libfsntfs(3)

📦

this version · 2 versions

debian trixie, opensuse-leap 16.0, ubuntu questing, ubuntu resolute, ubuntu stonking (latest)
debian bookworm, ubuntu jammy, ubuntu noble

, in debian trixie, opensuse-leap 16.0, ubuntu questing, ubuntu resolute, ubuntu stonking

✨ NAME ✨

okay so bestie, welcome to libfsntfs(3) 💖 this is libfsntfs.h — the Library to access the Windows New Technology File System (NTFS) format. no cap, it's literally the toolkit for peeking into NTFS volumes, file entries, errors, notifications — the whole vibe. 🦋✨

✨ SYNOPSIS ✨

first things first, you gotta include the header like this:

#include <libfsntfs.h>

then it's function city, population: a lot. buckle up. 💅

🛠️ Support functions

these are the little helpers that get you started. version check, read access flags, codepage get/set, and signature checks. here's the whole squad:

const char *
libfsntfs_get_version(void);

int
libfsntfs_get_access_flags_read(void);

int
libfsntfs_get_codepage(int *codepage, libfsntfs_error_t **error);

int
libfsntfs_set_codepage(int codepage, libfsntfs_error_t **error);

int
libfsntfs_check_volume_signature(const char *filename,
    libfsntfs_error_t **error);

int
libfsntfs_check_mft_metadata_file_signature(const char *filename,
    libfsntfs_error_t **error);

and if you compiled with wide character string support, these two are also available:

int
libfsntfs_check_volume_signature_wide(const wchar_t *filename,
    libfsntfs_error_t **error);

int
libfsntfs_check_mft_metadata_file_signature_wide(const wchar_t *filename,
    libfsntfs_error_t **error);

and when compiled with libbfio support, you get these too:

int
libfsntfs_check_volume_signature_file_io_handle(libbfio_handle_t *file_io_handle,
    libfsntfs_error_t **error);

int
libfsntfs_check_mft_metadata_file_signature_file_io_handle(libbfio_handle_t *file_io_handle,
    libfsntfs_error_t **error);

📢 Notify functions

notification era. let the library tell you things. verbose mode, set stream, open stream, close stream. iconic.

void
libfsntfs_notify_set_verbose(int verbose);

int
libfsntfs_notify_set_stream(FILE *stream, libfsntfs_error_t **error);

int
libfsntfs_notify_stream_open(const char *filename,
    libfsntfs_error_t **error);

int
libfsntfs_notify_stream_close(libfsntfs_error_t **error);

😭 Error functions

errors happen, bestie. free them, print them, sprint them, backtrace them. all the coping mechanisms.

void
libfsntfs_error_free(libfsntfs_error_t **error);

int
libfsntfs_error_fprint(libfsntfs_error_t *error, FILE *stream);

int
libfsntfs_error_sprint(libfsntfs_error_t *error, char *string,
    size_t size);

int
libfsntfs_error_backtrace_fprint(libfsntfs_error_t *error,
    FILE *stream);

int
libfsntfs_error_backtrace_sprint(libfsntfs_error_t *error, char *string,
    size_t size);

💽 Volume functions

volume functions, aka the main character energy. initialize, free, signal abort, open, close, check BitLocker drive encryption, check volume shadow snapshots, get bytes per sector, cluster block size, MFT entry size, index entry size, UTF-8 name size, UTF-8 name, UTF-16 name size, UTF-16 name, version, flags, serial number, root directory, number of file entries, file entry by index, file entry by UTF-8 path, file entry by UTF-16 path, and the USN change journal. periodt.

int
libfsntfs_volume_initialize(libfsntfs_volume_t **volume,
    libfsntfs_error_t **error);

int
libfsntfs_volume_free(libfsntfs_volume_t **volume,
    libfsntfs_error_t **error);

int
libfsntfs_volume_signal_abort(libfsntfs_volume_t *volume,
    libfsntfs_error_t **error);

int
libfsntfs_volume_open(libfsntfs_volume_t *volume, const char *filename,
    int access_flags, libfsntfs_error_t **error);

int
libfsntfs_volume_close(libfsntfs_volume_t *volume,
    libfsntfs_error_t **error);

int
libfsntfs_volume_has_bitlocker_drive_encryption(libfsntfs_volume_t *volume,
    libfsntfs_error_t **error);

int
libfsntfs_volume_has_volume_shadow_snapshots(libfsntfs_volume_t *volume,
    libfsntfs_error_t **error);

int
libfsntfs_volume_get_bytes_per_sector(libfsntfs_volume_t *volume,
    uint16_t *bytes_per_sector, libfsntfs_error_t **error);

