Changes by: uvman
Update of /cvs/linux-ntfs/ntfsdocs
In directory delta357.server4you.de:/tmp/cvs-serv1077
Modified Files:
concepts.xml
Log Message:
programlisting conversions, encryption overview, interix special files
Index: concepts.xml
===================================================================
RCS file: /cvs/linux-ntfs/ntfsdocs/concepts.xml,v
retrieving revision 1.4
retrieving revision 1.5
diff -u -p -r1.4 -r1.5
--- concepts.xml 23 Oct 2005 23:03:44 -0000 1.4
+++ concepts.xml 2 Jun 2006 12:12:46 -0000 1.5
@@ -84,6 +84,14 @@
</row>
<row>
<entry>
+ <link linkend="concept_encryption">Encryption</link>
+ </entry>
+ <entry>
+ <link linkend="concept_encryption">Encryption</link>
+ </entry>
+ </row>
+ <row>
+ <entry>
<link linkend="concept_file">File</link>
</entry>
<entry>
@@ -140,6 +148,15 @@
</row>
<row>
<entry>
+ <link linkend="concept_interix_special_files">Interix Special Files</link>
+ </entry>
+ <entry>
+ <link linkend="concept_interix_special_files">FIFOs, sockets, symbolic links, char,
+ block.</link>
+ </entry>
+ </row>
+ <row>
+ <entry>
<link linkend="concept_links">Links</link>
</entry>
<entry>
@@ -245,9 +262,9 @@
<table>
<title>Layout of an ACE</title>
<tgroup cols="3">
- <colspec colname="Offset"/>
- <colspec colname="Size"/>
- <colspec colname="Description"/>
+ <colspec colname="Offset" colwidth="1*"/>
+ <colspec colname="Size" colwidth="1*"/>
+ <colspec colname="Description" colwidth="3*"/>
<thead>
<row>
<entry>Offset</entry>
@@ -285,69 +302,81 @@
</tgroup>
</table>
<section>
- <title>Types</title>
- <para>The currently implemented (in NT) Types are:</para>
+ <title>Type</title>
+ <para>The possible ACE Types (in win2k) are:</para>
<table>
<title>ACE types</title>
- <tgroup cols="2">
- <colspec colname="Value"/>
- <colspec colname="Description"/>
+ <tgroup cols="3">
+ <colspec colname="Value" colwidth="1*"/>
+ <colspec colname="Minimal Version" colwidth="1*"/>
+ <colspec colname="Description" colwidth="3*"/>
<thead>
<row>
<entry>Value</entry>
+ <entry>Minimal ACE Version</entry>
<entry>Description</entry>
</row>
</thead>
<tbody>
<row>
<entry>0x00</entry>
- <entry>Access Allowed</entry>
+ <entry>2</entry>
+ <entry>Access Allowed (ACCESS_ALLOWED_ACE_TYPE)</entry>
</row>
<row>
<entry>0x01</entry>
- <entry>Access Denied</entry>
+ <entry>2</entry>
+ <entry>Access Denied (ACCESS_DENIED_ACE_TYPE)</entry>
</row>
<row>
<entry>0x02</entry>
- <entry>System Audit</entry>
+ <entry>2</entry>
+ <entry>System Audit (SYSTEM_AUDIT_ACE_TYPE)</entry>
+ </row>
+ <row>
+ <entry>0x03</entry>
+ <entry>2</entry>
+ <entry>System Alarm (SYSTEM_ALARM_ACE_TYPE) (a)</entry>
+ </row>
+ <row>
+ <entry>0x04</entry>
+ <entry>3</entry>
+ <entry>Access Allowed (ACCESS_ALLOWED_COMPOUND_ACE_TYPE)</entry>
+ </row>
+ <row>
+ <entry>0x05</entry>
+ <entry>4</entry>
+ <entry>ACCESS_ALLOWED_OBJECT_ACE_TYPE (b)</entry>
+ </row>
+ <row>
+ <entry>0x06</entry>
+ <entry>4</entry>
+ <entry>ACCESS_DENIED_OBJECT_ACE_TYPE (b)</entry>
+ </row>
+ <row>
+ <entry>0x07</entry>
+ <entry>4</entry>
+ <entry>SYSTEM_AUDIT_OBJECT_ACE_TYPE (b)</entry>
+ </row>
+ <row>
+ <entry>0x08</entry>
+ <entry>4</entry>
+ <entry>SYSTEM_ALARM_OBJECT_ACE_TYPE (b)</entry>
</row>
</tbody>
</tgroup>
</table>
- <programlisting>
- ACE Types
- ACCESS_MIN_MS_ACE_TYPE = 0
- ACCESS_ALLOWED_ACE_TYPE = 0
- ACCESS_DENIED_ACE_TYPE = 1
- SYSTEM_AUDIT_ACE_TYPE = 2
- SYSTEM_ALARM_ACE_TYPE = 3 Not implemented as of Win2k.
