UltraDefrag Engine Logo UltraDefrag Engine

Architecture - Reference Manual - Guides

Fast NTFS Scan

Functions

void CheckForNtfsPartition (void)
 Retrieves a type of the file system containing on the volume.
NTSTATUS GetMftLayout (void)
 Retrieves some basic information about MFT.
BOOLEAN ScanMFT (void)
 Scans the entire MFT retrieving information about each file contained on the volume.
void UpdateMaxMftEntriesNumber (PNTFS_FILE_RECORD_OUTPUT_BUFFER pnfrob, ULONG nfrob_size)
 Defines exactly how many entries has the MFT.
NTSTATUS GetMftRecord (PNTFS_FILE_RECORD_OUTPUT_BUFFER pnfrob, ULONG nfrob_size, ULONGLONG mft_id)
 Retrieves a single MFT record.
int UpdateAttributeName (PFILENAME pfn, PMY_FILE_INFORMATION pmfi)
 Appends the file name to the attribute name.
void AnalyseMftRecord (PNTFS_FILE_RECORD_OUTPUT_BUFFER pnfrob, ULONG nfrob_size, PMY_FILE_INFORMATION pmfi)
 Analyzes the MFT record.
void EnumerateAttributes (PFILE_RECORD_HEADER pfrh, ATTRHANDLER_PROC ahp, PMY_FILE_INFORMATION pmfi)
 Enumerates attributes contained in MFT record.
void AnalyseAttribute (PATTRIBUTE pattr, PMY_FILE_INFORMATION pmfi)
 Analyzes a file attribute.
void AnalyseResidentAttribute (PRESIDENT_ATTRIBUTE pr_attr, PMY_FILE_INFORMATION pmfi)
 Analyzes a resident attribute of the file.
void GetFileFlags (PRESIDENT_ATTRIBUTE pr_attr, PMY_FILE_INFORMATION pmfi)
 Retrieves a flags of the file.
void GetFileName (PRESIDENT_ATTRIBUTE pr_attr, PMY_FILE_INFORMATION pmfi)
 Retrieves a name of the file.
void UpdateFileName (PMY_FILE_INFORMATION pmfi, WCHAR *name, UCHAR name_type)
 Updates a name of the file.
void GetVolumeInformationData (PRESIDENT_ATTRIBUTE pr_attr)
 Retrieves some filesystem information.
void CheckReparsePointResident (PRESIDENT_ATTRIBUTE pr_attr, PMY_FILE_INFORMATION pmfi)
 Retrieves an information about the reparse point.
void AnalyseResidentAttributeList (PRESIDENT_ATTRIBUTE pr_attr, PMY_FILE_INFORMATION pmfi)
 Analyzes a resident attribute list.
void AnalyseAttributeFromAttributeList (PATTRIBUTE_LIST attr_list_entry, PMY_FILE_INFORMATION pmfi)
 Analyzes a file attribute from the attribute list.
void AnalyseAttributeFromMftRecord (ULONGLONG mft_id, ATTRIBUTE_TYPE attr_type, short *attr_name, USHORT attr_number, PMY_FILE_INFORMATION pmfi)
 Analyzes a single attribute from the MFT record.
short * GetDefaultAttributeName (ATTRIBUTE_TYPE attr_type)
 Retrieves the default name of the attribute.
void AnalyseNonResidentAttribute (PNONRESIDENT_ATTRIBUTE pnr_attr, PMY_FILE_INFORMATION pmfi)
 Analyzes a nonresident attribute of the file.
void ProcessRunList (WCHAR *full_path, PNONRESIDENT_ATTRIBUTE pnr_attr, PMY_FILE_INFORMATION pmfi, BOOLEAN is_attr_list)
 Retrieves VCN/LCN pairs of the attribute.
void AnalyseNonResidentAttributeList (PFILENAME pfn, PMY_FILE_INFORMATION pmfi, ULONGLONG size)
 Analyzes a nonresident attribute list.
ULONGLONG ProcessMftSpace (PNTFS_DATA nd)
 Retrieves MFT position and size and applies them to the cluster map.
void ProcessRun (WCHAR *full_path, PMY_FILE_INFORMATION pmfi, PFILENAME pfn, ULONGLONG vcn, ULONGLONG length, ULONGLONG lcn)
 Adds information about a single VCN/LCN pair to the structure describing the file.
PFILENAME FindFileListEntryForTheAttribute (WCHAR *full_path, PMY_FILE_INFORMATION pmfi)
 Searches for the file list entry describing the file.
void UpdateClusterMapAndStatistics (PMY_FILE_INFORMATION pmfi)
 Applies information about the file to the cluster map and statistics.
BOOLEAN TemporaryStuffDetected (PMY_FILE_INFORMATION pmfi)
 Defines, is a file temporary or not.
BOOLEAN UnwantedStuffDetected (PFILENAME pfn)
 Checks, must file be skipped or not.
void BuildPaths (void)
 Builds a full paths of all files contained on the volume.
void BuildPath2 (PFILENAME pfn)
 Builds a full path of the file.
BOOLEAN GetFileNameAndParentMftId (ULONGLONG mft_id, ULONGLONG *parent_mft_id, WCHAR *buffer, ULONG length)
 Retrieves a file name and a parent MFT identifier for the MFT record.
void AddResidentDirectoryToFileList (PMY_FILE_INFORMATION pmfi)
 Adds a resident directory to the file list.
PFILENAME FindDirectoryByMftId (ULONGLONG mft_id)
 Searches for a directory by its MFT identifier.
NTSTATUS ReadSectors (ULONGLONG lsn, PVOID buffer, ULONG length)
 Reads sectors from disk.