int
libfsntfs_volume_get_cluster_block_size(libfsntfs_volume_t *volume,
    size32_t *cluster_block_size, libfsntfs_error_t **error);

int
libfsntfs_volume_get_mft_entry_size(libfsntfs_volume_t *volume,
    size32_t *mft_entry_size, libfsntfs_error_t **error);

int
libfsntfs_volume_get_index_entry_size(libfsntfs_volume_t *volume,
    size32_t *index_entry_size, libfsntfs_error_t **error);

int
libfsntfs_volume_get_utf8_name_size(libfsntfs_volume_t *volume,
    size_t *utf8_string_size, libfsntfs_error_t **error);

int
libfsntfs_volume_get_utf8_name(libfsntfs_volume_t *volume,
    uint8_t *utf8_string, size_t utf8_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_volume_get_utf16_name_size(libfsntfs_volume_t *volume,
    size_t *utf16_string_size, libfsntfs_error_t **error);

int
libfsntfs_volume_get_utf16_name(libfsntfs_volume_t *volume,
    uint16_t *utf16_string, size_t utf16_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_volume_get_version(libfsntfs_volume_t *volume,
    uint8_t *major_version, uint8_t *minor_version,
    libfsntfs_error_t **error);

int
libfsntfs_volume_get_flags(libfsntfs_volume_t *volume, uint16_t *flags,
    libfsntfs_error_t **error);

int
libfsntfs_volume_get_serial_number(libfsntfs_volume_t *volume,
    uint64_t *serial_number, libfsntfs_error_t **error);

int
libfsntfs_volume_get_root_directory(libfsntfs_volume_t *volume,
    libfsntfs_file_entry_t **file_entry, libfsntfs_error_t **error);

int
libfsntfs_volume_get_number_of_file_entries(libfsntfs_volume_t *volume,
    uint64_t *number_of_file_entries, libfsntfs_error_t **error);

int
libfsntfs_volume_get_file_entry_by_index(libfsntfs_volume_t *volume,
    uint64_t mft_entry_index, libfsntfs_file_entry_t **file_entry,
    libfsntfs_error_t **error);

int
libfsntfs_volume_get_file_entry_by_utf8_path(libfsntfs_volume_t *volume,
    const uint8_t *utf8_string, size_t utf8_string_length,
    libfsntfs_file_entry_t **file_entry, libfsntfs_error_t **error);

int
libfsntfs_volume_get_file_entry_by_utf16_path(libfsntfs_volume_t *volume,
    const uint16_t *utf16_string, size_t utf16_string_length,
    libfsntfs_file_entry_t **file_entry, libfsntfs_error_t **error);

int
libfsntfs_volume_get_usn_change_journal(libfsntfs_volume_t *volume,
    libfsntfs_usn_change_journal_t **usn_change_journal,
    libfsntfs_error_t **error);

and if you compiled with wide character string support, this one's here too:

int
libfsntfs_volume_open_wide(libfsntfs_volume_t *volume,
    const wchar_t *filename, int access_flags,
    libfsntfs_error_t **error);

and if you compiled with libbfio support, this one joins the party:

int
libfsntfs_volume_open_file_io_handle(libfsntfs_volume_t *volume,
    libbfio_handle_t *file_io_handle, int access_flags,
    libfsntfs_error_t **error);

📁 File entry functions

file entry functions, and there are so many. check if empty, allocated, corrupted. get file reference, base record file reference, parent file reference, parent file reference by attribute index, journal sequence number, creation time, modification time, access time, entry modification time, file attribute flags, UTF-8 name size, UTF-8 name, UTF-16 name size, UTF-16 name, name attribute index, UTF-8 name size by attribute index, UTF-8 name by attribute index, UTF-16 name size by attribute index, UTF-16 name by attribute index, UTF-8 path hint size, UTF-8 path hint, UTF-16 path hint size, UTF-16 path hint, UTF-8 symbolic link target size, UTF-8 symbolic link target, and UTF-16 symbolic link target size. slay.

