Unit NTFSClass
From Ultibo.org
Return to Unit Reference
Contents
Description
Ultibo NTFS classes unit
To be documented
Constants
None defined
Type definitions
NTFS compare security descriptor
TNTFSCompareSecurityDescriptor = function(ASecurityId:LongWord; ADescriptor:Pointer; ASize:Word):Boolean of Object;
|
Class definitions
NTFS disk table
TNTFSDiskTable = class(TDiskTable)
| Note: Respresents the $Mft and $MftMirr | |
constructor Create(ALocalLock:TMutexHandle);
|
|
destructor Destroy; override;
|
|
private
| |
FStartSector:Int64;
|
Absolute starting sector of this table |
FStartCluster:Int64;
|
Absolute starting cluster of this table |
FEntry:TNTFSDiskEntry;
|
|
public
| |
property StartSector:Int64 read FStartSector write FStartSector;
|
|
property StartCluster:Int64 read FStartCluster write FStartCluster;
|
|
property Entry:TNTFSDiskEntry read FEntry write FEntry;
|
|
NTFS disk block
TNTFSDiskBlock = class(TDiskBlock)
| Note: Represents a block of $Bitmap entries | |
constructor Create(ALocalLock:TMutexHandle);
|
|
destructor Destroy; override;
|
|
private
| |
FBlockCount:LongWord;
|
Number of cluster entries in this block (Bits in the bitmap) |
FBlockBuffer:Pointer;
|
|
FBlockCluster:Int64;
|
First cluster represented by this block (BlockNo represents the VCN of the block) |
public
| |
property BlockCount:LongWord read FBlockCount write FBlockCount;
|
|
property BlockBuffer:Pointer read FBlockBuffer write FBlockBuffer;
|
|
property BlockCluster:Int64 read FBlockCluster write FBlockCluster;
|
|
NTFS disk entry
TNTFSDiskEntry = class(TDiskEntry)
| Note: Represents a file entry. | |
constructor Create(ALocalLock:TMutexHandle; AOrigin:TNTFSDiskRecord; AAttribute:TNTFSDiskAttribute);
|
|
destructor Destroy; override;
|
|
private
| |
FPrevEntry:TNTFSDiskEntry;
|
|
FNextEntry:TNTFSDiskEntry;
|
|
FUsed:Int64;
|
Used size of the file |
FAllocated:Int64;
|
Allocated size of file |
FChangeTime:TFileTime;
|
MFT record change time |
FOrigin:TNTFSDiskRecord;
|
Entry origin record |
FAttribute:TNTFSDiskAttribute;
|
Entry naming attribute |
FAlternate:TNTFSDiskAttribute;
|
Alternate name attribute |
procedure SetOrigin(AOrigin:TNTFSDiskRecord);
|
|
public
| |
property LocalLock:TMutexHandle read FLocalLock write FLocalLock;
|
|
property PrevEntry:TNTFSDiskEntry read FPrevEntry write FPrevEntry;
|
|
property NextEntry:TNTFSDiskEntry read FNextEntry write FNextEntry;
|
|
property Used:Int64 read FUsed write FUsed;
|
|
property Allocated:Int64 read FAllocated write FAllocated;
|
|
property ChangeTime:TFileTime read FChangeTime write FChangeTime;
|
|
property Origin:TNTFSDiskRecord read FOrigin write SetOrigin;
|
|
property Attribute:TNTFSDiskAttribute read FAttribute write FAttribute;
|
|
property Alternate:TNTFSDiskAttribute read FAlternate write FAlternate;
|
|
function GetDot:TNTFSDiskEntry;
|
|
function GetDotDot:TNTFSDiskEntry;
|
|
function CreateDot:TNTFSDiskEntry;
|
|
function CreateDotDot:TNTFSDiskEntry;
|
|
function UpdateDot:Boolean;
|
|
function UpdateDotDot(AEntry:TNTFSDiskEntry):Boolean;
|
|
function RecordNumber:Int64;
|
|
function FileReference:Int64;
|
|
function UpdateEntry:Boolean;
|
|
function UpdateRecord:Boolean;
|
|
function FindFirstName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;
|
|
function FindPrevName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;
|
|
function FindNextName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;
|
|
function FindLastName(AHandle:TFindHandle; AReference:Boolean):TDiskEntry; override;
|
|
NTFS disk access contol list
TNTFSDiskAcl = class(TDiskAcl)
| Note: Data of attribute $SECURITY_DESCRIPTOR | |
constructor Create(ALocalLock:TMutexHandle);
|
|
destructor Destroy; override;
|
|
private
| |
public
| |
NTFS disk access control entry
TNTFSDiskAce = class(TDiskAce)
| Note: Data of attribute $SECURITY_DESCRIPTOR | |
constructor Create(ALocalLock:TMutexHandle);
|
|
destructor Destroy; override;
|
|
private
| |
public
| |
NTFS entry list
TNTFSEntryList = class(TObject)
constructor Create;
|
|
destructor Destroy; override;
|
|
private
| |
FEntryCount:Integer;
|
|
FFirstEntry:TNTFSDiskEntry;
|
|
FLastEntry:TNTFSDiskEntry;
|
|
function Link(AEntry:TNTFSDiskEntry):Boolean;
|
|
function Unlink(AEntry:TNTFSDiskEntry):Boolean;
|
|
public
| |
property EntryCount:Integer read FEntryCount;
|
|
property FirstEntry:TNTFSDiskEntry read FFirstEntry;
|
|
property LastEntry:TNTFSDiskEntry read FLastEntry;
|
|
function Add(AEntry:TNTFSDiskEntry):Boolean;
|
|
function Remove(AEntry:TNTFSDiskEntry):Boolean;
|
|
procedure ClearList; virtual;
|
|
NTFS record list
TNTFSRecordList = class(TObject)
constructor Create;
|
|
destructor Destroy; override;
|
|
private
| |
FRecordCount:Integer;
|
|
FFirstRecord:TNTFSDiskRecord;
|
|
FLastRecord:TNTFSDiskRecord;
|
|
function Link(ARecord:TNTFSDiskRecord):Boolean;
|
|
function Unlink(ARecord:TNTFSDiskRecord):Boolean;
|
|
public
| |
property RecordCount:Integer read FRecordCount;
|
|
property FirstRecord:TNTFSDiskRecord read FFirstRecord;
|
|
property LastRecord:TNTFSDiskRecord read FLastRecord;
|
|
function Add(ARecord:TNTFSDiskRecord):Boolean;
|
|
function Remove(ARecord:TNTFSDiskRecord):Boolean;
|
|
procedure ClearList; virtual;
|
|
NTFS record index
TNTFSRecordIndex = class(TLinkedObjBtree)
| Note: Index of FILE records. | |
constructor Create;
|
|
destructor Destroy; override;
|
|
private
| |
FLock:TSynchronizerHandle;
|
|
FRecordLocal:TMutexHandle;
|
|
FRunsLock:TSynchronizerHandle;
|
|
FItemsLock:TSynchronizerHandle;
|
|
FNodesLock:TSynchronizerHandle;
|
|
FIndexLock:TSynchronizerHandle;
|
|
FExtendedsLock:TSynchronizerHandle;
|
|
FAttributesLock:TSynchronizerHandle;
|
|
FRunLocal:TMutexHandle;
|
|
FItemLocal:TMutexHandle;
|
|
FKeyLocal:TMutexHandle;
|
|
FNodeLocal:TMutexHandle;
|
|
FExtendedLocal:TMutexHandle;
|
|
FAttributeLocal:TMutexHandle;
|
|
function Find(const ARecordNumber:Int64; ACurrent:TNTFSDiskRecord):TNTFSDiskRecord;
|
|
protected
| |
function CreateBlank:TBtreeObject; override;
|
|
function Compare(AEntry1,AEntry2:TBtreeObject):Integer; override;
|
|
public
| |
function CreateRecord(ABase:TNTFSDiskRecord; const ARecordNumber:Int64; AVersion:Word):TNTFSDiskRecord;
|
|
function DestroyRecord(ARecord:TNTFSDiskRecord):Boolean;
|
|
function NewRecord(ABase:TNTFSDiskRecord; const ARecordNumber:Int64; AVersion:Word):TNTFSDiskRecord;
|
|
function InsertRecord(ARecord:TNTFSDiskRecord):Boolean;
|
|
function DeleteRecord(ARecord:TNTFSDiskRecord):Boolean;
|
|
function RemoveRecord(ARecord:TNTFSDiskRecord):Boolean;
|
|
function FindRecord(const ARecordNumber:Int64):TNTFSDiskRecord;
|
|
function ReaderLock:Boolean;
|
|
function ReaderUnlock:Boolean;
|
|
function ReaderConvert:Boolean;
|
|
function WriterLock:Boolean;
|
|
function WriterUnlock:Boolean;
|
|
function WriterConvert:Boolean;
|
|
function RunsReaderLock:Boolean;
|
|
function RunsReaderUnlock:Boolean;
|
|
function RunsWriterLock:Boolean;
|
|
function RunsWriterUnlock:Boolean;
|
|
function ItemsReaderLock:Boolean;
|
|
function ItemsReaderUnlock:Boolean;
|
|
function ItemsWriterLock:Boolean;
|
|
function ItemsWriterUnlock:Boolean;
|
|
function NodesReaderLock:Boolean;
|
|
function NodesReaderUnlock:Boolean;
|
|
function NodesWriterLock:Boolean;
|
|
function NodesWriterUnlock:Boolean;
|
|
function IndexReaderLock:Boolean;
|
|
function IndexReaderUnlock:Boolean;
|
|
function IndexWriterLock:Boolean;
|
|
function IndexWriterUnlock:Boolean;
|
|
function ExtendedsReaderLock:Boolean;
|
|
function ExtendedsReaderUnlock:Boolean;
|
|
function ExtendedsWriterLock:Boolean;
|
|
function ExtendedsWriterUnlock:Boolean;
|
|
function AttributesReaderLock:Boolean;
|
|
function AttributesReaderUnlock:Boolean;
|
|
function AttributesWriterLock:Boolean;
|
|
function AttributesWriterUnlock:Boolean;
|
|
NTFS disk record
TNTFSDiskRecord = class(TBtreeObject)
| Note: Represents a FILE record entry. | |
constructor Create(ALocalLock:TMutexHandle; ABase:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
private
| |
FLocalLock:TMutexHandle;
|
|
FRunsLock:TSynchronizerHandle;
|
|
FItemsLock:TSynchronizerHandle;
|
|
FNodesLock:TSynchronizerHandle;
|
|
FIndexLock:TSynchronizerHandle;
|
|
FExtendedsLock:TSynchronizerHandle;
|
|
FAttributesLock:TSynchronizerHandle;
|
|
FRunLocal:TMutexHandle;
|
|
FItemLocal:TMutexHandle;
|
|
FKeyLocal:TMutexHandle;
|
|
FNodeLocal:TMutexHandle;
|
|
FExtendedLocal:TMutexHandle;
|
|
FAttributeLocal:TMutexHandle;
|
|
FStatus:LongWord;
|
|
FPrevRecord:TNTFSDiskRecord;
|
|
FNextRecord:TNTFSDiskRecord;
|
|
FRecordFlags:Word;
|
Flags (See Consts) |
FHardLinkCount:Word;
|
Hard link count |
FSequenceNumber:Word;
|
Sequence number |
FNextAttributeId:Word;
|
Next Attribute Id |
FRecordNumber:Int64;
|
Number of this MFT Record |
FRecordSize:LongWord;
|
Actual size of the FILE record |
FRecordAllocated:LongWord;
|
Allocated size of the FILE record |
FAttributeOffset:Word;
|
Offset to the first Attribute |
FUpdateSequenceOffset:Word;
|
Offset to the Update Sequence Record |
FUpdateSequenceLength:Word;
|
Size in words of the Update Sequence Record |
FUpdateSequenceNumber:Word;
|
Update Sequence Number |
FLogFileSequenceNumber:Int64;
|
LogFile Sequence Number (LSN) |
FBase:TNTFSDiskRecord;
|
Base file record |
FLinks:TNTFSEntryList;
|
List of record links |
FStreams:TNTFSEntryList;
|
List of record streams |
FRecords:TNTFSRecordList;
|
List of child records |
FAttributes:TNTFSDiskAttributes;
|
List of record attributes |
function AcquireLock:Boolean;
|
|
function ReleaseLock:Boolean;
|
|
function GetResizing:Boolean;
|
|
procedure SetResizing(AValue:Boolean);
|
|
function GetRemoving:Boolean;
|
|
procedure SetRemoving(AValue:Boolean);
|
|
function GetMirrored:Boolean;
|
|
