2 * volume_id - reads filesystem label and uuid
4 * Copyright (C) 2004 Kay Sievers <kay.sievers@vrfy.org>
6 * This program is free software; you can redistribute it and/or modify it
7 * under the terms of the GNU General Public License as published by the
8 * Free Software Foundation version 2 of the License.
26 #include "libvolume_id.h"
29 static struct ntfs_super_block {
32 uint16_t bytes_per_sector;
33 uint8_t sectors_per_cluster;
34 uint16_t reserved_sectors;
36 uint16_t root_entries;
39 uint16_t sectors_per_fat;
40 uint16_t sectors_per_track;
42 uint32_t hidden_sectors;
43 uint32_t large_sectors;
45 uint64_t number_of_sectors;
46 uint64_t mft_cluster_location;
47 uint64_t mft_mirror_cluster_location;
48 int8_t cluster_per_mft_record;
50 int8_t cluster_per_index_record;
52 uint8_t volume_serial[8];
56 static struct master_file_table_record {
61 uint16_t sequence_number;
63 uint16_t attrs_offset;
65 uint32_t bytes_in_use;
66 uint32_t bytes_allocated;
69 static struct file_attribute {
78 uint16_t value_offset;
81 static struct volume_info {
87 #define MFT_RECORD_VOLUME 3
88 #define MFT_RECORD_ATTR_VOLUME_NAME 0x60
89 #define MFT_RECORD_ATTR_VOLUME_INFO 0x70
90 #define MFT_RECORD_ATTR_OBJECT_ID 0x40
91 #define MFT_RECORD_ATTR_END 0xffffffffu
93 int volume_id_probe_ntfs(struct volume_id *id, uint64_t off, uint64_t size)
95 unsigned int sector_size;
96 unsigned int cluster_size;
99 unsigned int mft_record_size;
100 unsigned int attr_type;
101 unsigned int attr_off;
102 unsigned int attr_len;
103 unsigned int val_off;
104 unsigned int val_len;
108 info("probing at offset 0x%llx\n", (unsigned long long) off);
110 ns = (struct ntfs_super_block *) volume_id_get_buffer(id, off, 0x200);
114 if (memcmp(ns->oem_id, "NTFS", 4) != 0)
117 volume_id_set_uuid(id, ns->volume_serial, 0, UUID_64BIT_LE);
119 sector_size = le16_to_cpu(ns->bytes_per_sector);
120 if (sector_size < 0x200)
123 cluster_size = ns->sectors_per_cluster * sector_size;
124 mft_cluster = le64_to_cpu(ns->mft_cluster_location);
125 mft_off = mft_cluster * cluster_size;
127 if (ns->cluster_per_mft_record < 0)
128 /* size = -log2(mft_record_size); normally 1024 Bytes */
129 mft_record_size = 1 << -ns->cluster_per_mft_record;
131 mft_record_size = ns->cluster_per_mft_record * cluster_size;
133 dbg("sectorsize 0x%x\n", sector_size);
134 dbg("clustersize 0x%x\n", cluster_size);
135 dbg("mftcluster %llu\n", (unsigned long long) mft_cluster);
136 dbg("mftoffset 0x%llx\n", (unsigned long long) mft_off);
137 dbg("cluster per mft_record %i\n", ns->cluster_per_mft_record);
138 dbg("mft record size %i\n", mft_record_size);
140 buf = volume_id_get_buffer(id, off + mft_off + (MFT_RECORD_VOLUME * mft_record_size),
145 mftr = (struct master_file_table_record*) buf;
146 dbg("mftr->magic '%c%c%c%c'\n", mftr->magic[0], mftr->magic[1], mftr->magic[2], mftr->magic[3]);
147 if (memcmp(mftr->magic, "FILE", 4) != 0)
150 attr_off = le16_to_cpu(mftr->attrs_offset);
151 dbg("file $Volume's attributes are at offset %i\n", attr_off);
154 attr = (struct file_attribute*) &buf[attr_off];
155 attr_type = le32_to_cpu(attr->type);
156 attr_len = le16_to_cpu(attr->len);
157 val_off = le16_to_cpu(attr->value_offset);
158 val_len = le32_to_cpu(attr->value_len);
159 attr_off += attr_len;
164 if (attr_off >= mft_record_size)
167 if (attr_type == MFT_RECORD_ATTR_END)
170 dbg("found attribute type 0x%x, len %i, at offset %i\n",
171 attr_type, attr_len, attr_off);
173 if (attr_type == MFT_RECORD_ATTR_VOLUME_INFO) {
174 dbg("found info, len %i\n", val_len);
175 info = (struct volume_info*) (((uint8_t *) attr) + val_off);
176 snprintf(id->type_version, sizeof(id->type_version)-1,
177 "%u.%u", info->major_ver, info->minor_ver);
180 if (attr_type == MFT_RECORD_ATTR_VOLUME_NAME) {
181 dbg("found label, len %i\n", val_len);
182 if (val_len > VOLUME_ID_LABEL_SIZE)
183 val_len = VOLUME_ID_LABEL_SIZE;
185 val = ((uint8_t *) attr) + val_off;
186 volume_id_set_label_raw(id, val, val_len);
187 volume_id_set_label_unicode16(id, val, LE, val_len);
191 volume_id_set_usage(id, VOLUME_ID_FILESYSTEM);