int
libfsntfs_file_entry_free(libfsntfs_file_entry_t **file_entry,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_is_empty(libfsntfs_file_entry_t *file_entry,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_is_allocated(libfsntfs_file_entry_t *file_entry,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_is_corrupted(libfsntfs_file_entry_t *file_entry,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_file_reference(libfsntfs_file_entry_t *file_entry,
    uint64_t *file_reference, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_base_record_file_reference(libfsntfs_file_entry_t *file_entry,
    uint64_t *file_reference, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_parent_file_reference(libfsntfs_file_entry_t *file_entry,
    uint64_t *parent_file_reference, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_parent_file_reference_by_attribute_index(libfsntfs_file_entry_t *file_entry,
    int attribute_index, uint64_t *parent_file_reference,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_journal_sequence_number(libfsntfs_file_entry_t *file_entry,
    uint64_t *journal_sequence_number, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_creation_time(libfsntfs_file_entry_t *file_entry,
    uint64_t *filetime, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_modification_time(libfsntfs_file_entry_t *file_entry,
    uint64_t *filetime, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_access_time(libfsntfs_file_entry_t *file_entry,
    uint64_t *filetime, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_entry_modification_time(libfsntfs_file_entry_t *file_entry,
    uint64_t *filetime, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_file_attribute_flags(libfsntfs_file_entry_t *file_entry,
    uint32_t *file_attribute_flags, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_utf8_name_size(libfsntfs_file_entry_t *file_entry,
    size_t *utf8_string_size, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_utf8_name(libfsntfs_file_entry_t *file_entry,
    uint8_t *utf8_string, size_t utf8_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_utf16_name_size(libfsntfs_file_entry_t *file_entry,
    size_t *utf16_string_size, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_utf16_name(libfsntfs_file_entry_t *file_entry,
    uint16_t *utf16_string, size_t utf16_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_name_attribute_index(libfsntfs_file_entry_t *file_entry,
    int *attribute_index, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_utf8_name_size_by_attribute_index(libfsntfs_file_entry_t *file_entry,
    int attribute_index, size_t *utf8_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_utf8_name_by_attribute_index(libfsntfs_file_entry_t *file_entry,
    int attribute_index, uint8_t *utf8_string, size_t utf8_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_utf16_name_size_by_attribute_index(libfsntfs_file_entry_t *file_entry,
    int attribute_index, size_t *utf16_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_utf16_name_by_attribute_index(libfsntfs_file_entry_t *file_entry,
    int attribute_index, uint16_t *utf16_string,
    size_t utf16_string_size, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_utf8_path_hint_size(libfsntfs_file_entry_t *file_entry,
    int attribute_index, size_t *utf8_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_utf8_path_hint(libfsntfs_file_entry_t *file_entry,
    int attribute_index, uint8_t *utf8_string, size_t utf8_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_utf16_path_hint_size(libfsntfs_file_entry_t *file_entry,
    int attribute_index, size_t *utf16_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_utf16_path_hint(libfsntfs_file_entry_t *file_entry,
    int attribute_index, uint16_t *utf16_string,
    size_t utf16_string_size, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_utf8_symbolic_link_target_size(libfsntfs_file_entry_t *file_entry,
    size_t *utf8_string_size, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_utf8_symbolic_link_target(libfsntfs_file_entry_t *file_entry,
    uint8_t *utf8_string, size_t utf8_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_utf16_symbolic_link_target_size(libfsntfs_file_entry_t *file_entry,
    size_t *utf16_string_size, libfsntfs_error_t **error);

okay so the prototypes just keep coming and honestly? iconic. still in SYNOPSIS bestie, buckle up 🎀

int
libfsntfs_file_entry_get_utf16_symbolic_link_target(libfsntfs_file_entry_t *file_entry,
    uint16_t *utf16_string, size_t utf16_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_security_descriptor_size(libfsntfs_file_entry_t *file_entry,
    size_t *data_size, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_security_descriptor(libfsntfs_file_entry_t *file_entry,
    uint8_t *data, size_t data_size, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_number_of_attributes(libfsntfs_file_entry_t *file_entry,
    int *number_of_attributes, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_attribute_by_index(libfsntfs_file_entry_t *file_entry,
    int attribute_index, libfsntfs_attribute_t **attribute,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_has_directory_entries_index(libfsntfs_file_entry_t *file_entry,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_has_default_data_stream(libfsntfs_file_entry_t *file_entry,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_is_symbolic_link(libfsntfs_file_entry_t *file_entry,
    libfsntfs_error_t **error);

like, yes, she does have a lot of things to check 👑 and she's gonna check ALL of them.

int
libfsntfs_file_entry_get_number_of_alternate_data_streams(libfsntfs_file_entry_t *file_entry,
    int *number_of_alternate_data_streams, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_alternate_data_stream_by_index(libfsntfs_file_entry_t *file_entry,
    int alternate_data_stream_index,
    libfsntfs_data_stream_t **alternate_data_stream,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_has_alternate_data_stream_by_utf8_name(libfsntfs_file_entry_t *file_entry,
    const uint8_t *utf8_string, size_t utf8_string_length,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_has_alternate_data_stream_by_utf16_name(libfsntfs_file_entry_t *file_entry,
    const uint16_t *utf16_string, size_t utf16_string_length,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_alternate_data_stream_by_utf8_name(libfsntfs_file_entry_t *file_entry,
    const uint8_t *utf8_string, size_t utf8_string_length,
    libfsntfs_data_stream_t **alternate_data_stream,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_alternate_data_stream_by_utf16_name(libfsntfs_file_entry_t *file_entry,
    const uint16_t *utf16_string, size_t utf16_string_length,
    libfsntfs_data_stream_t **alternate_data_stream,
    libfsntfs_error_t **error);

utf8 and utf16 versions of everything, because of course 💅 queen of being thorough.