procedure SetMirrored(AValue:Boolean);
|
|
function GetMetafile:Boolean;
|
|
procedure SetMetafile(AValue:Boolean);
|
|
function GetReserved:Boolean;
|
|
procedure SetReserved(AValue:Boolean);
|
|
function GetExpansion:Boolean;
|
|
procedure SetExpansion(AValue:Boolean);
|
|
function GetOverflow:Boolean;
|
|
procedure SetOverflow(AValue:Boolean);
|
|
function GetExtension:Boolean;
|
|
procedure SetExtension(AValue:Boolean);
|
|
function GetIsUsed:Boolean;
|
|
procedure SetIsUsed(AValue:Boolean);
|
|
function GetIsFolder:Boolean;
|
|
procedure SetIsFolder(AValue:Boolean);
|
|
function GetIsUnknown1:Boolean;
|
|
procedure SetIsUnknown1(AValue:Boolean);
|
|
function GetIsIndexView:Boolean;
|
|
procedure SetIsIndexView(AValue:Boolean);
|
|
function GetOrigin:TNTFSDiskRecord;
|
|
function CreateLinks(ANew:Boolean):TNTFSEntryList;
|
|
function CreateStreams(ANew:Boolean):TNTFSEntryList;
|
|
function CreateRecords(ANew:Boolean):TNTFSRecordList;
|
|
function CreateAttributes(AVersion:Word; ANew:Boolean):TNTFSDiskAttributes;
|
|
public
| |
property Resizing:Boolean read GetResizing write SetResizing;
|
Record is being Resized |
property Removing:Boolean read GetRemoving write SetRemoving;
|
Record is being Removed |
property Mirrored:Boolean read GetMirrored write SetMirrored;
|
Record is in $MftMirr file |
property Metafile:Boolean read GetMetafile write SetMetafile;
|
Record is an NTFS metafile |
property Reserved:Boolean read GetReserved write SetReserved;
|
Record is an Mft reserved record |
property Expansion:Boolean read GetExpansion write SetExpansion;
|
Record is an Mft expansion record |
property Overflow:Boolean read GetOverflow write SetOverflow;
|
Record has an attribute list attribute |
property Extension:Boolean read GetExtension write SetExtension;
|
Record is an extension of the base record |
property PrevRecord:TNTFSDiskRecord read FPrevRecord write FPrevRecord;
|
|
property NextRecord:TNTFSDiskRecord read FNextRecord write FNextRecord;
|
|
property IsUsed:Boolean read GetIsUsed write SetIsUsed;
|
Record is in use |
property IsFolder:Boolean read GetIsFolder write SetIsFolder;
|
Record is a folder |
property IsUnknown1:Boolean read GetIsUnknown1 write SetIsUnknown1;
| |
property IsIndexView:Boolean read GetIsIndexView write SetIsIndexView;
|
Record is an index view |
property RecordFlags:Word read FRecordFlags write FRecordFlags;
|
|
property HardLinkCount:Word read FHardLinkCount write FHardLinkCount;
|
|
property SequenceNumber:Word read FSequenceNumber write FSequenceNumber;
|
|
property NextAttributeId:Word read FNextAttributeId write FNextAttributeId;
|
|
property RecordNumber:Int64 read FRecordNumber write FRecordNumber;
|
|
property RecordSize:LongWord read FRecordSize write FRecordSize;
|
|
property RecordAllocated:LongWord read FRecordAllocated write FRecordAllocated;
|
|
property AttributeOffset:Word read FAttributeOffset write FAttributeOffset;
|
|
property UpdateSequenceOffset:Word read FUpdateSequenceOffset write FUpdateSequenceOffset;
|
|
property UpdateSequenceLength:Word read FUpdateSequenceLength write FUpdateSequenceLength;
|
|
property UpdateSequenceNumber:Word read FUpdateSequenceNumber write FUpdateSequenceNumber;
|
|
property LogFileSequenceNumber:Int64 read FLogFileSequenceNumber write FLogFileSequenceNumber;
|
|
property Base:TNTFSDiskRecord read FBase write FBase;
|
|
property Links:TNTFSEntryList read FLinks;
|
|
property Streams:TNTFSEntryList read FStreams;
|
|
property Records:TNTFSRecordList read FRecords;
|
|
property Attributes:TNTFSDiskAttributes read FAttributes;
|
|
property Origin:TNTFSDiskRecord read GetOrigin;
|
|
function CreateLink(AAttribute,AAlternate:TNTFSDiskAttribute; ANew:Boolean):TNTFSDiskEntry;
|
|
function DestroyLink(ALink:TNTFSDiskEntry):Boolean;
|
|
function NewLink(AAttribute,AAlternate:TNTFSDiskAttribute):TNTFSDiskEntry;
|
|
function GetLink(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;
|
|
function DeleteLink(ALink:TNTFSDiskEntry):Boolean;
|
|
function RenameLink(ALink:TNTFSDiskEntry; AAttribute,AAlternate:TNTFSDiskAttribute):Boolean;
|
|
function CreateStream(AAttribute:TNTFSDiskAttribute; ANew:Boolean):TNTFSDiskEntry;
|
|
function DestroyStream(AStream:TNTFSDiskEntry):Boolean;
|
|
function NewStream(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;
|
|
function GetStream(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;
|
|
function DeleteStream(AStream:TNTFSDiskEntry):Boolean;
|
|
function GetFileNameByKey(AKey:TNTFSAttributeKey):TNTFSDiskAttribute;
|
|
function GetFileNameByName(const AName:String; AInstance:Integer):TNTFSDiskAttribute;
|
|
function GetFileNameByParent(const AName:String; const AParent:Int64; AInstance:Integer):TNTFSDiskAttribute;
|
|
function GetFileNameByNameSpace(const AName:String; const AParent:Int64; ANameSpace:Byte; AInstance:Integer):TNTFSDiskAttribute;
|
|
function GetRecord(AInstance:Integer):TNTFSDiskRecord;
|
|
function GetRecordByFree(AFree:LongWord; AExclude:Boolean):TNTFSDiskRecord;
|
|
function GetRecordByReference(const AFileReference:Int64):TNTFSDiskRecord;
|
|
function AddRecord(ARecord:TNTFSDiskRecord):Boolean;
|
|
function RemoveRecord(ARecord:TNTFSDiskRecord):Boolean;
|
|
function GetAttributeByItem(AItem:TNTFSDiskItem):TNTFSDiskAttribute;
|
|
function GetAttributeByStatus(AInclude,AExclude:Word; AInstance:Integer):TNTFSDiskAttribute;
|
|
function GetAttributeByVCN(AAttribute:TNTFSDiskAttribute; const AVCN:Int64; var AInstance:LongWord):TNTFSDiskAttribute;
|
|
function GetAttributeByUnit(AAttribute:TNTFSDiskAttribute; const AUnit:Int64; var AInstance:LongWord):TNTFSDiskAttribute;
|
|
function CreateAttribute(AType:LongWord; AVersion:Word; ANew:Boolean):TNTFSDiskAttribute;
|
|
function DestroyAttribute(AAttribute:TNTFSDiskAttribute):Boolean;
|
|
function NewAttribute(APrevious:TNTFSDiskAttribute; AType:LongWord; const AName:String; AVersion:Word):TNTFSDiskAttribute;
|
|
function GetAttribute(AType:LongWord; const AName:String; AInstance:Integer):TNTFSDiskAttribute;
|
|
function RemoveAttribute(AAttribute:TNTFSDiskAttribute):Boolean;
|
|
function MoveAttribute(ADest:TNTFSDiskRecord; AAttribute:TNTFSDiskAttribute):Boolean;
|
|
function RenameAttribute(AAttribute:TNTFSDiskAttribute; const AName:String):Boolean;
|
|
function FileReference:Int64;
|
|
function BaseReference:Int64;
|
File reference to the base FILE record |
function LinkCount:LongWord;
|
|
function StreamCount:LongWord;
|
|
function RecordCount:LongWord;
|
|
function AttributeCount:LongWord;
|
|
function RecordFree:LongWord;
|
|
function AttributeSize(AVersion:Word; AType:LongWord):LongWord;
|
|
function CalculatedSize(AVersion:Word):LongWord;
|
|
function CalculatedOffset(AVersion:Word):Word;
|
|
function CalculatedSequenceOffset(AVersion:Word):Word;
|
|
function CalculatedSequenceLength(ASectorSize:Word):Word;
|
|
function CalculatedStreamUsed(AVersion:Word; AAttribute:TNTFSDiskAttribute):Int64;
|
|
function ReadAttributes(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function WriteAttributes(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function ReadRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word; AFree:Boolean):Boolean;
|
|
function WriteRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
NTFS disk index
TNTFSDiskIndex = class(TLinkedObjBtree)
| Note: Index of INDX records. | |
constructor Create(AKeyLocal:TMutexHandle; ALock:TSynchronizerHandle; AVolumeVersion,ASectorSize:Word; AIndexType,ACollateRule:LongWord; AAttribute:TNTFSDiskAttribute);
|
|
destructor Destroy; override;
|
|
private
| |
FLock:TSynchronizerHandle;
|
|
FKeyLocal:TMutexHandle;
|
|
FStatus:LongWord;
|
|
FSectorSize:Word;
|
|
FVolumeVersion:Word;
|
|
FIndexType:LongWord;
|
Attribute Type (Or None if Data Index) |
FCollateRule:LongWord;
|
Collation Rule |
FIndexRecordSize:LongWord;
|
Size of Index Allocation Entry (bytes) |
FIndexCounterOffset:LongWord;
|
Index Record Number increment |
FClustersPerIndex:LongWord;
|
Clusters per INDX Record or 0 if less than cluster size |
FIndexsPerCluster:LongWord;
|
INDX Records per Cluster or 0 if more than cluster size |
FIndexCounterShift:Word;
|
Shift count for Record -> Counter |
FIndexRecordShiftCount:Word;
|
Shift count for Record -> VCN |
FIndexRecordOffsetMask:Int64;
|
Mask for Record offset calculation |
FTotalIndexRecordCount:Int64;
|
Total number of index records in index |
FLastFreeIndexRecord:Int64;
|
Or ntfsUnknownRecordNumber if not known |
FFreeIndexRecordCount:Int64;
|
Or ntfsUnknownRecordNumber if not known |
FCompareSecurityDescriptor:TNTFSCompareSecurityDescriptor;
|
|
FUpCase:TNTFSUpCase;
|
Uppercase Conversion Table |
FNodes:TNTFSDiskNodes;
|
List of index nodes |
FAttribute:TNTFSDiskAttribute;
|
Attribute owning this index |
function GetNodesLock:TSynchronizerHandle;
|
|
function GetKeyLocal:TMutexHandle;
|
|
function GetNodeLocal:TMutexHandle;
|
|
function GetLoaded:Boolean;
|
|
procedure SetLoaded(AValue:Boolean);
|
|
function GetChanged:Boolean;
|
|
function GetUpCase:PNTFSUpCaseData;
|
|
function GetRootNode:TNTFSDiskNode;
|
|
function CreateNodes(ANew:Boolean):TNTFSDiskNodes;
|
|
function CompareKey(AEntry1,AEntry2:Pointer; ASize1,ASize2:Word):Integer;
|
|
function CompareBinary(AEntry1,AEntry2:Pointer; ASize1,ASize2:Word):Integer;
|
|
function CompareFileName(AEntry1,AEntry2:PWideChar; ASize1,ASize2:Word):Integer;
|
|
function CompareUnicode(AEntry1,AEntry2:PWideChar; ASize1,ASize2:Word):Integer;
|
|
function CompareLongWord(AEntry1,AEntry2:LongWord; ASize1,ASize2:Word):Integer;
|
|
function CompareSID(AEntry1,AEntry2:PSID; ASize1,ASize2:Word):Integer;
|
|
function CompareSecurityHash(AEntry1,AEntry2:PNTFSSecurityHashKeyData; ASize1,ASize2:Word):Integer;
|
|
