path: root/ntfsprogs/ntfsinfo.c (plain)
blob: 32f82e76639e9d7349db3175299030f8965decc0

1	/**
2	* ntfsinfo - Part of the Linux-NTFS project.
3	*
4	* Copyright (c) 2002-2004 Matthew J. Fanto
5	* Copyright (c) 2002-2006 Anton Altaparmakov
6	* Copyright (c) 2002-2005 Richard Russon
7	* Copyright (c) 2003-2006 Szabolcs Szakacsits
8	* Copyright (c) 2004-2005 Yuval Fledel
9	* Copyright (c) 2004-2007 Yura Pakhuchiy
10	* Copyright (c) 2005 Cristian Klein
11	*
12	* This utility will dump a file's attributes.
13	*
14	* This program is free software; you can redistribute it and/or modify
15	* it under the terms of the GNU General Public License as published by
16	* the Free Software Foundation; either version 2 of the License, or
17	* (at your option) any later version.
18	*
19	* This program is distributed in the hope that it will be useful,
20	* but WITHOUT ANY WARRANTY; without even the implied warranty of
21	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22	* GNU General Public License for more details.
23	*
24	* You should have received a copy of the GNU General Public License
25	* along with this program (in the main directory of the Linux-NTFS
26	* distribution in the file COPYING); if not, write to the Free Software
27	* Foundation,Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
28	*/
29	/*
30	* TODO LIST:
31	* - Better error checking. (focus on ntfs_dump_volume)
32	* - Comment things better.
33	* - More things at verbose mode.
34	* - Dump ACLs when security_id exists (NTFS 3+ only).
35	* - Clean ups.
36	* - Internationalization.
37	* - Add more Indexed Attr Types.
38	* - Make formatting look more like www.flatcap.org/ntfs/info
39	*
40	* Still not dumping certain attributes. Need to find the best
41	* way to output some of these attributes.
42	*
43	* Still need to do:
44	* $REPARSE_POINT/$SYMBOLIC_LINK
45	* $LOGGED_UTILITY_STREAM
46	*/
47
48	#include "config.h"
49
50	#ifdef HAVE_STDIO_H
51	#include <stdio.h>
52	#endif
53	#ifdef HAVE_STDLIB_H
54	#include <stdlib.h>
55	#endif
56	#ifdef HAVE_STRING_H
57	#include <string.h>
58	#endif
59	#ifdef HAVE_TIME_H
60	#include <time.h>
61	#endif
62	#ifdef HAVE_GETOPT_H
63	#include <getopt.h>
64	#endif
65	#ifdef HAVE_ERRNO_H
66	#include <errno.h>
67	#endif
68
69	#include "types.h"
70	#include "mft.h"
71	#include "attrib.h"
72	#include "layout.h"
73	#include "inode.h"
74	#include "index.h"
75	#include "utils.h"
76	#include "security.h"
77	#include "mst.h"
78	#include "dir.h"
79	#include "ntfstime.h"
80	/* #include "version.h" */
81	#include "support.h"
82	#include "misc.h"
83
84	static const char *EXEC_NAME = "ntfsinfo";
85
86	static struct options {
87	const char *device; /* Device/File to work with */
88	const char *filename; /* Resolve this filename to mft number */
89	s64 inode; /* Info for this inode */
90	int quiet; /* Less output */
91	int verbose; /* Extra output */
92	int force; /* Override common sense */
93	int notime; /* Don't report timestamps at all */
94	int mft; /* Dump information about the volume as well */
95	} opts;
96
97	struct RUNCOUNT {
98	unsigned long runs;
99	unsigned long fragments;
100	} ;
101
102	/**
103	* version - Print version information about the program
104	*
105	* Print a copyright statement and a brief description of the program.
106	*
107	* Return: none
108	*/
109	static void version(void)
110	{
111	printf("\n%s v%s (libntfs-3g) - Display information about an NTFS "
112	"Volume.\n\n", EXEC_NAME, VERSION);
113	printf("Copyright (c)\n");
114	printf(" 2002-2004 Matthew J. Fanto\n");
115	printf(" 2002-2006 Anton Altaparmakov\n");
116	printf(" 2002-2005 Richard Russon\n");
117	printf(" 2003-2006 Szabolcs Szakacsits\n");
118	printf(" 2003 Leonard Norrgård\n");
119	printf(" 2004-2005 Yuval Fledel\n");
120	printf(" 2004-2007 Yura Pakhuchiy\n");
121	printf("\n%s\n%s%s\n", ntfs_gpl, ntfs_bugs, ntfs_home);
122	}
123
124	/**
125	* usage - Print a list of the parameters to the program
126	*
127	* Print a list of the parameters and options for the program.
128	*
129	* Return: none
130	*/
131	static void usage(void)
132	{
133	printf("\nUsage: %s [options] device\n"
134	" -i, --inode NUM Display information about this inode\n"
135	" -F, --file FILE Display information about this file (absolute path)\n"
136	" -m, --mft Dump information about the volume\n"
137	" -t, --notime Don't report timestamps\n"
138	"\n"
139	" -f, --force Use less caution\n"
140	" -q, --quiet Less output\n"
141	" -v, --verbose More output\n"
142	" -V, --version Display version information\n"
143	" -h, --help Display this help\n"
144	"\n",
145	EXEC_NAME);
146	printf("%s%s\n", ntfs_bugs, ntfs_home);
147	}
148
149	/**
150	* parse_options - Read and validate the programs command line
151	*
152	* Read the command line, verify the syntax and parse the options.
153	* This function is very long, but quite simple.
154	*
155	* Return: 1 Success
156	* 0 Error, one or more problems
157	*/
158	static int parse_options(int argc, char *argv[])
159	{
160	static const char *sopt = "-:dfhi:F:mqtTvV";
161	static const struct option lopt[] = {
162	{ "force", no_argument, NULL, 'f' },
163	{ "help", no_argument, NULL, 'h' },
164	{ "inode", required_argument, NULL, 'i' },
165	{ "file", required_argument, NULL, 'F' },
166	{ "quiet", no_argument, NULL, 'q' },
167	{ "verbose", no_argument, NULL, 'v' },
168	{ "version", no_argument, NULL, 'V' },
169	{ "notime", no_argument, NULL, 'T' },
170	{ "mft", no_argument, NULL, 'm' },
171	{ NULL, 0, NULL, 0 }
172	};
173
174	int c = -1;
175	int err = 0;
176	int ver = 0;
177	int help = 0;
178	int levels = 0;
179
180	opterr = 0; /* We'll handle the errors, thank you. */
181
182	opts.inode = -1;
183	opts.filename = NULL;
184
185	while ((c = getopt_long(argc, argv, sopt, lopt, NULL)) != -1) {
186	switch (c) {
187	case 1:
188	if (!opts.device)
189	opts.device = optarg;
190	else
191	err++;
192	break;
193	case 'i':
194	if ((opts.inode != -1) ||
195	(!utils_parse_size(optarg, &opts.inode, FALSE))) {
196	err++;
197	}
198	break;
199	case 'F':
200	if (opts.filename == NULL) {
201	/* The inode can not be resolved here,
202	store the filename */
203	opts.filename = argv[optind-1];
204	} else {
205	/* "-F" can't appear more than once */
206	err++;
207	}
208	break;
209	case 'f':
210	opts.force++;
211	break;
212	case 'h':
213	help++;
214	break;
215	case 'q':
216	opts.quiet++;
217	ntfs_log_clear_levels(NTFS_LOG_LEVEL_QUIET);
218	break;
219	case 't':
220	opts.notime++;
221	break;
222	case 'T':
223	/* 'T' is deprecated, notify */
224	ntfs_log_error("Option 'T' is deprecated, it was "
225	"replaced by 't'.\n");
226	err++;
227	break;
228	case 'v':
229	opts.verbose++;
230	ntfs_log_set_levels(NTFS_LOG_LEVEL_VERBOSE);
231	break;
232	case 'V':
233	ver++;
234	break;
235	case 'm':
236	opts.mft++;
237	break;
238	case '?':
239	if (optopt=='?') {
240	help++;
241	continue;
242	}
243	if (ntfs_log_parse_option(argv[optind-1]))
244	continue;
245	ntfs_log_error("Unknown option '%s'.\n",
246	argv[optind-1]);
247	err++;
248	break;
249	case ':':
250	ntfs_log_error("Option '%s' requires an "
251	"argument.\n", argv[optind-1]);
252	err++;
253	break;
254	default:
255	ntfs_log_error("Unhandled option case: %d.\n", c);
256	err++;
257	break;
258	}
259	}
260
261	/* Make sure we're in sync with the log levels */
262	levels = ntfs_log_get_levels();
263	if (levels & NTFS_LOG_LEVEL_VERBOSE)
264	opts.verbose++;
265	if (!(levels & NTFS_LOG_LEVEL_QUIET))
266	opts.quiet++;
267
268	if (help || ver) {
269	opts.quiet = 0;
270	} else {
271	if (opts.device == NULL) {
272	if (argc > 1)
273	ntfs_log_error("You must specify exactly one "
274	"device.\n");
275	err++;
276	}
277
278	if (opts.inode == -1 && !opts.filename && !opts.mft) {
279	if (argc > 1)
280	ntfs_log_error("You must specify an inode to "
281	"learn about.\n");
282	err++;
283	}
284
285	if (opts.quiet && opts.verbose) {
286	ntfs_log_error("You may not use --quiet and --verbose "
287	"at the same time.\n");
288	err++;
289	}
290
291	if ((opts.inode != -1) && (opts.filename != NULL)) {
292	if (argc > 1)
293	ntfs_log_error("You may not specify --inode "
294	"and --file together.\n");
295	err++;
296	}
297
298	}
299
300	if (ver)
301	version();
302	if (help || err)
303	usage();
304
305	return (!err && !help && !ver);
306	}
307
308
309	/* *************** utility functions ******************** */
310	/**
311	* ntfsinfo_time_to_str() -
312	* @sle_ntfs_clock: on disk time format in 100ns units since 1st jan 1601
313	* in little-endian format
314	*
315	* Return char* in a format 'Thu Jan 1 00:00:00 1970'.
316	* No need to free the returned memory.
317	*
318	* Example of usage:
319	* char *time_str = ntfsinfo_time_to_str(
320	* sle64_to_cpu(standard_attr->creation_time));
321	* printf("\tFile Creation Time:\t %s", time_str);
322	*/
323	static char *ntfsinfo_time_to_str(const sle64 sle_ntfs_clock)
324	{
325	/* JPA display timestamps in UTC */
326	static const char *months[]
327	= { "Jan", "Feb", "Mar", "Apr", "May", "Jun",
328	"Jul", "Aug", "Sep", "Oct", "Nov", "Dec" } ;
329	static const char *wdays[]
330	= { "Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat" } ;
331	static char str[30];
332	long long stamp;
333	u32 days;
334	u32 seconds;
335	unsigned int year;
336	unsigned int wday;
337	int mon;
338	int cnt;
339
340	stamp = sle64_to_cpu(sle_ntfs_clock);
341	days = (stamp/(86400*10000000LL)) & 0x7ffff;
342	seconds = ((stamp/10000000LL)%86400) & 0x1ffff;
343	wday = (days + 1)%7;
344	year = 1601;
345	/* periods of 400 years */
346	cnt = days/146097;
347	days -= 146097*cnt;
348	year += 400*cnt;
349	/* periods of 100 years */
350	cnt = (3*days + 3)/109573;
351	days -= 36524*cnt;
352	year += 100*cnt;
353	/* periods of 4 years */
354	cnt = days/1461;
355	days -= 1461*cnt;
356	year += 4*cnt;
357	/* periods of a single year */
358	cnt = (3*days + 3)/1096;
359	days -= 365*cnt;
360	year += cnt;
361
362	if ((!(year % 100) ? (year % 400) : (year % 4))
363	&& (days > 58)) days++;
364	if (days > 59) {
365	mon = (5*days + 161)/153;
366	days -= (153*mon - 162)/5;
367	} else {
368	mon = days/31 + 1;
369	days -= 31*(mon - 1) - 1;
370	}
371	sprintf(str,"%3s %3s %2u %02u:%02u:%02u %4u UTC\n",
372	wdays[wday],
373	months[mon-1],(unsigned int)days,
374	(unsigned int)(seconds/3600),
375	(unsigned int)(seconds/60%60),
376	(unsigned int)(seconds%60),
377	(unsigned int)year);
378	return (str);
379	}
380
381	/**
382	* ntfs_attr_get_name()
383	* @attr: a valid attribute record
384	*
385	* return multi-byte string containing the attribute name if exist. the user
386	* is then responsible of freeing that memory.
387	* null if no name exists (attr->name_length==0). no memory allocated.
