^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) /* SPDX-License-Identifier: GPL-2.0-or-later */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) * usnjrnl.h - Defines for NTFS kernel transaction log ($UsnJrnl) handling.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) * Part of the Linux-NTFS project.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * Copyright (c) 2005 Anton Altaparmakov
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) #ifndef _LINUX_NTFS_USNJRNL_H
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) #define _LINUX_NTFS_USNJRNL_H
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) #ifdef NTFS_RW
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14) #include "types.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include "endian.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #include "layout.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include "volume.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) * Transaction log ($UsnJrnl) organization:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) * The transaction log records whenever a file is modified in any way. So for
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) * example it will record that file "blah" was written to at a particular time
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) * but not what was written. If will record that a file was deleted or
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) * created, that a file was truncated, etc. See below for all the reason
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) * codes used.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) * The transaction log is in the $Extend directory which is in the root
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) * directory of each volume. If it is not present it means transaction
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) * logging is disabled. If it is present it means transaction logging is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) * either enabled or in the process of being disabled in which case we can
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) * ignore it as it will go away as soon as Windows gets its hands on it.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34) * To determine whether the transaction logging is enabled or in the process
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) * of being disabled, need to check the volume flags in the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) * $VOLUME_INFORMATION attribute in the $Volume system file (which is present
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37) * in the root directory and has a fixed mft record number, see layout.h).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) * If the flag VOLUME_DELETE_USN_UNDERWAY is set it means the transaction log
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) * is in the process of being disabled and if this flag is clear it means the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) * transaction log is enabled.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) * The transaction log consists of two parts; the $DATA/$Max attribute as well
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) * as the $DATA/$J attribute. $Max is a header describing the transaction
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44) * log whilst $J is the transaction log data itself as a sequence of variable
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) * sized USN_RECORDs (see below for all the structures).
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) * We do not care about transaction logging at this point in time but we still
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) * need to let windows know that the transaction log is out of date. To do
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) * this we need to stamp the transaction log. This involves setting the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) * lowest_valid_usn field in the $DATA/$Max attribute to the usn to be used
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) * for the next added USN_RECORD to the $DATA/$J attribute as well as
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) * generating a new journal_id in $DATA/$Max.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) * The journal_id is as of the current version (2.0) of the transaction log
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) * simply the 64-bit timestamp of when the journal was either created or last
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) * stamped.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) * To determine the next usn there are two ways. The first is to parse
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) * $DATA/$J and to find the last USN_RECORD in it and to add its record_length
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) * to its usn (which is the byte offset in the $DATA/$J attribute). The
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) * second is simply to take the data size of the attribute. Since the usns
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) * are simply byte offsets into $DATA/$J, this is exactly the next usn. For
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) * obvious reasons we use the second method as it is much simpler and faster.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) * As an aside, note that to actually disable the transaction log, one would
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) * need to set the VOLUME_DELETE_USN_UNDERWAY flag (see above), then go
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) * through all the mft records on the volume and set the usn field in their
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68) * $STANDARD_INFORMATION attribute to zero. Once that is done, one would need
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) * to delete the transaction log file, i.e. \$Extent\$UsnJrnl, and finally,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) * one would need to clear the VOLUME_DELETE_USN_UNDERWAY flag.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) * Note that if a volume is unmounted whilst the transaction log is being
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) * disabled, the process will continue the next time the volume is mounted.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) * This is why we can safely mount read-write when we see a transaction log
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) * in the process of being deleted.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) /* Some $UsnJrnl related constants. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) #define UsnJrnlMajorVer 2
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) #define UsnJrnlMinorVer 0
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) * $DATA/$Max attribute. This is (always?) resident and has a fixed size of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) * 32 bytes. It contains the header describing the transaction log.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) /*Ofs*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) /* 0*/sle64 maximum_size; /* The maximum on-disk size of the $DATA/$J
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) attribute. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90) /* 8*/sle64 allocation_delta; /* Number of bytes by which to increase the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) size of the $DATA/$J attribute. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) /*0x10*/sle64 journal_id; /* Current id of the transaction log. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) /*0x18*/leUSN lowest_valid_usn; /* Lowest valid usn in $DATA/$J for the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) current journal_id. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) /* sizeof() = 32 (0x20) bytes */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) } __attribute__ ((__packed__)) USN_HEADER;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) * Reason flags (32-bit). Cumulative flags describing the change(s) to the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) * file since it was last opened. I think the names speak for themselves but
