Unit NTFSConst
From Ultibo.org
Return to Unit Reference
Description
Ultibo NTFS constants unit
To be documented
Constants
NTFS specific constants
ntfs* ntfsNTFS12 = 0;
|
4.0 (WinNT) |
ntfsNTFS30 = 1;
|
5.0 (Win2000) |
ntfsNTFS31 = 2;
|
5.1/5.2/6.0/6.1 (WinXP/Win2003/WinVista/Win2008/Win7) |
ntfsAnyName = '*';
|
|
ntfsDotName = '.';
|
|
ntfsDotDotName = '..';
|
|
ntfsAnyNameLength = 1;
|
|
ntfsDotNameLength = 1;
|
|
ntfsDotDotNameLength = 2;
|
|
ntfsBlankNameLength = 0;
|
|
ntfsOemName = 'NTFS';
|
Padded with spaces to 8 bytes |
ntfsEntryPadding = $20;
|
Padded with spaces (32) |
NTFS security
ntfsSecurity* ntfsSecurityHashPadding = $00490049;
|
Unicode string II |
ntfsSecurityHashPaddingSize = 4;
|
SizeOf(LongWord) |
ntfsSecurityMirrorOffset = $00040000;
|
256K Offset between primary and mirror entries |
ntfsSecuritySectionOffset = $00040000;
|
256K Offset between sections (End of one section to Start of next) |
ntfsSecuritySectionShift = 18;
|
Not Used |
ntfsSecurityOffsetMask = $0003FFFF;
|
Used to determine the offset within a section from the offset |
ntfsSecuritySectionMask = $FFFC0000;
|
Used to determine the start of a section from the offset |
ntfsSecurityMirrorTest = $00040000;
|
Mirror blocks will always be 40000 or C0000 |
NTFS max number
ntfsMax* ntfsMaxPath = 260;
|
|
ntfsMaxFile = 255;
|
|
ntfsMaxAlias = 999999;
|
Max number of lfn aliases (ie ~999999) |
ntfsMaxNameAlias = 4;
|
|
ntfsMaxHashAlias = 999;
|
|
ntfsMaxHashShift = 16;
|
|
ntfsMaxVolumeName = 255;
|
|
ntfsMaxAttributeName = 255;
|
|
NTFS cluster size
ntfs*ClusterSize* ntfsMinClusterSize = 512;
|
|
ntfs12MaxClusterSize = 4096;
|
|
ntfs30MaxClusterSize = 65536;
|
NTFS sector
ntfs*Sector ntfsBootSector = 0;
|
|
ntfsStartSector = 0;
|
Int64 |
ntfsUnknownSector = -1;
|
Int64 |
NTFS cluster
ntfs*Cluster ntfsStartCluster = 0;
|
Int64 |
ntfsUnevenCluster = 1;
|
Int64 |
ntfsUnknownCluster = -1;
|
Int64 |
NTFS status
ntfsStatus* ntfsStatusNone = $00000000;
|
|
ntfsStatusAdded = $00000001;
|
Used by Node |
ntfsStatusDeleted = $00000002;
|
Used by Node |
ntfsStatusChanged = $00000004;
|
Used by Key, Node, Index |
ntfsStatusLoaded = $00000008;
|
Used by Index, List |
ntfsStatusInvalid = $00000010;
|
Used by Key, Item |
ntfsStatusResizing = $00000020;
|
Used by Record |
ntfsStatusRemoving = $00000040;
|
Used by Record |
ntfsStatusUpdating = $00000080;
|
Used by Attribute |
ntfsStatusMirrored = $00000100;
|
Metafile Records (0 to 3) |
ntfsStatusMetafile = $00000200;
|
Metafile Records (0 to 11) |
ntfsStatusReserved = $00000400;
|
Reserved MFT Records (12 to 15)(0C to 0F) |
ntfsStatusExpansion = $00000800;
|
Expansion MFT Records (16 to 23)(10 to 17) |
ntfsStatusOverflow = $00001000;
|
Record has an attribute list attribute |
ntfsStatusExtension = $00002000;
|
Record is an extension of the base record |
ntfsStatusFixed = $00004000;
|
Attribute is a fixed size (can write single item) Not used due to Fixups |
ntfsStatusSingle = $00008000;
|
Attribute only allows a single instance (Standard Information, Attribute List, End etc) |
ntfsStatusUnlisted = $00010000;
|
Attribute is not listed in an Attribute List (Attribute List, End) |
ntfsStatusUnmovable = $00020000;
|
Attribute cannot be moved from the Base Record (Standard Information, Attribute List) |
ntfsStatusManaged = $00040000;
|
Attribute is handled as a record or list, data member is not valid (Standard Information, Attribute List, FileName etc) |
ntfsStatusAny = $FFFFFFFF;
|
|
NTFS compare
ntfsCompare* ntfsCompareLess = -1;
|
|
ntfsCompareEqual = 0;
|
|
ntfsCompareGreater = 1;
|
NTFS instance
ntfsInstance* ntfsInstanceFirst = 0;
|
|
ntfsInstanceLast = -1;
|
NTFS attribute definition
ntfsAttrDefNo* ntfsAttrDefNoMinimum = 0;
|
Int64 |
ntfsAttrDefNoMaximum = -1;
|
Int64 |
NTFS file reference
ntfsFileReference* ntfsFileReferenceNone = 0;
|
Int64 |
ntfsRecordNumberMask = $0000FFFFFFFFFFFF;