388	* null if cannot convert to multi-byte string. errno would contain the
389	* error id. no memory allocated in that case
390	*/
391	static char *ntfs_attr_get_name_mbs(ATTR_RECORD *attr)
392	{
393	ntfschar *ucs_attr_name;
394	char *mbs_attr_name = NULL;
395	int mbs_attr_name_size;
396
397	/* Get name in unicode. */
398	ucs_attr_name = ntfs_attr_get_name(attr);
399	/* Convert unicode to printable format. */
400	mbs_attr_name_size = ntfs_ucstombs(ucs_attr_name, attr->name_length,
401	&mbs_attr_name, 0);
402	if (mbs_attr_name_size > 0)
403	return mbs_attr_name;
404	else
405	return NULL;
406	}
407
408
409	/* *************** functions for dumping global info ******************** */
410	/**
411	* ntfs_dump_volume - dump information about the volume
412	*/
413	static void ntfs_dump_volume(ntfs_volume *vol)
414	{
415	printf("Volume Information \n");
416	printf("\tName of device: %s\n", vol->dev->d_name);
417	printf("\tDevice state: %lu\n", vol->dev->d_state);
418	printf("\tVolume Name: %s\n", vol->vol_name);
419	printf("\tVolume State: %lu\n", vol->state);
420	printf("\tVolume Flags: 0x%04x", (int)vol->flags);
421	if (vol->flags & VOLUME_IS_DIRTY)
422	printf(" DIRTY");
423	if (vol->flags & VOLUME_MODIFIED_BY_CHKDSK)
424	printf(" MODIFIED_BY_CHKDSK");
425	printf("\n");
426	printf("\tVolume Version: %u.%u\n", vol->major_ver, vol->minor_ver);
427	printf("\tSector Size: %hu\n", vol->sector_size);
428	printf("\tCluster Size: %u\n", (unsigned int)vol->cluster_size);
429	printf("\tIndex Block Size: %u\n", (unsigned int)vol->indx_record_size);
430	printf("\tVolume Size in Clusters: %lld\n",
431	(long long)vol->nr_clusters);
432
433	printf("MFT Information \n");
434	printf("\tMFT Record Size: %u\n", (unsigned int)vol->mft_record_size);
435	printf("\tMFT Zone Multiplier: %u\n", vol->mft_zone_multiplier);
436	printf("\tMFT Data Position: %lld\n", (long long)vol->mft_data_pos);
437	printf("\tMFT Zone Start: %lld\n", (long long)vol->mft_zone_start);
438	printf("\tMFT Zone End: %lld\n", (long long)vol->mft_zone_end);
439	printf("\tMFT Zone Position: %lld\n", (long long)vol->mft_zone_pos);
440	printf("\tCurrent Position in First Data Zone: %lld\n",
441	(long long)vol->data1_zone_pos);
442	printf("\tCurrent Position in Second Data Zone: %lld\n",
443	(long long)vol->data2_zone_pos);
444	printf("\tAllocated clusters %lld (%2.1lf%%)\n",
445	(long long)vol->mft_na->allocated_size
446	>> vol->cluster_size_bits,
447	100.0*(vol->mft_na->allocated_size
448	>> vol->cluster_size_bits)
449	/ vol->nr_clusters);
450	printf("\tLCN of Data Attribute for FILE_MFT: %lld\n",
451	(long long)vol->mft_lcn);
452	printf("\tFILE_MFTMirr Size: %d\n", vol->mftmirr_size);
453	printf("\tLCN of Data Attribute for File_MFTMirr: %lld\n",
454	(long long)vol->mftmirr_lcn);
455	printf("\tSize of Attribute Definition Table: %d\n",
456	(int)vol->attrdef_len);
457	printf("\tNumber of Attached Extent Inodes: %d\n",
458	(int)vol->mft_ni->nr_extents);
459
460	printf("FILE_Bitmap Information \n");
461	printf("\tFILE_Bitmap MFT Record Number: %llu\n",
462	(unsigned long long)vol->lcnbmp_ni->mft_no);
463	printf("\tState of FILE_Bitmap Inode: %lu\n", vol->lcnbmp_ni->state);
464	printf("\tLength of Attribute List: %u\n",
465	(unsigned int)vol->lcnbmp_ni->attr_list_size);
466	/* JPA printf("\tAttribute List: %s\n", vol->lcnbmp_ni->attr_list); */
467	printf("\tNumber of Attached Extent Inodes: %d\n",
468	(int)vol->lcnbmp_ni->nr_extents);
469	/* FIXME: need to add code for the union if nr_extens != 0, but
470	i dont know if it will ever != 0 with FILE_Bitmap */
471
472	printf("FILE_Bitmap Data Attribute Information\n");
473	printf("\tDecompressed Runlist: not done yet\n");
474	printf("\tBase Inode: %llu\n",
475	(unsigned long long)vol->lcnbmp_na->ni->mft_no);
476	printf("\tAttribute Types: not done yet\n");
477	//printf("\tAttribute Name: %s\n", vol->lcnbmp_na->name);
478	printf("\tAttribute Name Length: %u\n",
479	(unsigned int)vol->lcnbmp_na->name_len);
480	printf("\tAttribute State: %lu\n", vol->lcnbmp_na->state);
481	printf("\tAttribute Allocated Size: %lld\n",
482	(long long)vol->lcnbmp_na->allocated_size);
483	printf("\tAttribute Data Size: %lld\n",
484	(long long)vol->lcnbmp_na->data_size);
485	printf("\tAttribute Initialized Size: %lld\n",
486	(long long)vol->lcnbmp_na->initialized_size);
487	printf("\tAttribute Compressed Size: %lld\n",
488	(long long)vol->lcnbmp_na->compressed_size);
489	printf("\tCompression Block Size: %u\n",
490	(unsigned int)vol->lcnbmp_na->compression_block_size);
491	printf("\tCompression Block Size Bits: %u\n",
492	vol->lcnbmp_na->compression_block_size_bits);
493	printf("\tCompression Block Clusters: %u\n",
494	vol->lcnbmp_na->compression_block_clusters);
495	if (!ntfs_volume_get_free_space(vol))
496	printf("\tFree Clusters: %lld (%2.1lf%%)\n",
497	(long long)vol->free_clusters,
498	100.0*vol->free_clusters
499	/(double)vol->nr_clusters);
500
501	//TODO: Still need to add a few more attributes
502	}
503
504	/**
505	* ntfs_dump_flags - Dump flags for STANDARD_INFORMATION and FILE_NAME.
506	* @type: dump flags for this attribute type
507	* @flags: flags for dumping
508	*/
509	static void ntfs_dump_flags(const char *indent, ATTR_TYPES type, le32 flags)
510	{
511	const le32 original_flags = flags;
512
513	printf("%sFile attributes:\t", indent);
514	if (flags & FILE_ATTR_READONLY) {
515	printf(" READONLY");
516	flags &= ~FILE_ATTR_READONLY;
517	}
518	if (flags & FILE_ATTR_HIDDEN) {
519	printf(" HIDDEN");
520	flags &= ~FILE_ATTR_HIDDEN;
521	}
522	if (flags & FILE_ATTR_SYSTEM) {
523	printf(" SYSTEM");
524	flags &= ~FILE_ATTR_SYSTEM;
525	}
526	if (flags & FILE_ATTR_DIRECTORY) {
527	printf(" DIRECTORY");
528	flags &= ~FILE_ATTR_DIRECTORY;
529	}
530	if (flags & FILE_ATTR_ARCHIVE) {
531	printf(" ARCHIVE");
532	flags &= ~FILE_ATTR_ARCHIVE;
533	}
534	if (flags & FILE_ATTR_DEVICE) {
535	printf(" DEVICE");
536	flags &= ~FILE_ATTR_DEVICE;
537	}
538	if (flags & FILE_ATTR_NORMAL) {
539	printf(" NORMAL");
540	flags &= ~FILE_ATTR_NORMAL;
541	}
542	if (flags & FILE_ATTR_TEMPORARY) {
543	printf(" TEMPORARY");
544	flags &= ~FILE_ATTR_TEMPORARY;
545	}
546	if (flags & FILE_ATTR_SPARSE_FILE) {
547	printf(" SPARSE_FILE");
548	flags &= ~FILE_ATTR_SPARSE_FILE;
549	}
550	if (flags & FILE_ATTR_REPARSE_POINT) {
551	printf(" REPARSE_POINT");
552	flags &= ~FILE_ATTR_REPARSE_POINT;
553	}
554	if (flags & FILE_ATTR_COMPRESSED) {
555	printf(" COMPRESSED");
556	flags &= ~FILE_ATTR_COMPRESSED;
557	}
558	if (flags & FILE_ATTR_OFFLINE) {
559	printf(" OFFLINE");
560	flags &= ~FILE_ATTR_OFFLINE;
561	}
562	if (flags & FILE_ATTR_NOT_CONTENT_INDEXED) {
563	printf(" NOT_CONTENT_INDEXED");
564	flags &= ~FILE_ATTR_NOT_CONTENT_INDEXED;
565	}
566	if (flags & FILE_ATTR_ENCRYPTED) {
567	printf(" ENCRYPTED");
568	flags &= ~FILE_ATTR_ENCRYPTED;
569	}
570	/* We know that FILE_ATTR_I30_INDEX_PRESENT only exists on $FILE_NAME,
571	and in case we are wrong, let it appear as UNKNOWN */
572	if (type == AT_FILE_NAME) {
573	if (flags & FILE_ATTR_I30_INDEX_PRESENT) {
574	printf(" I30_INDEX");
575	flags &= ~FILE_ATTR_I30_INDEX_PRESENT;
576	}
577	}
578	if (flags & FILE_ATTR_VIEW_INDEX_PRESENT) {
579	printf(" VIEW_INDEX");
580	flags &= ~FILE_ATTR_VIEW_INDEX_PRESENT;
581	}
582	if (flags)
583	printf(" UNKNOWN: 0x%08x", (unsigned int)le32_to_cpu(flags));
584	/* Print all the flags in hex. */
585	printf(" (0x%08x)\n", (unsigned)le32_to_cpu(original_flags));
586	}
587
588	/**
589	* ntfs_dump_namespace
590	*/
591	static void ntfs_dump_namespace(const char *indent, u8 file_name_type)
592	{
593	const char *mbs_file_type;
594
595	/* name space */
596	switch (file_name_type) {
597	case FILE_NAME_POSIX:
598	mbs_file_type = "POSIX";
599	break;
600	case FILE_NAME_WIN32:
601	mbs_file_type = "Win32";
602	break;
603	case FILE_NAME_DOS:
604	mbs_file_type = "DOS";
605	break;
606	case FILE_NAME_WIN32_AND_DOS:
607	mbs_file_type = "Win32 & DOS";
608	break;
609	default:
610	mbs_file_type = "(unknown)";
611	}
612	printf("%sNamespace:\t\t %s\n", indent, mbs_file_type);
613	}
614
615	/* *************** functions for dumping attributes ******************** */
616	/**
617	* ntfs_dump_standard_information
618	*/
619	static void ntfs_dump_attr_standard_information(ATTR_RECORD *attr)
620	{
621	STANDARD_INFORMATION *standard_attr = NULL;
622	u32 value_length;
623
624	standard_attr = (STANDARD_INFORMATION*)((char *)attr +
625	le16_to_cpu(attr->value_offset));
626
627	/* time conversion stuff */
628	if (!opts.notime) {
629	char *ntfs_time_str = NULL;
630
631	ntfs_time_str = ntfsinfo_time_to_str(standard_attr->creation_time);
632	printf("\tFile Creation Time:\t %s",ntfs_time_str);
633
634	ntfs_time_str = ntfsinfo_time_to_str(
635	standard_attr->last_data_change_time);
636	printf("\tFile Altered Time:\t %s",ntfs_time_str);
637
638	ntfs_time_str = ntfsinfo_time_to_str(
639	standard_attr->last_mft_change_time);
640	printf("\tMFT Changed Time:\t %s",ntfs_time_str);
641
642	ntfs_time_str = ntfsinfo_time_to_str(standard_attr->last_access_time);
643	printf("\tLast Accessed Time:\t %s",ntfs_time_str);
644	}
645	ntfs_dump_flags("\t", attr->type, standard_attr->file_attributes);
646
647	value_length = le32_to_cpu(attr->value_length);
648	if (value_length == 48) {