- ACCESS_MAX_MS_V2_ACE_TYPE = 3
-
- ACCESS_ALLOWED_COMPOUND_ACE_TYPE = 4
- ACCESS_MAX_MS_V3_ACE_TYPE = 4
-
- The following are Win2k only.
- ACCESS_MIN_MS_OBJECT_ACE_TYPE = 5
- ACCESS_ALLOWED_OBJECT_ACE_TYPE = 5
- ACCESS_DENIED_OBJECT_ACE_TYPE = 6
- SYSTEM_AUDIT_OBJECT_ACE_TYPE = 7
- SYSTEM_ALARM_OBJECT_ACE_TYPE = 8
- ACCESS_MAX_MS_OBJECT_ACE_TYPE = 8
-
- ACCESS_MAX_MS_V4_ACE_TYPE = 8
-
- This one is for WinNT&2k.
- ACCESS_MAX_MS_ACE_TYPE = 8
- </programlisting>
+ <para>(a) Not implemented as of Win2k</para>
+ <para>(b) Win2k only (maybe Win2k+ ?)</para>
</section>
<section>
- <title>Flags</title>
+ <title>Inheritance Flags</title>
<para>Flags is a bit field. The possible values of Flags depend on the value of Type. When applied to a directory, Access Allowed or Access Denied can have flags of</para>
<table>
- <title>ACE flags</title>
+ <title>Access Allowed or Access Denied ACE flags</title>
<tgroup cols="2">
- <colspec colname="Value"/>
- <colspec colname="Description"/>
+ <colspec colname="Value" colwidth="1*"/>
+ <colspec colname="Description" colwidth="4*"/>
<thead>
<row>
<entry>Value</entry>
@@ -357,29 +386,34 @@
<tbody>
<row>
<entry>0x01</entry>
- <entry>Object inherits ACE</entry>
+ <entry>Object inherits ACE (OBJECT_INHERIT_ACE)</entry>
</row>
<row>
<entry>0x02</entry>
- <entry>Container inherits ACE</entry>
+ <entry>Container inherits ACE (CONTAINER_INHERIT_ACE)</entry>
</row>
<row>
<entry>0x04</entry>
- <entry>Don't propagate 'Inherit ACE'</entry>
+ <entry>Don't propagate 'Inherit ACE' (NO_PROPAGATE_INHERIT_ACE)</entry>
</row>
<row>
<entry>0x08</entry>
- <entry>Inherit only ACE</entry>
+ <entry>Inherit only ACE (INHERIT_ONLY_ACE)</entry>
+ </row>
+ <row>
+ <entry>0x10</entry>
+ <entry>Inherit only ACE (INHERITED_ACE) (a)</entry>
</row>
</tbody>
</tgroup>
</table>
- <para>If the Type is System Audit, then the flags can be</para>
+ <para>(a) Only Win2k (maybe win2k+ ?)</para>
+ <para>If the Type is System Audit or System Alarm, then the flags can be</para>
<table>
<title>ACE audit flags</title>
<tgroup cols="2">
- <colspec colname="Value"/>
- <colspec colname="Description"/>
+ <colspec colname="Value" colwidth="1*"/>
+ <colspec colname="Description" colwidth="4*"/>
<thead>
<row>
<entry>Value</entry>
@@ -389,37 +423,15 @@
<tbody>
<row>
<entry>0x40</entry>
- <entry>Audit on Success</entry>
+ <entry>Audit on Success (SUCCESSFUL_ACCESS_ACE_FLAG). If this flag is set, Each successful access should be logged.</entry>
</row>
<row>
<entry>0x80</entry>
- <entry>Audit on Failure</entry>
+ <entry>Audit on Failure (FAILED_ACCESS_ACE_FLAG). If this flag is set, Each failed access should be logged.</entry>
</row>
</tbody>
</tgroup>
</table>
- <programlisting>
- The ACE flags (8-bit) for audit and inheritance
-
- SUCCESSFUL_ACCESS_ACE_FLAG is only used with system audit and alarm ACE
- types to indicate that a message is generated (in Windows!) for successful
- accesses.