Variables

ATTRIBUTE_NAME default_attribute_names []
 Array containing default names of the attributes.

Function Documentation

void CheckForNtfsPartition ( void   ) 

Retrieves a type of the file system containing on the volume.

Sets the global partition_type variable.

Definition at line 52 of file ntfs.c.

Referenced by Analyze().

NTSTATUS GetMftLayout ( void   ) 

Retrieves some basic information about MFT.

Returns:
An appropriate NTSTATUS code.

Definition at line 139 of file ntfs.c.

References ProcessMftSpace().

Referenced by ScanMFT().

BOOLEAN ScanMFT ( void   ) 

Scans the entire MFT retrieving information about each file contained on the volume.

Returns:
Boolean value. TRUE indicates success.

Definition at line 199 of file ntfs.c.

References _rdtsc(), AnalyseMftRecord(), BuildPaths(), CheckForStopEvent(), GetMftLayout(), GetMftRecord(), and UpdateMaxMftEntriesNumber().

Referenced by Analyze().

void UpdateMaxMftEntriesNumber ( PNTFS_FILE_RECORD_OUTPUT_BUFFER  pnfrob,
ULONG  nfrob_size 
)

Defines exactly how many entries has the MFT.

Parameters:
[in] pnfrob pointer to the buffer receiving a single NTFS record for the internal computations.
[in] nfrob_size the size of the buffer, in bytes.

Definition at line 330 of file ntfs.c.

References EnumerateAttributes(), and GetMftRecord().

Referenced by ScanMFT().

NTSTATUS GetMftRecord ( PNTFS_FILE_RECORD_OUTPUT_BUFFER  pnfrob,
ULONG  nfrob_size,
ULONGLONG  mft_id 
)

Retrieves a single MFT record.

Parameters:
[out] pnfrob pointer to the buffer receiving the MFT record.
[in] nfrob_size the size of the buffer, in bytes.
[in] mft_id the MFT record number.
Returns:
An appropriate NTSTATUS code.

Definition at line 394 of file ntfs.c.

Referenced by AnalyseAttributeFromMftRecord(), ScanMFT(), and UpdateMaxMftEntriesNumber().

int UpdateAttributeName ( PFILENAME  pfn,
PMY_FILE_INFORMATION  pmfi 
)

Appends the file name to the attribute name.

Parameters:
[in,out] pfn pointer to structure containing the attribute name.
[in] pmfi pointer to structure containing the name of the file.
Returns:
Zero for success, negative value otherwise.

Definition at line 423 of file ntfs.c.

Referenced by AnalyseMftRecord().

void AnalyseMftRecord ( PNTFS_FILE_RECORD_OUTPUT_BUFFER  pnfrob,
ULONG  nfrob_size,
PMY_FILE_INFORMATION  pmfi 
)

Analyzes the MFT record.

Parameters:
[out] pnfrob pointer to the buffer containing the MFT record.
[in] nfrob_size the size of the buffer, in bytes.
[out] pmfi pointer to the structure receiving information about the file containing in MFT record.