649	/* Only 12 reserved bytes here */
650	} else if (value_length == 72) {
651	printf("\tMaximum versions:\t %u \n", (unsigned int)
652	le32_to_cpu(standard_attr->maximum_versions));
653	printf("\tVersion number:\t\t %u \n", (unsigned int)
654	le32_to_cpu(standard_attr->version_number));
655	printf("\tClass ID:\t\t %u \n",
656	(unsigned int)le32_to_cpu(standard_attr->class_id));
657	printf("\tUser ID:\t\t %u (0x%x)\n",
658	(unsigned int)le32_to_cpu(standard_attr->owner_id),
659	(unsigned int)le32_to_cpu(standard_attr->owner_id));
660	printf("\tSecurity ID:\t\t %u (0x%x)\n",
661	(unsigned int)le32_to_cpu(standard_attr->security_id),
662	(unsigned int)le32_to_cpu(standard_attr->security_id));
663	printf("\tQuota charged:\t\t %llu (0x%llx)\n",
664	(unsigned long long)
665	le64_to_cpu(standard_attr->quota_charged),
666	(unsigned long long)
667	le64_to_cpu(standard_attr->quota_charged));
668	printf("\tUpdate Sequence Number:\t %llu (0x%llx)\n",
669	(unsigned long long)
670	le64_to_cpu(standard_attr->usn),
671	(unsigned long long)
672	le64_to_cpu(standard_attr->usn));
673	} else {
674	printf("\tSize of STANDARD_INFORMATION is %u (0x%x). It "
675	"should be either 72 or 48, something is "
676	"wrong...\n", (unsigned int)value_length,
677	(unsigned)value_length);
678	}
679	}
680
681	static void ntfs_dump_bytes(u8 *buf, int start, int stop)
682	{
683	int i;
684
685	for (i = start; i < stop; i++) {
686	printf("%02x ", buf[i]);
687	}
688	}
689
690	/**
691	* ntfs_dump_attr_list()
692	*/
693	static void ntfs_dump_attr_list(ATTR_RECORD *attr, ntfs_volume *vol)
694	{
695	ATTR_LIST_ENTRY *entry;
696	u8 *value;
697	s64 l;
698
699	if (!opts.verbose)
700	return;
701
702	l = ntfs_get_attribute_value_length(attr);
703	if (!l) {
704	ntfs_log_perror("ntfs_get_attribute_value_length failed");
705	return;
706	}
707	value = ntfs_malloc(l);
708	if (!value)
709	return;
710
711	l = ntfs_get_attribute_value(vol, attr, value);
712	if (!l) {
713	ntfs_log_perror("ntfs_get_attribute_value failed");
714	free(value);
715	return;
716	}
717	printf("\tDumping attribute list:");
718	entry = (ATTR_LIST_ENTRY *) value;
719	for (;(u8 *)entry < (u8 *) value + l; entry = (ATTR_LIST_ENTRY *)
720	((u8 *) entry + le16_to_cpu(entry->length))) {
721	printf("\n");
722	printf("\t\tAttribute type:\t0x%x\n",
723	(unsigned int)le32_to_cpu(entry->type));
724	printf("\t\tRecord length:\t%u (0x%x)\n",
725	(unsigned)le16_to_cpu(entry->length),
726	(unsigned)le16_to_cpu(entry->length));
727	printf("\t\tName length:\t%u (0x%x)\n",
728	(unsigned)entry->name_length,
729	(unsigned)entry->name_length);
730	printf("\t\tName offset:\t%u (0x%x)\n",
731	(unsigned)entry->name_offset,
732	(unsigned)entry->name_offset);
733	printf("\t\tStarting VCN:\t%lld (0x%llx)\n",
734	(long long)sle64_to_cpu(entry->lowest_vcn),
735	(unsigned long long)
736	sle64_to_cpu(entry->lowest_vcn));
737	printf("\t\tMFT reference:\t%lld (0x%llx)\n",
738	(unsigned long long)
739	MREF_LE(entry->mft_reference),
740	(unsigned long long)
741	MREF_LE(entry->mft_reference));
742	printf("\t\tInstance:\t%u (0x%x)\n",
743	(unsigned)le16_to_cpu(entry->instance),
744	(unsigned)le16_to_cpu(entry->instance));
745	printf("\t\tName:\t\t");
746	if (entry->name_length) {
747	char *name = NULL;
748	int name_size;
749
750	name_size = ntfs_ucstombs(entry->name,
751	entry->name_length, &name, 0);
752
753	if (name_size > 0) {
754	printf("%s\n", name);
755	free(name);
756	} else
757	ntfs_log_perror("ntfs_ucstombs failed");
758	} else
759	printf("unnamed\n");
760	printf("\t\tPadding:\t");
761	ntfs_dump_bytes((u8 *)entry, entry->name_offset +
762	sizeof(ntfschar) * entry->name_length,
763	le16_to_cpu(entry->length));
764	printf("\n");
765	}
766	free(value);
767	printf("\tEnd of attribute list reached.\n");
768	}
769
770	/**
771	* ntfs_dump_filename()
772	*/
773	static void ntfs_dump_filename(const char *indent,
774	FILE_NAME_ATTR *file_name_attr)
775	{
776	printf("%sParent directory:\t %lld (0x%llx)\n", indent,
777	(long long)MREF_LE(file_name_attr->parent_directory),
778	(long long)MREF_LE(file_name_attr->parent_directory));
779	/* time stuff */
780	if (!opts.notime) {
781	char *ntfs_time_str;
782
783	ntfs_time_str = ntfsinfo_time_to_str(
784	file_name_attr->creation_time);
785	printf("%sFile Creation Time:\t %s", indent, ntfs_time_str);
786
787	ntfs_time_str = ntfsinfo_time_to_str(
788	file_name_attr->last_data_change_time);
789	printf("%sFile Altered Time:\t %s", indent, ntfs_time_str);
790
791	ntfs_time_str = ntfsinfo_time_to_str(
792	file_name_attr->last_mft_change_time);
793	printf("%sMFT Changed Time:\t %s", indent, ntfs_time_str);
794
795	ntfs_time_str = ntfsinfo_time_to_str(
796	file_name_attr->last_access_time);
797	printf("%sLast Accessed Time:\t %s", indent, ntfs_time_str);
798	}
799	/* other basic stuff about the file */
800	printf("%sAllocated Size:\t\t %lld (0x%llx)\n", indent, (long long)
801	sle64_to_cpu(file_name_attr->allocated_size),
802	(unsigned long long)
803	sle64_to_cpu(file_name_attr->allocated_size));
804	printf("%sData Size:\t\t %lld (0x%llx)\n", indent,
805	(long long)sle64_to_cpu(file_name_attr->data_size),
806	(unsigned long long)
807	sle64_to_cpu(file_name_attr->data_size));
808	printf("%sFilename Length:\t %d (0x%x)\n", indent,
809	(unsigned)file_name_attr->file_name_length,
810	(unsigned)file_name_attr->file_name_length);
811	ntfs_dump_flags(indent, AT_FILE_NAME, file_name_attr->file_attributes);
812	if (file_name_attr->file_attributes & FILE_ATTR_REPARSE_POINT &&
813	file_name_attr->reparse_point_tag)
814	printf("%sReparse point tag:\t 0x%x\n", indent, (unsigned)
815	le32_to_cpu(file_name_attr->reparse_point_tag));
816	else if (file_name_attr->reparse_point_tag) {
817	printf("%sEA Length:\t\t %d (0x%x)\n", indent, (unsigned)
818	le16_to_cpu(file_name_attr->packed_ea_size),
819	(unsigned)
820	le16_to_cpu(file_name_attr->packed_ea_size));
821	if (file_name_attr->reserved)
822	printf("%sReserved:\t\t %d (0x%x)\n", indent,
823	(unsigned)
824	le16_to_cpu(file_name_attr->reserved),
825	(unsigned)
826	le16_to_cpu(file_name_attr->reserved));
827	}
828	/* The filename. */
829	ntfs_dump_namespace(indent, file_name_attr->file_name_type);
830	if (file_name_attr->file_name_length > 0) {
831	/* but first we need to convert the little endian unicode string
832	into a printable format */
833	char *mbs_file_name = NULL;
834	int mbs_file_name_size;
835
836	mbs_file_name_size = ntfs_ucstombs(file_name_attr->file_name,
837	file_name_attr->file_name_length,&mbs_file_name,0);
838
839	if (mbs_file_name_size>0) {
840	printf("%sFilename:\t\t '%s'\n", indent, mbs_file_name);
841	free(mbs_file_name);
842	} else {
843	/* an error occurred, errno holds the reason - notify the user */
844	ntfs_log_perror("ntfsinfo error: could not parse file name");
845	}
846	} else {
847	printf("%sFile Name:\t\t unnamed?!?\n", indent);
848	}
849	}
850
851	/**
852	* ntfs_dump_attr_file_name()
853	*/
854	static void ntfs_dump_attr_file_name(ATTR_RECORD *attr)
855	{
856	ntfs_dump_filename("\t", (FILE_NAME_ATTR*)((u8*)attr +
857	le16_to_cpu(attr->value_offset)));
858	}
859
860	/**
861	* ntfs_dump_object_id
862	*
863	* dump the $OBJECT_ID attribute - not present on all systems
864	*/
865	static void ntfs_dump_attr_object_id(ATTR_RECORD *attr,ntfs_volume *vol)
866	{
867	OBJECT_ID_ATTR *obj_id_attr = NULL;
868
869	obj_id_attr = (OBJECT_ID_ATTR *)((u8*)attr +
870	le16_to_cpu(attr->value_offset));
871
872	if (vol->major_ver >= 3.0) {
873	u32 value_length;
874	char printable_GUID[37];
875
876	value_length = le32_to_cpu(attr->value_length);
877
878	/* Object ID is mandatory. */
879	ntfs_guid_to_mbs(&obj_id_attr->object_id, printable_GUID);
880	printf("\tObject ID:\t\t %s\n", printable_GUID);
881
882	/* Dump Birth Volume ID. */
883	if ((value_length > sizeof(GUID)) && !ntfs_guid_is_zero(
884	&obj_id_attr->birth_volume_id)) {
885	ntfs_guid_to_mbs(&obj_id_attr->birth_volume_id,
886	printable_GUID);
887	printf("\tBirth Volume ID:\t\t %s\n", printable_GUID);
888	} else
889	printf("\tBirth Volume ID:\t missing\n");
890
891	/* Dumping Birth Object ID */
892	if ((value_length > sizeof(GUID)) && !ntfs_guid_is_zero(
893	&obj_id_attr->birth_object_id)) {
894	ntfs_guid_to_mbs(&obj_id_attr->birth_object_id,
895	printable_GUID);
896	printf("\tBirth Object ID:\t\t %s\n", printable_GUID);
897	} else
898	printf("\tBirth Object ID:\t missing\n");
899
900	/* Dumping Domain_id - reserved for now */
901	if ((value_length > sizeof(GUID)) && !ntfs_guid_is_zero(
902	&obj_id_attr->domain_id)) {
903	ntfs_guid_to_mbs(&obj_id_attr->domain_id,
904	printable_GUID);
905	printf("\tDomain ID:\t\t\t %s\n", printable_GUID);
906	} else
907	printf("\tDomain ID:\t\t missing\n");
908	} else
909	printf("\t$OBJECT_ID not present. Only NTFS versions > 3.0\n"
910	"\thave $OBJECT_ID. Your version of NTFS is %d.\n",
911	vol->major_ver);
912	}
913
914	/**
915	* ntfs_dump_acl
916	*
917	* given an acl, print it in a beautiful & lovely way.
918	*/
919	static void ntfs_dump_acl(const char *prefix, ACL *acl)
920	{
921	unsigned int i;
922	u16 ace_count;
923	ACCESS_ALLOWED_ACE *ace;
924
925	printf("%sRevision\t %u\n", prefix, acl->revision);
926
927	/*
928	* Do not recalculate le16_to_cpu every iteration (minor speedup on
929	* big-endian machines.
