Difference between revisions of "Unit NTFSClass"

From Ultibo.org
Jump to: navigation, search
Line 31: Line 31:
 
----
 
----
  
−
''To be documented''
+
 
 +
'''NTFS disk table'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskTable = class(TDiskTable)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Respresents the $Mft and $MftMirr
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FStartSector:Int64;</code>
 +
| Absolute starting sector of this table
 +
|-
 +
| <code>FStartCluster:Int64;</code>
 +
| Absolute starting cluster of this table
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FEntry:TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property StartSector:Int64 read FStartSector write FStartSector;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property StartCluster:Int64 read FStartCluster write FStartCluster;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Entry:TNTFSDiskEntry read FEntry write FEntry;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk block'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskBlock = class(TDiskBlock)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Represents a block of $Bitmap entries
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FBlockCount:LongWord;</code>
 +
| Number of cluster entries in this block (Bits in the bitmap)
 +
|-
 +
| <code>FBlockBuffer:Pointer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FBlockCluster:Int64;</code>
 +
| First cluster represented by this block (BlockNo represents the VCN of the block)
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property BlockCount:LongWord read FBlockCount write FBlockCount;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property BlockBuffer:Pointer read FBlockBuffer write FBlockBuffer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property BlockCluster:Int64 read FBlockCluster write FBlockCluster;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk entry'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskEntry = class(TDiskEntry)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Represents a file entry.
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AOrigin:TNTFSDiskRecord; AAttribute:TNTFSDiskAttribute);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FPrevEntry:TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FNextEntry:TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FUsed:Int64;</code>
 +
| Used size of the file
 +
|-
 +
| <code>FAllocated:Int64;</code>
 +
| Allocated size of file
 +
|-
 +
| <code>FChangeTime:TFileTime;</code>
 +
| MFT record change time
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FOrigin:TNTFSDiskRecord;</code>
 +
| Entry origin record
 +
|-
 +
| <code>FAttribute:TNTFSDiskAttribute;</code>
 +
| Entry naming attribute
 +
|-
 +
| <code>FAlternate:TNTFSDiskAttribute;</code>
 +
| Alternate name attribute
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetOrigin(AOrigin:TNTFSDiskRecord);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property LocalLock:TMutexHandle read FLocalLock write FLocalLock;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property PrevEntry:TNTFSDiskEntry read FPrevEntry write FPrevEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property NextEntry:TNTFSDiskEntry read FNextEntry write FNextEntry;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Used:Int64 read FUsed write FUsed;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Allocated:Int64 read FAllocated write FAllocated;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ChangeTime:TFileTime read FChangeTime write FChangeTime;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Origin:TNTFSDiskRecord read FOrigin write SetOrigin;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Attribute:TNTFSDiskAttribute read FAttribute write FAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Alternate:TNTFSDiskAttribute read FAlternate write FAlternate;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetDot:TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetDotDot:TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateDot:TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CreateDotDot:TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateDot:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateDotDot(AEntry:TNTFSDiskEntry):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RecordNumber:Int64;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function FileReference:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateEntry:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateRecord:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function FindFirstName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function FindPrevName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function FindNextName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function FindLastName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk access contol list'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskAcl = class(TDiskAcl)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of attribute $SECURITY_DESCRIPTOR
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk access control entry'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskAce = class(TDiskAce)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of attribute $SECURITY_DESCRIPTOR
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS entry list'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSEntryList = class(TObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FEntryCount:Integer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FFirstEntry:TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FLastEntry:TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Link(AEntry:TNTFSDiskEntry):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function Unlink(AEntry:TNTFSDiskEntry):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property EntryCount:Integer read FEntryCount;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property FirstEntry:TNTFSDiskEntry read FFirstEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property LastEntry:TNTFSDiskEntry read FLastEntry;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Add(AEntry:TNTFSDiskEntry):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function Remove(AEntry:TNTFSDiskEntry):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure ClearList; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS record list'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSRecordList = class(TObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FRecordCount:Integer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FFirstRecord:TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FLastRecord:TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Link(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function Unlink(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property RecordCount:Integer read FRecordCount;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property FirstRecord:TNTFSDiskRecord read FFirstRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property LastRecord:TNTFSDiskRecord read FLastRecord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Add(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function Remove(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure ClearList; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS record index'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSRecordIndex = class(TLinkedObjBtree)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Index of FILE records.
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FRecordLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FRunsLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FItemsLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FNodesLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FIndexLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FExtendedsLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FAttributesLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FRunLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FItemLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FKeyLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FNodeLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FExtendedLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FAttributeLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Find(const ARecordNumber:Int64; ACurrent:TNTFSDiskRecord):TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>function CreateBlank:TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Compare(AEntry1,AEntry2:TBtreeObject):Integer; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function CreateRecord(ABase:TNTFSDiskRecord; const ARecordNumber:Int64; AVersion:Word):TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyRecord(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewRecord(ABase:TNTFSDiskRecord; const ARecordNumber:Int64; AVersion:Word):TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function InsertRecord(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DeleteRecord(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveRecord(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function FindRecord(const ARecordNumber:Int64):TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReaderLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReaderUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReaderConvert:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriterLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriterUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriterConvert:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RunsReaderLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RunsReaderUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RunsWriterLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RunsWriterUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ItemsReaderLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ItemsReaderUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ItemsWriterLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ItemsWriterUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function NodesReaderLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NodesReaderUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NodesWriterLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NodesWriterUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function IndexReaderLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function IndexReaderUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function IndexWriterLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function IndexWriterUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ExtendedsReaderLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ExtendedsReaderUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ExtendedsWriterLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ExtendedsWriterUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AttributesReaderLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function AttributesReaderUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function AttributesWriterLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function AttributesWriterUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk record'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskRecord = class(TBtreeObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Represents a FILE record entry.
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; ABase:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLocalLock:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FRunsLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FItemsLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FNodesLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FIndexLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FExtendedsLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FAttributesLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FRunLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FItemLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FKeyLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FNodeLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FExtendedLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FAttributeLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FStatus:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FPrevRecord:TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FNextRecord:TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FRecordFlags:Word;</code>
 +
| Flags (See Consts)
 +
|-
 +
| <code>FHardLinkCount:Word;</code>
 +
| Hard link count
 +
|-
 +
| <code>FSequenceNumber:Word;</code>
 +
| Sequence number
 +
|-
 +
| <code>FNextAttributeId:Word;</code>
 +
| Next Attribute Id
 +
|-
 +
| <code>FRecordNumber:Int64;</code>
 +
| Number of this MFT Record
 +
|-
 +
| <code>FRecordSize:LongWord;</code>
 +
| Actual size of the FILE record
 +
|-
 +
| <code>FRecordAllocated:LongWord;</code>
 +
| Allocated size of the FILE record
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FAttributeOffset:Word;</code>
 +
| Offset to the first Attribute
 +
|-
 +
| <code>FUpdateSequenceOffset:Word;</code>
 +
| Offset to the Update Sequence Record
 +
|-
 +
| <code>FUpdateSequenceLength:Word;</code>
 +
| Size in words of the Update Sequence Record
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FUpdateSequenceNumber:Word;</code>
 +
| Update Sequence Number
 +
|-
 +
| <code>FLogFileSequenceNumber:Int64;</code>
 +
| LogFile Sequence Number (LSN)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FBase:TNTFSDiskRecord;</code>
 +
| Base file record
 +
|-
 +
| <code>FLinks:TNTFSEntryList;</code>
 +
| List of record links
 +
|-
 +
| <code>FStreams:TNTFSEntryList;</code>
 +
| List of record streams
 +
|-
 +
| <code>FRecords:TNTFSRecordList;</code>
 +
| List of child records
 +
|-
 +
| <code>FAttributes:TNTFSDiskAttributes;</code>
 +
| List of record attributes
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AcquireLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetResizing:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetResizing(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetRemoving:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetRemoving(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetMirrored:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetMirrored(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetMetafile:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetMetafile(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetReserved:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetReserved(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetExpansion:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetExpansion(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetOverflow:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetOverflow(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetExtension:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetExtension(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetIsUsed:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsUsed(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsFolder:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsFolder(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsUnknown1:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsUnknown1(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsIndexView:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsIndexView(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetOrigin:TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateLinks(ANew:Boolean):TNTFSEntryList;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CreateStreams(ANew:Boolean):TNTFSEntryList;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CreateRecords(ANew:Boolean):TNTFSRecordList;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CreateAttributes(AVersion:Word; ANew:Boolean):TNTFSDiskAttributes;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Resizing:Boolean read GetResizing write SetResizing;</code>
 +
| Record is being Resized
 +
|-
 +
| <code>property Removing:Boolean read GetRemoving write SetRemoving;</code>
 +
| Record is being Removed
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Mirrored:Boolean read GetMirrored write SetMirrored;</code>
 +
| Record is in $MftMirr file
 +
|-
 +
| <code>property Metafile:Boolean read GetMetafile write SetMetafile;</code>
 +
| Record is an NTFS metafile
 +
|-
 +
| <code>property Reserved:Boolean read GetReserved write SetReserved;</code>
 +
| Record is an Mft reserved record
 +
|-
 +
| <code>property Expansion:Boolean read GetExpansion write SetExpansion;</code>
 +
| Record is an Mft expansion record
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Overflow:Boolean read GetOverflow write SetOverflow;</code>
 +
| Record has an attribute list attribute
 +
|-
 +
| <code>property Extension:Boolean read GetExtension write SetExtension;</code>
 +
| Record is an extension of the base record
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property PrevRecord:TNTFSDiskRecord read FPrevRecord write FPrevRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property NextRecord:TNTFSDiskRecord read FNextRecord write FNextRecord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property IsUsed:Boolean read GetIsUsed write SetIsUsed;</code>
 +
| Record is in use
 +
|-
 +
| <code>property IsFolder:Boolean read GetIsFolder write SetIsFolder;</code>
 +
| Record is a folder
 +
|-
 +
| <code>property IsUnknown1:Boolean read GetIsUnknown1 write SetIsUnknown1;</code>
 +
|-
 +
| <code>property IsIndexView:Boolean read GetIsIndexView write SetIsIndexView;</code>
 +
| Record is an index view
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property RecordFlags:Word read FRecordFlags write FRecordFlags;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property HardLinkCount:Word read FHardLinkCount write FHardLinkCount;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property SequenceNumber:Word read FSequenceNumber write FSequenceNumber;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property NextAttributeId:Word read FNextAttributeId write FNextAttributeId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property RecordNumber:Int64 read FRecordNumber write FRecordNumber;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property RecordSize:LongWord read FRecordSize write FRecordSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property RecordAllocated:LongWord read FRecordAllocated write FRecordAllocated;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property AttributeOffset:Word read FAttributeOffset write FAttributeOffset;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property UpdateSequenceOffset:Word read FUpdateSequenceOffset write FUpdateSequenceOffset;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property UpdateSequenceLength:Word read FUpdateSequenceLength write FUpdateSequenceLength;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property UpdateSequenceNumber:Word read FUpdateSequenceNumber write FUpdateSequenceNumber;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property LogFileSequenceNumber:Int64 read FLogFileSequenceNumber write FLogFileSequenceNumber;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Base:TNTFSDiskRecord read FBase write FBase;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Links:TNTFSEntryList read FLinks;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Streams:TNTFSEntryList read FStreams;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Records:TNTFSRecordList read FRecords;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Attributes:TNTFSDiskAttributes read FAttributes;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Origin:TNTFSDiskRecord read GetOrigin;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateLink(AAttribute,AAlternate:TNTFSDiskAttribute; ANew:Boolean):TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyLink(ALink:TNTFSDiskEntry):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewLink(AAttribute,AAlternate:TNTFSDiskAttribute):TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetLink(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DeleteLink(ALink:TNTFSDiskEntry):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RenameLink(ALink:TNTFSDiskEntry; AAttribute,AAlternate:TNTFSDiskAttribute):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateStream(AAttribute:TNTFSDiskAttribute; ANew:Boolean):TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyStream(AStream:TNTFSDiskEntry):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewStream(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetStream(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DeleteStream(AStream:TNTFSDiskEntry):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetFileNameByKey(AKey:TNTFSAttributeKey):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetFileNameByName(const AName:String; AInstance:Integer):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetFileNameByParent(const AName:String; const AParent:Int64; AInstance:Integer):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetFileNameByNameSpace(const AName:String; const AParent:Int64; ANameSpace:Byte; AInstance:Integer):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetRecord(AInstance:Integer):TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetRecordByFree(AFree:LongWord; AExclude:Boolean):TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetRecordByReference(const AFileReference:Int64):TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AddRecord(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveRecord(ARecord:TNTFSDiskRecord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetAttributeByItem(AItem:TNTFSDiskItem):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetAttributeByStatus(AInclude,AExclude:Word; AInstance:Integer):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetAttributeByVCN(AAttribute:TNTFSDiskAttribute; const AVCN:Int64; var AInstance:LongWord):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetAttributeByUnit(AAttribute:TNTFSDiskAttribute; const AUnit:Int64; var AInstance:LongWord):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateAttribute(AType:LongWord; AVersion:Word; ANew:Boolean):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyAttribute(AAttribute:TNTFSDiskAttribute):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewAttribute(APrevious:TNTFSDiskAttribute; AType:LongWord; const AName:String; AVersion:Word):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetAttribute(AType:LongWord; const AName:String; AInstance:Integer):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveAttribute(AAttribute:TNTFSDiskAttribute):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function MoveAttribute(ADest:TNTFSDiskRecord; AAttribute:TNTFSDiskAttribute):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RenameAttribute(AAttribute:TNTFSDiskAttribute; const AName:String):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function FileReference:Int64;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function BaseReference:Int64;</code>
 +
| File reference to the base FILE record
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function LinkCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function StreamCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RecordCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function AttributeCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RecordFree:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function AttributeSize(AVersion:Word; AType:LongWord):LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedOffset(AVersion:Word):Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedSequenceOffset(AVersion:Word):Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedSequenceLength(ASectorSize:Word):Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedStreamUsed(AVersion:Word; AAttribute:TNTFSDiskAttribute):Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadAttributes(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteAttributes(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word; AFree:Boolean):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk index'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskIndex = class(TLinkedObjBtree)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Index of INDX records.
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(AKeyLocal:TMutexHandle; ALock:TSynchronizerHandle; AVolumeVersion,ASectorSize:Word; AIndexType,ACollateRule:LongWord; AAttribute:TNTFSDiskAttribute);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FKeyLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FStatus:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FSectorSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FVolumeVersion:Word;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FIndexType:LongWord;</code>
 +
| Attribute Type (Or None if Data Index)
 +
|-
 +
| <code>FCollateRule:LongWord;</code>
 +
| Collation Rule
 +
|-
 +
| <code>FIndexRecordSize:LongWord;</code>
 +
| Size of Index Allocation Entry (bytes)
 +
|-
 +
| <code>FIndexCounterOffset:LongWord;</code>
 +
| Index Record Number increment
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FClustersPerIndex:LongWord;</code>
 +
| Clusters per INDX Record or 0 if less than cluster size
 +
|-
 +
| <code>FIndexsPerCluster:LongWord;</code>
 +
| INDX Records per Cluster or 0 if more than cluster size
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FIndexCounterShift:Word;</code>
 +
| Shift count for Record -> Counter
 +
|-
 +
| <code>FIndexRecordShiftCount:Word;</code>
 +
| Shift count for Record -> VCN
 +
|-
 +
| <code>FIndexRecordOffsetMask:Int64;</code>
 +
| Mask for Record offset calculation
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FTotalIndexRecordCount:Int64;</code>
 +
| Total number of index records in index
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FLastFreeIndexRecord:Int64;</code>
 +
| Or ntfsUnknownRecordNumber if not known
 +
|-
 +
| <code>FFreeIndexRecordCount:Int64;</code>
 +
| Or ntfsUnknownRecordNumber if not known
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FCompareSecurityDescriptor:TNTFSCompareSecurityDescriptor;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FUpCase:TNTFSUpCase;</code>
 +
| Uppercase Conversion Table
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FNodes:TNTFSDiskNodes;</code>
 +
| List of index nodes
 +
|-
 +
| <code>FAttribute:TNTFSDiskAttribute;</code>
 +
| Attribute owning this index
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetNodesLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetKeyLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetNodeLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetLoaded:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetLoaded(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetChanged:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetUpCase:PNTFSUpCaseData;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetRootNode:TNTFSDiskNode;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateNodes(ANew:Boolean):TNTFSDiskNodes;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CompareKey(AEntry1,AEntry2:Pointer; ASize1,ASize2:Word):Integer;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CompareBinary(AEntry1,AEntry2:Pointer; ASize1,ASize2:Word):Integer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CompareFileName(AEntry1,AEntry2:PWideChar; ASize1,ASize2:Word):Integer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CompareUnicode(AEntry1,AEntry2:PWideChar; ASize1,ASize2:Word):Integer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CompareLongWord(AEntry1,AEntry2:LongWord; ASize1,ASize2:Word):Integer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CompareSID(AEntry1,AEntry2:PSID; ASize1,ASize2:Word):Integer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CompareSecurityHash(AEntry1,AEntry2:PNTFSSecurityHashKeyData; ASize1,ASize2:Word):Integer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CompareGUID(AEntry1,AEntry2:PGUID; ASize1,ASize2:Word):Integer;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>function GetEnd(AEntry:TBtreeObject):TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetStart(AEntry:TBtreeObject):TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetBlank(AEntry:TBtreeObject):TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetMedian(AEntry:TBtreeObject):TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetDropTest(AEntry:TBtreeObject; var ALeft:Boolean):TBtreeObject;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetDrop(AEntry:TBtreeObject; var ALeft:Boolean):TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetMerge(AEntry:TBtreeObject):TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetBorrow(AEntry:TBtreeObject):TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetTarget(ADrop:TBtreeObject; ALeft:Boolean):TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function PushNode(AEntry:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function SplitNode(AEntry:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DropNode(AEntry,ADrop,ATarget:TBtreeObject; ALeft:Boolean):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DropNodeOld(AEntry,ADrop:TBtreeObject; ALeft:Boolean):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function MergeNode(AEntry,AMerge:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function BorrowEntry(AEntry,ABorrow:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function SwapEntry(AEntry,ASwap:TBtreeObject;ALeft:Boolean):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function SetParentEntry(AEntry,AParent:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function DeleteBlank(ABlank:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AttachBlank(ABlank:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DetachBlank(ABlank:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AttachEntry(AEntry:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DetachEntry(AEntry:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RequirePush(AEntry:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RequireSplit(AEntry:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RequireDrop(AEntry:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RequireMerge(AEntry:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RequireBorrow(AEntry:TBtreeObject):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Loaded:Boolean read GetLoaded write SetLoaded;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Changed:Boolean read GetChanged;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property SectorSize:Word read FSectorSize write FSectorSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property VolumeVersion:Word read FVolumeVersion;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property IndexType:LongWord read FIndexType write FIndexType;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property CollateRule:LongWord read FCollateRule write FCollateRule;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IndexRecordSize:LongWord read FIndexRecordSize write FIndexRecordSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IndexCounterOffset:LongWord read FIndexCounterOffset write FIndexCounterOffset;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property ClustersPerIndex:LongWord read FClustersPerIndex write FClustersPerIndex;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IndexsPerCluster:LongWord read FIndexsPerCluster write FIndexsPerCluster;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property IndexCounterShift:Word read FIndexCounterShift write FIndexCounterShift;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IndexRecordShiftCount:Word read FIndexRecordShiftCount write FIndexRecordShiftCount;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IndexRecordOffsetMask:Int64 read FIndexRecordOffsetMask write FIndexRecordOffsetMask;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property TotalIndexRecordCount:Int64 read FTotalIndexRecordCount write FTotalIndexRecordCount;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property LastFreeIndexRecord:Int64 read FLastFreeIndexRecord write FLastFreeIndexRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property FreeIndexRecordCount:Int64 read FFreeIndexRecordCount write FFreeIndexRecordCount;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property CompareSecurityDescriptor:TNTFSCompareSecurityDescriptor read FCompareSecurityDescriptor write FCompareSecurityDescriptor;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property UpCase:TNTFSUpCase read FUpCase write FUpCase;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Nodes:TNTFSDiskNodes read FNodes;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Attribute:TNTFSDiskAttribute read FAttribute;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property RootNode:TNTFSDiskNode read GetRootNode;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function NodeCount:Integer;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyKey(AKey:TNTFSDiskKey):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewKeyEx(AKey,AData,APadding:Pointer; AKeySize,ADataSize,APaddingSize:Word):TNTFSDiskKey; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function AddKey(AParent,AKey:TNTFSDiskKey):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function InsertKey(AKey:TNTFSDiskKey):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveKey(AKey:TNTFSDiskKey):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateNode(ANew:Boolean):TNTFSDiskNode;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyNode(ANode:TNTFSDiskNode):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewNode(const ARecordNumber:Int64):TNTFSDiskNode;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetNode(const ARecordNumber:Int64):TNTFSDiskNode;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DeleteNode(ANode:TNTFSDiskNode):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveNode(ANode:TNTFSDiskNode):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateNodes(AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function FindKey(AValue:Pointer; ASize:Word):TNTFSDiskKey; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadRoot(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteRoot(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadKeys(AParent:TNTFSDiskKey; ANode:TNTFSDiskNode; ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteKeys(AParent:TNTFSDiskKey; ANode:TNTFSDiskNode; ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReaderLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReaderUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriterLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriterUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 +