Definition at line 474 of file ntfs.c.

References AddResidentDirectoryToFileList(), EnumerateAttributes(), UpdateAttributeName(), and UpdateClusterMapAndStatistics().

Referenced by ScanMFT().

void EnumerateAttributes ( PFILE_RECORD_HEADER  pfrh,
ATTRHANDLER_PROC  ahp,
PMY_FILE_INFORMATION  pmfi 
)

Enumerates attributes contained in MFT record.

Parameters:
[in] pfrh pointer to the file record header.
[in] ahp pointer to the callback procedure to be called once for each attribute found.
[out] pmfi pointer to the structure receiving information about the file containing in MFT record.
Note:
The ntfs_record_size global variable must be initialized before this call.

Definition at line 592 of file ntfs.c.

References CheckForStopEvent().

Referenced by AnalyseMftRecord(), and UpdateMaxMftEntriesNumber().

void AnalyseResidentAttribute ( PRESIDENT_ATTRIBUTE  pr_attr,
PMY_FILE_INFORMATION  pmfi 
)

Analyzes a resident attribute of the file.

Parameters:
[in] pr_attr pointer to the structure describing the resident attribute of the file.
[out] pmfi pointer to the structure receiving information about the file containing in MFT record.
Note:
Resident attributes never contain fragmented data, because they are placed in MFT record entirely. We analyze resident attributes only if we need some information stored in them.

Definition at line 677 of file ntfs.c.

References AnalyseResidentAttributeList(), CheckReparsePointResident(), GetFileFlags(), GetFileName(), and GetVolumeInformationData().

Referenced by AnalyseAttribute().

void GetFileFlags ( PRESIDENT_ATTRIBUTE  pr_attr,
PMY_FILE_INFORMATION  pmfi 
)

Retrieves a flags of the file.

Parameters:
[in] pr_attr pointer to the structure describing the resident attribute of the file.
[out] pmfi pointer to the structure receiving information about the file.

Definition at line 727 of file ntfs.c.

Referenced by AnalyseResidentAttribute().

void GetFileName ( PRESIDENT_ATTRIBUTE  pr_attr,
PMY_FILE_INFORMATION  pmfi 
)

Retrieves a name of the file.

Parameters:
[in] pr_attr pointer to the structure describing the resident attribute of the file.
[out] pmfi pointer to the structure receiving information about the file.
Note:
The pmfi pointed structure MUST be initialized before!

Definition at line 749 of file ntfs.c.

References UpdateFileName().

Referenced by AnalyseResidentAttribute().

void UpdateFileName ( PMY_FILE_INFORMATION  pmfi,
WCHAR *  name,
UCHAR  name_type 
)

Updates a name of the file.

Replaces a DOS name by WINDOWS name, WINDOWS name by POSIX when available.

Parameters:
[in,out] pmfi pointer to the structure containing information about the file.
[in] name the name of the file.
[in] name_type the type of the file name.

Definition at line 797 of file ntfs.c.

Referenced by GetFileName().

void GetVolumeInformationData ( PRESIDENT_ATTRIBUTE  pr_attr  ) 

Retrieves some filesystem information.

Parameters:
[in] pr_attr pointer to the structure describing the resident attribute of the file.

Definition at line 813 of file ntfs.c.

Referenced by AnalyseResidentAttribute().

void CheckReparsePointResident ( PRESIDENT_ATTRIBUTE  pr_attr,
PMY_FILE_INFORMATION  pmfi 
)

Retrieves an information about the reparse point.

Parameters:
[in] pr_attr pointer to the structure describing the resident attribute of the file.
[out] pmfi pointer to the structure receiving information about the file.

Definition at line 839 of file ntfs.c.

Referenced by AnalyseResidentAttribute().

void AnalyseResidentAttributeList ( PRESIDENT_ATTRIBUTE  pr_attr,
PMY_FILE_INFORMATION  pmfi 
)

Analyzes a resident attribute list.

Analyzes attributes of the current file packed in another MFT records.

Parameters:
[in] pr_attr pointer to the structure describing the resident attribute of the file.
[out] pmfi pointer to the structure receiving information about the file.

Definition at line 864 of file ntfs.c.

References AnalyseAttributeFromAttributeList(), and CheckForStopEvent().

