Unit NTFSConst

From Ultibo.org
Revision as of 03:50, 30 May 2017 by Ultibo (Talk | contribs)

Jump to: navigation, search

Return to Unit Reference


Description


Ultibo NTFS constants unit

To be documented

Constants



NTFS specific constants ntfs*
ntfsNTFS12 = 0; 4.0 (WinNT)
ntfsNTFS30 = 1; 5.0 (Win2000)
ntfsNTFS31 = 2; 5.1/5.2/6.0/6.1 (WinXP/Win2003/WinVista/Win2008/Win7)
 
ntfsAnyName = '*';  
ntfsDotName = '.';  
ntfsDotDotName = '..';  
 
ntfsAnyNameLength = 1;  
ntfsDotNameLength = 1;  
ntfsDotDotNameLength = 2;  
ntfsBlankNameLength = 0;  
 
ntfsOemName = 'NTFS'; Padded with spaces to 8 bytes
 
ntfsEntryPadding = $20; Padded with spaces (32)


NTFS security ntfsSecurity*
ntfsSecurityHashPadding = $00490049; Unicode string II
ntfsSecurityHashPaddingSize = 4; SizeOf(LongWord)
 
ntfsSecurityMirrorOffset = $00040000; 256K Offset between primary and mirror entries
ntfsSecuritySectionOffset = $00040000; 256K Offset between sections (End of one section to Start of next)
ntfsSecuritySectionShift = 18; Not Used
ntfsSecurityOffsetMask = $0003FFFF; Used to determine the offset within a section from the offset
ntfsSecuritySectionMask = $FFFC0000; Used to determine the start of a section from the offset
ntfsSecurityMirrorTest = $00040000; Mirror blocks will always be 40000 or C0000


NTFS max number ntfsMax*
ntfsMaxPath = 260;  
ntfsMaxFile = 255;  
 
ntfsMaxAlias = 999999; Max number of lfn aliases (ie ~999999)
ntfsMaxNameAlias = 4;  
ntfsMaxHashAlias = 999;  
ntfsMaxHashShift = 16;  
 
ntfsMaxVolumeName = 255;  
ntfsMaxAttributeName = 255;  


NTFS cluster size ntfs*ClusterSize*
ntfsMinClusterSize = 512;  
ntfs12MaxClusterSize = 4096;  
ntfs30MaxClusterSize = 65536;  


NTFS sector ntfs*Sector
ntfsBootSector = 0;  
ntfsStartSector = 0; Int64
ntfsUnknownSector = -1; Int64


NTFS cluster ntfs*Cluster
ntfsStartCluster = 0; Int64
ntfsUnevenCluster = 1; Int64
ntfsUnknownCluster = -1; Int64


NTFS status ntfsStatus*
ntfsStatusNone = $00000000;  
ntfsStatusAdded = $00000001; Used by Node
ntfsStatusDeleted = $00000002; Used by Node
ntfsStatusChanged = $00000004; Used by Key, Node, Index
ntfsStatusLoaded = $00000008; Used by Index, List
ntfsStatusInvalid = $00000010; Used by Key, Item
ntfsStatusResizing = $00000020; Used by Record
ntfsStatusRemoving = $00000040; Used by Record
ntfsStatusUpdating = $00000080; Used by Attribute
 
ntfsStatusMirrored = $00000100; Metafile Records (0 to 3)
ntfsStatusMetafile = $00000200; Metafile Records (0 to 11)
ntfsStatusReserved = $00000400; Reserved MFT Records (12 to 15)(0C to 0F)
ntfsStatusExpansion = $00000800; Expansion MFT Records (16 to 23)(10 to 17)
 
ntfsStatusOverflow = $00001000; Record has an attribute list attribute
ntfsStatusExtension = $00002000; Record is an extension of the base record
 
ntfsStatusFixed = $00004000; Attribute is a fixed size (can write single item) Not used due to Fixups
ntfsStatusSingle = $00008000; Attribute only allows a single instance (Standard Information, Attribute List, End etc)
ntfsStatusUnlisted = $00010000; Attribute is not listed in an Attribute List (Attribute List, End)
ntfsStatusUnmovable = $00020000; Attribute cannot be moved from the Base Record (Standard Information, Attribute List)
ntfsStatusManaged = $00040000; Attribute is handled as a record or list, data member is not valid (Standard Information, Attribute List, FileName etc)
 
ntfsStatusAny = $FFFFFFFF;  


NTFS compare ntfsCompare*
ntfsCompareLess = -1;  
ntfsCompareEqual = 0;  
ntfsCompareGreater = 1;  


NTFS instance ntfsInstance*
ntfsInstanceFirst = 0;  
ntfsInstanceLast = -1;  


NTFS attribute definition ntfsAttrDefNo*
ntfsAttrDefNoMinimum = 0; Int64
ntfsAttrDefNoMaximum = -1; Int64


NTFS file reference ntfsFileReference*
ntfsFileReferenceNone = 0; Int64
ntfsRecordNumberMask = $0000FFFFFFFFFFFF; Get a record number from a file reference
ntfsUnknownRecordNumber = -1; Int64


