnpackedSize:LongWord;</code>
 +
| Size of the unpacked Extended Attributes
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property PackedSize:Word read FPackedSize write FPackedSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property FlagCount:Word read FFlagCount write FFlagCount;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property UnpackedSize:LongWord read FUnpackedSize write FUnpackedSize;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS extended attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSExtendedAttrAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FExtendeds:TNTFSExtendeds;</code>
 +
| List of attributes of this attribute
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Extendeds:TNTFSExtendeds read FExtendeds;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateExtended:TNTFSExtended;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyExtended(AExtended:TNTFSExtended):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewExtended(const AName:String):TNTFSExtended;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetExtended(const AName:String):TNTFSExtended;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveExtended(AExtended:TNTFSExtended):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ExtendedCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadExtendeds(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteExtendeds(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS property set attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSPropertySetAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS logged utility stream attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSLoggedUtilityStreamAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS end attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSEndAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):LongWord; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedDataSize(AVersion:Word):LongWord; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS unknown attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSUnknownAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS object Id'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSObjId = class(TObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of index $O in file $ObjId (Not Used)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS quota'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSQuota = class(TObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of index $Q in file $Quota (Not Used)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS owner'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSOwner = class(TObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of index $O in file $Quota (Not Used)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS upper case'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSUpCase = class(TObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of file $UpCase
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FData:Pointer;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReaderLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReaderUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriterLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriterUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Data:Pointer read FData;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Init(AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Convert(ASource,ADest:Pointer; ASize:LongWord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadUpCase(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteUpCase(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS attribute definitions'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSAttrDefs = class(TFileSysList)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FAttrDefLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetPrevious(AAttrDef:TNTFSAttrDef):TNTFSAttrDef;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function CreateAttrDef(AType:LongWord; AVersion:Word; ANew:Boolean):TNTFSAttrDef;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyAttrDef(AAttrDef:TNTFSAttrDef):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewAttrDef(AType:LongWord; const AName:String; AVersion:Word):TNTFSAttrDef;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetAttrDef(AType:LongWord; const AName:String):TNTFSAttrDef;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetAttrDefByIndex(AIndex:Integer; AVersion:Word):TNTFSAttrDef;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetAttrDefByIndexEx(AIndex:Integer; AVersion:Word; AWrite:Boolean):TNTFSAttrDef;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetAttrDefByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSAttrDef;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveAttrDef(AAttrDef:TNTFSAttrDef):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CheckSize(AAttribute:TNTFSDiskAttribute;const ASize:Int64):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CheckIndexed(AAttribute:TNTFSDiskAttribute):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CheckResident(AAttribute:TNTFSDiskAttribute):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CheckUncompressed(AAttribute:TNTFSDiskAttribute):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function TotalSize:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AttrDefCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Init(AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadAttrDefs(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteAttrDefs(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS attribute definition'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSAttrDef = class(TListObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of file $AttrDef
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLocalLock:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FAttributeName:String;</code>
 +
| Label in Unicode
 +
|-
 +
| <code>FAttributeType:LongWord;</code>
 +
| Type
 +
|-
 +
| <code>FDisplayRule:LongWord;</code>
 +
| Display rule
 +
|-
 +
| <code>FCollateRule:LongWord;</code>
 +
| Collation rule
 +
|-
 +
| <code>FAttrDefFlags:LongWord;</code>
 +
| Flags (See Consts)
 +
|-
 +
| <code>FMinimumSize:Int64;</code>
 +
| Minimum size
 +
|-
 +
| <code>FMaximumSize:Int64;</code>
 +
| Maximum size
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FAttributeHash:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AcquireLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetAttributeName:String;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetAttributeName(const AAttributeName:String);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetIsIndexed:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsResident:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsUncompressed:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Compare(AAttrDef:TNTFSAttrDef):Integer; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property AttributeName:String read GetAttributeName write SetAttributeName;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AttributeType:LongWord read FAttributeType write FAttributeType;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property DisplayRule:LongWord read FDisplayRule write FDisplayRule;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property CollateRule:LongWord read FCollateRule write FCollateRule;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AttrDefFlags:LongWord read FAttrDefFlags write FAttrDefFlags;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property MinimumSize:Int64 read FMinimumSize write FMinimumSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property MaximumSize:Int64 read FMaximumSize write FMaximumSize;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property IsIndexed:Boolean read GetIsIndexed;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsResident:Boolean read GetIsResident;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsUncompressed:Boolean read GetIsUncompressed;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Init(AIndex:Integer;AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property AttributeHash:LongWord read FAttributeHash;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadAttrDef(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteAttrDef(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS reparse'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSReparse = class(TDiskReparse)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of attribute $REPARSE_POINT
