![]() |
UltraDefrag Engine Architecture - Reference Manual - Guides |
|
Fast NTFS analysis code. More...
Go to the source code of this file.
Functions | |
void | CheckForNtfsPartition (void) |
Retrieves a type of the file system containing on the volume. | |
NTSTATUS | GetMftLayout (void) |
Retrieves some basic information about MFT. | |
BOOLEAN | ScanMFT (void) |
Scans the entire MFT retrieving information about each file contained on the volume. | |
void | UpdateMaxMftEntriesNumber (PNTFS_FILE_RECORD_OUTPUT_BUFFER pnfrob, ULONG nfrob_size) |
Defines exactly how many entries has the MFT. | |
NTSTATUS | GetMftRecord (PNTFS_FILE_RECORD_OUTPUT_BUFFER pnfrob, ULONG nfrob_size, ULONGLONG mft_id) |
Retrieves a single MFT record. | |
int | UpdateAttributeName (PFILENAME pfn, PMY_FILE_INFORMATION pmfi) |
Appends the file name to the attribute name. | |
void | AnalyseMftRecord (PNTFS_FILE_RECORD_OUTPUT_BUFFER pnfrob, ULONG nfrob_size, PMY_FILE_INFORMATION pmfi) |
Analyzes the MFT record. | |
void | EnumerateAttributes (PFILE_RECORD_HEADER pfrh, ATTRHANDLER_PROC ahp, PMY_FILE_INFORMATION pmfi) |
Enumerates attributes contained in MFT record. | |
void | AnalyseAttribute (PATTRIBUTE pattr, PMY_FILE_INFORMATION pmfi) |
Analyzes a file attribute. | |
void | AnalyseResidentAttribute (PRESIDENT_ATTRIBUTE pr_attr, PMY_FILE_INFORMATION pmfi) |
Analyzes a resident attribute of the file. | |
void | GetFileFlags (PRESIDENT_ATTRIBUTE pr_attr, PMY_FILE_INFORMATION pmfi) |
Retrieves a flags of the file. | |
void | GetFileName (PRESIDENT_ATTRIBUTE pr_attr, PMY_FILE_INFORMATION pmfi) |
Retrieves a name of the file. | |
void | UpdateFileName (PMY_FILE_INFORMATION pmfi, WCHAR *name, UCHAR name_type) |
Updates a name of the file. | |
void | GetVolumeInformationData (PRESIDENT_ATTRIBUTE pr_attr) |
Retrieves some filesystem information. | |
void | CheckReparsePointResident (PRESIDENT_ATTRIBUTE pr_attr, PMY_FILE_INFORMATION pmfi) |
Retrieves an information about the reparse point. | |
void | AnalyseResidentAttributeList (PRESIDENT_ATTRIBUTE pr_attr, PMY_FILE_INFORMATION pmfi) |
Analyzes a resident attribute list. | |
void | AnalyseAttributeFromAttributeList (PATTRIBUTE_LIST attr_list_entry, PMY_FILE_INFORMATION pmfi) |
Analyzes a file attribute from the attribute list. | |
void | AnalyseAttributeFromMftRecord (ULONGLONG mft_id, ATTRIBUTE_TYPE attr_type, short *attr_name, USHORT attr_number, PMY_FILE_INFORMATION pmfi) |
Analyzes a single attribute from the MFT record. | |
short * | GetDefaultAttributeName (ATTRIBUTE_TYPE attr_type) |
Retrieves the default name of the attribute. | |
void | AnalyseNonResidentAttribute (PNONRESIDENT_ATTRIBUTE pnr_attr, PMY_FILE_INFORMATION pmfi) |
Analyzes a nonresident attribute of the file. | |
void | ProcessRunList (WCHAR *full_path, PNONRESIDENT_ATTRIBUTE pnr_attr, PMY_FILE_INFORMATION pmfi, BOOLEAN is_attr_list) |
Retrieves VCN/LCN pairs of the attribute. | |
void | AnalyseNonResidentAttributeList (PFILENAME pfn, PMY_FILE_INFORMATION pmfi, ULONGLONG size) |
Analyzes a nonresident attribute list. | |
ULONGLONG | ProcessMftSpace (PNTFS_DATA nd) |
Retrieves MFT position and size and applies them to the cluster map. | |
void | ProcessRun (WCHAR *full_path, PMY_FILE_INFORMATION pmfi, PFILENAME pfn, ULONGLONG vcn, ULONGLONG length, ULONGLONG lcn) |
Adds information about a single VCN/LCN pair to the structure describing the file. | |
PFILENAME | FindFileListEntryForTheAttribute (WCHAR *full_path, PMY_FILE_INFORMATION pmfi) |
Searches for the file list entry describing the file. | |
void | UpdateClusterMapAndStatistics (PMY_FILE_INFORMATION pmfi) |
Applies information about the file to the cluster map and statistics. | |
BOOLEAN | TemporaryStuffDetected (PMY_FILE_INFORMATION pmfi) |
Defines, is a file temporary or not. | |
BOOLEAN | UnwantedStuffDetected (PFILENAME pfn) |
Checks, must file be skipped or not. | |
void | BuildPaths (void) |
Builds a full paths of all files contained on the volume. | |
void | BuildPath2 (PFILENAME pfn) |
Builds a full path of the file. | |
BOOLEAN | GetFileNameAndParentMftId (ULONGLONG mft_id, ULONGLONG *parent_mft_id, WCHAR *buffer, ULONG length) |
Retrieves a file name and a parent MFT identifier for the MFT record. | |
void | AddResidentDirectoryToFileList (PMY_FILE_INFORMATION pmfi) |
Adds a resident directory to the file list. | |
PFILENAME | FindDirectoryByMftId (ULONGLONG mft_id) |
Searches for a directory by its MFT identifier. | |
NTSTATUS | ReadSectors (ULONGLONG lsn, PVOID buffer, ULONG length) |
Reads sectors from disk. | |
Variables | |
ATTRIBUTE_NAME | default_attribute_names [] |
Array containing default names of the attributes. |
Fast NTFS analysis code.
Definition in file ntfs.c.