|
|
| Line 5: |
Line 5: |
| | ---- | | ---- |
| | | | |
| − | '''Ultibo NTFS constants unit''' | + | '''Ultibo NTFS Constants unit''' |
| − | | + | |
| − | ''To be documented''
| + | |
| | | | |
| | === Constants === | | === Constants === |
Latest revision as of 05:38, 31 August 2021
Return to Unit Reference
Description
Ultibo NTFS Constants unit
Constants
[Expand]
NTFS specific constants ntfs*
ntfsNTFS12 = 0;
|
4.0 (WinNT)
|
ntfsNTFS30 = 1;
|
5.0 (Win2000)
|
ntfsNTFS31 = 2;
|
5.1/5.2/6.0/6.1 (WinXP/Win2003/WinVista/Win2008/Win7)
|
|
|
ntfsAnyName = '*';
|
|
ntfsDotName = '.';
|
|
ntfsDotDotName = '..';
|
|
|
|
ntfsAnyNameLength = 1;
|
|
ntfsDotNameLength = 1;
|
|
ntfsDotDotNameLength = 2;
|
|
ntfsBlankNameLength = 0;
|
|
|
|
ntfsOemName = 'NTFS';
|
Padded with spaces to 8 bytes
|
|
|
ntfsEntryPadding = $20;
|
Padded with spaces (32)
|
[Expand]
NTFS security ntfsSecurity*
ntfsSecurityHashPadding = $00490049;
|
Unicode string II
|
ntfsSecurityHashPaddingSize = 4;
|
SizeOf(LongWord)
|
|
|
ntfsSecurityMirrorOffset = $00040000;
|
256K Offset between primary and mirror entries
|
ntfsSecuritySectionOffset = $00040000;
|
256K Offset between sections (End of one section to Start of next)
|
ntfsSecuritySectionShift = 18;
|
Not Used
|
ntfsSecurityOffsetMask = $0003FFFF;
|
Used to determine the offset within a section from the offset
|
ntfsSecuritySectionMask = $FFFC0000;
|
Used to determine the start of a section from the offset
|
ntfsSecurityMirrorTest = $00040000;
|
Mirror blocks will always be 40000 or C0000
|
[Expand]
NTFS max number ntfsMax*
ntfsMaxPath = 260;
|
|
ntfsMaxFile = 255;
|
|
|
|
ntfsMaxAlias = 999999;
|
Max number of lfn aliases (ie ~999999)
|
ntfsMaxNameAlias = 4;
|
|
ntfsMaxHashAlias = 999;
|
|
ntfsMaxHashShift = 16;
|
|
|
|
ntfsMaxVolumeName = 255;
|
|
ntfsMaxAttributeName = 255;
|
|
[Expand]
NTFS cluster size ntfs*ClusterSize*
ntfsMinClusterSize = 512;
|
|
ntfs12MaxClusterSize = 4096;
|
|
ntfs30MaxClusterSize = 65536;
|
|
[Expand]
NTFS sector ntfs*Sector
ntfsBootSector = 0;
|
|
ntfsStartSector = 0;
|
Int64
|
ntfsUnknownSector = -1;
|
Int64
|
[Expand]
NTFS cluster ntfs*Cluster
ntfsStartCluster = 0;
|
Int64
|
ntfsUnevenCluster = 1;
|
Int64
|
ntfsUnknownCluster = -1;
|
Int64
|
[Expand]
NTFS status ntfsStatus*
ntfsStatusNone = $00000000;
|
|
ntfsStatusAdded = $00000001;
|
Used by Node
|
ntfsStatusDeleted = $00000002;
|
Used by Node
|
ntfsStatusChanged = $00000004;
|
Used by Key, Node, Index
|
ntfsStatusLoaded = $00000008;
|
Used by Index, List
|
ntfsStatusInvalid = $00000010;
|
Used by Key, Item
|
ntfsStatusResizing = $00000020;
|
Used by Record
|
ntfsStatusRemoving = $00000040;
|
Used by Record
|
ntfsStatusUpdating = $00000080;
|
Used by Attribute
|
|
|
ntfsStatusMirrored = $00000100;
|
Metafile Records (0 to 3)
|
ntfsStatusMetafile = $00000200;
|
Metafile Records (0 to 11)
|
ntfsStatusReserved = $00000400;
|
Reserved MFT Records (12 to 15)(0C to 0F)
|
ntfsStatusExpansion = $00000800;
|
Expansion MFT Records (16 to 23)(10 to 17)
|
|
|
ntfsStatusOverflow = $00001000;
|
Record has an attribute list attribute
|
ntfsStatusExtension = $00002000;
|
Record is an extension of the base record
|
|
|
ntfsStatusFixed = $00004000;
|
Attribute is a fixed size (can write single item) Not used due to Fixups
|
ntfsStatusSingle = $00008000;
|
Attribute only allows a single instance (Standard Information, Attribute List, End etc)
|
ntfsStatusUnlisted = $00010000;
|
Attribute is not listed in an Attribute List (Attribute List, End)
|
ntfsStatusUnmovable = $00020000;
|
Attribute cannot be moved from the Base Record (Standard Information, Attribute List)
|
ntfsStatusManaged = $00040000;
|
Attribute is handled as a record or list, data member is not valid (Standard Information, Attribute List, FileName etc)
|
|
|
ntfsStatusAny = $FFFFFFFF;
|
|
[Expand]
NTFS compare ntfsCompare*
ntfsCompareLess = -1;
|
|
ntfsCompareEqual = 0;
|
|
ntfsCompareGreater = 1;
|
|
[Expand]
NTFS instance ntfsInstance*
ntfsInstanceFirst = 0;
|
|
ntfsInstanceLast = -1;
|
|
[Expand]
NTFS attribute definition ntfsAttrDefNo*
ntfsAttrDefNoMinimum = 0;
|
Int64
|
ntfsAttrDefNoMaximum = -1;