-
- FAILED_ACCESS_ACE_FLAG is only used with system audit and alarm ACE types
- to indicate that a message is generated (in Windows!) for failed accesses.
-
- The inheritance flags.
- OBJECT_INHERIT_ACE = 0x01
- CONTAINER_INHERIT_ACE = 0x02
- NO_PROPAGATE_INHERIT_ACE = 0x04
- INHERIT_ONLY_ACE = 0x08
- INHERITED_ACE = 0x10 Win2k only
- VALID_INHERIT_FLAGS = 0x1f
-
- The audit flags.
- SUCCESSFUL_ACCESS_ACE_FLAG = 0x40
- FAILED_ACCESS_ACE_FLAG = 0x80
- </programlisting>
</section>
<section>
<title>Access Mask / Access Rights</title>
@@ -429,7 +441,7 @@
<tgroup cols="3">
<colspec colname="Bit(Range)" colwidth="1*"/>
<colspec colname="Meaning" colwidth="2*"/>
- <colspec colname="Description / Examples" colwidth="2*"/>
+ <colspec colname="Description / Examples" colwidth="3*"/>
<thead>
<row>
<entry>Bit(Range)</entry>
@@ -529,11 +541,23 @@
ACL_REVISION3 = 3
ACL_REVISION4 = 4
MAX_ACL_REVISION = 4
+
+ ACE Types
+ ACCESS_MIN_MS_ACE_TYPE = 0
+ ACCESS_MAX_MS_V2_ACE_TYPE = 3
+ ACCESS_MAX_MS_V3_ACE_TYPE = 4
+ The following are Win2k only.
+ ACCESS_MIN_MS_OBJECT_ACE_TYPE = 5
+ ACCESS_MAX_MS_OBJECT_ACE_TYPE = 8
+ ACCESS_MAX_MS_V4_ACE_TYPE = 8
+ ACCESS_MAX_MS_ACE_TYPE = 8
+
+ VALID_INHERIT_FLAGS = 0x1f
</programlisting>
</section>
</section>
</section>
- <section id="concept_attribute_header">
+ <section id="concept_attribute_header"> <!-- todo: unite resident named and unnamed -->
<title>Concept - Attribute Header</title>
<section>
<title>Overview</title>
@@ -741,143 +765,17 @@
<para>(c) Rounded up to a multiple of 4 bytes.</para>
</section>
<section>
- <title>Non-Resident, No Name</title>
- <table>
- <title>Layout of a non-resident unnamed attribute header</title>
- <tgroup cols="4">
- <colspec colname="Offset" colwidth="1*"/>
- <colspec colname="Size" colwidth="1*"/>
- <colspec colname="Value" colwidth="1*"/>
- <colspec colname="Description" colwidth="3*"/>
- <thead>
- <row>
- <entry>Offset</entry>
- <entry>Size</entry>
- <entry>Value</entry>
- <entry>Description</entry>
- </row>
- </thead>
- <tbody>
- <row>
- <entry>0x00</entry>
- <entry>4</entry>
- <entry/>
- <entry>Attribute Type (e.g. 0x20, 0x80)</entry>
- </row>
- <row>
- <entry>0x04</entry>
- <entry>4</entry>
- <entry/>
- <entry>Length (including this header)</entry>
- </row>
- <row>
- <entry>0x08</entry>
- <entry>1</entry>
- <entry>0x01</entry>
- <entry>Non-resident flag</entry>
- </row>
- <row>
- <entry>0x09</entry>
- <entry>1</entry>
- <entry>0x00</entry>
- <entry>Name length</entry>
- </row>
- <row>
- <entry>0x0A</entry>
- <entry>2</entry>
- <entry>0x00</entry>
- <entry>Offset to the Name</entry>
- </row>
- <row>
- <entry>0x0C</entry>
- <entry>2</entry>
- <entry/>
- <entry>Flags</entry>
- </row>
- <row>
- <entry>0x0E</entry>
- <entry>2</entry>
- <entry/>
- <entry>Attribute Id (a)</entry>
- </row>
- <row>