int
libfsntfs_file_entry_get_number_of_sub_file_entries(libfsntfs_file_entry_t *file_entry,
    int *number_of_sub_file_entries, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_sub_file_entry_by_index(libfsntfs_file_entry_t *file_entry,
    int sub_file_entry_index, libfsntfs_file_entry_t **sub_file_entry,
    libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_sub_file_entry_by_utf8_name(libfsntfs_file_entry_t *file_entry,
    const uint8_t *utf8_string, size_t utf8_string_length,
    libfsntfs_file_entry_t **sub_file_entry, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_sub_file_entry_by_utf16_name(libfsntfs_file_entry_t *file_entry,
    const uint16_t *utf16_string, size_t utf16_string_length,
    libfsntfs_file_entry_t **sub_file_entry, libfsntfs_error_t **error);

so you can walk down the tree by index or by name, in whichever encoding your heart desires 🦋

ssize_t
libfsntfs_file_entry_read_buffer(libfsntfs_file_entry_t *file_entry,
    void *buffer, size_t buffer_size, libfsntfs_error_t **error);

ssize_t
libfsntfs_file_entry_read_buffer_at_offset(libfsntfs_file_entry_t *file_entry,
    void *buffer, size_t buffer_size, off64_t offset,
    libfsntfs_error_t **error);

off64_t
libfsntfs_file_entry_seek_offset(libfsntfs_file_entry_t *file_entry,
    off64_t offset, int whence, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_offset(libfsntfs_file_entry_t *file_entry,
    off64_t *offset, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_size(libfsntfs_file_entry_t *file_entry,
    size64_t *size, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_number_of_extents(libfsntfs_file_entry_t *file_entry,
    int *number_of_extents, libfsntfs_error_t **error);

int
libfsntfs_file_entry_get_extent_by_index(libfsntfs_file_entry_t *file_entry,
    int extent_index, off64_t *extent_offset, size64_t *extent_size,
    uint32_t *extent_flags, libfsntfs_error_t **error);

reading, seeking, and peeking at extents — the full main character lineup 🔥

✨ Attribute functions ✨

int
libfsntfs_attribute_free(libfsntfs_attribute_t **attribute,
    libfsntfs_error_t **error);

int
libfsntfs_attribute_get_type(libfsntfs_attribute_t *attribute,
    uint32_t *type, libfsntfs_error_t **error);

int
libfsntfs_attribute_get_data_flags(libfsntfs_attribute_t *attribute,
    uint16_t *data_flags, libfsntfs_error_t **error);

int
libfsntfs_attribute_get_utf8_name_size(libfsntfs_attribute_t *attribute,
    size_t *utf8_string_size, libfsntfs_error_t **error);

int
libfsntfs_attribute_get_utf8_name(libfsntfs_attribute_t *attribute,
    uint8_t *utf8_string, size_t utf8_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_attribute_get_utf16_name_size(libfsntfs_attribute_t *attribute,
    size_t *utf16_string_size, libfsntfs_error_t **error);

int
libfsntfs_attribute_get_utf16_name(libfsntfs_attribute_t *attribute,
    uint16_t *utf16_string, size_t utf16_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_attribute_get_data_vcn_range(libfsntfs_attribute_t *attribute,
    uint64_t *data_first_vcn, uint64_t *data_last_vcn,
    libfsntfs_error_t **error);

int
libfsntfs_attribute_get_data_size(libfsntfs_attribute_t *attribute,
    size64_t *data_size, libfsntfs_error_t **error);

int
libfsntfs_attribute_get_valid_data_size(libfsntfs_attribute_t *attribute,
    size64_t *valid_data_size, libfsntfs_error_t **error);

free her, get her type, get her flags, get her names in both flavours, get her VCN range and both sizes — the way that an attribute can just be all of that 🫶