NTFS bitmap ntfsBitmap*
ntfsBitmapUnknown = LongWord(-1);  


NTFS block count mask ntfsBlockCountMask*
ntfsBlockCountMask8 = $FFFFFFFFFFFFFFF8; 0000000000000007
ntfsBlockCountMask64 = $FFFFFFFFFFFFFFC0; 000000000000003F


NTFS MFT zone ntfsMftZone*
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem - NtfsMftZoneReservation - DWORD
 
ntfsMftZone50percent = 500; Registry value 4
ntfsMftZone37percent = 375; Registry value 3
ntfsMftZone25percent = 250; Registry value 2
ntfsMftZone12percent = 125; Registry value 1 (Default)
ntfsMftZone0percent = 0; Registry value 0 (Not allowed)


NTFS MFT fixed zone ntfsMftFixedZone*
Vista/2008
 
ntfsMftFixedZone1000MB = 1000; Registry value 0 (Not allowed)
ntfsMftFixedZone800MB = 800; Registry value 4
ntfsMftFixedZone600MB = 600; Registry value 3
ntfsMftFixedZone400MB = 400; Registry value 2
ntfsMftFixedZone200MB = 200; Registry value 1 (Default)
ntfsMftFixedZone0MB = 0; Registry value 0 (Not allowed)
 
ntfsMftFixedZone1000MBSize = 1048576000;  
ntfsMftFixedZone800MBSize = 838860800;  
ntfsMftFixedZone600MBSize = 629145600;  
ntfsMftFixedZone400MBSize = 419430400;  
ntfsMftFixedZone200MBSize = 209715200;  
ntfsMftFixedZone0MBSize = 0;  


NTFS run offset mask ntfsRunOffsetMask*
ntfsRunOffsetMask = $F0; shr 4
ntfsRunLengthMask = $0F;  


NTFS run encode mask ntfsRunEncodeMask*
(and)
 
ntfsRunEncodeMasks:array[0..8] of Int64 = (
$0000000000000000,  
$00000000000000FF,  
$000000000000FFFF,  
$0000000000FFFFFF,  
$00000000FFFFFFFF,  
$000000FFFFFFFFFF,  
$0000FFFFFFFFFFFF,  
$00FFFFFFFFFFFFFF,  
$FFFFFFFFFFFFFFFF); Not Used


NTFS run encode test ntfsRunEncodeTest*
(and)
 
(*ntfsRunEncodeTests:array[0..8] of Int64 = (
$FFFFFFFFFFFFFFFF, Not Used
$FFFFFFFFFFFFFF00,  
$FFFFFFFFFFFF0000,  
$FFFFFFFFFF000000,  
$FFFFFFFF00000000,  
$FFFFFF0000000000,  
$FFFF000000000000,  
$FF00000000000000,  
$0000000000000000);*)  
 
ntfsRunEncodeTests:array[0..8] of Int64 = (
$0000000000000000,  
$000000000000007F,  
$0000000000007FFF,  
$00000000007FFFFF,  
$000000007FFFFFFF,  
$0000007FFFFFFFFF,  
$00007FFFFFFFFFFF,  
$007FFFFFFFFFFFFF,  
$7FFFFFFFFFFFFFFF); Not Used


NTFS run negative test ntfsRunNegativeTest*
ntfsRunNegativeTests:array[0..8] of Int64 = (
$FFFFFFFFFFFFFFFF, Not Used
$FFFFFFFFFFFFFF80,  
$FFFFFFFFFFFF8000,  
$FFFFFFFFFF800000,  
$FFFFFFFF80000000,  
$FFFFFF8000000000,  
$FFFF800000000000,  
$FF80000000000000,  
$8000000000000000);  


NTFS run decode mask ntfsRunDecode*Mask
(and) (or not)
 
ntfsRunDecode1Masks:array[1..1] of Byte = (
$FF);  
 
ntfsRunDecode2Masks:array[2..2] of Word = (
$FFFF);  
 
ntfsRunDecode4Masks:array[3..4] of LongWord = (
$00FFFFFF,  
$FFFFFFFF);  
 
ntfsRunDecode8Masks:array[5..8] of Int64 = (
$000000FFFFFFFFFF,  
$0000FFFFFFFFFFFF,  
$00FFFFFFFFFFFFFF,  
$FFFFFFFFFFFFFFFF);  


NTFS run decode test ntfsRunDecode*Test
(>=)
 
ntfsRunDecode1Tests:array[1..1] of Byte = (
$80);  
 
ntfsRunDecode2Tests:array[2..2] of Word = (
$8000);  
 
ntfsRunDecode4Tests:array[3..4] of LongWord = (
$00800000,  
$80000000);  
 
ntfsRunDecode8Tests:array[5..8] of Int64 = (
$0000008000000000,  
$0000800000000000,  
$0080000000000000,  
$8000000000000000);  


NTFS compression tag ntfsCompression*
ntfsCompressionTags:array[1..8] of Byte = (
$01,  
$02,  
$04,  
$08,  
$10,  
$20,  
$40,  
$80);  
 
ntfsCompressionTagMask = $0FFF; The default mask for encoding and decoding the offset and length of a tag
ntfsCompressionTagShift = 12; The default shift for encoding and decoding the offset and length of a tag.