'''NTFS data index'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDataIndex = class(TNTFSDiskIndex)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>function CompareSecurityDescriptor(AHash1,AHash2,ASecurityId:LongWord; ADescriptor:Pointer; ASize:Word):Integer;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Find(AValue:Pointer; ASize:Word; ACurrent:TNTFSDataKey):TNTFSDataKey;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function FindEx(AValue:Pointer; ASize:Word; AHash:LongWord; ACurrent:TNTFSDataKey):TNTFSDataKey;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>function CreateBlank:TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Compare(AEntry1,AEntry2:TBtreeObject):Integer; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetKeyBySID(ASID:PSID):TNTFSDiskKey;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetKeyByOwner(AOwner:LongWord):TNTFSDiskKey;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetKeyByObjectId(const AObjectId:TGUID):TNTFSDiskKey;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetKeyBySecurity(ASecurity:TNTFSSecurity):TNTFSDiskKey;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetKeyByReparse(AReparseTag:LongWord; const AFileReference:Int64):TNTFSDiskKey;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function FindKey(AValue:Pointer;ASize:Word):TNTFSDiskKey; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS padded index'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSPaddedIndex = class(TNTFSDataIndex)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: A DataIndex that allows a block of Padding to be specified.
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>function CreateBlank:TBtreeObject; override;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>function CreateBlank:TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewKeyEx(AKey,AData,APadding:Pointer; AKeySize,ADataSize,APaddingSize:Word):TNTFSDiskKey; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS attribute index'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSAttributeIndex = class(TNTFSDiskIndex)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>function Find(AValue:Pointer; ASize:Word; ACurrent:TNTFSAttributeKey):TNTFSAttributeKey;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>function CreateBlank:TBtreeObject; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Compare(AEntry1,AEntry2:TBtreeObject):Integer; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetKeyByFileName(const AFileName:String):TNTFSDiskKey;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function NewKeyByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSDiskKey;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetKeyByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSDiskKey;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function FindKey(AValue:Pointer; ASize:Word):TNTFSDiskKey; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk nodes'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskNodes = class(TFileSysListEx)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ANodeLocal:TMutexHandle; ALock:TSynchronizerHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FNodeLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetModified:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetModified(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Modified:Boolean read GetModified write SetModified;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function TotalSize:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function NodeCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk node'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskNode = class(TListObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Represents an INDX record header.
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AIndex:TNTFSDiskIndex);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLocalLock:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FStatus:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FIndexFlags:Word;</code>
 +
| Flags (See Consts)
 +
|-
 +
| <code>FIndexSize:LongWord;</code>
 +
| Total size of the Index Entries
 +
|-
 +
| <code>FIndexAllocated:LongWord;</code>
 +
| Allocated size of the Index Entries
 +
|-
 +
| <code>FEntryOffset:LongWord;</code>
 +
| Offset to first Index Entry
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FRecordNumber:Int64;</code>
 +
| Number of this INDX record in the Index Allocation
 +
|-
 +
| <code>FUpdateSequenceOffset:Word;</code>
 +
| Offset to the Update Sequence Record
 +
|-
 +
| <code>FUpdateSequenceLength:Word;</code>
 +
| Size in words of the Update Sequence Record
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FUpdateSequenceNumber:Word;</code>
 +
| Update Sequence Number
 +
|-
 +
| <code>FLogFileSequenceNumber:Int64;</code>
 +
| LogFile sequence number
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FIndex:TNTFSDiskIndex;</code>
 +
| Index owning this node
 +
|-
 +
| <code>FBlank:TNTFSDiskKey;</code>
 +
| Blank key of this node (Blank keys do not move)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AcquireLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetAdded:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetAdded(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetDeleted:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetDeleted(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetChanged:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetChanged(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetModified:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetModified(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetIsRoot:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetHasSubNodes:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetHasSubNodes(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetStart:TNTFSDiskKey;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Added:Boolean read GetAdded write SetAdded;</code>
 +
| Index record to be allocated
 +
|-
 +
| <code>property Deleted:Boolean read GetDeleted write SetDeleted;</code>
 +
| Index record to be deallocated
 +
|-
 +
| <code>property Changed:Boolean read GetChanged write SetChanged;</code>
 +
| Index record to be updated
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Modified:Boolean read GetModified write SetModified;</code>
 +
| Index record has been added, deleted or changed
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property IsRoot:Boolean read GetIsRoot;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property HasSubNodes:Boolean read GetHasSubNodes write SetHasSubNodes;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property IndexFlags:Word read FIndexFlags write FIndexFlags;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IndexSize:LongWord read FIndexSize write FIndexSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IndexAllocated:LongWord read FIndexAllocated write FIndexAllocated;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property EntryOffset:LongWord read FEntryOffset write FEntryOffset;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property RecordNumber:Int64 read FRecordNumber write FRecordNumber;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property UpdateSequenceOffset:Word read FUpdateSequenceOffset write FUpdateSequenceOffset;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property UpdateSequenceLength:Word read FUpdateSequenceLength write FUpdateSequenceLength;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property UpdateSequenceNumber:Word read FUpdateSequenceNumber write FUpdateSequenceNumber;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property LogFileSequenceNumber:Int64 read FLogFileSequenceNumber write FLogFileSequenceNumber;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Index:TNTFSDiskIndex read FIndex;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Blank:TNTFSDiskKey read FBlank write FBlank;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Start:TNTFSDiskKey read GetStart;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function KeyCount:Integer;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function IndexFree:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateKeys(AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedOffset(AVersion:Word):LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedAllocated(AVersion:Word):LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedSequenceOffset(AVersion:Word):Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedSequenceLength(ASectorSize:Word):Word;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function WriteEmpty(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word; var AUpdateSequenceOffset,AUpdateSequenceLength:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadHeader(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteHeader(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk key'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskKey = class(TBtreeObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Represents an INDX record entry.
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLocalLock:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FStatus:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FKey:Pointer;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FEntryFlags:Word;</code>
 +
| Flags (See Consts)
 +
|-
 +
| <code>FEntrySize:Word;</code>
 +
| Length of the index entry
 +
|-
 +
| <code>FKeySize:Word;</code>
 +
| Length of the key entry
 +
|-
 +
| <code>FSubNodeNumber:Int64;</code>
 +
| Number of the sub-node in the index allocation attribute
 +
|-
 +
|colspan="2"|&nbsp; 
 +
|-
 +
| <code>FNode:TNTFSDiskNode;</code>
 +
| Index node of this key
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AcquireLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetChanged:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetChanged(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetHasSubNode:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetHasSubNode(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsLastNode:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsLastNode(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetKeySize(ASize:Word); virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetSubNodeNumber(const ANodeNumber:Int64);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetNode(ANode:TNTFSDiskNode);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Changed:Boolean read GetChanged write SetChanged;</code>
 +
| Index record to be updated
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property HasSubNode:Boolean read GetHasSubNode write SetHasSubNode;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsLastNode:Boolean read GetIsLastNode write SetIsLastNode;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Key:Pointer read FKey;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property EntryFlags:Word read FEntryFlags write FEntryFlags;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property EntrySize:Word read FEntrySize write FEntrySize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property KeySize:Word read FKeySize write SetKeySize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property SubNodeNumber:Int64 read FSubNodeNumber write SetSubNodeNumber;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Node:TNTFSDiskNode read FNode write SetNode;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):Word; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS data key'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDataKey = class(TNTFSDiskKey)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FData:Pointer;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FDataSize:Word;</code>
 +
| Size of the data (Only valid when the last entry flag is not set)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetKeySize(ASize:Word); override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetData(AData:Pointer);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetDataSize(ASize:Word);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Data:Pointer read FData write SetData;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property DataSize:Word read FDataSize write SetDataSize;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function DataOffset:Word;</code>
 +
| Offset to the data (Only valid when the last entry flag is not set)
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):Word; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 +
'''NTFS padded key'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSPaddedKey = class(TNTFSDataKey)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FPadding:Pointer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FPaddingSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetPadding(APadding:Pointer);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetPaddingSize(ASize:Word);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Padding:Pointer read FPadding write SetPadding;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property PaddingSize:Word read FPaddingSize write SetPaddingSize;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS attribute key'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSAttributeKey = class(TNTFSDiskKey)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FFileReference:Int64;</code>
 +
| File reference (Only valid when the last entry flag is not set)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FAttribute:TNTFSDiskAttribute;</code>
 +
| Indexed attribute of this key
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetInvalid:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetInvalid(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetKeySize(ASize:Word); override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetAttribute(AAttribute:TNTFSDiskAttribute);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Invalid:Boolean read GetInvalid write SetInvalid;</code>
 +
| Key points to invalid file record or attribute
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property FileReference:Int64 read FFileReference write FFileReference;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Attribute:TNTFSDiskAttribute read FAttribute write SetAttribute;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateKey:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RecordNumber:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):Word; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk runs'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskRuns = class(TFileSysListEx)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ARunLocal:TMutexHandle; ALock:TSynchronizerHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FRunLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FRecent:TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FRecentVCN:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetStart:TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetFinal:TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Recent:TNTFSDiskRun read FRecent write FRecent;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property RecentVCN:Int64 read FRecentVCN write FRecentVCN;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function SparseCount:Int64;</code>
 +
| Count of sparse runs in list
 +
|-
 +
| <code>function ClusterCount:Int64;</code>
 +
| Count of normal runs in list
 +
|-
 +
| <code>function AllocatedCount:Int64;</code>
 +
| Count of allocated runs in list
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function TotalSize:LongWord;</code>
 +
| Total size of the encoded data runs
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RunCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk run'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskRun = class(TListObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLocalLock:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FStart:Int64;</code>
 +
| Run start logical cluster
 +
|-
 +
| <code>FOffset:Int64;</code>
 +
| Run start cluster offset
 +
|-
 +
| <code>FLength:Int64;</code>
 +
| Run length in clusters
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FAttribute:TNTFSDiskAttribute;</code>
 +
| Attribute owning this run
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AcquireLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetIsLast:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsSparse:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetOffsetSize:Byte;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetLengthSize:Byte;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetStart(const AStart:Int64);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetOffset(const AOffset:Int64);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetSuccessor:TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetPredecessor:TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property IsLast:Boolean read GetIsLast;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsSparse:Boolean read GetIsSparse;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Start:Int64 read FStart write SetStart;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Offset:Int64 read FOffset write SetOffset;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Length:Int64 read FLength write FLength;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Attribute:TNTFSDiskAttribute read FAttribute;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RunSize:LongWord; </code>
 +
| Size of the encoded data run
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateRun:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadRun(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteRun(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk items'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskItems = class(TFileSysListEx)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(AItemLocal:TMutexHandle; ALock:TSynchronizerHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FItemLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FStatus:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetLoaded:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetLoaded(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetPrevious(AItem:TNTFSDiskItem):TNTFSDiskItem;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Loaded:Boolean read GetLoaded write SetLoaded;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function TotalSize:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ItemCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk item'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskItem = class(TListObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of attribute $ATTRIBUTE_LIST
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskAttribute);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLocalLock:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FStatus:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FItemSize:Word;</code>
 +
| Record length
 +
|-
 +
| <code>FStartVCN:Int64;</code>
 +
| Starting VCN if non resident
 +
|-
 +
| <code>FFileReference:Int64;</code>
 +
| File Reference of the attribute
 +
|-
 +
| <code>FAttributeType:LongWord;</code>
 +
| Attribute Type
 +
|-
 +
| <code>FAttributeId:Word;</code>
 +
| Attribute Id
 +
|-
 +
| <code>FAttributeName:String;</code>
 +
| Name in Unicode (if NameLength > 0)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FParent:TNTFSDiskAttribute;</code>
 +
| Attribute list owning this item
 +
|-
 +
| <code>FAttribute:TNTFSDiskAttribute;</code>
 +
| Attribute pointed to by this item
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FAttributeHash:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AcquireLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetInvalid:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetInvalid(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetAttributeName:String;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetAttributeName(const AAttributeName:String);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetAttribute(AAttribute:TNTFSDiskAttribute);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Compare(AItem:TNTFSDiskItem):Integer; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Invalid:Boolean read GetInvalid write SetInvalid;</code>
 +
| Item points to invalid file record or attribute
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property ItemSize:Word read FItemSize write FItemSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property StartVCN:Int64 read FStartVCN write FStartVCN;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property FileReference:Int64 read FFileReference write FFileReference;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AttributeType:LongWord read FAttributeType write FAttributeType;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AttributeId:Word read FAttributeId write FAttributeId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AttributeName:String read GetAttributeName write SetAttributeName;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Parent:TNTFSDiskAttribute read FParent;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Attribute:TNTFSDiskAttribute read FAttribute write SetAttribute;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property AttributeHash:LongWord read FAttributeHash;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RecordNumber:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AttributeNameSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function AttributeNameLength:Byte;</code>
 +
| Name length
 +
|-
 +
| <code>function AttributeNameOffset:Byte;</code>
 +
| Offset to Name
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateItem:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):Word;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS disk attributes'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskAttributes = class(TFileSysListEx)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(AAttributeLocal:TMutexHandle; ALock:TSynchronizerHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FAttributeLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetPrevious(AAttribute:TNTFSDiskAttribute):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function TotalSize:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AttributeCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 +
'''NTFS disk attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDiskAttribute = class(TListObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLocalLock:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>FStatus:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FData:Pointer;</code>
 +
| Only applicable if attribute is resident
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FAttributeType:LongWord;</code>
 +
| Attribute Type (e.g. 0x80, 0xA0)
 +
|-
 +
| <code>FAttributeSize:LongWord;</code>
 +
| Length of the Attribute (including header)
 +
|-
 +
| <code>FAttributeFlags:Word;</code>
 +
| Attribute Flags
 +
|-
 +
| <code>FAttributeId:Word;</code>
 +
| Attribute Id
 +
|-
 +
| <code>FAttributeName:String;</code>
 +
| Attribute Name
 +
|-
 +
| <code>FNonResident:Byte;</code>
 +
| Non-resident flag
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FIndexed:Byte;</code>
 +
| Indexed flag
 +
|-
 +
| <code>FDataSize:LongWord;</code>
 +
| Length of the Attribute Data
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FStartVCN:Int64;</code>
 +
| Starting VCN
 +
|-
 +
| <code>FLastVCN:Int64;</code>
 +
| Last VCN
 +
|-
 +
| <code>FStreamSize:Int64;</code>
 +
| Real size of the attribute
 +
|-
 +
| <code>FStreamUsed:Int64;</code>
 +
| The actual Allocated size of the attribute (Only present when compressed and only in the first instance)
 +
|-
 +
| <code>FStreamAllocated:Int64;</code>
 +
| Allocated size of the attribute
 +
|-
 +
| <code>FInitializedSize:Int64;</code>
 +
| Initialized data size of the stream (Portion which has been Written)
 +
|-
 +
| <code>FCompressionUnit:Word;</code>
 +
| Compression Unit Size
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FRuns:TNTFSDiskRuns;</code>
 +
| List of runs of this attribute
 +
|-
 +
| <code>FItems:TNTFSDiskItems;</code>
 +
| List of items of this attribute
 +
|-
 +
| <code>FIndex:TNTFSDiskIndex;</code>
 +
| Index of this attribute if applicable
 +
|-
 +
| <code>FParent:TNTFSDiskRecord;</code>
 +
| Record owning this attribute
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FAttributeHash:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AcquireLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetRunsLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetItemsLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIndexLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetExtendedsLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetRunLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetItemLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetKeyLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetExtendedLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetUpdating:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetUpdating(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetIsFixed:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsSingle:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsUnlisted:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsUnmovable:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsManaged:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetIsSparse:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsSparse(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsEncrypted:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsEncrypted(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsCompressed:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsCompressed(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetAttributeName:String;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetAttributeName(const AAttributeName:String);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetDataSize:LongWord; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetDataSize(AValue:LongWord); virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Compare(AAttribute:TNTFSDiskAttribute):Integer; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateRuns(ANew:Boolean):TNTFSDiskRuns;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CreateItems(ANew:Boolean):TNTFSDiskItems;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetRecord(AInstance:Integer):TNTFSDiskRecord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetAttribute(AType:LongWord; const AName:String; AInstance:Integer):TNTFSDiskAttribute;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Updating:Boolean read GetUpdating write SetUpdating;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property IsFixed:Boolean read GetIsFixed;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsSingle:Boolean read GetIsSingle;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsUnlisted:Boolean read GetIsUnlisted;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsUnmovable:Boolean read GetIsUnmovable;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsManaged:Boolean read GetIsManaged;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property IsSparse:Boolean read GetIsSparse write SetIsSparse;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsEncrypted:Boolean read GetIsEncrypted write SetIsEncrypted;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsCompressed:Boolean read GetIsCompressed write SetIsCompressed;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Data:Pointer read FData;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property AttributeType:LongWord read FAttributeType;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AttributeSize:LongWord read FAttributeSize write FAttributeSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AttributeFlags:Word read FAttributeFlags write FAttributeFlags;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AttributeId:Word read FAttributeId write FAttributeId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AttributeName:String read GetAttributeName write SetAttributeName;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property NonResident:Byte read FNonResident write FNonResident;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Indexed:Byte read FIndexed write FIndexed;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property DataSize:LongWord read GetDataSize write SetDataSize;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property StartVCN:Int64 read FStartVCN write FStartVCN;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property LastVCN:Int64 read FLastVCN write FLastVCN;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property StreamSize:Int64 read FStreamSize write FStreamSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property StreamUsed:Int64 read FStreamUsed write FStreamUsed;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property StreamAllocated:Int64 read FStreamAllocated write FStreamAllocated;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property InitializedSize:Int64 read FInitializedSize write FInitializedSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property CompressionUnit:Word read FCompressionUnit write FCompressionUnit;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Runs:TNTFSDiskRuns read FRuns;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Items:TNTFSDiskItems read FItems;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Index:TNTFSDiskIndex read FIndex;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Parent:TNTFSDiskRecord read FParent write FParent;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property AttributeHash:LongWord read FAttributeHash;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetRunCount(const AVCN:Int64; var AStartVCN,ACount:Int64):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetRunLength(const AVCN:Int64; var AStartVCN,ALength:Int64):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetRunByUnit(const AUnit:Int64; var AStartVCN:Int64):TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetRunByCluster(const ACluster:Int64; var AStartVCN:Int64):TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateRun(ANew:Boolean):TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyRun(ARun:TNTFSDiskRun):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewRun(const AStart,ALength:Int64):TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function InsertRun(APrev:TNTFSDiskRun; const AStart,ALength:Int64):TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetRun(const AVCN:Int64; var AStartVCN:Int64):TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetRunOld(const AVCN:Int64; var AStartVCN:Int64):TNTFSDiskRun;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function MergeRun(ARun:TNTFSDiskRun):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function SplitRun(ARun:TNTFSDiskRun; const ALength:Int64):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveRun(ARun:TNTFSDiskRun):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function MoveRun(ADest:TNTFSDiskAttribute; ARun:TNTFSDiskRun):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetItemByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSDiskItem;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateItem(ANew:Boolean):TNTFSDiskItem;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyItem(AItem:TNTFSDiskItem):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewItem(AAttribute:TNTFSDiskAttribute):TNTFSDiskItem;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetItem(AType:LongWord; const AName:String; AInstance:Integer):TNTFSDiskItem;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveItem(AItem:TNTFSDiskItem):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function MoveItem(AItem:TNTFSDiskItem; AAttribute:TNTFSDiskAttribute):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RenameItem(AItem:TNTFSDiskItem; AAttribute:TNTFSDiskAttribute):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateIndex(AVersion,ASector:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewIndex(AVersion,ASector:Word; AType,ARule,ASize,AOffset:LongWord):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RecordNumber:Int64;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function FileReference:Int64;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function BaseReference:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RunOffset:Word;</code>
 +
| Offset to the Data Run
 +
|-
 +
| <code>function DataOffset:Word;</code>
 +
| Offset to the Attribute Data
 +
|-
 +
| <code>function AttributeNameSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function AttributeNameLength:Byte;</code>
 +
| Name length
 +
|-
 +
| <code>function AttributeNameOffset:Word;</code>
 +
| Offset to the Name
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function RunCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ItemCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):LongWord; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedDataSize(AVersion:Word):LongWord; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedStreamUsed(AVersion:Word):Int64; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CoalesceRun(ARun:TNTFSDiskRun):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateRun(ARun:TNTFSDiskRun):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateKey(AKey:TNTFSDiskKey):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateItem(AItem:TNTFSDiskItem):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadRuns(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteRuns(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 +
'''NTFS standard information attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSStandardInformationAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FCreateTime:TFileTime;</code>
 +
| File Creation
 +
|-
 +
| <code>FWriteTime:TFileTime;</code>
 +
| File Altered
 +
|-
 +
| <code>FChangeTime:TFileTime;</code>
 +
| MFT Changed
 +
|-
 +
| <code>FAccessTime:TFileTime;</code>
 +
| File Read
 +
|-
 +
| <code>FAttributes:LongWord;</code>
 +
| DOS File Permissions
 +
|-
 +
| <code>FMaxVersions:LongWord;</code>
 +
| Maximum Number of Versions
 +
|-
 +
| <code>FVersionNo:LongWord;</code>
 +
| Version Number
 +
|-
 +
| <code>FClassId:LongWord;</code>
 +
| Class Id
 +
|-
 +
| <code>FOwnerId:LongWord;</code>
 +
| Owner Id
 +
|-
 +
| <code>FSecurityId:LongWord;</code>
 +
| Security Id
 +
|-
 +
| <code>FQuotaCharge:Int64;</code>
 +
| Quota Charged
 +
|-
 +
| <code>FUpdateSequenceNumber:Int64;</code>
 +
| Update Sequence Number
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property CreateTime:TFileTime read FCreateTime write FCreateTime;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property WriteTime:TFileTime read FWriteTime write FWriteTime;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ChangeTime:TFileTime read FChangeTime write FChangeTime;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AccessTime:TFileTime read FAccessTime write FAccessTime;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Attributes:LongWord read FAttributes write FAttributes;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property MaxVersions:LongWord read FMaxVersions write FMaxVersions;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property VersionNo:LongWord read FVersionNo write FVersionNo;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ClassId:LongWord read FClassId write FClassId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property OwnerId:LongWord read FOwnerId write FOwnerId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property SecurityId:LongWord read FSecurityId write FSecurityId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property QuotaCharge:Int64 read FQuotaCharge write FQuotaCharge;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property UpdateSequenceNumber:Int64 read FUpdateSequenceNumber write FUpdateSequenceNumber;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS attribute list'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSAttributeListAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS file name attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSFileNameAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FParentReference:Int64;</code>
