Dzięki za szybką odpowiedź. Wróciłem po pracy i skopiowane do pliku sektory od 0 do 2048 (z kopii posektorowej)- mam nadzieję, że dobrze. Czy ewentualnie z oryginalnego adata?
DMDE (Disk Editor and Data Recovery Software)
The software is to search, edit, and recover data on disks
Copyright (c) 2005-2020 Dmitry Sidorov
WWW: http://dmde.com/
http://softdm.com/
The software may be used under the terms of the license
agreements in the file " eula.txt "
Be sure to know system requirements before use (read the manual)
DMDE 3.8 - DM Disk Editor and Data Recovery Software
Àâòîðñêèå ïðàâà (C) 2005-2020 Äìèòðèé Ñèäîðîâ
http://dmde.ru/
http://dmde.com/
ËÈÖÅÍÇÈÎÍÍÎÅ ÑÎÃËÀØÅÍÈÅ
Íàñòîÿùåå ëèöåíçèîííîå ñîãëàøåíèå ÿâëÿåòñÿ þðèäè÷åñêèì ñîãëàøåíèåì
ìåæäó Âàìè (ôèçè÷åñêèì èëè þðèäè÷åñêèì ëèöîì), è àâòîðîì äàííîãî
ïðîãðàììíîãî îáåñïå÷åíèÿ (ÏÎ) Äìèòðèåì Ñèäîðîâûì. Èñïîëüçóÿ ÏÎ, Âû
ïðèíèìàåòå óñëîâèÿ Ñîãëàøåíèÿ.
1. ÏÐÅÄÎÑÒÀÂËßÅÌÛÅ ÏÐÀÂÀ
1.0. ÐÅÄÀÊÖÈÈ ÏÎ
Îáúåì Âàøèõ ïðàâ íà èñïîëüçîâàíèå ÏÎ çàâèñèò îò ÐÅÄÀÊÖÈÈ ÏÎ (òèïà
ëèöåíçèè) è êîëè÷åñòâà ëèöåíçèîííûõ êîïèé, ïðåäîñòàâëåííûõ Âàì.
ÐÅÄÀÊÖÈß, êîëè÷åñòâî êîïèé è êîëè÷åñòâî ïîääåðæèâàåìûõ ïëàòôîðì ÎÑ
óêàçàíû â Âàøåì çàêàçå ëèöåíçèè. ÐÅÄÀÊÖÈß, êîëè÷åñòâî êîïèé, ñðîê
ëèöåíçèè òàêæå îòîáðàæàþòñÿ â îêíå ÏÎ " Î ïðîãðàììå " (â ìåíþ ÏÎ
" Ñïðàâêà " ). Åñëè êîëè÷åñòâî êîïèé íå óêàçàíî ÿâíî, òî ïðåäîñòàâëåíà
îäíà (1) ëèöåíçèÿ. Åñëè ñðîê ëèöåíçèè íå óêàçàí, òî îí íå îãðàíè÷åí.
1.1. ÐÅÄÀÊÖÈß " FREE EDITION "
Ê ðåäàêöèè " FREE EDITION " ïðèìåíÿþòñÿ òîëüêî ïóíêòû 1.1, 5 è 6.
Ìîæíî èñïîëüçîâàòü ëþáîå ÷èñëî êîïèé " FREE EDITION " â íåêîììåð÷åñêèõ
öåëÿõ, âêëþ÷àÿ îáðàçîâàòåëüíûå öåëè ó÷ðåæäåíèé è îçíàêîìëåíèå.
Äîïóñêàåòñÿ âîññòàíîâëåíèå ôàéëîâ òîëüêî èç òåêóùåé ïàíåëè è
ñ îãðàíè÷åíèåì äî 4000 ôàéëîâ çà ðàç (îäíîé êîìàíäîé).
Êîïèè " FREE EDITION " ìîæíî ñîçäàâàòü è ðàñïðîñòðàíÿòü (â òîì ÷èñëå â
ñîñòàâå ïëàòíûõ êîìïëåêñîâ) ïðè âûïîëíåíèè âñåõ óñëîâèé: ÏÎ ïîëó÷åíî
íåïîñðåäñòâåííî ó àâòîðà èëè íà ñàéòàõ ÏÎ; íå ïåðåäàþòñÿ êëþ÷è è èíûå
êîìïîíåíòû äðóãèõ ÐÅÄÀÊÖÈÉ ÏÎ; ñîñòàâ è êîìïîíåíòû ÏÎ íå èçìåíåíû
(êðîìå îáðàòèìîãî ïåðåêîäèðîâàíèÿ); ïðîèñõîæäåíèå, àâòîðñòâî, óñëîâèÿ
äàííîãî ñîãëàøåíèÿ äîñòóïíû êîíå÷íîìó ïîëüçîâàòåëþ â ÿâíîì âèäå.
1.2.1. ÐÅÄÀÊÖÈÈ " EXPRESS " È " PERSONAL " : ÒÎËÜÊÎ ËÈ×ÍÎÅ ÈÑÏÎËÜÇÎÂÀÍÈÅ
Ðåäàêöèè " EXPRESS " è " PERSONAL " äàþò ïðàâî èñïîëüçîâàòü ÏÎ òîëüêî â
ëè÷íûõ íåêîììåð÷åñêèõ öåëÿõ. Çàïðåùàåòñÿ ëþáîå èñïîëüçîâàíèå ÏÎ,
ïðÿìî èëè êîñâåííî ïðèâîäÿùåå ê ïîëó÷åíèþ âûãîäû.
1.2.2. ÐÅÄÀÊÖÈß " STANDARD " : ÈÑÏÎËÜÇÎÂÀÍÈÅ ÒÎËÜÊÎ ÄËß ÑÎÁÑÒÂÅÍÍÛÕ ÍÓÆÄ
Ðåäàêöèÿ " STANDARD " äàåò ïðàâî èñïîëüçîâàòü ÏÎ ÷àñòíûì ëèöàì è
îðãàíèçàöèÿì òîëüêî äëÿ ñîáñòâåííûõ íóæä. Çàïðåùàåòñÿ îêàçàíèå óñëóã
ïî âîññòàíîâëåíèþ äàííûõ äëÿ òðåòüèõ ëèö.  òîì ÷èñëå, ÏÎ íå ìîãóò
èñïîëüçîâàòü ëþáûå îðãàíèçàöèè, à òàêæå èõ ñîòðóäíèêè è èíûå ëèöà,
ïðåäîñòàâëÿþùèå óñëóãè ïî âîññòàíîâëåíèþ äàííûõ.
1.3. ÇÀÏÓÑÊ È ÕÐÀÍÅÍÈÅ ÊÎÏÈÉ ÏÎ
Âû ìîæåòå îäíîâðåìåííî çàïóñêàòü ýêçåìïëÿðû ÏÎ â ïðåäåëàõ êîëè÷åñòâà
ïðåäîñòàâëåííûõ êîïèé ëèöåíçèè (÷èñëî íåçàâåðøåííûõ ïðîöåññîâ íå
äîëæíî ïðåâûøàòü êîëè÷åñòâî êîïèé ëèöåíçèè).
 îáùåé ñëîæíîñòè Âû ìîæåòå ñîçäàòü è õðàíèòü íà äâå (2) êîïèè ÏÎ
áîëüøå, ÷åì êîëè÷åñòâî êîïèé ëèöåíçèè. Îäíà êîïèÿ ìîæåò âêëþ÷àòü
íåñêîëüêî âåðñèé ÏÎ â îäíîì õðàíèëèùå äàííûõ.
2. ÀÊÒÈÂÀÖÈß
Àêòèâàöèÿ ñâÿçûâàåò çàïóñê ÏÎ ñ êîíêðåòíîé àïïàðàòíîé êîíôèãóðàöèåé
ÝÂÌ è ðàçáëîêèðóåò ïîëíóþ ôóíêöèîíàëüíîñòü ÏÎ. Àêòèâàöèÿ òðåáóåò
îòïðàâêè êîäà èäåíòèôèêàöèè îáîðóäîâàíèÿ íà ñàéòû àêòèâàöèè ÏÎ äëÿ
ïîëó÷åíèÿ êîäà ðàçáëîêèðîâêè.
Àêòèâàöèÿ ìîæåò áûòü îòêëîíåíà â ñëó÷àå çàïóñêà ÏÎ áîëåå ÷åì íà
òðåõ (3) àïïàðàòíûõ êîíôèãóðàöèÿõ â ãîä íà îäíó êîïèþ ëèöåíçèè.
Ñìåíà ïðîöåññîðà èëè ìàòåðèíñêîé ïëàòû (âêëþ÷àÿ èçìåíåíèå ñåðèéíîãî
íîìåðà â ÏÇÓ), èñïîëüçîâàíèå äîïîëíèòåëüíîé âèðòóàëèçàöèè îçíà÷àþò
ñìåíó àïïàðàòíîé êîíôèãóðàöèè. Ïðè íåêîòîðûõ äðóãèõ àïïàðàòíûõ èëè
ïðîãðàììíûõ èçìåíåíèÿõ ìîæåò ïîòðåáîâàòüñÿ (è äîïóñêàåòñÿ) ïîâòîðíàÿ
àêòèâàöèÿ ÏÎ.
 ñëó÷àå èñòå÷åíèÿ ñðîêà ëèöåíçèè Âû ìîæåòå ïðîäîëæàòü èñïîëüçîâàíèå
ÏÎ â ïðåæíåé ñðåäå, îäíàêî, íèêàêàÿ ïîääåðæêà, â òîì ÷èñëå ïîâòîðíàÿ
àêòèâàöèÿ, íå ïðåäîñòàâëÿåòñÿ.
3. ÎÁÍÎÂËÅÍÈß ÏÎ
Åñëè ïîääåðæêà èìåþùåéñÿ âåðñèè ïðåêðàùàåòñÿ, Âû ìîæåòå èñïîëüçîâàòü
ñëåäóþùóþ äîñòóïíóþ âåðñèþ, ïðè ýòîì íîâîå ñîãëàøåíèå çàìåíÿåò
ïðåäûäóùåå òîëüêî â ïóíêòàõ, óòî÷íÿþùèõ óñëîâèÿ è ÿâíî ðàñøèðÿþùèõ
Âàøè ïðàâà.  èíûõ ñëó÷àÿõ íîâûå âåðñèè ìîãóò èñïîëüçîâàòüñÿ òîëüêî
ïîëíîñòüþ íà óñëîâèÿõ íîâûõ ñîãëàøåíèé.
Âû òàêæå ìîæåòå èñïîëüçîâàòü ïðåäûäóùèå äîñòóïíûå âåðñèè ÏÎ íà
óñëîâèÿõ äàííîãî ñîãëàøåíèÿ. Îäíàêî, çàïóñê ïðåäûäóùèõ âåðñèé ÏÎ
(ñ ó÷åòîì íîìåðà äî ïåðâîé òî÷êè) ïðèðàâíèâàåòñÿ ê çàïóñêó íà äðóãîì
îáîðóäîâàíèè ñ ïðèìåíåíèåì îãðàíè÷åíèé ïóíêòà 2.
4. ÀÏÃÐÅÉÄ ÏÎ
Àïãðåéä - èçìåíåíèå êîìïëåêòàöèè, ÷èñëà êîïèé ëèöåíçèè èëè ÐÅÄÀÊÖÈÈ.
Äëÿ àïãðåéäà ÏÎ íåîáõîäèìî èìåòü èñõîäíóþ ëèöåíçèþ, äëÿ êîòîðîé
ïðåäîñòàâëÿåòñÿ àïãðåéä. Ïðè àïãðåéäå íîâîå ëèöåíçèîííîå ñîãëàøåíèå
çàìåíÿåò ñîáîé ïðåäûäóùåå, è Âû áîëüøå íå ìîæåòå èñïîëüçîâàòü êëþ÷è
è èíûå êîìïîíåíòû, ïðåäîñòàâëåííûå ïî óñëîâèÿì ïðåäûäóùåé ëèöåíçèè.
5. ÎÏÈÑÀÍÈÅ ÏÐÎ×ÈÕ ÏÐÀÂ È ÎÃÐÀÍÈ×ÅÍÈÉ
Âû íå ìîæåòå èñïîëüçîâàòü ÏÎ èíà÷å, ÷åì ÿâíî ïðåäóñìîòðåíî çàêîíîì,
íàñòîÿùèì Ñîãëàøåíèåì è äîïîëíèòåëüíûìè ñîãëàøåíèÿìè ñ àâòîðîì ÏÎ.
Íàñòîÿùåå Ñîãëàøåíèå íå äàåò ïðàâà èçìåíÿòü, äåêîìïèëèðîâàòü,
äèçàññåìáëèðîâàòü è èçó÷àòü êîä ÏÎ èíûì îáðàçîì, à òàêæå ïðîäàâàòü,
ñäàâàòü â àðåíäó èëè ñóáëèöåíçèðîâàòü ÏÎ.
Íàðóøåíèå ëþáûõ óñëîâèé Ñîãëàøåíèÿ àâòîìàòè÷åñêè îòìåíÿåò Ñîãëàøåíèå
è Âàøè ïðàâà íà ëþáîå èñïîëüçîâàíèå ÏÎ.
Âñå ïðàâà àâòîðà ÏÎ ñîõðàíÿþòñÿ çà àâòîðîì ÏÎ.
6. ÎÃÐÀÍÈ×ÅÍÍÀß ÃÀÐÀÍÒÈß
ÀÂÒÎÐ ÏÐÎÃÐÀÌÌÍÎÃÎ ÎÁÅÑÏÅ×ÅÍÈß ßÂÍÛÌ ÎÁÐÀÇÎÌ ÎÒÊÀÇÛÂÀÅÒÑß ÎÒ ËÞÁÛÕ
ÃÀÐÀÍÒÈÉ ÍÀ ÏÐÎÃÐÀÌÌÍÎÅ ÎÁÅÑÏÅ×ÅÍÈÅ. ÏÐÎÃÐÀÌÌÍÎÅ ÎÁÅÑÏÅ×ÅÍÈÅ
ÏÎÑÒÀÂËßÅÒÑß ÏÎ ÏÐÈÍÖÈÏÓ " ÊÀÊ ÅÑÒÜ " . ÍÈÊÀÊÈÕ ÃÀÐÀÍÒÈÉ, ßÂÍÛÕ ÈËÈ
ÏÎÄÐÀÇÓÌÅÂÀÅÌÛÕ, ÍÅ ÏÐÈËÀÃÀÅÒÑß È ÍÅ ÏÐÅÄÓÑÌÀÒÐÈÂÀÒÅÑß, ÂÊËÞ×Àß,
ÍÎ ÍÅ ÎÃÐÀÍÈ×ÈÂÀßÑÜ ÒÀÊÈÌÈ ÊÀÊ: ÃÀÐÀÍÒÈÈ ÑÎÂÌÅÑÒÈÌÎÑÒÈ, ÏÐÈÃÎÄÍÎÑÒÈ
ÄËß ÈÑÏÎËÜÇÎÂÀÍÈß ÈËÈ ÎÒÑÓÒÑÒÂÈß ÂÎÇÌÎÆÍÛÕ ÐÈÑÊÎÂ ÏÐÈ ÝÊÑÏËÓÀÒÀÖÈÈ.
ÂÛ ÈÑÏÎËÜÇÓÅÒÅ ÝÒÎ ÏÐÎÃÐÀÌÌÍÎÅ ÎÁÅÑÏÅ×ÅÍÈÅ ÍÀ ÑÂÎÉ ÑÒÐÀÕ È ÐÈÑÊ.
ÍÈ Â ÊÎÅÌ ÑËÓ×ÀÅ ÀÂÒÎÐ ÍÅ ÍÅÑ¨Ò ÎÒÂÅÒÑÒÂÅÍÍÎÑÒÜ ÇÀ ÓÙÅÐÁ È ÏÎÒÅÐÈ,
ÂÎÇÍÈÊØÈÅ ÂÑËÅÄÑÒÂÈÅ ÈÑÏÎËÜÇÎÂÀÍÈß ÈËÈ ÍÅÂÎÇÌÎÆÍÎÑÒÈ ÈÑÏÎËÜÇÎÂÀÍÈß
ÏÐÎÃÐÀÌÌÍÎÃÎ ÎÁÅÑÏÅ×ÅÍÈß (ÂÊËÞ×Àß, ÍÎ ÍÅ ÎÃÐÀÍÈ×ÈÂÀßÑÜ ÒÀÊÈÌÈ ÊÀÊ:
ËÞÁÛÅ ÏÎÒÅÐÈ ÈËÈ ÈÑÊÀÆÅÍÈß ÄÀÍÍÛÕ, ÓÏÓÙÅÍÍÀß ÂÛÃÎÄÀ, ÏÅÐÅÐÛÂÛ Â
ÐÀÁÎÒÅ, ÏÎÒÅÐß ÄÅËÎÂÎÉ ÈÍÔÎÐÌÀÖÈÈ, ËÈ×ÍÛÉ ÂÐÅÄ, ÐÀÑÊÐÛÒÈÅ
ÊÎÍÔÈÄÅÍÖÈÀËÜÍÎÉ ÈÍÔÎÐÌÀÖÈÈ, ÌÀÒÅÐÈÀËÜÍÛÅ ÈËÈ ËÞÁÛÅ ÄÐÓÃÈÅ ÓÁÛÒÊÈ),
ÄÀÆÅ ÅÑËÈ ÀÂÒÎÐ ÁÛË ÎÑÂÅÄÎÌË¨Í Î ÂÎÇÌÎÆÍÎÑÒÈ ÒÀÊÈÕ ÏÎÑËÅÄÑÒÂÈÉ.