🌸 $ATTRIBUTE_LIST attribute functions 🌸

(copying the placeholder exactly as it's written, don't @ me 💀)

int
libfsntfs_attribute_list_attribute_get_number_of_entries(libfsntfs_attribute_t *attribute,
    int *number_of_entries, libfsntfs_error_t **error);

int
libfsntfs_attribute_list_attribute_get_entry_by_index(libfsntfs_attribute_t *attribute,
    int entry_index, libfsntfs_attribute_list_entry_t **entry,
    libfsntfs_error_t **error);

counting entries, grabbing entries by entry_index, done and dusted ✨

🧚 Attribute list entry functions 🧚

int
libfsntfs_attribute_list_entry_free(libfsntfs_attribute_list_entry_t **attribute_list_entry,
    libfsntfs_error_t **error);

int
libfsntfs_attribute_list_entry_get_attribute_type(libfsntfs_attribute_list_entry_t *attribute_list_entry,
    uint32_t *attribute_type, libfsntfs_error_t **error);

int
libfsntfs_attribute_list_entry_get_file_reference(libfsntfs_attribute_list_entry_t *attribute_list_entry,
    uint64_t *file_reference, libfsntfs_error_t **error);

int
libfsntfs_attribute_list_entry_get_utf8_name_size(libfsntfs_attribute_list_entry_t *attribute_list_entry,
    size_t *utf8_string_size, libfsntfs_error_t **error);

int
libfsntfs_attribute_list_entry_get_utf8_name(libfsntfs_attribute_list_entry_t *attribute_list_entry,
    uint8_t *utf8_string, size_t utf8_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_attribute_list_entry_get_utf16_name_size(libfsntfs_attribute_list_entry_t *attribute_list_entry,
    size_t *utf16_string_size, libfsntfs_error_t **error);

int
libfsntfs_attribute_list_entry_get_utf16_name(libfsntfs_attribute_list_entry_t *attribute_list_entry,
    uint16_t *utf16_string, size_t utf16_string_size,
    libfsntfs_error_t **error);

same deal, one level down: free, type, file reference, names both ways 💜

💖 $FILE_NAME attribute functions 💖

int
libfsntfs_file_name_attribute_get_parent_file_reference(libfsntfs_attribute_t *attribute,
    uint64_t *parent_file_reference, libfsntfs_error_t **error);

int
libfsntfs_file_name_attribute_get_creation_time(libfsntfs_attribute_t *attribute,
    uint64_t *filetime, libfsntfs_error_t **error);

int
libfsntfs_file_name_attribute_get_modification_time(libfsntfs_attribute_t *attribute,
    uint64_t *filetime, libfsntfs_error_t **error);

int
libfsntfs_file_name_attribute_get_access_time(libfsntfs_attribute_t *attribute,
    uint64_t *filetime, libfsntfs_error_t **error);

int
libfsntfs_file_name_attribute_get_entry_modification_time(libfsntfs_attribute_t *attribute,
    uint64_t *filetime, libfsntfs_error_t **error);

int
libfsntfs_file_name_attribute_get_file_attribute_flags(libfsntfs_attribute_t *attribute,
    uint32_t *file_attribute_flags, libfsntfs_error_t **error);

int
libfsntfs_file_name_attribute_get_name_space(libfsntfs_attribute_t *attribute,
    uint8_t *name_space, libfsntfs_error_t **error);

int
libfsntfs_file_name_attribute_get_utf8_name_size(libfsntfs_attribute_t *attribute,
    size_t *utf8_string_size, libfsntfs_error_t **error);

int
libfsntfs_file_name_attribute_get_utf8_name(libfsntfs_attribute_t *attribute,
    uint8_t *utf8_string, size_t utf8_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_file_name_attribute_get_utf16_name_size(libfsntfs_attribute_t *attribute,
    size_t *utf16_string_size, libfsntfs_error_t **error);

int
libfsntfs_file_name_attribute_get_utf16_name(libfsntfs_attribute_t *attribute,
    uint16_t *utf16_string, size_t utf16_string_size,
    libfsntfs_error_t **error);

parent reference, creation / modification / access / entry-modification times (all uint64_t *filetime, obvs), file attribute flags, name space, and the names themselves. it's giving complete metadata package 🌈

⭐ $OBJECT_ID attribute functions ⭐

int
libfsntfs_object_identifier_attribute_get_droid_file_identifier(libfsntfs_attribute_t *attribute,
    uint8_t *guid, size_t size, libfsntfs_error_t **error);

int
libfsntfs_object_identifier_attribute_get_birth_droid_volume_identifier(libfsntfs_attribute_t *attribute,
    uint8_t *guid, size_t size, libfsntfs_error_t **error);

int
libfsntfs_object_identifier_attribute_get_birth_droid_file_identifier(libfsntfs_attribute_t *attribute,
    uint8_t *guid, size_t size, libfsntfs_error_t **error);

int
libfsntfs_object_identifier_attribute_get_birth_droid_domain_identifier(libfsntfs_attribute_t *attribute,
    uint8_t *guid, size_t size, libfsntfs_error_t **error);

four GUIDs, all uint8_t *guid + size_t size: the droid file identifier, plus the birth droid volume / file / domain identifiers. yes the names are A Lot, no I did not make them up 😭