Referenced by AnalyseResidentAttribute().

void AnalyseAttributeFromAttributeList ( PATTRIBUTE_LIST  attr_list_entry,
PMY_FILE_INFORMATION  pmfi 
)

Analyzes a file attribute from the attribute list.

Parameters:
[in] attr_list_entry pointer to the attribute list entry.
[out] pmfi pointer to the structure receiving information about the file.

Definition at line 893 of file ntfs.c.

References AnalyseAttributeFromMftRecord().

Referenced by AnalyseNonResidentAttributeList(), and AnalyseResidentAttributeList().

void AnalyseAttributeFromMftRecord ( ULONGLONG  mft_id,
ATTRIBUTE_TYPE  attr_type,
short *  attr_name,
USHORT  attr_number,
PMY_FILE_INFORMATION  pmfi 
)

Analyzes a single attribute from the MFT record.

Parameters:
[in] mft_id the MFT record identifier.
[in] attr_type the attribute type.
[in] attr_name the name of the attribute.
[in] attr_number the numeric identifier of the instance of the attribute.
[in] pmfi pointer to the structure containing information about the file.
Note:
The attr_name paramter is equal to NULL for empty names.

Definition at line 956 of file ntfs.c.

References GetMftRecord().

Referenced by AnalyseAttributeFromAttributeList().

short* GetDefaultAttributeName ( ATTRIBUTE_TYPE  attr_type  ) 

Retrieves the default name of the attribute.

Parameters:
[in] attr_type the type of the attribute.
Returns:
The default name of the attribute. NULL indicates that the attribute has unknown type.

Definition at line 1133 of file ntfs.c.

Referenced by AnalyseNonResidentAttribute().

void AnalyseNonResidentAttribute ( PNONRESIDENT_ATTRIBUTE  pnr_attr,
PMY_FILE_INFORMATION  pmfi 
)

Analyzes a nonresident attribute of the file.

Parameters:
[in] pnr_attr pointer to the structure describing the nonresident attribute of the file.
[out] pmfi pointer to the structure receiving information about the file.
Note:
  • Nonresident attributes may contain fragmented data.
  • Never use a name of the file here, because it may be not available yet.

Definition at line 1155 of file ntfs.c.

References GetDefaultAttributeName(), ProcessRunList(), and wcsistr().

Referenced by AnalyseAttribute().

void ProcessRunList ( WCHAR *  full_path,
PNONRESIDENT_ATTRIBUTE  pnr_attr,
PMY_FILE_INFORMATION  pmfi,
BOOLEAN  is_attr_list 
)

Retrieves VCN/LCN pairs of the attribute.

Parameters:
[in] full_path the full path of the attribute.
[in] pnr_attr pointer to the structure describing the nonresident attribute of the file.
[out] pmfi pointer to the structure receiving information about the file.
[in] is_attr_list boolean value indicating, is attribute list to be analysed or not.

Definition at line 1283 of file ntfs.c.

References AnalyseNonResidentAttributeList(), FindFileListEntryForTheAttribute(), and ProcessRun().

Referenced by AnalyseNonResidentAttribute().

void AnalyseNonResidentAttributeList ( PFILENAME  pfn,
PMY_FILE_INFORMATION  pmfi,
ULONGLONG  size 
)

Analyzes a nonresident attribute list.

Parameters:
[out] pfn pointer to the structure containing information about the attribute list file.
[out] pmfi pointer to the structure receiving information about the file.
[in] size the size of the attribute list file, in bytes.

Definition at line 1337 of file ntfs.c.

References AnalyseAttributeFromAttributeList(), CheckForStopEvent(), and ReadSectors().

Referenced by ProcessRunList().

ULONGLONG ProcessMftSpace ( PNTFS_DATA  nd  ) 

Retrieves MFT position and size and applies them to the cluster map.

Parameters:
[in] nd pointer to the structure containing all information needed for computations.
Returns:
The complete MFT length, in clusters.

Definition at line 1433 of file ntfs.c.

References RemarkBlock(), and RemoveFreeSpaceBlock().

Referenced by GetMftLayout().

void ProcessRun ( WCHAR *  full_path,
PMY_FILE_INFORMATION  pmfi,
PFILENAME  pfn,
ULONGLONG  vcn,
ULONGLONG  length,
ULONGLONG  lcn 
)

Adds information about a single VCN/LCN pair to the structure describing the file.