|
Int64
|
[Expand]
NTFS file reference ntfsFileReference*
ntfsFileReferenceNone = 0;
|
Int64
|
ntfsRecordNumberMask = $0000FFFFFFFFFFFF;
|
Get a record number from a file reference
|
ntfsUnknownRecordNumber = -1;
|
Int64
|
[Expand]
NTFS bitmap ntfsBitmap*
ntfsBitmapUnknown = LongWord(-1);
|
|
[Expand]
NTFS block count mask ntfsBlockCountMask*
ntfsBlockCountMask8 = $FFFFFFFFFFFFFFF8;
|
0000000000000007
|
ntfsBlockCountMask64 = $FFFFFFFFFFFFFFC0;
|
000000000000003F
|
[Expand]
NTFS MFT zone ntfsMftZone*
| HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem - NtfsMftZoneReservation - DWORD
|
|
|
ntfsMftZone50percent = 500;
|
Registry value 4
|
ntfsMftZone37percent = 375;
|
Registry value 3
|
ntfsMftZone25percent = 250;
|
Registry value 2
|
ntfsMftZone12percent = 125;
|
Registry value 1 (Default)
|
ntfsMftZone0percent = 0;
|
Registry value 0 (Not allowed)
|
[Expand]
NTFS MFT fixed zone ntfsMftFixedZone*
| Vista/2008
|
|
|
ntfsMftFixedZone1000MB = 1000;
|
Registry value 0 (Not allowed)
|
ntfsMftFixedZone800MB = 800;
|
Registry value 4
|
ntfsMftFixedZone600MB = 600;
|
Registry value 3
|
ntfsMftFixedZone400MB = 400;
|
Registry value 2
|
ntfsMftFixedZone200MB = 200;
|
Registry value 1 (Default)
|
ntfsMftFixedZone0MB = 0;
|
Registry value 0 (Not allowed)
|
|
|
ntfsMftFixedZone1000MBSize = 1048576000;
|
|
ntfsMftFixedZone800MBSize = 838860800;
|
|
ntfsMftFixedZone600MBSize = 629145600;
|
|
ntfsMftFixedZone400MBSize = 419430400;
|
|
ntfsMftFixedZone200MBSize = 209715200;
|
|
ntfsMftFixedZone0MBSize = 0;
|
|
[Expand]
NTFS run offset mask ntfsRunOffsetMask*
ntfsRunOffsetMask = $F0;
|
shr 4
|
ntfsRunLengthMask = $0F;
|
|
[Expand]
NTFS run encode mask ntfsRunEncodeMask*
| (and)
|
|
|
ntfsRunEncodeMasks:array[0..8] of Int64 = (
|
$0000000000000000,
|
|
$00000000000000FF,
|
|
$000000000000FFFF,
|
|
$0000000000FFFFFF,
|
|
$00000000FFFFFFFF,
|
|
$000000FFFFFFFFFF,
|
|
$0000FFFFFFFFFFFF,
|
|
$00FFFFFFFFFFFFFF,
|
|
$FFFFFFFFFFFFFFFF);
|
Not Used
|
[Expand]
NTFS run encode test ntfsRunEncodeTest*
| (and)
|
|
|
(*ntfsRunEncodeTests:array[0..8] of Int64 = (
|
$FFFFFFFFFFFFFFFF,
|
Not Used
|
$FFFFFFFFFFFFFF00,
|
|
$FFFFFFFFFFFF0000,
|
|
$FFFFFFFFFF000000,
|
|
$FFFFFFFF00000000,
|
|
$FFFFFF0000000000,
|
|
$FFFF000000000000,
|
|
$FF00000000000000,
|
|
$0000000000000000);*)
|
|
|
|
ntfsRunEncodeTests:array[0..8] of Int64 = (
|
$0000000000000000,
|
|
$000000000000007F,
|
|
$0000000000007FFF,
|
|
$00000000007FFFFF,
|
|
$000000007FFFFFFF,
|
|
$0000007FFFFFFFFF,
|
|
$00007FFFFFFFFFFF,
|
|
$007FFFFFFFFFFFFF,
|
|
$7FFFFFFFFFFFFFFF);
|
Not Used
|
[Expand]
NTFS run negative test ntfsRunNegativeTest*
ntfsRunNegativeTests:array[0..8] of Int64 = (
|
$FFFFFFFFFFFFFFFF,
|
Not Used
|
$FFFFFFFFFFFFFF80,
|
|
$FFFFFFFFFFFF8000,
|
|
$FFFFFFFFFF800000,
|
|
$FFFFFFFF80000000,
|
|
$FFFFFF8000000000,
|
|
$FFFF800000000000,
|
|
$FF80000000000000,
|
|
$8000000000000000);
|
|
[Expand]
NTFS run decode mask ntfsRunDecode*Mask
| (and) (or not)
|
|
|
ntfsRunDecode1Masks:array[1..1] of Byte = (
|
$FF);
|
|
|
|
ntfsRunDecode2Masks:array[2..2] of Word = (
|
$FFFF);
|
|
|
|
ntfsRunDecode4Masks:array[3..4] of LongWord = (
|
$00FFFFFF,
|
|
$FFFFFFFF);
|
|
|
|
ntfsRunDecode8Masks:array[5..8] of Int64 = (
|
$000000FFFFFFFFFF,
|
|
$0000FFFFFFFFFFFF,
|
|
$00FFFFFFFFFFFFFF,
|
|
$FFFFFFFFFFFFFFFF);
|
|
[Expand]
NTFS run decode test ntfsRunDecode*Test
| (>=)
|
|
|
ntfsRunDecode1Tests:array[1..1] of Byte = (
|
$80);
|
|
|
|
ntfsRunDecode2Tests:array[2..2] of Word = (
|
$8000);
|
|
|
|
ntfsRunDecode4Tests:array[3..4] of LongWord = (
|
$00800000,
|
|
$80000000);
|
|
|
|
ntfsRunDecode8Tests:array[5..8] of Int64 = (
|
$0000008000000000,
|
|
$0000800000000000,
|
|
$0080000000000000,
|
|
$8000000000000000);
|
|
[Expand]
NTFS compression tag ntfsCompression*
ntfsCompressionTags:array[1..8] of Byte = (
|
$01,
|
|
$02,
|
|
$04,
|
|
$08,
|
|
$10,
|
|
$20,
|
|
$40,
|
|
$80);
|
|
|
|
ntfsCompressionTagMask = $0FFF;
|
The default mask for encoding and decoding the offset and length of a tag
|
ntfsCompressionTagShift = 12;
|
The default shift for encoding and decoding the offset and length of a tag.