Tag is encoded as Offset:Length by varying the mask and shift based on the position.

 
ntfsCompressionUnitSize = 4; The default shift count for compression unit to cluster conversion
ntfsCompressionBlockSize = 4096; The fixed size of a compression block inside the variable compression unit
 
ntfsCompressionLengthMask = $0FFF; The mask for the maximum length of a compressed block
ntfsCompressionMarkerMask = $B000; The mask for the marker of a compressed block
ntfsCompressionMarkerTest = $8000; The test for the marker of a compressed block
 
ntfsCompressionTableInit = $FF; The initialization value for the compression table
ntfsCompressionTableUnused = $FFFF; The unused or unseen value for the compression table


NTFS bitmap mask ntfsBitmapMask*
ntfsBitmapMaskBits = 64; Int64 Bitmap Masks
ntfsBitmapMaskNone = $0000000000000000; Int64 (Used for fast counting of free blocks)
ntfsBitmapMaskAll = $FFFFFFFFFFFFFFFF; Int64 (Used for fast counting of used blocks)


NTFS signature ntfs*Signature
ntfsFileSignature = $454C4946; FILE
ntfsIndexSignature = $58444E49; INDX
ntfsRecordSignature = $44524352; RCRD
ntfsRestartSignature = $52545352; RSTR
ntfsCheckedSignature = $00000000; CHKD
 
ntfsNullGUID:TGUID = (D1:$00000000;D2:$0000;D3:$0000;D4:($00,$00,$00,$00,$00,$00,$00,$00));  
 
ntfsNullFileTime:TFileTime = (dwLowDateTime:$00000000;dwHighDateTime:$00000000);  


NTFS table type ntfsTableType*
ntfsTableTypeMft = $00000000;  
ntfsTableTypeMftMirr = $00000001;  


NTFS file type ntfsFileType*
ntfsFileTypeMft = $00000000;  
ntfsFileTypeMftMirr = $00000001;  
ntfsFileTypeLogFile = $00000002;  
ntfsFileTypeVolume = $00000003;  
ntfsFileTypeAttrDef = $00000004;  
ntfsFileTypeRoot = $00000005;  
ntfsFileTypeBitmap = $00000006;  
ntfsFileTypeBoot = $00000007;  
ntfsFileTypeBadClus = $00000008;  
ntfsFileTypeSecure = $00000009;  
ntfs12FileTypeQuota = $00000009; Version 1.2 only
ntfsFileTypeUpCase = $0000000A;  
ntfsFileTypeExtend = $0000000B;  
 
ntfsFileTypeObjId = $10000000; Any record number
ntfsFileTypeQuota = $20000000; Any record number
ntfsFileTypeReparse = $30000000; Any record number
ntfsFileTypeUsnJrnl = $40000000; Any record number
 
ntfsFileTypeFile = $50000000; Any record number (Not Used)
ntfsFileTypeDirectory = $60000000; Any record number (Not Used)
 
ntfsFileTypeReserved1 = $0000000C; Reserved Records
ntfsFileTypeReserved2 = $0000000D;  
ntfsFileTypeReserved3 = $0000000E;  
ntfsFileTypeReserved4 = $0000000F;  
 
ntfsFileTypeExpansion1 = $00000010; Expansion Records
ntfsFileTypeExpansion2 = $00000011;  
ntfsFileTypeExpansion3 = $00000012;  
ntfsFileTypeExpansion4 = $00000013;  
ntfsFileTypeExpansion5 = $00000014;  
ntfsFileTypeExpansion6 = $00000015;  
ntfsFileTypeExpansion7 = $00000016;  
ntfsFileTypeExpansion8 = $00000017;  


NTFS record number ntfs*RecordNumber
ntfsQuotaRecordNumber = $00000018; Only used during Format
ntfsObjIdRecordNumber = $00000019; Only used during Format
ntfsReparseRecordNumber = $0000001A; Only used during Format
ntfsUsnJrnlRecordNumber = $0000001B; Not Used
 
ntfsDefaultRecordCount = $0000001B; Files up to $Reparse
ntfsDefaultMirrorCount = $00000004; Files up to $Volume


NTFS file reference ntfs*FileReference
ntfsRootFileReference = $0005000000000005; Only used during Format
ntfsExtendFileReference = $000B00000000000B; Only used during Format
ntfsVolumeFileReference = $0003000000000003; Only used during Format


NTFS file name ntfsFileName*
ntfsFileNameMft = '$MFT';  
ntfsFileNameMftMirr = '$MFTMirr';  
ntfsFileNameLogFile = '$LogFile';  
ntfsFileNameVolume = '$Volume';  
ntfsFileNameAttrDef = '$AttrDef';  
ntfsFileNameRoot = '.';  
ntfsFileNameBitmap = '$Bitmap';  
ntfsFileNameBoot = '$Boot';  
ntfsFileNameBadClus = '$BadClus';  
ntfsFileNameSecure = '$Secure';  
ntfsFileNameUpCase = '$UpCase';  
ntfsFileNameExtend = '$Extend';  
 
ntfsFileNameObjId = '$ObjId';  
ntfsFileNameQuota = '$Quota';  
ntfsFileNameReparse = '$Reparse';  
ntfsFileNameUsnJrnl = '$UsnJrnl';  