DMDE Change Log
Version 3.8.0.790 (2020-11-05)
new: APFS support (without encryption)
new: image preview (for standard graphics)
new: Portuguese Brazilian, Simplified Chinese translations
fixed: HFS support critical bugs
fixed: extfs Full Scan critical bug processing damaged inodes
other improvements and fixes
Version 3.6.1.773 (2019-10-12)
new: 64-bit version for macOS
Version 3.6.0.770 (2019-09-14)
new: ReFS v1/v3 support
new: filtering Raw results by using cluster map
new: applying Raw results to FS data
new: support for VMDK disk image files
new: support for EWF disk image files (e01/etc., Professional Edition only)
improved: cluster map support (diff. FS types / damaged FS / reports)
improved: more presize detection of RAID parameters, fixed offset detection
fixed: HFS support critical bugs
fixed: extfs some rare parameters support
fixed: exFAT found directory fragments processing
fixed: copying sectors bug when loading log with retried bad ranges
other improvements and fixes
Version 3.4.4.740 (2018-08-03)
new: version for macOS
new: GUI version for Linux
improved: size detection of some Jpeg files (Raw search)
fixed: support for custom EOF signatures (Raw search)
other improvements and fixes
Version 3.4.2.722 (2017-11-21)
new: Apple partitioning support (read-only)
new: HFS+/HFSX support including complex HFS search
new: popup hints
improved: detection of some file types (Raw search)
improved: custom file signature support (detection, complex signatures)
fixed: RAID-6 detection critical bug
other improvements and fixes
Version 3.2.0.692 (2017-01-14)
new: tabbed interface to work with multiple devices and objects
new: custom file signatures support
new: detection of RAID parameters
new: support for VHD and VHDX dynamic disk image files
new: SMART report reading
new: NTFS encrypted file recovery (without decryption)
new: NTFS option: reading MFT from an external file
new: disk imaging option: splitted image creation
improved: exFAT boot sector recognition during fullscan
improved: improved NTFS reconstruction by processing INDX records
improved: better name recognition for some removed NTFS files
other improvements and fixes
Version 3.0.6.648 (2016-06-22)
new: recovery of some truncated NTFS files
improved: file signatures and size detection
improved: branches separation of directory tree (NTFS and extfs)
fixed: NTFS search critical bug
fixed: storing/loading found signatures to/from log
fixed: RAID-5 forward dynamic parity: wrong striping
new: French, Italian, Spanish, Persian (+RTL UI) translation
other improvements and fixes
Version 3.0.4.630 (2015-10-15)
new: Full Scan (multiple FS and Raw search, improved interface)
new: Raw file search by signatures
new: NTFS extended search (FS structures and file signatures based)
new: exFAT extended search (FS structures and file signatures based)
new: extfs extended search (FS structures based)
new: extfs removed entries processing
new: FAT32 removed file recovery using signatures
other improvements and fixes
Version 2.10.2.564 (2014-12-11)
improved: NTFS reconstruction default filters
fixed: exFAT reconstruction when there are removed directories
fixed: ex(FAT) table processing memory exception
fixed: search string in 64-bit version
fixed: extFS superblock detection in 64-bit version
fixed: extFS 64-bit support
other fixes
Version 2.10.0.560 (2014-07-12)
added: Basic exFAT support
added: DOS ASPI support
improved: FAT reconstruction
fixed: 64-bit versions issues
some bugs fixed
Version 2.8.2.546 (2014-04-18)
fixed: extfs: missing files while recovering
fixed: extfs: reporting error for sparse files
fixed: extfs inode template
fixed: DOS version bugs (device selection when copy sectors)
fixed: DOS ATA reset option is not visible
other fixes
Version 2.8.0.542 (2014-02-13)
added: Basic Ext2/3/4 support
added: Disk Editor: custom template support
fixed: critical error when open some USB devices
minor improvements and fixes
Version 2.6.0.522 (2013-11-18)
added: GUID partitioning (GPT) support (edit mode)
added: Disk images/clones: load/save parameters, write log; resume using log (Prof. Edition)
added: Disk images/clones: simultaneous read and write in two threads (Linux and Windows)
added: Bad I/O option: replace bad sector data by filler
added: RAID: RAID-6 support (only XOR recovery), custom striping, load/save parameters
added: Undo, Redo support (Disk Editor, Partition Manager)
added: ATA software reset (DOS ATA)
added: Unicode support for Windows console interface, Linux terminal interface, Disk Editor
added: NTFS reconstruction: MFT fragment manager
added: additional NTFS features to recover lost or damaged files
added: NTFS Search: search shifted MFT records
improved: NTFS Search: handling many MFT fragments optimization
improved: FAT Search: search volumes w/o subdirectories, detect small FAT tables
other improvements
Version 2.4.6.448 (2013-08-29)
fixed: erroneous omission of some close small MFT fragments
fixed: handling found MFT fragment larger than 2GB
fixed: cache error (data confusion on drives & gt; 2TiB in some special cases)
fixed: search by name (last symbol omission for name without extension)
other bugs fixed
Version 2.4.4.442 (2012-09-05)
fixed: RAID redundant data parity use when disk is absent
fixed: read backward issues
fixed: NTFS Search 64-bit cluster support
minor improvements and fixes
Version 2.4.2 (2012-04-05)
fixed: disk size detection
fixed: NTFS sparse file support
fixed: GPT copy test
fixed: Chinese Big5 Code issue
other bugs fixed
Version 2.4.0 (2011-12-18)
improved: partition search (flash disks, Vista/Win7 partitioning)
improved: handling directory recovery with the same names
improved: FAT volume scan uses FAT Search results
added: recovery reports
added: exFAT boot sector, Ext2/3/4 superblock detection
added: RAID delayed parity support, RAID-4 support
added: NTFS alternate data stream support
fixed: Large sector support
fixed: NTFS search critical bug on MFT gaps
fixed: special sector search critical bug
fixed: device I/O error handling bug
fixed: pci scan for ATA devices over non-default ports (DOS)
fixed: DMA transfer completing detection (DOS)
other improvements
other bugs fixed
Version 2.2.2 (2010-12-10)
imporved: FAT search speed up
imporved: NTFS search speed up
improved: partition manager
fixed, improved: volume locking
added: customizable device I/O error handler (Professional Edition only)
added: DMA I/O under DOS (Professional Edition only)
added: recover NTFS multirecord files w/o attribute list
added: support for compressed files when cluster size is less than 4KB
some bugs fixed
Version 2.0.1 (2009-09-20)
added: version for Linux terminal
added: support for devices larger than 1TB
added: device I/O retry dialog
added: RAID partial support
added: GPT partial support
added: Unicode name support
added: support for large NTFS compressed files
added: multi language support
added: file and directory marking for group recovery
improved: device access
interface improved
other improvements
some bugs fixed
Version 01.39 (2008-05-01)
added: Windows XP+ theme support
added: write siupport under Windows Vista+
Version 01.38 (2007-09-03)
added: GUI version
improved: NTFS search
improved: processing lost FAT directories
some bugs fixed
Version 01.37 (2007-07-23)
improved: faster input/output operations
added: recovery NTFS directory structure (full version only)
added: support for disk images
added: support for IDE ATA drives in DOS version
added: support for DOS logical drives DOS version
interface improved
some bugs fixed
Version 01.36 (2006-10-22)
added: russian/english interface
added: work with FAT volumes with damaged directories structure
added: directory recovery (full version only)
some bugs fixed
Version 01.35 (2006-09-10)
added: cluster map
added: support for FAT files & gt; 2GB and NTFS files & gt; 4GB
fixed: NTFS Search
fixed: writing to MFT reserved area when create NTFS files and directories
fixed: NTFS directory recovery (support for 64bits, file attributes corrected)
Version 01.34 (2006-07-27)
added: support for different NTFS versions
fixed: processing NTFS volumes without MFT record 0
improved: NTFS indexes reading
Version 01.33 (2006-07-19)
fixed: MFTMirr updating after MFT modification
fixed: NTFS extended attribute processing
Version 01.32 (2006-07-13)
added: direct NTFS write access
some small bugs fixed
Version 01.30 (2006-06-26)
critical bug fixed: detecting XBIOS in 32bit DOS version
fixed: NTFS FILE fragmented record processing
added: FAT Search
added: file panel for FAT
added: write file to sectors, save sectors to file
added: work without FAT tables, with bad FAT tables
improved: partition manager
improved: NTFS file enumeration
improved: removed file recovery for FAT
improved: interface
changed: Windows event handler
some other logical bugs fixed
some other modifications
Version 01.23 (2006-03-27)
fixed: processing cluster chains for removed FAT files
fixed: mouse and keyboard processing under Windows
Version 01.22 (2006-03-23)
added: versions for Windows NT/2000/XP
some interface improvements
Version 01.21 (2006-03-17)
added: 32-bit DOS version
some interface improvements
some bugs fixed
Version 01.20 (2006-01-09)
added: quick search for lost partitions
added: simple partition manager
added: file recovery
some bugs fixed
Version 01.11 (2005-12-23)
improved: NTFS Search (more information used, some bugs fixed)
Version 01.10 (2005-11-18)
added: NTFS Search
added: safe processing compressed files with errors
fixed: memory loss
fixed: error handling
some interface modifications
Version 01.04 (2005-09-17)
added: support for NTFS volumes without MFT
fixed: incorrect partition start sector for DOS extended partitions
Version 01.03 (2005-09-09)
added: viewing MFT record details
fixed: NTFS compression processing
fixed: NTFS extended attribute processing
fixed: searching for string
-- Device I/O handler script
--
-- Variables (all are zero based):
-- %CONFIRM% - 1 if Confirm pressed, 0 if Cancel pressed
-- %DISKNUM% - disk number in RAID array
-- %TRYNUM% - i/o retry number
-- %LBA% - first i/o sector number
-- %SECNUM% - number of i/o sectors
-- %ERROR% - i/o error
-- %ATASTATUS% - DOS ATA only ATA status register value (defined if not busy)
-- %ATAERROR% - DOS ATA only ATA error register (defined if ERR bit set in %ATASTATUS%)
-- %LINE% - current line number in script
-- %SERVICE% - i/o service number:
-- 0-ATA 1-ATAPI 3-BIOSINT13OLD 4-BIOSINT13
-- 5-DOSINT25 6-DOSINT73 8-DOSMSCDEX 9-DOSFILE
-- 11-WINFILE 12-WINSCSI 14-WIN9XINT13 20-LINUXFILE
-- %LASTRES% - result of the previous command
-- %LASTERR% - error of the previous command
--
-- After a colon there may be a format specifier for output:
-- x = hexadecimal
-- %LBA:10x%
--
-- Commands:
-- SHOWDLG - force device i/o dialog box
-- WAIT - wait for user choice
-- DELAY N - delay for N msec
-- EXECCMD CMDLINE - execute external command CMDLINE using Command interpreter
-- (equals " cmd CMDLINE " in Windows)
-- EXECCMDQ CMDLINE - execute without creating new console window (quiet)
-- EXEC " FILENAME " CMDLINE - call external programm FILENAME with parameter CMDLINE
-- EXECQ " FILENAME " CMDLINE - call without creating new console window (quiet)
-- MSDOS - call Command processor (not supported in Linux)
-- GOTO LABELNAME - jump to label LABELNAME in script (to the string " :LABELNAME " )
-- RETURN - break script, handle error according to device I/O params
-- RETRETRY - break script as Retry button pressed
-- RETIGNORE - break script as Ignore button pressed
-- RETABORT - break script as Abort button pressed
-- ADDLOG " FILENAME " LOGLINE - write LOGLINE to file FILENAME (LOGLINE may contain variables)
-- CANCELIO - Call CancelIO (WinNT+ only)
-- (available if a device is opened with " overlapped " option)
-- OVLRESLT N - Check Overlapped result (N=1 wait; 0:not wait) (WinNT+ only)
-- (must be used if a device is opened with " overlapped " option)
-- RESETHANDLE - Reopen disk (WinNT+ only)
-- ATARESET - DOS ATA only software reset
-- ATARESETDET - DOS ATA only software reset followed by ATA device detection
-- Script example:
IF %ERROR%=0 RETURN -- return if no error on last i/o
IF %ERROR%=128 GOTO LABEL1
IF %ERROR%=5 GOTO LABEL1
RETURN
:LABEL1
IF %CONFIRM%=0 RETRETRY -- retry if Cancel button is pressed
-- continue script execution if Confirm is pressed
EXECCMD /K ECHO error %ERROR% at LBA: %LBA% (%SECNUM%) try: %TRYNUM%. Type EXIT to return.
IF %TRYNUM% & lt; 2 RETRETRY
DELAY 500
ADDLOG " C:\ERRORS.LOG " error %ERROR% at LBA: %LBA:10% (%SECNUM%) try: %TRYNUM%
RETIGNORE
;DMDE Disk Editor Templates
[Test]
fuse:0
$i:=0
WHILE $i & lt; 5
$i:=$i+1
$j:=0
$x:=10
WHILE $j & lt; 5
$j:=$j+1
{4},x:$x,f:%u
$x:=$x+11
ENDWHILE
=
ENDWHILE
[MFT Record]
;remove guid not to use by default:
guid:{1df5ef71-7ae4-b176-c967-f94c63c5fb7a}
flow:1
CALCSIZESTART
$1:={0x1C,2}
IF $1 & lt; 1024
$1:=1024
ENDIF
$RECSIZE:=$1
CALCSIZEEND
LOADSTART
$fx_srcofs:={0x04,2}
$fx_count:={0x06,2}
IF ($fx_srcofs & gt; = 0x2A) AND ($fx_srcofs & lt; 0x1FE) AND ($fx_count & gt; 1)
$fx_dstofs:=0x1FE
IF {$fx_dstofs,2} = {$fx_srcofs,2}
WHILE ($fx_count & gt; 1) AND ($fx_dstofs + 2 & lt; = $RECSIZE)
$fx_srcofs:=$fx_srcofs+2
$fx_count:=$fx_count-1
{$fx_dstofs,2}:={$fx_srcofs,2}
$fx_dstofs:=$fx_dstofs+0x200
ENDWHILE
ENDIF
ENDIF
LOADEND
FLUSHSTART
$fx_srcofs:={0x04,2}
$fx_count:={0x06,2}
IF ($fx_srcofs & gt; = 0x2A) AND ($fx_srcofs & lt; 0x1FE) AND ($fx_count & gt; 1)
$fx_value:={$fx_srcofs,2}
$fx_dstofs:=0x1FE
WHILE ($fx_count & gt; 1) AND ($fx_dstofs + 2 & lt; = $RECSIZE)
$fx_srcofs:=$fx_srcofs+2
$fx_count:=$fx_count-1
{$fx_srcofs,2}:={$fx_dstofs,2}
{$fx_dstofs,2}:=$fx_value
$fx_dstofs:=$fx_dstofs+0x200
ENDWHILE
ENDIF
FLUSHEND
$OPENFILERECOFS:=0x00
$63:=TOGGLE:0,x:1
$10:=0 ;default color
IF {0x00,4}!=0x454c4946
$10:=8 ;error color
ENDIF
IF {0x16,2} & 1
$13:=0 ;default color
ELSE
$13:=10 ;grayed (removed)
ENDIF
x:5,c:$10,f:File
IF {0x04,2} & gt; =0x30
({0x2C,4}),x:10,f:#%u ========
ENDIF
({0x10,2}),x:22,f:(%u) ============
x:38,f:==================
IF $63
=
x:5,f:magic ( " FILE " ):
{0x00,4},x:32,c:$10,f:%4c
=
$10:=0
IF {0x04,2} & lt; 0x2A OR {0x04,2} & gt; =$RECSIZE
$10:=8
ENDIF
x:5,f:fixups offset:
{0x04,2},x:32,c:$10,f:%4X
x:36,f:h
=
$10:=$13
IF {0x06,2} & lt; 2
$10:=8
ENDIF
x:5,f:fixups count:
{0x06,2},x:32,f:%4u
=
x:5,f:LSNlo:
{0x08,4},x:28,f:%08X
x:36,f:h
=
x:5,f:LSNHi:
{0x0C,4},x:28,f:%08X
x:36,f:h
=
x:5,f:seq. number:
{0x10,2},x:32,f:%4u
=
x:5,f:hlink number:
{0x12,2},x:32,f:%4u
=
x:5,f:attrs offset:
{0x14,2},x:32,f:%4X
x:36,f:h
=
x:5,f:flags:
{0x16,2},x:32,f:%4X
x:36,f:h
=
x:5,f:used size:
{0x18,4},x:28,f:%8X
x:36,f:h
{0x18,4},x:38,f:%8u
=
x:5,f:record size:
{0x1C,4},x:28,f:%8X
x:36,f:h
{0x1C,4},x:38,f:%8u
=
x:5,f:basefileref:
