TNTFSDiskRecord

From Ultibo.org
Revision as of 05:44, 24 May 2018 by Ultibo (Talk | contribs) (Created page with "Return to Unit NTFSClass __TOC__ === Description === ---- ''To be documented'' === Class definitions === ---- <div class="toccolours mw-collapsible m...")

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jump to: navigation, search

Return to Unit NTFSClass


Description


To be documented

Class definitions



TNTFSDiskRecord = class(TBtreeObject)

Note: Represents a FILE record entry.
 
constructor Create(ALocalLock:TMutexHandle; ABase:TNTFSDiskRecord);  
destructor Destroy; override;  
private
FLocalLock:TMutexHandle;  
 
FRunsLock:TSynchronizerHandle;  
FItemsLock:TSynchronizerHandle;  
FNodesLock:TSynchronizerHandle;  
FIndexLock:TSynchronizerHandle;  
FExtendedsLock:TSynchronizerHandle;  
FAttributesLock:TSynchronizerHandle;  
 
FRunLocal:TMutexHandle;  
FItemLocal:TMutexHandle;  
FKeyLocal:TMutexHandle;  
FNodeLocal:TMutexHandle;  
FExtendedLocal:TMutexHandle;  
FAttributeLocal:TMutexHandle;  
 
FStatus:LongWord;  
 
FPrevRecord:TNTFSDiskRecord;  
FNextRecord:TNTFSDiskRecord;  
 
FRecordFlags:Word; Flags (See Consts)
FHardLinkCount:Word; Hard link count
FSequenceNumber:Word; Sequence number
FNextAttributeId:Word; Next Attribute Id
FRecordNumber:Int64; Number of this MFT Record
FRecordSize:LongWord; Actual size of the FILE record
FRecordAllocated:LongWord; Allocated size of the FILE record
 
FAttributeOffset:Word; Offset to the first Attribute
FUpdateSequenceOffset:Word; Offset to the Update Sequence Record
FUpdateSequenceLength:Word; Size in words of the Update Sequence Record
 
FUpdateSequenceNumber:Word; Update Sequence Number
FLogFileSequenceNumber:Int64; LogFile Sequence Number (LSN)
 
FBase:TNTFSDiskRecord; Base file record
FLinks:TNTFSEntryList; List of record links
FStreams:TNTFSEntryList; List of record streams
FRecords:TNTFSRecordList; List of child records
FAttributes:TNTFSDiskAttributes; List of record attributes
 
function AcquireLock:Boolean;  
function ReleaseLock:Boolean;  
 
function GetResizing:Boolean;  
procedure SetResizing(AValue:Boolean);  
function GetRemoving:Boolean;  
procedure SetRemoving(AValue:Boolean);  
 
function GetMirrored:Boolean;  
procedure SetMirrored(AValue:Boolean);  
function GetMetafile:Boolean;  
procedure SetMetafile(AValue:Boolean);  
function GetReserved:Boolean;  
procedure SetReserved(AValue:Boolean);  
function GetExpansion:Boolean;  
procedure SetExpansion(AValue:Boolean);  
 
function GetOverflow:Boolean;  
procedure SetOverflow(AValue:Boolean);  
function GetExtension:Boolean;  
procedure SetExtension(AValue:Boolean);  
 
function GetIsUsed:Boolean;  
procedure SetIsUsed(AValue:Boolean);  
function GetIsFolder:Boolean;  
procedure SetIsFolder(AValue:Boolean);  
function GetIsUnknown1:Boolean;  
procedure SetIsUnknown1(AValue:Boolean);  
function GetIsIndexView:Boolean;  
procedure SetIsIndexView(AValue:Boolean);  
 
function GetOrigin:TNTFSDiskRecord;  
 
function CreateLinks(ANew:Boolean):TNTFSEntryList;  
function CreateStreams(ANew:Boolean):TNTFSEntryList;  
function CreateRecords(ANew:Boolean):TNTFSRecordList;  
function CreateAttributes(AVersion:Word; ANew:Boolean):TNTFSDiskAttributes;  
public
property Resizing:Boolean read GetResizing write SetResizing; Record is being Resized
property Removing:Boolean read GetRemoving write SetRemoving; Record is being Removed
 