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FData:Pointer;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FDataSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FAttribute:TNTFSDiskAttribute;</code>
 +
| Attribute owning this index
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetData(AData:Pointer); virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetDataSize:Word; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetDataSize(ASize:Word); virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Data:Pointer read FData write SetData;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property DataSize:Word read GetDataSize write SetDataSize;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Attribute:TNTFSDiskAttribute read FAttribute;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):Word; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS reparse symbolic link'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSReparseSymLink = class(TNTFSReparse)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of attribute $REPARSE_POINT (Tag 0xA000000C)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>procedure SetData(AData:Pointer); override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetDataSize(ASize:Word); override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>FPrintName:String;</code>
 +
| Path Buffer
 +
|-
 +
| <code>FSubstituteName:String;</code>
 +
| Path Buffer
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FPrintHash:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FSubstituteHash:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetTarget:String; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetPrintName:String;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetPrintName(const APrintName:String);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetSubstituteName:String;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetSubstituteName(const ASubstituteName:String);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property PrintName:String read GetPrintName write SetPrintName;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property SubstituteName:String read GetSubstituteName write SetSubstituteName;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property PrintHash:LongWord read FPrintHash;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property SubstituteHash:LongWord read FSubstituteHash;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function PrintNameSize:Word; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function PrintNameOffset:Word; virtual;</code>
 +
| Print Name Offset
 +
|-
 +
| <code>function PrintNameLength:Word; virtual;</code>
 +
| Print Name Length
 +
|-
 +
| <code>function SubstituteNameSize:Word; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function SubstituteNameOffset:Word; virtual;</code>
 +
| Substitute Name Offset
 +
|-
 +
| <code>function SubstituteNameLength:Word; virtual;</code>
 +
| Substitute Name Length
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):Word; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS reparse mount point'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSReparseMountPoint = class(TNTFSReparseSymLink)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of attribute $REPARSE_POINT (Tag 0xA0000003)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function PrintNameSize:Word; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function PrintNameOffset:Word; override;</code>
 +
| Print Name Offset
 +
|-
 +
| <code>function PrintNameLength:Word; override;</code>
 +
| Print Name Length
 +
|-
 +
| <code>function SubstituteNameSize:Word; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function SubstituteNameOffset:Word; override;</code>
 +
| Substitute Name Offset
 +
|-
 +
| <code>function SubstituteNameLength:Word; override;</code>
 +
| Substitute Name Length
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):Word; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS extendeds'''
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSExtendeds = class(TFileSysListEx)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(AExtendedLocal:TMutexHandle; ALock:TSynchronizerHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FExtendedLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function TotalSize:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ExtendedCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS extended'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSExtended = class(TListObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of attribute $EA
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLocalLock:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FExtendedOffset:LongWord;</code>
 +
| Offset to next Extended Attribute (Offset to next EA is the size of this EA)
 +
|-
 +
| <code>FExtendedFlags:Byte;</code>
 +
| Flags
 +
|-
 +
| <code>FExtendedName:String;</code>
 +
| Name Note: No offset so always in the same location (Not Unicode)
 +
|-
 +
| <code>FExtendedData:Pointer;</code>
 +
| Value
 +
|-
 +
| <code>FExtendedDataSize:Word;</code>
 +
| Value Length
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FExtendedHash:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AcquireLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetExtendedName:String;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetExtendedName(const AExtendedName:String);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetExtendedDataSize(ASize:Word);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property ExtendedOffset:LongWord read FExtendedOffset write FExtendedOffset;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ExtendedFlags:Byte read FExtendedFlags write FExtendedFlags;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ExtendedName:String read GetExtendedName write SetExtendedName;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ExtendedData:Pointer read FExtendedData;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ExtendedDataSize:Word read FExtendedDataSize write SetExtendedDataSize;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property ExtendedHash:LongWord read FExtendedHash;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ExtendedSize:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ExtendedNameSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ExtendedNameLength:Byte;</code>
 +
| Name Length
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadExtended(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteExtended(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS security items'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSSecurityItems = class(TFileSysList)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FSecurityLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetPrevious(ASecurityItem:TNTFSSecurityItem):TNTFSSecurityItem;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function CreateSecurityItem(ANew:Boolean):TNTFSSecurityItem;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroySecurityItem(ASecurityItem:TNTFSSecurityItem):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewSecurityItem(ASecurityId:LongWord; const ASecurityOffset:Int64; ASecurity:TNTFSSecurity):TNTFSSecurityItem;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetSecurityItem(ASecurityId:LongWord):TNTFSSecurityItem;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetSecurityItemEx(ASecurityId:LongWord; AWrite:Boolean):TNTFSSecurityItem;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateSecurityItem(ASecurityItem:TNTFSSecurityItem; ASecurityId:LongWord; ASecurity:TNTFSSecurity):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DeleteSecurityItem(ASecurityItem:TNTFSSecurityItem):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveSecurityItem(ASecurityItem:TNTFSSecurityItem; AFree:Boolean):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function TotalSize:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function SecurityItemCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Init(AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadSecurityItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteSecurityItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS security item'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSSecurityItem = class(TListObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of stream $SDS in file $Secure