 +
| File reference to the parent directory
 +
|-
 +
| <code>FCreateTime:TFileTime;</code>
 +
| C Time - File Creation
 +
Note: These fields are only updated when the filename is changed (See Standard Information instead)
 +
|-
 +
| <code>FWriteTime:TFileTime;</code>
 +
| A Time - File Altered
 +
Note: These fields are only updated when the filename is changed (See Standard Information instead)
 +
|-
 +
| <code>FChangeTime:TFileTime;</code>
 +
| M Time - MFT Changed
 +
Note: These fields are only updated when the filename is changed (See Standard Information instead)
 +
|-
 +
| <code>FAccessTime:TFileTime;</code>
 +
| R Time - File Read
 +
Note: These fields are only updated when the filename is changed (See Standard Information instead)
 +
|-
 +
| <code>FFileAllocated:Int64;</code>
 +
| Allocated size of the file (As for CreateTime/WriteTime/ChangeTime etc)
 +
|-
 +
| <code>FFileSize:Int64;</code>
 +
| Real size of the file (As for CreateTime/WriteTime/ChangeTime etc)
 +
|-
 +
| <code>FFileFlags:LongWord;</code>
 +
| Flags, e.g. Directory, compressed, hidden (As for CreateTime/WriteTime/ChangeTime etc)
 +
|-
 +
| <code>FReparseTag:LongWord;</code>
 +
| Used by EAs and Reparse
 +
|-
 +
| <code>FNameSpace:Byte;</code>
 +
| Filename namespace
 +
|-
 +
| <code>FFileName:String;</code>
 +
| File name
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FFileHash:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetFileName:String;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetFileName(const AFileName:String);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property ParentReference:Int64 read FParentReference write FParentReference;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property CreateTime:TFileTime read FCreateTime write FCreateTime;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property WriteTime:TFileTime read FWriteTime write FWriteTime;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ChangeTime:TFileTime read FChangeTime write FChangeTime;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AccessTime:TFileTime read FAccessTime write FAccessTime;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property FileAllocated:Int64 read FFileAllocated write FFileAllocated;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property FileSize:Int64 read FFileSize write FFileSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property FileFlags:LongWord read FFileFlags write FFileFlags;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ReparseTag:LongWord read FReparseTag write FReparseTag;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property NameSpace:Byte read FNameSpace write FNameSpace;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property FileName:String read GetFileName write SetFileName;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property FileHash:LongWord read FFileHash;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function FileNameSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function FileNameLength:Byte;</code>
 +
| Filename length in characters
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ParentRecord:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS object Id attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSObjectIdAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FObjectId:TGUID;</code>
 +
| GUID Object Id Unique Id assigned to file
 +
|-
 +
| <code>FBirthVolumeId:TGUID;</code>
 +
| GUID Birth Volume Id Volume where file was created
 +
|-
 +
| <code>FBirthObjectId:TGUID;</code>
 +
| GUID Birth Object Id Original Object Id of file
 +
|-
 +
| <code>FDomainId:TGUID;</code>
 +
| GUID Domain Id Domain in which object was created
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property ObjectId:TGUID read FObjectId write FObjectId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property BirthVolumeId:TGUID read FBirthVolumeId write FBirthVolumeId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property BirthObjectId:TGUID read FBirthObjectId write FBirthObjectId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property DomainId:TGUID read FDomainId write FDomainId;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 +
'''NTFS volume version attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSVolumeVersionAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS security descriptor attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSSecurityDescriptorAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: This is the same structure that is used for all security in Windows (File/Kernel/Registry etc). See TSecurityDescriptor and associated values in Security unit for more information.
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FSecurity:TNTFSSecurity;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Security:TNTFSSecurity read FSecurity;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateSecurity:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewSecurity(ASecurity:TNTFSSecurity):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS volume name attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSVolumeNameAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FVolumeName:String;</code>
 +
| Volume name
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetVolumeName:String;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetVolumeName(const AVolumeName:String);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property VolumeName:String read GetVolumeName write SetVolumeName;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS volume information attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSVolumeInformationAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FMajorVersion:Byte;</code>
 +
| Major version number
 +
|-
 +
| <code>FMinorVersion:Byte;</code>
 +
| Minor version number
 +
|-
 +
| <code>FVolumeFlags:Word;</code>
 +
| Flags
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property MajorVersion:Byte read FMajorVersion write FMajorVersion;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property MinorVersion:Byte read FMinorVersion write FMinorVersion;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property VolumeFlags:Word read FVolumeFlags write FVolumeFlags;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS data attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSDataAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS index root attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSIndexRootAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FIndexType:LongWord;</code>
 +
| Attribute Type
 +
|-
 +
| <code>FCollateRule:LongWord;</code>
 +
| Collation Rule
 +
|-
 +
| <code>FIndexRecordSize:LongWord;</code>
 +
| Size of Index Allocation Entry (bytes)
 +
|-
 +
| <code>FIndexCounterOffset:LongWord;</code>
 +
| Index Record Number increment
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property IndexType:LongWord read FIndexType write FIndexType;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property CollateRule:LongWord read FCollateRule write FCollateRule;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IndexRecordSize:LongWord read FIndexRecordSize write FIndexRecordSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IndexCounterOffset:LongWord read FIndexCounterOffset write FIndexCounterOffset;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateIndex(AVersion,ASector:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewIndex(AVersion,ASector:Word; AType,ARule,ASize,AOffset:LongWord):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS index allocation attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSIndexAllocationAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS bitmap attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSBitmapAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FBitmap:Pointer;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FBitmapSize:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetBitmapSize(AValue:LongWord);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Bitmap:Pointer read FBitmap;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property BitmapSize:LongWord read FBitmapSize write SetBitmapSize;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 +
'''NTFS reparse point attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSReparsePointAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FReparseTag:LongWord;</code>
 +
| Reparse Type (and Flags)
 +
|-
 +
| <code>FReparseSize:Word;</code>
 +
| Reparse Data Length
 +
|-
 +
| <code>FReparseGUID:TGUID;</code>
 +
| Reparse GUID
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FReparse:TNTFSReparse;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetIsAlias:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsAlias(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsHighLatency:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsHighLatency(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsMicrosoft:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetIsMicrosoft(AValue:Boolean);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property IsAlias:Boolean read GetIsAlias write SetIsAlias;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsHighLatency:Boolean read GetIsHighLatency write SetIsHighLatency;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsMicrosoft:Boolean read GetIsMicrosoft write SetIsMicrosoft;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property ReparseTag:LongWord read FReparseTag write FReparseTag;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ReparseSize:Word read FReparseSize write FReparseSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ReparseGUID:TGUID read FReparseGUID write FReparseGUID;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Reparse:TNTFSReparse read FReparse;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateReparse:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewReparse(AReparseTag:LongWord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS symbolic link attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSSymbolicLinkAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS extended attribute information'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSExtendedAttrInformationAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FPackedSize:Word;</code>
 +
| Size of the packed Extended Attributes
 +
|-
 +
| <code>FFlagCount:Word;</code>
 +
| Number of Extended Attributes with NEED_EA
 +
|-
 +
| <code>FUnpackedSize:LongWord;</code>
 +
| Size of the unpacked Extended Attributes
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property PackedSize:Word read FPackedSize write FPackedSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property FlagCount:Word read FFlagCount write FFlagCount;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property UnpackedSize:LongWord read FUnpackedSize write FUnpackedSize;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS extended attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSExtendedAttrAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FExtendeds:TNTFSExtendeds;</code>
 +
| List of attributes of this attribute
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Extendeds:TNTFSExtendeds read FExtendeds;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateExtended:TNTFSExtended;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyExtended(AExtended:TNTFSExtended):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewExtended(const AName:String):TNTFSExtended;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetExtended(const AName:String):TNTFSExtended;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveExtended(AExtended:TNTFSExtended):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ExtendedCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadExtendeds(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteExtendeds(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS property set attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSPropertySetAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS logged utility stream attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSLoggedUtilityStreamAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS end attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSEndAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):LongWord; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedDataSize(AVersion:Word):LongWord; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CalculatedStreamSize(AVersion:Word):Int64; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS unknown attribute'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSUnknownAttribute = class(TNTFSDiskAttribute)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>procedure SetDataSize(AValue:LongWord); override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS object Id'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSObjId = class(TObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of index $O in file $ObjId (Not Used)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS quota'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSQuota = class(TObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of index $Q in file $Quota (Not Used)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS owner'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSOwner = class(TObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of index $O in file $Quota (Not Used)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS upper case'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSUpCase = class(TObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of file $UpCase
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLock:TSynchronizerHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FData:Pointer;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReaderLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReaderUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriterLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriterUnlock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Data:Pointer read FData;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Init(AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Convert(ASource,ADest:Pointer; ASize:LongWord):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadUpCase(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteUpCase(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS attribute definitions'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSAttrDefs = class(TFileSysList)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FAttrDefLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetPrevious(AAttrDef:TNTFSAttrDef):TNTFSAttrDef;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function CreateAttrDef(AType:LongWord; AVersion:Word; ANew:Boolean):TNTFSAttrDef;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroyAttrDef(AAttrDef:TNTFSAttrDef):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewAttrDef(AType:LongWord; const AName:String; AVersion:Word):TNTFSAttrDef;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetAttrDef(AType:LongWord; const AName:String):TNTFSAttrDef;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetAttrDefByIndex(AIndex:Integer; AVersion:Word):TNTFSAttrDef;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetAttrDefByIndexEx(AIndex:Integer; AVersion:Word; AWrite:Boolean):TNTFSAttrDef;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetAttrDefByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSAttrDef;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveAttrDef(AAttrDef:TNTFSAttrDef):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CheckSize(AAttribute:TNTFSDiskAttribute;const ASize:Int64):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CheckIndexed(AAttribute:TNTFSDiskAttribute):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CheckResident(AAttribute:TNTFSDiskAttribute):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CheckUncompressed(AAttribute:TNTFSDiskAttribute):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function TotalSize:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AttrDefCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Init(AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadAttrDefs(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteAttrDefs(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS attribute definition'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSAttrDef = class(TListObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of file $AttrDef
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLocalLock:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FAttributeName:String;</code>
 +
| Label in Unicode
 +
|-
 +
| <code>FAttributeType:LongWord;</code>
 +
| Type
 +
|-
 +
| <code>FDisplayRule:LongWord;</code>
 +
| Display rule
 +
|-
 +
| <code>FCollateRule:LongWord;</code>
 +
| Collation rule
 +
|-
 +
| <code>FAttrDefFlags:LongWord;</code>
 +
| Flags (See Consts)
 +
|-
 +
| <code>FMinimumSize:Int64;</code>
 +
| Minimum size
 +
|-
 +
| <code>FMaximumSize:Int64;</code>
 +
| Maximum size
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FAttributeHash:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AcquireLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetAttributeName:String;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetAttributeName(const AAttributeName:String);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetIsIndexed:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsResident:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetIsUncompressed:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Compare(AAttrDef:TNTFSAttrDef):Integer; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property AttributeName:String read GetAttributeName write SetAttributeName;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AttributeType:LongWord read FAttributeType write FAttributeType;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property DisplayRule:LongWord read FDisplayRule write FDisplayRule;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property CollateRule:LongWord read FCollateRule write FCollateRule;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property AttrDefFlags:LongWord read FAttrDefFlags write FAttrDefFlags;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property MinimumSize:Int64 read FMinimumSize write FMinimumSize;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property MaximumSize:Int64 read FMaximumSize write FMaximumSize;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property IsIndexed:Boolean read GetIsIndexed;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsResident:Boolean read GetIsResident;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property IsUncompressed:Boolean read GetIsUncompressed;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Init(AIndex:Integer;AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property AttributeHash:LongWord read FAttributeHash;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadAttrDef(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteAttrDef(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS reparse'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSReparse = class(TDiskReparse)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of attribute $REPARSE_POINT
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FData:Pointer;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FDataSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FAttribute:TNTFSDiskAttribute;</code>
 +
| Attribute owning this index
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetData(AData:Pointer); virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetDataSize:Word; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetDataSize(ASize:Word); virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property Data:Pointer read FData write SetData;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property DataSize:Word read GetDataSize write SetDataSize;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Attribute:TNTFSDiskAttribute read FAttribute;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):Word; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS reparse symbolic link'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSReparseSymLink = class(TNTFSReparse)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of attribute $REPARSE_POINT (Tag 0xA000000C)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>procedure SetData(AData:Pointer); override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetDataSize(ASize:Word); override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''protected'''</div>
 +
|-
 +
| <code>FPrintName:String;</code>
 +
| Path Buffer
 +
|-
 +
| <code>FSubstituteName:String;</code>
 +
| Path Buffer
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FPrintHash:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
| <code>FSubstituteHash:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetTarget:String; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetPrintName:String;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetPrintName(const APrintName:String);</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetSubstituteName:String;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetSubstituteName(const ASubstituteName:String);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property PrintName:String read GetPrintName write SetPrintName;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property SubstituteName:String read GetSubstituteName write SetSubstituteName;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property PrintHash:LongWord read FPrintHash;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property SubstituteHash:LongWord read FSubstituteHash;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function PrintNameSize:Word; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function PrintNameOffset:Word; virtual;</code>
 +
| Print Name Offset
 +
|-
 +
| <code>function PrintNameLength:Word; virtual;</code>
 +
| Print Name Length
 +
|-
 +
| <code>function SubstituteNameSize:Word; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function SubstituteNameOffset:Word; virtual;</code>
 +
| Substitute Name Offset
 +
|-
 +
| <code>function SubstituteNameLength:Word; virtual;</code>
 +
| Substitute Name Length
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):Word; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS reparse mount point'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSReparseMountPoint = class(TNTFSReparseSymLink)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of attribute $REPARSE_POINT (Tag 0xA0000003)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function PrintNameSize:Word; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function PrintNameOffset:Word; override;</code>
 +
| Print Name Offset
 +
|-
 +
| <code>function PrintNameLength:Word; override;</code>
 +
| Print Name Length
 +
|-
 +
| <code>function SubstituteNameSize:Word; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function SubstituteNameOffset:Word; override;</code>
 +
| Substitute Name Offset
 +
|-
 +
| <code>function SubstituteNameLength:Word; override;</code>
 +
| Substitute Name Length
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CalculatedSize(AVersion:Word):Word; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS extendeds'''
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSExtendeds = class(TFileSysListEx)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create(AExtendedLocal:TMutexHandle; ALock:TSynchronizerHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FExtendedLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function TotalSize:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ExtendedCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS extended'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSExtended = class(TListObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of attribute $EA
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLocalLock:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FExtendedOffset:LongWord;</code>
 +
| Offset to next Extended Attribute (Offset to next EA is the size of this EA)
 +
|-
 +
| <code>FExtendedFlags:Byte;</code>
 +
| Flags
 +
|-
 +
| <code>FExtendedName:String;</code>
 +
| Name Note: No offset so always in the same location (Not Unicode)
 +
|-
 +
| <code>FExtendedData:Pointer;</code>
 +
| Value
 +
|-
 +
| <code>FExtendedDataSize:Word;</code>
 +
| Value Length
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FExtendedHash:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AcquireLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetExtendedName:String;</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetExtendedName(const AExtendedName:String);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetExtendedDataSize(ASize:Word);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property ExtendedOffset:LongWord read FExtendedOffset write FExtendedOffset;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ExtendedFlags:Byte read FExtendedFlags write FExtendedFlags;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ExtendedName:String read GetExtendedName write SetExtendedName;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ExtendedData:Pointer read FExtendedData;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property ExtendedDataSize:Word read FExtendedDataSize write SetExtendedDataSize;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property ExtendedHash:LongWord read FExtendedHash;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ExtendedSize:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ExtendedNameSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ExtendedNameLength:Byte;</code>
 +
| Name Length
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadExtended(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteExtended(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS security items'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSSecurityItems = class(TFileSysList)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
| <code>constructor Create;</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FSecurityLocal:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function GetPrevious(ASecurityItem:TNTFSSecurityItem):TNTFSSecurityItem;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>function CreateSecurityItem(ANew:Boolean):TNTFSSecurityItem;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DestroySecurityItem(ASecurityItem:TNTFSSecurityItem):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewSecurityItem(ASecurityId:LongWord; const ASecurityOffset:Int64; ASecurity:TNTFSSecurity):TNTFSSecurityItem;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetSecurityItem(ASecurityId:LongWord):TNTFSSecurityItem;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GetSecurityItemEx(ASecurityId:LongWord; AWrite:Boolean):TNTFSSecurityItem;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateSecurityItem(ASecurityItem:TNTFSSecurityItem; ASecurityId:LongWord; ASecurity:TNTFSSecurity):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DeleteSecurityItem(ASecurityItem:TNTFSSecurityItem):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveSecurityItem(ASecurityItem:TNTFSSecurityItem; AFree:Boolean):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function TotalSize:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function SecurityItemCount:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Init(AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadSecurityItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteSecurityItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS security item'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSSecurityItem = class(TListObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of stream $SDS in file $Secure
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FLocalLock:TMutexHandle;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FSecurityHash:LongWord;</code>
 +
| Hash of Security Descriptor
 +
|-
 +
| <code>FSecurityId:LongWord;</code>
 +
| Security Id
 +
|-
 +
| <code>FSecurityOffset:Int64;</code>
 +
| Offset of this entry in $SDS
 +
|-
 +
| <code>FSecuritySize:LongWord;</code>
 +
| Size of this entry in $SDS
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FSecurity:TNTFSSecurity;</code>
 +
| Self-relative Security Descriptor
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function AcquireLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseLock:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Compare(ASecurityItem:TNTFSSecurityItem):Integer; virtual;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CompareOld(ASecurityItem:TNTFSSecurityItem):Integer; virtual; </code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property SecurityHash:LongWord read FSecurityHash write FSecurityHash;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property SecurityId:LongWord read FSecurityId write FSecurityId;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property SecurityOffset:Int64 read FSecurityOffset write FSecurityOffset;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property SecuritySize:LongWord read FSecuritySize write FSecuritySize;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Security:TNTFSSecurity read FSecurity;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CreateSecurity:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function NewSecurity(ASecurity:TNTFSSecurity):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function UpdateSecurity(ASecurity:TNTFSSecurity):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DeleteSecurity:Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function RemoveSecurity(AFree:Boolean):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function MirrorOffset:Int64;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function Init(ASecurityId:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadSecurityItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteSecurityItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS security'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSSecurity = class(TDiskSecurity)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of attribute $SECURITY_DESCRIPTOR and stream $SDS in file $Secure
 +
|-
 +
|colspan="2"|Note: This is the same structure that is used for all security in Windows (File/Kernel/Registry etc). See TSecurityDescriptor and associated values in Security unit for more information.
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>constructor Create(ALocalLock:TMutexHandle);</code>
 +
| style="width: 50%;"|&nbsp;
 +
|-
 +
| <code>constructor CreateFromSecurity(ALocalLock:TMutexHandle; ASecurity:TDiskSecurity); override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>constructor CreateFromDescriptor(ALocalLock:TMutexHandle; ADescriptor:Pointer); override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>destructor Destroy; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
| <code>FVolumeVersion:Word;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>FRevision:Byte;</code>
 +
| Revision
 +
|-
 +
| <code>FControl:Word;</code>
 +
| Control Flags
 +
|-
 +
| <code>FSacl:PACL;</code>
 +
| SACL
 +
|-
 +
| <code>FDacl:PACL;</code>
 +
| DACL
 +
|-
 +
| <code>FOwner:PSID;</code>
 +
| Owner SID
 +
|-
 +
| <code>FGroup:PSID;</code>
 +
| Group SID
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>procedure SetSacl(ASacl:PACL);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetDacl(ADacl:PACL);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetOwner(AOwner:PSID);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetGroup(AGroup:PSID);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetSaclSize(ASize:Word);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetDaclSize(ASize:Word);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetOwnerSize(ASize:Word);</code>
 +
| &nbsp;
 +
|-
 +
| <code>procedure SetGroupSize(ASize:Word);</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
| <code>property VolumeVersion:Word read FVolumeVersion;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>property Revision:Byte read FRevision write FRevision;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Control:Word read FControl write FControl;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Sacl:PACL read FSacl write SetSacl;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Dacl:PACL read FDacl write SetDacl;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Owner:PSID read FOwner write SetOwner;</code>
 +
| &nbsp;
 +
|-
 +
| <code>property Group:PSID read FGroup write SetGroup;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function SaclSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function DaclSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function OwnerSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function GroupSize:Word;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function SaclOffset:LongWord;</code>
 +
| Offset to SACL
 +
|-
 +
| <code>function DaclOffset:LongWord;</code>
 +
| Offset to DACL
 +
|-
 +
| <code>function OwnerOffset:LongWord;</code>
 +
| Offset to Owner SID
 +
|-
 +
| <code>function GroupOffset:LongWord;</code>
 +
| Offset to Group SID
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function SaclOffsetEx(ALocal:Boolean):LongWord;</code>
 +
| Offset to SACL
 +
|-
 +
| <code>function DaclOffsetEx(ALocal:Boolean):LongWord;</code>
 +
| Offset to DACL
 +
|-
 +
| <code>function OwnerOffsetEx(ALocal:Boolean):LongWord;</code>
 +
| Offset to Owner SID
 +
|-
 +
| <code>function GroupOffsetEx(ALocal:Boolean):LongWord;</code>
 +
| Offset to Group SID
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function SecuritySize:LongWord; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function SecurityHash:LongWord;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function SecurityDescriptor:Pointer; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function SecurityDescriptorEx(ALocal:Boolean):Pointer; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function InheritedDescriptor:Pointer; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function MergedDescriptor(AChild:Pointer):Pointer; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function ReleaseDescriptor(ADescriptor:Pointer; AInherited,AMerged:Boolean):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CopyToSecurity(ASecurity:TDiskSecurity):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function CopyToDescriptor(ADescriptor:Pointer; ASize:LongWord):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CopyToDescriptorEx(ADescriptor:Pointer; ASize:LongWord; ALocal:Boolean):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function CopyFromDescriptor(ADescriptor:Pointer; ASize:LongWord):Boolean; override;</code>
 +
| &nbsp;
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
| <code>function ReadSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
| <code>function WriteSecurityEx(ABuffer:Pointer; var AOffset,ASize:LongWord; ALocal:Boolean; AVersion:Word):Boolean;</code>
 +
| &nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS security Id'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSSecurityId = class(TObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of index $SII in file $Secure (Not Used)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|}
 +
</div></div>
 +
 