- <entry>0x10</entry>
- <entry>8</entry>
- <entry/>
- <entry>Starting VCN</entry>
- </row>
- <row>
- <entry>0x18</entry>
- <entry>8</entry>
- <entry/>
- <entry>Last VCN</entry>
- </row>
- <row>
- <entry>0x20</entry>
- <entry>2</entry>
- <entry>0x40</entry>
- <entry>Offset to the Data Runs</entry>
- </row>
- <row>
- <entry>0x22</entry>
- <entry>2</entry>
- <entry/>
- <entry>Compression Unit Size (b)</entry>
- </row>
- <row>
- <entry>0x24</entry>
- <entry>4</entry>
- <entry>0x00</entry>
- <entry>Padding</entry>
- </row>
- <row>
- <entry>0x28</entry>
- <entry>8</entry>
- <entry/>
- <entry>Allocated size of the attribute (c)</entry>
- </row>
- <row>
- <entry>0x30</entry>
- <entry>8</entry>
- <entry/>
- <entry>Real size of the attribute</entry>
- </row>
- <row>
- <entry>0x38</entry>
- <entry>8</entry>
- <entry/>
- <entry>Initialized data size of the stream (d)</entry>
- </row>
- <row>
- <entry>0x40</entry>
- <entry>...</entry>
- <entry/>
- <entry>Data Runs</entry>
- </row>
- </tbody>
- </tgroup>
- </table>
- <para>(a) Each attribute has a unique identifier</para>
- <para>(b) Compression unit size = 2
- <superscript>x</superscript> clusters. 0 implies uncompressed
- </para>
- <para>(c) This is the attribute size rounded up to the cluster size</para>
- <para>(d) When is this not equal to the allocated size?</para>
- </section>
- <section>
- <title>Non-Resident, Named</title>
+ <title>Non-Resident</title>
<table>
<title>Layout of a non-resident named attribute header</title>
- <tgroup cols="4">
+ <tgroup cols="3">
<colspec colname="Offset" colwidth="1*"/>
<colspec colname="Size" colwidth="1*"/>
- <colspec colname="Value" colwidth="1*"/>
<colspec colname="Description" colwidth="3*"/>
<thead>
<row>
<entry>Offset</entry>
<entry>Size</entry>
- <entry>Value</entry>
<entry>Description</entry>
</row>
</thead>
@@ -885,103 +783,91 @@
<row>
<entry>0x00</entry>
<entry>4</entry>
- <entry/>
<entry>Attribute Type (e.g. 0x80, 0xA0)</entry>
</row>
<row>
<entry>0x04</entry>
<entry>4</entry>
- <entry/>
<entry>Length (including this header)</entry>
</row>
<row>
<entry>0x08</entry>
<entry>1</entry>
- <entry>0x01</entry>
- <entry>Non-resident flag</entry>
+ <entry>Non-resident flag (value is 0x01)</entry>
</row>
<row>
<entry>0x09</entry>
<entry>1</entry>
- <entry>N</entry>
- <entry>Name length</entry>
+ <entry>Name length (g)</entry>
</row>
<row>
<entry>0x0A</entry>
<entry>2</entry>
- <entry>0x40</entry>
- <entry>Offset to the Name</entry>
+ <entry>Offset to the Name (g)</entry>
</row>
<row>
<entry>0x0C</entry>
<entry>2</entry>
- <entry/>
<entry>Flags</entry>
</row>
<row>
<entry>0x0E</entry>
<entry>2</entry>
- <entry/>
<entry>Attribute Id (a)</entry>
</row>
<row>
<entry>0x10</entry>
<entry>8</entry>
- <entry/>
<entry>Starting VCN</entry>
</row>
<row>
<entry>0x18</entry>
<entry>8</entry>