function CompareGUID(AEntry1,AEntry2:PGUID; ASize1,ASize2:Word):Integer;
|
|
protected
| |
function GetEnd(AEntry:TBtreeObject):TBtreeObject; override;
|
|
function GetStart(AEntry:TBtreeObject):TBtreeObject; override;
|
|
function GetBlank(AEntry:TBtreeObject):TBtreeObject; override;
|
|
function GetMedian(AEntry:TBtreeObject):TBtreeObject; override;
|
|
function GetDropTest(AEntry:TBtreeObject; var ALeft:Boolean):TBtreeObject;
|
|
function GetDrop(AEntry:TBtreeObject; var ALeft:Boolean):TBtreeObject; override;
|
|
function GetMerge(AEntry:TBtreeObject):TBtreeObject; override;
|
|
function GetBorrow(AEntry:TBtreeObject):TBtreeObject; override;
|
|
function GetTarget(ADrop:TBtreeObject; ALeft:Boolean):TBtreeObject; override;
|
|
function PushNode(AEntry:TBtreeObject):Boolean; override;
|
|
function SplitNode(AEntry:TBtreeObject):Boolean; override;
|
|
function DropNode(AEntry,ADrop,ATarget:TBtreeObject; ALeft:Boolean):Boolean; override;
|
|
function DropNodeOld(AEntry,ADrop:TBtreeObject; ALeft:Boolean):Boolean; override;
|
|
function MergeNode(AEntry,AMerge:TBtreeObject):Boolean; override;
|
|
function BorrowEntry(AEntry,ABorrow:TBtreeObject):Boolean; override;
|
|
function SwapEntry(AEntry,ASwap:TBtreeObject;ALeft:Boolean):Boolean; override;
|
|
function SetParentEntry(AEntry,AParent:TBtreeObject):Boolean; override;
|
|
function DeleteBlank(ABlank:TBtreeObject):Boolean; override;
|
|
function AttachBlank(ABlank:TBtreeObject):Boolean; override;
|
|
function DetachBlank(ABlank:TBtreeObject):Boolean; override;
|
|
function AttachEntry(AEntry:TBtreeObject):Boolean; override;
|
|
function DetachEntry(AEntry:TBtreeObject):Boolean; override;
|
|
function RequirePush(AEntry:TBtreeObject):Boolean; override;
|
|
function RequireSplit(AEntry:TBtreeObject):Boolean; override;
|
|
function RequireDrop(AEntry:TBtreeObject):Boolean; override;
|
|
function RequireMerge(AEntry:TBtreeObject):Boolean; override;
|
|
function RequireBorrow(AEntry:TBtreeObject):Boolean; override;
|
|
public
| |
property Loaded:Boolean read GetLoaded write SetLoaded;
|
|
property Changed:Boolean read GetChanged;
|
|
property SectorSize:Word read FSectorSize write FSectorSize;
|
|
property VolumeVersion:Word read FVolumeVersion;
|
|
property IndexType:LongWord read FIndexType write FIndexType;
|
|
property CollateRule:LongWord read FCollateRule write FCollateRule;
|
|
property IndexRecordSize:LongWord read FIndexRecordSize write FIndexRecordSize;
|
|
property IndexCounterOffset:LongWord read FIndexCounterOffset write FIndexCounterOffset;
|
|
property ClustersPerIndex:LongWord read FClustersPerIndex write FClustersPerIndex;
|
|
property IndexsPerCluster:LongWord read FIndexsPerCluster write FIndexsPerCluster;
|
|
property IndexCounterShift:Word read FIndexCounterShift write FIndexCounterShift;
|
|
property IndexRecordShiftCount:Word read FIndexRecordShiftCount write FIndexRecordShiftCount;
|
|
property IndexRecordOffsetMask:Int64 read FIndexRecordOffsetMask write FIndexRecordOffsetMask;
|
|
property TotalIndexRecordCount:Int64 read FTotalIndexRecordCount write FTotalIndexRecordCount;
|
|
property LastFreeIndexRecord:Int64 read FLastFreeIndexRecord write FLastFreeIndexRecord;
|
|
property FreeIndexRecordCount:Int64 read FFreeIndexRecordCount write FFreeIndexRecordCount;
|
|
property CompareSecurityDescriptor:TNTFSCompareSecurityDescriptor read FCompareSecurityDescriptor write FCompareSecurityDescriptor;
|
|
property UpCase:TNTFSUpCase read FUpCase write FUpCase;
|
|
property Nodes:TNTFSDiskNodes read FNodes;
|
|
property Attribute:TNTFSDiskAttribute read FAttribute;
|
|
property RootNode:TNTFSDiskNode read GetRootNode;
|
|
function NodeCount:Integer;
|
|
function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; virtual;
|
|
function DestroyKey(AKey:TNTFSDiskKey):Boolean;
|
|
function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; virtual;
|
|
function NewKeyEx(AKey,AData,APadding:Pointer; AKeySize,ADataSize,APaddingSize:Word):TNTFSDiskKey; virtual;
|
|
function AddKey(AParent,AKey:TNTFSDiskKey):Boolean;
|
|
function InsertKey(AKey:TNTFSDiskKey):Boolean;
|
|
function RemoveKey(AKey:TNTFSDiskKey):Boolean;
|
|
function CreateNode(ANew:Boolean):TNTFSDiskNode;
|
|
function DestroyNode(ANode:TNTFSDiskNode):Boolean;
|
|
function NewNode(const ARecordNumber:Int64):TNTFSDiskNode;
|
|
function GetNode(const ARecordNumber:Int64):TNTFSDiskNode;
|
|
function DeleteNode(ANode:TNTFSDiskNode):Boolean;
|
|
function RemoveNode(ANode:TNTFSDiskNode):Boolean;
|
|
function UpdateNodes(AVersion:Word):Boolean; virtual;
|
|
function FindKey(AValue:Pointer; ASize:Word):TNTFSDiskKey; virtual;
|
|
function ReadRoot(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function WriteRoot(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function ReadKeys(AParent:TNTFSDiskKey; ANode:TNTFSDiskNode; ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function WriteKeys(AParent:TNTFSDiskKey; ANode:TNTFSDiskNode; ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function ReaderLock:Boolean;
|
|
function ReaderUnlock:Boolean;
|
|
function WriterLock:Boolean;
|
|
function WriterUnlock:Boolean;
|
|
NTFS data index
TNTFSDataIndex = class(TNTFSDiskIndex)
private
| |
function CompareSecurityDescriptor(AHash1,AHash2,ASecurityId:LongWord; ADescriptor:Pointer; ASize:Word):Integer;
|
|
function Find(AValue:Pointer; ASize:Word; ACurrent:TNTFSDataKey):TNTFSDataKey;
|
|
function FindEx(AValue:Pointer; ASize:Word; AHash:LongWord; ACurrent:TNTFSDataKey):TNTFSDataKey;
|
|
protected
| |
function CreateBlank:TBtreeObject; override;
|
|
function Compare(AEntry1,AEntry2:TBtreeObject):Integer; override;
|
|
public
| |
function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; override;
|
|
function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; override;
|
|
function GetKeyBySID(ASID:PSID):TNTFSDiskKey;
|
|
function GetKeyByOwner(AOwner:LongWord):TNTFSDiskKey;
|
|
function GetKeyByObjectId(const AObjectId:TGUID):TNTFSDiskKey;
|
|
function GetKeyBySecurity(ASecurity:TNTFSSecurity):TNTFSDiskKey;
|
|
function GetKeyByReparse(AReparseTag:LongWord; const AFileReference:Int64):TNTFSDiskKey;
|
|
function FindKey(AValue:Pointer;ASize:Word):TNTFSDiskKey; override;
|
|
NTFS padded index
TNTFSPaddedIndex = class(TNTFSDataIndex)
| Note: A DataIndex that allows a block of Padding to be specified. | |
protected
| |
function CreateBlank:TBtreeObject; override;
|
|
private
| |
function CreateBlank:TBtreeObject; override;
|
|
public
| |
function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; override;
|
|
function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; override;
|
|
function NewKeyEx(AKey,AData,APadding:Pointer; AKeySize,ADataSize,APaddingSize:Word):TNTFSDiskKey; override;
|
|
NTFS attribute index
TNTFSAttributeIndex = class(TNTFSDiskIndex)
private
| |
function Find(AValue:Pointer; ASize:Word; ACurrent:TNTFSAttributeKey):TNTFSAttributeKey;
|
|
protected
| |
function CreateBlank:TBtreeObject; override;
|
|
function Compare(AEntry1,AEntry2:TBtreeObject):Integer; override;
|
|
public
| |
function CreateKey(ANode:TNTFSDiskNode; ABlank:Boolean):TNTFSDiskKey; override;
|
|
function NewKey(AKey,AData:Pointer; AKeySize,ADataSize:Word):TNTFSDiskKey; override;
|
|
function GetKeyByFileName(const AFileName:String):TNTFSDiskKey;
|
|
function NewKeyByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSDiskKey;
|
|
function GetKeyByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSDiskKey;
|
|
function FindKey(AValue:Pointer; ASize:Word):TNTFSDiskKey; override;
|
|
NTFS disk nodes
TNTFSDiskNodes = class(TFileSysListEx)
constructor Create(ANodeLocal:TMutexHandle; ALock:TSynchronizerHandle);
|
|
destructor Destroy; override;
|
|
private
| |
FNodeLocal:TMutexHandle;
|
|
function GetModified:Boolean;
|
|
procedure SetModified(AValue:Boolean);
|
|
public
| |
property Modified:Boolean read GetModified write SetModified;
|
|
function TotalSize:LongWord;
|
|
function NodeCount:LongWord;
|
|
NTFS disk node
TNTFSDiskNode = class(TListObject)
| Note: Represents an INDX record header. | |
constructor Create(ALocalLock:TMutexHandle; AIndex:TNTFSDiskIndex);
|
|
destructor Destroy; override;
|
|
private
| |
FLocalLock:TMutexHandle;
|
|
FStatus:LongWord;
|
|
FIndexFlags:Word;
|
Flags (See Consts) |
FIndexSize:LongWord;
|
Total size of the Index Entries |
FIndexAllocated:LongWord;
|
Allocated size of the Index Entries |
FEntryOffset:LongWord;
|
Offset to first Index Entry |
FRecordNumber:Int64;
|
Number of this INDX record in the Index Allocation |
FUpdateSequenceOffset:Word;
|
Offset to the Update Sequence Record |
FUpdateSequenceLength:Word;
|
Size in words of the Update Sequence Record |
FUpdateSequenceNumber:Word;
|
Update Sequence Number |
FLogFileSequenceNumber:Int64;
|
LogFile sequence number |
FIndex:TNTFSDiskIndex;
|
Index owning this node |
FBlank:TNTFSDiskKey;
|
Blank key of this node (Blank keys do not move) |
function AcquireLock:Boolean;
|
|
function ReleaseLock:Boolean;
|
|
function GetAdded:Boolean;
|
|
procedure SetAdded(AValue:Boolean);
|
|
function GetDeleted:Boolean;
|
|
procedure SetDeleted(AValue:Boolean);
|
|
function GetChanged:Boolean;
|
|
procedure SetChanged(AValue:Boolean);
|
|
function GetModified:Boolean;
|
|
procedure SetModified(AValue:Boolean);
|
|
function GetIsRoot:Boolean;
|
|
function GetHasSubNodes:Boolean;
|
|
procedure SetHasSubNodes(AValue:Boolean);
|
|
function GetStart:TNTFSDiskKey;
|
|
public
| |
property Added:Boolean read GetAdded write SetAdded;
|
Index record to be allocated |
property Deleted:Boolean read GetDeleted write SetDeleted;
|
Index record to be deallocated |
property Changed:Boolean read GetChanged write SetChanged;
|
Index record to be updated |