property Mirrored:Boolean read GetMirrored write SetMirrored; Record is in $MftMirr file
property Metafile:Boolean read GetMetafile write SetMetafile; Record is an NTFS metafile
property Reserved:Boolean read GetReserved write SetReserved; Record is an Mft reserved record
property Expansion:Boolean read GetExpansion write SetExpansion; Record is an Mft expansion record
 
property Overflow:Boolean read GetOverflow write SetOverflow; Record has an attribute list attribute
property Extension:Boolean read GetExtension write SetExtension; Record is an extension of the base record
 
property PrevRecord:TNTFSDiskRecord read FPrevRecord write FPrevRecord;  
property NextRecord:TNTFSDiskRecord read FNextRecord write FNextRecord;  
 
property IsUsed:Boolean read GetIsUsed write SetIsUsed; Record is in use
property IsFolder:Boolean read GetIsFolder write SetIsFolder; Record is a folder
property IsUnknown1:Boolean read GetIsUnknown1 write SetIsUnknown1;
property IsIndexView:Boolean read GetIsIndexView write SetIsIndexView; Record is an index view
 
property RecordFlags:Word read FRecordFlags write FRecordFlags;  
property HardLinkCount:Word read FHardLinkCount write FHardLinkCount;  
property SequenceNumber:Word read FSequenceNumber write FSequenceNumber;  
property NextAttributeId:Word read FNextAttributeId write FNextAttributeId;  
property RecordNumber:Int64 read FRecordNumber write FRecordNumber;  
property RecordSize:LongWord read FRecordSize write FRecordSize;  
property RecordAllocated:LongWord read FRecordAllocated write FRecordAllocated;  
 
property AttributeOffset:Word read FAttributeOffset write FAttributeOffset;  
property UpdateSequenceOffset:Word read FUpdateSequenceOffset write FUpdateSequenceOffset;  
property UpdateSequenceLength:Word read FUpdateSequenceLength write FUpdateSequenceLength;  
 
property UpdateSequenceNumber:Word read FUpdateSequenceNumber write FUpdateSequenceNumber;  
property LogFileSequenceNumber:Int64 read FLogFileSequenceNumber write FLogFileSequenceNumber;  
 
property Base:TNTFSDiskRecord read FBase write FBase;  
property Links:TNTFSEntryList read FLinks;  
property Streams:TNTFSEntryList read FStreams;  
property Records:TNTFSRecordList read FRecords;  
property Attributes:TNTFSDiskAttributes read FAttributes;  
 
property Origin:TNTFSDiskRecord read GetOrigin;  
 
function CreateLink(AAttribute,AAlternate:TNTFSDiskAttribute; ANew:Boolean):TNTFSDiskEntry;  
function DestroyLink(ALink:TNTFSDiskEntry):Boolean;  
function NewLink(AAttribute,AAlternate:TNTFSDiskAttribute):TNTFSDiskEntry;  
function GetLink(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;  
function DeleteLink(ALink:TNTFSDiskEntry):Boolean;  
function RenameLink(ALink:TNTFSDiskEntry; AAttribute,AAlternate:TNTFSDiskAttribute):Boolean;  
 
function CreateStream(AAttribute:TNTFSDiskAttribute; ANew:Boolean):TNTFSDiskEntry;  
function DestroyStream(AStream:TNTFSDiskEntry):Boolean;  
function NewStream(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;  
function GetStream(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;  
function DeleteStream(AStream:TNTFSDiskEntry):Boolean;  
 
function GetFileNameByKey(AKey:TNTFSAttributeKey):TNTFSDiskAttribute;  
function GetFileNameByName(const AName:String; AInstance:Integer):TNTFSDiskAttribute;  
function GetFileNameByParent(const AName:String; const AParent:Int64; AInstance:Integer):TNTFSDiskAttribute;  
function GetFileNameByNameSpace(const AName:String; const AParent:Int64; ANameSpace:Byte; AInstance:Integer):TNTFSDiskAttribute;  
 