Tag is encoded as Offset:Length by varying the mask and shift based on the position.
|
|
|
ntfsCompressionUnitSize = 4;
|
The default shift count for compression unit to cluster conversion
|
ntfsCompressionBlockSize = 4096;
|
The fixed size of a compression block inside the variable compression unit
|
|
|
ntfsCompressionLengthMask = $0FFF;
|
The mask for the maximum length of a compressed block
|
ntfsCompressionMarkerMask = $B000;
|
The mask for the marker of a compressed block
|
ntfsCompressionMarkerTest = $8000;
|
The test for the marker of a compressed block
|
|
|
ntfsCompressionTableInit = $FF;
|
The initialization value for the compression table
|
ntfsCompressionTableUnused = $FFFF;
|
The unused or unseen value for the compression table
|
[Expand]
NTFS bitmap mask ntfsBitmapMask*
ntfsBitmapMaskBits = 64;
|
Int64 Bitmap Masks
|
ntfsBitmapMaskNone = $0000000000000000;
|
Int64 (Used for fast counting of free blocks)
|
ntfsBitmapMaskAll = $FFFFFFFFFFFFFFFF;
|
Int64 (Used for fast counting of used blocks)
|
[Expand]
NTFS signature ntfs*Signature
ntfsFileSignature = $454C4946;
|
FILE
|
ntfsIndexSignature = $58444E49;
|
INDX
|
ntfsRecordSignature = $44524352;
|
RCRD
|
ntfsRestartSignature = $52545352;
|
RSTR
|
ntfsCheckedSignature = $00000000;
|
CHKD
|
|
|
ntfsNullGUID:TGUID = (D1:$00000000;D2:$0000;D3:$0000;D4:($00,$00,$00,$00,$00,$00,$00,$00));
|
|
|
|
ntfsNullFileTime:TFileTime = (dwLowDateTime:$00000000;dwHighDateTime:$00000000);
|
|
[Expand]
NTFS table type ntfsTableType*
ntfsTableTypeMft = $00000000;
|
|
ntfsTableTypeMftMirr = $00000001;
|
|
[Expand]
NTFS file type ntfsFileType*
ntfsFileTypeMft = $00000000;
|
|
ntfsFileTypeMftMirr = $00000001;
|
|
ntfsFileTypeLogFile = $00000002;
|
|
ntfsFileTypeVolume = $00000003;
|
|
ntfsFileTypeAttrDef = $00000004;
|
|
ntfsFileTypeRoot = $00000005;
|
|
ntfsFileTypeBitmap = $00000006;
|
|
ntfsFileTypeBoot = $00000007;
|
|
ntfsFileTypeBadClus = $00000008;
|
|
ntfsFileTypeSecure = $00000009;
|
|
ntfs12FileTypeQuota = $00000009;
|
Version 1.2 only
|
ntfsFileTypeUpCase = $0000000A;
|
|
ntfsFileTypeExtend = $0000000B;
|
|
|
|
ntfsFileTypeObjId = $10000000;
|
Any record number
|
ntfsFileTypeQuota = $20000000;
|
Any record number
|
ntfsFileTypeReparse = $30000000;
|
Any record number
|
ntfsFileTypeUsnJrnl = $40000000;
|
Any record number
|
|
|
ntfsFileTypeFile = $50000000;
|
Any record number (Not Used)
|
ntfsFileTypeDirectory = $60000000;
|
Any record number (Not Used)
|
|
|
ntfsFileTypeReserved1 = $0000000C;
|
Reserved Records
|
ntfsFileTypeReserved2 = $0000000D;
|
|
ntfsFileTypeReserved3 = $0000000E;
|
|
ntfsFileTypeReserved4 = $0000000F;
|
|
|
|
ntfsFileTypeExpansion1 = $00000010;
|
Expansion Records
|
ntfsFileTypeExpansion2 = $00000011;
|
|
ntfsFileTypeExpansion3 = $00000012;
|
|
ntfsFileTypeExpansion4 = $00000013;
|
|
ntfsFileTypeExpansion5 = $00000014;
|
|
ntfsFileTypeExpansion6 = $00000015;
|
|
ntfsFileTypeExpansion7 = $00000016;
|
|
ntfsFileTypeExpansion8 = $00000017;
|
|
[Expand]
NTFS record number ntfs*RecordNumber
ntfsQuotaRecordNumber = $00000018;
|
Only used during Format
|
ntfsObjIdRecordNumber = $00000019;
|
Only used during Format
|
ntfsReparseRecordNumber = $0000001A;
|
Only used during Format
|
ntfsUsnJrnlRecordNumber = $0000001B;
|
Not Used
|
|
|
ntfsDefaultRecordCount = $0000001B;
|
Files up to $Reparse
|
ntfsDefaultMirrorCount = $00000004;
|
Files up to $Volume
|
[Expand]
NTFS file reference ntfs*FileReference
ntfsRootFileReference = $0005000000000005;
|
Only used during Format
|
ntfsExtendFileReference = $000B00000000000B;
|
Only used during Format
|
ntfsVolumeFileReference = $0003000000000003;
|
Only used during Format
|
[Expand]
NTFS file name ntfsFileName*
ntfsFileNameMft = '$MFT';
|
|
ntfsFileNameMftMirr = '$MFTMirr';
|
|
ntfsFileNameLogFile = '$LogFile';
|
|
ntfsFileNameVolume = '$Volume';
|
|
ntfsFileNameAttrDef = '$AttrDef';
|
|
ntfsFileNameRoot = '.';
|
|