- <entry/>
<entry>Last VCN</entry>
</row>
<row>
<entry>0x20</entry>
<entry>2</entry>
- <entry>2N+0x40</entry>
<entry>Offset to the Data Runs (b)</entry>
</row>
<row>
<entry>0x22</entry>
- <entry>2</entry>
- <entry/>
+ <entry>1</entry>
<entry>Compression Unit Size (c)</entry>
</row>
<row>
- <entry>0x24</entry>
- <entry>4</entry>
- <entry>0x00</entry>
- <entry>Padding</entry>
+ <entry>0x23</entry>
+ <entry>5</entry>
+ <entry>Padding of zeros (align to 8 byte boundary)</entry>
</row>
<row>
<entry>0x28</entry>
<entry>8</entry>
- <entry/>
<entry>Allocated size of the attribute (d)</entry>
</row>
<row>
<entry>0x30</entry>
<entry>8</entry>
- <entry/>
- <entry>Real size of the attribute</entry>
+ <entry>Real size of the attribute. Can be larger than the allocated size if the attribute is compressed or sparse. (TODO: xref)</entry>
</row>
<row>
<entry>0x38</entry>
<entry>8</entry>
- <entry/>
<entry>Initialized data size of the stream (e)</entry>
</row>
<row>
<entry>0x40</entry>
+ <entry>8</entry>
+ <entry>Compressed size (f)</entry>
+ </row>
+ <row>
+ <entry>0x40 or 0x48</entry>
<entry>2N</entry>
- <entry>Unicode</entry>
- <entry>The Attribute's Name</entry>
+ <entry>The Attribute's Name in Unicode. Not null terminated.</entry>
</row>
<row>
- <entry>2N+0x40</entry>
+ <entry>2N+(0x40 or 0x48)</entry>
<entry>...</entry>
- <entry/>
<entry>Data Runs (b)</entry>
</row>
</tbody>
@@ -993,7 +879,13 @@
<superscript>x</superscript> clusters. 0 implies uncompressed
</para>
<para>(d) This is the attribute size rounded up to the cluster size</para>
- <para>(e) When is this not equal to the allocated size?</para>
+ <para>(e) May be smaller than the Real/Allocated sizes if the file was not filled with data yet. For
+ example: after seeking beyond the end of a non-sparse file and not writing anything.</para>
+ <para>(f) Byte size of the attribute value after compression. Only present when compressed. Always is a
+ multiple of the compression unit size (which is a multiple of the cluster size). Represents the
+ actual amount of disk space being used on the disk.</para>
+ <para>(g) The name is not null-terminated. If the attribute is unnamed, both the name length and offset
+ are 0.</para>
</section>
<section>
<title>Flags</title>
@@ -1032,16 +924,6 @@
<title>Other Information</title>
<para>Only the data attribute can be compressed, or sparse, and only when it is non-resident.</para>
<para>Although the compression flag is stored in the header, it does not affect the size of the header.</para>
- <programlisting>
- name isn't null terminated
-
-
- FIXME
- 0x40 __s64 compressed_size;
- Byte size of the attribute value after compression.
- Only present when compressed. Always is a multiple of the cluster
- size. Represents the actual amount of disk space being used on the disk.