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) * if you disagree check out the descriptions in the Linux NTFS project NTFS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102) * documentation: http://www.linux-ntfs.org/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) USN_REASON_DATA_OVERWRITE = cpu_to_le32(0x00000001),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) USN_REASON_DATA_EXTEND = cpu_to_le32(0x00000002),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) USN_REASON_DATA_TRUNCATION = cpu_to_le32(0x00000004),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) USN_REASON_NAMED_DATA_OVERWRITE = cpu_to_le32(0x00000010),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) USN_REASON_NAMED_DATA_EXTEND = cpu_to_le32(0x00000020),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) USN_REASON_NAMED_DATA_TRUNCATION= cpu_to_le32(0x00000040),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) USN_REASON_FILE_CREATE = cpu_to_le32(0x00000100),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112) USN_REASON_FILE_DELETE = cpu_to_le32(0x00000200),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) USN_REASON_EA_CHANGE = cpu_to_le32(0x00000400),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) USN_REASON_SECURITY_CHANGE = cpu_to_le32(0x00000800),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) USN_REASON_RENAME_OLD_NAME = cpu_to_le32(0x00001000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) USN_REASON_RENAME_NEW_NAME = cpu_to_le32(0x00002000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) USN_REASON_INDEXABLE_CHANGE = cpu_to_le32(0x00004000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118) USN_REASON_BASIC_INFO_CHANGE = cpu_to_le32(0x00008000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) USN_REASON_HARD_LINK_CHANGE = cpu_to_le32(0x00010000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) USN_REASON_COMPRESSION_CHANGE = cpu_to_le32(0x00020000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) USN_REASON_ENCRYPTION_CHANGE = cpu_to_le32(0x00040000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122) USN_REASON_OBJECT_ID_CHANGE = cpu_to_le32(0x00080000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) USN_REASON_REPARSE_POINT_CHANGE = cpu_to_le32(0x00100000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) USN_REASON_STREAM_CHANGE = cpu_to_le32(0x00200000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) USN_REASON_CLOSE = cpu_to_le32(0x80000000),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) typedef le32 USN_REASON_FLAGS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) * Source info flags (32-bit). Information about the source of the change(s)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) * to the file. For detailed descriptions of what these mean, see the Linux
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) * NTFS project NTFS documentation:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) * http://www.linux-ntfs.org/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) enum {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) USN_SOURCE_DATA_MANAGEMENT = cpu_to_le32(0x00000001),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) USN_SOURCE_AUXILIARY_DATA = cpu_to_le32(0x00000002),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139) USN_SOURCE_REPLICATION_MANAGEMENT = cpu_to_le32(0x00000004),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) typedef le32 USN_SOURCE_INFO_FLAGS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) * $DATA/$J attribute. This is always non-resident, is marked as sparse, and
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146) * is of variabled size. It consists of a sequence of variable size
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) * USN_RECORDS. The minimum allocated_size is allocation_delta as
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) * specified in $DATA/$Max. When the maximum_size specified in $DATA/$Max is
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149) * exceeded by more than allocation_delta bytes, allocation_delta bytes are
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) * allocated and appended to the $DATA/$J attribute and an equal number of
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) * bytes at the beginning of the attribute are freed and made sparse. Note the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) * making sparse only happens at volume checkpoints and hence the actual
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153) * $DATA/$J size can exceed maximum_size + allocation_delta temporarily.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) typedef struct {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) /*Ofs*/
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157) /* 0*/le32 length; /* Byte size of this record (8-byte
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) aligned). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) /* 4*/le16 major_ver; /* Major version of the transaction log used
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) for this record. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161) /* 6*/le16 minor_ver; /* Minor version of the transaction log used
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) for this record. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163) /* 8*/leMFT_REF mft_reference;/* The mft reference of the file (or
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) directory) described by this record. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) /*0x10*/leMFT_REF parent_directory;/* The mft reference of the parent
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) directory of the file described by this
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) record. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) /*0x18*/leUSN usn; /* The usn of this record. Equals the offset
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) within the $DATA/$J attribute. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) /*0x20*/sle64 time; /* Time when this record was created. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) /*0x28*/USN_REASON_FLAGS reason;/* Reason flags (see above). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) /*0x2c*/USN_SOURCE_INFO_FLAGS source_info;/* Source info flags (see above). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) /*0x30*/le32 security_id; /* File security_id copied from
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) $STANDARD_INFORMATION. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) /*0x34*/FILE_ATTR_FLAGS file_attributes; /* File attributes copied from
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) $STANDARD_INFORMATION or $FILE_NAME (not
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) sure which). */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) /*0x38*/le16 file_name_size; /* Size of the file name in bytes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) /*0x3a*/le16 file_name_offset; /* Offset to the file name in bytes from the
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) start of this record. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) /*0x3c*/ntfschar file_name[0]; /* Use when creating only. When reading use
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) file_name_offset to determine the location
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) of the name. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) /* sizeof() = 60 (0x3c) bytes */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) } __attribute__ ((__packed__)) USN_RECORD;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) extern bool ntfs_stamp_usnjrnl(ntfs_volume *vol);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) #endif /* NTFS_RW */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) #endif /* _LINUX_NTFS_USNJRNL_H */