.\" This manpage has been automatically generated by docbook2man 
.\" from a DocBook document.  This tool can be found at:
.\" <http://shell.ipoline.com/~elmert/comp/docbook2X/> 
.\" Please send any bug reports, improvements, comments, patches, 
.\" etc. to Steve Cheng <steve@ggi-project.org>.
.TH "FIND_EXTERNAL_ATTR" "" "06 October 2005" "" ""

.SH NAME
find_external_attr \- find an attribute in the attribute list of an ntfs inode
.SH SYNOPSIS
"SYNOPSIS"
.sp
\fB
.sp
BOOL find_external_attr  (const ATTR_TYPES \fItype\fB, const uchar_t * \fIname\fB, const u32 \fIname_len\fB, const IGNORE_CASE_BOOL \fIic\fB, const VCN \fIlowest_vcn\fB, const u8 * \fIval\fB, const u32 \fIval_len\fB, attr_search_context * \fIctx\fB);
\fR
.SH "ARGUMENTS"
.TP
\fB\fItype\fB\fR
attribute type to find
.TP
\fB\fIname\fB\fR
attribute name to find (optional, i.e. NULL means don't care)
.TP
\fB\fIname_len\fB\fR
attribute name length (only needed if \fIname\fR present)
.TP
\fB\fIic\fB\fR
IGNORE_CASE or CASE_SENSITIVE (ignored if \fIname\fR not present)
.TP
\fB\fIlowest_vcn\fB\fR
lowest vcn to find (optional, non-resident attributes only)
.TP
\fB\fIval\fB\fR
attribute value to find (optional, resident attributes only)
.TP
\fB\fIval_len\fB\fR
attribute value length
.TP
\fB\fIctx\fB\fR
search context with mft record and attribute to search from
.SH "DESCRIPTION"
.PP
You shouldn't need to call this function directly. Use \fBlookup_attr\fR instead.
.PP
Find an attribute by searching the attribute list for the corresponding
attribute list entry. Having found the entry, map the mft record for read
if the attribute is in a different mft record/inode, find_attr the attribute
in there and return it.
.PP
On first search \fIctx\fR->ntfs_ino must be the base mft record and \fIctx\fR must
have been obtained from a call to \fBget_attr_search_ctx\fR\&. On subsequent calls
\fIctx\fR->ntfs_ino can be any extent inode, too (\fIctx\fR->base_ntfs_ino is then the
base inode).
.PP
After finishing with the attribute/mft record you need to call
\fBrelease_attr_search_ctx\fR to cleanup the search context (unmapping any
mapped inodes, etc).
.PP
Return TRUE if the search was successful and FALSE if not. When TRUE,
\fIctx\fR->attr is the found attribute and it is in mft record \fIctx\fR->mrec. When
FALSE, \fIctx\fR->attr is the attribute which collates just after the attribute
being searched for in the base ntfs inode, i.e. if one wants to add the
attribute to the mft record this is the correct place to insert it into
and if there is not enough space, the attribute should be placed in an
extent mft record.