BOOL find_attr (const ATTR_TYPES type, const uchar_t * name, const u32 name_len, const IGNORE_CASE_BOOL ic, const u8 * val, const u32 val_len, attr_search_context * ctx);
You shouldn't need to call this function directly. Use lookup_attr instead.
find_attr takes a search context ctx as parameter and searches the mft record specified by ctx->mrec, beginning at ctx->attr, for an attribute of type, optionally name and val. If found, find_attr returns TRUE and ctx->attr will point to the found attribute. If not found, find_attr returns FALSE and ctx->attr is undefined (i.e. do not rely on it not changing).
If ctx->is_first is TRUE, the search begins with ctx->attr itself. If it is FALSE, the search begins after ctx->attr.
If ic is IGNORE_CASE, the name comparisson is not case sensitive and ctx->ntfs_ino must be set to the ntfs inode to which the mft record ctx->mrec belongs. This is so we can get at the ntfs volume and hence at the upcase table. If ic is CASE_SENSITIVE, the comparison is case sensitive. When name is present, name_len is the name length in Unicode characters.
If name is not present (NULL), we assume that the unnamed attribute is being searched for.
Finally, the resident attribute value val is looked for, if present. If val is not present (NULL), val_len is ignored.
find_attr only searches the specified mft record and it ignores the presence of an attribute list attribute (unless it is the one being searched for, obviously). If you need to take attribute lists into consideration, use lookup_attr instead (see below). This also means that you cannot use find_attr to search for extent records of non-resident attributes, as extents with lowest_vcn != 0 are usually described by the attribute list attribute only. - Note that it is possible that the first extent is only in the attribute list while the last extent is in the base mft record, so don't rely on being able to find the first extent in the base mft record.
Never use val when looking for attribute types which can be non-resident as this most likely will result in a crash!