property Modified:Boolean read GetModified write SetModified;
|
Index record has been added, deleted or changed |
property IsRoot:Boolean read GetIsRoot;
|
|
property HasSubNodes:Boolean read GetHasSubNodes write SetHasSubNodes;
|
|
property IndexFlags:Word read FIndexFlags write FIndexFlags;
|
|
property IndexSize:LongWord read FIndexSize write FIndexSize;
|
|
property IndexAllocated:LongWord read FIndexAllocated write FIndexAllocated;
|
|
property EntryOffset:LongWord read FEntryOffset write FEntryOffset;
|
|
property RecordNumber:Int64 read FRecordNumber write FRecordNumber;
|
|
property UpdateSequenceOffset:Word read FUpdateSequenceOffset write FUpdateSequenceOffset;
|
|
property UpdateSequenceLength:Word read FUpdateSequenceLength write FUpdateSequenceLength;
|
|
property UpdateSequenceNumber:Word read FUpdateSequenceNumber write FUpdateSequenceNumber;
|
|
property LogFileSequenceNumber:Int64 read FLogFileSequenceNumber write FLogFileSequenceNumber;
|
|
property Index:TNTFSDiskIndex read FIndex;
|
|
property Blank:TNTFSDiskKey read FBlank write FBlank;
|
|
property Start:TNTFSDiskKey read GetStart;
|
|
function KeyCount:Integer;
|
|
function IndexFree:LongWord;
|
|
function UpdateKeys(AVersion:Word):Boolean; virtual;
|
|
function CalculatedSize(AVersion:Word):LongWord;
|
|
function CalculatedOffset(AVersion:Word):LongWord;
|
|
function CalculatedAllocated(AVersion:Word):LongWord;
|
|
function CalculatedSequenceOffset(AVersion:Word):Word;
|
|
function CalculatedSequenceLength(ASectorSize:Word):Word;
|
|
function WriteEmpty(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word; var AUpdateSequenceOffset,AUpdateSequenceLength:Word):Boolean;
|
|
function ReadRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function WriteRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function ReadHeader(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function WriteHeader(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
NTFS disk key
TNTFSDiskKey = class(TBtreeObject)
| Note: Represents an INDX record entry. | |
constructor Create(ALocalLock:TMutexHandle);
|
|
destructor Destroy; override;
|
|
private
| |
FLocalLock:TMutexHandle;
|
|
FStatus:LongWord;
|
|
FKey:Pointer;
|
|
FEntryFlags:Word;
|
Flags (See Consts) |
FEntrySize:Word;
|
Length of the index entry |
FKeySize:Word;
|
Length of the key entry |
FSubNodeNumber:Int64;
|
Number of the sub-node in the index allocation attribute |
FNode:TNTFSDiskNode;
|
Index node of this key |
function AcquireLock:Boolean;
|
|
function ReleaseLock:Boolean;
|
|
function GetChanged:Boolean;
|
|
procedure SetChanged(AValue:Boolean);
|
|
function GetHasSubNode:Boolean;
|
|
procedure SetHasSubNode(AValue:Boolean);
|
|
function GetIsLastNode:Boolean;
|
|
procedure SetIsLastNode(AValue:Boolean);
|
|
procedure SetKeySize(ASize:Word); virtual;
|
|
procedure SetSubNodeNumber(const ANodeNumber:Int64);
|
|
procedure SetNode(ANode:TNTFSDiskNode);
|
|
public
| |
property Changed:Boolean read GetChanged write SetChanged;
|
Index record to be updated |
property HasSubNode:Boolean read GetHasSubNode write SetHasSubNode;
|
|
property IsLastNode:Boolean read GetIsLastNode write SetIsLastNode;
|
|
property Key:Pointer read FKey;
|
|
property EntryFlags:Word read FEntryFlags write FEntryFlags;
|
|
property EntrySize:Word read FEntrySize write FEntrySize;
|
|
property KeySize:Word read FKeySize write SetKeySize;
|
|
property SubNodeNumber:Int64 read FSubNodeNumber write SetSubNodeNumber;
|
|
property Node:TNTFSDiskNode read FNode write SetNode;
|
|
function CalculatedSize(AVersion:Word):Word; virtual;
|
|
function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;
|
|
function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;
|
|
NTFS data key
TNTFSDataKey = class(TNTFSDiskKey)
constructor Create(ALocalLock:TMutexHandle);
|
|
destructor Destroy; override;
|
|
private
| |
FData:Pointer;
|
|
FDataSize:Word;
|
Size of the data (Only valid when the last entry flag is not set) |
procedure SetKeySize(ASize:Word); override;
|
|
procedure SetData(AData:Pointer);
|
|
procedure SetDataSize(ASize:Word);
|
|
public
| |
property Data:Pointer read FData write SetData;
|
|
property DataSize:Word read FDataSize write SetDataSize;
|
|
function DataOffset:Word;
|
Offset to the data (Only valid when the last entry flag is not set) |
function CalculatedSize(AVersion:Word):Word; override;
|
|
function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;
|
|
function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;
|
|
NTFS padded key
TNTFSPaddedKey = class(TNTFSDataKey)
constructor Create(ALocalLock:TMutexHandle);
|
|
destructor Destroy; override;
|
|
private
| |
FPadding:Pointer;
|
|
FPaddingSize:Word;
|
|
procedure SetPadding(APadding:Pointer);
|
|
procedure SetPaddingSize(ASize:Word);
|
|
public
| |
property Padding:Pointer read FPadding write SetPadding;
|
|
property PaddingSize:Word read FPaddingSize write SetPaddingSize;
|
|
function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;
|
|
function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;
|
|
NTFS attribute key
TNTFSAttributeKey = class(TNTFSDiskKey)
constructor Create(ALocalLock:TMutexHandle);
|
|
destructor Destroy; override;
|
|
private
| |
FFileReference:Int64;
|
File reference (Only valid when the last entry flag is not set) |
FAttribute:TNTFSDiskAttribute;
|
Indexed attribute of this key |
function GetInvalid:Boolean;
|
|
procedure SetInvalid(AValue:Boolean);
|
|
procedure SetKeySize(ASize:Word); override;
|
|
procedure SetAttribute(AAttribute:TNTFSDiskAttribute);
|
|
public
| |
property Invalid:Boolean read GetInvalid write SetInvalid;
|
Key points to invalid file record or attribute |
property FileReference:Int64 read FFileReference write FFileReference;
|
|
property Attribute:TNTFSDiskAttribute read FAttribute write SetAttribute;
|
|
function UpdateKey:Boolean;
|
|
function RecordNumber:Int64;
|
|
function CalculatedSize(AVersion:Word):Word; override;
|
|
function ReadKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;
|
|
function WriteKey(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;
|
|
NTFS disk runs
TNTFSDiskRuns = class(TFileSysListEx)
constructor Create(ARunLocal:TMutexHandle; ALock:TSynchronizerHandle);
|
|
destructor Destroy; override;
|
|
private
| |
FRunLocal:TMutexHandle;
|
|
FRecent:TNTFSDiskRun;
|
|
FRecentVCN:Int64;
|
|
function GetStart:TNTFSDiskRun;
|
|
function GetFinal:TNTFSDiskRun;
|
|
public
| |
property Recent:TNTFSDiskRun read FRecent write FRecent;
|
|
property RecentVCN:Int64 read FRecentVCN write FRecentVCN;
|
|
function SparseCount:Int64;
|
Count of sparse runs in list |
function ClusterCount:Int64;
|
Count of normal runs in list |
function AllocatedCount:Int64;
|
Count of allocated runs in list |
function TotalSize:LongWord;
|
Total size of the encoded data runs |
function RunCount:LongWord;
|
|
NTFS disk run
TNTFSDiskRun = class(TListObject)
constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);
|
|
destructor Destroy; override;
|
|
private
| |
FLocalLock:TMutexHandle;
|
|
FStart:Int64;
|
Run start logical cluster |
FOffset:Int64;
|
Run start cluster offset |
FLength:Int64;
|
Run length in clusters |
FAttribute:TNTFSDiskAttribute;
|
Attribute owning this run |
function AcquireLock:Boolean;
|
|
function ReleaseLock:Boolean;
|
|
function GetIsLast:Boolean;
|
|
function GetIsSparse:Boolean;
|
|
function GetOffsetSize:Byte;
|
|
function GetLengthSize:Byte;
|
|
procedure SetStart(const AStart:Int64);
|
|
procedure SetOffset(const AOffset:Int64);
|
|
function GetSuccessor:TNTFSDiskRun;
|
|
function GetPredecessor:TNTFSDiskRun;
|
|
public
| |
property IsLast:Boolean read GetIsLast;
|
|
property IsSparse:Boolean read GetIsSparse;
|
|
property Start:Int64 read FStart write SetStart;
|
|
property Offset:Int64 read FOffset write SetOffset;
|
|
property Length:Int64 read FLength write FLength;
|
|
property Attribute:TNTFSDiskAttribute read FAttribute;
|
|
function RunSize:LongWord;
|
Size of the encoded data run |
function UpdateRun:Boolean;
|
|
function ReadRun(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;
|
|
function WriteRun(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;
|
|
NTFS disk items
TNTFSDiskItems = class(TFileSysListEx)
constructor Create(AItemLocal:TMutexHandle; ALock:TSynchronizerHandle);
|
|
destructor Destroy; override;
|
|
private
| |
FItemLocal:TMutexHandle;
|
|
FStatus:LongWord;
|
|
function GetLoaded:Boolean;
|
|
procedure SetLoaded(AValue:Boolean);
|
|
function GetPrevious(AItem:TNTFSDiskItem):TNTFSDiskItem;
|
|
public
| |
property Loaded:Boolean read GetLoaded write SetLoaded;
|
|
function TotalSize:Int64;
|
|
function ItemCount:LongWord;
|
|
NTFS disk item
TNTFSDiskItem = class(TListObject)
| Note: Data of attribute $ATTRIBUTE_LIST | |
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskAttribute);
|
|
destructor Destroy; override;
|
|
private
| |
FLocalLock:TMutexHandle;
|
|
FStatus:LongWord;
|
|
FItemSize:Word;
|
Record length |
FStartVCN:Int64;
|
Starting VCN if non resident |
FFileReference:Int64;
|
File Reference of the attribute |
FAttributeType:LongWord;
|
Attribute Type |
FAttributeId:Word;
|
Attribute Id |
FAttributeName:String;
|
Name in Unicode (if NameLength > 0) |
FParent:TNTFSDiskAttribute;
|
Attribute list owning this item |
FAttribute:TNTFSDiskAttribute;
|
Attribute pointed to by this item |
FAttributeHash:LongWord;
|
|
function AcquireLock:Boolean;
|
|
function ReleaseLock:Boolean;
|
|
function GetInvalid:Boolean;
|
|
procedure SetInvalid(AValue:Boolean);
|
|
function GetAttributeName:String;
|
|
procedure SetAttributeName(const AAttributeName:String);
|
|
procedure SetAttribute(AAttribute:TNTFSDiskAttribute);
|