NTFS attribute type ntfsAttrType*
ntfsAttrTypeNone = $00000000; Marker only
ntfsAttrTypeStandardInformation = $00000010;  
ntfsAttrTypeAttributeList = $00000020;  
ntfsAttrTypeFileName = $00000030;  
ntfsAttrTypeObjectId = $00000040;  
ntfsAttrTypeVolumeVersion = $00000040; Version 1.2 only
ntfsAttrTypeSecurityDescriptor = $00000050;  
ntfsAttrTypeVolumeName = $00000060;  
ntfsAttrTypeVolumeInformation = $00000070;  
ntfsAttrTypeData = $00000080;  
ntfsAttrTypeIndexRoot = $00000090;  
ntfsAttrTypeIndexAllocation = $000000A0;  
ntfsAttrTypeBitmap = $000000B0;  
ntfsAttrTypeReparsePoint = $000000C0;  
ntfsAttrTypeSymbolicLink = $000000C0; Version 1.2 only
ntfsAttrTypeExtendedAttrInformation = $000000D0;  
ntfsAttrTypeExtendedAttr = $000000E0;  
ntfsAttrTypePropertySet = $000000F0; Version 3.0 only
ntfsAttrTypeLoggedUtilityStream = $00000100;  
ntfsAttrTypeEnd = $FFFFFFFF; Marker only
 
ntfsAttrTypeAny = $00000000; Used to return all attributes


NTFS attribute name ntfsAttrName*
ntfsAttrNameNone = '$NONE'; Marker only
ntfsAttrNameStandardInformation = '$STANDARD_INFORMATION';  
ntfsAttrNameAttributeList = '$ATTRIBUTE_LIST';  
ntfsAttrNameFileName = '$FILE_NAME';  
ntfsAttrNameObjectId = '$OBJECT_ID';  
ntfsAttrNameVolumeVersion = '$VOLUME_VERSION'; Version 1.2 only
ntfsAttrNameSecurityDescriptor = '$SECURITY_DESCRIPTOR';  
ntfsAttrNameVolumeName = '$VOLUME_NAME';  
ntfsAttrNameVolumeInformation = '$VOLUME_INFORMATION';  
ntfsAttrNameData = '$DATA';  
ntfsAttrNameIndexRoot = '$INDEX_ROOT';  
ntfsAttrNameIndexAllocation = '$INDEX_ALLOCATION';  
ntfsAttrNameBitmap = '$BITMAP';  
ntfsAttrNameReparsePoint = '$REPARSE_POINT';  
ntfsAttrNameSymbolicLink = '$SYMBOLIC_LINK'; Version 1.2 only
ntfsAttrNameExtendedAttrInformation = '$EA_INFORMATION';  
ntfsAttrNameExtendedAttr = '$EA';  
ntfsAttrNamePropertySet = '$PROPERTY_SET'; Version 3.0 only
ntfsAttrNameLoggedUtilityStream = '$LOGGED_UTILITY_STREAM';  
ntfsAttrNameEnd = '$END'; Marker only


NTFS owner Id ntfsOwnerId*
ntfsOwnerIdNull = $00000001;  
ntfsOwnerIdFirst = $00000100;  
 
ntfsOwnerIdUnknown = $FFFFFFFF;  


NTFS default owner Id ntfsDefaultOwnerId*
ntfsDefaultOwnerId1 = $00000001;  
ntfsDefaultOwnerId100 = $00000100;  


NTFS default sid ntfsDefaultSid*
ntfsMaxDefaultSid = 1;  
 
ntfsDefaultSidNone = 0;  
ntfsDefaultSid100 = 1;  
 
ntfsDefaultSids:array[1..ntfsMaxDefaultSid] of TNTFSDefaultSid = (
(Sid:WinBuiltinAdministratorsSid)); 100


NTFS security Id ntfsSecurityId*
ntfsSecurityIdNull = $00000001;  
ntfsSecurityIdFirst = $00000100;  
 
ntfsSecurityIdUnknown = $FFFFFFFF;  


NTFS default security Id ntfsDefaultSecurityId*
ntfsDefaultSecurityId100 = $00000100;  
ntfsDefaultSecurityId101 = $00000101;  
ntfsDefaultSecurityId102 = $00000102;  
ntfsDefaultSecurityId103 = $00000103;  