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLocalLock:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FSecurityHash:LongWord;</code>
 +
| Hash of Security Descriptor
 +
|-
 +
| <code>FSecurityId:LongWord;</code>
 +
| Security Id
 +
|-
 +
| <code>FSecurityOffset:Int64;</code>
 +
| Offset of this entry in $SDS
 +
|-
 +
| <code>FSecuritySize:LongWord;</code>
 +
| Size of this entry in $SDS
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FSecurity:TNTFSSecurity;</code>
 +
| Self-relative Security Descriptor
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AcquireLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Compare(ASecurityItem:TNTFSSecurityItem):Integer; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CompareOld(ASecurityItem:TNTFSSecurityItem):Integer; virtual; </code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property SecurityHash:LongWord read FSecurityHash write FSecurityHash;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property SecurityId:LongWord read FSecurityId write FSecurityId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property SecurityOffset:Int64 read FSecurityOffset write FSecurityOffset;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property SecuritySize:LongWord read FSecuritySize write FSecuritySize;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Security:TNTFSSecurity read FSecurity;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateSecurity:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewSecurity(ASecurity:TNTFSSecurity):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateSecurity(ASecurity:TNTFSSecurity):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DeleteSecurity:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveSecurity(AFree:Boolean):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function MirrorOffset:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Init(ASecurityId:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadSecurityItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteSecurityItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS security'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSSecurity = class(TDiskSecurity)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of attribute $SECURITY_DESCRIPTOR and stream $SDS in file $Secure
 +
|-
 +
|colspan="2"|Note: This is the same structure that is used for all security in Windows (File/Kernel/Registry etc). See TSecurityDescriptor and associated values in Security unit for more information.
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>constructor CreateFromSecurity(ALocalLock:TMutexHandle; ASecurity:TDiskSecurity); override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>constructor CreateFromDescriptor(ALocalLock:TMutexHandle; ADescriptor:Pointer); override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FVolumeVersion:Word;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FRevision:Byte;</code>
 +
| Revision
 +
|-
 +
| <code>FControl:Word;</code>
 +
| Control Flags
 +
|-
 +
| <code>FSacl:PACL;</code>
 +
| SACL
 +
|-
 +
| <code>FDacl:PACL;</code>
 +
| DACL
 +
|-
 +
| <code>FOwner:PSID;</code>
 +
| Owner SID
 +
|-
 +
| <code>FGroup:PSID;</code>
 +
| Group SID
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetSacl(ASacl:PACL);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetDacl(ADacl:PACL);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetOwner(AOwner:PSID);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetGroup(AGroup:PSID);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetSaclSize(ASize:Word);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetDaclSize(ASize:Word);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetOwnerSize(ASize:Word);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetGroupSize(ASize:Word);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property VolumeVersion:Word read FVolumeVersion;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Revision:Byte read FRevision write FRevision;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Control:Word read FControl write FControl;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Sacl:PACL read FSacl write SetSacl;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Dacl:PACL read FDacl write SetDacl;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Owner:PSID read FOwner write SetOwner;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Group:PSID read FGroup write SetGroup;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function SaclSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DaclSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function OwnerSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GroupSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function SaclOffset:LongWord;</code>
 +
| Offset to SACL
 +
|-
 +
| <code>function DaclOffset:LongWord;</code>
 +
| Offset to DACL
 +
|-
 +
| <code>function OwnerOffset:LongWord;</code>
 +
| Offset to Owner SID
 +
|-
 +
| <code>function GroupOffset:LongWord;</code>
 +
| Offset to Group SID
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function SaclOffsetEx(ALocal:Boolean):LongWord;</code>
 +
| Offset to SACL
 +
|-
 +
| <code>function DaclOffsetEx(ALocal:Boolean):LongWord;</code>
 +
| Offset to DACL
 +
|-
 +
| <code>function OwnerOffsetEx(ALocal:Boolean):LongWord;</code>
 +
| Offset to Owner SID
 +
|-
 +
| <code>function GroupOffsetEx(ALocal:Boolean):LongWord;</code>
 +
| Offset to Group SID
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function SecuritySize:LongWord; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function SecurityHash:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function SecurityDescriptor:Pointer; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function SecurityDescriptorEx(ALocal:Boolean):Pointer; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function InheritedDescriptor:Pointer; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function MergedDescriptor(AChild:Pointer):Pointer; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseDescriptor(ADescriptor:Pointer; AInherited,AMerged:Boolean):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CopyToSecurity(ASecurity:TDiskSecurity):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CopyToDescriptor(ADescriptor:Pointer; ASize:LongWord):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CopyToDescriptorEx(ADescriptor:Pointer; ASize:LongWord; ALocal:Boolean):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CopyFromDescriptor(ADescriptor:Pointer; ASize:LongWord):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteSecurityEx(ABuffer:Pointer; var AOffset,ASize:LongWord; ALocal:Boolean; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS security Id'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSSecurityId = class(TObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of index $SII in file $Secure (Not Used)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS security hash'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSSecurityHash = class(TObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of index $SDH in file $Secure (Not Used)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|}
 +
</div></div> 
 +
<br />
  
