<html> <head> <meta http-equiv="Content-Type" content="text/html; charset=unicode" /> <meta http-equiv="Content-Language" content="en-us" /> <style> <!-- p.MsoNormal {margin-top:0mm; margin-right:0mm; margin-bottom:10.0pt; margin-left:0mm; line-height:115%; font-size:11.0pt; font-family:"Calibri","sans-serif";} a:link {color:blue; text-decoration:underline;} a:visited {color:purple; text-decoration:underline;} p {margin-right:0mm; margin-left:0mm; font-size:12.0pt; font-family:"Times New Roman","serif";} --> </style> <title>Recovering and listing the deleted file from Windows Master File Table (MFT)</title> <meta name="keywords" content="Windows system, MFT, Master File Table, programming, file, delete file, recover file, hard disk, information, program examples" /> <meta name="description" content="The C/C++ programming example to recover and list the deleted file from the Windows Master File Table (MFT)" /> </head> <body lang="EN-US" link="#0000FF" vlink="#800080" topmargin="20" leftmargin="20" rightmargin="20" bottommargin="20"> <div class="Section1"> <h1 align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center"><font size="5" face="Times New Roman"> <span style="line-height:115%;font-family:&quot;Arial&quot;; font-weight:400"> Win32 Windows Volume Program and Code Example 25</span></font></h1> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal" align="center"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font><script type="text/javascript"> <!-- google_ad_client = "pub-8089415323104206"; google_ad_slot = "0761177910"; google_ad_width = 728; google_ad_height = 90; //--> </script> <script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script> </p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">Next, add a ntfs.h header file to the project.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center;line-height:normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt;font-family:&quot;Arial&quot;"> <img border="0" width="540" height="325" src="windowsvolumeapis1_files/win32volume090.png" alt="Another Day, Another MFT Program Example: List, Recover and Delete the Deleted Files from Master File Table - adding a new ntfs.h header file" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">Then, add the source code.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="green" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:green">// ntfs.h</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="green" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:green">// Just a portion of the NTFS types</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="green" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:green">// A more complete can be found in reactos.org</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="green" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:green">// source code repsitory or other Linux/Unix source code</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="green" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:green">// repo or at http://www.ntfs-3g.org/</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG Type; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT UsaOffset; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT UsaCount; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USN Usn; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} NTFS_RECORD_HEADER, *PNTFS_RECORD_HEADER; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; NTFS_RECORD_HEADER Ntfs; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT SequenceNumber; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT LinkCount; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT AttributesOffset;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font color="green"><span style="color:green">// 0x0001 = InUse, 0x0002 = Directory</span></font></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT Flags; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG BytesInUse; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG BytesAllocated; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG BaseFileRecord; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT NextAttributeNumber; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} FILE_RECORD_HEADER, *PFILE_RECORD_HEADER; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">enum</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; AttributeStandardInformation = 0x10, </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; AttributeAttributeList = 0x20, </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; AttributeFileName = 0x30, </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; AttributeObjectId = 0x40, </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; AttributeSecurityDescriptor = 0x50, </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; AttributeVolumeName = 0x60, </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; AttributeVolumeInformation = 0x70, </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; AttributeData = 0x80, </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; AttributeIndexRoot = 0x90, </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; AttributeIndexAllocation = 0xA0, </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; AttributeBitmap = 0xB0, </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; AttributeReparsePoint = 0xC0, </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; AttributeEAInformation = 0xD0, </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; AttributeEA = 0xE0, </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; AttributePropertySet = 0xF0, </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; AttributeLoggedUtilityStream = 0x100 </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} ATTRIBUTE_TYPE, *PATTRIBUTE_TYPE; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ATTRIBUTE_TYPE AttributeType; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG Length; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; BOOLEAN Nonresident; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; UCHAR NameLength; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT NameOffset;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font color="green"><span style="color:green">// 0x0001 = Compressed</span></font></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT Flags; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT AttributeNumber; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} ATTRIBUTE, *PATTRIBUTE; </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ATTRIBUTE Attribute; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG ValueLength; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT ValueOffset;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font color="green"><span style="color:green">// 0x0001 = Indexed</span></font></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT Flags; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} RESIDENT_ATTRIBUTE, *PRESIDENT_ATTRIBUTE; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ATTRIBUTE Attribute; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG LowVcn; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG HighVcn; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT RunArrayOffset; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; UCHAR CompressionUnit; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; UCHAR AlignmentOrReserved[5]; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG AllocatedSize; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG DataSize; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG InitializedSize;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font color="green"><span style="color:green">// Only when compressed</span></font></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG CompressedSize; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} NONRESIDENT_ATTRIBUTE, *PNONRESIDENT_ATTRIBUTE; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG CreationTime;&nbsp; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG ChangeTime; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG LastWriteTime;&nbsp; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG LastAccessTime;&nbsp; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG FileAttributes;&nbsp; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG AlignmentOrReservedOrUnknown[3]; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG QuotaId;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font color="green"><span style="color:green">// NTFS 3.0 only </span> </font></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG SecurityId;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font color="green"><span style="color:green">// NTFS 3.0 only </span> </font></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG QuotaCharge;&nbsp;&nbsp;&nbsp; <font color="green"><span style="color:green">// NTFS 3.0 only </span> </font></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USN Usn;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font color="green"><span style="color:green">// NTFS 3.0 only </span> </font></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} STANDARD_INFORMATION, *PSTANDARD_INFORMATION; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ATTRIBUTE_TYPE AttributeType; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT Length; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; UCHAR NameLength; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; UCHAR NameOffset; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG LowVcn; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG FileReferenceNumber; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT AttributeNumber; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT AlignmentOrReserved[3]; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} ATTRIBUTE_LIST, *PATTRIBUTE_LIST; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG DirectoryFileReferenceNumber; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG CreationTime;&nbsp;&nbsp; <font color="green"><span style="color:green">// Saved when filename last changed </span></font></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG ChangeTime;&nbsp;&nbsp;&nbsp;&nbsp; <font color="green"><span style="color:green">// ditto </span></font></span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG LastWriteTime;&nbsp; <font color="green"><span style="color:green">// ditto </span></font></span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG LastAccessTime; <font color="green"><span style="color:green">// ditto </span></font></span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG AllocatedSize;&nbsp; <font color="green"><span style="color:green">// ditto </span></font></span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG DataSize;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font color="green"><span style="color:green">// ditto </span></font></span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG FileAttributes;&nbsp;&nbsp;&nbsp;&nbsp; <font color="green"><span style="color:green">// ditto </span></font></span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG AlignmentOrReserved; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; UCHAR NameLength; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; UCHAR NameType;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font color="green"><span style="color:green">// 0x01 = Long, 0x02 = Short </span></font></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; WCHAR Name[1]; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} FILENAME_ATTRIBUTE, *PFILENAME_ATTRIBUTE; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; GUID ObjectId; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; <font color="blue"><span style="color:blue">union</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; GUID BirthVolumeId; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; GUID BirthObjectId; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; GUID DomainId; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; } ; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; UCHAR ExtendedInfo[48]; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; }; </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} OBJECTID_ATTRIBUTE, *POBJECTID_ATTRIBUTE; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG Unknown[2]; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; UCHAR MajorVersion; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; UCHAR MinorVersion; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT Flags; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} VOLUME_INFORMATION, *PVOLUME_INFORMATION; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG EntriesOffset; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG IndexBlockLength; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG AllocatedSize; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG Flags;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font color="green"><span style="color:green">// 0x00 = Small directory, 0x01 = Large directory </span></font></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} DIRECTORY_INDEX, *PDIRECTORY_INDEX; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG FileReferenceNumber; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT Length; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT AttributeLength; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG Flags;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; <font color="green"><span style="color:green">// 0x01 = Has trailing VCN, 0x02 = Last entry </span></font></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; <font color="green"><span style="color:green">// FILENAME_ATTRIBUTE Name; </span></font></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; <font color="green"><span style="color:green">// ULONGLONG Vcn;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; // VCN in IndexAllocation of earlier entries </span></font></span></font> </p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} DIRECTORY_ENTRY, *PDIRECTORY_ENTRY; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ATTRIBUTE_TYPE Type; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG CollationRule; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG BytesPerIndexBlock; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG ClustersPerIndexBlock; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; DIRECTORY_INDEX