| 1 |
62 |
marcus.erl |
/*
|
| 2 |
|
|
* usnjrnl.h - Defines for NTFS kernel transaction log ($UsnJrnl) handling.
|
| 3 |
|
|
* Part of the Linux-NTFS project.
|
| 4 |
|
|
*
|
| 5 |
|
|
* Copyright (c) 2005 Anton Altaparmakov
|
| 6 |
|
|
*
|
| 7 |
|
|
* This program/include file is free software; you can redistribute it and/or
|
| 8 |
|
|
* modify it under the terms of the GNU General Public License as published
|
| 9 |
|
|
* by the Free Software Foundation; either version 2 of the License, or
|
| 10 |
|
|
* (at your option) any later version.
|
| 11 |
|
|
*
|
| 12 |
|
|
* This program/include file is distributed in the hope that it will be
|
| 13 |
|
|
* useful, but WITHOUT ANY WARRANTY; without even the implied warranty
|
| 14 |
|
|
* of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
| 15 |
|
|
* GNU General Public License for more details.
|
| 16 |
|
|
*
|
| 17 |
|
|
* You should have received a copy of the GNU General Public License
|
| 18 |
|
|
* along with this program (in the main directory of the Linux-NTFS
|
| 19 |
|
|
* distribution in the file COPYING); if not, write to the Free Software
|
| 20 |
|
|
* Foundation,Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
|
| 21 |
|
|
*/
|
| 22 |
|
|
|
| 23 |
|
|
#ifndef _LINUX_NTFS_USNJRNL_H
|
| 24 |
|
|
#define _LINUX_NTFS_USNJRNL_H
|
| 25 |
|
|
|
| 26 |
|
|
#ifdef NTFS_RW
|
| 27 |
|
|
|
| 28 |
|
|
#include "types.h"
|
| 29 |
|
|
#include "endian.h"
|
| 30 |
|
|
#include "layout.h"
|
| 31 |
|
|
#include "volume.h"
|
| 32 |
|
|
|
| 33 |
|
|
/*
|
| 34 |
|
|
* Transaction log ($UsnJrnl) organization:
|
| 35 |
|
|
*
|
| 36 |
|
|
* The transaction log records whenever a file is modified in any way. So for
|
| 37 |
|
|
* example it will record that file "blah" was written to at a particular time
|
| 38 |
|
|
* but not what was written. If will record that a file was deleted or
|
| 39 |
|
|
* created, that a file was truncated, etc. See below for all the reason
|
| 40 |
|
|
* codes used.
|
| 41 |
|
|
*
|
| 42 |
|
|
* The transaction log is in the $Extend directory which is in the root
|
| 43 |
|
|
* directory of each volume. If it is not present it means transaction
|
| 44 |
|
|
* logging is disabled. If it is present it means transaction logging is
|
| 45 |
|
|
* either enabled or in the process of being disabled in which case we can
|
| 46 |
|
|
* ignore it as it will go away as soon as Windows gets its hands on it.
|
| 47 |
|
|
*
|
| 48 |
|
|
* To determine whether the transaction logging is enabled or in the process
|
| 49 |
|
|
* of being disabled, need to check the volume flags in the
|
| 50 |
|
|
* $VOLUME_INFORMATION attribute in the $Volume system file (which is present
|
| 51 |
|
|
* in the root directory and has a fixed mft record number, see layout.h).
|
| 52 |
|
|
* If the flag VOLUME_DELETE_USN_UNDERWAY is set it means the transaction log
|
| 53 |
|
|
* is in the process of being disabled and if this flag is clear it means the
|
| 54 |
|
|
* transaction log is enabled.
|
| 55 |
|
|
*
|
| 56 |
|
|
* The transaction log consists of two parts; the $DATA/$Max attribute as well
|
| 57 |
|
|
* as the $DATA/$J attribute. $Max is a header describing the transaction
|
| 58 |
|
|
* log whilst $J is the transaction log data itself as a sequence of variable
|
| 59 |
|
|
* sized USN_RECORDs (see below for all the structures).