NTFS default descriptor ntfsDefaultDescriptor*
ntfsMaxDefaultDescriptor = 7;  
 
ntfsDefaultDescriptorNone = 0;  
ntfsDefaultDescriptorVolume = 1;  
ntfsDefaultDescriptorAttrDef = 2;  
ntfsDefaultDescriptorRoot = 3;  
ntfsDefaultDescriptor102 = 4;  
ntfsDefaultDescriptor103 = 5;  
ntfsDefaultDescriptorFile = 6; Used by NTFSDefaultSecurity option
ntfsDefaultDescriptorFolder = 7; Used by NTFSDefaultSecurity option
 
ntfsDefaultDescriptorBoot = 2; Same as ntfsDefaultDescriptorAttrDef
ntfsDefaultDescriptor100 = 2; Same as ntfsDefaultDescriptorAttrDef
ntfsDefaultDescriptor101 = 1; Same as ntfsDefaultDescriptorVolume
ntfsDefaultDescriptorReserved = 1; Same as ntfsDefaultDescriptorVolume


NTFS security offset ntfsSecurityOffset*
ntfsSecurityOffsetFirst = 0; Int64
 
ntfsSecurityOffsetUnknown = -1; Int64


NTFS index name ntfsIndexName*
ntfsIndexNameFileName = '$I30';  
ntfsIndexNameSecurityId = '$SII';  
ntfsIndexNameSecurityHash = '$SDH';  
ntfsIndexNameObjectId = '$O';  
ntfsIndexNameOwnerId = '$O';  
ntfsIndexNameQuota = '$Q';  
ntfsIndexNameReparse = '$R';  


NTFS index order ntfsIndexOrder*
ntfsIndexOrderFileName = 38;  
ntfsIndexOrderSecurityId = 100;  
ntfsIndexOrderSecurityHash = 100;  
ntfsIndexOrderObjectId = 100;  
ntfsIndexOrderOwnerId = 100;  
ntfsIndexOrderQuota = 100;  
ntfsIndexOrderReparse = 100;  


NTFS stream name ntfsStreamName*
ntfsStreamNameSecurity = '$SDS';  
ntfsStreamNameBadClus = '$Bad';  
ntfsStreamNameMountMgr = '$MountMgrDatabase';  
ntfsStreamNameJournal = '$J';  
ntfsStreamNameJrnlMax = '$Max';  


NTFS file namespace ntfsNameSpace*
ntfsNameSpacePosix = $00;  
ntfsNameSpaceWin32 = $01;  
ntfsNameSpaceDos = $02;  
ntfsNameSpaceBoth = ntfsNamespaceWin32 or ntfsNamespaceDos;  


NTFS display type ntfsDisplayType*
ntfsDisplayTypeNone = $00000000;  


NTFS collate type ntfsCollateType*
ntfsCollateTypeBinary = $00000000; Binary, where the first byte is most significant
ntfsCollateTypeFileName = $00000001; Filename Unicode strings (This is a case insensitive compare)
ntfsCollateTypeUnicode = $00000002; Unicode strings, except that upper case letters should come first (This is a case sensitive compare)
ntfsCollateTypeLongWord = $00000010; An unsigned long (32 bits, little endian)
ntfsCollateTypeSID = $00000011; A Security Identifier
ntfsCollateTypeSecurityHash = $00000012; First compare by the Security Hash, then by Security Descriptor (Sorting is by Security Hash then Security Id)
ntfsCollateTypeGUID = $00000013; Object GUIDs


NTFS volume flag ntfsVolumeFlag*
ntfsVolumeFlagNone = $0000;  
ntfsVolumeFlagDirty = $0001;  
ntfsVolumeFlagResizeLogFile = $0002;  
ntfsVolumeFlagUpgradeMount = $0004;  
ntfsVolumeFlagMountedNT4 = $0008;  
ntfsVolumeFlagDeleteUSN = $0010;  
ntfsVolumeFlagRepairObjectIds = $0020;  
ntfsVolumeFlagModifiedChkdsk = $8000;  


NTFS file record flag ntfsFileRecordFlag*
ntfsFileRecordFlagNone = $0000;  
ntfsFileRecordFlagInUse = $0001;  
ntfsFileRecordFlagDirectory = $0002;  
ntfsFileRecordFlagUnknown1 = $0004; Used by $Quota,$ObjId,$Reparse
ntfsFileRecordFlagIndexView = $0008; Used by $Secure,$Quota,$ObjId,$Reparse


NTFS attribute flag ntfsAttrDefFlag* ntfsAttributeFlag*
ntfsAttrDefFlagNone = $00000000;  
ntfsAttrDefFlagIndexed = $00000002;  
ntfsAttrDefFlagResident = $00000040; Always resident
ntfsAttrDefFlagUncompressed = $00000080; Cannot Compress (Note: Resident Attributes cannot be compressed anyway)
 
ntfsAttrDefFlagResidentIndex = $00000042; Used by FileName (Resident and Indexed)
 
ntfsAttributeFlagNone = $0000;  
ntfsAttributeFlagCompressed = $0001;  
ntfsAttributeFlagEncrypted = $4000;  
ntfsAttributeFlagSparse = $8000;  


NTFS attribute ntfsAttribute*
ntfsAttributeIndexed = $01;  
ntfsAttributeNonIndexed = $00;  
ntfsAttributeResident = $00;  
ntfsAttributeNonResident = $01;  


NTFS index header flag ntfsIndexHeaderFlag*
ntfsIndexHeaderFlagNone = $0000;  
ntfsIndexHeaderFlagSubNodes = $0001; Index has Sub Nodes