 +
'''NTFS security hash'''
 +
 
 +
<div class="toccolours mw-collapsible mw-collapsed" style="border: 1; font-family: arial;">
 +
 
 +
<code>TNTFSSecurityHash = class(TObject)</code>
 +
<div class="mw-collapsible-content" style="text-align: left; padding-left: 5px;">
 +
{| class="wikitable" style="font-size: 14px; background: white;"
 +
|-
 +
|colspan="2"|Note: Data of index $SDH in file $Secure (Not Used)
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''private'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|colspan="2"|<div style="font-family: monospace,courier;">'''public'''</div>
 +
|-
 +
|colspan="2"|&nbsp;
 +
|-
 +
|}
 +
</div></div> 
 +
<br />
  
 
=== Public variables ===
 
=== Public variables ===

Revision as of 03:44, 17 March 2017

Return to Unit Reference


Description

Ultibo NTFS classes unit

To be documented

Constants

None defined

Type definitions


NTFS compare security descriptor

TNTFSCompareSecurityDescriptor = function(ASecurityId:LongWord; ADescriptor:Pointer; ASize:Word):Boolean of Object;


Class definitions


NTFS disk table

TNTFSDiskTable = class(TDiskTable)

Note: Respresents the $Mft and $MftMirr
 
constructor Create(ALocalLock:TMutexHandle);  
destructor Destroy; override;  
private
FStartSector:Int64; Absolute starting sector of this table
FStartCluster:Int64; Absolute starting cluster of this table
 
FEntry:TNTFSDiskEntry;  
public
property StartSector:Int64 read FStartSector write FStartSector;  
property StartCluster:Int64 read FStartCluster write FStartCluster;  
 
property Entry:TNTFSDiskEntry read FEntry write FEntry;  

NTFS disk block

TNTFSDiskBlock = class(TDiskBlock)

Note: Represents a block of $Bitmap entries
 
constructor Create(ALocalLock:TMutexHandle);  
destructor Destroy; override;  
private
FBlockCount:LongWord; Number of cluster entries in this block (Bits in the bitmap)
FBlockBuffer:Pointer;  
FBlockCluster:Int64; First cluster represented by this block (BlockNo represents the VCN of the block)
public
property BlockCount:LongWord read FBlockCount write FBlockCount;  
property BlockBuffer:Pointer read FBlockBuffer write FBlockBuffer;  
property BlockCluster:Int64 read FBlockCluster write FBlockCluster;  

NTFS disk entry

TNTFSDiskEntry = class(TDiskEntry)

Note: Represents a file entry.
 
constructor Create(ALocalLock:TMutexHandle; AOrigin:TNTFSDiskRecord; AAttribute:TNTFSDiskAttribute);  
destructor Destroy; override;  
private
FPrevEntry:TNTFSDiskEntry;  
FNextEntry:TNTFSDiskEntry;  
 
FUsed:Int64; Used size of the file
FAllocated:Int64; Allocated size of file
FChangeTime:TFileTime; MFT record change time
 
FOrigin:TNTFSDiskRecord; Entry origin record
FAttribute:TNTFSDiskAttribute; Entry naming attribute
FAlternate:TNTFSDiskAttribute; Alternate name attribute
 
procedure SetOrigin(AOrigin:TNTFSDiskRecord);  
public
property LocalLock:TMutexHandle read FLocalLock write FLocalLock;  
 
property PrevEntry:TNTFSDiskEntry read FPrevEntry write FPrevEntry;  
property NextEntry:TNTFSDiskEntry read FNextEntry write FNextEntry;  
 
property Used:Int64 read FUsed write FUsed;  
property Allocated:Int64 read FAllocated write FAllocated;  
property ChangeTime:TFileTime read FChangeTime write FChangeTime;  
 
property Origin:TNTFSDiskRecord read FOrigin write SetOrigin;  
property Attribute:TNTFSDiskAttribute read FAttribute write FAttribute;  
property Alternate:TNTFSDiskAttribute read FAlternate write FAlternate;  
 
function GetDot:TNTFSDiskEntry;  
function GetDotDot:TNTFSDiskEntry;  
 
function CreateDot:TNTFSDiskEntry;  
function CreateDotDot:TNTFSDiskEntry;  
 
function UpdateDot:Boolean;  
function UpdateDotDot(AEntry:TNTFSDiskEntry):Boolean;  
 
function RecordNumber:Int64;  
function FileReference:Int64;  
 
function UpdateEntry:Boolean;  
function UpdateRecord:Boolean;  
 
function FindFirstName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;  
function FindPrevName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;  
function FindNextName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;  
function FindLastName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;  

NTFS disk access contol list

TNTFSDiskAcl = class(TDiskAcl)

Note: Data of attribute $SECURITY_DESCRIPTOR
 
constructor Create(ALocalLock:TMutexHandle);  
destructor Destroy; override;  
private
 
public
 

NTFS disk access control entry

TNTFSDiskAce = class(TDiskAce)

Note: Data of attribute $SECURITY_DESCRIPTOR
 
constructor Create(ALocalLock:TMutexHandle);  
destructor Destroy; override;  
private
 
public
 

NTFS entry list

TNTFSEntryList = class(TObject)

constructor Create;  
destructor Destroy; override;  
private
FEntryCount:Integer;  
FFirstEntry:TNTFSDiskEntry;  
FLastEntry:TNTFSDiskEntry;  
 
function Link(AEntry:TNTFSDiskEntry):Boolean;  
function Unlink(AEntry:TNTFSDiskEntry):Boolean;  
public
property EntryCount:Integer read FEntryCount;  
property FirstEntry:TNTFSDiskEntry read FFirstEntry;  
property LastEntry:TNTFSDiskEntry read FLastEntry;  
 
function Add(AEntry:TNTFSDiskEntry):Boolean;  
function Remove(AEntry:TNTFSDiskEntry):Boolean;  
 
procedure ClearList; virtual;  

NTFS record list

TNTFSRecordList = class(TObject)

constructor Create;  
destructor Destroy; override;  
private
FRecordCount:Integer;  
FFirstRecord:TNTFSDiskRecord;  
FLastRecord:TNTFSDiskRecord;  
 
function Link(ARecord:TNTFSDiskRecord):Boolean;  
function Unlink(ARecord:TNTFSDiskRecord):Boolean;  
public
property RecordCount:Integer read FRecordCount;  
property FirstRecord:TNTFSDiskRecord read FFirstRecord;  
property LastRecord:TNTFSDiskRecord read FLastRecord;  
 
function Add(ARecord:TNTFSDiskRecord):Boolean;  
function Remove(ARecord:TNTFSDiskRecord):Boolean;  
 
procedure ClearList; virtual;  

NTFS record index

TNTFSRecordIndex = class(TLinkedObjBtree)

Note: Index of FILE records.
 
constructor Create;  
destructor Destroy; override;  
private
FLock:TSynchronizerHandle;  
FRecordLocal:TMutexHandle;  
 
FRunsLock:TSynchronizerHandle;  
FItemsLock:TSynchronizerHandle;  
FNodesLock:TSynchronizerHandle;  
FIndexLock:TSynchronizerHandle;  
FExtendedsLock:TSynchronizerHandle;  
FAttributesLock:TSynchronizerHandle;  
 