ntfsFileNameBitmap = '$Bitmap';
|
|
ntfsFileNameBoot = '$Boot';
|
|
ntfsFileNameBadClus = '$BadClus';
|
|
ntfsFileNameSecure = '$Secure';
|
|
ntfsFileNameUpCase = '$UpCase';
|
|
ntfsFileNameExtend = '$Extend';
|
|
|
|
ntfsFileNameObjId = '$ObjId';
|
|
ntfsFileNameQuota = '$Quota';
|
|
ntfsFileNameReparse = '$Reparse';
|
|
ntfsFileNameUsnJrnl = '$UsnJrnl';
|
|
[Expand]
NTFS attribute type ntfsAttrType*
ntfsAttrTypeNone = $00000000;
|
Marker only
|
ntfsAttrTypeStandardInformation = $00000010;
|
|
ntfsAttrTypeAttributeList = $00000020;
|
|
ntfsAttrTypeFileName = $00000030;
|
|
ntfsAttrTypeObjectId = $00000040;
|
|
ntfsAttrTypeVolumeVersion = $00000040;
|
Version 1.2 only
|
ntfsAttrTypeSecurityDescriptor = $00000050;
|
|
ntfsAttrTypeVolumeName = $00000060;
|
|
ntfsAttrTypeVolumeInformation = $00000070;
|
|
ntfsAttrTypeData = $00000080;
|
|
ntfsAttrTypeIndexRoot = $00000090;
|
|
ntfsAttrTypeIndexAllocation = $000000A0;
|
|
ntfsAttrTypeBitmap = $000000B0;
|
|
ntfsAttrTypeReparsePoint = $000000C0;
|
|
ntfsAttrTypeSymbolicLink = $000000C0;
|
Version 1.2 only
|
ntfsAttrTypeExtendedAttrInformation = $000000D0;
|
|
ntfsAttrTypeExtendedAttr = $000000E0;
|
|
ntfsAttrTypePropertySet = $000000F0;
|
Version 3.0 only
|
ntfsAttrTypeLoggedUtilityStream = $00000100;
|
|
ntfsAttrTypeEnd = $FFFFFFFF;
|
Marker only
|
|
|
ntfsAttrTypeAny = $00000000;
|
Used to return all attributes
|
[Expand]
NTFS attribute name ntfsAttrName*
ntfsAttrNameNone = '$NONE';
|
Marker only
|
ntfsAttrNameStandardInformation = '$STANDARD_INFORMATION';
|
|
ntfsAttrNameAttributeList = '$ATTRIBUTE_LIST';
|
|
ntfsAttrNameFileName = '$FILE_NAME';
|
|
ntfsAttrNameObjectId = '$OBJECT_ID';
|
|
ntfsAttrNameVolumeVersion = '$VOLUME_VERSION';
|
Version 1.2 only
|
ntfsAttrNameSecurityDescriptor = '$SECURITY_DESCRIPTOR';
|
|
ntfsAttrNameVolumeName = '$VOLUME_NAME';
|
|
ntfsAttrNameVolumeInformation = '$VOLUME_INFORMATION';
|
|
ntfsAttrNameData = '$DATA';
|
|
ntfsAttrNameIndexRoot = '$INDEX_ROOT';
|
|
ntfsAttrNameIndexAllocation = '$INDEX_ALLOCATION';
|
|
ntfsAttrNameBitmap = '$BITMAP';
|
|
ntfsAttrNameReparsePoint = '$REPARSE_POINT';
|
|
ntfsAttrNameSymbolicLink = '$SYMBOLIC_LINK';
|
Version 1.2 only
|
ntfsAttrNameExtendedAttrInformation = '$EA_INFORMATION';
|
|
ntfsAttrNameExtendedAttr = '$EA';
|
|
ntfsAttrNamePropertySet = '$PROPERTY_SET';
|
Version 3.0 only
|
ntfsAttrNameLoggedUtilityStream = '$LOGGED_UTILITY_STREAM';
|
|
ntfsAttrNameEnd = '$END';
|
Marker only
|
[Expand]
NTFS owner Id ntfsOwnerId*
ntfsOwnerIdNull = $00000001;
|
|
ntfsOwnerIdFirst = $00000100;
|
|
|
|
ntfsOwnerIdUnknown = $FFFFFFFF;
|
|
[Expand]
NTFS default owner Id ntfsDefaultOwnerId*
ntfsDefaultOwnerId1 = $00000001;
|
|
ntfsDefaultOwnerId100 = $00000100;
|
|
[Expand]
NTFS default sid ntfsDefaultSid*
ntfsMaxDefaultSid = 1;
|
|
|
|
ntfsDefaultSidNone = 0;
|
|
ntfsDefaultSid100 = 1;
|
|
|
|
ntfsDefaultSids:array[1..ntfsMaxDefaultSid] of TNTFSDefaultSid = (
|
(Sid:WinBuiltinAdministratorsSid));
|
100
|
[Expand]
NTFS security Id ntfsSecurityId*
ntfsSecurityIdNull = $00000001;
|
|
ntfsSecurityIdFirst = $00000100;
|
|
|
|
ntfsSecurityIdUnknown = $FFFFFFFF;
|
|
[Expand]
NTFS default security Id ntfsDefaultSecurityId*
ntfsDefaultSecurityId100 = $00000100;
|
|
ntfsDefaultSecurityId101 = $00000101;
|
|
ntfsDefaultSecurityId102 = $00000102;
|
|
ntfsDefaultSecurityId103 = $00000103;
|
|
[Expand]
NTFS default descriptor ntfsDefaultDescriptor*
ntfsMaxDefaultDescriptor = 7;
|
|
|
|
ntfsDefaultDescriptorNone = 0;
|
|
ntfsDefaultDescriptorVolume = 1;
|
|
ntfsDefaultDescriptorAttrDef = 2;
|
|
ntfsDefaultDescriptorRoot = 3;
|
|
ntfsDefaultDescriptor102 = 4;
|
|
ntfsDefaultDescriptor103 = 5;
|
|
ntfsDefaultDescriptorFile = 6;
|
Used by NTFSDefaultSecurity option
|
ntfsDefaultDescriptorFolder = 7;
|
Used by NTFSDefaultSecurity option
|
|
|
ntfsDefaultDescriptorBoot = 2;
|
Same as ntfsDefaultDescriptorAttrDef
|
ntfsDefaultDescriptor100 = 2;