function GetRecord(AInstance:Integer):TNTFSDiskRecord;  
function GetRecordByFree(AFree:LongWord; AExclude:Boolean):TNTFSDiskRecord;  
function GetRecordByReference(const AFileReference:Int64):TNTFSDiskRecord;  
 
function AddRecord(ARecord:TNTFSDiskRecord):Boolean;  
function RemoveRecord(ARecord:TNTFSDiskRecord):Boolean;  
 
function GetAttributeByItem(AItem:TNTFSDiskItem):TNTFSDiskAttribute;  
function GetAttributeByStatus(AInclude,AExclude:Word; AInstance:Integer):TNTFSDiskAttribute;  
function GetAttributeByVCN(AAttribute:TNTFSDiskAttribute; const AVCN:Int64; var AInstance:LongWord):TNTFSDiskAttribute;  
function GetAttributeByUnit(AAttribute:TNTFSDiskAttribute; const AUnit:Int64; var AInstance:LongWord):TNTFSDiskAttribute;  
 
function CreateAttribute(AType:LongWord; AVersion:Word; ANew:Boolean):TNTFSDiskAttribute;  
function DestroyAttribute(AAttribute:TNTFSDiskAttribute):Boolean;  
function NewAttribute(APrevious:TNTFSDiskAttribute; AType:LongWord; const AName:String; AVersion:Word):TNTFSDiskAttribute;  
function GetAttribute(AType:LongWord; const AName:String; AInstance:Integer):TNTFSDiskAttribute;  
function RemoveAttribute(AAttribute:TNTFSDiskAttribute):Boolean;  
function MoveAttribute(ADest:TNTFSDiskRecord; AAttribute:TNTFSDiskAttribute):Boolean;  
function RenameAttribute(AAttribute:TNTFSDiskAttribute; const AName:String):Boolean;  
 
function FileReference:Int64;  
function BaseReference:Int64; File reference to the base FILE record
 
function LinkCount:LongWord;  
function StreamCount:LongWord;  
function RecordCount:LongWord;  
function AttributeCount:LongWord;  
 
function RecordFree:LongWord;  
function AttributeSize(AVersion:Word; AType:LongWord):LongWord;  
 
function CalculatedSize(AVersion:Word):LongWord;  
function CalculatedOffset(AVersion:Word):Word;  
function CalculatedSequenceOffset(AVersion:Word):Word;  
function CalculatedSequenceLength(ASectorSize:Word):Word;  
function CalculatedStreamUsed(AVersion:Word; AAttribute:TNTFSDiskAttribute):Int64;  
 
function ReadAttributes(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
function WriteAttributes(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  
 
function ReadRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word; AFree:Boolean):Boolean;  
function WriteRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;  


Function declarations



constructor TNTFSDiskRecord.Create(ALocalLock:TMutexHandle; ABase:TNTFSDiskRecord);
Description: To be documented
Note None documented


destructor TNTFSDiskRecord.Destroy;
Description: To be documented
Note None documented


function TNTFSDiskRecord.AcquireLock:Boolean;
Description: To be documented
Note None documented


function TNTFSDiskRecord.ReleaseLock:Boolean;
Description: To be documented
Note None documented


function TNTFSDiskRecord.GetResizing:Boolean;
Description: To be documented
Note None documented


procedure TNTFSDiskRecord.SetResizing(AValue:Boolean);
Description: To be documented
Note None documented


function TNTFSDiskRecord.GetRemoving:Boolean;
Description: To be documented
Note None documented


procedure TNTFSDiskRecord.SetRemoving(AValue:Boolean);
Description: To be documented
Note None documented


function TNTFSDiskRecord.GetMirrored:Boolean;
Description: To be documented
Note None documented


procedure TNTFSDiskRecord.SetMirrored(AValue:Boolean);
Description: To be documented
Note None documented


function TNTFSDiskRecord.GetMetafile:Boolean;
Description: To be documented
Note None documented


procedure TNTFSDiskRecord.SetMetafile(AValue:Boolean);
Description: To be documented
Note None documented


function TNTFSDiskRecord.GetReserved:Boolean;
Description: To be documented
Note None documented