FRunLocal:TMutexHandle;  
FItemLocal:TMutexHandle;  
FKeyLocal:TMutexHandle;  
FNodeLocal:TMutexHandle;  
FExtendedLocal:TMutexHandle;  
FAttributeLocal:TMutexHandle;  
 
function Find(const ARecordNumber:Int64; ACurrent:TNTFSDiskRecord):TNTFSDiskRecord;  
protected
function CreateBlank:TBtreeObject; override;  
 
function Compare(AEntry1,AEntry2:TBtreeObject):Integer; override;  
public
function CreateRecord(ABase:TNTFSDiskRecord; const ARecordNumber:Int64; AVersion:Word):TNTFSDiskRecord;  
function DestroyRecord(ARecord:TNTFSDiskRecord):Boolean;  
function NewRecord(ABase:TNTFSDiskRecord; const ARecordNumber:Int64; AVersion:Word):TNTFSDiskRecord;  
function InsertRecord(ARecord:TNTFSDiskRecord):Boolean;  
function DeleteRecord(ARecord:TNTFSDiskRecord):Boolean;  
function RemoveRecord(ARecord:TNTFSDiskRecord):Boolean;  
 
function FindRecord(const ARecordNumber:Int64):TNTFSDiskRecord;  
 
function ReaderLock:Boolean;  
function ReaderUnlock:Boolean;  
function ReaderConvert:Boolean;  
function WriterLock:Boolean;  
function WriterUnlock:Boolean;  
function WriterConvert:Boolean;  
 
function RunsReaderLock:Boolean;  
function RunsReaderUnlock:Boolean;  
function RunsWriterLock:Boolean;  
function RunsWriterUnlock:Boolean;  
 
function ItemsReaderLock:Boolean;  
function ItemsReaderUnlock:Boolean;  
function ItemsWriterLock:Boolean;  
function ItemsWriterUnlock:Boolean;  
 
function NodesReaderLock:Boolean;  
function NodesReaderUnlock:Boolean;  
function NodesWriterLock:Boolean;  
function NodesWriterUnlock:Boolean;  
 
function IndexReaderLock:Boolean;  
function IndexReaderUnlock:Boolean;  
function IndexWriterLock:Boolean;  
function IndexWriterUnlock:Boolean;  
 
function ExtendedsReaderLock:Boolean;  
function ExtendedsReaderUnlock:Boolean;  
function ExtendedsWriterLock:Boolean;  
function ExtendedsWriterUnlock:Boolean;  
 
function AttributesReaderLock:Boolean;  
function AttributesReaderUnlock:Boolean;  
function AttributesWriterLock:Boolean;  
function AttributesWriterUnlock:Boolean;  

NTFS disk record

TNTFSDiskRecord = class(TBtreeObject)

Note: Represents a FILE record entry.
 
constructor Create(ALocalLock:TMutexHandle; ABase:TNTFSDiskRecord);  
destructor Destroy; override;  
private
FLocalLock:TMutexHandle;  
 
FRunsLock:TSynchronizerHandle;  
FItemsLock:TSynchronizerHandle;  
FNodesLock:TSynchronizerHandle;  
FIndexLock:TSynchronizerHandle;  
FExtendedsLock:TSynchronizerHandle;  
FAttributesLock:TSynchronizerHandle;  
 
FRunLocal:TMutexHandle;  
FItemLocal:TMutexHandle;  
FKeyLocal:TMutexHandle;  
FNodeLocal:TMutexHandle;  
FExtendedLocal:TMutexHandle;  
FAttributeLocal:TMutexHandle;  
 
FStatus:LongWord;  
 
FPrevRecord:TNTFSDiskRecord;  
FNextRecord:TNTFSDiskRecord;  
 
FRecordFlags:Word; Flags (See Consts)
FHardLinkCount:Word; Hard link count
FSequenceNumber:Word; Sequence number
FNextAttributeId:Word; Next Attribute Id
FRecordNumber:Int64; Number of this MFT Record
FRecordSize:LongWord; Actual size of the FILE record
FRecordAllocated:LongWord; Allocated size of the FILE record
 
FAttributeOffset:Word; Offset to the first Attribute
FUpdateSequenceOffset:Word; Offset to the Update Sequence Record
FUpdateSequenceLength:Word; Size in words of the Update Sequence Record
 
FUpdateSequenceNumber:Word; Update Sequence Number
FLogFileSequenceNumber:Int64; LogFile Sequence Number (LSN)
 
FBase:TNTFSDiskRecord; Base file record
FLinks:TNTFSEntryList; List of record links
FStreams:TNTFSEntryList; List of record streams
FRecords:TNTFSRecordList; List of child records
FAttributes:TNTFSDiskAttributes; List of record attributes
 
function AcquireLock:Boolean;  
function ReleaseLock:Boolean;  
 
function GetResizing:Boolean;  
procedure SetResizing(AValue:Boolean);  
function GetRemoving:Boolean;  
procedure SetRemoving(AValue:Boolean);  
 
function GetMirrored:Boolean;  
procedure SetMirrored(AValue:Boolean);  
function GetMetafile:Boolean;  
procedure SetMetafile(AValue:Boolean);  
function GetReserved:Boolean;  
procedure SetReserved(AValue:Boolean);  
function GetExpansion:Boolean;  
procedure SetExpansion(AValue:Boolean);  
 
function GetOverflow:Boolean;  
procedure SetOverflow(AValue:Boolean);  
function GetExtension:Boolean;  
procedure SetExtension(AValue:Boolean);  
 
function GetIsUsed:Boolean;  
procedure SetIsUsed(AValue:Boolean);  
function GetIsFolder:Boolean;  
procedure SetIsFolder(AValue:Boolean);  
function GetIsUnknown1:Boolean;  
procedure SetIsUnknown1(AValue:Boolean);  
function GetIsIndexView:Boolean;  
procedure SetIsIndexView(AValue:Boolean);  
 
function GetOrigin:TNTFSDiskRecord;  
 
function CreateLinks(ANew:Boolean):TNTFSEntryList;  
function CreateStreams(ANew:Boolean):TNTFSEntryList;  
function CreateRecords(ANew:Boolean):TNTFSRecordList;  
function CreateAttributes(AVersion:Word; ANew:Boolean):TNTFSDiskAttributes;  
public
property Resizing:Boolean read GetResizing write SetResizing; Record is being Resized
property Removing:Boolean read GetRemoving write SetRemoving; Record is being Removed
 
property Mirrored:Boolean read GetMirrored write SetMirrored; Record is in $MftMirr file
property Metafile:Boolean read GetMetafile write SetMetafile; Record is an NTFS metafile
property Reserved:Boolean read GetReserved write SetReserved; Record is an Mft reserved record
property Expansion:Boolean read GetExpansion write SetExpansion; Record is an Mft expansion record
 
property Overflow:Boolean read GetOverflow write SetOverflow; Record has an attribute list attribute
property Extension:Boolean read GetExtension write SetExtension; Record is an extension of the base record
 
property PrevRecord:TNTFSDiskRecord read FPrevRecord write FPrevRecord;  
property NextRecord:TNTFSDiskRecord read FNextRecord write FNextRecord;  
 
property IsUsed:Boolean read GetIsUsed write SetIsUsed; Record is in use
property IsFolder:Boolean read GetIsFolder write SetIsFolder; Record is a folder
property IsUnknown1:Boolean read GetIsUnknown1 write SetIsUnknown1;
property IsIndexView:Boolean read GetIsIndexView write SetIsIndexView; Record is an index view
 
property RecordFlags:Word read FRecordFlags write FRecordFlags;  
property HardLinkCount:Word read FHardLinkCount write FHardLinkCount;  
property SequenceNumber:Word read FSequenceNumber write FSequenceNumber;  
property NextAttributeId:Word read FNextAttributeId write FNextAttributeId;  
property RecordNumber:Int64 read FRecordNumber write FRecordNumber;  
property RecordSize:LongWord read FRecordSize write FRecordSize;  
property RecordAllocated:LongWord read FRecordAllocated write FRecordAllocated;  
 
property AttributeOffset:Word read FAttributeOffset write FAttributeOffset;  
property UpdateSequenceOffset:Word read FUpdateSequenceOffset write FUpdateSequenceOffset;  
property UpdateSequenceLength:Word read FUpdateSequenceLength write FUpdateSequenceLength;  
 
property UpdateSequenceNumber:Word read FUpdateSequenceNumber write FUpdateSequenceNumber;  
property LogFileSequenceNumber:Int64 read FLogFileSequenceNumber write FLogFileSequenceNumber;  
 
property Base:TNTFSDiskRecord read FBase write FBase;  
property Links:TNTFSEntryList read FLinks;  
property Streams:TNTFSEntryList read FStreams;  
property Records:TNTFSRecordList read FRecords;  
property Attributes:TNTFSDiskAttributes read FAttributes;  
 
property Origin:TNTFSDiskRecord read GetOrigin;  
 
function CreateLink(AAttribute,AAlternate:TNTFSDiskAttribute; ANew:Boolean):TNTFSDiskEntry;  
function DestroyLink(ALink:TNTFSDiskEntry):Boolean;  
function NewLink(AAttribute,AAlternate:TNTFSDiskAttribute):TNTFSDiskEntry;  
function GetLink(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;  
function DeleteLink(ALink:TNTFSDiskEntry):Boolean;  
function RenameLink(ALink:TNTFSDiskEntry; AAttribute,AAlternate:TNTFSDiskAttribute):Boolean;  
 
function CreateStream(AAttribute:TNTFSDiskAttribute; ANew:Boolean):TNTFSDiskEntry;  
function DestroyStream(AStream:TNTFSDiskEntry):Boolean;  
function NewStream(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;  
function GetStream(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;  
function DeleteStream(AStream:TNTFSDiskEntry):Boolean;  
 
function GetFileNameByKey(AKey:TNTFSAttributeKey):TNTFSDiskAttribute;  
function GetFileNameByName(const AName:String; AInstance:Integer):TNTFSDiskAttribute;  
function GetFileNameByParent(const AName:String; const AParent:Int64; AInstance:Integer):TNTFSDiskAttribute;  
function GetFileNameByNameSpace(const AName:String; const AParent:Int64; ANameSpace:Byte; AInstance:Integer):TNTFSDiskAttribute;  
 
function GetRecord(AInstance:Integer):TNTFSDiskRecord;  
function GetRecordByFree(AFree:LongWord; AExclude:Boolean):TNTFSDiskRecord;  
function GetRecordByReference(const AFileReference:Int64):TNTFSDiskRecord;  
 
function AddRecord(ARecord:TNTFSDiskRecord):Boolean;  
function RemoveRecord(ARecord:TNTFSDiskRecord):Boolean;  
 
function GetAttributeByItem(AItem:TNTFSDiskItem):TNTFSDiskAttribute;  
function GetAttributeByStatus(AInclude,AExclude:Word; AInstance:Integer):TNTFSDiskAttribute;  
function GetAttributeByVCN(AAttribute:TNTFSDiskAttribute; const AVCN:Int64; var AInstance:LongWord):TNTFSDiskAttribute;  
function GetAttributeByUnit(AAttribute:TNTFSDiskAttribute; const AUnit:Int64; var AInstance:LongWord):TNTFSDiskAttribute;  
 
function CreateAttribute(AType:LongWord; AVersion:Word; ANew:Boolean):TNTFSDiskAttribute;  
function DestroyAttribute(AAttribute:TNTFSDiskAttribute):Boolean;  
function NewAttribute(APrevious:TNTFSDiskAttribute; AType:LongWord; const AName:String; AVersion:Word):TNTFSDiskAttribute;  
function GetAttribute(AType:LongWord; const AName:String; AInstance:Integer):TNTFSDiskAttribute;  
function RemoveAttribute(AAttribute:TNTFSDiskAttribute):Boolean;  
function MoveAttribute(ADest:TNTFSDiskRecord; AAttribute:TNTFSDiskAttribute):Boolean;  
function RenameAttribute(AAttribute:TNTFSDiskAttribute; const AName:String):Boolean;  
 
function FileReference:Int64;  
function BaseReference:Int64; File reference to the base FILE record
 
function LinkCount:LongWord;  
function StreamCount:LongWord;  
function RecordCount:LongWord;  
function AttributeCount:LongWord;  
 
function RecordFree:LongWord;  
function AttributeSize(AVersion:Word; AType:LongWord):LongWord;  
 
function CalculatedSize(AVersion:Word):LongWord;  
function CalculatedOffset(AVersion:Word):Word;  
function CalculatedSequenceOffset(AVersion:Word):Word;  
function CalculatedSequenceLength(ASectorSize:Word):Word;  
function CalculatedStreamUsed(AVersion:Word; AAttribute:TNTFSDiskAttribute):Int64;  
 
function ReadAttributes(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
function WriteAttributes(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
 
function ReadRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word; AFree:Boolean):Boolean;  
function WriteRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  

NTFS disk index

TNTFSDiskIndex = class(TLinkedObjBtree)

Note: Index of INDX records.
 
constructor Create(AKeyLocal:TMutexHandle; ALock:TSynchronizerHandle; AVolumeVersion,ASectorSize:Word; AIndexType,ACollateRule:LongWord; AAttribute:TNTFSDiskAttribute);  
destructor Destroy; override;  
private
FLock:TSynchronizerHandle;  
FKeyLocal:TMutexHandle;  
 
FStatus:LongWord;  
 
FSectorSize:Word;  
FVolumeVersion:Word;  
 
FIndexType:LongWord; Attribute Type (Or None if Data Index)
FCollateRule:LongWord; Collation Rule
FIndexRecordSize:LongWord; Size of Index Allocation Entry (bytes)
FIndexCounterOffset:LongWord; Index Record Number increment
 
FClustersPerIndex:LongWord; Clusters per INDX Record or 0 if less than cluster size
FIndexsPerCluster:LongWord; INDX Records per Cluster or 0 if more than cluster size
 
FIndexCounterShift:Word; Shift count for Record -> Counter
FIndexRecordShiftCount:Word; Shift count for Record -> VCN
FIndexRecordOffsetMask:Int64; Mask for Record offset calculation
 
FTotalIndexRecordCount:Int64; Total number of index records in index
 
FLastFreeIndexRecord:Int64; Or ntfsUnknownRecordNumber if not known
FFreeIndexRecordCount:Int64; Or ntfsUnknownRecordNumber if not known
 
FCompareSecurityDescriptor:TNTFSCompareSecurityDescriptor;  
 
FUpCase:TNTFSUpCase; Uppercase Conversion Table
 
FNodes:TNTFSDiskNodes; List of index nodes
FAttribute:TNTFSDiskAttribute; Attribute owning this index
 
function GetNodesLock:TSynchronizerHandle;  
 
function GetKeyLocal:TMutexHandle;  
function GetNodeLocal:TMutexHandle;  
 
function GetLoaded:Boolean;  
procedure SetLoaded(AValue:Boolean);  
function GetChanged:Boolean;  
 
function GetUpCase:PNTFSUpCaseData;  
function GetRootNode:TNTFSDiskNode;  
 
function CreateNodes(ANew:Boolean):TNTFSDiskNodes;  
 
function CompareKey(AEntry1,AEntry2:Pointer; ASize1,ASize2:Word):Integer;  
 
function CompareBinary(AEntry1,AEntry2:Pointer; ASize1,ASize2:Word):Integer;  
function CompareFileName(AEntry1,AEntry2:PWideChar; ASize1,ASize2:Word):Integer;  
function CompareUnicode(AEntry1,AEntry2:PWideChar; ASize1,ASize2:Word):Integer;  
function CompareLongWord(AEntry1,AEntry2:LongWord; ASize1,ASize2:Word):Integer;  
function CompareSID(AEntry1,AEntry2:PSID; ASize1,ASize2:Word):Integer;  
function CompareSecurityHash(AEntry1,AEntry2:PNTFSSecurityHashKeyData; ASize1,ASize2:Word):Integer;  
function CompareGUID(AEntry1,AEntry2:PGUID; ASize1,ASize2:Word):Integer;  
protected
function GetEnd(AEntry:TBtreeObject):TBtreeObject; override;  
function GetStart(AEntry:TBtreeObject):TBtreeObject; override;  
function GetBlank(AEntry:TBtreeObject):TBtreeObject; override;  
function GetMedian(AEntry:TBtreeObject):TBtreeObject; override;  
 
function GetDropTest(AEntry:TBtreeObject; var ALeft:Boolean):TBtreeObject;  
function GetDrop(AEntry:TBtreeObject; var ALeft:Boolean):TBtreeObject; override;  
function GetMerge(AEntry:TBtreeObject):TBtreeObject; override;  
function GetBorrow(AEntry:TBtreeObject):TBtreeObject; override;  
function GetTarget(ADrop:TBtreeObject; ALeft:Boolean):TBtreeObject; override;  
 
function PushNode(AEntry:TBtreeObject):Boolean; override;  
function SplitNode(AEntry:TBtreeObject):Boolean; override;  
function DropNode(AEntry,ADrop,ATarget:TBtreeObject; ALeft:Boolean):Boolean; override;  
function DropNodeOld(AEntry,ADrop:TBtreeObject; ALeft:Boolean):Boolean; override;  
function MergeNode(AEntry,AMerge:TBtreeObject):Boolean; override;  
function BorrowEntry(AEntry,ABorrow:TBtreeObject):Boolean; override;  
 
function SwapEntry(AEntry,ASwap:TBtreeObject;ALeft:Boolean):Boolean; override;  
function SetParentEntry(AEntry,AParent:TBtreeObject):Boolean; override;  
 
function DeleteBlank(ABlank:TBtreeObject):Boolean; override;  
 
function AttachBlank(ABlank:TBtreeObject):Boolean; override;  
function DetachBlank(ABlank:TBtreeObject):Boolean; override;  
 
function AttachEntry(AEntry:TBtreeObject):Boolean; override;  
function DetachEntry(AEntry:TBtreeObject):Boolean; override;  
 
function RequirePush(AEntry:TBtreeObject):Boolean; override;  
function RequireSplit(AEntry:TBtreeObject):Boolean; override;  
function RequireDrop(AEntry:TBtreeObject):Boolean; override;  
function RequireMerge(AEntry:TBtreeObject):Boolean; override;  
function RequireBorrow(AEntry:TBtreeObject):Boolean; override;  
public
property Loaded:Boolean read GetLoaded write SetLoaded;  
property Changed:Boolean read GetChanged;  
 
property SectorSize:Word read FSectorSize write FSectorSize;  
property VolumeVersion:Word read FVolumeVersion;  
 
property IndexType:LongWord read FIndexType write FIndexType;  
property CollateRule:LongWord read FCollateRule write FCollateRule;  
property IndexRecordSize:LongWord read FIndexRecordSize write FIndexRecordSize;  
property IndexCounterOffset:LongWord read FIndexCounterOffset write FIndexCounterOffset;  
 
property ClustersPerIndex:LongWord read FClustersPerIndex write FClustersPerIndex;  
property IndexsPerCluster:LongWord read FIndexsPerCluster write FIndexsPerCluster;  
 
property IndexCounterShift:Word read FIndexCounterShift write FIndexCounterShift;  
property IndexRecordShiftCount:Word read FIndexRecordShiftCount write FIndexRecordShiftCount;  
property IndexRecordOffsetMask:Int64 read FIndexRecordOffsetMask write FIndexRecordOffsetMask;  
 
property TotalIndexRecordCount:Int64 read FTotalIndexRecordCount write FTotalIndexRecordCount;  
 
property LastFreeIndexRecord:Int64 read FLastFreeIndexRecord write FLastFreeIndexRecord;  
property FreeIndexRecordCount:Int64 read FFreeIndexRecordCount write FFreeIndexRecordCount;  
 
property CompareSecurityDescriptor:TNTFSCompareSecurityDescriptor read FCompareSecurityDescriptor write FCompareSecurityDescriptor;  
 
property UpCase:TNTFSUpCase read FUpCase write FUpCase;  
 
property Nodes:TNTFSDiskNodes read FNodes;  
property Attribute:TNTFSDiskAttribute read FAttribute;  
 
property RootNode:TNTFSDiskNode read GetRootNode;  
 
function NodeCount:Integer;  
 
function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; virtual;  
function DestroyKey(AKey:TNTFSDiskKey):Boolean;  
function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; virtual;  
function NewKeyEx(AKey,AData,APadding:Pointer; AKeySize,ADataSize,APaddingSize:Word):TNTFSDiskKey; virtual;  
function AddKey(AParent,AKey:TNTFSDiskKey):Boolean;  
function InsertKey(AKey:TNTFSDiskKey):Boolean;  
function RemoveKey(AKey:TNTFSDiskKey):Boolean;  
 
function CreateNode(ANew:Boolean):TNTFSDiskNode;  
function DestroyNode(ANode:TNTFSDiskNode):Boolean;  
function NewNode(const ARecordNumber:Int64):TNTFSDiskNode;  
function GetNode(const ARecordNumber:Int64):TNTFSDiskNode;  
function DeleteNode(ANode:TNTFSDiskNode):Boolean;  
function RemoveNode(ANode:TNTFSDiskNode):Boolean;  
 
function UpdateNodes(AVersion:Word):Boolean; virtual;  
 
function FindKey(AValue:Pointer; ASize:Word):TNTFSDiskKey; virtual;  
 
function ReadRoot(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
function WriteRoot(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
 
function ReadKeys(AParent:TNTFSDiskKey; ANode:TNTFSDiskNode; ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
function WriteKeys(AParent:TNTFSDiskKey; ANode:TNTFSDiskNode; ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
 
function ReaderLock:Boolean;  
function ReaderUnlock:Boolean;  
function WriterLock:Boolean;  
function WriterUnlock:Boolean;  