|
Get a record number from a file reference |
ntfsUnknownRecordNumber = -1;
|
Int64 |
NTFS bitmap
ntfsBitmap* ntfsBitmapUnknown = LongWord(-1);
|
NTFS block count mask
ntfsBlockCountMask* ntfsBlockCountMask8 = $FFFFFFFFFFFFFFF8;
|
0000000000000007 |
ntfsBlockCountMask64 = $FFFFFFFFFFFFFFC0;
|
000000000000003F |
NTFS MFT zone
ntfsMftZone* | HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\FileSystem - NtfsMftZoneReservation - DWORD | |
ntfsMftZone50percent = 500;
|
Registry value 4 |
ntfsMftZone37percent = 375;
|
Registry value 3 |
ntfsMftZone25percent = 250;
|
Registry value 2 |
ntfsMftZone12percent = 125;
|
Registry value 1 (Default) |
ntfsMftZone0percent = 0;
|
Registry value 0 (Not allowed) |
NTFS MFT fixed zone
ntfsMftFixedZone* | Vista/2008 | |
ntfsMftFixedZone1000MB = 1000;
|
Registry value 0 (Not allowed) |
ntfsMftFixedZone800MB = 800;
|
Registry value 4 |
ntfsMftFixedZone600MB = 600;
|
Registry value 3 |
ntfsMftFixedZone400MB = 400;
|
Registry value 2 |
ntfsMftFixedZone200MB = 200;
|
Registry value 1 (Default) |
ntfsMftFixedZone0MB = 0;
|
Registry value 0 (Not allowed) |
ntfsMftFixedZone1000MBSize = 1048576000;
|
|
ntfsMftFixedZone800MBSize = 838860800;
|
|
ntfsMftFixedZone600MBSize = 629145600;
|
|
ntfsMftFixedZone400MBSize = 419430400;
|
|
ntfsMftFixedZone200MBSize = 209715200;
|
|
ntfsMftFixedZone0MBSize = 0;
|
|
NTFS run offset mask
ntfsRunOffsetMask* ntfsRunOffsetMask = $F0;
|
shr 4 |
ntfsRunLengthMask = $0F;
|
NTFS run encode mask
ntfsRunEncodeMask* | (and) | |
ntfsRunEncodeMasks:array[0..8] of Int64 = (
| |
$0000000000000000,
|
|
$00000000000000FF,
|
|
$000000000000FFFF,
|
|
$0000000000FFFFFF,
|
|
$00000000FFFFFFFF,
|
|
$000000FFFFFFFFFF,
|
|
$0000FFFFFFFFFFFF,
|
|
$00FFFFFFFFFFFFFF,
|
|
$FFFFFFFFFFFFFFFF);
|
Not Used |
NTFS run encode test
ntfsRunEncodeTest* | (and) | |
(*ntfsRunEncodeTests:array[0..8] of Int64 = (
| |
$FFFFFFFFFFFFFFFF,
|
Not Used |
$FFFFFFFFFFFFFF00,
|
|
$FFFFFFFFFFFF0000,
|
|
$FFFFFFFFFF000000,
|
|
$FFFFFFFF00000000,
|
|
$FFFFFF0000000000,
|
|
$FFFF000000000000,
|
|
$FF00000000000000,
|
|
$0000000000000000);*)
|
|
ntfsRunEncodeTests:array[0..8] of Int64 = (
| |
$0000000000000000,
|
|
$000000000000007F,
|
|
$0000000000007FFF,
|
|
$00000000007FFFFF,
|
|
$000000007FFFFFFF,
|
|
$0000007FFFFFFFFF,
|
|
$00007FFFFFFFFFFF,
|
|
$007FFFFFFFFFFFFF,
|
|
$7FFFFFFFFFFFFFFF);
|
Not Used |
NTFS run negative test
ntfsRunNegativeTest* ntfsRunNegativeTests:array[0..8] of Int64 = (
| |
$FFFFFFFFFFFFFFFF,
|
Not Used |
$FFFFFFFFFFFFFF80,
|
|
$FFFFFFFFFFFF8000,
|
|
$FFFFFFFFFF800000,
|
|
$FFFFFFFF80000000,
|
|
$FFFFFF8000000000,
|
|
$FFFF800000000000,
|
|
$FF80000000000000,
|
|
$8000000000000000);
|
|
NTFS run decode mask
ntfsRunDecode*Mask | (and) (or not) | |
ntfsRunDecode1Masks:array[1..1] of Byte = (
| |
$FF);
|
|
ntfsRunDecode2Masks:array[2..2] of Word = (
| |
$FFFF);
|
|
ntfsRunDecode4Masks:array[3..4] of LongWord = (
| |
$00FFFFFF,
|
|
$FFFFFFFF);
|
|
ntfsRunDecode8Masks:array[5..8] of Int64 = (
| |
$000000FFFFFFFFFF,
|
|
$0000FFFFFFFFFFFF,
|
|
$00FFFFFFFFFFFFFF,
|
|
$FFFFFFFFFFFFFFFF);
|
|
NTFS run decode test
ntfsRunDecode*Test | (>=) | |
ntfsRunDecode1Tests:array[1..1] of Byte = (
| |
$80);
|
|
ntfsRunDecode2Tests:array[2..2] of Word = (
| |
$8000);
|
|
ntfsRunDecode4Tests:array[3..4] of LongWord = (
| |
$00800000,
|
|
$80000000);
|
|
ntfsRunDecode8Tests:array[5..8] of Int64 = (
| |
$0000008000000000,
|
|
$0000800000000000,
|
|
$0080000000000000,
|
|
$8000000000000000);
|
|
NTFS compression tag
ntfsCompression* ntfsCompressionTags:array[1..8] of Byte = (
| |
$01,
|
|
$02,
|
|
$04,
|
|
$08,
|
|
$10,
|
|
$20,
|
|
$40,
|
|
$80);
|
|
ntfsCompressionTagMask = $0FFF;
|
The default mask for encoding and decoding the offset and length of a tag |
ntfsCompressionTagShift = 12;
|
The default shift for encoding and decoding the offset and length of a tag.