930	*/
931	ace_count = le16_to_cpu(acl->ace_count);
932
933	/* initialize 'ace' to the first ace (if any) */
934	ace = (ACCESS_ALLOWED_ACE *)((char *)acl + 8);
935
936	/* iterate through ACE's */
937	for (i = 1; i <= ace_count; i++) {
938	const char *ace_type;
939	char *sid;
940
941	/* set ace_type. */
942	switch (ace->type) {
943	case ACCESS_ALLOWED_ACE_TYPE:
944	ace_type = "allow";
945	break;
946	case ACCESS_DENIED_ACE_TYPE:
947	ace_type = "deny";
948	break;
949	case SYSTEM_AUDIT_ACE_TYPE:
950	ace_type = "audit";
951	break;
952	default:
953	ace_type = "unknown";
954	break;
955	}
956
957	printf("%sACE:\t\t type:%s flags:0x%x access:0x%x\n", prefix,
958	ace_type, (unsigned int)ace->flags,
959	(unsigned int)le32_to_cpu(ace->mask));
960	/* get a SID string */
961	sid = ntfs_sid_to_mbs(&ace->sid, NULL, 0);
962	printf("%s\t\t SID: %s\n", prefix, sid);
963	free(sid);
964
965	/* proceed to next ACE */
966	ace = (ACCESS_ALLOWED_ACE *)(((char *)ace) +
967	le16_to_cpu(ace->size));
968	}
969	}
970
971
972	static void ntfs_dump_security_descriptor(SECURITY_DESCRIPTOR_ATTR *sec_desc,
973	const char *indent)
974	{
975	char *sid;
976
977	printf("%s\tRevision:\t\t %u\n", indent, sec_desc->revision);
978
979	/* TODO: parse the flags */
980	printf("%s\tControl:\t\t 0x%04x\n", indent,
981	le16_to_cpu(sec_desc->control));
982
983	if (~sec_desc->control & SE_SELF_RELATIVE) {
984	SECURITY_DESCRIPTOR *sd = (SECURITY_DESCRIPTOR *)sec_desc;
985
986	printf("%s\tOwner SID pointer:\t %p\n", indent, sd->owner);
987	printf("%s\tGroup SID pointer:\t %p\n", indent, sd->group);
988	printf("%s\tSACL pointer:\t\t %p\n", indent, sd->sacl);
989	printf("%s\tDACL pointer:\t\t %p\n", indent, sd->dacl);
990
991	return;
992	}
993
994	if (sec_desc->owner) {
995	sid = ntfs_sid_to_mbs((SID *)((char *)sec_desc +
996	le32_to_cpu(sec_desc->owner)), NULL, 0);
997	printf("%s\tOwner SID:\t\t %s\n", indent, sid);
998	free(sid);
999	} else
1000	printf("%s\tOwner SID:\t\t missing\n", indent);
1001
1002	if (sec_desc->group) {
1003	sid = ntfs_sid_to_mbs((SID *)((char *)sec_desc +
1004	le32_to_cpu(sec_desc->group)), NULL, 0);
1005	printf("%s\tGroup SID:\t\t %s\n", indent, sid);
1006	free(sid);
1007	} else
1008	printf("%s\tGroup SID:\t\t missing\n", indent);
1009
1010	printf("%s\tSystem ACL:\t\t ", indent);
1011	if (sec_desc->control & SE_SACL_PRESENT) {
1012	if (sec_desc->control & SE_SACL_DEFAULTED) {
1013	printf("defaulted");
1014	}
1015	printf("\n");
1016	ntfs_dump_acl(indent ? "\t\t\t" : "\t\t",
1017	(ACL *)((char *)sec_desc +
1018	le32_to_cpu(sec_desc->sacl)));
1019	} else {
1020	printf("missing\n");
1021	}
1022
1023	printf("%s\tDiscretionary ACL:\t ", indent);
1024	if (sec_desc->control & SE_DACL_PRESENT) {
1025	if (sec_desc->control & SE_SACL_DEFAULTED) {
1026	printf("defaulted");
1027	}
1028	printf("\n");
1029	ntfs_dump_acl(indent ? "\t\t\t" : "\t\t",
1030	(ACL *)((char *)sec_desc +
1031	le32_to_cpu(sec_desc->dacl)));
1032	} else {
1033	printf("missing\n");
1034	}
1035	}
1036
1037	/**
1038	* ntfs_dump_security_descriptor()
1039	*
1040	* dump the security information about the file
1041	*/
1042	static void ntfs_dump_attr_security_descriptor(ATTR_RECORD *attr, ntfs_volume *vol)
1043	{
1044	SECURITY_DESCRIPTOR_ATTR *sec_desc_attr;
1045
1046	if (attr->non_resident) {
1047	/* FIXME: We don't handle fragmented mapping pairs case. */
1048	runlist *rl = ntfs_mapping_pairs_decompress(vol, attr, NULL);
1049	if (rl) {
1050	s64 data_size, bytes_read;
1051
1052	data_size = sle64_to_cpu(attr->data_size);
1053	sec_desc_attr = ntfs_malloc(data_size);
1054	if (!sec_desc_attr) {
1055	free(rl);
1056	return;
1057	}
1058	bytes_read = ntfs_rl_pread(vol, rl, 0,
1059	data_size, sec_desc_attr);
1060	if (bytes_read != data_size) {
1061	ntfs_log_error("ntfsinfo error: could not "
1062	"read security descriptor\n");
1063	free(rl);
1064	free(sec_desc_attr);
1065	return;
1066	}
1067	free(rl);
1068	} else {
1069	ntfs_log_error("ntfsinfo error: could not "
1070	"decompress runlist\n");
1071	return;
1072	}
1073	} else {
1074	sec_desc_attr = (SECURITY_DESCRIPTOR_ATTR *)((u8*)attr +
1075	le16_to_cpu(attr->value_offset));
1076	}
1077
1078	ntfs_dump_security_descriptor(sec_desc_attr, "");
1079
1080	if (attr->non_resident)
1081	free(sec_desc_attr);
1082	}
1083
1084	/**
1085	* ntfs_dump_volume_name()
1086	*
1087	* dump the name of the volume the inode belongs to
1088	*/
1089	static void ntfs_dump_attr_volume_name(ATTR_RECORD *attr)
1090	{
1091	ntfschar *ucs_vol_name = NULL;
1092
1093	if (le32_to_cpu(attr->value_length) > 0) {
1094	char *mbs_vol_name = NULL;
1095	int mbs_vol_name_size;
1096	/* calculate volume name position */
1097	ucs_vol_name = (ntfschar*)((u8*)attr +
1098	le16_to_cpu(attr->value_offset));
1099	/* convert the name to current locale multibyte sequence */
1100	mbs_vol_name_size = ntfs_ucstombs(ucs_vol_name,
1101	le32_to_cpu(attr->value_length) /
1102	sizeof(ntfschar), &mbs_vol_name, 0);
1103
1104	if (mbs_vol_name_size>0) {
1105	/* output the converted name. */
1106	printf("\tVolume Name:\t\t '%s'\n", mbs_vol_name);
1107	free(mbs_vol_name);
1108	} else
1109	ntfs_log_perror("ntfsinfo error: could not parse "
1110	"volume name");
1111	} else
1112	printf("\tVolume Name:\t\t unnamed\n");
1113	}
1114
1115	/**
1116	* ntfs_dump_volume_information()
1117	*
1118	* dump the information for the volume the inode belongs to
1119	*
1120	*/
1121	static void ntfs_dump_attr_volume_information(ATTR_RECORD *attr)
1122	{
1123	VOLUME_INFORMATION *vol_information = NULL;
1124
1125	vol_information = (VOLUME_INFORMATION*)((char *)attr+
1126	le16_to_cpu(attr->value_offset));
1127
1128	printf("\tVolume Version:\t\t %d.%d\n", vol_information->major_ver,
1129	vol_information->minor_ver);
1130	printf("\tVolume Flags:\t\t ");
1131	if (vol_information->flags & VOLUME_IS_DIRTY)
1132	printf("DIRTY ");
1133	if (vol_information->flags & VOLUME_RESIZE_LOG_FILE)
1134	printf("RESIZE_LOG ");
1135	if (vol_information->flags & VOLUME_UPGRADE_ON_MOUNT)
1136	printf("UPG_ON_MOUNT ");
1137	if (vol_information->flags & VOLUME_MOUNTED_ON_NT4)
1138	printf("MOUNTED_NT4 ");
1139	if (vol_information->flags & VOLUME_DELETE_USN_UNDERWAY)
1140	printf("DEL_USN ");
1141	if (vol_information->flags & VOLUME_REPAIR_OBJECT_ID)
1142	printf("REPAIR_OBJID ");
1143	if (vol_information->flags & VOLUME_CHKDSK_UNDERWAY)
1144	printf("CHKDSK_UNDERWAY ");
1145	if (vol_information->flags & VOLUME_MODIFIED_BY_CHKDSK)
1146	printf("MOD_BY_CHKDSK ");
1147	if (vol_information->flags & VOLUME_FLAGS_MASK) {
1148	printf("(0x%04x)\n",
1149	(unsigned)le16_to_cpu(vol_information->flags));
1150	} else
1151	printf("none set (0x0000)\n");
1152	if (vol_information->flags & (~VOLUME_FLAGS_MASK))
1153	printf("\t\t\t\t Unknown Flags: 0x%04x\n",
1154	le16_to_cpu(vol_information->flags &
1155	(~VOLUME_FLAGS_MASK)));
1156	}
1157
1158	static ntfschar NTFS_DATA_SDS[5] = { const_cpu_to_le16('$'),
1159	const_cpu_to_le16('S'), const_cpu_to_le16('D'),
1160	const_cpu_to_le16('S'), const_cpu_to_le16('\0') };
1161
1162	static void ntfs_dump_sds_entry(SECURITY_DESCRIPTOR_HEADER *sds)
1163	{
1164	SECURITY_DESCRIPTOR_RELATIVE *sd;
1165
1166	ntfs_log_verbose("\n");
1167	ntfs_log_verbose("\t\tHash:\t\t\t 0x%08x\n",
1168	(unsigned)le32_to_cpu(sds->hash));
1169	ntfs_log_verbose("\t\tSecurity id:\t\t %u (0x%x)\n",
1170	(unsigned)le32_to_cpu(sds->security_id),
1171	(unsigned)le32_to_cpu(sds->security_id));
1172	ntfs_log_verbose("\t\tOffset:\t\t\t %llu (0x%llx)\n",
1173	(unsigned long long)le64_to_cpu(sds->offset),
1174	(unsigned long long)le64_to_cpu(sds->offset));
1175	ntfs_log_verbose("\t\tLength:\t\t\t %u (0x%x)\n",
1176	(unsigned)le32_to_cpu(sds->length),
1177	(unsigned)le32_to_cpu(sds->length));
1178
1179	sd = (SECURITY_DESCRIPTOR_RELATIVE *)((char *)sds +
1180	sizeof(SECURITY_DESCRIPTOR_HEADER));
1181
1182	ntfs_dump_security_descriptor(sd, "\t");
1183	}
1184
1185	static void ntfs_dump_sds(ATTR_RECORD *attr, ntfs_inode *ni)
1186	{
1187	SECURITY_DESCRIPTOR_HEADER *sds, *sd;
1188	ntfschar *name;
1189	int name_len;
1190	s64 data_size;
1191	u64 inode;
1192
1193	inode = ni->mft_no;
1194	if (ni->nr_extents < 0)
1195	inode = ni->base_ni->mft_no;
1196	if (FILE_Secure != inode)
1197	return;
1198
1199	name_len = attr->name_length;
1200	if (!name_len)
1201	return;
1202
1203	name = (ntfschar *)((u8 *)attr + le16_to_cpu(attr->name_offset));
1204	if (!ntfs_names_are_equal(NTFS_DATA_SDS, sizeof(NTFS_DATA_SDS) / 2 - 1,
1205	name, name_len, CASE_SENSITIVE, NULL, 0))
1206	return;
1207
1208	sd = sds = ntfs_attr_readall(ni, AT_DATA, name, name_len, &data_size);
1209	if (!sd) {
1210	ntfs_log_perror("Failed to read $SDS attribute");
1211	return;
1212	}
1213	/*
1214	* FIXME: The right way is based on the indexes, so we couldn't
1215	* miss real entries. For now, dump until it makes sense.