procedure TNTFSDiskRecord.SetReserved(AValue:Boolean);
Description: To be documented
Note None documented


function TNTFSDiskRecord.GetExpansion:Boolean;
Description: To be documented
Note None documented


procedure TNTFSDiskRecord.SetExpansion(AValue:Boolean);
Description: To be documented
Note None documented


function TNTFSDiskRecord.GetOverflow:Boolean;
Description: To be documented
Note None documented


procedure TNTFSDiskRecord.SetOverflow(AValue:Boolean);
Description: To be documented
Note None documented


function TNTFSDiskRecord.GetExtension:Boolean;
Description: To be documented
Note None documented


procedure TNTFSDiskRecord.SetExtension(AValue:Boolean);
Description: To be documented
Note None documented


function TNTFSDiskRecord.GetIsUsed:Boolean;
Description: To be documented
Note None documented


procedure TNTFSDiskRecord.SetIsUsed(AValue:Boolean);
Description: To be documented
Note None documented


function TNTFSDiskRecord.GetIsFolder:Boolean;
Description: To be documented
Note None documented


procedure TNTFSDiskRecord.SetIsFolder(AValue:Boolean);
Description: To be documented
Note None documented


function TNTFSDiskRecord.GetIsUnknown1:Boolean;
Description: To be documented
Note None documented


procedure TNTFSDiskRecord.SetIsUnknown1(AValue:Boolean);
Description: To be documented
Note None documented


function TNTFSDiskRecord.GetIsIndexView:Boolean;
Description: To be documented
Note None documented


procedure TNTFSDiskRecord.SetIsIndexView(AValue:Boolean);
Description: To be documented
Note None documented


function TNTFSDiskRecord.GetOrigin:TNTFSDiskRecord;
Description: To be documented
Note As attribute list must be in origin, Base (if not nil) will always be the origin record.


function TNTFSDiskRecord.CreateLinks(ANew:Boolean):TNTFSEntryList;
Description: To be documented
Note None documented


function TNTFSDiskRecord.CreateStreams(ANew:Boolean):TNTFSEntryList;
Description: To be documented
Note None documented


function TNTFSDiskRecord.CreateRecords(ANew:Boolean):TNTFSRecordList;
Description: To be documented
Note None documented


function TNTFSDiskRecord.CreateAttributes(AVersion:Word; ANew:Boolean):TNTFSDiskAttributes;
Description: To be documented
Note None documented


function TNTFSDiskRecord.CreateLink(AAttribute,AAlternate:TNTFSDiskAttribute; ANew:Boolean):TNTFSDiskEntry;
Description: Create a link, add to list do not update Record
Note Request is propogated to base record to contain all links within one record


function TNTFSDiskRecord.DestroyLink(ALink:TNTFSDiskEntry):Boolean;
Description: Remove the link from list and free but do not update record
Note Request is propogated to base record to contain all links within one record


function TNTFSDiskRecord.NewLink(AAttribute,AAlternate:TNTFSDiskAttribute):TNTFSDiskEntry;
Description: Create a link, add to list and update Record
Note Request is propogated to base record to contain all links within one record


function TNTFSDiskRecord.GetLink(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;
Description: Request is propogated to base record to contain all links within one record
Note None documented


function TNTFSDiskRecord.DeleteLink(ALink:TNTFSDiskEntry):Boolean;
Description: Remove the link from list and update record but do not free
Note Request is propogated to base record to contain all links within one record


function TNTFSDiskRecord.RenameLink(ALink:TNTFSDiskEntry; AAttribute,AAlternate:TNTFSDiskAttribute):Boolean;
Description: Update the link with new attribute and alternate and update Record
Note Request is propogated to base record to contain all links within one record


function TNTFSDiskRecord.CreateStream(AAttribute:TNTFSDiskAttribute; ANew:Boolean):TNTFSDiskEntry;
Description: Create a stream, add to list do not update Record
Note Request is propogated to base record to contain all streams within one record


function TNTFSDiskRecord.DestroyStream(AStream:TNTFSDiskEntry):Boolean;
Description: Remove the stream from list and free but do not update record
Note Request is propogated to base record to contain all streams within one record