Tag is encoded as Offset:Length by varying the mask and shift based on the position. |
ntfsCompressionUnitSize = 4;
|
The default shift count for compression unit to cluster conversion |
ntfsCompressionBlockSize = 4096;
|
The fixed size of a compression block inside the variable compression unit |
ntfsCompressionLengthMask = $0FFF;
|
The mask for the maximum length of a compressed block |
ntfsCompressionMarkerMask = $B000;
|
The mask for the marker of a compressed block |
ntfsCompressionMarkerTest = $8000;
|
The test for the marker of a compressed block |
ntfsCompressionTableInit = $FF;
|
The initialization value for the compression table |
ntfsCompressionTableUnused = $FFFF;
|
The unused or unseen value for the compression table |
NTFS bitmap mask
ntfsBitmapMask* ntfsBitmapMaskBits = 64;
|
Int64 Bitmap Masks |
ntfsBitmapMaskNone = $0000000000000000;
|
Int64 (Used for fast counting of free blocks) |
ntfsBitmapMaskAll = $FFFFFFFFFFFFFFFF;
|
Int64 (Used for fast counting of used blocks) |
NTFS signature
ntfs*Signature ntfsFileSignature = $454C4946;
|
FILE |
ntfsIndexSignature = $58444E49;
|
INDX |
ntfsRecordSignature = $44524352;
|
RCRD |
ntfsRestartSignature = $52545352;
|
RSTR |
ntfsCheckedSignature = $00000000;
|
CHKD |
ntfsNullGUID:TGUID = (D1:$00000000;D2:$0000;D3:$0000;D4:($00,$00,$00,$00,$00,$00,$00,$00));
|
|
ntfsNullFileTime:TFileTime = (dwLowDateTime:$00000000;dwHighDateTime:$00000000);
|
|
NTFS table type
ntfsTableType* ntfsTableTypeMft = $00000000;
|
|
ntfsTableTypeMftMirr = $00000001;
|
NTFS file type
ntfsFileType* ntfsFileTypeMft = $00000000;
|
|
ntfsFileTypeMftMirr = $00000001;
|
|
ntfsFileTypeLogFile = $00000002;
|
|
ntfsFileTypeVolume = $00000003;
|
|
ntfsFileTypeAttrDef = $00000004;
|
|
ntfsFileTypeRoot = $00000005;
|
|
ntfsFileTypeBitmap = $00000006;
|
|
ntfsFileTypeBoot = $00000007;
|
|
ntfsFileTypeBadClus = $00000008;
|
|
ntfsFileTypeSecure = $00000009;
|
|
ntfs12FileTypeQuota = $00000009;
|
Version 1.2 only |
ntfsFileTypeUpCase = $0000000A;
|
|
ntfsFileTypeExtend = $0000000B;
|
|
ntfsFileTypeObjId = $10000000;
|
Any record number |
ntfsFileTypeQuota = $20000000;
|
Any record number |
ntfsFileTypeReparse = $30000000;
|
Any record number |
ntfsFileTypeUsnJrnl = $40000000;
|
Any record number |
ntfsFileTypeFile = $50000000;
|
Any record number (Not Used) |
ntfsFileTypeDirectory = $60000000;
|
Any record number (Not Used) |
ntfsFileTypeReserved1 = $0000000C;
|
Reserved Records |
ntfsFileTypeReserved2 = $0000000D;
|
|
ntfsFileTypeReserved3 = $0000000E;
|
|
ntfsFileTypeReserved4 = $0000000F;
|
|
ntfsFileTypeExpansion1 = $00000010;
|
Expansion Records |
ntfsFileTypeExpansion2 = $00000011;
|
|
ntfsFileTypeExpansion3 = $00000012;
|
|
ntfsFileTypeExpansion4 = $00000013;
|
|
ntfsFileTypeExpansion5 = $00000014;
|
|
ntfsFileTypeExpansion6 = $00000015;
|
|
ntfsFileTypeExpansion7 = $00000016;
|
|
ntfsFileTypeExpansion8 = $00000017;
|
|
NTFS record number
ntfs*RecordNumber ntfsQuotaRecordNumber = $00000018;
|
Only used during Format |
ntfsObjIdRecordNumber = $00000019;
|
Only used during Format |
ntfsReparseRecordNumber = $0000001A;
|
Only used during Format |
ntfsUsnJrnlRecordNumber = $0000001B;
|
Not Used |
ntfsDefaultRecordCount = $0000001B;
|
Files up to $Reparse |
ntfsDefaultMirrorCount = $00000004;
|
Files up to $Volume |
NTFS file reference
ntfs*FileReference ntfsRootFileReference = $0005000000000005;
|
Only used during Format |
ntfsExtendFileReference = $000B00000000000B;
|
Only used during Format |
ntfsVolumeFileReference = $0003000000000003;
|
Only used during Format |
NTFS file name
ntfsFileName* ntfsFileNameMft = '$MFT';
|
|
ntfsFileNameMftMirr = '$MFTMirr';
|
|
ntfsFileNameLogFile = '$LogFile';
|
|
ntfsFileNameVolume = '$Volume';
|
|
ntfsFileNameAttrDef = '$AttrDef';
|
|
ntfsFileNameRoot = '.';
|
|