|
Same as ntfsDefaultDescriptorAttrDef
|
ntfsDefaultDescriptor101 = 1;
|
Same as ntfsDefaultDescriptorVolume
|
ntfsDefaultDescriptorReserved = 1;
|
Same as ntfsDefaultDescriptorVolume
|
[Expand]
NTFS security offset ntfsSecurityOffset*
ntfsSecurityOffsetFirst = 0;
|
Int64
|
|
|
ntfsSecurityOffsetUnknown = -1;
|
Int64
|
[Expand]
NTFS index name ntfsIndexName*
ntfsIndexNameFileName = '$I30';
|
|
ntfsIndexNameSecurityId = '$SII';
|
|
ntfsIndexNameSecurityHash = '$SDH';
|
|
ntfsIndexNameObjectId = '$O';
|
|
ntfsIndexNameOwnerId = '$O';
|
|
ntfsIndexNameQuota = '$Q';
|
|
ntfsIndexNameReparse = '$R';
|
|
[Expand]
NTFS index order ntfsIndexOrder*
ntfsIndexOrderFileName = 38;
|
|
ntfsIndexOrderSecurityId = 100;
|
|
ntfsIndexOrderSecurityHash = 100;
|
|
ntfsIndexOrderObjectId = 100;
|
|
ntfsIndexOrderOwnerId = 100;
|
|
ntfsIndexOrderQuota = 100;
|
|
ntfsIndexOrderReparse = 100;
|
|
[Expand]
NTFS stream name ntfsStreamName*
ntfsStreamNameSecurity = '$SDS';
|
|
ntfsStreamNameBadClus = '$Bad';
|
|
ntfsStreamNameMountMgr = '$MountMgrDatabase';
|
|
ntfsStreamNameJournal = '$J';
|
|
ntfsStreamNameJrnlMax = '$Max';
|
|
[Expand]
NTFS file namespace ntfsNameSpace*
ntfsNameSpacePosix = $00;
|
|
ntfsNameSpaceWin32 = $01;
|
|
ntfsNameSpaceDos = $02;
|
|
ntfsNameSpaceBoth = ntfsNamespaceWin32 or ntfsNamespaceDos;
|
|
[Expand]
NTFS display type ntfsDisplayType*
ntfsDisplayTypeNone = $00000000;
|
|
[Expand]
NTFS collate type ntfsCollateType*
ntfsCollateTypeBinary = $00000000;
|
Binary, where the first byte is most significant
|
ntfsCollateTypeFileName = $00000001;
|
Filename Unicode strings (This is a case insensitive compare)
|
ntfsCollateTypeUnicode = $00000002;
|
Unicode strings, except that upper case letters should come first (This is a case sensitive compare)
|
ntfsCollateTypeLongWord = $00000010;
|
An unsigned long (32 bits, little endian)
|
ntfsCollateTypeSID = $00000011;
|
A Security Identifier
|
ntfsCollateTypeSecurityHash = $00000012;
|
First compare by the Security Hash, then by Security Descriptor (Sorting is by Security Hash then Security Id)
|
ntfsCollateTypeGUID = $00000013;
|
Object GUIDs
|
[Expand]
NTFS volume flag ntfsVolumeFlag*
ntfsVolumeFlagNone = $0000;
|
|
ntfsVolumeFlagDirty = $0001;
|
|
ntfsVolumeFlagResizeLogFile = $0002;
|
|
ntfsVolumeFlagUpgradeMount = $0004;
|
|
ntfsVolumeFlagMountedNT4 = $0008;
|
|
ntfsVolumeFlagDeleteUSN = $0010;
|
|
ntfsVolumeFlagRepairObjectIds = $0020;
|
|
ntfsVolumeFlagModifiedChkdsk = $8000;
|
|
[Expand]
NTFS file record flag ntfsFileRecordFlag*
ntfsFileRecordFlagNone = $0000;
|
|
ntfsFileRecordFlagInUse = $0001;
|
|
ntfsFileRecordFlagDirectory = $0002;
|
|
ntfsFileRecordFlagUnknown1 = $0004;
|
Used by $Quota,$ObjId,$Reparse
|
ntfsFileRecordFlagIndexView = $0008;
|
Used by $Secure,$Quota,$ObjId,$Reparse
|
[Expand]
NTFS attribute flag ntfsAttrDefFlag* ntfsAttributeFlag*
ntfsAttrDefFlagNone = $00000000;
|
|
ntfsAttrDefFlagIndexed = $00000002;
|
|
ntfsAttrDefFlagResident = $00000040;
|
Always resident
|
ntfsAttrDefFlagUncompressed = $00000080;
|
Cannot Compress (Note: Resident Attributes cannot be compressed anyway)
|
|
|
ntfsAttrDefFlagResidentIndex = $00000042;
|
Used by FileName (Resident and Indexed)
|
|
|
ntfsAttributeFlagNone = $0000;
|
|
ntfsAttributeFlagCompressed = $0001;
|
|
ntfsAttributeFlagEncrypted = $4000;
|
|
ntfsAttributeFlagSparse = $8000;
|
|
[Expand]
NTFS attribute ntfsAttribute*
ntfsAttributeIndexed = $01;
|
|
ntfsAttributeNonIndexed = $00;
|
|
ntfsAttributeResident = $00;
|
|
ntfsAttributeNonResident = $01;
|
|
[Expand]
NTFS index header flag ntfsIndexHeaderFlag*
ntfsIndexHeaderFlagNone = $0000;
|
|
ntfsIndexHeaderFlagSubNodes = $0001;
|
Index has Sub Nodes
|
[Expand]
NTFS index entry flag ntfsIndexEntryFlag*
ntfsIndexEntryFlagNone = $0000;
|
|
ntfsIndexEntryFlagSubNode = $0001;
|
Entry has Sub Node
|
ntfsIndexEntryFlagLastNode = $0002;
|
Entry is Last Node (Always the Blank Node)