- </programlisting>
<para>FIXME: The indexed flag only appears in the resident attributes. Does this mean you can only index resident attributes?</para>
</section>
</section>
@@ -2216,20 +2098,17 @@ therefore -10 = 0xF6
</section>
</section>
</section>
- <section id="concept_encryption">
- <title>Concept - Encryption</title>
- <para>TODO</para>
- </section>
<section id="concept_directory">
<title>Concept - Directory</title>
<section>
<title>Overview</title>
- <para>Under NTFS every object on the volume is a file, even directories. A directory is an index of filenames.</para>
+ <para>A directory is a set of files.</para>
+ <para>On NTFS, A directory is a file record (TODO:xref) with an index of filenames.</para>
</section>
<section>
- <title>Attributes</title>
+ <title>Layout of a directory file record</title>
<table>
- <title>A directory record attributes</title>
+ <title>A directory file record attributes</title>
<tgroup cols="3">
<colspec colname="Type" colwidth="1*"/>
<colspec colname="Description" colwidth="2*"/>
@@ -2243,11 +2122,6 @@ therefore -10 = 0xF6
</thead>
<tbody>
<row>
- <entry>Type</entry>
- <entry>Description</entry>
- <entry>Name</entry>
- </row>
- <row>
<entry>
<link linkend="attribute_standard_information">0x10</link>
</entry>
@@ -2305,24 +2179,24 @@ therefore -10 = 0xF6
</tgroup>
</table>
<section>
- <title/>
- <section>
- <title>Index Entry</title>
- <para>An index is a list of index entries. Each entry contains the name of the file, the standard information and a pointer to the security information. The correct starting place is the Index Entry.</para>
- </section>
- <section>
- <title>Index Root</title>
- <para>This attribute, which is always resident, holds several index entries. It forms the root of the index tree.</para>
- </section>
- <section>
- <title>Index Allocation</title>
- <para>A set of runs telling the system where the other indexes are. (preposition!)</para>
- </section>
- <section>
- <title>Index Bitmap</title>
- <para>Which clusters (indexes) are in use.</para>
- <programlisting>A directory can even have a named data stream</programlisting>
- </section>
+ <title>Index Entry</title>
+ <para>An index is a list of index entries. Each entry contains the name of the file, the standard
+ information and a pointer to the security information. The correct starting place is the Index
+ Entry.</para>
+ </section>
+ <section>
+ <title>Index Root</title>
+ <para>This attribute, which is always resident, holds several index entries. It forms the root of
+ the index tree.</para>
+ </section>
+ <section>
+ <title>Index Allocation</title>
+ <para>A set of runs telling the system where the other indexes are. (preposition!)</para>
+ </section>
+ <section>
+ <title>Index Bitmap</title>
+ <para>Which clusters (indexes) are in use.</para>
+ <programlisting>A directory can even have a named data stream</programlisting>
</section>
</section>
<section>
@@ -2353,6 +2227,47 @@ therefore -10 = 0xF6
<para>In a directory, the three file attributes: index root, index allocation, and bitmap are named "$I30", and a directory is just an Index of file attributes whose type is 30. But NTFS has been thought as a database filesystem, and it can actually create indexes based on any file attribute that is always resident. E.g., you could create a new file attribute labeled "author name", and sort your files according to that criteria.</para>
</section>
</section>
+ <section id="concept_encryption">
+ <title>Concept - Encryption</title>
+ <section>
+ <title>Overview</title>
+ <para>A special feature of NTFS is the ability to encrypt files. Encrypted files' content is safe from the
+ Administrator too (Unless DRAs are used), as they can not be decrypted without having the key.</para>
+ <para>Each user has his own Private/Public key pair. When an encrypted file is created, the system creates a
+ random file encryption key (FEK) for this file and encrypts the FEK with the user's public key. The file
+ is encrypted with a strong symetric cipher and this FEK.</para>
+ <para>An encrypted file may not be locked only by a single user. Any user that can read the file (can
+ decrypt it), and can alter its permissions (the ACL) may specify additional users to be able to decrypt
+ it. When a new user is specified, the system decrypts the FEK with the adding user's private key,
+ encrypt it with the added user's public key and attaches the new encrypted FEK to the file's
+ metadata.</para>
+ <para>NTFS also supports the concept of Data Recovery Agents (DRAs). An Administrator may specify a specific
+ user/s to function as DRA/s. Any new encrypted file is also attached with a FEK encrypted with each of
+ the current DRAs public keys. This method allows the data to be recovered if the user's private key is
+ lost (Such as when a password reset is performed). There is no fundamental difference between a FEK
+ encrypted with a normal public key and a FEK encrypted with a recovery public key.</para>
+ </section>
+ <section>
+ <title>Disk Layout</title>
+ <para>An encrypted file</para>
+ </section>
+ <section>
+ <title>TODO</title>
+ <para>TODO</para>
+ <programlisting>
+ only files can be encrypted, no dirs.
+ no compression allowed.
+ table of attributes in mft record.