NTFS data index

TNTFSDataIndex = class(TNTFSDiskIndex)

private
function CompareSecurityDescriptor(AHash1,AHash2,ASecurityId:LongWord; ADescriptor:Pointer; ASize:Word):Integer;  
 
function Find(AValue:Pointer; ASize:Word; ACurrent:TNTFSDataKey):TNTFSDataKey;  
function FindEx(AValue:Pointer; ASize:Word; AHash:LongWord; ACurrent:TNTFSDataKey):TNTFSDataKey;  
protected
function CreateBlank:TBtreeObject; override;  
 
function Compare(AEntry1,AEntry2:TBtreeObject):Integer; override;  
public
function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; override;  
function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; override;  
 
function GetKeyBySID(ASID:PSID):TNTFSDiskKey;  
function GetKeyByOwner(AOwner:LongWord):TNTFSDiskKey;  
function GetKeyByObjectId(const AObjectId:TGUID):TNTFSDiskKey;  
function GetKeyBySecurity(ASecurity:TNTFSSecurity):TNTFSDiskKey;  
function GetKeyByReparse(AReparseTag:LongWord; const AFileReference:Int64):TNTFSDiskKey;  
 
function FindKey(AValue:Pointer;ASize:Word):TNTFSDiskKey; override;  

NTFS padded index

TNTFSPaddedIndex = class(TNTFSDataIndex)

Note: A DataIndex that allows a block of Padding to be specified.
 
protected
function CreateBlank:TBtreeObject; override;  
private
function CreateBlank:TBtreeObject; override;  
public
function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; override;  
function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; override;  
function NewKeyEx(AKey,AData,APadding:Pointer; AKeySize,ADataSize,APaddingSize:Word):TNTFSDiskKey; override;  

NTFS attribute index

TNTFSAttributeIndex = class(TNTFSDiskIndex)

private
function Find(AValue:Pointer; ASize:Word; ACurrent:TNTFSAttributeKey):TNTFSAttributeKey;  
protected
function CreateBlank:TBtreeObject; override;  
 
function Compare(AEntry1,AEntry2:TBtreeObject):Integer; override;  
public
function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; override;  
function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; override;  
 
function GetKeyByFileName(const AFileName:String):TNTFSDiskKey;  
 
function NewKeyByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSDiskKey;  
function GetKeyByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSDiskKey;  
 
function FindKey(AValue:Pointer; ASize:Word):TNTFSDiskKey; override;  

NTFS disk nodes

TNTFSDiskNodes = class(TFileSysListEx)

constructor Create(ANodeLocal:TMutexHandle; ALock:TSynchronizerHandle);  
destructor Destroy; override;  
private
FNodeLocal:TMutexHandle;  
 
function GetModified:Boolean;  
procedure SetModified(AValue:Boolean);  
public
property Modified:Boolean read GetModified write SetModified;  
 
function TotalSize:LongWord;  
 
function NodeCount:LongWord;  

NTFS disk node

TNTFSDiskNode = class(TListObject)

Note: Represents an INDX record header.
 
constructor Create(ALocalLock:TMutexHandle; AIndex:TNTFSDiskIndex);  
destructor Destroy; override;  
private
FLocalLock:TMutexHandle;  
 
FStatus:LongWord;  
 
FIndexFlags:Word; Flags (See Consts)
FIndexSize:LongWord; Total size of the Index Entries
FIndexAllocated:LongWord; Allocated size of the Index Entries
FEntryOffset:LongWord; Offset to first Index Entry
 
FRecordNumber:Int64; Number of this INDX record in the Index Allocation
FUpdateSequenceOffset:Word; Offset to the Update Sequence Record
FUpdateSequenceLength:Word; Size in words of the Update Sequence Record
 
FUpdateSequenceNumber:Word; Update Sequence Number
FLogFileSequenceNumber:Int64; LogFile sequence number
 
FIndex:TNTFSDiskIndex; Index owning this node
FBlank:TNTFSDiskKey; Blank key of this node (Blank keys do not move)
 
function AcquireLock:Boolean;  
function ReleaseLock:Boolean;  
 
function GetAdded:Boolean;  
procedure SetAdded(AValue:Boolean);  
function GetDeleted:Boolean;  
procedure SetDeleted(AValue:Boolean);  
function GetChanged:Boolean;  
procedure SetChanged(AValue:Boolean);  
 
function GetModified:Boolean;  
procedure SetModified(AValue:Boolean);  
 
function GetIsRoot:Boolean;  
 
function GetHasSubNodes:Boolean;  
procedure SetHasSubNodes(AValue:Boolean);  
 
function GetStart:TNTFSDiskKey;  
public
property Added:Boolean read GetAdded write SetAdded; Index record to be allocated
property Deleted:Boolean read GetDeleted write SetDeleted; Index record to be deallocated
property Changed:Boolean read GetChanged write SetChanged; Index record to be updated
 
property Modified:Boolean read GetModified write SetModified; Index record has been added, deleted or changed
 
property IsRoot:Boolean read GetIsRoot;  
 
property HasSubNodes:Boolean read GetHasSubNodes write SetHasSubNodes;  
 
property IndexFlags:Word read FIndexFlags write FIndexFlags;  
property IndexSize:LongWord read FIndexSize write FIndexSize;  
property IndexAllocated:LongWord read FIndexAllocated write FIndexAllocated;  
property EntryOffset:LongWord read FEntryOffset write FEntryOffset;  
 
property RecordNumber:Int64 read FRecordNumber write FRecordNumber;  
property UpdateSequenceOffset:Word read FUpdateSequenceOffset write FUpdateSequenceOffset;  
property UpdateSequenceLength:Word read FUpdateSequenceLength write FUpdateSequenceLength;  
 
property UpdateSequenceNumber:Word read FUpdateSequenceNumber write FUpdateSequenceNumber;  
property LogFileSequenceNumber:Int64 read FLogFileSequenceNumber write FLogFileSequenceNumber;  
 
property Index:TNTFSDiskIndex read FIndex;  
property Blank:TNTFSDiskKey read FBlank write FBlank;  
property Start:TNTFSDiskKey read GetStart;  
 
function KeyCount:Integer;  
 
function IndexFree:LongWord;  
 
function UpdateKeys(AVersion:Word):Boolean; virtual;  
 
function CalculatedSize(AVersion:Word):LongWord;  
function CalculatedOffset(AVersion:Word):LongWord;  
function CalculatedAllocated(AVersion:Word):LongWord;  
function CalculatedSequenceOffset(AVersion:Word):Word;  
function CalculatedSequenceLength(ASectorSize:Word):Word;  
 
function WriteEmpty(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word; var AUpdateSequenceOffset,AUpdateSequenceLength:Word):Boolean;  
 
function ReadRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
function WriteRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
 
function ReadHeader(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
function WriteHeader(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  

NTFS disk key

TNTFSDiskKey = class(TBtreeObject)

Note: Represents an INDX record entry.
 
constructor Create(ALocalLock:TMutexHandle);  
destructor Destroy; override;  
private
FLocalLock:TMutexHandle;  
 
FStatus:LongWord;  
FKey:Pointer;  
 
FEntryFlags:Word; Flags (See Consts)
FEntrySize:Word; Length of the index entry
FKeySize:Word; Length of the key entry
FSubNodeNumber:Int64; Number of the sub-node in the index allocation attribute
 
FNode:TNTFSDiskNode; Index node of this key
 
function AcquireLock:Boolean;  
function ReleaseLock:Boolean;  
 
function GetChanged:Boolean;  
procedure SetChanged(AValue:Boolean);  
 
function GetHasSubNode:Boolean;  
procedure SetHasSubNode(AValue:Boolean);  
function GetIsLastNode:Boolean;  
procedure SetIsLastNode(AValue:Boolean);  
 
procedure SetKeySize(ASize:Word); virtual;  
procedure SetSubNodeNumber(const ANodeNumber:Int64);  
 
procedure SetNode(ANode:TNTFSDiskNode);  
public
property Changed:Boolean read GetChanged write SetChanged; Index record to be updated
 
property HasSubNode:Boolean read GetHasSubNode write SetHasSubNode;  
property IsLastNode:Boolean read GetIsLastNode write SetIsLastNode;  
 
property Key:Pointer read FKey;  
 
property EntryFlags:Word read FEntryFlags write FEntryFlags;  
property EntrySize:Word read FEntrySize write FEntrySize;  
property KeySize:Word read FKeySize write SetKeySize;  
property SubNodeNumber:Int64 read FSubNodeNumber write SetSubNodeNumber;  
 
property Node:TNTFSDiskNode read FNode write SetNode;  
 
function CalculatedSize(AVersion:Word):Word; virtual;  
 
function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;  
function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;  

NTFS data key

TNTFSDataKey = class(TNTFSDiskKey)

constructor Create(ALocalLock:TMutexHandle);  
destructor Destroy; override;  
private
FData:Pointer;  
 
FDataSize:Word; Size of the data (Only valid when the last entry flag is not set)
 
procedure SetKeySize(ASize:Word); override;  
procedure SetData(AData:Pointer);  
procedure SetDataSize(ASize:Word);  
public
property Data:Pointer read FData write SetData;  
 
property DataSize:Word read FDataSize write SetDataSize;  
 
function DataOffset:Word; Offset to the data (Only valid when the last entry flag is not set)
function CalculatedSize(AVersion:Word):Word; override;  
 
function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;  
function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;  

NTFS padded key

TNTFSPaddedKey = class(TNTFSDataKey)

constructor Create(ALocalLock:TMutexHandle);  
destructor Destroy; override;  
private
FPadding:Pointer;  
FPaddingSize:Word;  
 
procedure SetPadding(APadding:Pointer);  
procedure SetPaddingSize(ASize:Word);  
public
property Padding:Pointer read FPadding write SetPadding;  
property PaddingSize:Word read FPaddingSize write SetPaddingSize;  
 
function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;  
function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;  

NTFS attribute key

TNTFSAttributeKey = class(TNTFSDiskKey)

constructor Create(ALocalLock:TMutexHandle);  
destructor Destroy; override;  
private
FFileReference:Int64; File reference (Only valid when the last entry flag is not set)
 
FAttribute:TNTFSDiskAttribute; Indexed attribute of this key
 
function GetInvalid:Boolean;  
procedure SetInvalid(AValue:Boolean);  
 
procedure SetKeySize(ASize:Word); override;  
procedure SetAttribute(AAttribute:TNTFSDiskAttribute);  
public
property Invalid:Boolean read GetInvalid write SetInvalid; Key points to invalid file record or attribute
 
property FileReference:Int64 read FFileReference write FFileReference;  
 
property Attribute:TNTFSDiskAttribute read FAttribute write SetAttribute;  
 
function UpdateKey:Boolean;  
 
function RecordNumber:Int64;  
 
function CalculatedSize(AVersion:Word):Word; override;  
 
function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;  
function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;  

NTFS disk runs

TNTFSDiskRuns = class(TFileSysListEx)

constructor Create(ARunLocal:TMutexHandle; ALock:TSynchronizerHandle);  
destructor Destroy; override;  
private
FRunLocal:TMutexHandle;  
 
FRecent:TNTFSDiskRun;  
FRecentVCN:Int64;  
 
function GetStart:TNTFSDiskRun;  
function GetFinal:TNTFSDiskRun;  
public
property Recent:TNTFSDiskRun read FRecent write FRecent;  
property RecentVCN:Int64 read FRecentVCN write FRecentVCN;  
 
function SparseCount:Int64; Count of sparse runs in list
function ClusterCount:Int64; Count of normal runs in list
function AllocatedCount:Int64; Count of allocated runs in list
 
function TotalSize:LongWord; Total size of the encoded data runs
 
function RunCount:LongWord;  

NTFS disk run

TNTFSDiskRun = class(TListObject)

constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);  
destructor Destroy; override;  
private
FLocalLock:TMutexHandle;  
 
FStart:Int64; Run start logical cluster
FOffset:Int64; Run start cluster offset
FLength:Int64; Run length in clusters
 
FAttribute:TNTFSDiskAttribute; Attribute owning this run
 
function AcquireLock:Boolean;  
function ReleaseLock:Boolean;  
 
function GetIsLast:Boolean;  
function GetIsSparse:Boolean;  
 
function GetOffsetSize:Byte;  
function GetLengthSize:Byte;  
 
procedure SetStart(const AStart:Int64);  
procedure SetOffset(const AOffset:Int64);  
 
function GetSuccessor:TNTFSDiskRun;  
function GetPredecessor:TNTFSDiskRun;  
public
property IsLast:Boolean read GetIsLast;  
property IsSparse:Boolean read GetIsSparse;  
 
property Start:Int64 read FStart write SetStart;  
property Offset:Int64 read FOffset write SetOffset;  
property Length:Int64 read FLength write FLength;  
 
property Attribute:TNTFSDiskAttribute read FAttribute;  
 
function RunSize:LongWord; Size of the encoded data run
 
function UpdateRun:Boolean;  
 
function ReadRun(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;  
function WriteRun(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;  

NTFS disk items

TNTFSDiskItems = class(TFileSysListEx)

constructor Create(AItemLocal:TMutexHandle; ALock:TSynchronizerHandle);  
destructor Destroy; override;  
private
FItemLocal:TMutexHandle;  
 
FStatus:LongWord;  
 
function GetLoaded:Boolean;  
procedure SetLoaded(AValue:Boolean);  
 
function GetPrevious(AItem:TNTFSDiskItem):TNTFSDiskItem;  
public
property Loaded:Boolean read GetLoaded write SetLoaded;  
 
function TotalSize:Int64;  
 
function ItemCount:LongWord;  

NTFS disk item

TNTFSDiskItem = class(TListObject)

Note: Data of attribute $ATTRIBUTE_LIST
 
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskAttribute);  
destructor Destroy; override;  
private
FLocalLock:TMutexHandle;  
 
FStatus:LongWord;  
 
FItemSize:Word; Record length
FStartVCN:Int64; Starting VCN if non resident
FFileReference:Int64; File Reference of the attribute
FAttributeType:LongWord; Attribute Type
FAttributeId:Word; Attribute Id
FAttributeName:String; Name in Unicode (if NameLength > 0)
 
FParent:TNTFSDiskAttribute; Attribute list owning this item
FAttribute:TNTFSDiskAttribute; Attribute pointed to by this item
 
FAttributeHash:LongWord;  
 
function AcquireLock:Boolean;  
function ReleaseLock:Boolean;  
 
function GetInvalid:Boolean;  
procedure SetInvalid(AValue:Boolean);  
 
function GetAttributeName:String;  
procedure SetAttributeName(const AAttributeName:String);  
procedure SetAttribute(AAttribute:TNTFSDiskAttribute);  
 
function Compare(AItem:TNTFSDiskItem):Integer; virtual;  
public
property Invalid:Boolean read GetInvalid write SetInvalid; Item points to invalid file record or attribute
 
property ItemSize:Word read FItemSize write FItemSize;  
property StartVCN:Int64 read FStartVCN write FStartVCN;  
property FileReference:Int64 read FFileReference write FFileReference;  
property AttributeType:LongWord read FAttributeType write FAttributeType;  
property AttributeId:Word read FAttributeId write FAttributeId;  
property AttributeName:String read GetAttributeName write SetAttributeName;  
 
property Parent:TNTFSDiskAttribute read FParent;  
property Attribute:TNTFSDiskAttribute read FAttribute write SetAttribute;  
 
property AttributeHash:LongWord read FAttributeHash;  
 
function RecordNumber:Int64;  
 
function AttributeNameSize:Word;  
function AttributeNameLength:Byte; Name length
function AttributeNameOffset:Byte; Offset to Name
 
function UpdateItem:Boolean;  
 
function CalculatedSize(AVersion:Word):Word;  
 
function ReadItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
function WriteItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  

NTFS disk attributes

TNTFSDiskAttributes = class(TFileSysListEx)

constructor Create(AAttributeLocal:TMutexHandle; ALock:TSynchronizerHandle);  
destructor Destroy; override;  
private
FAttributeLocal:TMutexHandle;  
 
function GetPrevious(AAttribute:TNTFSDiskAttribute):TNTFSDiskAttribute;  
public
function TotalSize:LongWord;  
 
function AttributeCount:LongWord;  