{0x20,4},x:28,f:%8u
=
x:5,f:0x24:
{0x24,2},x:32,f:%4X
x:36,f:h
=
x:5,f:basefileref seq.:
{0x26,2},x:32,f:%4u
=
x:5,f:next attribute #:
{0x28,2},x:32,f:%4u
IF {0x04,2} & gt; =0x30
=
x:5,f:0x2A:
{0x2A,2},x:32,f:%4X
x:36,f:h
=
x:5,f:file #:
{0x2C,4},x:28,f:%8u
ENDIF
$3:={0x04,2} ;fixup offset
IF $3 & gt; =0x2A AND $3 & lt; 0x1FE
=
x:5,f:fixup:
{$3,2},x:32,f:%04X
x:36,f:h
ENDIF
ELSE
;if grayed
IF NOT $10 AND $13
$10:=$13
ENDIF
x:30,f: "
{0x00,4},x:32,c:$10,f:%4c
x:36,f: " =
ENDIF
;Attributes
$2:={0x14,2}
WHILE 1
=
$1:=$2
IF $1 & lt; 0x2A OR $1 & gt; =$RECSIZE
x:5,c:8,f:ERROR Attribute Offset
=
BREAK
ENDIF
$OFFSET:=$1
$9:={0x00,4}
IF $9!=0xFFFFFFFF
$63:=TOGGLE:$1,x:1
ELSE
{0x00,4},x:11,c:10,f:%8X
x:19,f:h
x:21,f:End Mark
BREAK
ENDIF
$OPENATTROFS:=$1
x:5,f:#
$3:={0x0E,2}
$3,x:6,f:%u
IF NOT $63
{0x00,4},x:11,c:$13,f:%8X
x:19,f:h
ENDIF
IF NOT $63 AND {0x09,1}
;Attr name
$3:={0x0A,2}
$4:={0x09,1} & lt; & lt; 1
x:21,f::
IF ($3 & lt; =0) OR ($3 & gt; ={0x04,4}) OR ($3 & gt; =$RECSIZE-$OFFSET)
x:22,c:8,f:ERROR Attrname Offset
ELSEIF ($4 & gt; 0)
{$3,$4},x:22,c:$13,f:U
ENDIF
=
ENDIF
IF $9=0x10
x:21,f:$STANDARD_INFORMATION
ELSEIF $9=0x20
x:21,f:$ATTRIBUTE_LIST
ELSEIF $9=0x30
x:21,f:$FILE_NAME
ELSEIF $9=0x50
x:21,f:$SECURITY_DESCRIPTOR
ELSEIF $9=0x60
x:21,f:$VOLUME_NAME
ELSEIF $9=0x70
x:21,f:$VOLUME_INFORMATION
ELSEIF $9=0x80
x:21,f:$DATA
ELSEIF $9=0x90
x:21,f:$INDEX_ROOT
ELSEIF $9=0xA0
x:21,f:$INDEX_ALLOCATION
ELSEIF $9=0xB0
x:21,f:$BITMAP
ELSEIF $9=0x100
x:21,f:$LOGGED_UTILITY_STREAM
ELSE
;$9,x:11,f:Attribute (%Xh)
x:21,f:Other Attribute
ENDIF
$10:=0 ;color
$2:={0x04,4}
$5:=$2 ;full attr length
IF $2 & lt; =0
$10:=8 ;error color
ELSE
$2:=$1+$2 ;next attribute offset
IF $2 & gt; $RECSIZE
$2:=$RECSIZE
$5:=$2-$1
$10:=8
ENDIF
ENDIF
IF $63
=
x:7,f:Attr. type:
{0x00,4},x:34,f:%8X
x:42,f:h
=
x:7,c:$10,f:Attr. length:
{0x04,4},x:34,c:$10,f:%8X
x:42,f:h
{0x04,4},x:44,c:$10,f:%10u
=
ELSEIF $10
=
x:7,c:$10,f:Attr. length:
{0x04,4},x:34,c:$10,f:%8X
x:42,f:h
=
ENDIF
IF $2 & lt; =0
=
BREAK
ENDIF
IF $63
x:7,f:Non-resident:
{0x08,1},x:39,f:%3u
=
x:7,f:Attrname len:
{0x09,1},x:39,f:%3u
=
x:7,f:Attrname ofs:
{0x0A,2},x:38,f:%4X
x:42,f:h
=
x:7,f:Flags:
{0x0C,2},x:38,f:%4X
x:42,f:h
{0x0C:0,2},x:45,f:F:C-+-
{0x0C:14,2},x:48,f:F:E-S-
=
x:7,f:Attr. number:
{0x0E,2},x:37,f:%5u
=
ENDIF
IF NOT {0x08,1}
;resident attribute
$10:=0 ;color for offset
$11:=0 ;color for size
$3:={0x14,2} ;data offset
$4:={0x10,4} ;data size
IF $3 & gt; $5
;$3 & gt; full attr length
$3:=$5
$4:=0
$10:=8
ENDIF
IF $3+$4 & gt; $5
$4:=$5-$3
$11:=8
ENDIF
IF NOT $63
IF {0x00,4}=0x80
;$DATA:
;if grayed
IF NOT $11 AND $13
$11:=$13
ENDIF
{0x10,4},x:32,c:$11,f:%u
=
ELSEIF $11
=
x:7,c:$11,f:Data Size:
{0x10,4},x:34,c:$11,f:%8X
x:42,f:h
=
ENDIF
IF $10
=
x:7,c:$10,f:Data Offset:
{0x14,2},x:38,c:$10,f:%4X
x:42,f:h
=
ENDIF
ELSE
x:7,c:$11,f:Data Size:
{0x10,4},x:34,c:$11,f:%8X
x:42,f:h
{0x10,4},x:44,c:$11,f:%10u
=
x:7,c:$10,f:Data Offset:
{0x14,2},x:38,c:$10,f:%4X
x:42,f:h
=
$9:={0x09,1} & lt; & lt; 1
IF $9
x:7,f:Attr. name:
$8:={0x0A,2}
IF ($8 & lt; =0) OR ($8 & gt; ={0x04,4}) OR ($8 & gt; =$RECSIZE-$OFFSET)
x:32,c:8,f:ERROR Attrname Offset
ELSE
{$8,$9},x:32,f:U
ENDIF
=
ENDIF
ENDIF
$NEXTOFS:=$3
IF {0x00,4}=0x10
;standard information
IF NOT $63
$NEXTOFS:=$NEXTOFS+8
$4:=$4-8
{8},x:43,c:$13,f:FILETIME
=
ELSE
x:14,f:created:
{8},x:32,f:FILETIME
=
x:14,f:modified:
{8},x:32,f:FILETIME
=
x:14,f:changed:
{8},x:32,f:FILETIME
=
x:14,f:accessed:
{8},x:32,f:FILETIME
=
x:14,f:attrs:
{2},x:32,f:F:R-H-S-V-D-A-d-n-t-s-r-c-o-i-e-+-
{2},x:49,f:F:+-+-+-+-+-+-+-+-+-+-+-+-D-I-+-+-
=
$4:=$4 - ($NEXTOFS - $3)
$3:=$NEXTOFS
IF $4 & gt; =12
x:14,f:Max versions:
{4},x:32,f:%u
=
x:14,f:Version:
{4},x:32,f:%u
=
x:14,f:Class Id:
{4},x:32,f:%u
=
$4:=$4 - ($NEXTOFS - $3)
$3:=$NEXTOFS
IF $4 & gt; =24
x:14,f:Owner Id:
{4},x:32,f:%u
=
x:14,f:Security Id:
{4},x:32,f:%u
=
x:14,f:Quota Charged:
{8},x:32,f:%u
=
x:14,f:USN:
{8},x:32,f:%u
=
ENDIF
ENDIF
ENDIF
$4:=$4 - ($NEXTOFS - $3)
$3:=$NEXTOFS
ELSEIF {0x00,4}=0x20
;attribute list
IF $63
x:1,f:attr.type len n.len n.ofs vcn MFT (#) attr# name
=
$8:=$OFFSET
$OFFSET:=$OFFSET+$3
WHILE $4 & gt; 0
IF {0x04,2}
$OPENFILENUM:={0x10,4}
{0x00,4},x:1,f:%8X
x:9,f:h
ENDIF
$9:={0x04,2},x:11,f:%u
IF NOT $9
BREAK
ENDIF
{0x06,1},x:16,f:%u
$7:={0x07,1},x:21,f:%3X
x:24,f:h
{0x08,8},x:27,f:%d
{0x10,6},x:45,f:%u
{0x16,2},x:55,f:%u
{0x18,2},x:60,f:%u
$6:={0x06,1} & lt; & lt; 1
IF $6
{$7,$6},x:66,f:U
ENDIF
=
IF $9 & gt; $4
$9:=$4
ENDIF
IF NOT $9
BREAK
ENDIF
$OFFSET:=$OFFSET+$9
$3:=$3+$9
$4:=$4-$9
ENDWHILE
$OFFSET:=$8
ENDIF
ELSEIF {0x00,4}=0x30
;file name
$OPENFILENUM:={$3,4}
IF $63
x:14,f:directory:
{6},x:32,f:%u
x:44,f:(
{2},x:45,f:%u
x:50,f:)
=
x:14,f:created:
{8},x:32,f:FILETIME
=
x:14,f:modified:
{8},x:32,f:FILETIME
=
x:14,f:changed:
{8},x:32,f:FILETIME
=
x:14,f:accessed:
{8},x:32,f:FILETIME
=
x:14,f:allocated:
{8},x:32,f:%u
=
x:14,f:size:
{8},x:32,f:%u
=
x:14,f:attrs:
{2},x:32,f:F:R-H-S-V-D-A-d-n-t-s-r-c-o-i-e-+-
{2},x:49,f:F:+-+-+-+-+-+-+-+-+-+-+-+-D-I-+-+-
=
x:14,f:reparse:
{4},x:32,f:%u
=
x:14,f:name len:
{1},x:32,f:%u
=
x:14,f:posix:
{1},x:32,f:%u
=
x:14,f:name:
ELSE
$NEXTOFS:=$NEXTOFS+0x42
ENDIF
$9:={$3+0x40,1} & lt; & lt; 1
IF $9
{$9},x:32,c:$13,f:U
ENDIF
=
$4:=$4 - ($NEXTOFS - $3)
$3:=$NEXTOFS
ELSEIF {0x00,4}=0x60
=
x:14,f:Volume Name:
{$3,$4},x:32,c:$13,f:U
=
$3:=$3+$4
$4:=0
ELSEIF $63 AND {0x00,4}=0x90 AND {$3,4}=0x30 AND $4 & gt; 0x20
;INDX ROOT
;IF {0x10,2}=0x10
$8:=$OFFSET ;store
$OFFSET:=$OFFSET+$3+0x20
$3:=$3+0x20
$4:=$4-0x20
$10:=0 ;color
$12:=0 ;END MARK
$9:=0 ;entry size
WHILE $4 & gt; =0x10
IF $9
IF $9 & gt; =$4
$9:=$4
$3:=$3+$9
$4:=0
BREAK
ENDIF
$3:=$3+$9
$4:=$4-$9
$OFFSET:=$OFFSET+$9
ENDIF
$9:={0x08,2} ;entry size
IF $9 & 7 OR $9 & lt; 0x10
$9:=8
CONTINUE
ENDIF
IF $9 & gt; $4
$9:=$4
ENDIF
IF NOT {0x0C:1,1} AND $9 & lt; 0x54
$9:=8
CONTINUE
ENDIF
IF NOT {0x0C:1,1} OR NOT $12
IF {0x00,4}
;MFT num:
$OPENFILENUM:={0x00,4}
ENDIF
{0x00,6},x:1,c:$10,f:%u
;MFT seq num
x:11,f:(
{0x06,2},x:12,c:$10,f:%u
x:17,f:)
ENDIF
IF {0x0C:1,1}
;last entry
IF NOT $12
$12:=1
x:19,f:END MARK
=
ENDIF
BREAK
$10:=10 ;grayed
$7:=8
IF {0x0C:0,1}
$7:=$7+8
ENDIF
IF $9!=$7
$9:=8
ENDIF
CONTINUE
ENDIF
;{0x0A,2} orig nameattr size
;{0x0C,1} UINT8 flags:
; & 0x02 last entry
; & 0x01: {entry_size-8,8} - & gt; next sort vcn
;{0x0D,1} !=0 - D
;{0x0E,2} !=0 - U
;{0x10,original nameattr size} = name.data
;dir MFT num:
{0x10,6},x:19,c:10,f:%u
;dir MFT seq num
x:29,f:(
{0x16,2},x:30,c:10,f:%u
x:35,f:)
;creation time:
{0x18,8},x:37,w:10,c:10,f:FILETIME
;last modification time:
{0x20,8},x:48,w:10,c:10,f:FILETIME
;last change time:
{0x28,8},x:59,w:10,c:10,f:FILETIME
;access time:
{0x30,8},x:70,w:10,c:10,f:FILETIME
=
$OPENFILENUM:={0x00,4}
;allocated size:
{0x38,8},x:3,c:10,f:%u
;size:
{0x40,8},x:23,c:$10,f:%u
;{0x48,4}: file attributes
;namelen in bytes:
$7:={0x50,1} & lt; & lt; 1
;{0x51,1}: ngt
;name:
{0x52,$7},x:42,c:$10,f:U
=
$7:=(0x59+$7) & 0xFFFFFFF8
$11:=$7+8
IF {0x0C:0,1}
;sub nodes
$7:=$11
ENDIF
IF $7!=$9 AND $11!=$9
$9:=8
ENDIF
ENDWHILE
$OFFSET:=$8 ;restore
ENDIF
;$OFFSET = attr offset
;$3 = offset (relative to $OFFSET)
;$4 = rest data size
;$5 = full attr length
IF $3 & lt; $5
;hex output
IF $63
x:7,f:Hex:
=
$6:=$3
$7:=0
$9:=$3-{0x14,2}
$12:=12
$14:=61
;$6 = line start offset
;$7 = count of bytes per line for text
;$9 = offset relative to data start
;$10 = color
;$12 = screen position for hex output
;$14 = screen position for text output
$9,x:7,f:%03x:
WHILE 1
$10:=0
IF $4 & lt; =0
$10:=10 ;grayed
ENDIF
{$3,1},x:$12,c:$10,f:%cX
$3:=$3+1
IF $4
$4:=$4-1
$7:=$7+1
ENDIF
$12:=$12+3
$9:=$9+1
IF $12 & gt; 57 OR $3 & gt; =$5
{$6,$7},x:$14,f:T
$6:=$3
$7:=0
ENDIF
IF $3 & gt; =$5
BREAK
ENDIF
IF $12 & gt; 57
=
$12:=12
$7:=0
$14:=61
$9,x:7,f:%03x:
ENDIF
ENDWHILE
=
ENDIF
=
ENDIF
ELSE
;non-resident attribute
IF NOT $63
IF {0x00,4}=0x80
;$DATA
{0x30,8},x:32,c:$13,f:%u
=
ENDIF
ELSE
$NEXTOFS:=0x10
x:12,f:start vcn:
{8},x:22,f:%20d
=
x:12,f:end vcn:
{8},x:22,f:%20d
=
x:12,f:runs offset:
{2},x:38,f:%4X
x:42,f:h
=
x:12,f:clogblk:
{2},x:37,f:%5u
=
x:12,f:0x24:
{4},x:34,f:%08X
x:42,f:h
=
x:12,f:allocated:
{8},x:22,f:%20u
=
x:12,f:size:
{8},x:22,f:%20u
=
x:12,f:initializ:
{8},x:22,f:%20u
=
IF {0x20,2} & gt; =0x48 AND (NOT {0x09,1} OR {0x0A,2} & gt; =0x48)
x:12,f:compress:
{8},x:22,f:%20u
=
ENDIF
$3:={0x0A,2}
$4:={0x09,1} & lt; & lt; 1
IF $4
x:7,f:Attrname:
{$3,$4},x:32,f:U
=
ENDIF
;runlist:
$3:=$1+{0x20,2}
$cluster:=0
$vcn:=0
WHILE $3 & lt; $2
$OFFSET:=$3
$vcn,x:1,f:%10d
x:12,f:run:
{0x00,1},x:17,f:%02X
x:19,f:h
IF NOT {0x00,1}
BREAK
ENDIF
$4:={0:0,4}
x:21,f:len:
{1,$4},x:26,f:%16d
$vcn:=$vcn+{1,$4}
$4:=$4+1
$9:={0:4,4}
x:43,f:relc:
IF NOT $9
x:49,f:-
ELSE
;relative cluster value:
$7:={$4,$9},x:49,f:%13X
x:62,f:h
;convert to signed value:
IF {$4+$9-1,1} & 0x80
$7:=$7-(1 & lt; & lt; ($9*8))
ENDIF
$cluster:=$cluster+$7
$cluster,x:64,f::%d
ENDIF
=
$3:=$3+$4+$9
ENDWHILE
ENDIF
ENDIF
ENDWHILE
[NTFS Attribute List]
;uncomment guid to use by default:
guid:{27731dac-f9ab-8526-2ea2-55622acbbe12}
h: attr.type len n.len n.ofs vcn MFT (#) attr# name
WHILE $OFFSET & lt; $RECSIZE
$NEXTOFS:=0
{4},x:1,f:%8X
x:9,f:h
$2:={2},x:11,f:%u
IF NOT $2
BREAK
ENDIF
$3:={$NEXTOFS,1} & lt; & lt; 1
{1},x:16,f:%u
$4:={1},x:21,f:%3X
x:24,f:h
{8},x:27,f:%d
$OPENFILENUM:={0x10,4}
{6},x:45,f:%u
{2},x:55,f:%u
{2},x:60,f:%u
IF $3
{$4,$3},x:66,f:U
ENDIF
=
IF $2 & lt; =0
BREAK
ENDIF
$OFFSET:=$OFFSET+$2
ENDWHILE
[NTFS Dir Entries]
;uncomment guid to use by default:
guid:{451037af-3415-2b8f-a8e9-b3b9d72cd284}
flow:1
h: MFT No Size Name
CALCSIZESTART
$1:=$RECSIZE
; " INDX " header:
IF {0x00,4}=0x58444E49
$1:=0x18+{0x20,2}
IF $1 & lt; 512
$1:=512
ENDIF
ENDIF
$RECSIZE:=$1
CALCSIZEEND
LOADSTART
IF {0x00,4}=0x58444E49
$1:={0x04,2} ;fixups offset
IF $1 & lt; 0x28 OR $1 & gt; =$RECSIZE
GOTO:1
ENDIF
$2:={0x06,2} ;fixups count
IF $2 & lt; =1
GOTO:1
ENDIF
$3:=0x1FE ;seq. offset
IF {$3,2}={$1,2} ;insert fixups
$1:=$1+2
WHILE 1
$2:=$2-1
{$3,2}:={$1,2}
$1:=$1+2
$3:=$3+0x200
IF NOT $2 OR $3 & gt; =$RECSIZE
BREAK
ENDIF
ENDWHILE
ENDIF
LABEL:1
ENDIF
LOADEND
FLUSHSTART
IF {0x00,4}=0x58444E49
$1:={0x04,2}
IF $1 & lt; 0x28 OR $1 & gt; =$RECSIZE
GOTO:1
ENDIF
$2:={0x06,2}
IF $2 & lt; =1
GOTO:1
ENDIF
$3:=0x1FE
$4:={$1,2}
$1:=$1+2
$2:=$2-1
WHILE 1
{$1,2}:={$3,2}
{$3,2}:=$4
$1:=$1+2
$2:=$2-1
$3:=$3+0x200
IF NOT $2 OR $3 & gt; =$RECSIZE
BREAK
ENDIF
ENDWHILE
LABEL:1
ENDIF
FLUSHEND
$10:=0 ;color
IF {0x00,4}=0x58444E49
$63:=TOGGLE:$OFFSET,x:1
x:5,c:$10,f:magic ( " INDX " ):
{0x00,4},x:22,f:%4c
IF NOT $63
x:30,c:$10,f:vcn:
{0x10,8},x:35,f:%d
ELSE
=
x:5,f:fixups offset:
{0x04,2},x:32,c:$10,f:%4X
x:36,f:h
=
x:5,f:fixups count:
{0x06,2},x:32,f:%4u
=
x:5,f:LSNlo:
{0x08,4},x:28,f:%08X
x:36,f:h
=
x:5,f:LSNHi:
{0x0C,4},x:28,f:%08X
x:36,f:h
=
x:5,c:$10,f:vcn:
{0x10,8},x:22,f:%d
=
x:5,c:$10,f:items offset:
{0x18,2},x:22,f:%u
=
x:5,c:$10,f:usedsize:
{0x1C,4},x:22,f:%u
=
x:5,c:$10,f:recordsize:
{0x20,4},x:22,f:%u
ENDIF
=
$OFFSET:=0x18+{0x18,2}
ELSEIF {0x00,4}=0x30 AND {0x10,2}=0x10
$OFFSET:=0x20
ENDIF
$4:=$RECSIZE - $OFFSET
$12:=0
$9:=0 ;entry size
WHILE 1
IF $9
IF $9 & gt; =$4
$9:=$4
$3:=$3+$9
$4:=0
BREAK
ENDIF
$3:=$3+$9
$4:=$4-$9
$OFFSET:=$OFFSET+$9
ENDIF
IF $4 & lt; 0x10
BREAK
ENDIF
$9:={0x08,2} ;entry size
IF $9 & 7 OR $9 & lt; 0x10
$9:=8
CONTINUE
ENDIF
IF $9 & gt; $4
IF $12
$9:=8
CONTINUE
ENDIF
$9:=$4
ENDIF
IF $12 AND ({0x0C:1,1} OR $9 & lt; 0x54 OR {0x0A,2} & lt; 0x42 OR {0x0A,2} & gt; $9)
$9:=8
CONTINUE
ENDIF
$63:=TOGGLE:$OFFSET,x:1
IF NOT {0x0C:1,1} OR NOT $12
IF {0x00,8}
;MFT num:
$OPENFILENUM:={0x00,4}
x:4,f: & gt;
ENDIF
IF {0x04,2}
x:4,f:x
{0x00,6},x:5,c:$10,f:%X
ELSE
{0x00,4},x:5,c:$10,f:%u
ENDIF
;MFT seq num
x:15,f:(
{0x06,2},x:16,c:$10,f:%u
x:21,f:)
ENDIF
IF $63
=
x:5,f:Entry Size:
{0x08,2},x:24,c:$10,f:%u
=
x:5,f:Attr. Size:
{0x0A,2},x:24,c:$10,f:%u
=
x:5,f:Flags:
{0x0C,4},x:24,c:$10,f:%X
;{0x0C,1} flags:
; & 0x02 last entry
; & 0x01: {entry_size-8,8} - & gt; next sort vcn
;{0x0D,1} !=0 - D
;{0x0E,2} !=0 - U
=
ENDIF
IF {0x0C:1,1}
$12:=1
x:24,f:END MARK
=
;BREAK
$7:=0x10
IF {0x0C:0,1}
IF $63
;sub nodes
x:5,f:Subnode VCN:
{$7,8},x:24,c:$10,f:%d
=
ENDIF
$7:=$7+8
ENDIF
IF $9!=$7
$9:=8
ENDIF
$10:=10 ;grayed
CONTINUE
ENDIF
;IF ($9 & lt; 0x54 OR {0x0A,2} & lt; 0x42 OR {0x0A,2} & gt; $9)
; $9:=8
; =
; CONTINUE
;ENDIF
IF $63
$OPENFILENUM:={0x10,4}
x:5,f:Dir MFT Num: & gt;
IF {0x14,2}
x:23,f:x
{0x10,6},x:24,c:$10,f:%X
ELSE
{0x10,4},x:24,c:$10,f:%u
ENDIF
x:35,f:(
{0x16,2},x:36,c:$10,f:%u
x:41,f:)
=
x:5,f:Creation Time:
{0x18,8},x:24,c:$10,f:FILETIME
=
x:5,f:Modification Time:
{0x20,8},x:24,c:$10,f:FILETIME
=
x:5,f:Change Time:
{0x28,8},x:24,c:$10,f:FILETIME
=
x:5,f:Access Time:
{0x30,8},x:24,c:$10,f:FILETIME
=
x:5,f:Allocated Size:
{0x38,8},x:24,c:$10,f:%u
=
x:5,f:Size:
{0x40,8},x:24,c:$10,f:%u
=
x:5,f:Attributes:
{0x48,4},x:24,c:$10,f:%X
=
x:5,f:Name Length:
{0x50,1},x:24,c:$10,f:%u
=
x:5,f:Name POSIX:
{0x51,1},x:24,c:$10,f:%u
=
$7:={0x50,1} & lt; & lt; 1
x:5,f:Name:
{0x52,$7},x:24,c:$10,f:U
ELSE
IF {0x48,4} & 0x10000000
x:24,f:[dir]
ELSE
;size:
{0x40,8},x:24,c:$10,f:%u
ENDIF
;namelen in bytes:
$7:={0x50,1} & lt; & lt; 1
;{0x51,1}: ngt
;name:
{0x52,$7},x:42,c:$10,f:U
ENDIF
=
$7:=(0x59+$7) & 0xFFFFFFF8
$11:=$7+8
IF {0x0C:0,1}
IF $63
;sub nodes
x:5,f:Subnode VCN:
{$7,8},x:24,c:$10,f:%d
=
ENDIF
$7:=$11
ENDIF
IF $7!=$9 AND $11!=$9
$9:=8
ENDIF
ENDWHILE
[extFS Superblock]
guid:{e753e591-7808-eb38-a7d0-42cace180382}
o:1
$RECSIZE:=1024
x:1,f:s_inodes_count
{4},x:25,f:%u
=
x:1,f:s_blocks_count_lo
{4},x:25,f:%u
=
x:1,f:s_r_blocks_count_lo
{4},x:25,f:%u
=
x:1,f:s_free_blocks_count_lo
{4},x:25,f:%u
=
x:1,f:s_free_inodes_count
{4},x:25,f:%u
=
x:1,f:s_first_data_block
{4},x:25,f:%u
=
x:1,f:s_log_block_size
{4},x:25,f:%u
=
x:1,f:s_log_cluster_size
{4},x:25,f:%u
=
x:1,f:s_blocks_per_group
{4},x:25,f:%u
;=
;x:1,f:s_obso_frags_per_group
;{0x24,4},x:25,f:%u
$NEXTOFS:=$NEXTOFS+4
=
x:1,f:s_inodes_per_group
{4},x:25,f:%u
=
x:1,f:s_mtime
{4},x:25,f:UNIXDATE
=
x:1,f:s_wtime
{4},x:25,f:UNIXDATE
=
x:1,f:s_mnt_count
{2},x:25,f:%u
=
x:1,f:s_max_mnt_count
{2},x:25,f:%u
=
x:1,f:s_magic (53EF)
{2},x:25,f:%2cX
=
x:1,f:s_state
{2},x:25,f:%u
=
x:1,f:s_errors
{2},x:25,f:%u
=
x:1,f:s_minor_rev_level
{2},x:25,f:%u
=
x:1,f:s_lastcheck
{4},x:25,f:UNIXDATE
=
x:1,f:s_checkinterval
{4},x:25,f:%u
=
x:1,f:s_creator_os
{4},x:25,f:%u
=
$revision:={$NEXTOFS,4}
x:1,f:s_rev_level
{4},x:25,f:%u
=
;{0x50,2}s_def_resuid
;{0x52,2}s_def_resgid
$NEXTOFS:=$NEXTOFS+4
IF $revision
;revision & gt; 0
x:1,f:s_first_ino
{4},x:25,f:%u
=
x:1,f:s_inode_size
{2},x:25,f:%u
=
x:1,f:s_block_group_nr#
{2},x:25,f:%u
=
x:1,f:s_feature_compat
{4},x:25,f:%X
x:33,f:h
;0x1 Directory prealloc
;0x2 " imagic inodes "
;0x4 journal
;0x8 extended attributes
;0x10 reserved GDT blocks for filesystem expansion
;0x20 directory indices
;0x40 " Lazy BG "
;0x80 " Exclude inode "
=
x:1,f:s_feature_incompat
{4},x:25,f:%X
x:33,f:h
;0x1 Compression.