function TNTFSDiskRecord.NewStream(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;
Description: Create a stream, add to list and update Record
Note Request is propogated to base record to contain all streams within one record


function TNTFSDiskRecord.GetStream(AAttribute:TNTFSDiskAttribute):TNTFSDiskEntry;
Description: To be documented
Note Request is propogated to base record to contain all streams within one record


function TNTFSDiskRecord.DeleteStream(AStream:TNTFSDiskEntry):Boolean;
Description: Remove the stream from list and update record but do not free
Note Request is propogated to base record to contain all streams within one record


function TNTFSDiskRecord.GetFileNameByKey(AKey:TNTFSAttributeKey):TNTFSDiskAttribute;
Description: Get the attribute referenced by the supplied key (Checks base and extension records)
Note None documented


function TNTFSDiskRecord.GetFileNameByName(const AName:String; AInstance:Integer):TNTFSDiskAttribute;
Description: Get the attribute referenced by the supplied name (Checks base and extension records)
Note None documented


function TNTFSDiskRecord.GetFileNameByParent(const AName:String; const AParent:Int64; AInstance:Integer):TNTFSDiskAttribute;
Description: Get the attribute referenced by the supplied name and parent (Checks base and extension records)
Note None documented


function TNTFSDiskRecord.GetFileNameByNameSpace(const AName:String; const AParent:Int64; ANameSpace:Byte; AInstance:Integer):TNTFSDiskAttribute;
Description: Get the attribute referenced by the supplied name, parent and namespace (Checks base and extension records)
Note None documented


function TNTFSDiskRecord.GetRecord(AInstance:Integer):TNTFSDiskRecord;
Description: To be documented
Note Request is propogated to base record to allow search of all records


function TNTFSDiskRecord.GetRecordByFree(AFree:LongWord; AExclude:Boolean):TNTFSDiskRecord;
Description: To be documented
Note None documented


function TNTFSDiskRecord.GetRecordByReference(const AFileReference:Int64):TNTFSDiskRecord;
Description: To be documented
Note None documented


function TNTFSDiskRecord.AddRecord(ARecord:TNTFSDiskRecord):Boolean;
Description: To be documented
Note None documented


function TNTFSDiskRecord.RemoveRecord(ARecord:TNTFSDiskRecord):Boolean;
Description: To be documented
Note None documented


function TNTFSDiskRecord.GetAttributeByItem(AItem:TNTFSDiskItem):TNTFSDiskAttribute;
Description: To be documented
Note Get the attribute referenced by the supplied item (Checks current record only as the match is only unique per record)


function TNTFSDiskRecord.GetAttributeByStatus(AInclude,AExclude:Word; AInstance:Integer):TNTFSDiskAttribute;
Description: Get the next attribute whose status matches the supplied masks
Note None documented


function TNTFSDiskRecord.GetAttributeByVCN(AAttribute:TNTFSDiskAttribute; const AVCN:Int64; var AInstance:LongWord):TNTFSDiskAttribute;
Description: Get the attribute containing the supplied vcn, passed attribute supplies the name and type
Note Instance can be passed and will form the starting point, otherwise start at one.

Passed attribute can be any instance of a multiple instance attribute


function TNTFSDiskRecord.GetAttributeByUnit(AAttribute:TNTFSDiskAttribute; const AUnit:Int64; var AInstance:LongWord):TNTFSDiskAttribute;
Description: Get the attribute containing the supplied compression unit, passed attribute supplies the name, type and unit size
Note Instance can be passed and will form the starting point, otherwise start at one.