|
| 60 |
|
|
*
|
| 61 |
|
|
* We do not care about transaction logging at this point in time but we still
|
| 62 |
|
|
* need to let windows know that the transaction log is out of date. To do
|
| 63 |
|
|
* this we need to stamp the transaction log. This involves setting the
|
| 64 |
|
|
* lowest_valid_usn field in the $DATA/$Max attribute to the usn to be used
|
| 65 |
|
|
* for the next added USN_RECORD to the $DATA/$J attribute as well as
|
| 66 |
|
|
* generating a new journal_id in $DATA/$Max.
|
| 67 |
|
|
*
|
| 68 |
|
|
* The journal_id is as of the current version (2.0) of the transaction log
|
| 69 |
|
|
* simply the 64-bit timestamp of when the journal was either created or last
|
| 70 |
|
|
* stamped.
|
| 71 |
|
|
*
|
| 72 |
|
|
* To determine the next usn there are two ways. The first is to parse
|
| 73 |
|
|
* $DATA/$J and to find the last USN_RECORD in it and to add its record_length
|
| 74 |
|
|
* to its usn (which is the byte offset in the $DATA/$J attribute). The
|
| 75 |
|
|
* second is simply to take the data size of the attribute. Since the usns
|
| 76 |
|
|
* are simply byte offsets into $DATA/$J, this is exactly the next usn. For
|
| 77 |
|
|
* obvious reasons we use the second method as it is much simpler and faster.
|
| 78 |
|
|
*
|
| 79 |
|
|
* As an aside, note that to actually disable the transaction log, one would
|
| 80 |
|
|
* need to set the VOLUME_DELETE_USN_UNDERWAY flag (see above), then go
|
| 81 |
|
|
* through all the mft records on the volume and set the usn field in their
|
| 82 |
|
|
* $STANDARD_INFORMATION attribute to zero. Once that is done, one would need
|
| 83 |
|
|
* to delete the transaction log file, i.e. \$Extent\$UsnJrnl, and finally,
|
| 84 |
|
|
* one would need to clear the VOLUME_DELETE_USN_UNDERWAY flag.
|
| 85 |
|
|
*
|
| 86 |
|
|
* Note that if a volume is unmounted whilst the transaction log is being
|
| 87 |
|
|
* disabled, the process will continue the next time the volume is mounted.
|
| 88 |
|
|
* This is why we can safely mount read-write when we see a transaction log
|
| 89 |
|
|
* in the process of being deleted.
|
| 90 |
|
|
*/
|
| 91 |
|
|
|
| 92 |
|
|
/* Some $UsnJrnl related constants. */
|
| 93 |
|
|
#define UsnJrnlMajorVer 2
|
| 94 |
|
|
#define UsnJrnlMinorVer 0
|
| 95 |
|
|
|
| 96 |
|
|
/*
|
| 97 |
|
|
* $DATA/$Max attribute. This is (always?) resident and has a fixed size of
|
| 98 |
|
|
* 32 bytes. It contains the header describing the transaction log.