;0x2 Directory entries record the file type
;0x4 FS needs recovery
;0x8 FS has a separate journal device
;0x10 Meta block groups
;0x40 file extents
;0x80 2^64 blocks
;0x200 Flexible block groups
;0x400 Inodes for large extended attributes
;0x1000 Data in directory entry
=
x:1,f:s_feature_ro_compat
{4},x:25,f:%X
x:33,f:h
;0x1 Sparse superblocks.
;0x2 files greater than 2GiB.
;0x8 file sizes are in blocks, not 512-byte sectors
;0x10 Group descriptor checksums
;0x20 no 32,000 subdirectory limit
;0x40 large inodes
;0x80 FS has a snapshot.
=
x:1,f:s_uuid
{4},x:25,f:%08X
x:33,f:-
{2},x:34,f:%04X
x:38,f:-
{2},x:39,f:%04X
x:43,f:-
{2},x:44,f:%.2cX
x:48,f:-
{6},x:49,f:%.6cX
;UUID of the volume
=
x:1,f:s_volume_name "
{16},x:25,f:u
x:41,f: "
=
;{0x88,64}s_last_mounted:%64c
$NEXTOFS:=$NEXTOFS+64
=
x:1,f:s_algorithm_usage_bitmap
{4},x:25,f:%u
;compression
=
; {0xCC,1}s_prealloc_blocks
; {0xCD,1}s_prealloc_dir_blocks
; {0xCE,2}s_reserved_gdt_blocks
$NEXTOFS:=$NEXTOFS+4
IF {0x5C:2,1}
;has journal
x:1,f:s_journal_uuid
{4},x:25,f:%08X
x:33,f:-
{2},x:34,f:%04X
x:38,f:-
{2},x:39,f:%04X
x:43,f:-
{2},x:44,f:%.2cX
x:48,f:-
{6},x:49,f:%.6cX
=
x:1,f:s_journal_inum
{4},x:25,f:%u
=
x:1,f:s_journal_dev
{4},x:25,f:%u
=
ENDIF
;x:1,f:s_last_orphan
;{4},x:25,f:%u
; =
; {0xEC,16}s_hash_seed
; {0xFC,1}s_def_hash_version
; {0xFD,1}s_jnl_backup_type {?}
;=
$NEXTOFS:=$NEXTOFS+22
x:1,f:s_desc_size
{2},x:25,f:%u
=
; {0x100,4}s_default_mount_opts
;=
$NEXTOFS:=$NEXTOFS+4
x:1,f:s_first_meta_bg
{4},x:25,f:%u
=
x:1,f:s_mkfs_time
{4},x:25,f:UNIXDATE
; {0x10C,68}s_jnl_blocks 4x17
;=
$NEXTOFS:=$NEXTOFS+68
;64bit support valid if EXT4_FEATURE_COMPAT_64BIT
x:1,f:s_blocks_count_hi
{4},x:25,f:%X
x:33,f:h
=
x:1,f:s_r_blocks_count_hi
{4},x:25,f:%X
x:33,f:h
=
x:1,f:s_free_blocks_count_hi
{4},x:25,f:%X
x:33,f:h
=
x:1,f:s_min_extra_isize
{2},x:25,f:%u
=
x:1,f:s_want_extra_isize
{2},x:25,f:%u
=
x:1,f:s_flags
{4},x:25,f:%X
x:33,f:h
;0x0001 Signed directory hash in use.
;0x0002 Unsigned directory hash in use.
;0x0004 To test development code.
=
x:1,f:s_raid_stride
{2},x:25,f:%u
=
x:1,f:s_mmp_interval
{2},x:25,f:%u
=
x:1,f:s_mmp_block
{2},x:25,f:%u
=
x:1,f:s_raid_stripe_width
{4},x:25,f:%u
=
x:1,f:s_log_groups_per_flex
{1},x:25,f:%u
=
;0x175 __u8 s_reserved_char_pad
;0x176 __le16 s_reserved_pad
;=
$NEXTOFS:=$NEXTOFS+3
x:1,f:s_kbytes_written
{8},x:25,f:%u
=
;0x180 __le32 s_snapshot_inum
;0x184 __le32 s_snapshot_id
;0x188 __le64 s_snapshot_r_blocks_count
;0x190 __le32 s_snapshot_list
;0x194 __le32 s_error_count
;0x198 __le32 s_first_error_time
;0x19C __le32 s_first_error_ino
;0x1A0 __le64 s_first_error_block
;0x1A8 __u8 s_first_error_func[32]
;0x1C8 __le32 s_first_error_line
;0x1CC __le32 s_last_error_time
;0x1D0 __le32 s_last_error_ino
;0x1D4 __le32 s_last_error_line
;0x1D8 __le64 s_last_error_block
;0x1E0 __u8 s_last_error_func[32]
;0x200 __u8 s_mount_opts[64]
;0x240 __le32 s_reserved[108]
=
x:1,f:s_checksum
{0x3FC,4},x:25,f:%08X
x:33,f:h
ENDIF
[extFS Group Descriptors x32]
guid:{f377e6df-e06c-7909-922e-90d58c09259d}
flow:1
h: blk_bitmap ino_bitmap ino_table freblk frino usedir flag nusei csum
WHILE $OFFSET+32 & lt; =$RECSIZE
{0x0,4},x:1,f:%10u
{0x4,4},x:12,f:%10u
{0x8,4},x:23,f:%10u
{0xC,2},x:34,f:%5u
{0xE,2},x:40,f:%5u
{0x10,2},x:46,f:%5u
{0x12,2},x:52,f:%4X
x:56,f:h
;{0x14,4},x:58,f:%10u
;{0x18,2},x:58,f:%4X
;x:62,f:h
;{0x1A,2},x:64,f:%4X
;x:68,f:h
{0x1C,2},x:58,f:%5u
{0x1E,2},x:64,f:%4X
x:68,f:h
=
$OFFSET:=$OFFSET+32
ENDWHILE
[extFS Group Descriptors x64]
guid:{d3f3136d-fe00-3ffd-5cfb-eef922c334a3}
flow:1
h: blk_bitmap ino_bitmap ino_table freeblk freeino usedir unuse flags chksum
IF $1 & lt; =0
;desriptor size not given
$1:=64
ENDIF
WHILE $OFFSET+$1 & lt; =$RECSIZE
{0x0,4;0x20,4},x:0,f:%18u
{0x4,4;0x24,4},x:18,f:%18u
{0x8,4;0x28,4},x:36,f:%18u
{0xC,2;0x2C,2},x:54,f:%9u
{0xE,2;0x2E,2},x:63,f:%9u
{0x10,2;0x30,2},x:72,f:%9u
{0x1C,2;0x32,2},x:81,f:%9u
{0x12,2},x:91,f:%4X
x:95,f:h
{0x1E,2},x:97,f:%4X
=
$OFFSET:=$OFFSET+$1
ENDWHILE
[extFS Inodes Entries]
guid:{e39b26a7-c80d-8db3-adac-4251831fd053}
flow:1
IF $1 & lt; =0
;inode size not given
$1:=128
ENDIF
;$64=inode number (if given)
WHILE $OFFSET+$1 & lt; =$RECSIZE
$OPENFILERECOFS:=$OFFSET
$63:=TOGGLE:$OFFSET,x:1
x:5,f:Inode ====== #
$64,x:19,f:%u =======
$OFFSET,x:29,f:(+%u) =====
x:39,f:====================
IF $64 & gt; 0
$64:=$64+1
ENDIF
=
$OPENFILERECOFS:=$OFFSET
x:5,f:i_mode:
{0x0,2},x:19,f:%X
x:23,f:h:
$mode:={0x0:12,4}
IF $mode=0x1
x:25,f:FIFO
ELSEIF $mode=0x2
x:25,f:CHR
ELSEIF $mode=0x4
x:25,f:DIR
ELSEIF $mode=0x6
x:25,f:BLK
ELSEIF $mode=0x8
x:25,f:FILE
ELSEIF $mode=0xA
x:25,f:LINK
ELSEIF $mode=0xC
x:25,f:SOCK
ENDIF
x:30,f:Oth:
{0x0:0,3},x:34,f:F:X-W-R-
x:38,f:Grp:
{0x0:3,3},x:42,f:F:X-W-R-
x:46,f:Own:
{0x0:6,3},x:50,f:F:X-W-R-
x:54,f:StB:
{0x0:9,1},x:58,f:F:+-
x:60,f:Gid:
{0x0:10,1},x:64,f:F:+-
x:66,f:Uid:
{0x0:11,1},x:70,f:F:+-
=
IF $63
x:5,f:i_uid:
{0x2,2},x:19,f:%u
=
ENDIF
x:5,f:i_size_lo:
{0x4,4},x:19,f:%u
=
IF $63
x:5,f:i_atime:
{0x8,4},x:19,f:UNIXDATE
=
x:5,f:i_ctime:
{0xC,4},x:19,f:UNIXDATE
=
ENDIF
x:5,f:i_mtime:
{0x10,4},x:19,f:UNIXDATE
=
IF $63
x:5,f:i_dtime:
{0x14,4},x:19,f:UNIXDATE
=
x:5,f:i_gid:
{0x18,2},x:19,f:%u
=
x:5,f:i_links_count:
{0x1A,2},x:19,f:%u
=
x:5,f:i_blocks_lo:
{0x1C,4},x:19,f:%u
=
x:5,f:i_flags:
{0x20,4},x:19,f:%08X
x:27,f:h
IF {0x21:4,1}
x:30,f:INDEX
ENDIF
IF {0x21:5,1}
x:36,f:IMAGIC
ENDIF
IF {0x22:1,1}
x:43,f:TOPDIR
ENDIF
IF {0x22:2,1}
x:50,f:HUGE
ENDIF
IF {0x22:3,1}
x:55,f:EXTENT
ENDIF
IF {0x22:5,1}
x:62,f:EA
ENDIF
IF {0x23:4,1}
x:63,f:INLINE
ENDIF
;0x20 EXT4_APPEND_FL
;0x1000 EXT4_INDEX_FL
;0x2000 EXT4_IMAGIC_FL
;0x4000 EXT4_JOURNAL_DATA_F
;0x20000 EXT4_TOPDIR_FL
;0x40000 EXT4_HUGE_FILE_FL
;0x80000 EXT4_EXTENTS_FL
;0x200000 EXT4_EA_INODE_FL
;0x10000000 EXT4_INLINE_DATA_FL
=
x:5,f:l_i_version:
{0x24,4},x:19,f:%u
=
$3:=1
;extents
IF {0x22:3,1}
;extents header
$4:=$OFFSET+0x28
;save offset:
$2:=$OFFSET
$OFFSET:=$4
x:2,f:eh_magic (F30A):
{0x00,2},x:19,f:%04X
x:23,f:h
=
x:2,f:eh_entries:
{0x02,2},x:19,f:%u
=
x:2,f:eh_max:
{0x04,2},x:19,f:%u
=
x:2,f:eh_depth:
{0x06,2},x:19,f:%u
=
x:2,f:eh_generation:
{0x08,4},x:19,f:%X
x:27,f:h
=
;extents:
$3:={0x06,2}
$4:=$4+0x0C
$5:={0x02,2}
IF $5 & gt; 4
$5:=4
ENDIF
WHILE $5 & gt; 0
$OFFSET:=$4
IF NOT $3
;extent
x:3,f:ee_block:
{0x00,4},x:19,f:%u
x:30,f:ee_len:
{0x04,2},x:41,f:%u
$OPENCLUSTER:={0x08,4;0x06,2}
x:49,f:ee_start:
{0x08,4;0x06,2},x:60,f:%u
=
ELSE
;inode
x:3,f:ei_block:
{0x00,4},x:19,f:%u
$OPENTEMPLATE:='{30747da5-cdcb-b665-e094-12c9cdf32a26}'
$OPENCLUSTER:={0x04,4;0x08,2}
x:30,f:ei_leaf:
{0x04,4;0x08,2},x:41,f:%u
=
ENDIF
$4:=$4+12
$5:=$5-1
ENDWHILE
$OFFSET:=$2 ;restore offset
$3:=0 ;no blocks
ENDIF
IF $3
IF {0x0:12,4}=0xA
;link
IF {0x4,4} & lt; =60
;no blocks
$3:=0
ENDIF
ENDIF
IF {0x23:4,1}
;inline data
$3:=0
ENDIF
IF NOT $3
;inline data
$4:={0x4,4}
IF $4 & gt; 60
$4:=60
ENDIF
IF $4 & gt; 0
x:5,f:i_block:
IF {0x0:12,4}=0xA
;link
{0x28,$4},x:19,f:C
ELSE
;data
{0x28,$4},x:19,f:T
ENDIF
=
ENDIF
ENDIF
ENDIF
IF $3
;blocks:
$NEXTOFS:=0x28
$OPENCLUSTER:={0x28,4}
x:5,f:i_block:
$i:=0
WHILE $i & lt; 3
$i:=$i+1
$j:=0
$x:=19
WHILE $j & lt; 5
$j:=$j+1
{4},x:$x,f:%u
$x:=$x+11
ENDWHILE
=
ENDWHILE
ENDIF
=
x:5,f:i_generation:
{0x64,4},x:19,f:%u
=
x:5,f:i_file_acl_lo:
{0x68,4},x:19,f:%u
=
ENDIF
x:5,f:i_size_high:
{0x6C,4},x:19,f:%X
x:27,f:h
=
IF $63
;0x70 __le32 i_obso_faddr
;=
;0x0 __le16 l_i_blocks_high
x:5,f:l_i_blocks_hi:
{0x74,2},x:19,f:%X
x:23,f:h
=
;0x2 __le16 l_i_file_acl_high
x:5,f:l_i_file_aclh:
{0x76,2},x:19,f:%X
x:23,f:h
=
;0x4 __le16 l_i_uid_high
x:5,f:l_i_uid_high:
{0x78,2},x:19,f:%X
x:23,f:h
=
;0x6 __le16 l_i_gid_high
x:5,f:l_i_gid_high:
{0x7A,2},x:19,f:%X
x:23,f:h
=
;0x8 __le16 l_i_checksum_lo
x:5,f:l_i_checksuml:
{0x7C,2},x:19,f:%X
x:23,f:h
=
;0xA __le16 l_i_reserved
x:5,f:l_i_reserved:
{0x7E,2},x:19,f:%X
x:23,f:h
=
IF $1 & gt; 128
x:5,f:i_extra_isize:
{0x80,2},x:19,f:%u
=
x:5,f:i_pad1:
{0x82,2},x:19,f:%u
=
x:5,f:i_ctime_extra:
{0x84,4},x:19,f:%u
=
x:5,f:i_mtime_extra:
{0x88,4},x:19,f:%u
=
x:5,f:i_atime_extra:
{0x8C,4},x:19,f:%u
=
x:5,f:i_crtime:
{0x90,4},x:19,f:UNIXDATE
=
x:5,f:i_crtime_extra:
{0x94,4},x:19,f:%u
=
x:5,f:i_version_hi:
{0x98,4},x:19,f:%X
x:27,f:h
=
ENDIF
ENDIF
IF $OFFSET+$1 & gt; =$RECSIZE
BREAK
ENDIF
$OFFSET:=$OFFSET+$1
ENDWHILE
[extFS Extent List]
guid:{30747da5-cdcb-b665-e094-12c9cdf32a26}
CALCSIZESTART
IF {0x00,2}=0xF30A
$1:= (0x0C + {0x02,2}*12 + 511) & ~511
IF $1 & gt; 0x10000
$1:=0x10000
ENDIF
IF $RECSIZE & lt; $1
$RECSIZE:=$1
ENDIF
ENDIF
CALCSIZEEND
;extents header
$4:=0x00
$OFFSET:=$4
x:2,f:eh_magic (F30A):
{0x00,2},x:19,f:%04X
x:23,f:h
=
x:2,f:eh_entries:
{0x02,2},x:19,f:%u
=
x:2,f:eh_max:
{0x04,2},x:19,f:%u
=
x:2,f:eh_depth:
{0x06,2},x:19,f:%u
=
x:2,f:eh_generation:
{0x08,4},x:19,f:%X
x:27,f:h
;extents:
$3:={0x06,2}
$4:=$4+0x0C
$5:={0x02,2}
; IF $5 & gt; 4
; $5:=4
; ENDIF