 
=== Public variables ===
 
=== Public variables ===

Revision as of 03:44, 17 March 2017

Return to Unit Reference


Description

Ultibo NTFS classes unit

To be documented

Constants

None defined

Type definitions


NTFS compare security descriptor

TNTFSCompareSecurityDescriptor = function(ASecurityId:LongWord; ADescriptor:Pointer; ASize:Word):Boolean of Object;


Class definitions


NTFS disk table

[Expand]

TNTFSDiskTable = class(TDiskTable)

NTFS disk block

[Expand]

TNTFSDiskBlock = class(TDiskBlock)

NTFS disk entry

[Expand]

TNTFSDiskEntry = class(TDiskEntry)

NTFS disk access contol list

[Expand]

TNTFSDiskAcl = class(TDiskAcl)

NTFS disk access control entry

[Expand]

TNTFSDiskAce = class(TDiskAce)

NTFS entry list

[Expand]

TNTFSEntryList = class(TObject)

NTFS record list

[Expand]

TNTFSRecordList = class(TObject)

NTFS record index

[Expand]

TNTFSRecordIndex = class(TLinkedObjBtree)

NTFS disk record

[Expand]

TNTFSDiskRecord = class(TBtreeObject)

NTFS disk index

[Expand]

TNTFSDiskIndex = class(TLinkedObjBtree)

NTFS data index

[Expand]

TNTFSDataIndex = class(TNTFSDiskIndex)

NTFS padded index

[Expand]

TNTFSPaddedIndex = class(TNTFSDataIndex)

NTFS attribute index

[Expand]

TNTFSAttributeIndex = class(TNTFSDiskIndex)

NTFS disk nodes

[Expand]

TNTFSDiskNodes = class(TFileSysListEx)

NTFS disk node

[Expand]

TNTFSDiskNode = class(TListObject)

NTFS disk key

[Expand]

TNTFSDiskKey = class(TBtreeObject)

NTFS data key

[Expand]

TNTFSDataKey = class(TNTFSDiskKey)

NTFS padded key

[Expand]

TNTFSPaddedKey = class(TNTFSDataKey)

NTFS attribute key

[Expand]

TNTFSAttributeKey = class(TNTFSDiskKey)

NTFS disk runs

[Expand]

TNTFSDiskRuns = class(TFileSysListEx)

NTFS disk run

[Expand]

TNTFSDiskRun = class(TListObject)

NTFS disk items

[Expand]

