-
-
Notifications
You must be signed in to change notification settings - Fork 4
/
Copy pathfs_struct.txt
157 lines (100 loc) · 3.95 KB
/
fs_struct.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
Appvar: CEshMFTd
----------
Header:
A mft_header_t counting the number of entries
Example:
- 2
Size: sizeof(mft_header_t) bytes
----------
Entry:
Path (variable length) | Filename (8 bytes)
In no particular order
Unused filename bytes will be null
Null terminators after each entry component
If entry exists, but filename is NULL, folder is empty
- Therefore, if file moved to/created in empty folder,
simply update filename entry of respective folder
Iterating through entries:
i = sizeof(mft_header_t);
while (mft[i] != FS_MFT_END) {
path = mft[i];
filename = mft[i + strlen(path) + 1];
i += strlen(path) + FS_FNAME_LEN;
}
Example:
- / Ø CESHØØØØ Ø /prog Ø BEJEWLED Ø
- Path NULL Filename NULL Path NULL Filename NULL
Squished (char):
- /ØCESHØØØØØ/progØBEJEWLEDØ
- Size: 26 bytes
----------
Footer:
1 byte, 0x1A
- When iterating through entries, indicates EOF
___________________________________________________________________________________________________
Appvar: CEshMFTi
----------
Header:
A mft_header_t counting the number of entries
Should be same as CEshMFTd's equivalent header
- Can be used to know when to regenerate index
Example:
- 2
Size: sizeof(mft_header_t) bytes
----------
Entry 1:
An mft_index_t array with 28 entries
Each entry corresponds to a letter, where entry 0 is a . or no
character (the root directory) and entry 27 is any other
non-letter character (_, #, etc.)
Each entry will be the offset in entry 3 (pathnames index) where
each respective letter occurs, or 65535 if it doesn't
Note: This is sorted by the name of the FIRST folder in the path, so
/usr/bin/ would be placed under 'U'/'u', not 'B'/'b'
Example:
- [0, 65535, 65535, 65535, 65535, 65535, 65535, 65535, 65535, 65535, 65535,
65535, 65535, 65535, 65535, 65535, 1, 65535, 65535, 65535, 65535, 65535,
65535, 65535, 65535, 65535, 65535, 65535]
- This indicates that Entry_3[0] is the first occurrence of a '.'/''
in a filename, and Entry_3[1] is the first occurrence of 'P'/'p'
Size: 28*sizeof(mft_index_t) bytes
----------
Entry 2:
An mft_index_t array with 28 entries
Each entry corresponds to a letter, where entry 0 is a . and
entry 27 is any other non-letter character (_, #, etc.)
Each entry will be the offset in entry 4 (filenames index) where
each respective letter occurs, or 65535 if it doesn't
Example:
- [65535, 65535, 0 , 1 , 65535, 65535, 65535, 65535, 65535, 65535, 65535,
65535, 65535, 65535, 65535, 65535, 65535, 65535, 65535, 65535, 65535, 65535,
65535, 65535, 65535, 65535, 65535, 65535]
- This indicates that Entry_4[0] is the first occurrence of 'B'/'b' in a filename,
and Entry_4[1] is the first occurrence of 'C'/'c'
Size: 28*sizeof(mft_index_t) bytes
----------
Entry 3:
An mft_index_t array with <header value> entries
An alphabetic index by filepath of every entry in CEshMFTd, where
each entry is the offset of the corresponding entry in CEshMFTd
Example:
- [0, 11]
- This indicates that CEshMFTd[0 + sizeof(mft_header_t)] is the first
path, alphabetically, and CEshMFTd[11 + sizeof(mft_header_t)] is the second
Size: <header value>*sizeof(mft_index_t) bytes
----------
Entry 4:
An mft_index_t array with <header value> entries
An alphabetic index by filename of every entry in CEshMFTd, where
each entry is the offset of the corresponding entry in CEshMFTd
Example:
- [11, 0]
- This indicates that CEshMFTd[11 + sizeof(mft_header_t)] is the first
file, alphabetically, and CEshMFTd[0 + sizeof(mft_header_t)] is the second
Note: For entries 3 & 4, . comes before A, and any other special
character comes after Z, as in entries 1 & 2
Size: <header value>*sizeof(mft_index_t) bytes
----------
Footer:
1 byte, 0x1A (FS_MFT_END)
- When iterating through entries, indicates EOF