Parameters:
[in] full_path the full path of the file.
[out] pmfi pointer to the structure receiving information about the file.
[in,out] pfn pointer to the structure receiving information about the file.
[in] vcn the virtual cluster number.
[in] length the length of the block.
[in] lcn the logical cluster number.

Definition at line 1513 of file ntfs.c.

Referenced by ProcessRunList().

PFILENAME FindFileListEntryForTheAttribute ( WCHAR *  full_path,
PMY_FILE_INFORMATION  pmfi 
)

Searches for the file list entry describing the file.

Parameters:
[in] full_path the full path of the file.
[in] pmfi pointer to the structure containing information about the file.
Returns:
A pointer to the structure describing the file. NULL indicates failure.

Definition at line 1557 of file ntfs.c.

Referenced by ProcessRunList().

void UpdateClusterMapAndStatistics ( PMY_FILE_INFORMATION  pmfi  ) 

Applies information about the file to the cluster map and statistics.

Parameters:
[in] pmfi pointer to the structure containing information about the file.

Definition at line 1613 of file ntfs.c.

References TemporaryStuffDetected().

Referenced by AnalyseMftRecord().

BOOLEAN TemporaryStuffDetected ( PMY_FILE_INFORMATION  pmfi  ) 

Defines, is a file temporary or not.

Parameters:
[in] pmfi pointer to the structure containing information about the file.
Returns:
Boolean value. TRUE indicates that the file is temporary.

Definition at line 1685 of file ntfs.c.

Referenced by UpdateClusterMapAndStatistics().

BOOLEAN UnwantedStuffDetected ( PFILENAME  pfn  ) 

Checks, must file be skipped or not.

Parameters:
[in] pfn pointer to the variable containing information about the file.
Returns:
Boolean value. TRUE indicates that the file must be skipped, FALSE indicates contrary.

Definition at line 1703 of file ntfs.c.

References IsStringInFilter().

Referenced by BuildPaths().

void BuildPath2 ( PFILENAME  pfn  ) 

Builds a full path of the file.

Parameters:
[in,out] pfn pointer to the structure containing information about the file.

Definition at line 1810 of file ntfs.c.

References CheckForStopEvent(), GetFileNameAndParentMftId(), and offset.

Referenced by BuildPaths().

BOOLEAN GetFileNameAndParentMftId ( ULONGLONG  mft_id,
ULONGLONG *  parent_mft_id,
WCHAR *  buffer,
ULONG  length 
)

Retrieves a file name and a parent MFT identifier for the MFT record.

Parameters:
[in] mft_id the MFT record number.
[out] parent_mft_id pointer to the variable receiving the parent MFT identifier.
[out] buffer pointer to buffer receiving a file name.
[in] length the length of the buffer, in characters.
Returns:
Boolean value. TRUE indicates that the full path has been retrieved, FALSE indicates that it was retrieved just partially.

Definition at line 1963 of file ntfs.c.

References FindDirectoryByMftId().

Referenced by BuildPath2().

void AddResidentDirectoryToFileList ( PMY_FILE_INFORMATION  pmfi  ) 

Adds a resident directory to the file list.

Parameters:
[in] pmfi pointer to the structure describing the directory.

Definition at line 1999 of file ntfs.c.

Referenced by AnalyseMftRecord().

PFILENAME FindDirectoryByMftId ( ULONGLONG  mft_id  ) 

Searches for a directory by its MFT identifier.

Parameters:
[in] mft_id the MFT identifier of the directory.
Returns:
A pointer to the structure describing the directory. NULL indicates failure.

Definition at line 2045 of file ntfs.c.

Referenced by GetFileNameAndParentMftId().

NTSTATUS ReadSectors ( ULONGLONG  lsn,
PVOID  buffer,
ULONG  length 
)

Reads sectors from disk.

Parameters:
[in] lsn the logical sector number.
[out] buffer pointer to the buffer receiving sector data.
[in] length the length of the buffer, in bytes.
Returns:
An appropriate NTSTATUS code.
Note:
  • LSN, buffer, length must be valid before this call!
  • Length MUST BE an integral of the sector size.

Definition at line 2107 of file ntfs.c.

References _rdtsc(), and offset.

Referenced by AnalyseNonResidentAttributeList().


Generated on Sat May 29 23:06:46 2010 for UltraDefrag Engine by doxygen 1.6.2