+ DES/DESX/3DES/AES - versions of windows and of NTFS.
+ DESX - detailed.
+ Reference strings.
+ IV for each cipher, and sector.
+ Adding DRAs after the file is touched is not helpful
+ No hardware dongles/smartcards allowed by MS implementetion, it is allowed by disk structures.
+ (No) Padding scheme.
+ </programlisting>
+ </section>
+ </section>
<section id="concept_file">
<title>Concept - File</title>
<section>
@@ -2819,17 +2734,22 @@ therefore -10 = 0xF6
</tbody>
</tgroup>
</table>
- <para>(a) The offset to these two fields depends on your operating system.</para>
- <para>$LogFile Sequence Number (LSN)</para>
- <para>This is changed every time the record is modified.</para>
- <para>Sequence Number</para>
- <para>Number of times this mft record has been reused.</para>
- <para>N.B. The increment (skipping zero) is done when the file is deleted.</para>
- <para>N.B. If this is set to zero it is left as zero.</para>
- <para>Hard Link Count</para>
- <para>Number of hard links, i.e. the number of directory entries referencing this record.</para>
- <para>N.B. Only used in mft base records.</para>
- <para>Flags</para>
+ <para>(a) The offset to these two fields depends on the NTFS version.</para>
+ <section>
+ <title>$LogFile Sequence Number (LSN)</title>
+ <para>This is changed every time the record is modified.</para>
+ </section>
+ <section>
+ <title>Sequence Number</title>
+ <para>Number of times this mft record has been reused.</para>
+ <para>N.B. The increment (skipping zero) is done when the file is deleted.</para>
+ <para>N.B. If this is set to zero it is left as zero.</para>
+ </section>
+ <section>
+ <title>Hard Link Count</title>
+ <para>Number of hard links, i.e. the number of directory entries referencing this record.</para>
+ <para>N.B. Only used in mft base records.</para>
+ </section>
<table>
<title>File record flags</title>
<tgroup cols="2">
@@ -2861,17 +2781,31 @@ therefore -10 = 0xF6
</tbody>
</tgroup>
</table>
- <para>Real / Allocated Size</para>
- <para>The Allocated Size is how much space the Record takes up on disk. This should be a multiple of the cluster size and should probably be equal to the size of an MFT File Record. The Real Size is a count of how many bytes of the Record are actually used.</para>
- <para>N.B. The Real Size will be padded to an 8 byte boundary.</para>
- <para>Base MFT Record</para>
- <para>This is zero for Base MFT Records. When it is not zero it is a MFT Reference pointing to the Base MFT Record to which this Record belongs. The Base Record contains the information about the Extension Record. This information is stored in an ATTRIBUTE_LIST attribute.</para>
- <para>Next Attribute Id</para>
- <para>The Attribute Id that will be assigned to the next Attribute added to this MFT Record.</para>
- <para>N.B. Incremented each time it is used.</para>
- <para>N.B. Every time the MFT Record is reused this Id is set to zero.</para>
- <para>N.B. The first instance number is always 0.</para>
- <para>The master file table record consists of a header and the attribute list. It has a size of 400 (=1K), or the cluster size (whichever is larger). The header has the following fields:</para>
+ <section>
+ <title>Real / Allocated Size</title>
+ <para>The Allocated Size is how much space the Record takes up on disk. This should be a multiple of the
+ cluster size and should probably be equal to the size of an MFT File Record. The Real Size is a
+ count of
+ how many bytes of the Record are actually used.</para>
+ <para>N.B. The Real Size will be padded to an 8 byte boundary.</para>
+ </section>
+ <section>
+ <title>Base MFT Record</title>
+ <para>This is zero for Base MFT Records. When it is not zero it is a MFT Reference pointing to the Base
+ MFT
+ Record to which this Record belongs. The Base Record contains the information about the Extension
+ Record. This information is stored in an ATTRIBUTE_LIST attribute.</para>
+ </section>
+ <section>
+ <title>Next Attribute Id</title>