1216	*/
1217	while (sd->length && sd->hash &&
1218	le64_to_cpu(sd->offset) < (u64)data_size &&
1219	le32_to_cpu(sd->length) < (u64)data_size &&
1220	le64_to_cpu(sd->offset) +
1221	le32_to_cpu(sd->length) < (u64)data_size) {
1222	ntfs_dump_sds_entry(sd);
1223	sd = (SECURITY_DESCRIPTOR_HEADER *)((char*)sd +
1224	((le32_to_cpu(sd->length) + 15) & ~15));
1225	}
1226	free(sds);
1227	}
1228
1229	static const char *get_attribute_type_name(le32 type)
1230	{
1231	switch (type) {
1232	case AT_UNUSED: return "$UNUSED";
1233	case AT_STANDARD_INFORMATION: return "$STANDARD_INFORMATION";
1234	case AT_ATTRIBUTE_LIST: return "$ATTRIBUTE_LIST";
1235	case AT_FILE_NAME: return "$FILE_NAME";
1236	case AT_OBJECT_ID: return "$OBJECT_ID";
1237	case AT_SECURITY_DESCRIPTOR: return "$SECURITY_DESCRIPTOR";
1238	case AT_VOLUME_NAME: return "$VOLUME_NAME";
1239	case AT_VOLUME_INFORMATION: return "$VOLUME_INFORMATION";
1240	case AT_DATA: return "$DATA";
1241	case AT_INDEX_ROOT: return "$INDEX_ROOT";
1242	case AT_INDEX_ALLOCATION: return "$INDEX_ALLOCATION";
1243	case AT_BITMAP: return "$BITMAP";
1244	case AT_REPARSE_POINT: return "$REPARSE_POINT";
1245	case AT_EA_INFORMATION: return "$EA_INFORMATION";
1246	case AT_EA: return "$EA";
1247	case AT_PROPERTY_SET: return "$PROPERTY_SET";
1248	case AT_LOGGED_UTILITY_STREAM: return "$LOGGED_UTILITY_STREAM";
1249	case AT_END: return "$END";
1250	}
1251
1252	return "$UNKNOWN";
1253	}
1254
1255	static const char * ntfs_dump_lcn(LCN lcn)
1256	{
1257	switch (lcn) {
1258	case LCN_HOLE:
1259	return "<HOLE>\t";
1260	case LCN_RL_NOT_MAPPED:
1261	return "<RL_NOT_MAPPED>";
1262	case LCN_ENOENT:
1263	return "<ENOENT>\t";
1264	case LCN_EINVAL:
1265	return "<EINVAL>\t";
1266	case LCN_EIO:
1267	return "<EIO>\t";
1268	default:
1269	ntfs_log_error("Invalid LCN value %llx passed to "
1270	"ntfs_dump_lcn().\n", (long long)lcn);
1271	return "???\t";
1272	}
1273	}
1274
1275	static void ntfs_dump_attribute_header(ntfs_attr_search_ctx *ctx,
1276	ntfs_volume *vol, struct RUNCOUNT *runcount)
1277	{
1278	ATTR_RECORD *a = ctx->attr;
1279
1280	printf("Dumping attribute %s (0x%x) from mft record %lld (0x%llx)\n",
1281	get_attribute_type_name(a->type),
1282	(unsigned)le32_to_cpu(a->type),
1283	(unsigned long long)ctx->ntfs_ino->mft_no,
1284	(unsigned long long)ctx->ntfs_ino->mft_no);
1285
1286	ntfs_log_verbose("\tAttribute length:\t %u (0x%x)\n",
1287	(unsigned)le32_to_cpu(a->length),
1288	(unsigned)le32_to_cpu(a->length));
1289	printf("\tResident: \t\t %s\n", a->non_resident ? "No" : "Yes");
1290	ntfs_log_verbose("\tName length:\t\t %u (0x%x)\n",
1291	(unsigned)a->name_length, (unsigned)a->name_length);
1292	ntfs_log_verbose("\tName offset:\t\t %u (0x%x)\n",
1293	(unsigned)le16_to_cpu(a->name_offset),
1294	(unsigned)le16_to_cpu(a->name_offset));
1295
1296	/* Dump the attribute (stream) name */
1297	if (a->name_length) {
1298	char *attribute_name = NULL;
1299
1300	attribute_name = ntfs_attr_get_name_mbs(a);
1301	if (attribute_name) {
1302	printf("\tAttribute name:\t\t '%s'\n", attribute_name);
1303	free(attribute_name);
1304	} else
1305	ntfs_log_perror("Error: couldn't parse attribute name");
1306	}
1307
1308	/* TODO: parse the flags */
1309	printf("\tAttribute flags:\t 0x%04x\n",
1310	(unsigned)le16_to_cpu(a->flags));
1311	printf("\tAttribute instance:\t %u (0x%x)\n",
1312	(unsigned)le16_to_cpu(a->instance),
1313	(unsigned)le16_to_cpu(a->instance));
1314
1315	/* Resident attribute */
1316	if (!a->non_resident) {
1317	printf("\tData size:\t\t %u (0x%x)\n",
1318	(unsigned)le32_to_cpu(a->value_length),
1319	(unsigned)le32_to_cpu(a->value_length));
1320	ntfs_log_verbose("\tData offset:\t\t %u (0x%x)\n",
1321	(unsigned)le16_to_cpu(a->value_offset),
1322	(unsigned)le16_to_cpu(a->value_offset));
1323	/* TODO: parse the flags */
1324	printf("\tResident flags:\t\t 0x%02x\n",
1325	(unsigned)a->resident_flags);
1326	ntfs_log_verbose("\tReservedR:\t\t %d (0x%x)\n",
1327	(unsigned)a->reservedR, (unsigned)a->reservedR);
1328	return;
1329	}
1330
1331	/* Non-resident attribute */
1332	ntfs_log_verbose("\tLowest VCN\t\t %lld (0x%llx)\n",
1333	(long long)sle64_to_cpu(a->lowest_vcn),
1334	(unsigned long long)sle64_to_cpu(a->lowest_vcn));
1335	ntfs_log_verbose("\tHighest VCN:\t\t %lld (0x%llx)\n",
1336	(long long)sle64_to_cpu(a->highest_vcn),
1337	(unsigned long long)sle64_to_cpu(a->highest_vcn));
1338	ntfs_log_verbose("\tMapping pairs offset:\t %u (0x%x)\n",
1339	(unsigned)le16_to_cpu(a->mapping_pairs_offset),
1340	(unsigned)le16_to_cpu(a->mapping_pairs_offset));
1341	printf("\tCompression unit:\t %u (0x%x)\n",
1342	(unsigned)a->compression_unit,
1343	(unsigned)a->compression_unit);
1344	/* TODO: dump the 5 reserved bytes here in verbose mode */
1345
1346	if (!a->lowest_vcn) {
1347	printf("\tData size:\t\t %llu (0x%llx)\n",
1348	(long long)sle64_to_cpu(a->data_size),
1349	(unsigned long long)sle64_to_cpu(a->data_size));
1350	printf("\tAllocated size:\t\t %llu (0x%llx)\n",
1351	(long long)sle64_to_cpu(a->allocated_size),
1352	(unsigned long long)
1353	sle64_to_cpu(a->allocated_size));
1354	printf("\tInitialized size:\t %llu (0x%llx)\n",
1355	(long long)sle64_to_cpu(a->initialized_size),
1356	(unsigned long long)
1357	sle64_to_cpu(a->initialized_size));
1358	if (a->compression_unit || a->flags & ATTR_IS_COMPRESSED ||
1359	a->flags & ATTR_IS_SPARSE)
1360	printf("\tCompressed size:\t %llu (0x%llx)\n",
1361	(signed long long)
1362	sle64_to_cpu(a->compressed_size),
1363	(signed long long)
1364	sle64_to_cpu(a->compressed_size));
1365	}
1366
1367	if (opts.verbose) {
1368	runlist *rl;
1369
1370	rl = ntfs_mapping_pairs_decompress(vol, a, NULL);
1371	if (rl) {
1372	runlist *rlc = rl;
1373	LCN next_lcn;
1374
1375	next_lcn = LCN_HOLE;
1376	// TODO: Switch this to properly aligned hex...
1377	printf("\tRunlist:\tVCN\t\tLCN\t\tLength\n");
1378	runcount->fragments++;
1379	while (rlc->length) {
1380	runcount->runs++;
1381	if (rlc->lcn >= 0) {
1382	printf("\t\t\t0x%llx\t\t0x%llx\t\t"
1383	"0x%llx\n",
1384	(long long)rlc->vcn,
1385	(long long)rlc->lcn,
1386	(long long)rlc->length);
1387	if ((next_lcn >= 0)
1388	&& (rlc->lcn != next_lcn))
1389	runcount->fragments++;
1390	next_lcn = rlc->lcn + rlc->length;
1391	} else
1392	printf("\t\t\t0x%llx\t\t%s\t"
1393	"0x%llx\n",
1394	(long long)rlc->vcn,
1395	ntfs_dump_lcn(rlc->lcn),
1396	(long long)rlc->length);
1397	rlc++;
1398	}
1399	free(rl);
1400	} else
1401	ntfs_log_error("Error: couldn't decompress runlist\n");
1402	}
1403	}
1404
1405	/**
1406	* ntfs_dump_data_attr()
1407	*
1408	* dump some info about the data attribute if it's metadata
1409	*/
1410	static void ntfs_dump_attr_data(ATTR_RECORD *attr, ntfs_inode *ni)
1411	{
1412	if (opts.verbose)
1413	ntfs_dump_sds(attr, ni);
1414	}
1415
1416	typedef enum {
1417	INDEX_ATTR_UNKNOWN,
1418	INDEX_ATTR_DIRECTORY_I30,
1419	INDEX_ATTR_SECURE_SII,
1420	INDEX_ATTR_SECURE_SDH,
1421	INDEX_ATTR_OBJID_O,
1422	INDEX_ATTR_REPARSE_R,
1423	INDEX_ATTR_QUOTA_O,
1424	INDEX_ATTR_QUOTA_Q,
1425	} INDEX_ATTR_TYPE;
1426
1427	static void ntfs_dump_index_key(INDEX_ENTRY *entry, INDEX_ATTR_TYPE type)
1428	{
1429	char *sid;
1430	char printable_GUID[37];
1431
1432	switch (type) {
1433	case INDEX_ATTR_SECURE_SII:
1434	ntfs_log_verbose("\t\tKey security id:\t %u (0x%x)\n",
1435	(unsigned)
1436	le32_to_cpu(entry->key.sii.security_id),
1437	(unsigned)
1438	le32_to_cpu(entry->key.sii.security_id));
1439	break;
1440	case INDEX_ATTR_SECURE_SDH:
1441	ntfs_log_verbose("\t\tKey hash:\t\t 0x%08x\n",
1442	(unsigned)le32_to_cpu(entry->key.sdh.hash));
1443	ntfs_log_verbose("\t\tKey security id:\t %u (0x%x)\n",
1444	(unsigned)
1445	le32_to_cpu(entry->key.sdh.security_id),
1446	(unsigned)
1447	le32_to_cpu(entry->key.sdh.security_id));
1448	break;
1449	case INDEX_ATTR_OBJID_O:
1450	ntfs_guid_to_mbs(&entry->key.object_id, printable_GUID);
1451	ntfs_log_verbose("\t\tKey GUID:\t\t %s\n", printable_GUID);
1452	break;
1453	case INDEX_ATTR_REPARSE_R:
1454	ntfs_log_verbose("\t\tKey reparse tag:\t 0x%08x\n", (unsigned)
1455	le32_to_cpu(entry->key.reparse.reparse_tag));
1456	ntfs_log_verbose("\t\tKey file id:\t\t %llu (0x%llx)\n",
1457	(unsigned long long)
1458	le64_to_cpu(entry->key.reparse.file_id),
1459	(unsigned long long)
1460	le64_to_cpu(entry->key.reparse.file_id));
1461	break;
1462	case INDEX_ATTR_QUOTA_O:
1463	sid = ntfs_sid_to_mbs(&entry->key.sid, NULL, 0);
1464	ntfs_log_verbose("\t\tKey SID:\t\t %s\n", sid);
1465	free(sid);
1466	break;
1467	case INDEX_ATTR_QUOTA_Q:
1468	ntfs_log_verbose("\t\tKey owner id:\t\t %u (0x%x)\n",
1469	(unsigned)le32_to_cpu(entry->key.owner_id),
1470	(unsigned)le32_to_cpu(entry->key.owner_id));
1471	break;
1472	default:
1473	ntfs_log_verbose("\t\tIndex attr type is UNKNOWN: \t 0x%08x\n",
1474	(unsigned)type);
1475	break;
1476	}
1477	}
1478
1479	typedef union {
1480	SII_INDEX_DATA sii; /* $SII index data in $Secure */
1481	SDH_INDEX_DATA sdh; /* $SDH index data in $Secure */
1482	QUOTA_O_INDEX_DATA quota_o; /* $O index data in $Quota */
1483	QUOTA_CONTROL_ENTRY quota_q; /* $Q index data in $Quota */
1484	} __attribute__((__packed__)) INDEX_ENTRY_DATA;
1485
1486	static void ntfs_dump_index_data(INDEX_ENTRY *entry, INDEX_ATTR_TYPE type)
1487	{
1488	INDEX_ENTRY_DATA *data;
1489
1490	data = (INDEX_ENTRY_DATA *)((u8 *)entry +
1491	le16_to_cpu(entry->data_offset));
1492
1493	switch (type) {
1494	case INDEX_ATTR_SECURE_SII:
1495	ntfs_log_verbose("\t\tHash:\t\t\t 0x%08x\n",
1496	(unsigned)le32_to_cpu(data->sii.hash));
1497	ntfs_log_verbose("\t\tSecurity id:\t\t %u (0x%x)\n",
1498	(unsigned)le32_to_cpu(data->sii.security_id),
1499	(unsigned)le32_to_cpu(data->sii.security_id));
1500	ntfs_log_verbose("\t\tOffset in $SDS:\t\t %llu (0x%llx)\n",
1501	(unsigned long long)
1502	le64_to_cpu(data->sii.offset),
1503	(unsigned long long)
1504	le64_to_cpu(data->sii.offset));
1505	ntfs_log_verbose("\t\tLength in $SDS:\t\t %u (0x%x)\n",
1506	(unsigned)le32_to_cpu(data->sii.length),