ntfsFileNameBitmap = '$Bitmap';
|
|
ntfsFileNameBoot = '$Boot';
|
|
ntfsFileNameBadClus = '$BadClus';
|
|
ntfsFileNameSecure = '$Secure';
|
|
ntfsFileNameUpCase = '$UpCase';
|
|
ntfsFileNameExtend = '$Extend';
|
|
ntfsFileNameObjId = '$ObjId';
|
|
ntfsFileNameQuota = '$Quota';
|
|
ntfsFileNameReparse = '$Reparse';
|
|
ntfsFileNameUsnJrnl = '$UsnJrnl';
|
|
NTFS attribute type
ntfsAttrType* ntfsAttrTypeNone = $00000000;
|
Marker only |
ntfsAttrTypeStandardInformation = $00000010;
|
|
ntfsAttrTypeAttributeList = $00000020;
|
|
ntfsAttrTypeFileName = $00000030;
|
|
ntfsAttrTypeObjectId = $00000040;
|
|
ntfsAttrTypeVolumeVersion = $00000040;
|
Version 1.2 only |
ntfsAttrTypeSecurityDescriptor = $00000050;
|
|
ntfsAttrTypeVolumeName = $00000060;
|
|
ntfsAttrTypeVolumeInformation = $00000070;
|
|
ntfsAttrTypeData = $00000080;
|
|
ntfsAttrTypeIndexRoot = $00000090;
|
|
ntfsAttrTypeIndexAllocation = $000000A0;
|
|
ntfsAttrTypeBitmap = $000000B0;
|
|
ntfsAttrTypeReparsePoint = $000000C0;
|
|
ntfsAttrTypeSymbolicLink = $000000C0;
|
Version 1.2 only |
ntfsAttrTypeExtendedAttrInformation = $000000D0;
|
|
ntfsAttrTypeExtendedAttr = $000000E0;
|
|
ntfsAttrTypePropertySet = $000000F0;
|
Version 3.0 only |
ntfsAttrTypeLoggedUtilityStream = $00000100;
|
|
ntfsAttrTypeEnd = $FFFFFFFF;
|
Marker only |
ntfsAttrTypeAny = $00000000;
|
Used to return all attributes |
NTFS attribute name
ntfsAttrName* ntfsAttrNameNone = '$NONE';
|
Marker only |
ntfsAttrNameStandardInformation = '$STANDARD_INFORMATION';
|
|
ntfsAttrNameAttributeList = '$ATTRIBUTE_LIST';
|
|
ntfsAttrNameFileName = '$FILE_NAME';
|
|
ntfsAttrNameObjectId = '$OBJECT_ID';
|
|
ntfsAttrNameVolumeVersion = '$VOLUME_VERSION';
|
Version 1.2 only |
ntfsAttrNameSecurityDescriptor = '$SECURITY_DESCRIPTOR';
|
|
ntfsAttrNameVolumeName = '$VOLUME_NAME';
|
|
ntfsAttrNameVolumeInformation = '$VOLUME_INFORMATION';
|
|
ntfsAttrNameData = '$DATA';
|
|
ntfsAttrNameIndexRoot = '$INDEX_ROOT';
|
|
ntfsAttrNameIndexAllocation = '$INDEX_ALLOCATION';
|
|
ntfsAttrNameBitmap = '$BITMAP';
|
|
ntfsAttrNameReparsePoint = '$REPARSE_POINT';
|
|
ntfsAttrNameSymbolicLink = '$SYMBOLIC_LINK';
|
Version 1.2 only |
ntfsAttrNameExtendedAttrInformation = '$EA_INFORMATION';
|
|
ntfsAttrNameExtendedAttr = '$EA';
|
|
ntfsAttrNamePropertySet = '$PROPERTY_SET';
|
Version 3.0 only |
ntfsAttrNameLoggedUtilityStream = '$LOGGED_UTILITY_STREAM';
|
|
ntfsAttrNameEnd = '$END';
|
Marker only |
NTFS owner Id
ntfsOwnerId* ntfsOwnerIdNull = $00000001;
|
|
ntfsOwnerIdFirst = $00000100;
|
|
ntfsOwnerIdUnknown = $FFFFFFFF;
|
|
NTFS default owner Id
ntfsDefaultOwnerId* ntfsDefaultOwnerId1 = $00000001;
|
|
ntfsDefaultOwnerId100 = $00000100;
|
NTFS default sid
ntfsDefaultSid* ntfsMaxDefaultSid = 1;
|
|
ntfsDefaultSidNone = 0;
|
|
ntfsDefaultSid100 = 1;
|
|
ntfsDefaultSids:array[1..ntfsMaxDefaultSid] of TNTFSDefaultSid = (
| |
(Sid:WinBuiltinAdministratorsSid));
|
100 |
NTFS security Id
ntfsSecurityId* ntfsSecurityIdNull = $00000001;
|
|
ntfsSecurityIdFirst = $00000100;
|
|
ntfsSecurityIdUnknown = $FFFFFFFF;
|
|
NTFS default security Id
ntfsDefaultSecurityId* ntfsDefaultSecurityId100 = $00000100;
|
|
ntfsDefaultSecurityId101 = $00000101;
|
|
ntfsDefaultSecurityId102 = $00000102;
|
|
ntfsDefaultSecurityId103 = $00000103;
|
NTFS default descriptor
ntfsDefaultDescriptor* ntfsMaxDefaultDescriptor = 7;
|
|
ntfsDefaultDescriptorNone = 0;
|
|
ntfsDefaultDescriptorVolume = 1;
|
|
ntfsDefaultDescriptorAttrDef = 2;
|
|
ntfsDefaultDescriptorRoot = 3;
|
|
ntfsDefaultDescriptor102 = 4;
|
|
ntfsDefaultDescriptor103 = 5;
|
|
ntfsDefaultDescriptorFile = 6;
|
Used by NTFSDefaultSecurity option |
ntfsDefaultDescriptorFolder = 7;
|
Used by NTFSDefaultSecurity option |
ntfsDefaultDescriptorBoot = 2;
|
Same as ntfsDefaultDescriptorAttrDef |
ntfsDefaultDescriptor100 = 2;
|