🎀 $REPARSE_POINT attribute functions 🎀

int
libfsntfs_reparse_point_attribute_get_tag(libfsntfs_attribute_t *attribute,
    uint32_t *tag, libfsntfs_error_t **error);

int
libfsntfs_reparse_point_attribute_get_compression_method(libfsntfs_attribute_t *attribute,
    uint32_t *compression_method, libfsntfs_error_t **error);

int
libfsntfs_reparse_point_attribute_get_utf8_substitute_name_size(libfsntfs_attribute_t *attribute,
    size_t *utf8_string_size, libfsntfs_error_t **error);

int
libfsntfs_reparse_point_attribute_get_utf8_substitute_name(libfsntfs_attribute_t *attribute,
    uint8_t *utf8_string, size_t utf8_string_size,
    libfsntfs_error_t **error);

and that's where this part cuts off bestie 😭 tag, compression method, and the utf8 substitute name (size first, then the name itself) — classic size-then-name combo, lowkey her signature move 💅

int
libfsntfs_reparse_point_attribute_get_utf16_substitute_name_size(libfsntfs_attribute_t *attribute,
    size_t *utf16_string_size, libfsntfs_error_t **error);

int
libfsntfs_reparse_point_attribute_get_utf16_substitute_name(libfsntfs_attribute_t *attribute,
    uint16_t *utf16_string, size_t utf16_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_reparse_point_attribute_get_utf8_print_name_size(libfsntfs_attribute_t *attribute,
    size_t *utf8_string_size, libfsntfs_error_t **error);

int
libfsntfs_reparse_point_attribute_get_utf8_print_name(libfsntfs_attribute_t *attribute,
    uint8_t *utf8_string, size_t utf8_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_reparse_point_attribute_get_utf16_print_name_size(libfsntfs_attribute_t *attribute,
    size_t *utf16_string_size, libfsntfs_error_t **error);

int
libfsntfs_reparse_point_attribute_get_utf16_print_name(libfsntfs_attribute_t *attribute,
    uint16_t *utf16_string, size_t utf16_string_size,
    libfsntfs_error_t **error);

🦋 $SECURITY_DESCRIPTOR attribute functions 🦋

int
libfsntfs_security_descriptor_attribute_get_security_descriptor_size(libfsntfs_attribute_t *attribute,
    size_t *data_size, libfsntfs_error_t **error);

int
libfsntfs_security_descriptor_attribute_get_security_descriptor(libfsntfs_attribute_t *attribute,
    uint8_t *data, size_t data_size, libfsntfs_error_t **error);

🌟 $STANDARD_INFORMATION attribute functions 🌟

int
libfsntfs_standard_information_attribute_get_creation_time(libfsntfs_attribute_t *attribute,
    uint64_t *filetime, libfsntfs_error_t **error);

int
libfsntfs_standard_information_attribute_get_modification_time(libfsntfs_attribute_t *attribute,
    uint64_t *filetime, libfsntfs_error_t **error);

int
libfsntfs_standard_information_attribute_get_access_time(libfsntfs_attribute_t *attribute,
    uint64_t *filetime, libfsntfs_error_t **error);

int
libfsntfs_standard_information_attribute_get_entry_modification_time(libfsntfs_attribute_t *attribute,
    uint64_t *filetime, libfsntfs_error_t **error);

int
libfsntfs_standard_information_attribute_get_file_attribute_flags(libfsntfs_attribute_t *attribute,
    uint32_t *file_attribute_flags, libfsntfs_error_t **error);

int
libfsntfs_standard_information_attribute_get_owner_identifier(libfsntfs_attribute_t *attribute,
    uint32_t *owner_identifier, libfsntfs_error_t **error);

int
libfsntfs_standard_information_attribute_get_security_descriptor_identifier(libfsntfs_attribute_t *attribute,
    uint32_t *security_descriptor_identifier,
    libfsntfs_error_t **error);

int
libfsntfs_standard_information_attribute_get_update_sequence_number(libfsntfs_attribute_t *attribute,
    uint64_t *update_sequence_number, libfsntfs_error_t **error);

💫 $VOLUME_INFORMATION attribute functions 💫

int
libfsntfs_volume_information_attribute_get_version(libfsntfs_attribute_t *attribute,
    uint8_t *major_version, uint8_t *minor_version,
    libfsntfs_error_t **error);

int
libfsntfs_volume_information_attribute_get_flags(libfsntfs_attribute_t *attribute,
    uint16_t *flags, libfsntfs_error_t **error);