WHILE ($5 & gt; 0) AND ($4+12 & lt; =$RECSIZE)
$OFFSET:=$4
IF NOT $3
;extent
=
x:3,f:ee_block:
{0x00,4},x:19,f:%u
x:30,f:ee_len:
{0x04,2},x:41,f:%u
$OPENCLUSTER:={0x08,4;0x06,2}
x:49,f:ee_start:
{0x08,4;0x06,2},x:60,f:%u
ELSE
;inode
=
x:3,f:ei_block:
{0x00,4},x:19,f:%u
$OPENTEMPLATE:='{30747da5-cdcb-b665-e094-12c9cdf32a26}'
$OPENCLUSTER:={0x04,4;0x08,2}
x:30,f:ei_leaf:
{0x04,4;0x08,2},x:41,f:%u
ENDIF
$4:=$4+12
$5:=$5-1
ENDWHILE
[extFS Directory Entries]
guid:{8a4dbd31-8a3a-0aa6-b095-58c6f3416fed}
flow:1
h: Inode ESize NmLen Type Name
CALCSIZESTART
IF $1 & lt; =0
;recsize is not given
IF $RECSIZE & lt; 4096
$RECSIZE:=4096
ENDIF
ENDIF
CALCSIZEEND
;removed:
$4:=0
;index hashes:
$5:=0
$6:=0
WHILE $OFFSET+0x08 & lt; =$RECSIZE
$10:=0
$2:={0x06,1}
$3:=($2+11) & 0xFC
IF $OFFSET=0 AND {0x04,5}=\x0C\x00\x01\x02\x2E
$5:=1
ENDIF
IF $OFFSET=0x0C AND {0x06,4}!=\x02\x02\x2E\x2E
$5:=0
ENDIF
IF $5 AND $OFFSET=0x18 AND {0x0,4}=0 AND {0x07,1}=0 AND $4 & gt; =0x28 AND {0xA,2} & gt; 0
;dx_root
$63:=TOGGLE:0,x:1
x:5,f:dx_root (index hashes)
=
IF $63
x:9,f:reserved_zero
{0x00,4},x:28,f:%u
=
x:9,f:hash_version
{0x04,1},x:28,f:%u
=
x:9,f:info_length (8)
{0x05,1},x:28,f:%u
=
x:9,f:indirect_levels
{0x06,1},x:28,f:%u
=
x:9,f:unused_flags
{0x07,1},x:28,f:%u
=
x:9,f:limit
{0x08,2},x:28,f:%u
=
x:9,f:count
{0x0A,2},x:28,f:%u
=
x:38,f:block:
{0x0C,4},x:58,f:%u
=
ENDIF
$6:={0x0A,2}-1
$OFFSET:=0x28
ENDIF
IF $OFFSET=0 AND {0x0,4}=0 AND {0x6,2}=0 AND {0xA,2} & gt; 0
;dx_node
$5:=1
x:1,f:dx_node fake.inode (0)
{0x0,4},x:28,f:%u
=
x:9,f:fake.rec_len
{0x4,2},x:28,f:%u
=
x:9,f:name_len (0)
{0x6,1},x:28,f:%u
=
x:9,f:file_type (0)
{0x7,1},x:28,f:%u
=
x:9,f:limit
{0x8,2},x:28,f:%u
=
x:9,f:count
{0xA,2},x:28,f:%u
=
IF {0xA,2} & gt; 1
$63:=TOGGLE:0,x:5
x:9,f:hashes
ENDIF
x:38,f:block:
{0xC,4},x:58,f:%u
=
$4:={0x4,2}
$6:={0xA,2}-1
$OFFSET:=0x10
ENDIF
IF $6
WHILE 1
IF $63
x:9,f:hash:
{0x00,4},x:28,c:$10,f:%08X
x:38,f:block:
{0x04,4},x:58,c:$10,f:%u
=
ENDIF
$6:=$6-1
IF NOT $6
BREAK
ENDIF
$OFFSET:=$OFFSET+8
IF $OFFSET & gt; =$4
$OFFSET:=$4
$4:=0
BREAK
ENDIF
ENDWHILE
$6:=0
ENDIF
IF $4
IF NOT {0x07,1} OR {0x07,1} & gt; 7 OR {0x04:0,2} & gt; 0 OR {0x04,2} & lt; 8
$2:=0
ENDIF
$5:=$2+8
IF $5 & gt; {0x04,2}
$2:=0
ENDIF
IF $RECSIZE & gt; 0
$5:=$OFFSET+{0x04,2}
IF $5 & gt; $RECSIZE
$2:=0
ENDIF
ENDIF
IF NOT $2
$3:=$OFFSET+4
IF $3 & gt; =$4
$4:=0
ENDIF
IF $3 & gt; =$RECSIZE
BREAK
ENDIF
$OFFSET:=$3
CONTINUE
ENDIF
ENDIF
IF NOT $4 AND {0x00,6}=0
BREAK
ENDIF
$OPENFILENUM:={0x00,4}
$10:=0
IF $4
$10:=10 ;grayed
ENDIF
{0x00,4},x:1,c:$10,f:%u
$1:={0x04,2},x:12,c:$10,f:%u
$2:={0x06,1},x:19,c:$10,f:%u
{0x07,1},x:25,c:$10,f:%X
;0x0 Unknown.
;0x1 Regular file.
;0x2 Directory.
;0x3 Character device file.
;0x4 Block device file.
;0x5 FIFO.
;0x6 Socket.
;0x7 Symbolic link.
IF {0x07,1}=2
x:30,f: & gt;
ENDIF
IF $4
x:29,f:x
ENDIF
{0x08,$2},x:31,c:$10,f:u
$3,x:81,c:$10,f:%u
=
IF $3 & lt; $1
IF NOT $4
$4:=$OFFSET+$1
ENDIF
ELSE
$3:=$1
ENDIF
IF $3 & lt; 4
$3:=4
ENDIF
$3:=$OFFSET+$3
IF $4 AND $3 & gt; =$4
$3:=$4
$4:=0
ENDIF
IF $3 & gt; =$RECSIZE
BREAK
ENDIF
$OFFSET:=$3
ENDWHILE
[exFAT Boot Sector]
guid:{69aff35a-367b-8d25-22d2-2dfb6664ad4f}
;{0x00,3}BS_jmpBoot {0xEB7690}
x:1,f:OEMName (EXFAT)
x:24,f: "
{0x03,8},x:25,f:%-8c
x:33,f: "
=
;{0x0b,43}Zeroed
;=
x:1,f:PartitionOffset
{0x40,8},x:25,f:%u
=
x:1,f:VolumeLength
{0x48,8},x:25,f:%u
=
x:1,f:FATOffset
{0x50,4},x:25,f:%u
=
x:1,f:FATLength
{0x54,4},x:25,f:%u
=
x:1,f:ClusterHeapOffset
{0x58,4},x:25,f:%u
=
x:1,f:ClusterCount
{0x5C,4},x:25,f:%u
=
x:1,f:RootDirectoryFirstCluster
{0x60,4},x:25,f:%u
=
x:1,f:VolumeSerialNumber
{0x64,4},x:25,f:%08X
x:33,f:h
=
x:1,f:FileSystemRevision
{0x69,1},x:25,f:%02X
x:27,f:.
{0x68,1},x:28,f:%02X
=
x:1,f:VolumeFlags
{0x6A,2},x:25,f:%04X
x:29,f:h:
{0x6A:0,3},x:32,f:F:21DCFN
;Active FAT 0 1 0 1st, 1 2nd
;Volume Dirty 1 1 0 Clean, 1 - Dirty
;Media Failure 2 1 0 No Failures, 1 Failures Reported
;Clear to Zero 3 1 No Meaning
;Reserved 4 12
=
x:1,f:BytesPerSectorPow
{0x6C,1},x:25,f:%u
=
x:1,f:SectorsPerClusterPow
{0x6D,1},x:25,f:%u
=
x:1,f:NumberOfFATS
{0x6E,1},x:25,f:%u
=
x:1,f:DriveSelect
{0x6F,1},x:25,f:%02X
x:27,f:h
=
x:1,f:PercentInUse
{0x6F,1},x:25,f:%u
;=
;{0x71,7}Reserved
;{0x78,390}BS_Code
=
x:1,f:BS_ExtSign (0xAA55)
{0x1FE,2},x:25,f:%04X
x:29,f:h
[exFAT Dir Entries]
guid:{4496390b-27f1-a0f9-35bd-e144918e7ed0}
flow:1
WHILE $OFFSET+32 & lt; =$RECSIZE
$10:=0
IF NOT {0x00:7,1}
$10:=10 ;grayed
ENDIF
{0x00,1},x:1,c:$10,f:%02X
x:3,f:h
IF NOT {0x00:7,1}
x:4,c:$10,f:x
ENDIF
IF {0x00:0,7}=1
;BITMAP
$OPENFILERECOFS:=$OFFSET
x:5,f:BITMAP #:
{0x01,1},x:15,c:$10,f:F:21
x:47,f:cl:
{0x14,4},x:50,c:$10,f:%u
x:61,f:size:
{0x18,8},x:67,c:$10,f:%u
ELSEIF {0x00:0,7}=2
;UPCASE
$OPENFILERECOFS:=$OFFSET
x:5,c:$10,f:UPCASE:
x:12,f:CS:
{0x04,4},x:15,c:$10,f:%08X
x:23,c:$10,f:h
x:47,f:cl:
{0x14,4},x:50,c:$10,f:%u
x:61,f:size:
{0x18,8},x:67,c:$10,f:%u
ELSEIF {0x00:0,7}=3
;VOLLABEL
x:5,f:LABEL len:
{0x01,1},x:15,c:$10,f:%u
x:20,f:name:
$1:={0x01,1} & lt; & lt; 1
IF $1 & gt; 30
$1:=30
ENDIF
{0x02,$1},x:25,c:$10,f:U
ENDIF
IF {0x00:0,7}=5
$OPENFILERECOFS:=$OFFSET
x:5,f:#
{0x01,1},x:6,c:$10,f:%u
x:10,f:csum:
{0x02,2},x:15,c:$10,f:%04X
x:19,c:$10,f:h
x:29,f:attrs:
{0x04,1},x:35,c:$10,f:F:R-H-S-V-D-A-+-+-
;Creation Time:
;{0x0A:9,7},x:64,f:-%03u
;x:67,f:-
;{0x0A:5,4},x:68,f:-%02u
;x:70,f:-
;{0x0A:0,5},x:71,f:-%02u
;{0x08:11+5},x:74,f:-%02u
;x:76,f::
;{0x08:5,6},x:77,f:-%02u
;x:79,f::
;{0x08:0,5} & lt; & lt; 1,x:80,f:-%02u
;x:82,f:.
;{0x0D,1},x:83,f:%02u
ENDIF
IF {0x00:0,7}=0x40
IF $OFFSET & gt; =32
$OPENFILERECOFS:=$OFFSET-32
ELSE
$OPENFILERECOFS:=$OFFSET
ENDIF
x:5,f:F
{0x01,1},x:6,c:$10,f:F:+-+-
x:10,f:nlen:
{0x03,1},x:15,c:$10,f:%u
x:18,f:hash:
{0x04,2},x:23,c:$10,f:%04X
x:27,f:h
x:29,f:size:
{0x08,8},x:34,c:$10,f:%u
x:47,f:cl:
{0x14,4},x:50,c:$10,f:%u
x:61,f:alloc:
{0x18,8},x:67,c:$10,f:%u
ENDIF
IF {0x00:0,7}=0x41
x:5,f:F
{0x01,1},x:6,c:$10,f:F:+-+-
x:10,f:name:
{0x02,30},x:15,c:$10,f:U
ENDIF
=
$OFFSET:=$OFFSET+32
ENDWHILE
[HFS Volume Header]
guid:{f40f1a35-fe5d-19c5-3e94-a10992273292}
big-endian:1
o:1
x:1,f:signature
{0x00,2},x:25,f:C
=
x:1,f:version
{0x02,2},x:25,f:%u
=
x:1,f:attributes
{0x04,4},x:25,f:%08X
x:33,f:h
=
x:1,f:lastMountedVersion
{0x08,4},x:25,f:C
=
x:1,f:journalInfoBlock
{0x0C,4},x:25,f:%u
; UInt32 createDate;
; UInt32 modifyDate;
; UInt32 backupDate;
; UInt32 checkedDate;
=
x:1,f:fileCount
{0x20,4},x:25,f:%u
=
x:1,f:folderCount
{0x24,4},x:25,f:%u
=
x:1,f:blockSize
{0x28,4},x:25,f:%u
=
x:1,f:totalBlocks
{0x2C,4},x:25,f:%u
=
x:1,f:freeBlocks
{0x30,4},x:25,f:%u
=
x:1,f:nextAllocation
{0x34,4},x:25,f:%u
=
x:1,f:rsrcClumpSize
{0x38,4},x:25,f:%u
=
x:1,f:dataClumpSize
{0x3C,4},x:25,f:%u
=
x:1,f:nextCatalogID
{0x40,4},x:25,f:%u
=
x:1,f:writeCount
{0x44,4},x:25,f:%u
=
x:1,f:encodingsBitmap
{0x48,8},x:25,f:%u
=
$OFFSET:=0x50
$63:=TOGGLE:$OFFSET,x:1
x:5,f:finderInfo
IF $63
$1:=0;
WHILE $OFFSET & lt; 0x68
=
x:5,f:finderInfo[
$1,x:16,f:%u]
{0x00,4},x:25,f:%u
$OFFSET:=$OFFSET+4
$1:=$1+1
ENDWHILE
ENDIF
=
$OFFSET:=0
x:1,f:volume identifier
{0x68,4},x:25,f:%08X
x:33,f:-
{0x6C,4},x:34,f:%08X
$1:=0x70
WHILE $1 & lt; 0x200
=
$OFFSET:=$1
$63:=TOGGLE:$OFFSET,x:1
IF $1==0x70
x:5,f:allocationFile
ELSEIF $1==0xC0
x:5,f:extentsFile
ELSEIF $1==0x110
x:5,f:catalogFile
ELSEIF $1==0x160
x:5,f:attributesFile
ELSEIF $1==0x1B0
x:5,f:startupFile
ENDIF
IF NOT $63
{0x00,8},x:25,f:%u
ELSE
=
x:5,f:logicalSize
{0x00,8},x:25,f:%u
=
x:5,f:clumpSize
{0x08,4},x:25,f:%u
=
x:5,f:totalBlocks
{0x0c,4},x:25,f:%u
=
$OFFSET:=$OFFSET+0x10
$63:=TOGGLE:$OFFSET,x:5
x:9,f:extents
IF NOT $63
$OPENCLUSTER:={0x00,4},x:25,f:%u
ELSE
$2:=0
WHILE $2 & lt; 8
=
x:9,f:startBlock:
$OPENCLUSTER:={0x00,4},x:25,f:%u
x:35,f:blockCount:
{0x04,4},x:51,f:%u
$OFFSET:=$OFFSET+8
$2:=$2+1
ENDWHILE
ENDIF
ENDIF
$1:=$1+0x50
ENDWHILE
[HFS Catalog Nodes]
guid:{8c5be8bc-d060-0d6d-d76f-fc081e1d9187}
big-endian:1
flow:1
CALCSIZESTART
IF $1 & lt; =0
;recsize is not given
IF $RECSIZE & lt; 4096
$RECSIZE:=4096
ENDIF
ENDIF
CALCSIZEEND
;BTNodeDescriptor
x:1,f:fLink & gt;
$GOTOREC:={0x00,4},x:25,f:%u
=
x:1,f:bLink & gt;
$GOTOREC:={0x04,4},x:25,f:%u
=
x:1,f:kind
$9:={0x08,1},x:25,f:%u
IF $9==0xff
x:32,f:kBTLeafNode
ELSEIF $9==0
x:32,f:kBTIndexNode
ELSEIF $9==1
x:32,f:kBTHeaderNode
ELSEIF $9==2
x:32,f:kBTMapNode
ELSE
x:32,c:8,f:Unknown
ENDIF
=
x:1,f:height
{0x09,1},x:25,f:%u
=
x:1,f:numRecords
{0x0A,2},x:25,f:%u
=
x:1,f:reserved
{0x0C,2},x:25,f:%u
=
$2:=0x0E
$12:=$RECSIZE-2
;num records:
$13:={0x0A,2}
WHILE $2 & lt; $RECSIZE AND $13 & gt; 0
$13:=$13-1
x:1,f:==========
=
$OFFSET:=$2-2
IF $9==0
x:1,f:keyLength
$1:={0x02,2},x:25,f:%u
IF $1==0
BREAK
ENDIF
=
x:1,f:parentID & gt;
$OPENFILENUM:={0x04,4},x:25,f:%u
=
x:1,f:nodeName
$8:={0x08,2},x:25,f:%u
$8:=$8*2
IF $8 & gt; 510
$8:=510
ENDIF
{0x0A,$8},x:32,f:U
=
$OFFSET:=$OFFSET+$1+4
x:1,f:Node Number & gt;
$GOTOREC:={0x00,4},x:25,f:%u
=