Same as ntfsDefaultDescriptorAttrDef |
ntfsDefaultDescriptor101 = 1;
|
Same as ntfsDefaultDescriptorVolume |
ntfsDefaultDescriptorReserved = 1;
|
Same as ntfsDefaultDescriptorVolume |
NTFS security offset
ntfsSecurityOffset* ntfsSecurityOffsetFirst = 0;
|
Int64 |
ntfsSecurityOffsetUnknown = -1;
|
Int64 |
NTFS index name
ntfsIndexName* ntfsIndexNameFileName = '$I30';
|
|
ntfsIndexNameSecurityId = '$SII';
|
|
ntfsIndexNameSecurityHash = '$SDH';
|
|
ntfsIndexNameObjectId = '$O';
|
|
ntfsIndexNameOwnerId = '$O';
|
|
ntfsIndexNameQuota = '$Q';
|
|
ntfsIndexNameReparse = '$R';
|
NTFS index order
ntfsIndexOrder* ntfsIndexOrderFileName = 38;
|
|
ntfsIndexOrderSecurityId = 100;
|
|
ntfsIndexOrderSecurityHash = 100;
|
|
ntfsIndexOrderObjectId = 100;
|
|
ntfsIndexOrderOwnerId = 100;
|
|
ntfsIndexOrderQuota = 100;
|
|
ntfsIndexOrderReparse = 100;
|
NTFS stream name
ntfsStreamName* ntfsStreamNameSecurity = '$SDS';
|
|
ntfsStreamNameBadClus = '$Bad';
|
|
ntfsStreamNameMountMgr = '$MountMgrDatabase';
|
|
ntfsStreamNameJournal = '$J';
|
|
ntfsStreamNameJrnlMax = '$Max';
|
NTFS file namespace
ntfsNameSpace* ntfsNameSpacePosix = $00;
|
|
ntfsNameSpaceWin32 = $01;
|
|
ntfsNameSpaceDos = $02;
|
|
ntfsNameSpaceBoth = ntfsNamespaceWin32 or ntfsNamespaceDos;
|
NTFS display type
ntfsDisplayType* ntfsDisplayTypeNone = $00000000;
|
NTFS collate type
ntfsCollateType* ntfsCollateTypeBinary = $00000000;
|
Binary, where the first byte is most significant |
ntfsCollateTypeFileName = $00000001;
|
Filename Unicode strings (This is a case insensitive compare) |
ntfsCollateTypeUnicode = $00000002;
|
Unicode strings, except that upper case letters should come first (This is a case sensitive compare) |
ntfsCollateTypeLongWord = $00000010;
|
An unsigned long (32 bits, little endian) |
ntfsCollateTypeSID = $00000011;
|
A Security Identifier |
ntfsCollateTypeSecurityHash = $00000012;
|
First compare by the Security Hash, then by Security Descriptor (Sorting is by Security Hash then Security Id) |
ntfsCollateTypeGUID = $00000013;
|
Object GUIDs |
NTFS volume flag
ntfsVolumeFlag* ntfsVolumeFlagNone = $0000;
|
|
ntfsVolumeFlagDirty = $0001;
|
|
ntfsVolumeFlagResizeLogFile = $0002;
|
|
ntfsVolumeFlagUpgradeMount = $0004;
|
|
ntfsVolumeFlagMountedNT4 = $0008;
|
|
ntfsVolumeFlagDeleteUSN = $0010;
|
|
ntfsVolumeFlagRepairObjectIds = $0020;
|
|
ntfsVolumeFlagModifiedChkdsk = $8000;
|
NTFS file record flag
ntfsFileRecordFlag* ntfsFileRecordFlagNone = $0000;
|
|
ntfsFileRecordFlagInUse = $0001;
|
|
ntfsFileRecordFlagDirectory = $0002;
|
|
ntfsFileRecordFlagUnknown1 = $0004;
|
Used by $Quota,$ObjId,$Reparse |
ntfsFileRecordFlagIndexView = $0008;
|
Used by $Secure,$Quota,$ObjId,$Reparse |
NTFS attribute flag
ntfsAttrDefFlag* ntfsAttributeFlag* ntfsAttrDefFlagNone = $00000000;
|
|
ntfsAttrDefFlagIndexed = $00000002;
|
|
ntfsAttrDefFlagResident = $00000040;
|
Always resident |
ntfsAttrDefFlagUncompressed = $00000080;
|
Cannot Compress (Note: Resident Attributes cannot be compressed anyway) |
ntfsAttrDefFlagResidentIndex = $00000042;
|
Used by FileName (Resident and Indexed) |
ntfsAttributeFlagNone = $0000;
|
|
ntfsAttributeFlagCompressed = $0001;
|
|
ntfsAttributeFlagEncrypted = $4000;
|
|
ntfsAttributeFlagSparse = $8000;
|
|
NTFS attribute
ntfsAttribute* ntfsAttributeIndexed = $01;
|
|
ntfsAttributeNonIndexed = $00;
|
|
ntfsAttributeResident = $00;
|
|
ntfsAttributeNonResident = $01;
|
NTFS index header flag
ntfsIndexHeaderFlag* ntfsIndexHeaderFlagNone = $0000;
|
|
ntfsIndexHeaderFlagSubNodes = $0001;
|
Index has Sub Nodes |
NTFS index entry flag
ntfsIndexEntryFlag* ntfsIndexEntryFlagNone = $0000;
|
|
ntfsIndexEntryFlagSubNode = $0001;
|
Entry has Sub Node |
ntfsIndexEntryFlagLastNode = $0002;
|
Entry is Last Node (Always the Blank Node) |
NTFS quota flag
ntfsQuotaFlag* ntfsQuotaFlagNone = $0000;
