Home | History | Annotate | Download | only in ntfsprogs
      1 /*
      2  * ntfsundelete - Part of the Linux-NTFS project.
      3  *
      4  * Copyright (c) 2002 Richard Russon
      5  * Copyright (c) 2007 Yura Pakhuchiy
      6  *
      7  * This utility will recover deleted files from an NTFS volume.
      8  *
      9  * This program is free software; you can redistribute it and/or modify
     10  * it under the terms of the GNU General Public License as published by
     11  * the Free Software Foundation; either version 2 of the License, or
     12  * (at your option) any later version.
     13  *
     14  * This program is distributed in the hope that it will be useful,
     15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
     16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     17  * GNU General Public License for more details.
     18  *
     19  * You should have received a copy of the GNU General Public License
     20  * along with this program (in the main directory of the Linux-NTFS
     21  * distribution in the file COPYING); if not, write to the Free Software
     22  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
     23  */
     24 
     25 #ifndef _NTFSUNDELETE_H_
     26 #define _NTFSUNDELETE_H_
     27 
     28 #include "types.h"
     29 #include "list.h"
     30 #include "runlist.h"
     31 
     32 enum optmode {
     33 	MODE_NONE = 0,
     34 	MODE_SCAN,
     35 	MODE_UNDELETE,
     36 	MODE_COPY,
     37 	MODE_ERROR
     38 };
     39 
     40 struct options {
     41 	char		*device;	/* Device/File to work with */
     42 	enum optmode	 mode;		/* Scan / Undelete / Copy */
     43 	int		 percent;	/* Minimum recoverability */
     44 	int		 uinode;	/* Undelete this inode */
     45 	char		*dest;		/* Save file to this directory */
     46 	char		*output;	/* With this filename */
     47 	char		*match;		/* Pattern for filename matching */
     48 	int		 match_case;	/* Case sensitive matching */
     49 	int		 truncate;	/* Truncate files to exact size. */
     50 	int		 quiet;		/* Less output */
     51 	int		 verbose;	/* Extra output */
     52 	int		 force;		/* Override common sense */
     53 	int              optimistic;    /* Undelete in-use clusters as well */
     54 	int		 parent;	/* Show parent directory */
     55 	time_t		 since;		/* Since this time */
     56 	s64		 size_begin;	/* Range for file size */
     57 	s64		 size_end;
     58 	s64		 mft_begin;	/* Range for mft copy */
     59 	s64		 mft_end;
     60 	char		 fillbyte;	/* Use for unrecoverable sections */
     61 };
     62 
     63 struct filename {
     64 	struct list_head list;		/* Previous/Next links */
     65 	ntfschar	*uname;		/* Filename in unicode */
     66 	int		 uname_len;	/* and its length */
     67 	long long	 size_alloc;	/* Allocated size (multiple of cluster size) */
     68 	long long	 size_data;	/* Actual size of data */
     69 	FILE_ATTR_FLAGS	 flags;
     70 	time_t		 date_c;	/* Time created */
     71 	time_t		 date_a;	/*	altered */
     72 	time_t		 date_m;	/*	mft record changed */
     73 	time_t		 date_r;	/*	read */
     74 	char		*name;		/* Filename in current locale */
     75 	FILE_NAME_TYPE_FLAGS name_space;
     76 	leMFT_REF	 parent_mref;
     77 	char		*parent_name;
     78 };
     79 
     80 struct data {
     81 	struct list_head list;		/* Previous/Next links */
     82 	char		*name;		/* Stream name in current locale */
     83 	ntfschar	*uname;		/* Unicode stream name */
     84 	int		 uname_len;	/* and its length */
     85 	int		 resident;	/* Stream is resident */
     86 	int		 compressed;	/* Stream is compressed */
     87 	int		 encrypted;	/* Stream is encrypted */
     88 	long long	 size_alloc;	/* Allocated size (multiple of cluster size) */
     89 	long long	 size_data;	/* Actual size of data */
     90 	long long	 size_init;	/* Initialised size, may be less than data size */
     91 	long long	 size_vcn;	/* Highest VCN in the data runs */
     92 	runlist_element *runlist;	/* Decoded data runs */
     93 	int		 percent;	/* Amount potentially recoverable */
     94 	void		*data;		/* If resident, a pointer to the data */
     95 };
     96 
     97 struct ufile {
     98 	long long	 inode;		/* MFT record number */
     99 	time_t		 date;		/* Last modification date/time */
    100 	struct list_head name;		/* A list of filenames */
    101 	struct list_head data;		/* A list of data streams */
    102 	char		*pref_name;	/* Preferred filename */
    103 	char		*pref_pname;	/*	     parent filename */
    104 	long long	 max_size;	/* Largest size we find */
    105 	int		 attr_list;	/* MFT record may be one of many */
    106 	int		 directory;	/* MFT record represents a directory */
    107 	MFT_RECORD	*mft;		/* Raw MFT record */
    108 };
    109 
    110 #endif /* _NTFSUNDELETE_H_ */
    111 
    112