NTFS index entry flag ntfsIndexEntryFlag*
ntfsIndexEntryFlagNone = $0000;  
ntfsIndexEntryFlagSubNode = $0001; Entry has Sub Node
ntfsIndexEntryFlagLastNode = $0002; Entry is Last Node (Always the Blank Node)


NTFS quota flag ntfsQuotaFlag*
ntfsQuotaFlagNone = $0000;  
ntfsQuotaFlagDefaultLimits = $0001;  
ntfsQuotaFlagLimitReached = $0002;  
ntfsQuotaFlagIdDeleted = $0004;  
ntfsQuotaFlagTrackingEnabled = $0010;  
ntfsQuotaFlagEnforcementEnabled = $0020;  
ntfsQuotaFlagTrackingRequested = $0040;  
ntfsQuotaFlagLogThreshold = $0080;  
ntfsQuotaFlagLogLimit = $0100;  
ntfsQuotaFlagOutOfDate = $0200;  
ntfsQuotaFlagCorrupt = $0400;  
ntfsQuotaFlagPendingDeletes = $0800;  


NTFS reparse tag ntfsReparseTag*
ntfsReparseTagNone = $00000000;  
ntfsReparseTagMountPoint = $A0000003;  
ntfsReparseTagHSM = $C0000004;  
ntfsReparseTagNSS = $80000005;  
ntfsReparseTagNSSRecover = $80000006; ntfsReparseTagHSM2
ntfsReparseTagSIS = $80000007;  
ntfsReparseTagDFS = $80000008; Shown in some documentation
ntfsReparseTagDFS = $8000000A;  
ntfsReparseTagFilterManager = $8000000B;  
ntfsReparseTagSymbolicLink = $A000000C;  
ntfsReparseTagDFSR = $80000012;  


NTFS reparse tag flag ntfsReparseTagFlag*
ntfsReparseTagFlagNone = $00000000;  
ntfsReparseTagFlagIsAlias = $20000000; ntfsReparseTagFlagIsNameSurrogate
ntfsReparseTagFlagIsHighLatency = $40000000;  
ntfsReparseTagFlagIsMicrosoft = $80000000;  


NTFS reparse tag type ntfsReparseTagType*
ntfsReparseTagTypeNone = $00000000;  
ntfsReparseTagTypeMountPoint = $00000003;  
ntfsReparseTagTypeHSM = $00000004;  
ntfsReparseTagTypeNSS = $00000005;  
ntfsReparseTagTypeNSSRecover = $00000006; ntfsReparseTagHSM2
ntfsReparseTagTypeSIS = $00000007;  
ntfsReparseTagTypeDFS = $00000008; Shown in some documentation
ntfsReparseTagTypeDFS = $0000000A;  
ntfsReparseTagTypeFilterManager = $0000000B;  
ntfsReparseTagTypeSymbolicLink = $0000000C;  
ntfsReparseTagTypeDFSR = $00000012;  
 
ntfsReparsePointPrefix = '\??\';  


NTFS extended attribute flag ntfsExtendedAttributeFlag*
ntfsExtendedAttributeFlagNone = $00;  
ntfsExtendedAttributeFlagNeedEA = $80;  


NTFS default size ntfsDefault*Size
ntfsDefaultBootRecordSize = 8192;  
ntfsDefaultFileRecordSize = 1024;  
ntfsDefaultIndexRecordSize = 4096;  
 
ntfsDefaultSecureSdsSize = 262396; 262616 if including Id 102 and 103


NTFS log file ntfsLogFile*
ntfsRestartPageSize = $1000;  
 
ntfsLogFileClientFirst = $0000;  
ntfsLogFileClientUnknown = $FFFF;  
 
ntfsLogFileRestartFlagClean = $0002;  


NTFS old log file size ntfs*OldLogSize
ntfsMaxOldLogSize = 10;  
ntfsOldLogSizes:array[0..ntfsMaxOldLogSize] of TNTFSLogSize = (
DiskSize,LogSize
(DiskSize:8388608;LogSize:262144), greater than 8MB, 256KB log
(DiskSize:16777216;LogSize:262144), greater than 16MB, 256KB log
(DiskSize:33554432;LogSize:524288), greater than 32MB, 512KB log (Previously 262144)
(DiskSize:67108864;LogSize:1048576), greater than 64MB, 1MB log (Previously 524288)
(DiskSize:134217728;LogSize:2097152), greater than 128MB, 2MB log (Previously 1048576)
(DiskSize:268435456;LogSize:2097152), greater than 256MB, 2MB log
(DiskSize:536870912;LogSize:4194304), greater than 512MB, 4MB log
(DiskSize:1073741824;LogSize:8388608), greater than 1GB, 8MB log
(DiskSize:2147483648;LogSize:16777216), greater than 2GB, 16MB log
(DiskSize:4294967296;LogSize:33554432), greater than 4GB, 32MB log
(DiskSize:8589934592;LogSize:67108864)); greater than 8GB, 64MB log