NTFS disk attribute

TNTFSDiskAttribute = class(TListObject)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
private
FLocalLock:TMutexHandle;  
protected
FStatus:LongWord;  
FData:Pointer; Only applicable if attribute is resident
 
FAttributeType:LongWord; Attribute Type (e.g. 0x80, 0xA0)
FAttributeSize:LongWord; Length of the Attribute (including header)
FAttributeFlags:Word; Attribute Flags
FAttributeId:Word; Attribute Id
FAttributeName:String; Attribute Name
FNonResident:Byte; Non-resident flag
 
FIndexed:Byte; Indexed flag
FDataSize:LongWord; Length of the Attribute Data
 
FStartVCN:Int64; Starting VCN
FLastVCN:Int64; Last VCN
FStreamSize:Int64; Real size of the attribute
FStreamUsed:Int64; The actual Allocated size of the attribute (Only present when compressed and only in the first instance)
FStreamAllocated:Int64; Allocated size of the attribute
FInitializedSize:Int64; Initialized data size of the stream (Portion which has been Written)
FCompressionUnit:Word; Compression Unit Size
 
FRuns:TNTFSDiskRuns; List of runs of this attribute
FItems:TNTFSDiskItems; List of items of this attribute
FIndex:TNTFSDiskIndex; Index of this attribute if applicable
FParent:TNTFSDiskRecord; Record owning this attribute
 
FAttributeHash:LongWord;  
 
function AcquireLock:Boolean;  
function ReleaseLock:Boolean;  
 
function GetRunsLock:TSynchronizerHandle;  
function GetItemsLock:TSynchronizerHandle;  
function GetIndexLock:TSynchronizerHandle;  
function GetExtendedsLock:TSynchronizerHandle;  
 
function GetRunLocal:TMutexHandle;  
function GetItemLocal:TMutexHandle;  
function GetKeyLocal:TMutexHandle;  
function GetExtendedLocal:TMutexHandle;  
 
function GetUpdating:Boolean;  
procedure SetUpdating(AValue:Boolean);  
 
function GetIsFixed:Boolean;  
function GetIsSingle:Boolean;  
function GetIsUnlisted:Boolean;  
function GetIsUnmovable:Boolean;  
function GetIsManaged:Boolean;  
 
function GetIsSparse:Boolean;  
procedure SetIsSparse(AValue:Boolean);  
function GetIsEncrypted:Boolean;  
procedure SetIsEncrypted(AValue:Boolean);  
function GetIsCompressed:Boolean;  
procedure SetIsCompressed(AValue:Boolean);  
 
function GetAttributeName:String;  
procedure SetAttributeName(const AAttributeName:String);  
 
function GetDataSize:LongWord; virtual;  
procedure SetDataSize(AValue:LongWord); virtual;  
 
function Compare(AAttribute:TNTFSDiskAttribute):Integer; virtual;  
 
function CreateRuns(ANew:Boolean):TNTFSDiskRuns;  
function CreateItems(ANew:Boolean):TNTFSDiskItems;  
 
function GetRecord(AInstance:Integer):TNTFSDiskRecord;  
function GetAttribute(AType:LongWord; const AName:String; AInstance:Integer):TNTFSDiskAttribute;  
public
property Updating:Boolean read GetUpdating write SetUpdating;  
 
property IsFixed:Boolean read GetIsFixed;  
property IsSingle:Boolean read GetIsSingle;  
property IsUnlisted:Boolean read GetIsUnlisted;  
property IsUnmovable:Boolean read GetIsUnmovable;  
property IsManaged:Boolean read GetIsManaged;  
 
property IsSparse:Boolean read GetIsSparse write SetIsSparse;  
property IsEncrypted:Boolean read GetIsEncrypted write SetIsEncrypted;  
property IsCompressed:Boolean read GetIsCompressed write SetIsCompressed;  
 
property Data:Pointer read FData;  
 
property AttributeType:LongWord read FAttributeType;  
property AttributeSize:LongWord read FAttributeSize write FAttributeSize;  
property AttributeFlags:Word read FAttributeFlags write FAttributeFlags;  
property AttributeId:Word read FAttributeId write FAttributeId;  
property AttributeName:String read GetAttributeName write SetAttributeName;  
property NonResident:Byte read FNonResident write FNonResident;  
 
property Indexed:Byte read FIndexed write FIndexed;  
property DataSize:LongWord read GetDataSize write SetDataSize;  
 
property StartVCN:Int64 read FStartVCN write FStartVCN;  
property LastVCN:Int64 read FLastVCN write FLastVCN;  
property StreamSize:Int64 read FStreamSize write FStreamSize;  
property StreamUsed:Int64 read FStreamUsed write FStreamUsed;  
property StreamAllocated:Int64 read FStreamAllocated write FStreamAllocated;  
property InitializedSize:Int64 read FInitializedSize write FInitializedSize;  
property CompressionUnit:Word read FCompressionUnit write FCompressionUnit;  
 
property Runs:TNTFSDiskRuns read FRuns;  
property Items:TNTFSDiskItems read FItems;  
property Index:TNTFSDiskIndex read FIndex;  
property Parent:TNTFSDiskRecord read FParent write FParent;  
 
property AttributeHash:LongWord read FAttributeHash;  
 
function GetRunCount(const AVCN:Int64; var AStartVCN,ACount:Int64):Boolean;  
function GetRunLength(const AVCN:Int64; var AStartVCN,ALength:Int64):Boolean;  
function GetRunByUnit(const AUnit:Int64; var AStartVCN:Int64):TNTFSDiskRun;  
function GetRunByCluster(const ACluster:Int64; var AStartVCN:Int64):TNTFSDiskRun;  
 
function CreateRun(ANew:Boolean):TNTFSDiskRun;  
function DestroyRun(ARun:TNTFSDiskRun):Boolean;  
function NewRun(const AStart,ALength:Int64):TNTFSDiskRun;  
function InsertRun(APrev:TNTFSDiskRun; const AStart,ALength:Int64):TNTFSDiskRun;  
function GetRun(const AVCN:Int64; var AStartVCN:Int64):TNTFSDiskRun;  
function GetRunOld(const AVCN:Int64; var AStartVCN:Int64):TNTFSDiskRun;  
function MergeRun(ARun:TNTFSDiskRun):Boolean;  
function SplitRun(ARun:TNTFSDiskRun; const ALength:Int64):Boolean;  
function RemoveRun(ARun:TNTFSDiskRun):Boolean;  
function MoveRun(ADest:TNTFSDiskAttribute; ARun:TNTFSDiskRun):Boolean;  
 
function GetItemByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSDiskItem;  
 
function CreateItem(ANew:Boolean):TNTFSDiskItem;  
function DestroyItem(AItem:TNTFSDiskItem):Boolean;  
function NewItem(AAttribute:TNTFSDiskAttribute):TNTFSDiskItem;  
function GetItem(AType:LongWord; const AName:String; AInstance:Integer):TNTFSDiskItem;  
function RemoveItem(AItem:TNTFSDiskItem):Boolean;  
function MoveItem(AItem:TNTFSDiskItem; AAttribute:TNTFSDiskAttribute):Boolean;  
function RenameItem(AItem:TNTFSDiskItem; AAttribute:TNTFSDiskAttribute):Boolean;  
 
function CreateIndex(AVersion,ASector:Word):Boolean; virtual;  
function NewIndex(AVersion,ASector:Word; AType,ARule,ASize,AOffset:LongWord):Boolean; virtual;  
 
function RecordNumber:Int64;  
function FileReference:Int64;  
function BaseReference:Int64;  
 
function RunOffset:Word; Offset to the Data Run
function DataOffset:Word; Offset to the Attribute Data
function AttributeNameSize:Word;  
function AttributeNameLength:Byte; Name length
function AttributeNameOffset:Word; Offset to the Name
 
function RunCount:LongWord;  
function ItemCount:LongWord;  
 
function CalculatedSize(AVersion:Word):LongWord; virtual;  
function CalculatedDataSize(AVersion:Word):LongWord; virtual;  
function CalculatedStreamSize(AVersion:Word):Int64; virtual;  
function CalculatedStreamUsed(AVersion:Word):Int64; virtual;  
 
function CoalesceRun(ARun:TNTFSDiskRun):Boolean;  
 
function UpdateRun(ARun:TNTFSDiskRun):Boolean;  
function UpdateKey(AKey:TNTFSDiskKey):Boolean; virtual;  
function UpdateItem(AItem:TNTFSDiskItem):Boolean; virtual;  
function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; virtual;  
function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; virtual;  
 
function ReadRuns(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;  
function WriteRuns(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;  
 
function ReadItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
function WriteItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
 
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; virtual;  
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; virtual;  
 
function ReadAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;  
function WriteAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;  

NTFS standard information attribute

TNTFSStandardInformationAttribute = class(TNTFSDiskAttribute)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
private
FCreateTime:TFileTime; File Creation
FWriteTime:TFileTime; File Altered
FChangeTime:TFileTime; MFT Changed
FAccessTime:TFileTime; File Read
FAttributes:LongWord; DOS File Permissions
FMaxVersions:LongWord; Maximum Number of Versions
FVersionNo:LongWord; Version Number
FClassId:LongWord; Class Id
FOwnerId:LongWord; Owner Id
FSecurityId:LongWord; Security Id
FQuotaCharge:Int64; Quota Charged
FUpdateSequenceNumber:Int64; Update Sequence Number
public
property CreateTime:TFileTime read FCreateTime write FCreateTime;  
property WriteTime:TFileTime read FWriteTime write FWriteTime;  
property ChangeTime:TFileTime read FChangeTime write FChangeTime;  
property AccessTime:TFileTime read FAccessTime write FAccessTime;  
property Attributes:LongWord read FAttributes write FAttributes;  
property MaxVersions:LongWord read FMaxVersions write FMaxVersions;  
property VersionNo:LongWord read FVersionNo write FVersionNo;  
property ClassId:LongWord read FClassId write FClassId;  
property OwnerId:LongWord read FOwnerId write FOwnerId;  
property SecurityId:LongWord read FSecurityId write FSecurityId;  
property QuotaCharge:Int64 read FQuotaCharge write FQuotaCharge;  
property UpdateSequenceNumber:Int64 read FUpdateSequenceNumber write FUpdateSequenceNumber;  
 
function CalculatedStreamSize(AVersion:Word):Int64; override;  
 
function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; override;  
function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; override;  
 
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  

NTFS attribute list

TNTFSAttributeListAttribute = class(TNTFSDiskAttribute)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
public
function CalculatedStreamSize(AVersion:Word):Int64; override;  
 
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  

NTFS file name attribute

TNTFSFileNameAttribute = class(TNTFSDiskAttribute)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
private
FParentReference:Int64; File reference to the parent directory
FCreateTime:TFileTime; C Time - File Creation

Note: These fields are only updated when the filename is changed (See Standard Information instead)

FWriteTime:TFileTime; A Time - File Altered

Note: These fields are only updated when the filename is changed (See Standard Information instead)

FChangeTime:TFileTime; M Time - MFT Changed

Note: These fields are only updated when the filename is changed (See Standard Information instead)

FAccessTime:TFileTime; R Time - File Read

Note: These fields are only updated when the filename is changed (See Standard Information instead)

FFileAllocated:Int64; Allocated size of the file (As for CreateTime/WriteTime/ChangeTime etc)
FFileSize:Int64; Real size of the file (As for CreateTime/WriteTime/ChangeTime etc)
FFileFlags:LongWord; Flags, e.g. Directory, compressed, hidden (As for CreateTime/WriteTime/ChangeTime etc)
FReparseTag:LongWord; Used by EAs and Reparse
FNameSpace:Byte; Filename namespace
FFileName:String; File name
 
FFileHash:LongWord;  
 
function GetFileName:String;  
procedure SetFileName(const AFileName:String);  
public
property ParentReference:Int64 read FParentReference write FParentReference;  
property CreateTime:TFileTime read FCreateTime write FCreateTime;  
property WriteTime:TFileTime read FWriteTime write FWriteTime;  
property ChangeTime:TFileTime read FChangeTime write FChangeTime;  
property AccessTime:TFileTime read FAccessTime write FAccessTime;  
property FileAllocated:Int64 read FFileAllocated write FFileAllocated;  
property FileSize:Int64 read FFileSize write FFileSize;  
property FileFlags:LongWord read FFileFlags write FFileFlags;  
property ReparseTag:LongWord read FReparseTag write FReparseTag;  
property NameSpace:Byte read FNameSpace write FNameSpace;  
property FileName:String read GetFileName write SetFileName;  
 
property FileHash:LongWord read FFileHash;  
 
function FileNameSize:Word;  
function FileNameLength:Byte; Filename length in characters
 
function ParentRecord:Int64;  
 
function CalculatedStreamSize(AVersion:Word):Int64; override;  
 
function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; override;  
function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; override;  
 
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  

NTFS object Id attribute

TNTFSObjectIdAttribute = class(TNTFSDiskAttribute)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
private
FObjectId:TGUID; GUID Object Id Unique Id assigned to file
FBirthVolumeId:TGUID; GUID Birth Volume Id Volume where file was created
FBirthObjectId:TGUID; GUID Birth Object Id Original Object Id of file
FDomainId:TGUID; GUID Domain Id Domain in which object was created
public
property ObjectId:TGUID read FObjectId write FObjectId;  
property BirthVolumeId:TGUID read FBirthVolumeId write FBirthVolumeId;  
property BirthObjectId:TGUID read FBirthObjectId write FBirthObjectId;  
property DomainId:TGUID read FDomainId write FDomainId;  
 
function CalculatedStreamSize(AVersion:Word):Int64; override;  
 
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  

NTFS volume version attribute

TNTFSVolumeVersionAttribute = class(TNTFSDiskAttribute)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
protected
procedure SetDataSize(AValue:LongWord); override;  

NTFS security descriptor attribute

TNTFSSecurityDescriptorAttribute = class(TNTFSDiskAttribute)

Note: This is the same structure that is used for all security in Windows (File/Kernel/Registry etc). See TSecurityDescriptor and associated values in Security unit for more information.
 
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
private
FSecurity:TNTFSSecurity;  
public
property Security:TNTFSSecurity read FSecurity;  
 
function CreateSecurity:Boolean;  
function NewSecurity(ASecurity:TNTFSSecurity):Boolean;  
 
function CalculatedStreamSize(AVersion:Word):Int64; override;  
 
function ReadSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
function WriteSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
 
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  

NTFS volume name attribute

TNTFSVolumeNameAttribute = class(TNTFSDiskAttribute)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
private
FVolumeName:String; Volume name
 
function GetVolumeName:String;  
procedure SetVolumeName(const AVolumeName:String);  
public
property VolumeName:String read GetVolumeName write SetVolumeName;  
 
function CalculatedStreamSize(AVersion:Word):Int64; override;  
 
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  

NTFS volume information attribute

TNTFSVolumeInformationAttribute = class(TNTFSDiskAttribute)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
private
FMajorVersion:Byte; Major version number
FMinorVersion:Byte; Minor version number
FVolumeFlags:Word; Flags
public
property MajorVersion:Byte read FMajorVersion write FMajorVersion;  
property MinorVersion:Byte read FMinorVersion write FMinorVersion;  
property VolumeFlags:Word read FVolumeFlags write FVolumeFlags;  
 
function CalculatedStreamSize(AVersion:Word):Int64; override;  
 
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  

NTFS data attribute

TNTFSDataAttribute = class(TNTFSDiskAttribute)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
protected
procedure SetDataSize(AValue:LongWord); override;  
public
function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; override;  
function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; override;  

NTFS index root attribute

TNTFSIndexRootAttribute = class(TNTFSDiskAttribute)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
private
FIndexType:LongWord; Attribute Type
FCollateRule:LongWord; Collation Rule
FIndexRecordSize:LongWord; Size of Index Allocation Entry (bytes)
FIndexCounterOffset:LongWord; Index Record Number increment
public
property IndexType:LongWord read FIndexType write FIndexType;  
property CollateRule:LongWord read FCollateRule write FCollateRule;  
property IndexRecordSize:LongWord read FIndexRecordSize write FIndexRecordSize;  
property IndexCounterOffset:LongWord read FIndexCounterOffset write FIndexCounterOffset;  
 
function CreateIndex(AVersion,ASector:Word):Boolean; override;  
function NewIndex(AVersion,ASector:Word; AType,ARule,ASize,AOffset:LongWord):Boolean; override;  
 
function CalculatedStreamSize(AVersion:Word):Int64; override;  
 
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  

NTFS index allocation attribute

TNTFSIndexAllocationAttribute = class(TNTFSDiskAttribute)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
protected
procedure SetDataSize(AValue:LongWord); override;  

NTFS bitmap attribute

TNTFSBitmapAttribute = class(TNTFSDiskAttribute)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
private
FBitmap:Pointer;  
FBitmapSize:LongWord;  
protected
procedure SetDataSize(AValue:LongWord); override;  
procedure SetBitmapSize(AValue:LongWord);  
public
property Bitmap:Pointer read FBitmap;  
property BitmapSize:LongWord read FBitmapSize write SetBitmapSize;  
 
function CalculatedStreamSize(AVersion:Word):Int64; override;  

NTFS reparse point attribute

TNTFSReparsePointAttribute = class(TNTFSDiskAttribute)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
private
FReparseTag:LongWord; Reparse Type (and Flags)
FReparseSize:Word; Reparse Data Length
FReparseGUID:TGUID; Reparse GUID
 
FReparse:TNTFSReparse;  
 
function GetIsAlias:Boolean;  
procedure SetIsAlias(AValue:Boolean);  
function GetIsHighLatency:Boolean;  
procedure SetIsHighLatency(AValue:Boolean);  
function GetIsMicrosoft:Boolean;  
procedure SetIsMicrosoft(AValue:Boolean);  
public
property IsAlias:Boolean read GetIsAlias write SetIsAlias;  
property IsHighLatency:Boolean read GetIsHighLatency write SetIsHighLatency;  
property IsMicrosoft:Boolean read GetIsMicrosoft write SetIsMicrosoft;  
 
property ReparseTag:LongWord read FReparseTag write FReparseTag;  
property ReparseSize:Word read FReparseSize write FReparseSize;  
property ReparseGUID:TGUID read FReparseGUID write FReparseGUID;  
 
property Reparse:TNTFSReparse read FReparse;  
 
function CreateReparse:Boolean;  
function NewReparse(AReparseTag:LongWord):Boolean;  
 
function CalculatedStreamSize(AVersion:Word):Int64; override;  
 
function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
 
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  

NTFS symbolic link attribute

TNTFSSymbolicLinkAttribute = class(TNTFSDiskAttribute)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
protected
procedure SetDataSize(AValue:LongWord); override;  