|
function Compare(AItem:TNTFSDiskItem):Integer; virtual;
|
|
public
| |
property Invalid:Boolean read GetInvalid write SetInvalid;
|
Item points to invalid file record or attribute |
property ItemSize:Word read FItemSize write FItemSize;
|
|
property StartVCN:Int64 read FStartVCN write FStartVCN;
|
|
property FileReference:Int64 read FFileReference write FFileReference;
|
|
property AttributeType:LongWord read FAttributeType write FAttributeType;
|
|
property AttributeId:Word read FAttributeId write FAttributeId;
|
|
property AttributeName:String read GetAttributeName write SetAttributeName;
|
|
property Parent:TNTFSDiskAttribute read FParent;
|
|
property Attribute:TNTFSDiskAttribute read FAttribute write SetAttribute;
|
|
property AttributeHash:LongWord read FAttributeHash;
|
|
function RecordNumber:Int64;
|
|
function AttributeNameSize:Word;
|
|
function AttributeNameLength:Byte;
|
Name length |
function AttributeNameOffset:Byte;
|
Offset to Name |
function UpdateItem:Boolean;
|
|
function CalculatedSize(AVersion:Word):Word;
|
|
function ReadItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function WriteItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
NTFS disk attributes
TNTFSDiskAttributes = class(TFileSysListEx)
constructor Create(AAttributeLocal:TMutexHandle; ALock:TSynchronizerHandle);
|
|
destructor Destroy; override;
|
|
private
| |
FAttributeLocal:TMutexHandle;
|
|
function GetPrevious(AAttribute:TNTFSDiskAttribute):TNTFSDiskAttribute;
|
|
public
| |
function TotalSize:LongWord;
|
|
function AttributeCount:LongWord;
|
|
NTFS disk attribute
TNTFSDiskAttribute = class(TListObject)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
private
| |
FLocalLock:TMutexHandle;
|
|
protected
| |
FStatus:LongWord;
|
|
FData:Pointer;
|
Only applicable if attribute is resident |
FAttributeType:LongWord;
|
Attribute Type (e.g. 0x80, 0xA0) |
FAttributeSize:LongWord;
|
Length of the Attribute (including header) |
FAttributeFlags:Word;
|
Attribute Flags |
FAttributeId:Word;
|
Attribute Id |
FAttributeName:String;
|
Attribute Name |
FNonResident:Byte;
|
Non-resident flag |
FIndexed:Byte;
|
Indexed flag |
FDataSize:LongWord;
|
Length of the Attribute Data |
FStartVCN:Int64;
|
Starting VCN |
FLastVCN:Int64;
|
Last VCN |
FStreamSize:Int64;
|
Real size of the attribute |
FStreamUsed:Int64;
|
The actual Allocated size of the attribute (Only present when compressed and only in the first instance) |
FStreamAllocated:Int64;
|
Allocated size of the attribute |
FInitializedSize:Int64;
|
Initialized data size of the stream (Portion which has been Written) |
FCompressionUnit:Word;
|
Compression Unit Size |
FRuns:TNTFSDiskRuns;
|
List of runs of this attribute |
FItems:TNTFSDiskItems;
|
List of items of this attribute |
FIndex:TNTFSDiskIndex;
|
Index of this attribute if applicable |
FParent:TNTFSDiskRecord;
|
Record owning this attribute |
FAttributeHash:LongWord;
|
|
function AcquireLock:Boolean;
|
|
function ReleaseLock:Boolean;
|
|
function GetRunsLock:TSynchronizerHandle;
|
|
function GetItemsLock:TSynchronizerHandle;
|
|
function GetIndexLock:TSynchronizerHandle;
|
|
function GetExtendedsLock:TSynchronizerHandle;
|
|
function GetRunLocal:TMutexHandle;
|
|
function GetItemLocal:TMutexHandle;
|
|
function GetKeyLocal:TMutexHandle;
|
|
function GetExtendedLocal:TMutexHandle;
|
|
function GetUpdating:Boolean;
|
|
procedure SetUpdating(AValue:Boolean);
|
|
function GetIsFixed:Boolean;
|
|
function GetIsSingle:Boolean;
|
|
function GetIsUnlisted:Boolean;
|
|
function GetIsUnmovable:Boolean;
|
|
function GetIsManaged:Boolean;
|
|
function GetIsSparse:Boolean;
|
|
procedure SetIsSparse(AValue:Boolean);
|
|
function GetIsEncrypted:Boolean;
|
|
procedure SetIsEncrypted(AValue:Boolean);
|
|
function GetIsCompressed:Boolean;
|
|
procedure SetIsCompressed(AValue:Boolean);
|
|
function GetAttributeName:String;
|
|
procedure SetAttributeName(const AAttributeName:String);
|
|
function GetDataSize:LongWord; virtual;
|
|
procedure SetDataSize(AValue:LongWord); virtual;
|
|
function Compare(AAttribute:TNTFSDiskAttribute):Integer; virtual;
|
|
function CreateRuns(ANew:Boolean):TNTFSDiskRuns;
|
|
function CreateItems(ANew:Boolean):TNTFSDiskItems;
|
|
function GetRecord(AInstance:Integer):TNTFSDiskRecord;
|
|
function GetAttribute(AType:LongWord; const AName:String; AInstance:Integer):TNTFSDiskAttribute;
|
|
public
| |
property Updating:Boolean read GetUpdating write SetUpdating;
|
|
property IsFixed:Boolean read GetIsFixed;
|
|
property IsSingle:Boolean read GetIsSingle;
|
|
property IsUnlisted:Boolean read GetIsUnlisted;
|
|
property IsUnmovable:Boolean read GetIsUnmovable;
|
|
property IsManaged:Boolean read GetIsManaged;
|
|
property IsSparse:Boolean read GetIsSparse write SetIsSparse;
|
|
property IsEncrypted:Boolean read GetIsEncrypted write SetIsEncrypted;
|
|
property IsCompressed:Boolean read GetIsCompressed write SetIsCompressed;
|
|
property Data:Pointer read FData;
|
|
property AttributeType:LongWord read FAttributeType;
|
|
property AttributeSize:LongWord read FAttributeSize write FAttributeSize;
|
|
property AttributeFlags:Word read FAttributeFlags write FAttributeFlags;
|
|
property AttributeId:Word read FAttributeId write FAttributeId;
|
|
property AttributeName:String read GetAttributeName write SetAttributeName;
|
|
property NonResident:Byte read FNonResident write FNonResident;
|
|
property Indexed:Byte read FIndexed write FIndexed;
|
|
property DataSize:LongWord read GetDataSize write SetDataSize;
|
|
property StartVCN:Int64 read FStartVCN write FStartVCN;
|
|
property LastVCN:Int64 read FLastVCN write FLastVCN;
|
|
property StreamSize:Int64 read FStreamSize write FStreamSize;
|
|
property StreamUsed:Int64 read FStreamUsed write FStreamUsed;
|
|
property StreamAllocated:Int64 read FStreamAllocated write FStreamAllocated;
|
|
property InitializedSize:Int64 read FInitializedSize write FInitializedSize;
|
|
property CompressionUnit:Word read FCompressionUnit write FCompressionUnit;
|
|
property Runs:TNTFSDiskRuns read FRuns;
|
|
property Items:TNTFSDiskItems read FItems;
|
|
property Index:TNTFSDiskIndex read FIndex;
|
|
property Parent:TNTFSDiskRecord read FParent write FParent;
|
|
property AttributeHash:LongWord read FAttributeHash;
|
|
function GetRunCount(const AVCN:Int64; var AStartVCN,ACount:Int64):Boolean;
|
|
function GetRunLength(const AVCN:Int64; var AStartVCN,ALength:Int64):Boolean;
|
|
function GetRunByUnit(const AUnit:Int64; var AStartVCN:Int64):TNTFSDiskRun;
|
|
function GetRunByCluster(const ACluster:Int64; var AStartVCN:Int64):TNTFSDiskRun;
|
|
function CreateRun(ANew:Boolean):TNTFSDiskRun;
|
|
function DestroyRun(ARun:TNTFSDiskRun):Boolean;
|
|
function NewRun(const AStart,ALength:Int64):TNTFSDiskRun;
|
|
function InsertRun(APrev:TNTFSDiskRun; const AStart,ALength:Int64):TNTFSDiskRun;
|
|
function GetRun(const AVCN:Int64; var AStartVCN:Int64):TNTFSDiskRun;
|
|
function GetRunOld(const AVCN:Int64; var AStartVCN:Int64):TNTFSDiskRun;
|
|
function MergeRun(ARun:TNTFSDiskRun):Boolean;
|
|
function SplitRun(ARun:TNTFSDiskRun; const ALength:Int64):Boolean;
|
|
function RemoveRun(ARun:TNTFSDiskRun):Boolean;
|
|
function MoveRun(ADest:TNTFSDiskAttribute; ARun:TNTFSDiskRun):Boolean;
|
|
function GetItemByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSDiskItem;
|
|
function CreateItem(ANew:Boolean):TNTFSDiskItem;
|
|
function DestroyItem(AItem:TNTFSDiskItem):Boolean;
|
|
function NewItem(AAttribute:TNTFSDiskAttribute):TNTFSDiskItem;
|
|
function GetItem(AType:LongWord; const AName:String; AInstance:Integer):TNTFSDiskItem;
|
|
function RemoveItem(AItem:TNTFSDiskItem):Boolean;
|
|
function MoveItem(AItem:TNTFSDiskItem; AAttribute:TNTFSDiskAttribute):Boolean;
|
|
function RenameItem(AItem:TNTFSDiskItem; AAttribute:TNTFSDiskAttribute):Boolean;
|
|
function CreateIndex(AVersion,ASector:Word):Boolean; virtual;
|
|
function NewIndex(AVersion,ASector:Word; AType,ARule,ASize,AOffset:LongWord):Boolean; virtual;
|
|
function RecordNumber:Int64;
|
|
function FileReference:Int64;
|
|
function BaseReference:Int64;
|
|
function RunOffset:Word;
|
Offset to the Data Run |
function DataOffset:Word;
|
Offset to the Attribute Data |
function AttributeNameSize:Word;
|
|
function AttributeNameLength:Byte;
|
Name length |
function AttributeNameOffset:Word;
|
Offset to the Name |
function RunCount:LongWord;
|
|
function ItemCount:LongWord;
|
|
function CalculatedSize(AVersion:Word):LongWord; virtual;
|
|
function CalculatedDataSize(AVersion:Word):LongWord; virtual;
|
|
function CalculatedStreamSize(AVersion:Word):Int64; virtual;
|
|
function CalculatedStreamUsed(AVersion:Word):Int64; virtual;
|
|
function CoalesceRun(ARun:TNTFSDiskRun):Boolean;
|
|
function UpdateRun(ARun:TNTFSDiskRun):Boolean;
|
|
function UpdateKey(AKey:TNTFSDiskKey):Boolean; virtual;
|
|
function UpdateItem(AItem:TNTFSDiskItem):Boolean; virtual;
|
|
function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; virtual;
|
|
function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; virtual;
|
|
function ReadRuns(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;
|
|
function WriteRuns(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean;
|
|
function ReadItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function WriteItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; virtual;
|
|
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; virtual;
|
|
function ReadAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;
|
|
function WriteAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;
|
|
NTFS standard information attribute
TNTFSStandardInformationAttribute = class(TNTFSDiskAttribute)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