|
| 99 |
|
|
*/
|
| 100 |
|
|
typedef struct {
|
| 101 |
|
|
/*Ofs*/
|
| 102 |
|
|
/* 0*/sle64 maximum_size; /* The maximum on-disk size of the $DATA/$J
|
| 103 |
|
|
attribute. */
|
| 104 |
|
|
/* 8*/sle64 allocation_delta; /* Number of bytes by which to increase the
|
| 105 |
|
|
size of the $DATA/$J attribute. */
|
| 106 |
|
|
/*0x10*/sle64 journal_id; /* Current id of the transaction log. */
|
| 107 |
|
|
/*0x18*/leUSN lowest_valid_usn; /* Lowest valid usn in $DATA/$J for the
|
| 108 |
|
|
current journal_id. */
|
| 109 |
|
|
/* sizeof() = 32 (0x20) bytes */
|
| 110 |
|
|
} __attribute__ ((__packed__)) USN_HEADER;
|
| 111 |
|
|
|
| 112 |
|
|
/*
|
| 113 |
|
|
* Reason flags (32-bit). Cumulative flags describing the change(s) to the
|
| 114 |
|
|
* file since it was last opened. I think the names speak for themselves but
|
| 115 |
|
|
* if you disagree check out the descriptions in the Linux NTFS project NTFS
|
| 116 |
|
|
* documentation: http://linux-ntfs.sourceforge.net/ntfs/files/usnjrnl.html
|
| 117 |
|
|
*/
|
| 118 |
|
|
enum {
|
| 119 |
|
|
USN_REASON_DATA_OVERWRITE = const_cpu_to_le32(0x00000001),
|
| 120 |
|
|
USN_REASON_DATA_EXTEND = const_cpu_to_le32(0x00000002),
|
| 121 |
|
|
USN_REASON_DATA_TRUNCATION = const_cpu_to_le32(0x00000004),
|
| 122 |
|
|
USN_REASON_NAMED_DATA_OVERWRITE = const_cpu_to_le32(0x00000010),
|
| 123 |
|
|
USN_REASON_NAMED_DATA_EXTEND = const_cpu_to_le32(0x00000020),
|
| 124 |
|
|
USN_REASON_NAMED_DATA_TRUNCATION= const_cpu_to_le32(0x00000040),
|
| 125 |
|
|
USN_REASON_FILE_CREATE = const_cpu_to_le32(0x00000100),
|
| 126 |
|
|
USN_REASON_FILE_DELETE = const_cpu_to_le32(0x00000200),
|
| 127 |
|
|
USN_REASON_EA_CHANGE = const_cpu_to_le32(0x00000400),
|
| 128 |
|
|
USN_REASON_SECURITY_CHANGE = const_cpu_to_le32(0x00000800),
|
| 129 |
|
|
USN_REASON_RENAME_OLD_NAME = const_cpu_to_le32(0x00001000),
|
| 130 |
|
|
USN_REASON_RENAME_NEW_NAME = const_cpu_to_le32(0x00002000),
|
| 131 |
|
|
USN_REASON_INDEXABLE_CHANGE = const_cpu_to_le32(0x00004000),
|
| 132 |
|
|
USN_REASON_BASIC_INFO_CHANGE = const_cpu_to_le32(0x00008000),
|
| 133 |
|
|
USN_REASON_HARD_LINK_CHANGE = const_cpu_to_le32(0x00010000),
|
| 134 |
|
|
USN_REASON_COMPRESSION_CHANGE = const_cpu_to_le32(0x00020000),
|
| 135 |
|
|
USN_REASON_ENCRYPTION_CHANGE = const_cpu_to_le32(0x00040000),
|
| 136 |
|
|
USN_REASON_OBJECT_ID_CHANGE = const_cpu_to_le32(0x00080000),
|
| 137 |
|
|
USN_REASON_REPARSE_POINT_CHANGE = const_cpu_to_le32(0x00100000),
|
| 138 |
|
|
USN_REASON_STREAM_CHANGE = const_cpu_to_le32(0x00200000),
|
| 139 |
|
|
USN_REASON_CLOSE = const_cpu_to_le32(0x80000000),
|
| 140 |
|
|
};
|
| 141 |
|
|
|
| 142 |
|
|
typedef le32 USN_REASON_FLAGS;
|
| 143 |
|
|
|
| 144 |
|
|
/*
|
| 145 |
|
|
* Source info flags (32-bit). Information about the source of the change(s)
|
| 146 |
|
|
* to the file. For detailed descriptions of what these mean, see the Linux
|
| 147 |
|
|
* NTFS project NTFS documentation:
|
| 148 |
|
|
* http://linux-ntfs.sourceforge.net/ntfs/files/usnjrnl.html
|
| 149 |
|
|
*/
|
| 150 |
|
|
enum {
|
| 151 |
|
|
USN_SOURCE_DATA_MANAGEMENT = const_cpu_to_le32(0x00000001),
|
| 152 |
|
|
USN_SOURCE_AUXILIARY_DATA = const_cpu_to_le32(0x00000002),
|
| 153 |
|
|
USN_SOURCE_REPLICATION_MANAGEMENT = const_cpu_to_le32(0x00000004),
|
| 154 |
|
|
};
|
| 155 |
|
|
|
| 156 |
|
|
typedef le32 USN_SOURCE_INFO_FLAGS;
|
| 157 |
|
|
|
| 158 |
|
|
/*
|
| 159 |
|
|
* $DATA/$J attribute. This is always non-resident, is marked as sparse, and
|
| 160 |
|
|
* is of variabled size. It consists of a sequence of variable size
|
| 161 |
|
|
* USN_RECORDS. The minimum allocated_size is allocation_delta as
|
| 162 |
|
|
* specified in $DATA/$Max. When the maximum_size specified in $DATA/$Max is
|
| 163 |
|
|
* exceeded by more than allocation_delta bytes, allocation_delta bytes are
|
| 164 |
|
|
* allocated and appended to the $DATA/$J attribute and an equal number of
|
| 165 |
|
|
* bytes at the beginning of the attribute are freed and made sparse. Note the
|
| 166 |
|
|
* making sparse only happens at volume checkpoints and hence the actual
|
| 167 |
|
|
* $DATA/$J size can exceed maximum_size + allocation_delta temporarily.