ELSEIF $9==1
;BTHeaderRec
x:1,f:treeDepth
{0x02,2},x:25,f:%u
=
x:1,f:rootNode & gt;
$GOTOREC:={0x04,4},x:25,f:%u
=
x:1,f:leafRecords
{0x08,4},x:25,f:%u
=
x:1,f:firstLeafNode & gt;
$GOTOREC:={0x0C,4},x:25,f:%u
=
x:1,f:LastLeafNode & gt;
$GOTOREC:={0x10,4},x:25,f:%u
=
x:1,f:nodeSize
{0x14,2},x:25,f:%u
=
x:1,f:maxKeyLength
{0x16,2},x:25,f:%u
=
x:1,f:totalNodes
{0x18,4},x:25,f:%u
=
x:1,f:freeNodes
{0x1C,4},x:25,f:%u
=
x:1,f:reserved1
{0x20,2},x:25,f:%u
=
x:1,f:clumpSize
{0x22,4},x:25,f:%u
=
x:1,f:btreeType
{0x26,1},x:25,f:%u
=
x:1,f:keyCompareType
{0x27,1},x:25,f:%X
x:27,f:h
=
x:1,f:attributes
{0x28,4},x:25,f:%08X
x:33,f:h
;UInt32 reserved3[16]
BREAK
ELSE
x:1,f:keyLength
$1:={0x02,2},x:25,f:%u
IF $1==0
BREAK
ENDIF
=
x:1,f:parentID & gt;
$OPENFILENUM:={0x4,4},x:25,f:%u
=
x:1,f:nodeName
$8:={0x8,2},x:25,f:%u
$8:=$8*2
IF $8 & gt; 510
$8:=510
ENDIF
{0x0A,$8},x:32,f:U
IF $OFFSET+$1+4 & gt; =$RECSIZE
BREAK
ENDIF
=
$OFFSET:=$OFFSET+$1+4
$63:=TOGGLE:$OFFSET,x:1
x:5,f:recordType
$7:={0x00,2},x:25,f:%u
IF $7==1
;HFSPlusCatalogFolder
x:32,f:HFSPlusCatalogFolder
=
IF $63
x:5,f:flags
{0x02,2},x:25,f:%X
x:34,f:h
=
x:5,f:valence
{0x04,4},x:25,f:%X
x:38,f:h
=
x:5,f:folderID & gt;
$OPENFILENUM:={0x08,4},x:25,f:%u
=
x:5,f:createDate
{0x0C,4},x:25,f:%u
=
x:5,f:contentModDate
{0x10,4},x:25,f:%u
=
x:5,f:attributeModDate
{0x14,4},x:25,f:%u
=
x:5,f:accessDate
{0x18,4},x:25,f:%u
=
x:5,f:backupDate
{0x1C,4},x:25,f:%u
=
; {0x20,0x10}
; HFSPlusBSDInfo permissions;
; HFSPlusBSDInfo {
; UInt32 ownerID;
; UInt32 groupID;
; UInt8 adminFlags;
; UInt8 ownerFlags;
; UInt16 fileMode;
; union {
; UInt32 iNodeNum;
; UInt32 linkCount;
; UInt32 rawDevice;
; } special;
; {0x30,0x10}
; FolderInfo userInfo;
;struct FolderInfo {
; Rect windowBounds; /* The position and dimension of the folder's window */
; UInt16 finderFlags;
; Point location; /* Folder's location in the parent */
; /* folder. If set to {0, 0}, the Finder */
; /* will place the item automatically */
; UInt16 reservedField;
;};
; {0x40,0x10}
; ExtendedFolderInfo finderInfo;
;struct ExtendedFolderInfo {
; Point scrollPosition; /* Scroll position (for icon views) */
; SInt32 reserved1;
; UInt16 extendedFinderFlags;
; SInt16 reserved2;
; SInt32 putAwayFolderID;
;};
x:5,f:textEncoding
{0x50,4},x:25,f:%u
=
; UInt32 reserved;
ENDIF
ELSEIF $7==2
;HFSPlusCatalogFile
x:32,f:HFSPlusCatalogFile & gt;
$OPENFILERECOFS:=$2
=
IF $63
x:5,f:flags
{0x02,2},x:25,f:%X
x:34,f:h
=
x:5,f:reserved1
{0x04,4},x:25,f:%X
x:33,f:h
=
x:5,f:fileID & gt;
$OPENFILENUM:={0x08,4},x:25,f:%u
=
x:5,f:createDate
{0x0C,4},x:25,f:%u
=
x:5,f:contentModDate
{0x10,4},x:25,f:%u
=
x:5,f:attributeModDate
{0x14,4},x:25,f:%u
=
x:5,f:accessDate
{0x18,4},x:25,f:%u
=
x:5,f:backupDate
{0x1C,4},x:25,f:%u
=
; {0x20,0x10}
; HFSPlusBSDInfo permissions;
; HFSPlusBSDInfo {
; UInt32 ownerID;
; UInt32 groupID;
; UInt8 adminFlags;
; UInt8 ownerFlags;
; UInt16 fileMode;
; union {
; UInt32 iNodeNum;
; UInt32 linkCount;
; UInt32 rawDevice;
; } special;
; {0x30,0x10}
; FileInfo userInfo;
;struct FileInfo {
; OSType fileType; /* The type of the file */
; OSType fileCreator; /* The file's creator */
; UInt16 finderFlags;
; Point location; /* File's location in the folder. */
; UInt16 reservedField;
;};
; {0x40,0x10}
; ExtendedFileInfo finderInfo;
;struct ExtendedFileInfo {
; SInt16 reserved1[4];
; UInt16 extendedFinderFlags;
; SInt16 reserved2;
; SInt32 putAwayFolderID;
;};
x:5,f:textEncoding
{0x50,4},x:25,f:%u
=
; {0x54}
; UInt32 reserved2;
; {0x58}
; HFSPlusForkData dataFork;
; HFSPlusForkData resourceFork;
$4:=$OFFSET+0x58
$3:=0
WHILE $3 & lt; 2
$OFFSET:=$4
$63:=TOGGLE:$OFFSET,x:1
IF $3==0
x:5,f:dataFork
ELSE
x:5,f:resourceFork
ENDIF
IF NOT $63
{0x00,8},x:25,f:%u
$OPENCLUSTER:={0x10,4}
ELSE
=
x:5,f:logicalSize
{0x00,8},x:25,f:%u
=
x:5,f:clumpSize
{0x08,4},x:25,f:%u
=
x:5,f:totalBlocks
{0x0c,4},x:25,f:%u
=
$OFFSET:=$OFFSET+0x10
$63:=TOGGLE:$OFFSET,x:5
x:9,f:extents
IF NOT $63
$OPENCLUSTER:={0x00,4},x:25,f:%u
ELSE
$5:=0
WHILE $5 & lt; 8
=
x:9,f:startBlock:
$OPENCLUSTER:={0x00,4},x:25,f:%u
x:35,f:blockCount:
{0x04,4},x:51,f:%u
$OFFSET:=$OFFSET+8
$5:=$5+1
ENDWHILE
ENDIF
ENDIF
=
$4:=$4+0x50
$3:=$3+1
ENDWHILE
ENDIF
ELSEIF ($7==3) OR ($7==4)
;HFSPlusCatalogThread
IF ($7==3)
x:32,f:HFSPlusFolderThreadRec
ELSE
x:32,f:HFSPlusFileThreadRec
ENDIF
=
x:5,f:reserved
{0x02,2},x:25,f:%X
x:29,f:h
=
x:5,f:parentID & gt;
$OPENFILENUM:={0x04,4},x:25,f:%u
=
x:5,f:nodeName
$8:={0x8,2},x:25,f:%u
$8:=$8*2
IF $8 & gt; 510
$8:=510
ENDIF
{0x0A,$8},x:32,f:U
=
ELSE
x:32,f:Unknown Record Type
=
ENDIF
ENDIF
$2:=$2+$1
$12:=$12-2
$OFFSET:=0
IF {$12,2} & lt; =$2
BREAK
ENDIF
$2:={$12,2}
ENDWHILE
[HFS Extents Nodes]
guid:{95b010bd-e409-fd86-764a-ea95e78bf763}
big-endian:1
flow:1
;BTNodeDescriptor
x:1,f:fLink & gt;
$GOTOREC:={0x00,4},x:25,f:%u
=
x:1,f:bLink & gt;
$GOTOREC:={0x04,4},x:25,f:%u
=
x:1,f:kind
$9:={0x08,1},x:25,f:%u
IF $9==0xff
x:32,f:kBTLeafNode
ELSEIF $9==0
x:32,f:kBTIndexNode
ELSEIF $9==1
x:32,f:kBTHeaderNode
ELSEIF $9==2
x:32,f:kBTMapNode
ELSE
x:32,c:8,f:Unknown
ENDIF
=
x:1,f:height
{0x09,1},x:25,f:%u
=
x:1,f:numRecords
{0x0A,2},x:25,f:%u
=
x:1,f:reserved
{0x0C,2},x:25,f:%u
=
$2:=0x0E
$12:=$RECSIZE-2
;records num:
$13:={0x0A,2}
WHILE $2 & lt; $RECSIZE AND $13 & gt; 0
$13:=$13-1
x:1,f:==========
=
$OFFSET:=$2-2
IF $9==1
;BTHeaderRec
x:1,f:treeDepth
{0x02,2},x:25,f:%u
=
x:1,f:rootNode & gt;
$GOTOREC:={0x04,4},x:25,f:%u
=
x:1,f:leafRecords
{0x08,4},x:25,f:%u
=
x:1,f:firstLeafNode & gt;
$GOTOREC:={0x0C,4},x:25,f:%u
=
x:1,f:LastLeafNode & gt;
$GOTOREC:={0x10,4},x:25,f:%u
=
x:1,f:nodeSize
{0x14,2},x:25,f:%u
=
x:1,f:maxKeyLength
{0x16,2},x:25,f:%u
=
x:1,f:totalNodes
{0x18,4},x:25,f:%u
=
x:1,f:freeNodes
{0x1C,4},x:25,f:%u
=
x:1,f:reserved1
{0x20,2},x:25,f:%u
=
x:1,f:clumpSize
{0x22,4},x:25,f:%u
=
x:1,f:btreeType
{0x26,1},x:25,f:%u
=
x:1,f:keyCompareType
{0x27,1},x:25,f:%X
x:27,f:h
=
x:1,f:attributes
{0x28,4},x:25,f:%08X
x:33,f:h
;UInt32 reserved3[16]
BREAK
ELSE
x:1,f:keyLength
$1:={0x02,2},x:25,f:%u
IF $1==0
BREAK
ENDIF
=
x:1,f:forkType
{0x04,1},x:25,f:%u
=
x:1,f:pad
{0x05,1},x:25,f:%u
=
x:1,f:fileID & gt;
$OPENFILENUM:={0x06,4},x:25,f:%u
=
x:1,f:startBlock
{0x0A,4},x:25,f:%u
=
$OFFSET:=$OFFSET+$1+4
IF $9==1
x:1,f:Node Number & gt;
$GOTOREC:={0x00,4},x:25,f:%u
=
ELSE
$63:=TOGGLE:$OFFSET,x:5
x:9,f:extents
IF NOT $63
$OPENCLUSTER:={0x00,4},x:25,f:%u
ELSE
$5:=0
WHILE $5 & lt; 8
=
x:9,f:startBlock:
$OPENCLUSTER:={0x00,4},x:25,f:%u
x:35,f:blockCount:
{0x04,4},x:51,f:%u
$OFFSET:=$OFFSET+8
$5:=$5+1
ENDWHILE
ENDIF
=
ENDIF
ENDIF
$2:=$2+1
$12:=$12-2
$OFFSET:=0
IF {$12,2} & lt; =$2
BREAK
ENDIF
$2:={$12,2}
ENDWHILE
[Apple Partition Map]
guid:{8d3ad335-7279-d9c2-7c82-1d013c3da08e}
big-endian:1
flow:1
IF {0x00,2} = 0x4552
;Apple Partition Scheme
x:1,f:signature ( " ER " )
{0x00,2},x:25,f:C
=
x:1,f:block size
{0x02,2},x:25,f:%u
=
x:1,f:blocks number
{0x04,4},x:25,f:%u
ELSE
x:1,f:signature ( " PM " )
{0x00,2},x:25,f:C
=
x:1,f:reserved
{0x02,2},x:25,f:%u
=
x:1,f:partitions number
{0x04,4},x:25,f:%u
=
x:1,f:partition start
{0x08,4},x:25,f:%u
=
x:1,f:partition size
{0x0C,4},x:25,f:%u
=
x:1,f:partition name
{0x10,32},x:25,f:C
=
x:1,f:partition type
{0x30,32},x:25,f:C
=
x:1,f:data start
{0x50,4},x:25,f:%u
=
x:1,f:data size
{0x54,4},x:25,f:%u
=
x:1,f:partition status
{0x58,4},x:25,f:%08X
x:33,f:h
=
x:1,f:boot code start
{0x5C,4},x:25,f:%u
=
x:1,f:boot code size
{0x60,4},x:25,f:%u
=
x:1,f:bootloader code address
{0x64,4},x:25,f:%u
=
x:1,f:reserved
{0x68,4},x:25,f:%u
=
x:1,f:boot code entry point
{0x6C,4},x:25,f:%u
=
x:1,f:reserved
{0x70,4},x:25,f:%u
=
x:1,f:boot code checksum
{0x74,4},x:25,f:%08X
x:33,f:h
=
x:1,f:processor type
{0x78,16},x:25,f:C
ENDIF
[MBR Partition Table]
fuse:0
x:1,f:Disk identifier (Windows):
=
{0x1B8,4},x:1,f:%08X
x:9,f:h
=
x:1,f:Boot System ID : First : Last : Relative : Number of
=
x:1,f:Flag :Cyl Head Sec:Cyl Head Sec: Sector : Sectors
=
$OFFSET:=0x1BE
LABEL:0
$OPENLBA:={0x08,4}
{0x00,1},x:1,f:%02X
x:3,f:h
{0x04,1},x:7,f:%02X
x:9,f:h
x:19,f::
{0x03,1;0x02:6,2},x:20,f:%4u
{0x01,1},x:25,f:%3u
{0x02:0,6},x:29,f:%2u
x:32,f::
{0x07,1;0x06:6,2},x:33,f:%4u
{0x05,1},x:38,f:%3u
{0x06:0,6},x:42,f:%2u
x:45,f::
{0x08,4},x:46,f:%10u
x:56,f::
{0x0C,4},x:57,f:%10u
=
$OFFSET:=$OFFSET+16
IF $OFFSET & lt; 0x1FE
GOTO:0
ENDIF
x:1,f:MBR signature (0xAA55):
=
{0x00,2},x:1,f:%04X
x:5,f:h
[FAT Entries]
fuse:0
flow:1
h: Name Ext Size Cluster Attrs Modified Created Accessed
LABEL:0
$OPENFILERECOFS:=$OFFSET
IF {00,1}=0xE5
x:0,f:x
$10:=10
ELSE
$10:=0
ENDIF
IF {0x0B:0,4}!=0xF ;Short Name Entry
{0x00,8},x:01,c:$10,f:C
{0x08,3},x:10,c:$10,f:C
IF {0x0B:4,1}
x:13,f: & gt;
ENDIF
{0x1C,4},x:14,c:$10,f:-%u
{0x1A,2;0x14,2},x:24,c:$10,f:-%u
{0x0B,1},x:35,c:$10,f:F:R-H-S-V-D-A-+-+-
;Modification Time:
{0x16,4},x:44,c:$10,f:DOSDATE
;Creation Time:
{0x0E,4},x:64,c:$10,f:DOSDATE
x:83,f:.