|
|
ntfsQuotaFlagDefaultLimits = $0001;
|
|
ntfsQuotaFlagLimitReached = $0002;
|
|
ntfsQuotaFlagIdDeleted = $0004;
|
|
ntfsQuotaFlagTrackingEnabled = $0010;
|
|
ntfsQuotaFlagEnforcementEnabled = $0020;
|
|
ntfsQuotaFlagTrackingRequested = $0040;
|
|
ntfsQuotaFlagLogThreshold = $0080;
|
|
ntfsQuotaFlagLogLimit = $0100;
|
|
ntfsQuotaFlagOutOfDate = $0200;
|
|
ntfsQuotaFlagCorrupt = $0400;
|
|
ntfsQuotaFlagPendingDeletes = $0800;
|
NTFS reparse tag
ntfsReparseTag* ntfsReparseTagNone = $00000000;
|
|
ntfsReparseTagMountPoint = $A0000003;
|
|
ntfsReparseTagHSM = $C0000004;
|
|
ntfsReparseTagNSS = $80000005;
|
|
ntfsReparseTagNSSRecover = $80000006;
|
ntfsReparseTagHSM2 |
ntfsReparseTagSIS = $80000007;
|
|
ntfsReparseTagDFS = $80000008;
|
Shown in some documentation |
ntfsReparseTagDFS = $8000000A;
|
|
ntfsReparseTagFilterManager = $8000000B;
|
|
ntfsReparseTagSymbolicLink = $A000000C;
|
|
ntfsReparseTagDFSR = $80000012;
|
NTFS reparse tag flag
ntfsReparseTagFlag* ntfsReparseTagFlagNone = $00000000;
|
|
ntfsReparseTagFlagIsAlias = $20000000;
|
ntfsReparseTagFlagIsNameSurrogate |
ntfsReparseTagFlagIsHighLatency = $40000000;
|
|
ntfsReparseTagFlagIsMicrosoft = $80000000;
|
NTFS reparse tag type
ntfsReparseTagType* ntfsReparseTagTypeNone = $00000000;
|
|
ntfsReparseTagTypeMountPoint = $00000003;
|
|
ntfsReparseTagTypeHSM = $00000004;
|
|
ntfsReparseTagTypeNSS = $00000005;
|
|
ntfsReparseTagTypeNSSRecover = $00000006;
|
ntfsReparseTagHSM2 |
ntfsReparseTagTypeSIS = $00000007;
|
|
ntfsReparseTagTypeDFS = $00000008;
|
Shown in some documentation |
ntfsReparseTagTypeDFS = $0000000A;
|
|
ntfsReparseTagTypeFilterManager = $0000000B;
|
|
ntfsReparseTagTypeSymbolicLink = $0000000C;
|
|
ntfsReparseTagTypeDFSR = $00000012;
|
|
ntfsReparsePointPrefix = '\??\';
|
|
NTFS extended attribute flag
ntfsExtendedAttributeFlag* ntfsExtendedAttributeFlagNone = $00;
|
|
ntfsExtendedAttributeFlagNeedEA = $80;
|
NTFS default size
ntfsDefault*Size ntfsDefaultBootRecordSize = 8192;
|
|
ntfsDefaultFileRecordSize = 1024;
|
|
ntfsDefaultIndexRecordSize = 4096;
|
|
ntfsDefaultSecureSdsSize = 262396;
|
262616 if including Id 102 and 103 |
NTFS log file
ntfsLogFile* ntfsRestartPageSize = $1000;
|
|
ntfsLogFileClientFirst = $0000;
|
|
ntfsLogFileClientUnknown = $FFFF;
|
|
ntfsLogFileRestartFlagClean = $0002;
|
|
NTFS old log file size
ntfs*OldLogSize ntfsMaxOldLogSize = 10;
|
|
ntfsOldLogSizes:array[0..ntfsMaxOldLogSize] of TNTFSLogSize = (
| |
| DiskSize,LogSize | |
(DiskSize:8388608;LogSize:262144),
|
greater than 8MB, 256KB log |
(DiskSize:16777216;LogSize:262144),
|
greater than 16MB, 256KB log |
(DiskSize:33554432;LogSize:524288),
|
greater than 32MB, 512KB log (Previously 262144) |
(DiskSize:67108864;LogSize:1048576),
|
greater than 64MB, 1MB log (Previously 524288) |
(DiskSize:134217728;LogSize:2097152),
|
greater than 128MB, 2MB log (Previously 1048576) |
(DiskSize:268435456;LogSize:2097152),
|
greater than 256MB, 2MB log |
(DiskSize:536870912;LogSize:4194304),
|
greater than 512MB, 4MB log |
(DiskSize:1073741824;LogSize:8388608),
|
greater than 1GB, 8MB log |
(DiskSize:2147483648;LogSize:16777216),
|
greater than 2GB, 16MB log |
(DiskSize:4294967296;LogSize:33554432),
|
greater than 4GB, 32MB log |
(DiskSize:8589934592;LogSize:67108864));
|
greater than 8GB, 64MB log |
NTFS log file size
ntfs*LogSize ntfsMaxLogSize = 8;
|
|
ntfsLogSizes:array[0..ntfsMaxLogSize] of TNTFSLogSize = (
| |
| DiskSize,LogSize | |
(DiskSize:0;LogSize:2097152),
|
less than 128MB, 2MB log |
(DiskSize:134217728;LogSize:4194304),
|
greater than 128MB, 4MB log |
(DiskSize:268435456;LogSize:5242880),
|
greater than 256MB, 5MB log |
(DiskSize:536870912;LogSize:6291456),
|
greater than 512MB, 6MB log |
(DiskSize:805306368;LogSize:7340032),
|
greater than 768MB, 7MB log |