NTFS log file size ntfs*LogSize
ntfsMaxLogSize = 8;  
ntfsLogSizes:array[0..ntfsMaxLogSize] of TNTFSLogSize = (
DiskSize,LogSize
(DiskSize:0;LogSize:2097152), less than 128MB, 2MB log
(DiskSize:134217728;LogSize:4194304), greater than 128MB, 4MB log
(DiskSize:268435456;LogSize:5242880), greater than 256MB, 5MB log
(DiskSize:536870912;LogSize:6291456), greater than 512MB, 6MB log
(DiskSize:805306368;LogSize:7340032), greater than 768MB, 7MB log
(DiskSize:1073741824;LogSize:8388608), greater than 1GB, 8MB log
(DiskSize:2147483648;LogSize:16777216), greater than 2GB, 16MB log
(DiskSize:4294967296;LogSize:33554432), greater than 4GB, 32MB log
(DiskSize:8589934592;LogSize:67108864)); greater than 8GB, 64MB log


NTFS MFT/MFTMirr start ntfsMftStart*
ntfsMftStartCluster = 786432;  
ntfsMftCutoverCount = 4194304; 4194304 * 4096 = 16GB (The point at which the MFT becomes fixed in location)


NTFS file size ntfsFileSize*
ntfsFileSizeMft = ntfsUnknownCluster; Variable size
ntfsFileSizeMftMirr = ntfsUnknownCluster; Variable size
ntfsFileSizeLogFile = ntfsUnknownCluster; Variable size
ntfsFileSizeVolume = 0; Constant size
ntfsFileSize12AttrDef = 36864; Constant size
ntfsFileSize30AttrDef = 2560; Constant size
ntfsFileSize31AttrDef = 2560; Constant size
ntfsFileSizeRoot = ntfsUnknownCluster; Variable size
ntfsFileSizeBitmap = ntfsUnknownCluster; Variable size
ntfsFileSizeBoot = 8192; Constant size
ntfsFileSizeBadClus = 0; Starting size
ntfsFileSizeSecure = 0; Constant size
ntfsFileSizeUpCase = 131072; Constant size
ntfsFileSizeExtend = 0; Constant size
 
ntfsFileSizeObjId = 0; Constant size
ntfsFileSizeQuota = 0; Constant size
ntfsFileSizeReparse = 0; Constant size
ntfsFileSizeUsnJrnl = ntfsUnknownCluster; Variable size


NTFS stream size ntfsStreamSize*
ntfsStreamSizeSecurity = ntfsUnknownCluster; Variable size
ntfsStreamSizeBadClus = ntfsUnknownCluster; Variable size
ntfsStreamSizeMountMgr = ntfsUnknownCluster; Variable size
ntfsStreamSizeJournal = ntfsUnknownCluster; Variable size
ntfsStreamSizeJrnlMax = ntfsUnknownCluster; Variable size


NTFS header size ntfs*HeaderSize*
ntfsFileRecord12Size = 42; Constant size
ntfsFileRecord31Size = 48; Constant size
 
ntfsIndexRecordSize = 24; Constant size
ntfsIndexHeaderSize = 16; Constant size
ntfsIndexEntrySize = 16; Minimum size
 
ntfsAttributeTypeSize = 4; Constant size
ntfsAttributeHeaderSize = 16; Minimum size
ntfsResidentHeaderSize = 24; Minimum size
ntfsNonResidentHeaderSize = 64; Minimum size
ntfsCompressedHeaderSize = 72; Minimum size


NTFS attribute size ntfsAttribute*Size
Minimum sizes
 
ntfsStandardInformation12Size = 48; Constant size
ntfsStandardInformation30Size = 72; Constant size
ntfsAttributeListSize = 0; Variable size
ntfsFileNameSize = 66; Minimum size
ntfsObjectIdSize = 16; Minimum size
ntfsObjectIdSize2 = 32; Minimum size
ntfsObjectIdSize3 = 48; Minimum size
ntfsObjectIdSize4 = 64; Minimum size
ntfsVolumeVersionSize = 8; Constant size
ntfsSecurityDescriptorSize = 0; Variable size
ntfsVolumeNameSize = 0; Variable size
ntfsVolumeInformationSize = 12; Constant size
ntfsDataSize = 0; Variable size
ntfsIndexRootSize = 16; Constant size
ntfsIndexAllocationSize = 0; Variable size
ntfsBitmapSize = 0; Variable size
ntfsReparsePointSize = 8; Minimum size
ntfsReparsePointMicrosoftSize = 8; Minimum size
ntfsReparsePointOtherSize = 24; Minimum size
ntfsSymbolicLinkSize = 0; Variable size
ntfsExtendedAttrInformationSize = 8; Constant size
ntfsExtendedAttrSize = 0; Variable size
ntfsPropertySetSize = 0; Variable size
ntfsLoggedUtilityStreamSize = 0; Variable size
ntfsUnknownSize = 0; Variable size
ntfsEndSize = 4; Constant size


