1/*
2 * ntfsundelete - Part of the Linux-NTFS project.
3 *
4 * Copyright (c) 2002 Richard Russon
5 * Copyright (c) 2007 Yura Pakhuchiy
6 *
7 * This utility will recover deleted files from an NTFS volume.
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License
20 * along with this program (in the main directory of the Linux-NTFS
21 * distribution in the file COPYING); if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
23 */
24
25#ifndef _NTFSUNDELETE_H_
26#define _NTFSUNDELETE_H_
27
28#include "types.h"
29#include "list.h"
30#include "runlist.h"
31
32enum optmode {
33	MODE_NONE = 0,
34	MODE_SCAN,
35	MODE_UNDELETE,
36	MODE_COPY,
37	MODE_ERROR
38};
39
40struct options {
41	char		*device;	/* Device/File to work with */
42	enum optmode	 mode;		/* Scan / Undelete / Copy */
43	int		 percent;	/* Minimum recoverability */
44	int		 uinode;	/* Undelete this inode */
45	char		*dest;		/* Save file to this directory */
46	char		*output;	/* With this filename */
47	char		*match;		/* Pattern for filename matching */
48	int		 match_case;	/* Case sensitive matching */
49	int		 truncate;	/* Truncate files to exact size. */
50	int		 quiet;		/* Less output */
51	int		 verbose;	/* Extra output */
52	int		 force;		/* Override common sense */
53	int              optimistic;    /* Undelete in-use clusters as well */
54	int		 parent;	/* Show parent directory */
55	time_t		 since;		/* Since this time */
56	s64		 size_begin;	/* Range for file size */
57	s64		 size_end;
58	s64		 mft_begin;	/* Range for mft copy */
59	s64		 mft_end;
60	char		 fillbyte;	/* Use for unrecoverable sections */
61};
62
63struct filename {
64	struct list_head list;		/* Previous/Next links */
65	ntfschar	*uname;		/* Filename in unicode */
66	int		 uname_len;	/* and its length */
67	long long	 size_alloc;	/* Allocated size (multiple of cluster size) */
68	long long	 size_data;	/* Actual size of data */
69	FILE_ATTR_FLAGS	 flags;
70	time_t		 date_c;	/* Time created */
71	time_t		 date_a;	/*	altered */
72	time_t		 date_m;	/*	mft record changed */
73	time_t		 date_r;	/*	read */
74	char		*name;		/* Filename in current locale */
75	FILE_NAME_TYPE_FLAGS name_space;
76	leMFT_REF	 parent_mref;
77	char		*parent_name;
78};
79
80struct data {
81	struct list_head list;		/* Previous/Next links */
82	char		*name;		/* Stream name in current locale */
83	ntfschar	*uname;		/* Unicode stream name */
84	int		 uname_len;	/* and its length */
85	int		 resident;	/* Stream is resident */
86	int		 compressed;	/* Stream is compressed */
87	int		 encrypted;	/* Stream is encrypted */
88	long long	 size_alloc;	/* Allocated size (multiple of cluster size) */
89	long long	 size_data;	/* Actual size of data */
90	long long	 size_init;	/* Initialised size, may be less than data size */
91	long long	 size_vcn;	/* Highest VCN in the data runs */
92	runlist_element *runlist;	/* Decoded data runs */
93	int		 percent;	/* Amount potentially recoverable */
94	void		*data;		/* If resident, a pointer to the data */
95};
96
97struct ufile {
98	long long	 inode;		/* MFT record number */
99	time_t		 date;		/* Last modification date/time */
100	struct list_head name;		/* A list of filenames */
101	struct list_head data;		/* A list of data streams */
102	char		*pref_name;	/* Preferred filename */
103	char		*pref_pname;	/*	     parent filename */
104	long long	 max_size;	/* Largest size we find */
105	int		 attr_list;	/* MFT record may be one of many */
106	int		 directory;	/* MFT record represents a directory */
107	MFT_RECORD	*mft;		/* Raw MFT record */
108};
109
110#endif /* _NTFSUNDELETE_H_ */
111
112