(DiskSize:1073741824;LogSize:8388608),
|
greater than 1GB, 8MB log |
(DiskSize:2147483648;LogSize:16777216),
|
greater than 2GB, 16MB log |
(DiskSize:4294967296;LogSize:33554432),
|
greater than 4GB, 32MB log |
(DiskSize:8589934592;LogSize:67108864));
|
greater than 8GB, 64MB log |
NTFS MFT/MFTMirr start
ntfsMftStart* ntfsMftStartCluster = 786432;
|
|
ntfsMftCutoverCount = 4194304;
|
4194304 * 4096 = 16GB (The point at which the MFT becomes fixed in location) |
NTFS file size
ntfsFileSize* ntfsFileSizeMft = ntfsUnknownCluster;
|
Variable size |
ntfsFileSizeMftMirr = ntfsUnknownCluster;
|
Variable size |
ntfsFileSizeLogFile = ntfsUnknownCluster;
|
Variable size |
ntfsFileSizeVolume = 0;
|
Constant size |
ntfsFileSize12AttrDef = 36864;
|
Constant size |
ntfsFileSize30AttrDef = 2560;
|
Constant size |
ntfsFileSize31AttrDef = 2560;
|
Constant size |
ntfsFileSizeRoot = ntfsUnknownCluster;
|
Variable size |
ntfsFileSizeBitmap = ntfsUnknownCluster;
|
Variable size |
ntfsFileSizeBoot = 8192;
|
Constant size |
ntfsFileSizeBadClus = 0;
|
Starting size |
ntfsFileSizeSecure = 0;
|
Constant size |
ntfsFileSizeUpCase = 131072;
|
Constant size |
ntfsFileSizeExtend = 0;
|
Constant size |
ntfsFileSizeObjId = 0;
|
Constant size |
ntfsFileSizeQuota = 0;
|
Constant size |
ntfsFileSizeReparse = 0;
|
Constant size |
ntfsFileSizeUsnJrnl = ntfsUnknownCluster;
|
Variable size |
NTFS stream size
ntfsStreamSize* ntfsStreamSizeSecurity = ntfsUnknownCluster;
|
Variable size |
ntfsStreamSizeBadClus = ntfsUnknownCluster;
|
Variable size |
ntfsStreamSizeMountMgr = ntfsUnknownCluster;
|
Variable size |
ntfsStreamSizeJournal = ntfsUnknownCluster;
|
Variable size |
ntfsStreamSizeJrnlMax = ntfsUnknownCluster;
|
Variable size |
NTFS header size
ntfs*HeaderSize* ntfsFileRecord12Size = 42;
|
Constant size |
ntfsFileRecord31Size = 48;
|
Constant size |
ntfsIndexRecordSize = 24;
|
Constant size |
ntfsIndexHeaderSize = 16;
|
Constant size |
ntfsIndexEntrySize = 16;
|
Minimum size |
ntfsAttributeTypeSize = 4;
|
Constant size |
ntfsAttributeHeaderSize = 16;
|
Minimum size |
ntfsResidentHeaderSize = 24;
|
Minimum size |
ntfsNonResidentHeaderSize = 64;
|
Minimum size |
ntfsCompressedHeaderSize = 72;
|
Minimum size |
NTFS attribute size
ntfsAttribute*Size | Minimum sizes | |
ntfsStandardInformation12Size = 48;
|
Constant size |
ntfsStandardInformation30Size = 72;
|
Constant size |
ntfsAttributeListSize = 0;
|
Variable size |
ntfsFileNameSize = 66;
|
Minimum size |
ntfsObjectIdSize = 16;
|
Minimum size |
ntfsObjectIdSize2 = 32;
|
Minimum size |
ntfsObjectIdSize3 = 48;
|
Minimum size |
ntfsObjectIdSize4 = 64;
|
Minimum size |
ntfsVolumeVersionSize = 8;
|
Constant size |
ntfsSecurityDescriptorSize = 0;
|
Variable size |
ntfsVolumeNameSize = 0;
|
Variable size |
ntfsVolumeInformationSize = 12;
|
Constant size |
ntfsDataSize = 0;
|
Variable size |
ntfsIndexRootSize = 16;
|
Constant size |
ntfsIndexAllocationSize = 0;
|
Variable size |
ntfsBitmapSize = 0;
|
Variable size |
ntfsReparsePointSize = 8;
|
Minimum size |
ntfsReparsePointMicrosoftSize = 8;
|
Minimum size |
ntfsReparsePointOtherSize = 24;
|
Minimum size |
ntfsSymbolicLinkSize = 0;
|
Variable size |
ntfsExtendedAttrInformationSize = 8;
|
Constant size |
ntfsExtendedAttrSize = 0;
|
Variable size |
ntfsPropertySetSize = 0;
|
Variable size |
ntfsLoggedUtilityStreamSize = 0;
|
Variable size |
ntfsUnknownSize = 0;
|
Variable size |
ntfsEndSize = 4;
|
Constant size |
NTFS data size
ntfs*Size | Minimum sizes | |
ntfsRunSize = 1;
|
Minimum size |
ntfsItemSize = 26;
|
Minimum size |
ntfsObjIdSize = 56;
|
Constant size |
ntfsQuotaSize = 48;
|
Minimum size |
ntfsOwnerSize = 4;
|
Constant size |
ntfsUpCaseSize = 131072;
|
Constant size |
ntfsAttrDefSize = 160;
|
Constant size |
ntfsReparseSize = 12;
|
Minimum size |
ntfsExtendedSize = 8;