{0x0D,1},x:84,c:$10,f:%02u
;Access Date:
{0x12,2},x:88,c:$10,f:DOSDATE
ELSE
;LFN Entry:
IF {0:7,1}
x:3,f:x
ELSE
{0:0,5},x:2,c:$10,f:-%u
ENDIF
{0:5,3},x:5,c:$10,f:F:+-L-R-
{1,10},x:10,c:$10,f:U
{0x0E,12},x:15,c:$10,f:U
{0x1C,4},x:21,c:$10,f:U
{0x1A,2},x:25,c:$10,f:-%u
{0x0B,1},x:35,c:$10,f:F:R-H-S-V-D-A-+-+-
{0x0D,1},x:45,c:$10,f:%02X
x:47,f:h
ENDIF
=
$OFFSET:=$OFFSET+32
GOTO:0
[extFS HTree Root (dx_root)]
fuse:0
h: Inode ESize NmLen Type Name
$OPENFILENUM:={0x00,4}
{0x00,4},x:1,f:%u
$1:={0x04,2},x:12,f:%u
$2:={0x06,1},x:19,f:%u
{0x07,1},x:25,f:%X
{0x08,$2},x:30,f:C
=
$OFFSET:=$1
$OPENFILENUM:={0x00,4}
{0x00,4},x:1,f:%u
$2:={0x04,2},x:12,f:%u
$3:={0x06,1},x:19,f:%u
{0x07,1},x:25,f:%X
{0x08,$3},x:30,f:C
=
$OFFSET:=0
x:1,f:reserved_zero
{0x18,4},x:20,f:%u
=
x:1,f:hash_version
{0x1C,1},x:20,f:%u
=
x:1,f:info_length (8)
{0x1D,1},x:20,f:%u
=
x:1,f:indirect_levels
{0x1E,1},x:20,f:%u
=
x:1,f:unused_flags
{0x1F,1},x:20,f:%u
=
x:1,f:limit
{0x20,2},x:20,f:%u
=
x:1,f:count
{0x22,2},x:20,f:%u
=
x:30,f:block:
{0x24,4},x:50,f:%u
=
$2:={0x22,2}
$OFFSET:=0x28
WHILE $OFFSET+8 & lt; =$RECSIZE
x:1,f:hash:
{0x00,4},x:20,f:%08X
x:30,f:block:
{0x04,4},x:50,f:%u
=
$2:=$2-1
IF $2 & lt; =1
BREAK
ENDIF
$OFFSET:=$OFFSET+8
ENDWHILE
[extFS HTree Node (dx_node)]
fuse:0
x:1,f:fake.inode (0)
{0x0,4},x:20,f:%u
=
x:1,f:fake.rec_len
{0x4,2},x:20,f:%u
=
x:1,f:name_len (0)
{0x6,1},x:20,f:%u
=
x:1,f:file_type (0)
{0x7,1},x:20,f:%u
=
x:1,f:limit
{0x8,2},x:20,f:%u
=
x:1,f:count
{0xA,2},x:20,f:%u
=
x:1,f:block
{0xC,4},x:20,f:%u
=
$2:={0xA,2}
$OFFSET:=0x10
WHILE $OFFSET+8 & lt; =$RECSIZE
x:1,f:hash:
{0x00,4},x:20,f:%08X
x:30,f:block:
{0x04,4},x:50,f:%u
=
$2:=$2-1
IF $2 & lt; =0
BREAK
ENDIF
$OFFSET:=$OFFSET+8
ENDWHILE
[ReFS Volume Header]
guid:{b0e7a24d-7796-1e8f-c782-fb752e970447}
x:1,f:FSName
{0x03,8},x:25,f:C
=
x:1,f:Identifier
{0x10,4},x:25,f:%08X
=
x:1,f:LBASize
{0x18,8},x:25,f:%u
=
x:1,f:BytesPerSec
{0x20,4},x:25,f:%u
=
x:1,f:SecPerClus
{0x24,4},x:25,f:%u
=
[ReFS Superblock]
guid:{9b4d6f1e-5d3d-924d-c220-2cce1c7f9173}
$XOFS:=1
IF {0x00,4}=0x42505553
x:0,f:Node Signature
{0x00,0x0c},x:18,f:CXm
=
x:0,f:Volume Signature 0x
{0x0c,4},x:24,f:%X
=
x:0,f:Sequence Number 0x
{0x10,8},x:24,f:%X
=
x:0,f: 0x
{0x18,8},x:24,f:%X
=
x:0,f:Cluster Number [0..3] 0x
{0x20,8},x:24,f:%X
{0x28,8},x:42,f:%X
{0x30,8},x:60,f:%X
{0x38,8},x:78,f:%X
=
x:0,f:Object Id 0x
{0x40,8},x:24,f:%X
x:40,f:-
{0x48,8},x:42,f:%X
=
$3:=0xC0
$4:=1
ELSE
x:0,f:Page Number (Cluster) 0x
{0x00,8},x:24,f:%X
=
x:0,f:Sequence Number 0x
{0x08,8},x:24,f:%X
=
x:0,f:Object Id 0x
{0x10,8},x:24,f:%X
x:40,f:-
{0x18,8},x:42,f:%X
=
$3:=0xA0
$4:=0
ENDIF
x:0,f:FS Descr. Page 1 & gt; 0x
$OPENTEMPLATE:='{cdb0fa46-17bb-d839-15c5-8b7d9f75e0e2}'
$OPENCLUSTER:={$3,8},x:24,f:%X
=
x:0,f:FS Descr. Page 2 & gt; 0x
$OPENTEMPLATE:='{cdb0fa46-17bb-d839-15c5-8b7d9f75e0e2}'
$3:=$3+8
$OPENCLUSTER:={$3,8},x:24,f:%X
[ReFS Descriptors]
guid:{cdb0fa46-17bb-d839-15c5-8b7d9f75e0e2}
$RECSIZE:=16384
$XOFS:=1
IF {0x00,4}=0x504b4843
x:0,f:Node Signature
{0x00,0x0c},x:18,f:CXm
=
x:0,f:Volume Signature 0x
{0x0c,4},x:24,f:%X
=
x:0,f:Sequence Number 0x
{0x10,8},x:24,f:%X
=
x:0,f: 0x
{0x18,8},x:24,f:%X
=
x:0,f:Cluster Number [0..3] 0x
{0x20,8},x:24,f:%X
{0x28,8},x:42,f:%X
{0x30,8},x:60,f:%X
{0x38,8},x:78,f:%X
=
x:0,f:Object Id 0x
{0x40,8},x:24,f:%X
x:40,f:-
{0x48,8},x:42,f:%X
=
$3:=0x90
$4:=1
ELSE
x:0,f:Page Number (Cluster) 0x
{0x00,8},x:24,f:%X
=
x:0,f:Sequence Number 0x
{0x08,8},x:24,f:%X
=
x:0,f:Object Id 0x
{0x10,8},x:24,f:%X
x:40,f:-
{0x18,8},x:42,f:%X
;=
;x:0,f:Descr Offset 0x
;$1:={0x38,4},x:24,f:%X
=
$3:=0x58
$4:=0
ENDIF
x:0,f:Descriptors Number
$1:={$3,4},x:24,f:%u
=
$2:=$3+4
$11:=$1
$12:=$2
$63:=TOGGLE:$OFFSET,x:0,f:Offsets
=
IF $63
WHILE $1 & gt; 0
$11-$1,x:2,f:%2u:
$3:={$2,4},x:6,f:%X
$2:=$2+4
$1:=$1-1
IF $2+4 & gt; $RECSIZE
BREAK
ENDIF
=
ENDWHILE
ENDIF
$1:=$11
$2:=$12
WHILE $1 & gt; 0
$11-$1,x:2,f:%2u:
$3:={$2,4}
IF $3+8 & gt; $RECSIZE OR $3 & lt; 0x5C
x:6,c:8,f:Wrong Offs.
ELSE
x:6,f: & gt;
IF $4
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
ELSE
$OPENTEMPLATE:='{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}'
ENDIF
$OPENCLUSTER:={$3,8},x:8,f:%X
IF $4
$5:=$3+8
{$5,8},x:24,f:%X
$5:=$5+8
{$5,8},x:40,f:%X
$5:=$5+8
{$5,8},x:56,f:%X
ENDIF
ENDIF
$2:=$2+4
$1:=$1-1
IF $2+4 & gt; $RECSIZE
BREAK
ENDIF
=
ENDWHILE
[ReFSv1 Node]
guid:{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}
$RECSIZE:=0x4000
$XOFS:=1
x:0,f:Page Number (Cluster) 0x
{0x00,8},x:24,f:%X
=
x:0,f:Sequence Number 0x
{0x08,8},x:24,f:%X
=
x:0,f:Object Id & gt; 0x
{0x10,8},x:24,f:%X
x:40,f:-
$OPENTEMPLATE:='{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}'
$OPENFILENUM:={0x18,8},x:42,f:%X
$60:={0x18,8}
=
x:0,f:[0x20]: 0x
{0x20,8},x:24,f:CX
=
x:0,f:[0x28]: 0x
{0x28,8},x:24,f:CX
=
$OFFSET:=0x30
$63:=TOGGLE:$OFFSET,x:0,f:Header / Size 0x
$2:={0,4}
IF $OFFSET+$2 & gt; $RECSIZE
$10:=8
$2:=$RECSIZE-$OFFSET
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
IF $63 AND $2
{0,$2},x:4,f:CXm
ENDIF
$10:=$OFFSET+$2
IF $2 & gt; =4 AND $10+4 & lt; =$RECSIZE
$OFFSET:=$10
$63:=TOGGLE:$OFFSET,x:0,f:Entries Info/Size 0x
$2:={0,4}
IF $OFFSET+$2 & gt; $RECSIZE
$10:=8
$2:=$RECSIZE-$OFFSET
ELSEIF $2 & lt; 28
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
ELSE
$2:=0
ENDIF
IF $2 & gt; =28 AND $OFFSET+28 & lt; =$RECSIZE
IF $63
x:4,f:Unused Offset 0x
{4,4},x:24,f:%X
=
x:4,f:Unused Size 0x
{8,4},x:24,f:%X
=
x:4,f:[0x0C] 0x
{0x0C,4},x:24,f:%X
=
x:4,f:Entries Offsets & gt; 0x
{0x10,4},x:24,f:%X
$GOTORECOFS:=$OFFSET+{0x10,4}
=
x:4,f:Entries Num
{0x14,4},x:24,f:%u
=
x:4,f:End Offset 0x
{0x18,4},x:24,f:%X
=
x:4,f:[0x1C] 0x
{0x1C,4},x:24,f:%X
=
ENDIF
$1:={0x10,4}
$3:={0x14,4}
$4:=$OFFSET
WHILE $3 & gt; 0 AND $4+$1+4 & lt; =$RECSIZE
$XOFS:=1
$OFFSET:=$4
x:0,f:[0x
$OFFSET+$1,x:3,f:%X]
$2:={$1,4}
$1:=$1+4
x:9,f:0x
$2,x:11,f:%X:
$2:=$OFFSET+$2
IF $2+24 & gt; $RECSIZE
x:18,c:8,f:Error Offset
=
$3:=$3-1
CONTINUE
ENDIF
$OFFSET:=$2
x:18,f:AttrSize/ KeyOfs/ KeySz / Flags / ValOfs/ ValSize
=
x:16,f:0x
$9:={0,4}
IF $OFFSET+$9 & gt; $RECSIZE
$9:=$RECSIZE-$OFFSET
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:18,c:$10,f:%X
;Key Offs
$7:={4,2}
;Key Size
$8:={6,2}
IF $8 AND $7 & gt; =$9
$8:=0
$10:=8
ELSE
$10:=0
ENDIF
{4,2},x:28,c:$10,f:%X
IF $8 AND $7+$8 & gt; $9
$8:=$9-$7
$10:=8
ENDIF
{6,2},x:36,c:$10,f:%X
;Flags
{8,2},x:44,f:%X
;Value Offs
$5:={0x0A,2}
;Value Size
$6:={0x0C,4}
IF $6 AND $5 & gt; =$9
$10:=8
$6:=0
ELSE
$10:=0
ENDIF
{0x0A,2},x:52,c:$10,f:%X
IF $6 AND $5+$6 & gt; $9
$6:=$9-$5
$10:=8
ENDIF
{0x0C,4},x:60,c:$10,f:%X
IF $8 & gt; =4 AND {$7,4}=0x010030
$OPENFILERECOFS:=$OFFSET
x:6,f: & gt;
ENDIF
=
IF $8
$10:=$7+$OFFSET
$63:=TOGGLE:$10,x:2,f:Key
IF $63
{$7,$8},x:12,f:CXm
ELSEIF {$7,2}=0x0030
$2:=$7+4;
$10:=$8-4;
{$2,$10},x:18,f:U
ELSEIF $8=16 AND NOT {$7,8}
x:12,f:Obj. Id & gt; 0x
{$7,8},x:24,f:%X
x:40,f:-
$10:=$7+8
$OPENTEMPLATE:='{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}'
$OPENFILENUM:={$10,8},x:42,f:%X
ELSE
$10:=$8
IF $10 & gt; 16
$10:=16
ENDIF
{$7,$10},x:12,f:CXm
ENDIF
=
ENDIF
IF NOT $6
$3:=$3-1
CONTINUE
ENDIF
$10:=$5+$OFFSET
$63:=TOGGLE:$10,x:2,f:Value
IF $8 & gt; =4 AND ({$7,4}=0x010030 OR {$7,4}=0x0160) OR $8=4 AND {$7,4}=0x10
$59:=1
ELSEIF $8=4 AND {$7,4}=0x10000000
$59:=2
ELSE
$59:=0
ENDIF
IF $63 AND $59=1 AND $6 & gt; =0x20 AND {$5,4} & gt; 0 AND {$5,4} & lt; =$6
=
$XOFS:=7
$OFFSET:=$OFFSET+$5
$12:=$OFFSET+$6
$10:=$OFFSET+1
$63:=TOGGLE:$10,x:0,f:Header / Size 0x
$2:={0,4}
IF $OFFSET+$2 & gt; $12
$2:=$12-$OFFSET
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
IF $63 AND $2
{0,$2},x:4,f:CXm
ENDIF
$10:=$OFFSET+$2
IF $2 & gt; =4 AND $10+4 & lt; =$12
$OFFSET:=$10
$63:=TOGGLE:$OFFSET,x:0,f:Entries Info/Size 0x
$2:={0,4}
IF $OFFSET+$2 & gt; $12
$2:=$12-$OFFSET
$10:=8
ELSEIF $2 & lt; 28
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
ELSE
$2:=0
ENDIF
IF $2 & gt; =28 AND $OFFSET+28 & lt; =$12
IF $63
x:4,f:Unused Offset 0x
{4,4},x:24,f:%X
=
x:4,f:Unused Size 0x
{8,4},x:24,f:%X
=
x:4,f:[0x0C] 0x
{0x0C,4},x:24,f:%X
=
x:4,f:Entries Offsets & gt; 0x
{0x10,4},x:24,f:%X
$GOTORECOFS:=$OFFSET+{0x10,4}
=
x:4,f:Entries Num
{0x14,4},x:24,f:%u
=
x:4,f:End Offset 0x
{0x18,4},x:24,f:%X
=
x:4,f:[0x1C] 0x
{0x1C,4},x:24,f:%X
=
ENDIF
$21:={0x10,4}
$23:={0x14,4}
$24:=$OFFSET
WHILE $23 & gt; 0 AND $24+$21+4 & lt; =$12
$XOFS:=7
$OFFSET:=$24
x:0,f:[0x
$OFFSET+$21,x:3,f:%X]
$2:={$21,4}
$21:=$21+4
x:9,f:0x
$2,x:11,f:%X:
$2:=$OFFSET+$2
IF $2+24 & gt; $12
x:18,c:8,f:Error Offset
=
$23:=$23-1
CONTINUE
ENDIF
$OFFSET:=$2
x:18,f:AttrSize/ KeyOfs/ KeySz / Flags / ValOfs/ ValSize
=
x:16,f:0x
$29:={0,4}
IF $OFFSET+$29 & gt; $12
$29:=$12-$OFFSET
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:18,c:$10,f:%X
;Key Offs
$27:={4,2}
;Key Size
$28:={6,2}
IF $28 AND $27 & gt; =$29
$28:=0
$10:=8
ELSE
$10:=0
ENDIF
{4,2},x:28,c:$10,f:%X
IF $28 AND $27+$28 & gt; $29
$28:=$29-$27
$10:=8
ENDIF
{6,2},x:36,c:$10,f:%X
;Flags
{8,2},x:44,f:%X
;Value Offs
$25:={0x0A,2}
;Value Size
$26:={0x0C,4}
IF $26 AND $25 & gt; =$29
$26:=0
$10:=8
ELSE
$10:=0
ENDIF
{0x0A,2},x:52,c:$10,f:%X
IF $26 AND $25+$26 & gt; $29
$26:=$29-$25
$10:=8
ENDIF
{0x0C,4},x:60,c:$10,f:%X
=
IF $28
$10:=$27+$OFFSET
$63:=TOGGLE:$10,x:2,f:Key
IF $63
{$27,$28},x:12,f:CXm
ELSE
$10:=$28
IF $10 & gt; 16
$10:=16
ENDIF
{$27,$10},x:12,f:CXm
ENDIF
=
ENDIF
IF NOT $26
$23:=$23-1
CONTINUE
ENDIF
$10:=$25+$OFFSET
$63:=TOGGLE:$10,x:2,f:Value
IF $63 AND $59=1 AND $26 & gt; =0x20 AND {$25,4} & gt; 0 AND {$25,4} & lt; =$26
=
$XOFS:=13
$OFFSET:=$OFFSET+$25
$32:=$OFFSET+$26
$10:=$OFFSET+1
$63:=TOGGLE:$10,x:0,f:Header / Size 0x
$2:={0,4}
IF $OFFSET+$2 & gt; $32
$10:=8
$2:=$32-$OFFSET
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
IF $63 AND $2
{0,$2},x:4,f:CXm
ENDIF
$10:=$OFFSET+$2
IF $2 & gt; =4 AND $10+4 & lt; =$32
$OFFSET:=$10
$63:=TOGGLE:$OFFSET,x:0,f:Entries Info/Size 0x
$2:={0,4}
IF $OFFSET+$2 & gt; $32
$10:=8
$2:=$32-$OFFSET
ELSEIF $2 & lt; 28
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
ELSE
$2:=0
ENDIF
IF $2 & gt; 28 AND $OFFSET+28 & lt; =$32
IF $63
x:4,f:Unused Offset 0x
{4,4},x:24,f:%X
=
x:4,f:Unused Size 0x
{8,4},x:24,f:%X
=
x:4,f:[0x0C] 0x
{0x0C,4},x:24,f:%X
=
x:4,f:Entries Offsets & gt; 0x
{0x10,4},x:24,f:%X
$GOTORECOFS:=$OFFSET+{0x10,4}
=
x:4,f:Entries Num
{0x14,4},x:24,f:%u
=
x:4,f:End Offset 0x
{0x18,4},x:24,f:%X
=
x:4,f:[0x1C] 0x
{0x1C,4},x:24,f:%X
=
ENDIF
$41:={0x10,4}
$43:={0x14,4}
$44:=$OFFSET
WHILE $43 & gt; 0 AND $44+$41+4 & lt; =$32
$OFFSET:=$44
x:0,f:[0x
$OFFSET+$41,x:3,f:%X]
$2:={$41,4}
$41:=$41+4
x:9,f:0x
$2,x:11,f:%X:
$2:=$OFFSET+$2
IF $2+44 & gt; $32
x:18,c:8,f:Error Offset
=
$43:=$43-1
CONTINUE
ENDIF
$OFFSET:=$2
x:18,f:AttrSize/ KeyOfs/ KeySz / Flags / ValOfs/ ValSize
=
x:16,f:0x
$49:={0,4}
IF $OFFSET+$49 & gt; $32
$49:=$32-$OFFSET
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:18,c:$10,f:%X
;Key Offs
$47:={4,2}
;Key Size
$48:={6,2}
IF $48 AND $47 & gt; =$49
$48:=0
$10:=8
ELSE
$10:=0
ENDIF
{4,2},x:28,c:$10,f:%X
IF $48 AND $47+$48 & gt; $49
$48:=$49-$47
$10:=8
ENDIF
{6,2},x:36,c:$10,f:%X
;Flags
{8,2},x:44,f:%X
;Value Offs
$45:={0x0A,2}
;Value Size
$46:={0x0C,4}
IF $46 AND $45 & gt; =$49
$46:=0
$10:=8
ELSE
$10:=0
ENDIF
{0x0A,2},x:52,c:$10,f:%X
IF $46 AND $45+$46 & gt; $49
$46:=$49-$45
$10:=8
ENDIF
{0x0C,4},x:60,c:$10,f:%X
=
IF $48
$10:=$47+$OFFSET
$63:=TOGGLE:$10,x:2,f:Key
IF $63
{$47,$48},x:12,f:CXm
ELSE
$10:=$48
IF $10 & gt; 16
$10:=16
ENDIF
{$47,$10},x:12,f:CXm
ENDIF
=
ENDIF
IF NOT $46
$43:=$43-1
CONTINUE
ENDIF
$10:=$OFFSET+$45