|
[Expand]
NTFS quota flag ntfsQuotaFlag*
ntfsQuotaFlagNone = $0000;
|
|
ntfsQuotaFlagDefaultLimits = $0001;
|
|
ntfsQuotaFlagLimitReached = $0002;
|
|
ntfsQuotaFlagIdDeleted = $0004;
|
|
ntfsQuotaFlagTrackingEnabled = $0010;
|
|
ntfsQuotaFlagEnforcementEnabled = $0020;
|
|
ntfsQuotaFlagTrackingRequested = $0040;
|
|
ntfsQuotaFlagLogThreshold = $0080;
|
|
ntfsQuotaFlagLogLimit = $0100;
|
|
ntfsQuotaFlagOutOfDate = $0200;
|
|
ntfsQuotaFlagCorrupt = $0400;
|
|
ntfsQuotaFlagPendingDeletes = $0800;
|
|
[Expand]
NTFS reparse tag ntfsReparseTag*
ntfsReparseTagNone = $00000000;
|
|
ntfsReparseTagMountPoint = $A0000003;
|
|
ntfsReparseTagHSM = $C0000004;
|
|
ntfsReparseTagNSS = $80000005;
|
|
ntfsReparseTagNSSRecover = $80000006;
|
ntfsReparseTagHSM2
|
ntfsReparseTagSIS = $80000007;
|
|
ntfsReparseTagDFS = $80000008;
|
Shown in some documentation
|
ntfsReparseTagDFS = $8000000A;
|
|
ntfsReparseTagFilterManager = $8000000B;
|
|
ntfsReparseTagSymbolicLink = $A000000C;
|
|
ntfsReparseTagDFSR = $80000012;
|
|
[Expand]
NTFS reparse tag flag ntfsReparseTagFlag*
ntfsReparseTagFlagNone = $00000000;
|
|
ntfsReparseTagFlagIsAlias = $20000000;
|
ntfsReparseTagFlagIsNameSurrogate
|
ntfsReparseTagFlagIsHighLatency = $40000000;
|
|
ntfsReparseTagFlagIsMicrosoft = $80000000;
|
|
[Expand]
NTFS reparse tag type ntfsReparseTagType*
ntfsReparseTagTypeNone = $00000000;
|
|
ntfsReparseTagTypeMountPoint = $00000003;
|
|
ntfsReparseTagTypeHSM = $00000004;
|
|
ntfsReparseTagTypeNSS = $00000005;
|
|
ntfsReparseTagTypeNSSRecover = $00000006;
|
ntfsReparseTagHSM2
|
ntfsReparseTagTypeSIS = $00000007;
|
|
ntfsReparseTagTypeDFS = $00000008;
|
Shown in some documentation
|
ntfsReparseTagTypeDFS = $0000000A;
|
|
ntfsReparseTagTypeFilterManager = $0000000B;
|
|
ntfsReparseTagTypeSymbolicLink = $0000000C;
|
|
ntfsReparseTagTypeDFSR = $00000012;
|
|
|
|
ntfsReparsePointPrefix = '\??\';
|
|
[Expand]
NTFS extended attribute flag ntfsExtendedAttributeFlag*
ntfsExtendedAttributeFlagNone = $00;
|
|
ntfsExtendedAttributeFlagNeedEA = $80;
|
|
[Expand]
NTFS default size ntfsDefault*Size
ntfsDefaultBootRecordSize = 8192;
|
|
ntfsDefaultFileRecordSize = 1024;
|
|
ntfsDefaultIndexRecordSize = 4096;
|
|
|
|
ntfsDefaultSecureSdsSize = 262396;
|
262616 if including Id 102 and 103
|
[Expand]
NTFS log file ntfsLogFile*
ntfsRestartPageSize = $1000;
|
|
|
|
ntfsLogFileClientFirst = $0000;
|
|
ntfsLogFileClientUnknown = $FFFF;
|
|
|
|
ntfsLogFileRestartFlagClean = $0002;
|
|
[Expand]
NTFS old log file size ntfs*OldLogSize
ntfsMaxOldLogSize = 10;
|
|
ntfsOldLogSizes:array[0..ntfsMaxOldLogSize] of TNTFSLogSize = (
|
| DiskSize,LogSize
|
(DiskSize:8388608;LogSize:262144),
|
greater than 8MB, 256KB log
|
(DiskSize:16777216;LogSize:262144),
|
greater than 16MB, 256KB log
|
(DiskSize:33554432;LogSize:524288),
|
greater than 32MB, 512KB log (Previously 262144)
|
(DiskSize:67108864;LogSize:1048576),
|
greater than 64MB, 1MB log (Previously 524288)
|
(DiskSize:134217728;LogSize:2097152),
|
greater than 128MB, 2MB log (Previously 1048576)
|
(DiskSize:268435456;LogSize:2097152),
|
greater than 256MB, 2MB log
|
(DiskSize:536870912;LogSize:4194304),
|
greater than 512MB, 4MB log
|
(DiskSize:1073741824;LogSize:8388608),
|
greater than 1GB, 8MB log
|
(DiskSize:2147483648;LogSize:16777216),
|
greater than 2GB, 16MB log
|
(DiskSize:4294967296;LogSize:33554432),
|
greater than 4GB, 32MB log
|
(DiskSize:8589934592;LogSize:67108864));
|
greater than 8GB, 64MB log
|
[Expand]
NTFS log file size ntfs*LogSize
ntfsMaxLogSize = 8;
|
|
ntfsLogSizes:array[0..ntfsMaxLogSize] of TNTFSLogSize = (
|
| DiskSize,LogSize
|
(DiskSize:0;LogSize:2097152),
|
less than 128MB, 2MB log
|
(DiskSize:134217728;LogSize:4194304),
|
greater than 128MB, 4MB log
|
(DiskSize:268435456;LogSize:5242880),
|
greater than 256MB, 5MB log
|
(DiskSize:536870912;LogSize:6291456),
|
greater than 512MB, 6MB log
|
(DiskSize:805306368;LogSize:7340032),