|
| 168 |
|
|
*/
|
| 169 |
|
|
typedef struct {
|
| 170 |
|
|
/*Ofs*/
|
| 171 |
|
|
/* 0*/le32 length; /* Byte size of this record (8-byte
|
| 172 |
|
|
aligned). */
|
| 173 |
|
|
/* 4*/le16 major_ver; /* Major version of the transaction log used
|
| 174 |
|
|
for this record. */
|
| 175 |
|
|
/* 6*/le16 minor_ver; /* Minor version of the transaction log used
|
| 176 |
|
|
for this record. */
|
| 177 |
|
|
/* 8*/leMFT_REF mft_reference;/* The mft reference of the file (or
|
| 178 |
|
|
directory) described by this record. */
|
| 179 |
|
|
/*0x10*/leMFT_REF parent_directory;/* The mft reference of the parent
|
| 180 |
|
|
directory of the file described by this
|
| 181 |
|
|
record. */
|
| 182 |
|
|
/*0x18*/leUSN usn; /* The usn of this record. Equals the offset
|
| 183 |
|
|
within the $DATA/$J attribute. */
|
| 184 |
|
|
/*0x20*/sle64 time; /* Time when this record was created. */
|
| 185 |
|
|
/*0x28*/USN_REASON_FLAGS reason;/* Reason flags (see above). */
|
| 186 |
|
|
/*0x2c*/USN_SOURCE_INFO_FLAGS source_info;/* Source info flags (see above). */
|
| 187 |
|
|
/*0x30*/le32 security_id; /* File security_id copied from
|
| 188 |
|
|
$STANDARD_INFORMATION. */
|
| 189 |
|
|
/*0x34*/FILE_ATTR_FLAGS file_attributes; /* File attributes copied from
|
| 190 |
|
|
$STANDARD_INFORMATION or $FILE_NAME (not
|
| 191 |
|
|
sure which). */
|
| 192 |
|
|
/*0x38*/le16 file_name_size; /* Size of the file name in bytes. */
|
| 193 |
|
|
/*0x3a*/le16 file_name_offset; /* Offset to the file name in bytes from the
|
| 194 |
|
|
start of this record. */
|
| 195 |
|
|
/*0x3c*/ntfschar file_name[0]; /* Use when creating only. When reading use
|
| 196 |
|
|
file_name_offset to determine the location
|
| 197 |
|
|
of the name. */
|
| 198 |
|
|
/* sizeof() = 60 (0x3c) bytes */
|
| 199 |
|
|
} __attribute__ ((__packed__)) USN_RECORD;
|
| 200 |
|
|
|
| 201 |
|
|
extern bool ntfs_stamp_usnjrnl(ntfs_volume *vol);
|
| 202 |
|
|
|
| 203 |
|
|
#endif /* NTFS_RW */
|
| 204 |
|
|
|
| 205 |
|
|
#endif /* _LINUX_NTFS_USNJRNL_H */
|