1507	(unsigned)le32_to_cpu(data->sii.length));
1508	break;
1509	case INDEX_ATTR_SECURE_SDH:
1510	ntfs_log_verbose("\t\tHash:\t\t\t 0x%08x\n",
1511	(unsigned)le32_to_cpu(data->sdh.hash));
1512	ntfs_log_verbose("\t\tSecurity id:\t\t %u (0x%x)\n",
1513	(unsigned)le32_to_cpu(data->sdh.security_id),
1514	(unsigned)le32_to_cpu(data->sdh.security_id));
1515	ntfs_log_verbose("\t\tOffset in $SDS:\t\t %llu (0x%llx)\n",
1516	(unsigned long long)
1517	le64_to_cpu(data->sdh.offset),
1518	(unsigned long long)
1519	le64_to_cpu(data->sdh.offset));
1520	ntfs_log_verbose("\t\tLength in $SDS:\t\t %u (0x%x)\n",
1521	(unsigned)le32_to_cpu(data->sdh.length),
1522	(unsigned)le32_to_cpu(data->sdh.length));
1523	ntfs_log_verbose("\t\tUnknown (padding):\t 0x%08x\n",
1524	(unsigned)le32_to_cpu(data->sdh.reserved_II));
1525	break;
1526	case INDEX_ATTR_OBJID_O: {
1527	OBJ_ID_INDEX_DATA *object_id_data;
1528	char printable_GUID[37];
1529
1530	object_id_data = (OBJ_ID_INDEX_DATA*)((u8*)entry +
1531	le16_to_cpu(entry->data_offset));
1532	ntfs_log_verbose("\t\tMFT Number:\t\t 0x%llx\n",
1533	(unsigned long long)
1534	MREF_LE(object_id_data->mft_reference));
1535	ntfs_log_verbose("\t\tMFT Sequence Number:\t 0x%x\n",
1536	(unsigned)
1537	MSEQNO_LE(object_id_data->mft_reference));
1538	ntfs_guid_to_mbs(&object_id_data->birth_volume_id,
1539	printable_GUID);
1540	ntfs_log_verbose("\t\tBirth volume id GUID:\t %s\n",
1541	printable_GUID);
1542	ntfs_guid_to_mbs(&object_id_data->birth_object_id,
1543	printable_GUID);
1544	ntfs_log_verbose("\t\tBirth object id GUID:\t %s\n",
1545	printable_GUID);
1546	ntfs_guid_to_mbs(&object_id_data->domain_id, printable_GUID);
1547	ntfs_log_verbose("\t\tDomain id GUID:\t\t %s\n",
1548	printable_GUID);
1549	}
1550	break;
1551	case INDEX_ATTR_REPARSE_R:
1552	/* TODO */
1553	break;
1554	case INDEX_ATTR_QUOTA_O:
1555	ntfs_log_verbose("\t\tOwner id:\t\t %u (0x%x)\n",
1556	(unsigned)le32_to_cpu(data->quota_o.owner_id),
1557	(unsigned)le32_to_cpu(data->quota_o.owner_id));
1558	ntfs_log_verbose("\t\tUnknown:\t\t %u (0x%x)\n",
1559	(unsigned)le32_to_cpu(data->quota_o.unknown),
1560	(unsigned)le32_to_cpu(data->quota_o.unknown));
1561	break;
1562	case INDEX_ATTR_QUOTA_Q:
1563	ntfs_log_verbose("\t\tVersion:\t\t %u\n",
1564	(unsigned)le32_to_cpu(data->quota_q.version));
1565	ntfs_log_verbose("\t\tQuota flags:\t\t 0x%08x\n",
1566	(unsigned)le32_to_cpu(data->quota_q.flags));
1567	ntfs_log_verbose("\t\tBytes used:\t\t %llu (0x%llx)\n",
1568	(unsigned long long)
1569	le64_to_cpu(data->quota_q.bytes_used),
1570	(unsigned long long)
1571	le64_to_cpu(data->quota_q.bytes_used));
1572	ntfs_log_verbose("\t\tLast changed:\t\t %s",
1573	ntfsinfo_time_to_str(
1574	data->quota_q.change_time));
1575	ntfs_log_verbose("\t\tThreshold:\t\t %lld (0x%llx)\n",
1576	(unsigned long long)
1577	sle64_to_cpu(data->quota_q.threshold),
1578	(unsigned long long)
1579	sle64_to_cpu(data->quota_q.threshold));
1580	ntfs_log_verbose("\t\tLimit:\t\t\t %lld (0x%llx)\n",
1581	(unsigned long long)
1582	sle64_to_cpu(data->quota_q.limit),
1583	(unsigned long long)
1584	sle64_to_cpu(data->quota_q.limit));
1585	ntfs_log_verbose("\t\tExceeded time:\t\t %lld (0x%llx)\n",
1586	(unsigned long long)
1587	sle64_to_cpu(data->quota_q.exceeded_time),
1588	(unsigned long long)
1589	sle64_to_cpu(data->quota_q.exceeded_time));
1590	if (le16_to_cpu(entry->data_length) > 48) {
1591	char *sid;
1592	sid = ntfs_sid_to_mbs(&data->quota_q.sid, NULL, 0);
1593	ntfs_log_verbose("\t\tOwner SID:\t\t %s\n", sid);
1594	free(sid);
1595	}
1596	break;
1597	default:
1598	ntfs_log_verbose("\t\tIndex attr type is UNKNOWN: \t 0x%08x\n",
1599	(unsigned)type);
1600	break;
1601	}
1602	}
1603
1604	/**
1605	* ntfs_dump_index_entries()
1606	*
1607	* dump sequence of index_entries and return number of entries dumped.
1608	*/
1609	static int ntfs_dump_index_entries(INDEX_ENTRY *entry, INDEX_ATTR_TYPE type)
1610	{
1611	int numb_entries = 1;
1612	while (1) {
1613	if (!opts.verbose) {
1614	if (entry->ie_flags & INDEX_ENTRY_END)
1615	break;
1616	entry = (INDEX_ENTRY *)((u8 *)entry +
1617	le16_to_cpu(entry->length));
1618	numb_entries++;
1619	continue;
1620	}
1621	ntfs_log_verbose("\t\tEntry length:\t\t %u (0x%x)\n",
1622	(unsigned)le16_to_cpu(entry->length),
1623	(unsigned)le16_to_cpu(entry->length));
1624	ntfs_log_verbose("\t\tKey length:\t\t %u (0x%x)\n",
1625	(unsigned)le16_to_cpu(entry->key_length),
1626	(unsigned)le16_to_cpu(entry->key_length));
1627	ntfs_log_verbose("\t\tIndex entry flags:\t 0x%02x\n",
1628	(unsigned)le16_to_cpu(entry->ie_flags));
1629
1630	if (entry->ie_flags & INDEX_ENTRY_NODE)
1631	ntfs_log_verbose("\t\tSubnode VCN:\t\t %lld (0x%llx)\n",
1632	(long long)ntfs_ie_get_vcn(entry),
1633	(long long)ntfs_ie_get_vcn(entry));
1634	if (entry->ie_flags & INDEX_ENTRY_END)
1635	break;
1636
1637	switch (type) {
1638	case INDEX_ATTR_DIRECTORY_I30:
1639	ntfs_log_verbose("\t\tFILE record number:\t %llu "
1640	"(0x%llx)\n", (unsigned long long)
1641	MREF_LE(entry->indexed_file),
1642	(unsigned long long)
1643	MREF_LE(entry->indexed_file));
1644	ntfs_dump_filename("\t\t", &entry->key.file_name);
1645	break;
1646	default:
1647	ntfs_log_verbose("\t\tData offset:\t\t %u (0x%x)\n",
1648	(unsigned)
1649	le16_to_cpu(entry->data_offset),
1650	(unsigned)
1651	le16_to_cpu(entry->data_offset));
1652	ntfs_log_verbose("\t\tData length:\t\t %u (0x%x)\n",
1653	(unsigned)
1654	le16_to_cpu(entry->data_length),
1655	(unsigned)
1656	le16_to_cpu(entry->data_length));
1657	ntfs_dump_index_key(entry, type);
1658	ntfs_log_verbose("\t\tKey Data:\n");
1659	ntfs_dump_index_data(entry, type);
1660	break;
1661	}
1662	if (!entry->length) {
1663	ntfs_log_verbose("\tWARNING: Corrupt index entry, "
1664	"skipping the remainder of this index "
1665	"block.\n");
1666	break;
1667	}
1668	entry = (INDEX_ENTRY*)((u8*)entry + le16_to_cpu(entry->length));
1669	numb_entries++;
1670	ntfs_log_verbose("\n");
1671	}
1672	ntfs_log_verbose("\tEnd of index block reached\n");
1673	return numb_entries;
1674	}
1675
1676	#define COMPARE_INDEX_NAMES(attr, name) \
1677	ntfs_names_are_equal((name), sizeof(name) / 2 - 1, \
1678	(ntfschar*)((char*)(attr) + le16_to_cpu((attr)->name_offset)), \
1679	(attr)->name_length, CASE_SENSITIVE, NULL, 0)
1680
1681	static INDEX_ATTR_TYPE get_index_attr_type(ntfs_inode *ni, ATTR_RECORD *attr,
1682	INDEX_ROOT *index_root)
1683	{
1684	char file_name[64];
1685
1686	if (!attr->name_length)
1687	return INDEX_ATTR_UNKNOWN;
1688
1689	if (index_root->type) {
1690	if (index_root->type == AT_FILE_NAME)
1691	return INDEX_ATTR_DIRECTORY_I30;
1692	else
1693	/* weird, this should be illegal */
1694	ntfs_log_error("Unknown index attribute type: 0x%0X\n",
1695	index_root->type);
1696	return INDEX_ATTR_UNKNOWN;
1697	}
1698
1699	if (utils_is_metadata(ni) <= 0)
1700	return INDEX_ATTR_UNKNOWN;
1701	if (utils_inode_get_name(ni, file_name, sizeof(file_name)) <= 0)
1702	return INDEX_ATTR_UNKNOWN;
1703
1704	if (COMPARE_INDEX_NAMES(attr, NTFS_INDEX_SDH))
1705	return INDEX_ATTR_SECURE_SDH;
1706	else if (COMPARE_INDEX_NAMES(attr, NTFS_INDEX_SII))
1707	return INDEX_ATTR_SECURE_SII;
1708	else if (COMPARE_INDEX_NAMES(attr, NTFS_INDEX_SII))
1709	return INDEX_ATTR_SECURE_SII;
1710	else if (COMPARE_INDEX_NAMES(attr, NTFS_INDEX_Q))
1711	return INDEX_ATTR_QUOTA_Q;
1712	else if (COMPARE_INDEX_NAMES(attr, NTFS_INDEX_R))
1713	return INDEX_ATTR_REPARSE_R;
1714	else if (COMPARE_INDEX_NAMES(attr, NTFS_INDEX_O)) {
1715	if (!strcmp(file_name, "/$Extend/$Quota"))
1716	return INDEX_ATTR_QUOTA_O;
1717	else if (!strcmp(file_name, "/$Extend/$ObjId"))
1718	return INDEX_ATTR_OBJID_O;
1719	}
1720
1721	return INDEX_ATTR_UNKNOWN;
1722	}
1723
1724	static void ntfs_dump_index_attr_type(INDEX_ATTR_TYPE type)
1725	{
1726	if (type == INDEX_ATTR_DIRECTORY_I30)
1727	printf("DIRECTORY_I30");
1728	else if (type == INDEX_ATTR_SECURE_SDH)
1729	printf("SECURE_SDH");
1730	else if (type == INDEX_ATTR_SECURE_SII)
1731	printf("SECURE_SII");
1732	else if (type == INDEX_ATTR_OBJID_O)
1733	printf("OBJID_O");
1734	else if (type == INDEX_ATTR_QUOTA_O)
1735	printf("QUOTA_O");
1736	else if (type == INDEX_ATTR_QUOTA_Q)
1737	printf("QUOTA_Q");
1738	else if (type == INDEX_ATTR_REPARSE_R)
1739	printf("REPARSE_R");
1740	else
1741	printf("UNKNOWN");
1742	printf("\n");
1743	}
1744
1745	static void ntfs_dump_index_header(const char *indent, INDEX_HEADER *idx)
1746	{
1747	printf("%sEntries Offset:\t\t %u (0x%x)\n", indent,
1748	(unsigned)le32_to_cpu(idx->entries_offset),
1749	(unsigned)le32_to_cpu(idx->entries_offset));
1750	printf("%sIndex Size:\t\t %u (0x%x)\n", indent,
1751	(unsigned)le32_to_cpu(idx->index_length),
1752	(unsigned)le32_to_cpu(idx->index_length));
1753	printf("%sAllocated Size:\t\t %u (0x%x)\n", indent,
1754	(unsigned)le32_to_cpu(idx->allocated_size),
1755	(unsigned)le32_to_cpu(idx->allocated_size));
1756	printf("%sIndex header flags:\t 0x%02x\n", indent, idx->ih_flags);
1757
1758	/* FIXME: there are 3 reserved bytes here */
1759	}
1760
1761	/**
1762	* ntfs_dump_attr_index_root()
1763	*
1764	* dump the index_root attribute
1765	*/
1766	static void ntfs_dump_attr_index_root(ATTR_RECORD *attr, ntfs_inode *ni)
1767	{
1768	INDEX_ATTR_TYPE type;
1769	INDEX_ROOT *index_root = NULL;
1770	INDEX_ENTRY *entry;
1771
1772	index_root = (INDEX_ROOT*)((u8*)attr + le16_to_cpu(attr->value_offset));
1773
1774	/* attr_type dumping */
1775	type = get_index_attr_type(ni, attr, index_root);
1776	printf("\tIndexed Attr Type:\t ");
1777	ntfs_dump_index_attr_type(type);
1778
1779	/* collation rule dumping */
1780	printf("\tCollation Rule:\t\t %u (0x%x)\n",
1781	(unsigned)le32_to_cpu(index_root->collation_rule),
1782	(unsigned)le32_to_cpu(index_root->collation_rule));
1783	/* COLLATION_BINARY, COLLATION_FILE_NAME, COLLATION_UNICODE_STRING,
1784	COLLATION_NTOFS_ULONG, COLLATION_NTOFS_SID,
1785	COLLATION_NTOFS_SECURITY_HASH, COLLATION_NTOFS_ULONGS */
1786