|
greater than 768MB, 7MB log
|
(DiskSize:1073741824;LogSize:8388608),
|
greater than 1GB, 8MB log
|
(DiskSize:2147483648;LogSize:16777216),
|
greater than 2GB, 16MB log
|
(DiskSize:4294967296;LogSize:33554432),
|
greater than 4GB, 32MB log
|
(DiskSize:8589934592;LogSize:67108864));
|
greater than 8GB, 64MB log
|
[Expand]
NTFS MFT/MFTMirr start ntfsMftStart*
ntfsMftStartCluster = 786432;
|
|
ntfsMftCutoverCount = 4194304;
|
4194304 * 4096 = 16GB (The point at which the MFT becomes fixed in location)
|
[Expand]
NTFS file size ntfsFileSize*
ntfsFileSizeMft = ntfsUnknownCluster;
|
Variable size
|
ntfsFileSizeMftMirr = ntfsUnknownCluster;
|
Variable size
|
ntfsFileSizeLogFile = ntfsUnknownCluster;
|
Variable size
|
ntfsFileSizeVolume = 0;
|
Constant size
|
ntfsFileSize12AttrDef = 36864;
|
Constant size
|
ntfsFileSize30AttrDef = 2560;
|
Constant size
|
ntfsFileSize31AttrDef = 2560;
|
Constant size
|
ntfsFileSizeRoot = ntfsUnknownCluster;
|
Variable size
|
ntfsFileSizeBitmap = ntfsUnknownCluster;
|
Variable size
|
ntfsFileSizeBoot = 8192;
|
Constant size
|
ntfsFileSizeBadClus = 0;
|
Starting size
|
ntfsFileSizeSecure = 0;
|
Constant size
|
ntfsFileSizeUpCase = 131072;
|
Constant size
|
ntfsFileSizeExtend = 0;
|
Constant size
|
|
|
ntfsFileSizeObjId = 0;
|
Constant size
|
ntfsFileSizeQuota = 0;
|
Constant size
|
ntfsFileSizeReparse = 0;
|
Constant size
|
ntfsFileSizeUsnJrnl = ntfsUnknownCluster;
|
Variable size
|
[Expand]
NTFS stream size ntfsStreamSize*
ntfsStreamSizeSecurity = ntfsUnknownCluster;
|
Variable size
|
ntfsStreamSizeBadClus = ntfsUnknownCluster;
|
Variable size
|
ntfsStreamSizeMountMgr = ntfsUnknownCluster;
|
Variable size
|
ntfsStreamSizeJournal = ntfsUnknownCluster;
|
Variable size
|
ntfsStreamSizeJrnlMax = ntfsUnknownCluster;
|
Variable size
|
[Expand]
NTFS header size ntfs*HeaderSize*
ntfsFileRecord12Size = 42;
|
Constant size
|
ntfsFileRecord31Size = 48;
|
Constant size
|
|
|
ntfsIndexRecordSize = 24;
|
Constant size
|
ntfsIndexHeaderSize = 16;
|
Constant size
|
ntfsIndexEntrySize = 16;
|
Minimum size
|
|
|
ntfsAttributeTypeSize = 4;
|
Constant size
|
ntfsAttributeHeaderSize = 16;
|
Minimum size
|
ntfsResidentHeaderSize = 24;
|
Minimum size
|
ntfsNonResidentHeaderSize = 64;
|
Minimum size
|
ntfsCompressedHeaderSize = 72;
|
Minimum size
|
[Expand]
NTFS attribute size ntfsAttribute*Size
| Minimum sizes
|
|
|
ntfsStandardInformation12Size = 48;
|
Constant size
|
ntfsStandardInformation30Size = 72;
|
Constant size
|
ntfsAttributeListSize = 0;
|
Variable size
|
ntfsFileNameSize = 66;
|
Minimum size
|
ntfsObjectIdSize = 16;
|
Minimum size
|
ntfsObjectIdSize2 = 32;
|
Minimum size
|
ntfsObjectIdSize3 = 48;
|
Minimum size
|
ntfsObjectIdSize4 = 64;
|
Minimum size
|
ntfsVolumeVersionSize = 8;
|
Constant size
|
ntfsSecurityDescriptorSize = 0;
|
Variable size
|
ntfsVolumeNameSize = 0;
|
Variable size
|
ntfsVolumeInformationSize = 12;
|
Constant size
|
ntfsDataSize = 0;
|
Variable size
|
ntfsIndexRootSize = 16;
|
Constant size
|
ntfsIndexAllocationSize = 0;
|
Variable size
|
ntfsBitmapSize = 0;
|
Variable size
|
ntfsReparsePointSize = 8;
|
Minimum size
|
ntfsReparsePointMicrosoftSize = 8;
|
Minimum size
|
ntfsReparsePointOtherSize = 24;
|
Minimum size
|
ntfsSymbolicLinkSize = 0;
|
Variable size
|
ntfsExtendedAttrInformationSize = 8;
|
Constant size
|
ntfsExtendedAttrSize = 0;
|
Variable size
|
ntfsPropertySetSize = 0;
|
Variable size
|
ntfsLoggedUtilityStreamSize = 0;
|
Variable size
|
ntfsUnknownSize = 0;
|
Variable size
|
ntfsEndSize = 4;
|
Constant size
|
[Expand]
NTFS data size ntfs*Size
| Minimum sizes
|
|
|
ntfsRunSize = 1;
|
Minimum size
|
ntfsItemSize = 26;
|
Minimum size
|
ntfsObjIdSize = 56;
|
Constant size
|
ntfsQuotaSize = 48;
|
Minimum size
|
ntfsOwnerSize = 4;
|
Constant size
|
ntfsUpCaseSize = 131072;
|
Constant size
|
ntfsAttrDefSize = 160;
|
Constant size
|
ntfsReparseSize = 12;
|
Minimum size
|