private
| |
FCreateTime:TFileTime;
|
File Creation |
FWriteTime:TFileTime;
|
File Altered |
FChangeTime:TFileTime;
|
MFT Changed |
FAccessTime:TFileTime;
|
File Read |
FAttributes:LongWord;
|
DOS File Permissions |
FMaxVersions:LongWord;
|
Maximum Number of Versions |
FVersionNo:LongWord;
|
Version Number |
FClassId:LongWord;
|
Class Id |
FOwnerId:LongWord;
|
Owner Id |
FSecurityId:LongWord;
|
Security Id |
FQuotaCharge:Int64;
|
Quota Charged |
FUpdateSequenceNumber:Int64;
|
Update Sequence Number |
public
| |
property CreateTime:TFileTime read FCreateTime write FCreateTime;
|
|
property WriteTime:TFileTime read FWriteTime write FWriteTime;
|
|
property ChangeTime:TFileTime read FChangeTime write FChangeTime;
|
|
property AccessTime:TFileTime read FAccessTime write FAccessTime;
|
|
property Attributes:LongWord read FAttributes write FAttributes;
|
|
property MaxVersions:LongWord read FMaxVersions write FMaxVersions;
|
|
property VersionNo:LongWord read FVersionNo write FVersionNo;
|
|
property ClassId:LongWord read FClassId write FClassId;
|
|
property OwnerId:LongWord read FOwnerId write FOwnerId;
|
|
property SecurityId:LongWord read FSecurityId write FSecurityId;
|
|
property QuotaCharge:Int64 read FQuotaCharge write FQuotaCharge;
|
|
property UpdateSequenceNumber:Int64 read FUpdateSequenceNumber write FUpdateSequenceNumber;
|
|
function CalculatedStreamSize(AVersion:Word):Int64; override;
|
|
function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; override;
|
|
function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; override;
|
|
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
NTFS attribute list
TNTFSAttributeListAttribute = class(TNTFSDiskAttribute)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
public
| |
function CalculatedStreamSize(AVersion:Word):Int64; override;
|
|
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
NTFS file name attribute
TNTFSFileNameAttribute = class(TNTFSDiskAttribute)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
private
| |
FParentReference:Int64;
|
File reference to the parent directory |
FCreateTime:TFileTime;
|
C Time - File Creation
Note: These fields are only updated when the filename is changed (See Standard Information instead) |
FWriteTime:TFileTime;
|
A Time - File Altered
Note: These fields are only updated when the filename is changed (See Standard Information instead) |
FChangeTime:TFileTime;
|
M Time - MFT Changed
Note: These fields are only updated when the filename is changed (See Standard Information instead) |
FAccessTime:TFileTime;
|
R Time - File Read
Note: These fields are only updated when the filename is changed (See Standard Information instead) |
FFileAllocated:Int64;
|
Allocated size of the file (As for CreateTime/WriteTime/ChangeTime etc) |
FFileSize:Int64;
|
Real size of the file (As for CreateTime/WriteTime/ChangeTime etc) |
FFileFlags:LongWord;
|
Flags, e.g. Directory, compressed, hidden (As for CreateTime/WriteTime/ChangeTime etc) |
FReparseTag:LongWord;
|
Used by EAs and Reparse |
FNameSpace:Byte;
|
Filename namespace |
FFileName:String;
|
File name |
FFileHash:LongWord;
|
|
function GetFileName:String;
|
|
procedure SetFileName(const AFileName:String);
|
|
public
| |
property ParentReference:Int64 read FParentReference write FParentReference;
|
|
property CreateTime:TFileTime read FCreateTime write FCreateTime;
|
|
property WriteTime:TFileTime read FWriteTime write FWriteTime;
|
|
property ChangeTime:TFileTime read FChangeTime write FChangeTime;
|
|
property AccessTime:TFileTime read FAccessTime write FAccessTime;
|
|
property FileAllocated:Int64 read FFileAllocated write FFileAllocated;
|
|
property FileSize:Int64 read FFileSize write FFileSize;
|
|
property FileFlags:LongWord read FFileFlags write FFileFlags;
|
|
property ReparseTag:LongWord read FReparseTag write FReparseTag;
|
|
property NameSpace:Byte read FNameSpace write FNameSpace;
|
|
property FileName:String read GetFileName write SetFileName;
|
|
property FileHash:LongWord read FFileHash;
|
|
function FileNameSize:Word;
|
|
function FileNameLength:Byte;
|
Filename length in characters |
function ParentRecord:Int64;
|
|
function CalculatedStreamSize(AVersion:Word):Int64; override;
|
|
function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; override;
|
|
function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; override;
|
|
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
NTFS object Id attribute
TNTFSObjectIdAttribute = class(TNTFSDiskAttribute)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
private
| |
FObjectId:TGUID;
|
GUID Object Id Unique Id assigned to file |
FBirthVolumeId:TGUID;
|
GUID Birth Volume Id Volume where file was created |
FBirthObjectId:TGUID;
|
GUID Birth Object Id Original Object Id of file |
FDomainId:TGUID;
|
GUID Domain Id Domain in which object was created |
public
| |
property ObjectId:TGUID read FObjectId write FObjectId;
|
|
property BirthVolumeId:TGUID read FBirthVolumeId write FBirthVolumeId;
|
|
property BirthObjectId:TGUID read FBirthObjectId write FBirthObjectId;
|
|
property DomainId:TGUID read FDomainId write FDomainId;
|
|
function CalculatedStreamSize(AVersion:Word):Int64; override;
|
|
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
NTFS volume version attribute
TNTFSVolumeVersionAttribute = class(TNTFSDiskAttribute)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
protected
| |
procedure SetDataSize(AValue:LongWord); override;
|
|
NTFS security descriptor attribute
TNTFSSecurityDescriptorAttribute = class(TNTFSDiskAttribute)
| Note: This is the same structure that is used for all security in Windows (File/Kernel/Registry etc). See TSecurityDescriptor and associated values in Security unit for more information. | |
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
private
| |
FSecurity:TNTFSSecurity;
|
|
public
| |
property Security:TNTFSSecurity read FSecurity;
|
|
function CreateSecurity:Boolean;
|
|
function NewSecurity(ASecurity:TNTFSSecurity):Boolean;
|
|
function CalculatedStreamSize(AVersion:Word):Int64; override;
|
|
function ReadSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function WriteSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
NTFS volume name attribute
TNTFSVolumeNameAttribute = class(TNTFSDiskAttribute)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
private
| |
FVolumeName:String;
|
Volume name |
function GetVolumeName:String;
|
|
procedure SetVolumeName(const AVolumeName:String);
|
|
public
| |
property VolumeName:String read GetVolumeName write SetVolumeName;
|
|
function CalculatedStreamSize(AVersion:Word):Int64; override;
|
|
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
NTFS volume information attribute
TNTFSVolumeInformationAttribute = class(TNTFSDiskAttribute)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
private
| |
FMajorVersion:Byte;
|
Major version number |
FMinorVersion:Byte;
|
Minor version number |
FVolumeFlags:Word;
|
Flags |
public
| |
property MajorVersion:Byte read FMajorVersion write FMajorVersion;
|
|
property MinorVersion:Byte read FMinorVersion write FMinorVersion;
|
|
property VolumeFlags:Word read FVolumeFlags write FVolumeFlags;
|
|
function CalculatedStreamSize(AVersion:Word):Int64; override;
|
|
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
NTFS data attribute
TNTFSDataAttribute = class(TNTFSDiskAttribute)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
protected
| |
procedure SetDataSize(AValue:LongWord); override;
|
|
public
| |
function UpdateEntry(AEntry:TNTFSDiskEntry):Boolean; override;
|
|
function UpdateAttribute(AEntry:TNTFSDiskEntry):Boolean; override;
|
|
NTFS index root attribute
TNTFSIndexRootAttribute = class(TNTFSDiskAttribute)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
private
| |
FIndexType:LongWord;
|
Attribute Type |
FCollateRule:LongWord;
|
Collation Rule |
FIndexRecordSize:LongWord;
|
Size of Index Allocation Entry (bytes) |
FIndexCounterOffset:LongWord;
|
Index Record Number increment |
public
| |
property IndexType:LongWord read FIndexType write FIndexType;
|
|
property CollateRule:LongWord read FCollateRule write FCollateRule;
|
|
property IndexRecordSize:LongWord read FIndexRecordSize write FIndexRecordSize;
|
|
property IndexCounterOffset:LongWord read FIndexCounterOffset write FIndexCounterOffset;
|
|
function CreateIndex(AVersion,ASector:Word):Boolean; override;
|
|
function NewIndex(AVersion,ASector:Word; AType,ARule,ASize,AOffset:LongWord):Boolean; override;
|
|
function CalculatedStreamSize(AVersion:Word):Int64; override;
|
|
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
NTFS index allocation attribute
TNTFSIndexAllocationAttribute = class(TNTFSDiskAttribute)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
protected
| |
procedure SetDataSize(AValue:LongWord); override;
|
|
NTFS bitmap attribute
TNTFSBitmapAttribute = class(TNTFSDiskAttribute)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
private
| |
FBitmap:Pointer;
|
|
FBitmapSize:LongWord;
|
|
protected
| |
procedure SetDataSize(AValue:LongWord); override;
|
|
procedure SetBitmapSize(AValue:LongWord);
|
|
public
| |
property Bitmap:Pointer read FBitmap;
|
|
property BitmapSize:LongWord read FBitmapSize write SetBitmapSize;
|
|
function CalculatedStreamSize(AVersion:Word):Int64; override;
|
|
NTFS reparse point attribute
TNTFSReparsePointAttribute = class(TNTFSDiskAttribute)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
private
| |
FReparseTag:LongWord;
|
Reparse Type (and Flags) |
FReparseSize:Word;
|
Reparse Data Length |
FReparseGUID:TGUID;
|
Reparse GUID |
FReparse:TNTFSReparse;
|
|
function GetIsAlias:Boolean;
|
|
procedure SetIsAlias(AValue:Boolean);