1787	printf("\tIndex Block Size:\t %u (0x%x)\n",
1788	(unsigned)le32_to_cpu(index_root->index_block_size),
1789	(unsigned)le32_to_cpu(index_root->index_block_size));
1790	if (le32_to_cpu(index_root->index_block_size) < ni->vol->cluster_size)
1791	printf("\t512-byte Units Per Block:\t %u (0x%x)\n",
1792	(unsigned)index_root->clusters_per_index_block,
1793	(unsigned)index_root->clusters_per_index_block);
1794	else
1795	printf("\tClusters Per Block:\t %u (0x%x)\n",
1796	(unsigned)index_root->clusters_per_index_block,
1797	(unsigned)index_root->clusters_per_index_block);
1798
1799	ntfs_dump_index_header("\t", &index_root->index);
1800
1801	entry = (INDEX_ENTRY*)((u8*)index_root +
1802	le32_to_cpu(index_root->index.entries_offset) + 0x10);
1803	ntfs_log_verbose("\tDumping index root:\n");
1804	printf("\tIndex entries total:\t %d\n",
1805	ntfs_dump_index_entries(entry, type));
1806	}
1807
1808	static void ntfs_dump_usa_lsn(const char *indent, MFT_RECORD *mrec)
1809	{
1810	printf("%sUpd. Seq. Array Off.:\t %u (0x%x)\n", indent,
1811	(unsigned)le16_to_cpu(mrec->usa_ofs),
1812	(unsigned)le16_to_cpu(mrec->usa_ofs));
1813	printf("%sUpd. Seq. Array Count:\t %u (0x%x)\n", indent,
1814	(unsigned)le16_to_cpu(mrec->usa_count),
1815	(unsigned)le16_to_cpu(mrec->usa_count));
1816	printf("%sUpd. Seq. Number:\t %u (0x%x)\n", indent,
1817	(unsigned)le16_to_cpup((le16*)((u8*)mrec +
1818	le16_to_cpu(mrec->usa_ofs))),
1819	(unsigned)le16_to_cpup((le16*)((u8*)mrec +
1820	le16_to_cpu(mrec->usa_ofs))));
1821	printf("%sLogFile Seq. Number:\t 0x%llx\n", indent,
1822	(unsigned long long)sle64_to_cpu(mrec->lsn));
1823	}
1824
1825
1826	static s32 ntfs_dump_index_block(INDEX_BLOCK *ib, INDEX_ATTR_TYPE type,
1827	u32 ib_size)
1828	{
1829	INDEX_ENTRY *entry;
1830
1831	if (ntfs_mst_post_read_fixup((NTFS_RECORD*)ib, ib_size)) {
1832	ntfs_log_perror("Damaged INDX record");
1833	return -1;
1834	}
1835	ntfs_log_verbose("\tDumping index block:\n");
1836	if (opts.verbose)
1837	ntfs_dump_usa_lsn("\t\t", (MFT_RECORD*)ib);
1838
1839	ntfs_log_verbose("\t\tNode VCN:\t\t %lld (0x%llx)\n",
1840	(unsigned long long)sle64_to_cpu(ib->index_block_vcn),
1841	(unsigned long long)sle64_to_cpu(ib->index_block_vcn));
1842
1843	entry = (INDEX_ENTRY*)((u8*)ib +
1844	le32_to_cpu(ib->index.entries_offset) + 0x18);
1845
1846	if (opts.verbose) {
1847	ntfs_dump_index_header("\t\t", &ib->index);
1848	printf("\n");
1849	}
1850
1851	return ntfs_dump_index_entries(entry, type);
1852	}
1853
1854	/**
1855	* ntfs_dump_attr_index_allocation()
1856	*
1857	* dump context of the index_allocation attribute
1858	*/
1859	static void ntfs_dump_attr_index_allocation(ATTR_RECORD *attr, ntfs_inode *ni)
1860	{
1861	INDEX_ALLOCATION *allocation, *tmp_alloc;
1862	INDEX_ROOT *ir;
1863	INDEX_ATTR_TYPE type;
1864	int total_entries = 0;
1865	int total_indx_blocks = 0;
1866	u8 *bitmap, *byte;
1867	int bit;
1868	ntfschar *name;
1869	u32 name_len;
1870	s64 data_size;
1871
1872	ir = ntfs_index_root_get(ni, attr);
1873	if (!ir) {
1874	ntfs_log_perror("Failed to read $INDEX_ROOT attribute");
1875	return;
1876	}
1877
1878	type = get_index_attr_type(ni, attr, ir);
1879
1880	name = (ntfschar *)((u8 *)attr + le16_to_cpu(attr->name_offset));
1881	name_len = attr->name_length;
1882
1883	byte = bitmap = ntfs_attr_readall(ni, AT_BITMAP, name, name_len, NULL);
1884	if (!byte) {
1885	ntfs_log_perror("Failed to read $BITMAP attribute");
1886	goto out_index_root;
1887	}
1888
1889	tmp_alloc = allocation = ntfs_attr_readall(ni, AT_INDEX_ALLOCATION,
1890	name, name_len, &data_size);
1891	if (!tmp_alloc) {
1892	ntfs_log_perror("Failed to read $INDEX_ALLOCATION attribute");
1893	goto out_bitmap;
1894	}
1895
1896	bit = 0;
1897	while ((u8 *)tmp_alloc < (u8 *)allocation + data_size) {
1898	if (*byte & (1 << bit)) {
1899	int entries;
1900
1901	entries = ntfs_dump_index_block(tmp_alloc, type,
1902	le32_to_cpu(
1903	ir->index_block_size));
1904	if (entries != -1) {
1905	total_entries += entries;
1906	total_indx_blocks++;
1907	ntfs_log_verbose("\tIndex entries:\t\t %d\n",
1908	entries);
1909	}
1910	}
1911	tmp_alloc = (INDEX_ALLOCATION *)((u8 *)tmp_alloc +
1912	le32_to_cpu(
1913	ir->index_block_size));
1914	bit++;
1915	if (bit > 7) {
1916	bit = 0;
1917	byte++;
1918	}
1919	}
1920
1921	printf("\tIndex entries total:\t %d\n", total_entries);
1922	printf("\tINDX blocks total:\t %d\n", total_indx_blocks);
1923
1924	free(allocation);
1925	out_bitmap:
1926	free(bitmap);
1927	out_index_root:
1928	free(ir);
1929	}
1930
1931	/**
1932	* ntfs_dump_attr_bitmap()
1933	*
1934	* dump the bitmap attribute
1935	*/
1936	static void ntfs_dump_attr_bitmap(ATTR_RECORD *attr __attribute__((unused)))
1937	{
1938	/* TODO */
1939	}
1940
1941	/**
1942	* ntfs_dump_attr_reparse_point()
1943	*
1944	* of ntfs 3.x dumps the reparse_point attribute
1945	*/
1946	static void ntfs_dump_attr_reparse_point(ATTR_RECORD *attr __attribute__((unused)))
1947	{
1948	/* TODO */
1949	}
1950
1951	/**
1952	* ntfs_dump_attr_ea_information()
1953	*
1954	* dump the ea_information attribute
1955	*/
1956	static void ntfs_dump_attr_ea_information(ATTR_RECORD *attr)
1957	{
1958	EA_INFORMATION *ea_info;
1959
1960	ea_info = (EA_INFORMATION*)((u8*)attr +
1961	le16_to_cpu(attr->value_offset));
1962	printf("\tPacked EA length:\t %u (0x%x)\n",
1963	(unsigned)le16_to_cpu(ea_info->ea_length),
1964	(unsigned)le16_to_cpu(ea_info->ea_length));
1965	printf("\tNEED_EA count:\t\t %u (0x%x)\n",
1966	(unsigned)le16_to_cpu(ea_info->need_ea_count),
1967	(unsigned)le16_to_cpu(ea_info->need_ea_count));
1968	printf("\tUnpacked EA length:\t %u (0x%x)\n",
1969	(unsigned)le32_to_cpu(ea_info->ea_query_length),
1970	(unsigned)le32_to_cpu(ea_info->ea_query_length));
1971	}
1972
1973	/**
1974	* ntfs_dump_attr_ea()
1975	*
1976	* dump the ea attribute
1977	*/
1978	static void ntfs_dump_attr_ea(ATTR_RECORD *attr, ntfs_volume *vol)
1979	{
1980	EA_ATTR *ea;
1981	u8 *buf = NULL;
1982	le32 *pval;
1983	s64 data_size;
1984
1985	if (attr->non_resident) {
1986	runlist *rl;
1987
1988	data_size = sle64_to_cpu(attr->data_size);
1989	if (!opts.verbose)
1990	return;
1991	/* FIXME: We don't handle fragmented mapping pairs case. */
1992	rl = ntfs_mapping_pairs_decompress(vol, attr, NULL);
1993	if (rl) {
1994	s64 bytes_read;
1995
1996	buf = ntfs_malloc(data_size);
1997	if (!buf) {
1998	free(rl);
1999	return;
2000	}
2001	bytes_read = ntfs_rl_pread(vol, rl, 0, data_size, buf);
2002	if (bytes_read != data_size) {
2003	ntfs_log_perror("ntfs_rl_pread failed");
2004	free(buf);
2005	free(rl);
2006	return;
2007	}
2008	free(rl);
2009	ea = (EA_ATTR*)buf;
2010	} else {
2011	ntfs_log_perror("ntfs_mapping_pairs_decompress failed");
2012	return;
2013	}
2014	} else {
2015	data_size = le32_to_cpu(attr->value_length);
2016	if (!opts.verbose)
2017	return;
2018	ea = (EA_ATTR*)((u8*)attr + le16_to_cpu(attr->value_offset));
2019	}
2020	while (1) {
2021	printf("\n\tEA flags:\t\t ");
2022	if (ea->flags) {
2023	if (ea->flags == NEED_EA)
2024	printf("NEED_EA\n");
2025	else
2026	printf("Unknown (0x%02x)\n",
2027	(unsigned)ea->flags);
2028	} else
2029	printf("NONE\n");
2030	printf("\tName length:\t %d (0x%x)\n",
2031	(unsigned)ea->name_length,
2032	(unsigned)ea->name_length);
2033	printf("\tValue length:\t %d (0x%x)\n",
2034	(unsigned)le16_to_cpu(ea->value_length),
2035	(unsigned)le16_to_cpu(ea->value_length));
2036	printf("\tName:\t\t '%s'\n", ea->name);
2037	printf("\tValue:\t\t ");
2038	if (ea->name_length == 11 &&
2039	!strncmp((const char*)"SETFILEBITS",
2040	(const char*)ea->name, 11)) {
2041	pval = (le32*)(ea->value + ea->name_length + 1);
2042	printf("0%lo\n", (unsigned long)le32_to_cpu(*pval));
2043	} else
2044	printf("'%s'\n", ea->value + ea->name_length + 1);
2045	if (ea->next_entry_offset)
2046	ea = (EA_ATTR*)((u8*)ea +
2047	le32_to_cpu(ea->next_entry_offset));
2048	else
2049	break;
2050	if ((u8*)ea - buf >= data_size)
2051	break;
2052	}
2053	free(buf);
2054	}
2055
2056	/**
2057	* ntfs_dump_attr_property_set()
2058	*
2059	* dump the property_set attribute
2060	*/
2061	static void ntfs_dump_attr_property_set(ATTR_RECORD *attr __attribute__((unused)))
2062	{
2063	/* TODO */
2064	}
2065
2066	static void ntfs_hex_dump(void *buf,unsigned int length);
2067
2068	/**
2069	* ntfs_dump_attr_logged_utility_stream()
2070	*
2071	* dump the property_set attribute
2072	*/
2073	static void ntfs_dump_attr_logged_utility_stream(ATTR_RECORD *attr,
2074	ntfs_inode *ni)
2075	{
2076	char *buf;
2077	s64 size;
2078
2079	if (!opts.verbose)
2080	return;
2081	buf = ntfs_attr_readall(ni, AT_LOGGED_UTILITY_STREAM,
2082	ntfs_attr_get_name(attr), attr->name_length, &size);
2083	if (buf)
2084	ntfs_hex_dump(buf, size);
2085	free(buf);
2086	/* TODO */
2087	}
2088
2089	/**
2090	* ntfs_hex_dump
2091	*/
2092	static void ntfs_hex_dump(void *buf,unsigned int length)
2093	{
2094	unsigned int i=0;
2095	while (i<length) {
2096	unsigned int j;
2097
2098	/* line start */
2099	printf("\t%04X ",i);
2100
2101	/* hex content */
2102	for (j=i;(j<length) && (j<i+16);j++) {
2103	unsigned char c = *((char *)buf + j);
2104	printf("%02hhX ",c);
2105	}
2106
2107	/* realign */
2108	for (;j<i+16;j++) {
2109	printf(" ");
2110	}
2111
2112	/* char content */
2113	for (j=i;(j<length) && (j<i+16);j++) {
2114	unsigned char c = *((char *)buf + j);
2115	/* display unprintable chars as '.' */
2116	if ((c<32) || (c>126)) {
2117	c = '.';
2118	}
2119	printf("%c",c);
2120	}
2121
2122	/* end line */
2123	printf("\n");
2124	i=j;
2125	}
2126	}
2127
2128	/**
2129	* ntfs_dump_attr_unknown
2130	*/
2131	static void ntfs_dump_attr_unknown(ATTR_RECORD *attr)
2132	{
2133	printf("===== Please report this unknown attribute type to %s =====\n",
2134	NTFS_DEV_LIST);
2135
2136	if (!attr->non_resident) {
2137	/* hex dump */
2138	printf("\tDumping some of the attribute data:\n");
2139	ntfs_hex_dump((u8*)attr + le16_to_cpu(attr->value_offset),
2140	(le32_to_cpu(attr->value_length) > 128) ?
