1/*
2 * ntfsundelete - Part of the Linux-NTFS project.
3 *
4 * Copyright (c) 2002 Richard Russon
5 * Copyright (c) 2007 Yura Pakhuchiy
6 *
7 * This utility will recover deleted files from an NTFS volume.
8 *
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
13 *
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17 * GNU General Public License for more details.
18 *
19 * You should have received a copy of the GNU General Public License
20 * along with this program (in the main directory of the Linux-NTFS
21 * distribution in the file COPYING); if not, write to the Free Software
22 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
23 */
24
25#ifndef _NTFSUNDELETE_H_
26#define _NTFSUNDELETE_H_
27
28#include "types.h"
29#include "list.h"
30#include "runlist.h"
31#include "utils.h"
32
33enum optmode {
34	MODE_NONE = 0,
35	MODE_SCAN,
36	MODE_UNDELETE,
37	MODE_COPY,
38	MODE_ERROR
39};
40
41struct options {
42	char		*device;	/* Device/File to work with */
43	enum optmode	 mode;		/* Scan / Undelete / Copy */
44	int		 percent;	/* Minimum recoverability */
45	int		 uinode;	/* Undelete this inode */
46	char		*dest;		/* Save file to this directory */
47	char		*output;	/* With this filename */
48	char		*match;		/* Pattern for filename matching */
49	int		 match_case;	/* Case sensitive matching */
50	int		 truncate;	/* Truncate files to exact size. */
51	int		 quiet;		/* Less output */
52	int		 verbose;	/* Extra output */
53	int		 force;		/* Override common sense */
54	int              optimistic;    /* Undelete in-use clusters as well */
55	int		 parent;	/* Show parent directory */
56	time_t		 since;		/* Since this time */
57	s64		 size_begin;	/* Range for file size */
58	s64		 size_end;
59	s64		 mft_begin;	/* Range for mft copy */
60	s64		 mft_end;
61	char		 fillbyte;	/* Use for unrecoverable sections */
62};
63
64struct filename {
65	struct ntfs_list_head list;	/* Previous/Next links */
66	ntfschar	*uname;		/* Filename in unicode */
67	int		 uname_len;	/* and its length */
68	long long	 size_alloc;	/* Allocated size (multiple of cluster size) */
69	long long	 size_data;	/* Actual size of data */
70	FILE_ATTR_FLAGS	 flags;
71	time_t		 date_c;	/* Time created */
72	time_t		 date_a;	/*	altered */
73	time_t		 date_m;	/*	mft record changed */
74	time_t		 date_r;	/*	read */
75	char		*name;		/* Filename in current locale */
76	FILE_NAME_TYPE_FLAGS name_space;
77	leMFT_REF	 parent_mref;
78	char		*parent_name;
79};
80
81struct data {
82	struct ntfs_list_head list;	/* Previous/Next links */
83	char		*name;		/* Stream name in current locale */
84	ntfschar	*uname;		/* Unicode stream name */
85	int		 uname_len;	/* and its length */
86	int		 resident;	/* Stream is resident */
87	int		 compressed;	/* Stream is compressed */
88	int		 encrypted;	/* Stream is encrypted */
89	long long	 size_alloc;	/* Allocated size (multiple of cluster size) */
90	long long	 size_data;	/* Actual size of data */
91	long long	 size_init;	/* Initialised size, may be less than data size */
92	long long	 size_vcn;	/* Highest VCN in the data runs */
93	runlist_element *runlist;	/* Decoded data runs */
94	int		 percent;	/* Amount potentially recoverable */
95	void		*data;		/* If resident, a pointer to the data */
96};
97
98struct ufile {
99	long long	 inode;		/* MFT record number */
100	time_t		 date;		/* Last modification date/time */
101	struct ntfs_list_head name;	/* A list of filenames */
102	struct ntfs_list_head data;	/* A list of data streams */
103	char		*pref_name;	/* Preferred filename */
104	char		*pref_pname;	/*	     parent filename */
105	long long	 max_size;	/* Largest size we find */
106	int		 attr_list;	/* MFT record may be one of many */
107	int		 directory;	/* MFT record represents a directory */
108	MFT_RECORD	*mft;		/* Raw MFT record */
109};
110
111#endif /* _NTFSUNDELETE_H_ */
112
113