ntfsExtendedSize = 8;
|
Minimum size
|
ntfsSecuritySize = 20;
|
Minimum size
|
ntfsSidSize = 8;
|
Minimum size
|
ntfsAclSize = 8;
|
Minimum size
|
ntfsAceSize = 8;
|
Minimum size
|
ntfsSecurityItemSize = 40;
|
Minimum size (Includes ntfsSecuritySize)
|
ntfsSecurityIdSize = 20;
|
Minimum size
|
ntfsSecurityHashSize = 20;
|
Minimum size (Previously 24 - Modified to remove Padding)
|
[Expand]
NTFS key size ntfs*KeySize
| Minimum sizes
|
|
|
ntfsObjIdKeySize = 16;
|
Minimum size
|
ntfsQuotaKeySize = 4;
|
Minimum size
|
ntfsOwnerKeySize = 8;
|
Minimum size (Includes ntfsSidSize)
|
ntfsSecurityIdKeySize = 4;
|
Minimum size
|
ntfsSecurityHashKeySize = 8;
|
Minimum size
|
ntfsReparseKeySize = 12;
|
Constant size (Not 16 even though CollateType is GUID)
|
[Expand]
NTFS update sequence size ntfsUpdateSequenceSize*
ntfsUpdateSequenceSize = 512;
|
Constant size (Always 512 regardless of the sector size)
|
[Expand]
NTFS sector count ntfs*SectorCount
| Used for NTFS formatting (Fixed Disk only)
|
|
|
ntfs12MaxSectorCount = 4;
|
|
ntfs12SectorCounts:array[0..ntfs12MaxSectorCount] of TNTFSSectorCount = (
|
| SectorCount,SectorsPerCluster
|
(SectorCount:16384;SectorsPerCluster:0),
|
up to 8 MB, the 0 value for SectorsPerCluster trips an error
|
(SectorCount:1048576;SectorsPerCluster:1),
|
up to 512 MB, sector size cluster
|
(SectorCount:2097152;SectorsPerCluster:2),
|
up to 1 GB, 1k cluster
|
(SectorCount:4194304;SectorsPerCluster:4),
|
up to 2 GB, 2k cluster
|
(SectorCount:$FFFFFFFF;SectorsPerCluster:8));
|
greater than 2 GB, 4k cluster
|
|
|
ntfs30MaxSectorCount = 4;
|
|
ntfs30SectorCounts:array[0..ntfs30MaxSectorCount] of TNTFSSectorCount = (
|
| SectorCount,SectorsPerCluster
|
(SectorCount:16384;SectorsPerCluster:0),
|
up to 8 MB, the 0 value for SectorsPerCluster trips an error
|
(SectorCount:1048576;SectorsPerCluster:1),
|
up to 512 MB, sector size cluster
|
(SectorCount:2097152;SectorsPerCluster:2),
|
up to 1 GB, 1k cluster
|
(SectorCount:4194304;SectorsPerCluster:4),
|
up to 2 GB, 2k cluster
|
(SectorCount:$FFFFFFFF;SectorsPerCluster:8));
|
greater than 2 GB, 4k cluster
|
Type definitions
NTFS attribute definition
[Expand]
TNTFSAttrDefine = record
| Note: Not Packed
|
AttributeType:LongWord;
|
|
AttributeName:String;
|
|
AttrDefFlags:LongWord;
|
|
MinimumSize:Int64;
|
|
MaximumSize:Int64;
|
|
NTFS uppercase conversion
[Expand]
TNTFSUpcaseConvert = record
| Note: Not Packed
|
Count:Word;
|
|
Value:Word;
|
|
NTFS sector count
[Expand]
TNTFSSectorCount = record
| Note: Not Packed (Fixed Disk only)
|
SectorCount:LongWord;
|
Based on 512 bytes per sector only
|
SectorsPerCluster:LongWord;
|
|
NTFS log size
[Expand]
TNTFSLogSize = record
| Note: Not Packed
|
DiskSize:Int64;
|
|
LogSize:Int64;
|
|
NTFS default SID
[Expand]
PNTFSDefaultSid = ^TNTFSDefaultSid;
TNTFSDefaultSid = record
| Note: Not Packed
|
Sid:TWellKnownSidType;
|
|
NTFS default access control entry
[Expand]
TNTFSDefaultAce = record
| Note: Not Packed
|
AceType:Byte;
|
|
AceFlags:Byte;
|
|
AceSize:Word;
|
|
Mask:LongWord;
|
|
Sid:TWellKnownSidType;
|
|
NTFS default access control list
[Expand]
TNTFSDefaultAcl = record
| Note: Not Packed
|
AclRevision:Byte;
|
|
AclSize:Word;
|
|
AceCount:Word;
|
|
Aces:array[0..7] of TNTFSDefaultAce;
|
|
NTFS default descriptor
[Expand]
PNTFSDefaultDescriptor = ^TNTFSDefaultDescriptor;
TNTFSDefaultDescriptor = record
| Note: Not Packed
|
Size:LongWord;
|
|
Revision:Byte;
|
Revision
|
Control:Word;
|
Control Flags
|
OwnerOffset:LongWord;
|
Offset to Owner SID
|
GroupOffset:LongWord;
|
Offset to Group SID
|
SaclOffset:LongWord;
|
Offset to SACL
|
DaclOffset:LongWord;
|
Offset to DACL
|
Owner:TWellKnownSidType;
|
|
Group:TWellKnownSidType;
|
|
Sacl:TNTFSDefaultAcl;
|
|
Dacl:TNTFSDefaultAcl;
|
|
Public variables
NTFS specific variables
SecurityHashPadding:LongWord = ntfsSecurityHashPadding;
|
|
Function declarations
None defined
Return to Unit Reference
