FIND_EXTERNAL_ATTR

NAME

SYNOPSIS

BOOL find_external_attr (const ATTR_TYPES type, const uchar_t * name, const u32 name_len, const IGNORE_CASE_BOOL ic, const VCN lowest_vcn, const u8 * val, const u32 val_len, attr_search_context * ctx);  

ARGUMENTS

type

attribute type to find

name

attribute name to find (optional, i.e. NULL means don't care)

name_len

attribute name length (only needed if name present)

ic

IGNORE_CASE or CASE_SENSITIVE (ignored if name not present)

lowest_vcn

lowest vcn to find (optional, non-resident attributes only)

val

attribute value to find (optional, resident attributes only)

val_len

attribute value length

ctx

search context with mft record and attribute to search from

DESCRIPTION

You shouldn't need to call this function directly. Use lookup_attr instead.

Find an attribute by searching the attribute list for the corresponding attribute list entry. Having found the entry, map the mft record for read if the attribute is in a different mft record/inode, find_attr the attribute in there and return it.

On first search ctx->ntfs_ino must be the base mft record and ctx must have been obtained from a call to get_attr_search_ctx. On subsequent calls ctx->ntfs_ino can be any extent inode, too (ctx->base_ntfs_ino is then the base inode).

After finishing with the attribute/mft record you need to call release_attr_search_ctx to cleanup the search context (unmapping any mapped inodes, etc).

Return TRUE if the search was successful and FALSE if not. When TRUE, ctx->attr is the found attribute and it is in mft record ctx->mrec. When FALSE, ctx->attr is the attribute which collates just after the attribute being searched for in the base ntfs inode, i.e. if one wants to add the attribute to the mft record this is the correct place to insert it into and if there is not enough space, the attribute should be placed in an extent mft record.

Index

NAME

SYNOPSIS

ARGUMENTS

DESCRIPTION