Passed attribute can be any instance of a multiple instance attribute


function TNTFSDiskRecord.CreateAttribute(AType:LongWord; AVersion:Word; ANew:Boolean):TNTFSDiskAttribute;
Description: Create an attribute, add to end of list do not update record
Note List of Attributes is per Record (Do not propogate request to base)


function TNTFSDiskRecord.DestroyAttribute(AAttribute:TNTFSDiskAttribute):Boolean;
Description: Remove the atttribute from the list and free, do not update record
Note List of Attributes is per Record (Propogate request to parent if not self)


function TNTFSDiskRecord.NewAttribute(APrevious:TNTFSDiskAttribute; AType:LongWord; const AName:String; AVersion:Word):TNTFSDiskAttribute;
Description: Create an attribute, insert in sorted list and update record
Note List of Attributes is per Record (Do not propogate request to base)


function TNTFSDiskRecord.GetAttribute(AType:LongWord; const AName:String; AInstance:Integer):TNTFSDiskAttribute;
Description: To be documented
Note Request is propogated to base record to allow search of all attributes


function TNTFSDiskRecord.RemoveAttribute(AAttribute:TNTFSDiskAttribute):Boolean;
Description: Remove the attribute from the list, free and update record
Note List of Attributes is per Record (Propogate request to parent if not self)


function TNTFSDiskRecord.MoveAttribute(ADest:TNTFSDiskRecord; AAttribute:TNTFSDiskAttribute):Boolean;
Description: Remove the attribute from the list and insert in the list of the dest record
Note List of Attributes is per Record (Propogate request to parent if not self)


function TNTFSDiskRecord.RenameAttribute(AAttribute:TNTFSDiskAttribute; const AName:String):Boolean;
Description: Remove the attribute from the list and reinsert in the list with the new name
Note List of Attributes is per Record (Propogate request to parent if not self)


function TNTFSDiskRecord.FileReference:Int64;
Description: Build a File Reference from the RecordNumber and SequenceNumber
Note None documented


function TNTFSDiskRecord.BaseReference:Int64;
Description: To be documented
Note Returns zero when no base record is assigned (ie current record is the base)


function TNTFSDiskRecord.LinkCount:LongWord;
Description: To be documented
Note None documented


function TNTFSDiskRecord.StreamCount:LongWord;
Description: To be documented
Note None documented


function TNTFSDiskRecord.RecordCount:LongWord;
Description: To be documented
Note None documented


function TNTFSDiskRecord.AttributeCount:LongWord;
Description: To be documented
Note None documented


function TNTFSDiskRecord.RecordFree:LongWord;
Description: Determine the free space remaining in the record
Note None documented


function TNTFSDiskRecord.AttributeSize(AVersion:Word; AType:LongWord):LongWord;
Description: Determine the maximum size of this type of attribute in this record
Note None documented


function TNTFSDiskRecord.CalculatedSize(AVersion:Word):LongWord;
Description: To be documented
Note Calculated Size includes any rounding required for alignment


function TNTFSDiskRecord.CalculatedOffset(AVersion:Word):Word;
Description: Determine the attribute offset for this record based on version
Note None documented


function TNTFSDiskRecord.CalculatedSequenceOffset(AVersion:Word):Word;
Description: Determine the update sequence offset for this record based on version
Note None documented


function TNTFSDiskRecord.CalculatedSequenceLength(ASectorSize:Word):Word;
Description: Determine the update sequence length for this record based on sector size
Note Sequence Length is the number of Words in the update sequence array


function TNTFSDiskRecord.CalculatedStreamUsed(AVersion:Word; AAttribute:TNTFSDiskAttribute):Int64;
Description: Calculated Stream Used is the actual allocated size of the data stream in a compressed attribute
Note This will be the same as the Data Size value for Resident but will be the total allocated runs (Non Sparse) for Non Resident

Size Attribute will use this value to update Stream Used


function TNTFSDiskRecord.ReadAttributes(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
Description: Read the record attributes from the supplied buffer at the supplied offset
Note None documented


function TNTFSDiskRecord.WriteAttributes(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
Description: Write the record attributes to the supplied buffer at the supplied offset
Note None documented


function TNTFSDiskRecord.ReadRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word; AFree:Boolean):Boolean;
Description: Read the entry record from the supplied buffer at the supplied offset
Note A Free (but available) record will consist of just the USN in place of the Magic Number and Fixup values at the end of each sector in the record


function TNTFSDiskRecord.WriteRecord(ABuffer:Pointer; var AOffset,ASize:LongWord; AVersion:Word):Boolean;
Description: Write the file record to the supplied buffer at the supplied offset
Note None documented


Return to Unit Reference