NTFS: Difference between revisions

Jump to navigation Jump to search
[unchecked revision][unchecked revision]
Content deleted Content added
m →‎Structure: Fixed lengths of two fields in header
Solar (talk | contribs)
→‎Structure: Standard compliant and unambiguous field specs.
Line 30: Line 30:
! Field
! Field
! Type
! Type
! Length
|-
|-
|JMP || byte[3] || 3
|JMP || int8_t[3]
|-
|-
|OEM System || char[8] || 8
|OEM System || char[8]
|-
|-
|Bytes Per Sector || unsigned short || 2
|Bytes Per Sector || uint16_t
|-
|-
|Sectors Per Cluster || byte || 1
|Sectors Per Cluster || int8_t
|-
|-
|Reserved Sector Count || unsigned short || 2
|Reserved Sector Count || uint16_t
|-
|-
|Table Count || byte || 1
|Table Count || int8_t
|-
|-
|Root Entry Count || unsigned short || 2
|Root Entry Count || uint16_t
|-
|-
|Sector Count || unsigned short || 2
|Sector Count || uint16_t
|-
|-
|Media Type || byte || 1
|Media Type || int8_t
|-
|-
|Sectors Per Table || unsigned short || 2
|Sectors Per Table || uint16_t
|-
|-
|Sectors Per Track || unsigned short || 2
|Sectors Per Track || uint16_t
|-
|-
|Hidden Sector Count || unsigned int || 4
|Hidden Sector Count || uint32_t
|-
|-
|Sector Count (32-bit) || unsigned int || 4
|Sector Count (32-bit) || uint32_t
|-
|-
|Reserved || unsigned int || 4
|Reserved || uint32_t
|-
|-
|Sector Count (64-bit) || unsigned long || 8
|Sector Count (64-bit) || uint64_t
|}
|}


Line 68: Line 67:
!Field
!Field
!Type
!Type
!Length
|-
|-
|Master File Table Cluster || unsigned long || 8
|Master File Table Cluster || uint64_t
|-
|-
|Master File Table Mirror Cluster || unsigned long || 8
|Master File Table Mirror Cluster || uint64_t
|-
|-
|Clusters Per Record || signed byte || 1
|Clusters Per Record || int8_t
|-
|-
|Reserved || byte[3] || 3
|Reserved || int8_t[3]
|-
|-
|Clusters Per Index Buffer || signed byte || 1
|Clusters Per Index Buffer || int8_t
|-
|-
|Reserved || byte[3] || 3
|Reserved || int8_t[3]
|-
|-
|Serial Number || unsigned long || 8
|Serial Number || uint64_t
|-
|-
|Checksum || unsigned int || 4
|Checksum || uint32_t
|}
|}


Line 94: Line 92:
! Field
! Field
! Type
! Type
! Length
|-
|-
|Record Type || char[4] || 4
|Record Type || char[4]
|-
|-
|Update Sequence Offset || unsigned short || 2
|Update Sequence Offset || uint16_t
|-
|-
|Update Sequence Length || unsigned short || 2
|Update Sequence Length || uint16_t
|-
|-
|Log File Sequence Number || unsigned long || 8
|Log File Sequence Number || uint64_t
|-
|-
|Record Sequence Number || unsigned short || 2
|Record Sequence Number || uint16_t
|-
|-
|Hard Link Count || unsigned short || 2
|Hard Link Count || uint16_t
|-
|-
|Attributes Offset || unsigned short || 2
|Attributes Offset || uint16_t
|-
|-
|Flags || unsigned short || 2
|Flags || uint16_t
|-
|-
|Bytes In Use || unsigned int || 4
|Bytes In Use || uint32_t
|-
|-
|Bytes Allocated || unsigned int || 4
|Bytes Allocated || uint32_t
|-
|-
|Parent Record Number || unsigned long || 8
|Parent Record Number || uint64_t
|-
|-
|Next Attribute Index || unsigned short || 2
|Next Attribute Index || uint32_t
|-
|-
|Reserved || unsigned short || 2
|Reserved || uint32_t
|-
|-
|Record Number || unsigned int || 4
|Record Number || uint64_t
|}
|}


Line 132: Line 129:
! Field
! Field
! Type
! Type
! Length
|-
|-
| Attribute Type || unsigned int || 4
| Attribute Type || uint32_t
|}
|}


Line 142: Line 138:
! Field
! Field
! Type
! Type
! Length
|-
|-
| Attribute Length || unsigned int || 4
| Attribute Length || uint32_t
|}
|}