|
|
function GetIsHighLatency:Boolean;
|
|
procedure SetIsHighLatency(AValue:Boolean);
|
|
function GetIsMicrosoft:Boolean;
|
|
procedure SetIsMicrosoft(AValue:Boolean);
|
|
public
| |
property IsAlias:Boolean read GetIsAlias write SetIsAlias;
|
|
property IsHighLatency:Boolean read GetIsHighLatency write SetIsHighLatency;
|
|
property IsMicrosoft:Boolean read GetIsMicrosoft write SetIsMicrosoft;
|
|
property ReparseTag:LongWord read FReparseTag write FReparseTag;
|
|
property ReparseSize:Word read FReparseSize write FReparseSize;
|
|
property ReparseGUID:TGUID read FReparseGUID write FReparseGUID;
|
|
property Reparse:TNTFSReparse read FReparse;
|
|
function CreateReparse:Boolean;
|
|
function NewReparse(AReparseTag:LongWord):Boolean;
|
|
function CalculatedStreamSize(AVersion:Word):Int64; override;
|
|
function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
NTFS symbolic link attribute
TNTFSSymbolicLinkAttribute = class(TNTFSDiskAttribute)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
protected
| |
procedure SetDataSize(AValue:LongWord); override;
|
|
NTFS extended attribute information
TNTFSExtendedAttrInformationAttribute = class(TNTFSDiskAttribute)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
private
| |
FPackedSize:Word;
|
Size of the packed Extended Attributes |
FFlagCount:Word;
|
Number of Extended Attributes with NEED_EA |
FUnpackedSize:LongWord;
|
Size of the unpacked Extended Attributes |
public
| |
property PackedSize:Word read FPackedSize write FPackedSize;
|
|
property FlagCount:Word read FFlagCount write FFlagCount;
|
|
property UnpackedSize:LongWord read FUnpackedSize write FUnpackedSize;
|
|
function CalculatedStreamSize(AVersion:Word):Int64; override;
|
|
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
NTFS extended attribute
TNTFSExtendedAttrAttribute = class(TNTFSDiskAttribute)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
private
| |
FExtendeds:TNTFSExtendeds;
|
List of attributes of this attribute |
public
| |
property Extendeds:TNTFSExtendeds read FExtendeds;
|
|
function CreateExtended:TNTFSExtended;
|
|
function DestroyExtended(AExtended:TNTFSExtended):Boolean;
|
|
function NewExtended(const AName:String):TNTFSExtended;
|
|
function GetExtended(const AName:String):TNTFSExtended;
|
|
function RemoveExtended(AExtended:TNTFSExtended):Boolean;
|
|
function ExtendedCount:LongWord;
|
|
function CalculatedStreamSize(AVersion:Word):Int64; override;
|
|
function ReadExtendeds(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function WriteExtendeds(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function ReadData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
function WriteData(ABuffer:Pointer; var AOffset:LongWord; AVersion:Word):Boolean; override;
|
|
NTFS property set attribute
TNTFSPropertySetAttribute = class(TNTFSDiskAttribute)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
protected
| |
procedure SetDataSize(AValue:LongWord); override;
|
|
NTFS logged utility stream attribute
TNTFSLoggedUtilityStreamAttribute = class(TNTFSDiskAttribute)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
protected
| |
procedure SetDataSize(AValue:LongWord); override;
|
|
NTFS end attribute
TNTFSEndAttribute = class(TNTFSDiskAttribute)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
public
| |
function CalculatedSize(AVersion:Word):LongWord; override;
|
|
function CalculatedDataSize(AVersion:Word):LongWord; override;
|
|
function CalculatedStreamSize(AVersion:Word):Int64; override;
|
|
function ReadAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;
|
|
function WriteAttribute(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;
|
|
NTFS unknown attribute
TNTFSUnknownAttribute = class(TNTFSDiskAttribute)
constructor Create(ALocalLock:TMutexHandle; AParent:TNTFSDiskRecord);
|
|
destructor Destroy; override;
|
|
protected
| |
procedure SetDataSize(AValue:LongWord); override;
|
|
NTFS object Id
TNTFSObjId = class(TObject)
| Note: Data of index $O in file $ObjId (Not Used) | |
private
| |
public
| |
NTFS quota
TNTFSQuota = class(TObject)
| Note: Data of index $Q in file $Quota (Not Used) | |
private
| |
public
| |
NTFS owner
TNTFSOwner = class(TObject)
| Note: Data of index $O in file $Quota (Not Used) | |
private
| |
public
| |
NTFS upper case
TNTFSUpCase = class(TObject)
| Note: Data of file $UpCase | |
constructor Create;
|
|
destructor Destroy; override;
|
|
private
| |
FLock:TSynchronizerHandle;
|
|
FData:Pointer;
|
|
function ReaderLock:Boolean;
|
|
function ReaderUnlock:Boolean;
|
|
function WriterLock:Boolean;
|
|
function WriterUnlock:Boolean;
|
|
public
| |
property Data:Pointer read FData;
|
|
function Init(AVersion:Word):Boolean;
|
|
function Convert(ASource,ADest:Pointer; ASize:LongWord):Boolean;
|
|
function ReadUpCase(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function WriteUpCase(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
NTFS attribute definitions
TNTFSAttrDefs = class(TFileSysList)
constructor Create;
|
|
destructor Destroy; override;
|
|
private
| |
FAttrDefLocal:TMutexHandle;
|
|
function GetPrevious(AAttrDef:TNTFSAttrDef):TNTFSAttrDef;
|
|
public
| |
function CreateAttrDef(AType:LongWord; AVersion:Word; ANew:Boolean):TNTFSAttrDef;
|
|
function DestroyAttrDef(AAttrDef:TNTFSAttrDef):Boolean;
|
|
function NewAttrDef(AType:LongWord; const AName:String; AVersion:Word):TNTFSAttrDef;
|
|
function GetAttrDef(AType:LongWord; const AName:String):TNTFSAttrDef;
|
|
function GetAttrDefByIndex(AIndex:Integer; AVersion:Word):TNTFSAttrDef;
|
|
function GetAttrDefByIndexEx(AIndex:Integer; AVersion:Word; AWrite:Boolean):TNTFSAttrDef;
|
|
function GetAttrDefByAttribute(AAttribute:TNTFSDiskAttribute):TNTFSAttrDef;
|
|
function RemoveAttrDef(AAttrDef:TNTFSAttrDef):Boolean;
|
|
function CheckSize(AAttribute:TNTFSDiskAttribute;const ASize:Int64):Boolean;
|
|
function CheckIndexed(AAttribute:TNTFSDiskAttribute):Boolean;
|
|
function CheckResident(AAttribute:TNTFSDiskAttribute):Boolean;
|
|
function CheckUncompressed(AAttribute:TNTFSDiskAttribute):Boolean;
|
|
function TotalSize:Int64;
|
|
function AttrDefCount:LongWord;
|
|
function Init(AVersion:Word):Boolean;
|
|
function ReadAttrDefs(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function WriteAttrDefs(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
NTFS attribute definition
TNTFSAttrDef = class(TListObject)
| Note: Data of file $AttrDef | |
constructor Create(ALocalLock:TMutexHandle);
|
|
destructor Destroy; override;
|
|
private
| |
FLocalLock:TMutexHandle;
|
|
FAttributeName:String;
|
Label in Unicode |
FAttributeType:LongWord;
|
Type |
FDisplayRule:LongWord;
|
Display rule |
FCollateRule:LongWord;
|
Collation rule |
FAttrDefFlags:LongWord;
|
Flags (See Consts) |
FMinimumSize:Int64;
|
Minimum size |
FMaximumSize:Int64;
|
Maximum size |
FAttributeHash:LongWord;
|
|
function AcquireLock:Boolean;
|
|
function ReleaseLock:Boolean;
|
|
function GetAttributeName:String;
|
|
procedure SetAttributeName(const AAttributeName:String);
|
|
function GetIsIndexed:Boolean;
|
|
function GetIsResident:Boolean;
|
|
function GetIsUncompressed:Boolean;
|
|
function Compare(AAttrDef:TNTFSAttrDef):Integer; virtual;
|
|
public
| |
property AttributeName:String read GetAttributeName write SetAttributeName;
|
|
property AttributeType:LongWord read FAttributeType write FAttributeType;
|
|
property DisplayRule:LongWord read FDisplayRule write FDisplayRule;
|
|
property CollateRule:LongWord read FCollateRule write FCollateRule;
|
|
property AttrDefFlags:LongWord read FAttrDefFlags write FAttrDefFlags;
|
|
property MinimumSize:Int64 read FMinimumSize write FMinimumSize;
|
|
property MaximumSize:Int64 read FMaximumSize write FMaximumSize;
|
|
property IsIndexed:Boolean read GetIsIndexed;
|
|
property IsResident:Boolean read GetIsResident;
|
|
property IsUncompressed:Boolean read GetIsUncompressed;
|
|
function Init(AIndex:Integer;AVersion:Word):Boolean;
|
|
property AttributeHash:LongWord read FAttributeHash;
|
|
function ReadAttrDef(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function WriteAttrDef(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
NTFS reparse
TNTFSReparse = class(TDiskReparse)
| Note: Data of attribute $REPARSE_POINT | |
constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);
|
|
destructor Destroy; override;
|
|
private
| |
FData:Pointer;
|
|
FDataSize:Word;
|
|
FAttribute:TNTFSDiskAttribute;
|
Attribute owning this index |
procedure SetData(AData:Pointer); virtual;
|
|
function GetDataSize:Word; virtual;
|
|
procedure SetDataSize(ASize:Word); virtual;
|
|
public
| |
property Data:Pointer read FData write SetData;
|
|
property DataSize:Word read GetDataSize write SetDataSize;
|
|
property Attribute:TNTFSDiskAttribute read FAttribute;
|
|
function CalculatedSize(AVersion:Word):Word; virtual;
|
|
function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;
|
|
function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; virtual;
|
|
NTFS reparse symbolic link
TNTFSReparseSymLink = class(TNTFSReparse)
| Note: Data of attribute $REPARSE_POINT (Tag 0xA000000C) | |
constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);
|
|
destructor Destroy; override;
|
|
private
| |
procedure SetData(AData:Pointer); override;
|
|
procedure SetDataSize(ASize:Word); override;
|
|
protected
| |
FPrintName:String;
|
Path Buffer |
FSubstituteName:String;
|
Path Buffer |
FPrintHash:LongWord;
|
|
FSubstituteHash:LongWord;
|
|
function GetTarget:String; override;
|
|
function GetPrintName:String;
|
|
procedure SetPrintName(const APrintName:String);
|
|
function GetSubstituteName:String;
|
|
procedure SetSubstituteName(const ASubstituteName:String);
|
|
public