✨ $VOLUME_NAME attribute functions ✨

int
libfsntfs_volume_name_attribute_get_utf8_name_size(libfsntfs_attribute_t *attribute,
    size_t *utf8_string_size, libfsntfs_error_t **error);

int
libfsntfs_volume_name_attribute_get_utf8_name(libfsntfs_attribute_t *attribute,
    uint8_t *utf8_string, size_t utf8_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_volume_name_attribute_get_utf16_name_size(libfsntfs_attribute_t *attribute,
    size_t *utf16_string_size, libfsntfs_error_t **error);

int
libfsntfs_volume_name_attribute_get_utf16_name(libfsntfs_attribute_t *attribute,
    uint16_t *utf16_string, size_t utf16_string_size,
    libfsntfs_error_t **error);

🎀 Data stream functions 🎀

int
libfsntfs_data_stream_free(libfsntfs_data_stream_t **data_stream,
    libfsntfs_error_t **error);

int
libfsntfs_data_stream_get_utf8_name_size(libfsntfs_data_stream_t *data_stream,
    size_t *utf8_string_size, libfsntfs_error_t **error);

int
libfsntfs_data_stream_get_utf8_name(libfsntfs_data_stream_t *data_stream,
    uint8_t *utf8_string, size_t utf8_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_data_stream_get_utf16_name_size(libfsntfs_data_stream_t *data_stream,
    size_t *utf16_string_size, libfsntfs_error_t **error);

int
libfsntfs_data_stream_get_utf16_name(libfsntfs_data_stream_t *data_stream,
    uint16_t *utf16_string, size_t utf16_string_size,
    libfsntfs_error_t **error);

ssize_t
libfsntfs_data_stream_read_buffer(libfsntfs_data_stream_t *data_stream,
    void *buffer, size_t buffer_size, libfsntfs_error_t **error);

ssize_t
libfsntfs_data_stream_read_buffer_at_offset(libfsntfs_data_stream_t *data_stream,
    void *buffer, size_t buffer_size, off64_t offset,
    libfsntfs_error_t **error);

off64_t
libfsntfs_data_stream_seek_offset(libfsntfs_data_stream_t *data_stream,
    off64_t offset, int whence, libfsntfs_error_t **error);

int
libfsntfs_data_stream_get_offset(libfsntfs_data_stream_t *data_stream,
    off64_t *offset, libfsntfs_error_t **error);

int
libfsntfs_data_stream_get_size(libfsntfs_data_stream_t *data_stream,
    size64_t *size, libfsntfs_error_t **error);

int
libfsntfs_data_stream_get_number_of_extents(libfsntfs_data_stream_t *data_stream,
    int *number_of_extents, libfsntfs_error_t **error);

int
libfsntfs_data_stream_get_extent_by_index(libfsntfs_data_stream_t *data_stream,
    int extent_index, off64_t *extent_offset, size64_t *extent_size,
    uint32_t *extent_flags, libfsntfs_error_t **error);

🧚 MFT metadata file functions 🧚

int
libfsntfs_mft_metadata_file_initialize(libfsntfs_mft_metadata_file_t **mft_metadata_file,
    libfsntfs_error_t **error);

int
libfsntfs_mft_metadata_file_free(libfsntfs_mft_metadata_file_t **mft_metadata_file,
    libfsntfs_error_t **error);

int
libfsntfs_mft_metadata_file_open(libfsntfs_mft_metadata_file_t *mft_metadata_file,
    const char *filename, int access_flags, libfsntfs_error_t **error);

int
libfsntfs_mft_metadata_file_close(libfsntfs_mft_metadata_file_t *mft_metadata_file,
    libfsntfs_error_t **error);

int
libfsntfs_mft_metadata_file_get_utf8_volume_name_size(libfsntfs_mft_metadata_file_t *mft_metadata_file,
    size_t *utf8_string_size, libfsntfs_error_t **error);

int
libfsntfs_mft_metadata_file_get_utf8_volume_name(libfsntfs_mft_metadata_file_t *mft_metadata_file,
    uint8_t *utf8_string, size_t utf8_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_mft_metadata_file_get_utf16_volume_name_size(libfsntfs_mft_metadata_file_t *mft_metadata_file,
    size_t *utf16_string_size, libfsntfs_error_t **error);

int
libfsntfs_mft_metadata_file_get_utf16_volume_name(libfsntfs_mft_metadata_file_t *mft_metadata_file,
    uint16_t *utf16_string, size_t utf16_string_size,
    libfsntfs_error_t **error);

int
libfsntfs_mft_metadata_file_get_volume_version(libfsntfs_mft_metadata_file_t *mft_metadata_file,
    uint8_t *major_version, uint8_t *minor_version,
    libfsntfs_error_t **error);

