1N/A/*
1N/A * ntfsundelete - Part of the Linux-NTFS project.
1N/A *
1N/A * Copyright (c) 2002 Richard Russon
1N/A * Copyright (c) 2007 Yura Pakhuchiy
1N/A *
1N/A * This utility will recover deleted files from an NTFS volume.
1N/A *
1N/A * This program is free software; you can redistribute it and/or modify
1N/A * it under the terms of the GNU General Public License as published by
1N/A * the Free Software Foundation; either version 2 of the License, or
1N/A * (at your option) any later version.
1N/A *
1N/A * This program is distributed in the hope that it will be useful,
1N/A * but WITHOUT ANY WARRANTY; without even the implied warranty of
1N/A * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
1N/A * GNU General Public License for more details.
1N/A *
1N/A * You should have received a copy of the GNU General Public License
1N/A * along with this program (in the main directory of the Linux-NTFS
1N/A * distribution in the file COPYING); if not, write to the Free Software
1N/A * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
1N/A */
1N/A
1N/A#ifndef _NTFSUNDELETE_H_
1N/A#define _NTFSUNDELETE_H_
1N/A
1N/A#include "types.h"
1N/A#include "list.h"
1N/A#include "runlist.h"
1N/A
1N/Aenum optmode {
1N/A MODE_NONE = 0,
1N/A MODE_SCAN,
1N/A MODE_UNDELETE,
1N/A MODE_COPY,
1N/A MODE_ERROR
1N/A};
1N/A
1N/Astruct options {
1N/A char *device; /* Device/File to work with */
1N/A enum optmode mode; /* Scan / Undelete / Copy */
1N/A int percent; /* Minimum recoverability */
1N/A int uinode; /* Undelete this inode */
1N/A char *dest; /* Save file to this directory */
1N/A char *output; /* With this filename */
1N/A char *match; /* Pattern for filename matching */
1N/A int match_case; /* Case sensitive matching */
1N/A int truncate; /* Truncate files to exact size. */
1N/A int quiet; /* Less output */
1N/A int verbose; /* Extra output */
1N/A int force; /* Override common sense */
1N/A int optimistic; /* Undelete in-use clusters as well */
1N/A int parent; /* Show parent directory */
1N/A time_t since; /* Since this time */
1N/A s64 size_begin; /* Range for file size */
1N/A s64 size_end;
1N/A s64 mft_begin; /* Range for mft copy */
1N/A s64 mft_end;
1N/A char fillbyte; /* Use for unrecoverable sections */
1N/A};
1N/A
1N/Astruct filename {
1N/A struct list_head list; /* Previous/Next links */
1N/A ntfschar *uname; /* Filename in unicode */
1N/A int uname_len; /* and its length */
1N/A long long size_alloc; /* Allocated size (multiple of cluster size) */
1N/A long long size_data; /* Actual size of data */
1N/A FILE_ATTR_FLAGS flags;
1N/A time_t date_c; /* Time created */
1N/A time_t date_a; /* altered */
1N/A time_t date_m; /* mft record changed */
1N/A time_t date_r; /* read */
1N/A char *name; /* Filename in current locale */
1N/A FILE_NAME_TYPE_FLAGS name_space;
1N/A leMFT_REF parent_mref;
1N/A char *parent_name;
1N/A};
1N/A
1N/Astruct data {
1N/A struct list_head list; /* Previous/Next links */
1N/A char *name; /* Stream name in current locale */
1N/A ntfschar *uname; /* Unicode stream name */
1N/A int uname_len; /* and its length */
1N/A int resident; /* Stream is resident */
1N/A int compressed; /* Stream is compressed */
1N/A int encrypted; /* Stream is encrypted */
1N/A long long size_alloc; /* Allocated size (multiple of cluster size) */
1N/A long long size_data; /* Actual size of data */
1N/A long long size_init; /* Initialised size, may be less than data size */
1N/A long long size_vcn; /* Highest VCN in the data runs */
1N/A runlist_element *runlist; /* Decoded data runs */
1N/A int percent; /* Amount potentially recoverable */
1N/A void *data; /* If resident, a pointer to the data */
1N/A};
1N/A
1N/Astruct ufile {
1N/A long long inode; /* MFT record number */
1N/A time_t date; /* Last modification date/time */
1N/A struct list_head name; /* A list of filenames */
1N/A struct list_head data; /* A list of data streams */
1N/A char *pref_name; /* Preferred filename */
1N/A char *pref_pname; /* parent filename */
1N/A long long max_size; /* Largest size we find */
1N/A int attr_list; /* MFT record may be one of many */
1N/A int directory; /* MFT record represents a directory */
1N/A MFT_RECORD *mft; /* Raw MFT record */
1N/A};
1N/A
1N/A#endif /* _NTFSUNDELETE_H_ */
1N/A