|
Minimum size |
ntfsSecuritySize = 20;
|
Minimum size |
ntfsSidSize = 8;
|
Minimum size |
ntfsAclSize = 8;
|
Minimum size |
ntfsAceSize = 8;
|
Minimum size |
ntfsSecurityItemSize = 40;
|
Minimum size (Includes ntfsSecuritySize) |
ntfsSecurityIdSize = 20;
|
Minimum size |
ntfsSecurityHashSize = 20;
|
Minimum size (Previously 24 - Modified to remove Padding) |
NTFS key size
ntfs*KeySize | Minimum sizes | |
ntfsObjIdKeySize = 16;
|
Minimum size |
ntfsQuotaKeySize = 4;
|
Minimum size |
ntfsOwnerKeySize = 8;
|
Minimum size (Includes ntfsSidSize) |
ntfsSecurityIdKeySize = 4;
|
Minimum size |
ntfsSecurityHashKeySize = 8;
|
Minimum size |
ntfsReparseKeySize = 12;
|
Constant size (Not 16 even though CollateType is GUID) |
NTFS update sequence size
ntfsUpdateSequenceSize* ntfsUpdateSequenceSize = 512;
|
Constant size (Always 512 regardless of the sector size) |
NTFS sector count
ntfs*SectorCount | Used for NTFS formatting (Fixed Disk only) | |
ntfs12MaxSectorCount = 4;
|
|
ntfs12SectorCounts:array[0..ntfs12MaxSectorCount] of TNTFSSectorCount = (
| |
| SectorCount,SectorsPerCluster | |
(SectorCount:16384;SectorsPerCluster:0),
|
up to 8 MB, the 0 value for SectorsPerCluster trips an error |
(SectorCount:1048576;SectorsPerCluster:1),
|
up to 512 MB, sector size cluster |
(SectorCount:2097152;SectorsPerCluster:2),
|
up to 1 GB, 1k cluster |
(SectorCount:4194304;SectorsPerCluster:4),
|
up to 2 GB, 2k cluster |
(SectorCount:$FFFFFFFF;SectorsPerCluster:8));
|
greater than 2 GB, 4k cluster |
ntfs30MaxSectorCount = 4;
|
|
ntfs30SectorCounts:array[0..ntfs30MaxSectorCount] of TNTFSSectorCount = (
| |
| SectorCount,SectorsPerCluster | |
(SectorCount:16384;SectorsPerCluster:0),
|
up to 8 MB, the 0 value for SectorsPerCluster trips an error |
(SectorCount:1048576;SectorsPerCluster:1),
|
up to 512 MB, sector size cluster |
(SectorCount:2097152;SectorsPerCluster:2),
|
up to 1 GB, 1k cluster |
(SectorCount:4194304;SectorsPerCluster:4),
|
up to 2 GB, 2k cluster |
(SectorCount:$FFFFFFFF;SectorsPerCluster:8));
|
greater than 2 GB, 4k cluster |
Type definitions
NTFS attribute definition
TNTFSAttrDefine = record
| Note: Not Packed | |
AttributeType:LongWord;
|
|
AttributeName:String;
|
|
AttrDefFlags:LongWord;
|
|
MinimumSize:Int64;
|
|
MaximumSize:Int64;
|
|
NTFS uppercase conversion
TNTFSUpcaseConvert = record
| Note: Not Packed | |
Count:Word;
|
|
Value:Word;
|
|
NTFS sector count
TNTFSSectorCount = record
| Note: Not Packed (Fixed Disk only) | |
SectorCount:LongWord;
|
Based on 512 bytes per sector only |
SectorsPerCluster:LongWord;
|
|
NTFS log size
TNTFSLogSize = record
| Note: Not Packed | |
DiskSize:Int64;
|
|
LogSize:Int64;
|
|
NTFS default SID
PNTFSDefaultSid = ^TNTFSDefaultSid;
TNTFSDefaultSid = record
| Note: Not Packed | |
Sid:TWellKnownSidType;
|
|
NTFS default access control entry
TNTFSDefaultAce = record
| Note: Not Packed | |
AceType:Byte;
|
|
AceFlags:Byte;
|
|
AceSize:Word;
|
|
Mask:LongWord;
|
|
Sid:TWellKnownSidType;
|
|
NTFS default access control list
TNTFSDefaultAcl = record
| Note: Not Packed | |
AclRevision:Byte;
|
|
AclSize:Word;
|
|
AceCount:Word;
|
|
Aces:array[0..7] of TNTFSDefaultAce;
|
|
NTFS default descriptor
PNTFSDefaultDescriptor = ^TNTFSDefaultDescriptor;
TNTFSDefaultDescriptor = record
| Note: Not Packed | |
Size:LongWord;
|
|
Revision:Byte;
|
Revision |
Control:Word;
|
Control Flags |
OwnerOffset:LongWord;
|
Offset to Owner SID |
GroupOffset:LongWord;
|
Offset to Group SID |
SaclOffset:LongWord;
|
Offset to SACL |
DaclOffset:LongWord;
|
Offset to DACL |
Owner:TWellKnownSidType;
|
|
Group:TWellKnownSidType;
|
|
Sacl:TNTFSDefaultAcl;
|
|
Dacl:TNTFSDefaultAcl;
|
|
Public variables
NTFS specific variables
SecurityHashPadding:LongWord = ntfsSecurityHashPadding;
|
Function declarations
None defined
Return to Unit Reference