2141	128 : le32_to_cpu(attr->value_length));
2142	}
2143	}
2144
2145	/**
2146	* ntfs_dump_inode_general_info
2147	*/
2148	static void ntfs_dump_inode_general_info(ntfs_inode *inode)
2149	{
2150	MFT_RECORD *mrec = inode->mrec;
2151	le16 inode_flags = mrec->flags;
2152
2153	printf("Dumping Inode %llu (0x%llx)\n",
2154	(long long)inode->mft_no,
2155	(unsigned long long)inode->mft_no);
2156
2157	ntfs_dump_usa_lsn("", mrec);
2158	printf("MFT Record Seq. Numb.:\t %u (0x%x)\n",
2159	(unsigned)le16_to_cpu(mrec->sequence_number),
2160	(unsigned)le16_to_cpu(mrec->sequence_number));
2161	printf("Number of Hard Links:\t %u (0x%x)\n",
2162	(unsigned)le16_to_cpu(mrec->link_count),
2163	(unsigned)le16_to_cpu(mrec->link_count));
2164	printf("Attribute Offset:\t %u (0x%x)\n",
2165	(unsigned)le16_to_cpu(mrec->attrs_offset),
2166	(unsigned)le16_to_cpu(mrec->attrs_offset));
2167
2168	printf("MFT Record Flags:\t ");
2169	if (inode_flags) {
2170	if (MFT_RECORD_IN_USE & inode_flags) {
2171	printf("IN_USE ");
2172	inode_flags &= ~MFT_RECORD_IN_USE;
2173	}
2174	if (MFT_RECORD_IS_DIRECTORY & inode_flags) {
2175	printf("DIRECTORY ");
2176	inode_flags &= ~MFT_RECORD_IS_DIRECTORY;
2177	}
2178	/* The meaning of IS_4 is illusive but not its existence. */
2179	if (MFT_RECORD_IS_4 & inode_flags) {
2180	printf("IS_4 ");
2181	inode_flags &= ~MFT_RECORD_IS_4;
2182	}
2183	if (MFT_RECORD_IS_VIEW_INDEX & inode_flags) {
2184	printf("VIEW_INDEX ");
2185	inode_flags &= ~MFT_RECORD_IS_VIEW_INDEX;
2186	}
2187	if (inode_flags)
2188	printf("UNKNOWN: 0x%04x", (unsigned)le16_to_cpu(
2189	inode_flags));
2190	} else {
2191	printf("none");
2192	}
2193	printf("\n");
2194
2195	printf("Bytes Used:\t\t %u (0x%x) bytes\n",
2196	(unsigned)le32_to_cpu(mrec->bytes_in_use),
2197	(unsigned)le32_to_cpu(mrec->bytes_in_use));
2198	printf("Bytes Allocated:\t %u (0x%x) bytes\n",
2199	(unsigned)le32_to_cpu(mrec->bytes_allocated),
2200	(unsigned)le32_to_cpu(mrec->bytes_allocated));
2201
2202	if (mrec->base_mft_record) {
2203	printf("Base MFT Record:\t %llu (0x%llx)\n",
2204	(unsigned long long)
2205	MREF_LE(mrec->base_mft_record),
2206	(unsigned long long)
2207	MREF_LE(mrec->base_mft_record));
2208	}
2209	printf("Next Attribute Instance: %u (0x%x)\n",
2210	(unsigned)le16_to_cpu(mrec->next_attr_instance),
2211	(unsigned)le16_to_cpu(mrec->next_attr_instance));
2212
2213	printf("MFT Padding:\t");
2214	ntfs_dump_bytes((u8 *)mrec, le16_to_cpu(mrec->usa_ofs) +
2215	2 * le16_to_cpu(mrec->usa_count),
2216	le16_to_cpu(mrec->attrs_offset));
2217	printf("\n");
2218	}
2219
2220	/**
2221	* ntfs_get_file_attributes
2222	*/
2223	static void ntfs_dump_file_attributes(ntfs_inode *inode)
2224	{
2225	struct RUNCOUNT runcount;
2226	ntfs_attr_search_ctx *ctx = NULL;
2227
2228	runcount.runs = 0;
2229	runcount.fragments = 0;
2230	/* then start enumerating attributes
2231	see ntfs_attr_lookup documentation for detailed explanation */
2232	ctx = ntfs_attr_get_search_ctx(inode, NULL);
2233	while (!ntfs_attr_lookup(AT_UNUSED, NULL, 0, CASE_SENSITIVE,
2234	0, NULL, 0, ctx)) {
2235	if (ctx->attr->type == AT_END || ctx->attr->type == AT_UNUSED) {
2236	printf("Weird: %s attribute type was found, please "
2237	"report this.\n",
2238	get_attribute_type_name(
2239	ctx->attr->type));
2240	continue;
2241	}
2242
2243	ntfs_dump_attribute_header(ctx, inode->vol, &runcount);
2244
2245	switch (ctx->attr->type) {
2246	case AT_STANDARD_INFORMATION:
2247	ntfs_dump_attr_standard_information(ctx->attr);
2248	break;
2249	case AT_ATTRIBUTE_LIST:
2250	ntfs_dump_attr_list(ctx->attr, inode->vol);
2251	break;
2252	case AT_FILE_NAME:
2253	ntfs_dump_attr_file_name(ctx->attr);
2254	break;
2255	case AT_OBJECT_ID:
2256	ntfs_dump_attr_object_id(ctx->attr, inode->vol);
2257	break;
2258	case AT_SECURITY_DESCRIPTOR:
2259	ntfs_dump_attr_security_descriptor(ctx->attr,
2260	inode->vol);
2261	break;
2262	case AT_VOLUME_NAME:
2263	ntfs_dump_attr_volume_name(ctx->attr);
2264	break;
2265	case AT_VOLUME_INFORMATION:
2266	ntfs_dump_attr_volume_information(ctx->attr);
2267	break;
2268	case AT_DATA:
2269	ntfs_dump_attr_data(ctx->attr, inode);
2270	break;
2271	case AT_INDEX_ROOT:
2272	ntfs_dump_attr_index_root(ctx->attr, inode);
2273	break;
2274	case AT_INDEX_ALLOCATION:
2275	ntfs_dump_attr_index_allocation(ctx->attr, inode);
2276	break;
2277	case AT_BITMAP:
2278	ntfs_dump_attr_bitmap(ctx->attr);
2279	break;
2280	case AT_REPARSE_POINT:
2281	ntfs_dump_attr_reparse_point(ctx->attr);
2282	break;
2283	case AT_EA_INFORMATION:
2284	ntfs_dump_attr_ea_information(ctx->attr);
2285	break;
2286	case AT_EA:
2287	ntfs_dump_attr_ea(ctx->attr, inode->vol);
2288	break;
2289	case AT_PROPERTY_SET:
2290	ntfs_dump_attr_property_set(ctx->attr);
2291	break;
2292	case AT_LOGGED_UTILITY_STREAM:
2293	ntfs_dump_attr_logged_utility_stream(ctx->attr, inode);
2294	break;
2295	default:
2296	ntfs_dump_attr_unknown(ctx->attr);
2297	}
2298	}
2299
2300	/* if we exited the loop before we're done - notify the user */
2301	if (errno != ENOENT) {
2302	ntfs_log_perror("ntfsinfo error: stopped before finished "
2303	"enumerating attributes");
2304	} else {
2305	printf("End of inode reached\n");
2306	if (opts.verbose) {
2307	printf("Total runs: %lu (fragments: %lu)\n",
2308	runcount.runs, runcount.fragments);
2309	}
2310	}
2311
2312	/* close all data-structures we used */
2313	ntfs_attr_put_search_ctx(ctx);
2314	ntfs_inode_close(inode);
2315	}
2316
2317	/**
2318	* main() - Begin here
2319	*
2320	* Start from here.
2321	*
2322	* Return: 0 Success, the program worked
2323	* 1 Error, something went wrong
2324	*/
2325	int main(int argc, char **argv)
2326	{
2327	ntfs_volume *vol;
2328
2329	setlinebuf(stdout);
2330
2331	ntfs_log_set_handler(ntfs_log_handler_outerr);
2332
2333	if (!parse_options(argc, argv)) {
2334	printf("Failed to parse command line options\n");
2335	exit(1);
2336	}
2337
2338	utils_set_locale();
2339
2340	vol = utils_mount_volume(opts.device, NTFS_MNT_RDONLY |
2341	(opts.force ? NTFS_MNT_RECOVER : 0));
2342	if (!vol) {
2343	printf("Failed to open '%s'.\n", opts.device);
2344	exit(1);
2345	}
2346
2347	/*
2348	* if opts.mft is not 0, then we will print out information about
2349	* the volume, such as the sector size and whatnot.
2350	*/
2351	if (opts.mft)
2352	ntfs_dump_volume(vol);
2353
2354	if ((opts.inode != -1) || opts.filename) {
2355	ntfs_inode *inode;
2356	/* obtain the inode */
2357	if (opts.filename) {
2358	inode = ntfs_pathname_to_inode(vol, NULL,
2359	opts.filename);
2360	} else {
2361	inode = ntfs_inode_open(vol, MK_MREF(opts.inode, 0));
2362	}
2363
2364	/* dump the inode information */
2365	if (inode) {
2366	/* general info about the inode's mft record */
2367	ntfs_dump_inode_general_info(inode);
2368	/* dump attributes */
2369	ntfs_dump_file_attributes(inode);
2370	} else {
2371	/* can't open inode */
2372	/*
2373	* note: when the specified inode does not exist, either
2374	* EIO or or ESPIPE is returned, we should notify better
2375	* in those cases
2376	*/
2377	ntfs_log_perror("Error loading node");
2378	}
2379	}
2380
2381	ntfs_umount(vol, FALSE);
2382	return 0;
2383	}
2384
2385