| |
property PrintName:String read GetPrintName write SetPrintName;
|
|
property SubstituteName:String read GetSubstituteName write SetSubstituteName;
|
|
property PrintHash:LongWord read FPrintHash;
|
|
property SubstituteHash:LongWord read FSubstituteHash;
|
|
function PrintNameSize:Word; virtual;
|
|
function PrintNameOffset:Word; virtual;
|
Print Name Offset |
function PrintNameLength:Word; virtual;
|
Print Name Length |
function SubstituteNameSize:Word; virtual;
|
|
function SubstituteNameOffset:Word; virtual;
|
Substitute Name Offset |
function SubstituteNameLength:Word; virtual;
|
Substitute Name Length |
function CalculatedSize(AVersion:Word):Word; override;
|
|
function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;
|
|
function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;
|
|
NTFS reparse mount point
TNTFSReparseMountPoint = class(TNTFSReparseSymLink)
| Note: Data of attribute $REPARSE_POINT (Tag 0xA0000003) | |
constructor Create(ALocalLock:TMutexHandle; AAttribute:TNTFSDiskAttribute);
|
|
destructor Destroy; override;
|
|
public
| |
function PrintNameSize:Word; override;
|
|
function PrintNameOffset:Word; override;
|
Print Name Offset |
function PrintNameLength:Word; override;
|
Print Name Length |
function SubstituteNameSize:Word; override;
|
|
function SubstituteNameOffset:Word; override;
|
Substitute Name Offset |
function SubstituteNameLength:Word; override;
|
Substitute Name Length |
function CalculatedSize(AVersion:Word):Word; override;
|
|
function ReadReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;
|
|
function WriteReparse(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean; override;
|
|
NTFS extendeds
TNTFSExtendeds = class(TFileSysListEx)
constructor Create(AExtendedLocal:TMutexHandle; ALock:TSynchronizerHandle);
|
|
destructor Destroy; override;
|
|
private
| |
FExtendedLocal:TMutexHandle;
|
|
public
| |
function TotalSize:Int64;
|
|
function ExtendedCount:LongWord;
|
|
NTFS extended
TNTFSExtended = class(TListObject)
| Note: Data of attribute $EA | |
constructor Create(ALocalLock:TMutexHandle);
|
|
destructor Destroy; override;
|
|
private
| |
FLocalLock:TMutexHandle;
|
|
FExtendedOffset:LongWord;
|
Offset to next Extended Attribute (Offset to next EA is the size of this EA) |
FExtendedFlags:Byte;
|
Flags |
FExtendedName:String;
|
Name Note: No offset so always in the same location (Not Unicode) |
FExtendedData:Pointer;
|
Value |
FExtendedDataSize:Word;
|
Value Length |
FExtendedHash:LongWord;
|
|
function AcquireLock:Boolean;
|
|
function ReleaseLock:Boolean;
|
|
function GetExtendedName:String;
|
|
procedure SetExtendedName(const AExtendedName:String);
|
|
procedure SetExtendedDataSize(ASize:Word);
|
|
public
| |
property ExtendedOffset:LongWord read FExtendedOffset write FExtendedOffset;
|
|
property ExtendedFlags:Byte read FExtendedFlags write FExtendedFlags;
|
|
property ExtendedName:String read GetExtendedName write SetExtendedName;
|
|
property ExtendedData:Pointer read FExtendedData;
|
|
property ExtendedDataSize:Word read FExtendedDataSize write SetExtendedDataSize;
|
|
property ExtendedHash:LongWord read FExtendedHash;
|
|
function ExtendedSize:LongWord;
|
|
function ExtendedNameSize:Word;
|
|
function ExtendedNameLength:Byte;
|
Name Length |
function ReadExtended(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function WriteExtended(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
NTFS security items
TNTFSSecurityItems = class(TFileSysList)
constructor Create;
|
|
destructor Destroy; override;
|
|
private
| |
FSecurityLocal:TMutexHandle;
|
|
function GetPrevious(ASecurityItem:TNTFSSecurityItem):TNTFSSecurityItem;
|
|
public
| |
function CreateSecurityItem(ANew:Boolean):TNTFSSecurityItem;
|
|
function DestroySecurityItem(ASecurityItem:TNTFSSecurityItem):Boolean;
|
|
function NewSecurityItem(ASecurityId:LongWord; const ASecurityOffset:Int64; ASecurity:TNTFSSecurity):TNTFSSecurityItem;
|
|
function GetSecurityItem(ASecurityId:LongWord):TNTFSSecurityItem;
|
|
function GetSecurityItemEx(ASecurityId:LongWord; AWrite:Boolean):TNTFSSecurityItem;
|
|
function UpdateSecurityItem(ASecurityItem:TNTFSSecurityItem; ASecurityId:LongWord; ASecurity:TNTFSSecurity):Boolean;
|
|
function DeleteSecurityItem(ASecurityItem:TNTFSSecurityItem):Boolean;
|
|
function RemoveSecurityItem(ASecurityItem:TNTFSSecurityItem; AFree:Boolean):Boolean;
|
|
function TotalSize:Int64;
|
|
function SecurityItemCount:LongWord;
|
|
function Init(AVersion:Word):Boolean;
|
|
function ReadSecurityItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function WriteSecurityItems(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
NTFS security item
TNTFSSecurityItem = class(TListObject)
| Note: Data of stream $SDS in file $Secure | |
constructor Create(ALocalLock:TMutexHandle);
|
|
destructor Destroy; override;
|
|
private
| |
FLocalLock:TMutexHandle;
|
|
FSecurityHash:LongWord;
|
Hash of Security Descriptor |
FSecurityId:LongWord;
|
Security Id |
FSecurityOffset:Int64;
|
Offset of this entry in $SDS |
FSecuritySize:LongWord;
|
Size of this entry in $SDS |
FSecurity:TNTFSSecurity;
|
Self-relative Security Descriptor |
function AcquireLock:Boolean;
|
|
function ReleaseLock:Boolean;
|
|
function Compare(ASecurityItem:TNTFSSecurityItem):Integer; virtual;
|
|
function CompareOld(ASecurityItem:TNTFSSecurityItem):Integer; virtual;
|
|
public
| |
property SecurityHash:LongWord read FSecurityHash write FSecurityHash;
|
|
property SecurityId:LongWord read FSecurityId write FSecurityId;
|
|
property SecurityOffset:Int64 read FSecurityOffset write FSecurityOffset;
|
|
property SecuritySize:LongWord read FSecuritySize write FSecuritySize;
|
|
property Security:TNTFSSecurity read FSecurity;
|
|
function CreateSecurity:Boolean;
|
|
function NewSecurity(ASecurity:TNTFSSecurity):Boolean;
|
|
function UpdateSecurity(ASecurity:TNTFSSecurity):Boolean;
|
|
function DeleteSecurity:Boolean;
|
|
function RemoveSecurity(AFree:Boolean):Boolean;
|
|
function MirrorOffset:Int64;
|
|
function Init(ASecurityId:LongWord; AVersion:Word):Boolean;
|
|
function ReadSecurityItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function WriteSecurityItem(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
NTFS security
TNTFSSecurity = class(TDiskSecurity)
| Note: Data of attribute $SECURITY_DESCRIPTOR and stream $SDS in file $Secure | |
| Note: This is the same structure that is used for all security in Windows (File/Kernel/Registry etc). See TSecurityDescriptor and associated values in Security unit for more information. | |
constructor Create(ALocalLock:TMutexHandle);
|
|
constructor CreateFromSecurity(ALocalLock:TMutexHandle; ASecurity:TDiskSecurity); override;
|
|
constructor CreateFromDescriptor(ALocalLock:TMutexHandle; ADescriptor:Pointer); override;
|
|
destructor Destroy; override;
|
|
private
| |
FVolumeVersion:Word;
|
|
FRevision:Byte;
|
Revision |
FControl:Word;
|
Control Flags |
FSacl:PACL;
|
SACL |
FDacl:PACL;
|
DACL |
FOwner:PSID;
|
Owner SID |
FGroup:PSID;
|
Group SID |
procedure SetSacl(ASacl:PACL);
|
|
procedure SetDacl(ADacl:PACL);
|
|
procedure SetOwner(AOwner:PSID);
|
|
procedure SetGroup(AGroup:PSID);
|
|
procedure SetSaclSize(ASize:Word);
|
|
procedure SetDaclSize(ASize:Word);
|
|
procedure SetOwnerSize(ASize:Word);
|
|
procedure SetGroupSize(ASize:Word);
|
|
public
| |
property VolumeVersion:Word read FVolumeVersion;
|
|
property Revision:Byte read FRevision write FRevision;
|
|
property Control:Word read FControl write FControl;
|
|
property Sacl:PACL read FSacl write SetSacl;
|
|
property Dacl:PACL read FDacl write SetDacl;
|
|
property Owner:PSID read FOwner write SetOwner;
|
|
property Group:PSID read FGroup write SetGroup;
|
|
function SaclSize:Word;
|
|
function DaclSize:Word;
|
|
function OwnerSize:Word;
|
|
function GroupSize:Word;
|
|
function SaclOffset:LongWord;
|
Offset to SACL |
function DaclOffset:LongWord;
|
Offset to DACL |
function OwnerOffset:LongWord;
|
Offset to Owner SID |
function GroupOffset:LongWord;
|
Offset to Group SID |
function SaclOffsetEx(ALocal:Boolean):LongWord;
|
Offset to SACL |
function DaclOffsetEx(ALocal:Boolean):LongWord;
|
Offset to DACL |
function OwnerOffsetEx(ALocal:Boolean):LongWord;
|
Offset to Owner SID |
function GroupOffsetEx(ALocal:Boolean):LongWord;
|
Offset to Group SID |
function SecuritySize:LongWord; override;
|
|
function SecurityHash:LongWord;
|
|
function SecurityDescriptor:Pointer; override;
|
|
function SecurityDescriptorEx(ALocal:Boolean):Pointer; override;
|
|
function InheritedDescriptor:Pointer; override;
|
|
function MergedDescriptor(AChild:Pointer):Pointer; override;
|
|
function ReleaseDescriptor(ADescriptor:Pointer; AInherited,AMerged:Boolean):Boolean; override;
|
|
function CopyToSecurity(ASecurity:TDiskSecurity):Boolean; override;
|
|
function CopyToDescriptor(ADescriptor:Pointer; ASize:LongWord):Boolean; override;
|
|
function CopyToDescriptorEx(ADescriptor:Pointer; ASize:LongWord; ALocal:Boolean):Boolean; override;
|
|
function CopyFromDescriptor(ADescriptor:Pointer; ASize:LongWord):Boolean; override;
|
|
function ReadSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function WriteSecurity(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
|
|
function WriteSecurityEx(ABuffer:Pointer; var AOffset,ASize:LongWord; ALocal:Boolean; AVersion:Word):Boolean;
|
|
NTFS security Id
TNTFSSecurityId = class(TObject)
| Note: Data of index $SII in file $Secure (Not Used) | |
private
| |
public
| |
NTFS security hash
TNTFSSecurityHash = class(TObject)
| Note: Data of index $SDH in file $Secure (Not Used) | |
private
| |
public
| |
Public variables
None defined
Function declarations
None defined
Return to Unit Reference