NTFS extended attribute information

TNTFSExtendedAttrInformationAttribute = class(TNTFSDiskAttribute)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
private
FPackedSize:Word; Size of the packed Extended Attributes
FFlagCount:Word; Number of Extended Attributes with NEED_EA
FUnpackedSize:LongWord; Size of the unpacked Extended Attributes
public
property PackedSize:Word read FPackedSize write FPackedSize;  
property FlagCount:Word read FFlagCount write FFlagCount;  
property UnpackedSize:LongWord read FUnpackedSize write FUnpackedSize;  
 
function CalculatedStreamSize(AVersion:Word):Int64; override;  
 
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  

NTFS extended attribute

TNTFSExtendedAttrAttribute = class(TNTFSDiskAttribute)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
private
FExtendeds:TNTFSExtendeds; List of attributes of this attribute
public
property Extendeds:TNTFSExtendeds read FExtendeds;  
 
function CreateExtended:TNTFSExtended;  
function DestroyExtended(AExtended:TNTFSExtended):Boolean;  
function NewExtended(const AName:String):TNTFSExtended;  
function GetExtended(const AName:String):TNTFSExtended;  
function RemoveExtended(AExtended:TNTFSExtended):Boolean;  
 
function ExtendedCount:LongWord;  
 
function CalculatedStreamSize(AVersion:Word):Int64; override;  
 
function ReadExtendeds(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
function WriteExtendeds(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
 
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;  

NTFS property set attribute

TNTFSPropertySetAttribute = class(TNTFSDiskAttribute)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
protected
procedure SetDataSize(AValue:LongWord); override;  

NTFS logged utility stream attribute

TNTFSLoggedUtilityStreamAttribute = class(TNTFSDiskAttribute)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
protected
procedure SetDataSize(AValue:LongWord); override;  

NTFS end attribute

TNTFSEndAttribute = class(TNTFSDiskAttribute)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
public
function CalculatedSize(AVersion:Word):LongWord; override;  
function CalculatedDataSize(AVersion:Word):LongWord; override;  
function CalculatedStreamSize(AVersion:Word):Int64; override;  
 
function ReadAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;  
function WriteAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;  

NTFS unknown attribute

TNTFSUnknownAttribute = class(TNTFSDiskAttribute)

constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);  
destructor Destroy; override;  
protected
procedure SetDataSize(AValue:LongWord); override;  

NTFS object Id

TNTFSObjId = class(TObject)

Note: Data of index $O in file $ObjId (Not Used)
 
private
 
public
 

NTFS quota

TNTFSQuota = class(TObject)

Note: Data of index $Q in file $Quota (Not Used)
 
private
 
public
 

NTFS owner

TNTFSOwner = class(TObject)

Note: Data of index $O in file $Quota (Not Used)
 
private
 
public
 

NTFS upper case

TNTFSUpCase = class(TObject)

Note: Data of file $UpCase
 
constructor Create;  
destructor Destroy; override;  
private
FLock:TSynchronizerHandle;  
 
FData:Pointer;  
 
function ReaderLock:Boolean;  
function ReaderUnlock:Boolean;  
function WriterLock:Boolean;  
function WriterUnlock:Boolean;  
public
property Data:Pointer read FData;  
 
function Init(AVersion:Word):Boolean;  
 
function Convert(ASource,ADest:Pointer; ASize:LongWord):Boolean;  
 
function ReadUpCase(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
function WriteUpCase(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  

NTFS attribute definitions

TNTFSAttrDefs = class(TFileSysList)

constructor Create;  
destructor Destroy; override;  
private
FAttrDefLocal:TMutexHandle;  
 
function GetPrevious(AAttrDef:TNTFSAttrDef):TNTFSAttrDef;  
public
function CreateAttrDef(AType:LongWord; AVersion:Word; ANew:Boolean):TNTFSAttrDef;  
function DestroyAttrDef(AAttrDef:TNTFSAttrDef):Boolean;  
function NewAttrDef(AType:LongWord; const AName:String; AVersion:Word):TNTFSAttrDef;  
function GetAttrDef(AType:LongWord; const AName:String):TNTFSAttrDef;  
function GetAttrDefByIndex(AIndex:Integer; AVersion:Word):TNTFSAttrDef;  
function GetAttrDefByIndexEx(AIndex:Integer; AVersion:Word; AWrite:Boolean):TNTFSAttrDef;  
function GetAttrDefByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSAttrDef;  
function RemoveAttrDef(AAttrDef:TNTFSAttrDef):Boolean;  
 
function CheckSize(AAttribute:TNTFSDiskAttribute;const ASize:Int64):Boolean;  
function CheckIndexed(AAttribute:TNTFSDiskAttribute):Boolean;  
function CheckResident(AAttribute:TNTFSDiskAttribute):Boolean;  
function CheckUncompressed(AAttribute:TNTFSDiskAttribute):Boolean;  
 
function TotalSize:Int64;  
 
function AttrDefCount:LongWord;  
 
function Init(AVersion:Word):Boolean;  
 
function ReadAttrDefs(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
function WriteAttrDefs(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  

NTFS attribute definition

TNTFSAttrDef = class(TListObject)

Note: Data of file $AttrDef
 
constructor Create(ALocalLock:TMutexHandle);  
destructor Destroy; override;  
private
FLocalLock:TMutexHandle;  
 
FAttributeName:String; Label in Unicode
FAttributeType:LongWord; Type
FDisplayRule:LongWord; Display rule
FCollateRule:LongWord; Collation rule
FAttrDefFlags:LongWord; Flags (See Consts)
FMinimumSize:Int64; Minimum size
FMaximumSize:Int64; Maximum size
 
FAttributeHash:LongWord;  
 
function AcquireLock:Boolean;  
function ReleaseLock:Boolean;  
 
function GetAttributeName:String;  
procedure SetAttributeName(const AAttributeName:String);  
 
function GetIsIndexed:Boolean;  
function GetIsResident:Boolean;  
function GetIsUncompressed:Boolean;  
 
function Compare(AAttrDef:TNTFSAttrDef):Integer; virtual;  
public
property AttributeName:String read GetAttributeName write SetAttributeName;  
property AttributeType:LongWord read FAttributeType write FAttributeType;  
property DisplayRule:LongWord read FDisplayRule write FDisplayRule;  
property CollateRule:LongWord read FCollateRule write FCollateRule;  
property AttrDefFlags:LongWord read FAttrDefFlags write FAttrDefFlags;  
property MinimumSize:Int64 read FMinimumSize write FMinimumSize;  
property MaximumSize:Int64 read FMaximumSize write FMaximumSize;  
 
property IsIndexed:Boolean read GetIsIndexed;  
property IsResident:Boolean read GetIsResident;  
property IsUncompressed:Boolean read GetIsUncompressed;  
 
function Init(AIndex:Integer;AVersion:Word):Boolean;  
 
property AttributeHash:LongWord read FAttributeHash;  
 
function ReadAttrDef(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
function WriteAttrDef(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  

NTFS reparse

TNTFSReparse = class(TDiskReparse)

Note: Data of attribute $REPARSE_POINT
 
constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);  
destructor Destroy; override;  
private
FData:Pointer;  
 
FDataSize:Word;  
 
FAttribute:TNTFSDiskAttribute; Attribute owning this index
 
procedure SetData(AData:Pointer); virtual;  
 
function GetDataSize:Word; virtual;  
procedure SetDataSize(ASize:Word); virtual;  
public
property Data:Pointer read FData write SetData;  
 
property DataSize:Word read GetDataSize write SetDataSize;  
 
property Attribute:TNTFSDiskAttribute read FAttribute;  
 
function CalculatedSize(AVersion:Word):Word; virtual;  
 
function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;  
function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;  

NTFS reparse symbolic link

TNTFSReparseSymLink = class(TNTFSReparse)

Note: Data of attribute $REPARSE_POINT (Tag 0xA000000C)
 
constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);  
destructor Destroy; override;  
private
procedure SetData(AData:Pointer); override;  
 
procedure SetDataSize(ASize:Word); override;  
protected
FPrintName:String; Path Buffer
FSubstituteName:String; Path Buffer
 
FPrintHash:LongWord;  
FSubstituteHash:LongWord;  
 
function GetTarget:String; override;  
 
function GetPrintName:String;  
procedure SetPrintName(const APrintName:String);  
function GetSubstituteName:String;  
procedure SetSubstituteName(const ASubstituteName:String);  
public
property PrintName:String read GetPrintName write SetPrintName;  
property SubstituteName:String read GetSubstituteName write SetSubstituteName;  
 
property PrintHash:LongWord read FPrintHash;  
property SubstituteHash:LongWord read FSubstituteHash;  
 
function PrintNameSize:Word; virtual;  
function PrintNameOffset:Word; virtual; Print Name Offset
function PrintNameLength:Word; virtual; Print Name Length
function SubstituteNameSize:Word; virtual;  
function SubstituteNameOffset:Word; virtual; Substitute Name Offset
function SubstituteNameLength:Word; virtual; Substitute Name Length
 
function CalculatedSize(AVersion:Word):Word; override;  
 
function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;  
function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;  

NTFS reparse mount point

TNTFSReparseMountPoint = class(TNTFSReparseSymLink)

Note: Data of attribute $REPARSE_POINT (Tag 0xA0000003)
 
constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);  
destructor Destroy; override;  
public
function PrintNameSize:Word; override;  
function PrintNameOffset:Word; override; Print Name Offset
function PrintNameLength:Word; override; Print Name Length
function SubstituteNameSize:Word; override;  
function SubstituteNameOffset:Word; override; Substitute Name Offset
function SubstituteNameLength:Word; override; Substitute Name Length
 
function CalculatedSize(AVersion:Word):Word; override;  
 
function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;  
function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;  

NTFS extendeds

TNTFSExtendeds = class(TFileSysListEx)

constructor Create(AExtendedLocal:TMutexHandle; ALock:TSynchronizerHandle);  
destructor Destroy; override;  
private
FExtendedLocal:TMutexHandle;  
public
function TotalSize:Int64;  
 
function ExtendedCount:LongWord;  

NTFS extended

TNTFSExtended = class(TListObject)

Note: Data of attribute $EA
 
constructor Create(ALocalLock:TMutexHandle);  
destructor Destroy; override;  
private
FLocalLock:TMutexHandle;  
 
FExtendedOffset:LongWord; Offset to next Extended Attribute (Offset to next EA is the size of this EA)
FExtendedFlags:Byte; Flags
FExtendedName:String; Name Note: No offset so always in the same location (Not Unicode)
FExtendedData:Pointer; Value
FExtendedDataSize:Word; Value Length
 
FExtendedHash:LongWord;  
 
function AcquireLock:Boolean;  
function ReleaseLock:Boolean;  
 
function GetExtendedName:String;  
procedure SetExtendedName(const AExtendedName:String);  
procedure SetExtendedDataSize(ASize:Word);  
public
property ExtendedOffset:LongWord read FExtendedOffset write FExtendedOffset;  
property ExtendedFlags:Byte read FExtendedFlags write FExtendedFlags;  
property ExtendedName:String read GetExtendedName write SetExtendedName;  
property ExtendedData:Pointer read FExtendedData;  
property ExtendedDataSize:Word read FExtendedDataSize write SetExtendedDataSize;  
 
property ExtendedHash:LongWord read FExtendedHash;  
 
function ExtendedSize:LongWord;  
 
function ExtendedNameSize:Word;  
function ExtendedNameLength:Byte; Name Length
 
function ReadExtended(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
function WriteExtended(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  

NTFS security items

TNTFSSecurityItems = class(TFileSysList)

constructor Create;  
destructor Destroy; override;  
private
FSecurityLocal:TMutexHandle;  
 
function GetPrevious(ASecurityItem:TNTFSSecurityItem):TNTFSSecurityItem;  
public
function CreateSecurityItem(ANew:Boolean):TNTFSSecurityItem;  
function DestroySecurityItem(ASecurityItem:TNTFSSecurityItem):Boolean;  
function NewSecurityItem(ASecurityId:LongWord; const ASecurityOffset:Int64; ASecurity:TNTFSSecurity):TNTFSSecurityItem;  
function GetSecurityItem(ASecurityId:LongWord):TNTFSSecurityItem;  
function GetSecurityItemEx(ASecurityId:LongWord; AWrite:Boolean):TNTFSSecurityItem;  
function UpdateSecurityItem(ASecurityItem:TNTFSSecurityItem; ASecurityId:LongWord; ASecurity:TNTFSSecurity):Boolean;  
function DeleteSecurityItem(ASecurityItem:TNTFSSecurityItem):Boolean;  
function RemoveSecurityItem(ASecurityItem:TNTFSSecurityItem; AFree:Boolean):Boolean;  
 
function TotalSize:Int64;  
 
function SecurityItemCount:LongWord;  
 
function Init(AVersion:Word):Boolean;  
 
function ReadSecurityItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
function WriteSecurityItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  

NTFS security item

TNTFSSecurityItem = class(TListObject)

Note: Data of stream $SDS in file $Secure
 
constructor Create(ALocalLock:TMutexHandle);  
destructor Destroy; override;  
private
FLocalLock:TMutexHandle;  
 
FSecurityHash:LongWord; Hash of Security Descriptor
FSecurityId:LongWord; Security Id
FSecurityOffset:Int64; Offset of this entry in $SDS
FSecuritySize:LongWord; Size of this entry in $SDS
 
FSecurity:TNTFSSecurity; Self-relative Security Descriptor
 
function AcquireLock:Boolean;  
function ReleaseLock:Boolean;  
 
function Compare(ASecurityItem:TNTFSSecurityItem):Integer; virtual;  
function CompareOld(ASecurityItem:TNTFSSecurityItem):Integer; virtual;  
public
property SecurityHash:LongWord read FSecurityHash write FSecurityHash;  
property SecurityId:LongWord read FSecurityId write FSecurityId;  
property SecurityOffset:Int64 read FSecurityOffset write FSecurityOffset;  
property SecuritySize:LongWord read FSecuritySize write FSecuritySize;  
 
property Security:TNTFSSecurity read FSecurity;  
 
function CreateSecurity:Boolean;  
function NewSecurity(ASecurity:TNTFSSecurity):Boolean;  
function UpdateSecurity(ASecurity:TNTFSSecurity):Boolean;  
function DeleteSecurity:Boolean;  
function RemoveSecurity(AFree:Boolean):Boolean;  
 
function MirrorOffset:Int64;  
 
function Init(ASecurityId:LongWord; AVersion:Word):Boolean;  
 
function ReadSecurityItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
function WriteSecurityItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  

NTFS security

TNTFSSecurity = class(TDiskSecurity)

Note: Data of attribute $SECURITY_DESCRIPTOR and stream $SDS in file $Secure
Note: This is the same structure that is used for all security in Windows (File/Kernel/Registry etc). See TSecurityDescriptor and associated values in Security unit for more information.
 
constructor Create(ALocalLock:TMutexHandle);  
constructor CreateFromSecurity(ALocalLock:TMutexHandle; ASecurity:TDiskSecurity); override;  
constructor CreateFromDescriptor(ALocalLock:TMutexHandle; ADescriptor:Pointer); override;  
destructor Destroy; override;  
private
FVolumeVersion:Word;  
 
FRevision:Byte; Revision
FControl:Word; Control Flags
FSacl:PACL; SACL
FDacl:PACL; DACL
FOwner:PSID; Owner SID
FGroup:PSID; Group SID
 
procedure SetSacl(ASacl:PACL);  
procedure SetDacl(ADacl:PACL);  
procedure SetOwner(AOwner:PSID);  
procedure SetGroup(AGroup:PSID);  
procedure SetSaclSize(ASize:Word);  
procedure SetDaclSize(ASize:Word);  
procedure SetOwnerSize(ASize:Word);  
procedure SetGroupSize(ASize:Word);  
public
property VolumeVersion:Word read FVolumeVersion;  
 
property Revision:Byte read FRevision write FRevision;  
property Control:Word read FControl write FControl;  
property Sacl:PACL read FSacl write SetSacl;  
property Dacl:PACL read FDacl write SetDacl;  
property Owner:PSID read FOwner write SetOwner;  
property Group:PSID read FGroup write SetGroup;  
 
function SaclSize:Word;  
function DaclSize:Word;  
function OwnerSize:Word;  
function GroupSize:Word;  
function SaclOffset:LongWord; Offset to SACL
function DaclOffset:LongWord; Offset to DACL
function OwnerOffset:LongWord; Offset to Owner SID
function GroupOffset:LongWord; Offset to Group SID
 
function SaclOffsetEx(ALocal:Boolean):LongWord; Offset to SACL
function DaclOffsetEx(ALocal:Boolean):LongWord; Offset to DACL
function OwnerOffsetEx(ALocal:Boolean):LongWord; Offset to Owner SID
function GroupOffsetEx(ALocal:Boolean):LongWord; Offset to Group SID
 
function SecuritySize:LongWord; override;  
function SecurityHash:LongWord;  
 
function SecurityDescriptor:Pointer; override;  
function SecurityDescriptorEx(ALocal:Boolean):Pointer; override;  
function InheritedDescriptor:Pointer; override;  
function MergedDescriptor(AChild:Pointer):Pointer; override;  
function ReleaseDescriptor(ADescriptor:Pointer; AInherited,AMerged:Boolean):Boolean; override;  
 
function CopyToSecurity(ASecurity:TDiskSecurity):Boolean; override;  
 
function CopyToDescriptor(ADescriptor:Pointer; ASize:LongWord):Boolean; override;  
function CopyToDescriptorEx(ADescriptor:Pointer; ASize:LongWord; ALocal:Boolean):Boolean; override;  
function CopyFromDescriptor(ADescriptor:Pointer; ASize:LongWord):Boolean; override;  
 
function ReadSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
function WriteSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
function WriteSecurityEx(ABuffer:Pointer; var AOffset,ASize:LongWord; ALocal:Boolean; AVersion:Word):Boolean;  

NTFS security Id

TNTFSSecurityId = class(TObject)

Note: Data of index $SII in file $Secure (Not Used)
 
private
 
public
 

NTFS security hash

TNTFSSecurityHash = class(TObject)

Note: Data of index $SDH in file $Secure (Not Used)
 
private
 
public
 


Public variables

None defined

Function declarations

None defined


Return to Unit Reference

Retrieved from "https://ultibo.org/mediawiki_ultibo_org/index.php?title=Unit_NTFSClass&oldid=2625"