TNTFSDiskItems = class(TFileSysListEx)

NTFS disk item

[Expand]

TNTFSDiskItem = class(TListObject)

NTFS disk attributes

[Expand]

TNTFSDiskAttributes = class(TFileSysListEx)

NTFS disk attribute

[Expand]

TNTFSDiskAttribute = class(TListObject)

NTFS standard information attribute

[Expand]

TNTFSStandardInformationAttribute = class(TNTFSDiskAttribute)

NTFS attribute list

[Expand]

TNTFSAttributeListAttribute = class(TNTFSDiskAttribute)

NTFS file name attribute

[Expand]

TNTFSFileNameAttribute = class(TNTFSDiskAttribute)

NTFS object Id attribute

[Expand]

TNTFSObjectIdAttribute = class(TNTFSDiskAttribute)

NTFS volume version attribute

[Expand]

TNTFSVolumeVersionAttribute = class(TNTFSDiskAttribute)

NTFS security descriptor attribute

[Expand]

TNTFSSecurityDescriptorAttribute = class(TNTFSDiskAttribute)

NTFS volume name attribute

[Expand]

TNTFSVolumeNameAttribute = class(TNTFSDiskAttribute)

NTFS volume information attribute

[Expand]

TNTFSVolumeInformationAttribute = class(TNTFSDiskAttribute)

NTFS data attribute

[Expand]

TNTFSDataAttribute = class(TNTFSDiskAttribute)

NTFS index root attribute

[Expand]

TNTFSIndexRootAttribute = class(TNTFSDiskAttribute)

NTFS index allocation attribute

[Expand]

TNTFSIndexAllocationAttribute = class(TNTFSDiskAttribute)

NTFS bitmap attribute

[Expand]

TNTFSBitmapAttribute = class(TNTFSDiskAttribute)

NTFS reparse point attribute

[Expand]

TNTFSReparsePointAttribute = class(TNTFSDiskAttribute)

NTFS symbolic link attribute

[Expand]

TNTFSSymbolicLinkAttribute = class(TNTFSDiskAttribute)

NTFS extended attribute information

[Expand]

TNTFSExtendedAttrInformationAttribute = class(TNTFSDiskAttribute)

NTFS extended attribute

[Expand]

TNTFSExtendedAttrAttribute = class(TNTFSDiskAttribute)

NTFS property set attribute

[Expand]

TNTFSPropertySetAttribute = class(TNTFSDiskAttribute)

NTFS logged utility stream attribute

[Expand]

TNTFSLoggedUtilityStreamAttribute = class(TNTFSDiskAttribute)

NTFS end attribute

[Expand]

TNTFSEndAttribute = class(TNTFSDiskAttribute)

NTFS unknown attribute

[Expand]

TNTFSUnknownAttribute = class(TNTFSDiskAttribute)

NTFS object Id

[Expand]

TNTFSObjId = class(TObject)

NTFS quota

[Expand]

TNTFSQuota = class(TObject)

NTFS owner

[Expand]

TNTFSOwner = class(TObject)

NTFS upper case

[Expand]

TNTFSUpCase = class(TObject)

NTFS attribute definitions

[Expand]

TNTFSAttrDefs = class(TFileSysList)

NTFS attribute definition

[Expand]

TNTFSAttrDef = class(TListObject)

NTFS reparse

[Expand]

TNTFSReparse = class(TDiskReparse)

NTFS reparse symbolic link

[Expand]

TNTFSReparseSymLink = class(TNTFSReparse)

NTFS reparse mount point

[Expand]

TNTFSReparseMountPoint = class(TNTFSReparseSymLink)

NTFS extendeds

[Expand]

TNTFSExtendeds = class(TFileSysListEx)

NTFS extended

[Expand]

TNTFSExtended = class(TListObject)

NTFS security items

[Expand]

TNTFSSecurityItems = class(TFileSysList)

NTFS security item

[Expand]

TNTFSSecurityItem = class(TListObject)

NTFS security

[Expand]

TNTFSSecurity = class(TDiskSecurity)

NTFS security Id

[Expand]

TNTFSSecurityId = class(TObject)

NTFS security hash

[Expand]

TNTFSSecurityHash = class(TObject)


Public variables

None defined

Function declarations

None defined


Return to Unit Reference

Retrieved from "https://ultibo.org/mediawiki_ultibo_org/index.php?title=Unit_NTFSClass&oldid=2625"