+ <para>The Attribute Id that will be assigned to the next Attribute added to this MFT Record.</para>
+ <para>N.B. Incremented each time it is used.</para>
+ <para>N.B. Every time the MFT Record is reused this Id is set to zero.</para>
+ <para>N.B. The first instance number is always 0.</para>
+ <para>The master file table record consists of a header and the attribute list. It has a size of 400
+ (=1K),
+ or the cluster size (whichever is larger). The header has the following fields:</para>
+ </section>
</section>
<section>
<title>Notes</title>
@@ -3847,7 +3781,6 @@ therefore -10 = 0xF6
</section>
</section>
</section>
-
<section id="concept_index_record">
<title>Concept - Index Record</title>
<section>
@@ -4021,6 +3954,74 @@ therefore -10 = 0xF6
</section>
</section>
</section>
+ <section id="concept_interix_special_files">
+ <title>Concept - Interix Special Files</title>
+ <section>
+ <title>Overview</title>
+ <para>Interix is the POSIX subsystem for Windows name.</para>
+ <para>One of Interix's needs is to emulate the POSIX way of accessing the filesystem. And in respect to
+ that, supply POSIX special files on top of the NTFS filesystem.</para>
+ <para>File Types:
+ <itemizedlist>
+ <listitem>
+ <para>Socket</para>
+ </listitem>
+ <listitem>
+ <para>Symbolic Link</para>
+ </listitem>
+ <listitem>
+ <para>Regular File</para>
+ </listitem>
+ <listitem>
+ <para>Block Device</para>
+ </listitem>
+ <listitem>
+ <para>Directory</para>
+ </listitem>
+ <listitem>
+ <para>Character Device</para>
+ </listitem>
+ <listitem>
+ <para>FIFO</para>
+ </listitem>
+ </itemizedlist>
+ </para>
+ <para>Regular Files and Directories are not special, and already described in this documentation.</para>
+ </section>
+ <section>
+ <title>Layout of a special file</title>
+ <para>TODO: 0x10, 0x30, 0x80.</para>
+ </section>
+ <section>
+ <title>Sockets and FIFOs</title>
+ <para>Both sockets and FIFOs are files with the System attribute set. The difference is the file length
+ magic.</para>
+ <para>A FIFO special file is a file with the System attribute set and a 0 bytes length.</para>
+ <para>A socket special file is a file with the System attribute set and a 1 byte length.</para>
+ </section>
+ <section>
+ <title>Block and character devices and Symbolic links</title>
+ <para>Block and character devices and Symbolic links are files with the System attribute set. The difference
+ is their content</para>
+ <para>Block devices start with the 64-bit magic "IntxBLK\0" (that is the null terminated ASCII string
+ "IntxBLK") followed by 2 LE 64-bit integers representing the major and minor nodes.</para>
+ <para>Character devices are exactly like block devices except that they start with the "IntxCHR\0"
+ magic.</para>
+ <para>Symbolic links start with the 64-bit magic "IntxLNK\1" (notice: char 0x01 instead of a
+ null-terminator) followed by the link target name in a UTF-16LE string format. A detailed explanation
+ about Symbolic links can be found in
+ <xref linkend="concept_links"/>
+ .
+ </para>
+ <programlisting>
+ Add a layout table.
+ Offset Length Name
+ 0 8 Magic
+ 8 8 Major
+ 16 8 Minor
+ </programlisting>
+ </section>
+ </section>
<section id="concept_links">
<title>Concept - Links</title>
<section>
@@ -4835,7 +4836,14 @@ Offset(length) Description
<title>Concept - Sparse</title>
<section>
<title>Overview</title>
- <para>Sparse files</para>
+ <para>Sparse files are files that are not fully allocated.</para>
+ <para>On Linux, every new file is by default sparse. Windows files on the other hand, needs to be declared
+ specificly as sparse.</para>
+ <para>Once a file is tagged SPARSE on an NTFS volume, Windows is unable to untag it.</para>
+ <para>The SPARSE tagging is done in the DOS Attributes / File Permissions (TODO: link to the table) in both
+ the 0x10 and 0x30 (TODO: xref) attributes.</para>
+ <para>The sparse holes are marked in the runlist (TODO: xref).</para>
+ <para>Example: TODO</para>
<programlisting>
fix the data runs page for NT4 (old style)
13 b8 ae 04 ff 00 old
|