int ntfs_attr_find (const ATTR_TYPE type, const ntfschar * name, const u32 name_len, const IGNORE_CASE_BOOL ic, const u8 * val, const u32 val_len, ntfs_attr_search_ctx * ctx);
You should not need to call this function directly. Use ntfs_attr_lookup instead.
ntfs_attr_find takes a search context ctx as parameter and searches the mft record specified by ctx->mrec, beginning at ctx->attr, for an attribute of type, optionally name and val.
If the attribute is found, ntfs_attr_find returns 0 and ctx->attr will point to the found attribute.
If the attribute is not found, ntfs_attr_find returns -ENOENT and ctx->attr will point to the attribute before which the attribute being searched for would need to be inserted if such an action were to be desired.
On actual error, ntfs_attr_find returns -EIO. In this case ctx->attr is undefined and in particular do not rely on it not changing.
If ctx->is_first is TRUE, the search begins with ctx->attr itself. If it is FALSE, the search begins after ctx->attr.
If ic is IGNORE_CASE, the name comparisson is not case sensitive and ctx->ntfs_ino must be set to the ntfs inode to which the mft record ctx->mrec belongs. This is so we can get at the ntfs volume and hence at the upcase table. If ic is CASE_SENSITIVE, the comparison is case sensitive. When name is present, name_len is the name length in Unicode characters.
If name is not present (NULL), we assume that the unnamed attribute is being searched for.
Finally, the resident attribute value val is looked for, if present. If val is not present (NULL), val_len is ignored.
ntfs_attr_find only searches the specified mft record and it ignores the presence of an attribute list attribute (unless it is the one being searched for, obviously). If you need to take attribute lists into consideration, use ntfs_attr_lookup instead (see below). This also means that you cannot use ntfs_attr_find to search for extent records of non-resident attributes, as extents with lowest_vcn != 0 are usually described by the attribute list attribute only. - Note that it is possible that the first extent is only in the attribute list while the last extent is in the base mft record, so do not rely on being able to find the first extent in the base mft record.
Never use val when looking for attribute types which can be non-resident as this most likely will result in a crash!