NTFS data size ntfs*Size
Minimum sizes
 
ntfsRunSize = 1; Minimum size
ntfsItemSize = 26; Minimum size
ntfsObjIdSize = 56; Constant size
ntfsQuotaSize = 48; Minimum size
ntfsOwnerSize = 4; Constant size
ntfsUpCaseSize = 131072; Constant size
ntfsAttrDefSize = 160; Constant size
ntfsReparseSize = 12; Minimum size
ntfsExtendedSize = 8; Minimum size
ntfsSecuritySize = 20; Minimum size
ntfsSidSize = 8; Minimum size
ntfsAclSize = 8; Minimum size
ntfsAceSize = 8; Minimum size
ntfsSecurityItemSize = 40; Minimum size (Includes ntfsSecuritySize)
ntfsSecurityIdSize = 20; Minimum size
ntfsSecurityHashSize = 20; Minimum size (Previously 24 - Modified to remove Padding)


NTFS key size ntfs*KeySize
Minimum sizes
 
ntfsObjIdKeySize = 16; Minimum size
ntfsQuotaKeySize = 4; Minimum size
ntfsOwnerKeySize = 8; Minimum size (Includes ntfsSidSize)
ntfsSecurityIdKeySize = 4; Minimum size
ntfsSecurityHashKeySize = 8; Minimum size
ntfsReparseKeySize = 12; Constant size (Not 16 even though CollateType is GUID)


NTFS update sequence size ntfsUpdateSequenceSize*
ntfsUpdateSequenceSize = 512; Constant size (Always 512 regardless of the sector size)


NTFS sector count ntfs*SectorCount
Used for NTFS formatting (Fixed Disk only)
 
ntfs12MaxSectorCount = 4;  
ntfs12SectorCounts:array[0..ntfs12MaxSectorCount] of TNTFSSectorCount = (
SectorCount,SectorsPerCluster
(SectorCount:16384;SectorsPerCluster:0), up to 8 MB, the 0 value for SectorsPerCluster trips an error
(SectorCount:1048576;SectorsPerCluster:1), up to 512 MB, sector size cluster
(SectorCount:2097152;SectorsPerCluster:2), up to 1 GB, 1k cluster
(SectorCount:4194304;SectorsPerCluster:4), up to 2 GB, 2k cluster
(SectorCount:$FFFFFFFF;SectorsPerCluster:8)); greater than 2 GB, 4k cluster
 
ntfs30MaxSectorCount = 4;  
ntfs30SectorCounts:array[0..ntfs30MaxSectorCount] of TNTFSSectorCount = (
SectorCount,SectorsPerCluster
(SectorCount:16384;SectorsPerCluster:0), up to 8 MB, the 0 value for SectorsPerCluster trips an error
(SectorCount:1048576;SectorsPerCluster:1), up to 512 MB, sector size cluster
(SectorCount:2097152;SectorsPerCluster:2), up to 1 GB, 1k cluster
(SectorCount:4194304;SectorsPerCluster:4), up to 2 GB, 2k cluster
(SectorCount:$FFFFFFFF;SectorsPerCluster:8)); greater than 2 GB, 4k cluster


Type definitions



NTFS attribute definition

TNTFSAttrDefine = record

Note: Not Packed
AttributeType:LongWord;  
AttributeName:String;  
AttrDefFlags:LongWord;  
MinimumSize:Int64;  
MaximumSize:Int64;  

NTFS uppercase conversion

TNTFSUpcaseConvert = record

Note: Not Packed
Count:Word;  
Value:Word;  

NTFS sector count

TNTFSSectorCount = record

Note: Not Packed (Fixed Disk only)
SectorCount:LongWord; Based on 512 bytes per sector only
SectorsPerCluster:LongWord;  

NTFS log size

TNTFSLogSize = record

Note: Not Packed
DiskSize:Int64;  
LogSize:Int64;  

NTFS default SID

PNTFSDefaultSid = ^TNTFSDefaultSid;

TNTFSDefaultSid = record

Note: Not Packed
Sid:TWellKnownSidType;  

NTFS default access control entry

TNTFSDefaultAce = record

Note: Not Packed
AceType:Byte;  
AceFlags:Byte;  
AceSize:Word;  
Mask:LongWord;  
Sid:TWellKnownSidType;  

NTFS default access control list

TNTFSDefaultAcl = record

Note: Not Packed
AclRevision:Byte;  
AclSize:Word;  
AceCount:Word;  
Aces:array[0..7] of TNTFSDefaultAce;  

NTFS default descriptor

PNTFSDefaultDescriptor = ^TNTFSDefaultDescriptor;

TNTFSDefaultDescriptor = record

Note: Not Packed
Size:LongWord;  
Revision:Byte; Revision
Control:Word; Control Flags
OwnerOffset:LongWord; Offset to Owner SID
GroupOffset:LongWord; Offset to Group SID
SaclOffset:LongWord; Offset to SACL
DaclOffset:LongWord; Offset to DACL
Owner:TWellKnownSidType;  
Group:TWellKnownSidType;  
Sacl:TNTFSDefaultAcl;  
Dacl:TNTFSDefaultAcl;  


Public variables



NTFS specific variables

SecurityHashPadding:LongWord = ntfsSecurityHashPadding;


Function declarations


None defined


Return to Unit Reference