int
libfsntfs_mft_metadata_file_get_volume_flags(libfsntfs_mft_metadata_file_t *mft_metadata_file,
    uint16_t *flags, libfsntfs_error_t **error);

int
libfsntfs_mft_metadata_file_get_number_of_file_entries(libfsntfs_mft_metadata_file_t *mft_metadata_file,
    uint64_t *number_of_file_entries, libfsntfs_error_t **error);

int
libfsntfs_mft_metadata_file_get_file_entry_by_index(libfsntfs_mft_metadata_file_t *mft_metadata_file,
    uint64_t mft_entry_index, libfsntfs_file_entry_t **file_entry,
    libfsntfs_error_t **error);

Available when compiled with wide character string support:

int
libfsntfs_mft_metadata_file_open_wide(libfsntfs_mft_metadata_file_t *mft_metadata_file,
    const wchar_t *filename, int access_flags,
    libfsntfs_error_t **error);

Available when compiled with libbfio support:

int
libfsntfs_mft_metadata_file_open_file_io_handle(libfsntfs_mft_metadata_file_t *mft_metadata_file,
    libbfio_handle_t *file_io_handle, int access_flags,
    libfsntfs_error_t **error);

💜 USN change journal functions 💜

int
libfsntfs_usn_change_journal_free(libfsntfs_usn_change_journal_t **usn_change_journal,
    libfsntfs_error_t **error);

int
libfsntfs_usn_change_journal_get_offset(libfsntfs_usn_change_journal_t *usn_change_journal,
    off64_t *offset, libfsntfs_error_t **error);

ssize_t
libfsntfs_usn_change_journal_read_usn_record(libfsntfs_usn_change_journal_t *usn_change_journal,
    uint8_t *usn_record_data, size_t usn_record_data_size,
    libfsntfs_error_t **error);

💖 DESCRIPTION 💖

okay so like, the libfsntfs_get_version() function? It's literally just here to grab the library version for you. That's its whole job. No cap. 💅

🔙 RETURN VALUES 🔙

So most of these functions are gonna return NULL or -1 when something goes wrong, but it depends on what type they return. For the exact deets, you gotta check libfsntfs.h — that's where the real tea is. ☕️

🌿 ENVIRONMENT 🌿

Environment variables? None. Nada. Zero. Zilch. 💀

📁 FILES 📁

Files? Also none. We're not about that file life here. 🙈

📝 NOTES 📝

We got some notes, bestie. So libfsntfs can be compiled with wide character support (that's wchar_t for the uninitiated). To make that happen, you run ./configure --enable-wide-character-type=yes, or you can define _UNICODE or UNICODE during compilation. And if you wanna know if your build has it, check LIBFSNTFS_WIDE_CHARACTER_TYPE in libfsntfs/features.h. That's your vibe check. ✨

🐛 BUGS 🐛

Found a bug? Bestie, please report it on the project issue tracker: https://github.com/libyal/libfsntfs/issues. They wanna know. 🐛

👑 AUTHOR 👑

These man pages? They're generated from libfsntfs.h. So if you see something weird, blame the header. 😭

📜 COPYRIGHT 📜

Copyright (C) 2010-2024, Joachim Metz <joachim.metz@gmail.com>. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

So like, use at your own risk, bestie. 💅

🦋 SEE ALSO 🦋

the libfsntfs.h include file — that's the one. Go look at it. It's got all the forbidden knowledge.

and that's the tea! This page is from libfsntfs, dated November 19, 2023, and it's section 3. Stay slay, bestie! 💖✨

📦 where this page comes from

debian trixie: libfsntfs-dev 20240501-1+b1 · LGPL-3.0-or-later
opensuse-leap 16.0: libfsntfs-devel 20240501-bp160.1.12 · GFDL-1.3-or-later AND LGPL-3.0-or-later
opensuse-leap 16.0: libfsntfs-devel 20240501-bp160.1.12 · GFDL-1.3-or-later AND LGPL-3.0-or-later
opensuse-leap 16.0: libfsntfs-devel 20240501-bp160.1.12 · GFDL-1.3-or-later AND LGPL-3.0-or-later
opensuse-leap 16.0: libfsntfs-devel 20240501-bp160.1.12 · GFDL-1.3-or-later AND LGPL-3.0-or-later
ubuntu questing: libfsntfs-dev 20240501-1ubuntu1
ubuntu resolute: libfsntfs-dev 20240501-1ubuntu2 · LGPL-3.0-or-later
ubuntu stonking: libfsntfs-dev 20240501-1ubuntu2 · LGPL-3.0-or-later
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-11-03: a language model's rewrite of the original, under its terms