DirectoryIndex; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} INDEX_ROOT, *PINDEX_ROOT; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; NTFS_RECORD_HEADER Ntfs; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG IndexBlockVcn; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; DIRECTORY_INDEX DirectoryIndex; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} INDEX_BLOCK_HEADER, *PINDEX_BLOCK_HEADER; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG ReparseTag; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT ReparseDataLength; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT Reserved; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; UCHAR ReparseData[1]; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} REPARSE_POINT, *PREPARSE_POINT; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG EaLength; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG EaQueryLength; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} EA_INFORMATION, *PEA_INFORMATION; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG NextEntryOffset; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; UCHAR Flags; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; UCHAR EaNameLength; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT EaValueLength; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; CHAR EaName[1]; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; <font color="green"><span style="color:green">// UCHAR EaData[]; </span> </font></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} EA_ATTRIBUTE, *PEA_ATTRIBUTE; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; WCHAR AttributeName[64]; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG AttributeNumber; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG Unknown[2]; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG Flags; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG MinimumSize; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG MaximumSize; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} ATTRIBUTE_DEFINITION, *PATTRIBUTE_DEFINITION; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">#pragma</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">pack</span></font>(<font color="blue"><span style="color:blue">push</span></font>, 1) </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">typedef</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">struct</span></font> { </span> </font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; UCHAR Jump[3]; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; UCHAR Format[8]; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT BytesPerSector; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; UCHAR SectorsPerCluster; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT BootSectors; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; UCHAR Mbz1; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT Mbz2; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT Reserved1; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; UCHAR MediaType; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT Mbz3; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT SectorsPerTrack; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT NumberOfHeads; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG PartitionOffset; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG Reserved2[2]; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG TotalSectors; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG MftStartLcn; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG Mft2StartLcn; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG ClustersPerFileRecord; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONG ClustersPerIndexBlock; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; ULONGLONG VolumeSerialNumber; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; UCHAR Code[0x1AE]; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;&nbsp;&nbsp; USHORT BootSignature; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">} BOOT_BLOCK, *PBOOT_BLOCK; </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" face="Courier New"> <span style="font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal;text-autospace:none"><font size="3" color="blue" face="Courier New"> <span style="font-family:&quot;Arial&quot;;color:blue">#pragma</span></font><font size="3" face="Courier New"><span style="font-family:&quot;Arial&quot;"> <font color="blue"><span style="color:blue">pack</span></font>(<font color="blue"><span style="color:blue">pop</span></font>) </span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">Build and run the project. The following screenshot is an output sample.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center;line-height:normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt;font-family:&quot;Arial&quot;"> <img border="0" width="557" height="235" src="windowsvolumeapis1_files/win32volume091.png" alt="Another Day, Another MFT Program Example: List, Recover and Delete the Deleted Files from Master File Table - sample output without any argument supplied" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">When pressing any key, the deleted files (index, file size and file name) are stored in the <b>DeletedFile.txt</b>.</span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt; font-family:&quot;Arial&quot;">&nbsp;</span></font></p> <p class="MsoNormal" align="center" style="margin-bottom:0mm;margin-bottom:.0001pt; text-align:center;line-height:normal"><font size="3" face="Times New Roman"> <span style="font-size:12.0pt;font-family:&quot;Arial&quot;"> <img border="0" width="629" height="355" src="windowsvolumeapis1_files/win32volume092.png" alt="Another Day, Another MFT Program Example: List, Recover and Delete the Deleted Files from Master File Table - reading the MFT and recovering the deleted files looks successful" /></span></font></p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt;line-height: normal">&nbsp;</p> <p class="MsoNormal" style="margin-bottom:0mm;margin-bottom:.0001pt" align="center"> <script type="text/javascript"><!-- google_ad_client = "pub-8089415323104206"; google_ad_slot = "2156170134"; google_ad_width = 728; google_ad_height = 15; //--> </script> &nbsp;<script type="text/javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"> </script></p> <h3 align="center" style="margin-top: 0; margin-bottom: 0"> <font face="Byington"><span style="font-weight: 400">&nbsp; &lt; <a title="Another MFT Program Example: List, Recover and Delete the Deleted Files from Master File Table" href="windowsvolumeapis1_23.html"> Windows Volume 24</a> | <a title="The Win32 programming tutorial using Visual Studio, C and C++ languages" href="index.html"> Win32 Programming Index</a> | <a title="Windows storage/volume programming tutorials" href="windowsvolumeapis1index.html"> Windows Volume Index</a> | <a title="Recovering the deleted file from the Master File Table (MFT) then deleting them" href="windowsvolumeapis1_25.html"> Windows Volume 26</a> &gt;</span></font></h3> <div align="center"> <script src="http://tag.contextweb.com/TagPublish/getjs.aspx?action=VIEWAD&cwrun=200&cwadformat=300X250&cwpid=527221&cwwidth=300&cwheight=250&cwpnet=1&cwtagid=82741"></script> </div> </div> </body> </html>