$63:=TOGGLE:$10,x:2,f:Value
$10:=$45+8
IF $63
{$45,$46},x:12,f:CXm
ELSEIF NOT $48 OR ($46=0x18) AND {$45,8} AND {$10,8}=0x0808020000
IF $46 & gt; =0x8
x:12,f:Page & gt; 0x
$OPENTEMPLATE:='{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}'
$OPENCLUSTER:={$45,8},x:24,f:%X
ENDIF
ELSE
IF $46 & gt; =0x18
$10:=$45+0x10
x:12,f:Cluster & gt; 0x
$OPENCLUSTER:={$10,8},x:24,f:%X
ENDIF
ENDIF
=
$43:=$43-1
ENDWHILE
$XOFS:=13
$OFFSET:=$44
$41:={0x10,4}
$43:={0x14,4}
IF $43 & gt; 0 AND $41+4 & lt; =$32
$10:=$OFFSET+$41
$63:=TOGGLE:$10,x:0,f:Entries Offsets
=
IF $63
WHILE $43 & gt; 0 AND $41+4 & lt; =$32
x:4,f:0x
$10:=$OFFSET+$1
$10,x:6,f:%X:
x:12,f: & gt; 0x
$GOTORECOFS:=$OFFSET+{$41,4}
{$41,4},x:16,f:%X
$41:=$41+4
$43:=$43-1
=
ENDWHILE
ENDIF
ENDIF
ENDIF
ELSEIF $63
{$25,$26},x:12,f:CXm
ELSE
$10:=$25+8
$11:=$27+8
IF NOT $28 AND $26 & gt; =0x8 OR $26=0x18 AND {$25,8} AND {$10,8}=0x0808020000
x:12,f:Page & gt; 0x
$OPENTEMPLATE:='{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}'
$OPENCLUSTER:={$25,8},x:24,f:%X
ELSEIF $28=0x0E AND {$11,6}=0x38 AND $26 & gt; =0x60 AND {$25,4}=0
$10:=$25+0x0C
x:12,f:Obj. Id & gt; 0x
$OPENTEMPLATE:='{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}'
$OPENFILENUM:={$10,8},x:24,f:%X
=
$10:=$25+0x5E
$11:=$25+0x54
$11:={$11,1}*2
IF 0x5E+$11 & gt; $26
$11:=$26-0x5E
ENDIF
{$10,$11},x:18,f:U
ELSEIF $28=0x10
IF $26 & gt; =0x18
$10:=$25+0x10
x:12,f:Cluster & gt; 0x
$OPENCLUSTER:={$10,8},x:24,f:%X
ENDIF
ENDIF
ENDIF
=
$23:=$23-1
ENDWHILE
$XOFS:=7
$OFFSET:=$24
$21:={0x10,4}
$23:={0x14,4}
IF $23 & gt; 0 AND $21+4 & lt; =$12
$10:=$OFFSET+$21
$63:=TOGGLE:$10,x:0,f:Entries Offsets
=
IF $63
WHILE $23 & gt; 0 AND $21+4 & lt; =$12
x:4,f:0x
$10:=$OFFSET+$1
$10,x:6,f:%X:
x:12,f: & gt; 0x
$GOTORECOFS:=$OFFSET+{$21,4}
{$21,4},x:16,f:%X
$21:=$21+4
$23:=$23-1
=
ENDWHILE
ENDIF
ENDIF
ENDIF
ELSEIF $63
{$5,$6},x:12,f:CXm
ELSE
$10:=$5+8
$11:=$7+8
IF $8 & gt; =2 AND {$7,2}=0x0510
x:12,f:Label:
{$5,$6},x:18,f:U
ELSEIF $8 & gt; =4 AND {$7,4}=0x020030 AND $6 & gt; =0x20
x:12,f:Obj. Id & gt; 0x
$OPENTEMPLATE:='{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}'
$OPENFILENUM:={$5,8},x:24,f:%X
ELSEIF $60=2 OR $60=0x0C OR (NOT $59 OR $6=0x18) AND {$5,8} AND $6 & gt; =0x10 AND {$10,8}=0x0808020000
x:12,f:Page & gt; 0x
$OPENTEMPLATE:='{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}'
$OPENCLUSTER:={$5,8},x:24,f:%X
ELSEIF $60 & gt; =0x500 AND $8=0x0E AND {$11,6}=0x38 AND $6 & gt; =0x60 AND {$5,4}=0
$10:=$5+0x0C
x:12,f:Obj. Id & gt; 0x
$OPENTEMPLATE:='{650e7e87-71ad-6b45-52fc-ff29f7ee07bb}'
$OPENFILENUM:={$10,8},x:24,f:%X
=
$10:=$5+0x5E
$11:=$5+0x54
$11:={$11,1}*2
IF 0x5E+$11 & gt; $6
$11:=$6-0x5E
ENDIF
{$10,$11},x:18,f:U
ENDIF
=
ENDIF
$3:=$3-1
ENDWHILE
$XOFS:=1
$OFFSET:=$4
$1:={0x10,4}
$3:={0x14,4}
IF $3 & gt; 0 AND $1+4 & lt; =$RECSIZE
$10:=$OFFSET+$1
$63:=TOGGLE:$10,x:0,f:Entries Offsets
=
IF $63
WHILE $3 & gt; 0 AND $1+4 & lt; =$RECSIZE
x:4,f:0x
$10:=$OFFSET+$1
$10,x:6,f:%X:
x:12,f: & gt; 0x
$GOTORECOFS:=$OFFSET+{$1,4}
{$1,4},x:16,f:%X
$1:=$1+4
$3:=$3-1
=
ENDWHILE
ENDIF
ENDIF
ENDIF
[ReFSv3 Node]
guid:{2bf504cd-5185-ff23-a9bc-929a1abdcf79}
$RECSIZE:=0x4000
CALCSIZESTART
IF $1 & gt; =0x4000
$RECSIZE:=$1
ELSE
;recsize is not given
$10:=0x50+{0x50,4}+0x10
IF {$10,4} & gt; =0x4000
$RECSIZE:=0x10000
ENDIF
ENDIF
CALCSIZEEND
$XOFS:=1
x:0,f:Node Signature
{0x00,0x0c},x:18,f:CXm
=
x:0,f:Volume Signature 0x
{0x0c,4},x:24,f:%X
=
x:0,f:Sequence Number 0x
{0x10,8},x:24,f:%X
=
x:0,f: 0x
{0x18,8},x:24,f:%X
=
x:0,f:Cluster Number [0..3] 0x
{0x20,8},x:24,f:%X
{0x28,8},x:42,f:%X
{0x30,8},x:60,f:%X
{0x38,8},x:78,f:%X
=
x:0,f:Object Id & gt; 0x
{0x40,8},x:24,f:%X
x:40,f:-
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
$OPENFILENUM:={0x48,8},x:42,f:%X
$60:={0x48,8}
=
$OFFSET:=0x50
$63:=TOGGLE:$OFFSET,x:0,f:Header / Size 0x
$2:={0,4}
IF $OFFSET+$2 & gt; $RECSIZE
$10:=8
$2:=$RECSIZE-$OFFSET
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
IF $63 AND $2
{0,$2},x:4,f:CXm
ENDIF
$10:=$OFFSET+$2
IF $2 & gt; =4 AND $10+4 & lt; =$RECSIZE
$OFFSET:=$10
$63:=TOGGLE:$OFFSET,x:0,f:Entries Info/Size 0x
$2:={0,4}
IF $OFFSET+$2 & gt; $RECSIZE
$10:=8
$2:=$RECSIZE-$OFFSET
ELSEIF $2 & lt; 28
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
ELSE
$2:=0
ENDIF
IF $2 & gt; =28 AND $OFFSET+28 & lt; =$RECSIZE
IF $63
x:4,f:Unused Offset 0x
{4,4},x:24,f:%X
=
x:4,f:Unused Size 0x
{8,4},x:24,f:%X
=
x:4,f:[0x0C] 0x
{0x0C,4},x:24,f:%X
=
x:4,f:Entries Offsets & gt; 0x
{0x10,4},x:24,f:%X
$GOTORECOFS:=$OFFSET+{0x10,4}
=
x:4,f:Entries Num
{0x14,4},x:24,f:%u
=
x:4,f:[0x18] 0x
{0x18,4},x:24,f:%X
=
x:4,f:[0x1C] 0x
{0x1C,4},x:24,f:%X
=
ENDIF
$1:={0x10,4}
$3:={0x14,4}
$4:=$OFFSET
WHILE $3 & gt; 0 AND $4+$1+4 & lt; =$RECSIZE
$XOFS:=1
$OFFSET:=$4
x:0,f:[0x
$OFFSET+$1,x:3,f:%X]
$2:={$1,2}
$1:=$1+4
x:9,f:0x
$2,x:11,f:%X:
$2:=$OFFSET+$2
IF $2+24 & gt; $RECSIZE
x:18,c:8,f:Error Offset
=
$3:=$3-1
CONTINUE
ENDIF
$OFFSET:=$2
x:18,f:AttrSize/ KeyOfs/ KeySz / Flags / ValOfs/ ValSize
=
x:16,f:0x
$9:={0,4}
IF $OFFSET+$9 & gt; $RECSIZE
$9:=$RECSIZE-$OFFSET
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:18,c:$10,f:%X
;Key Offs
$7:={4,2}
;Key Size
$8:={6,2}
IF $8 AND $7 & gt; =$9
$8:=0
$10:=8
ELSE
$10:=0
ENDIF
{4,2},x:28,c:$10,f:%X
IF $8 AND $7+$8 & gt; $9
$8:=$9-$7
$10:=8
ENDIF
{6,2},x:36,c:$10,f:%X
;Flags
{8,2},x:44,f:%X
;Value Offs
$5:={0x0A,2}
;Value Size
$6:={0x0C,4}
IF $6 AND $5 & gt; =$9
$10:=8
$6:=0
ELSE
$10:=0
ENDIF
{0x0A,2},x:52,c:$10,f:%X
IF $6 AND $5+$6 & gt; $9
$6:=$9-$5
$10:=8
ENDIF
{0x0C,4},x:60,c:$10,f:%X
IF $8 & gt; =4 AND {$7,4}=0x010030
$OPENFILERECOFS:=$OFFSET
x:6,f: & gt;
ENDIF
=
IF $8
$10:=$7+$OFFSET
$63:=TOGGLE:$10,x:2,f:Key
IF $63
{$7,$8},x:12,f:CXm
ELSEIF {$7,2}=0x0030
$2:=$7+4;
$10:=$8-4;
{$2,$10},x:18,f:U
ELSEIF $8=16 AND NOT {$7,8}
x:12,f:Obj. Id & gt; 0x
{$7,8},x:24,f:%X
x:40,f:-
$10:=$7+8
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
$OPENFILENUM:={$10,8},x:42,f:%X
ELSE
$10:=$8
IF $10 & gt; 16
$10:=16
ENDIF
{$7,$10},x:12,f:CXm
ENDIF
=
ENDIF
IF NOT $6
$3:=$3-1
CONTINUE
ENDIF
$10:=$5+$OFFSET
$63:=TOGGLE:$10,x:2,f:Value
IF $8 & gt; =4 AND ({$7,4}=0x010030 OR {$7,4}=0x0160) OR $8=4 AND {$7,4}=0x10
$59:=1
ELSEIF $8=4 AND {$7,4}=0x10000000
$59:=2
ELSE
$59:=0
ENDIF
IF $63 AND $59=1 AND $6 & gt; =0x20 AND {$5,4} & gt; 0 AND {$5,4} & lt; =$6
=
$XOFS:=7
$OFFSET:=$OFFSET+$5
$12:=$OFFSET+$6
$10:=$OFFSET+1
$63:=TOGGLE:$10,x:0,f:Header / Size 0x
$2:={0,4}
IF $OFFSET+$2 & gt; $12
$2:=$12-$OFFSET
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
IF $63 AND $2
{0,$2},x:4,f:CXm
ENDIF
$10:=$OFFSET+$2
IF $2 & gt; =4 AND $10+4 & lt; =$12
$OFFSET:=$10
$63:=TOGGLE:$OFFSET,x:0,f:Entries Info/Size 0x
$2:={0,4}
IF $OFFSET+$2 & gt; $12
$2:=$12-$OFFSET
$10:=8
ELSEIF $2 & lt; 28
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
ELSE
$2:=0
ENDIF
IF $2 & gt; =28 AND $OFFSET+28 & lt; =$12
IF $63
x:4,f:Unused Offset 0x
{4,4},x:24,f:%X
=
x:4,f:Unused Size 0x
{8,4},x:24,f:%X
=
x:4,f:[0x0C] 0x
{0x0C,4},x:24,f:%X
=
x:4,f:Entries Offsets & gt; 0x
{0x10,4},x:24,f:%X
$GOTORECOFS:=$OFFSET+{0x10,4}
=
x:4,f:Entries Num
{0x14,4},x:24,f:%u
=
x:4,f:[0x18] 0x
{0x18,4},x:24,f:%X
=
x:4,f:[0x1C] 0x
{0x1C,4},x:24,f:%X
=
ENDIF
$21:={0x10,4}
$23:={0x14,4}
$24:=$OFFSET
WHILE $23 & gt; 0 AND $24+$21+4 & lt; =$12
$XOFS:=7
$OFFSET:=$24
x:0,f:[0x
$OFFSET+$21,x:3,f:%X]
$2:={$21,2}
$21:=$21+4
x:9,f:0x
$2,x:11,f:%X:
$2:=$OFFSET+$2
IF $2+24 & gt; $12
x:18,c:8,f:Error Offset
=
$23:=$23-1
CONTINUE
ENDIF
$OFFSET:=$2
x:18,f:AttrSize/ KeyOfs/ KeySz / Flags / ValOfs/ ValSize
=
x:16,f:0x
$29:={0,4}
IF $OFFSET+$29 & gt; $12
$29:=$12-$OFFSET
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:18,c:$10,f:%X
;Key Offs
$27:={4,2}
;Key Size
$28:={6,2}
IF $28 AND $27 & gt; =$29
$28:=0
$10:=8
ELSE
$10:=0
ENDIF
{4,2},x:28,c:$10,f:%X
IF $28 AND $27+$28 & gt; $29
$28:=$29-$27
$10:=8
ENDIF
{6,2},x:36,c:$10,f:%X
;Flags
{8,2},x:44,f:%X
;Value Offs
$25:={0x0A,2}
;Value Size
$26:={0x0C,4}
IF $26 AND $25 & gt; =$29
$26:=0
$10:=8
ELSE
$10:=0
ENDIF
{0x0A,2},x:52,c:$10,f:%X
IF $26 AND $25+$26 & gt; $29
$26:=$29-$25
$10:=8
ENDIF
{0x0C,4},x:60,c:$10,f:%X
=
IF $28
$10:=$27+$OFFSET
$63:=TOGGLE:$10,x:2,f:Key
IF $63
{$27,$28},x:12,f:CXm
ELSE
$10:=$28
IF $10 & gt; 16
$10:=16
ENDIF
{$27,$10},x:12,f:CXm
ENDIF
=
ENDIF
IF NOT $26
$23:=$23-1
CONTINUE
ENDIF
$10:=$25+$OFFSET
$63:=TOGGLE:$10,x:2,f:Value
IF $63 AND $59=1 AND $26 & gt; =0x20 AND {$25,4} & gt; 0 AND {$25,4} & lt; =$26
=
$XOFS:=13
$OFFSET:=$OFFSET+$25
$32:=$OFFSET+$26
$10:=$OFFSET+1
$63:=TOGGLE:$10,x:0,f:Header / Size 0x
$2:={0,4}
IF $OFFSET+$2 & gt; $32
$10:=8
$2:=$32-$OFFSET
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
IF $63 AND $2
{0,$2},x:4,f:CXm
ENDIF
$10:=$OFFSET+$2
IF $2 & gt; =4 AND $10+4 & lt; =$32
$OFFSET:=$10
$63:=TOGGLE:$OFFSET,x:0,f:Entries Info/Size 0x
$2:={0,4}
IF $OFFSET+$2 & gt; $32
$10:=8
$2:=$32-$OFFSET
ELSEIF $2 & lt; 28
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:24,c:$10,f:%X
=
ELSE
$2:=0
ENDIF
IF $2 & gt; 28 AND $OFFSET+28 & lt; =$32
IF $63
x:4,f:Unused Offset 0x
{4,4},x:24,f:%X
=
x:4,f:Unused Size 0x
{8,4},x:24,f:%X
=
x:4,f:[0x0C] 0x
{0x0C,4},x:24,f:%X
=
x:4,f:Entries Offsets & gt; 0x
{0x10,4},x:24,f:%X
$GOTORECOFS:=$OFFSET+{0x10,4}
=
x:4,f:Entries Num
{0x14,4},x:24,f:%u
=
x:4,f:[0x18] 0x
{0x18,4},x:24,f:%X
=
x:4,f:[0x1C] 0x
{0x1C,4},x:24,f:%X
=
ENDIF
$41:={0x10,4}
$43:={0x14,4}
$44:=$OFFSET
WHILE $43 & gt; 0 AND $44+$41+4 & lt; =$32
$OFFSET:=$44
x:0,f:[0x
$OFFSET+$41,x:3,f:%X]
$2:={$41,2}
$41:=$41+4
x:9,f:0x
$2,x:11,f:%X:
$2:=$OFFSET+$2
IF $2+44 & gt; $32
x:18,c:8,f:Error Offset
=
$43:=$43-1
CONTINUE
ENDIF
$OFFSET:=$2
x:18,f:AttrSize/ KeyOfs/ KeySz / Flags / ValOfs/ ValSize
=
x:16,f:0x
$49:={0,4}
IF $OFFSET+$49 & gt; $32
$49:=$32-$OFFSET
$10:=8
ELSE
$10:=0
ENDIF
{0,4},x:18,c:$10,f:%X
;Key Offs
$47:={4,2}
;Key Size
$48:={6,2}
IF $48 AND $47 & gt; =$49
$48:=0
$10:=8
ELSE
$10:=0
ENDIF
{4,2},x:28,c:$10,f:%X
IF $48 AND $47+$48 & gt; $49
$48:=$49-$47
$10:=8
ENDIF
{6,2},x:36,c:$10,f:%X
;Flags
{8,2},x:44,f:%X
;Value Offs
$45:={0x0A,2}
;Value Size
$46:={0x0C,4}
IF $46 AND $45 & gt; =$49
$46:=0
$10:=8
ELSE
$10:=0
ENDIF
{0x0A,2},x:52,c:$10,f:%X
IF $46 AND $45+$46 & gt; $49
$46:=$49-$45
$10:=8
ENDIF
{0x0C,4},x:60,c:$10,f:%X
=
IF $48
$10:=$47+$OFFSET
$63:=TOGGLE:$10,x:2,f:Key
IF $63
{$47,$48},x:12,f:CXm
ELSE
$10:=$48
IF $10 & gt; 16
$10:=16
ENDIF
{$47,$10},x:12,f:CXm
ENDIF
=
ENDIF
IF NOT $46
$43:=$43-1
CONTINUE
ENDIF
$10:=$OFFSET+$45
$63:=TOGGLE:$10,x:2,f:Value
$10:=$45+0x20
IF $63
{$45,$46},x:12,f:CXm
ELSEIF NOT $48 OR ($46=0x30) AND {$45,8} AND {$10,8}=0x0808020000
IF $46 & gt; =0x8
x:12,f:Page & gt; 0x
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
$OPENCLUSTER:={$45,8},x:24,f:%X
ENDIF
ELSE
IF $46 & gt; =0x18
$10:=$45+0x10
x:12,f:Cluster & gt; 0x
$OPENCLUSTER:={$10,8},x:24,f:%X
ENDIF
ENDIF
=
$43:=$43-1
ENDWHILE
$XOFS:=13
$OFFSET:=$44
$41:={0x10,4}
$43:={0x14,4}
IF $43 & gt; 0 AND $41+4 & lt; =$32
$10:=$OFFSET+$41
$63:=TOGGLE:$10,x:0,f:Entries Offsets
=
IF $63
WHILE $43 & gt; 0 AND $41+4 & lt; =$32
x:4,f:0x
$10:=$OFFSET+$1
$10,x:6,f:%X:
x:12,f: & gt; 0x
$GOTORECOFS:=$OFFSET+{$41,4}
{$41,4},x:16,f:%X
$41:=$41+4
$43:=$43-1
=
ENDWHILE
ENDIF
ENDIF
ENDIF
ELSEIF $63
{$25,$26},x:12,f:CXm
ELSE
$10:=$25+0x20
$11:=$27+8
IF NOT $28 AND $26 & gt; =0x8 OR $26=0x30 AND {$25,8} AND {$10,8}=0x0808020000
x:12,f:Page & gt; 0x
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
$OPENCLUSTER:={$25,8},x:24,f:%X
ELSEIF $28=0x0E AND {$11,6}=0x38 AND $26 & gt; =0x60 AND {$25,4}=0
$10:=$25+0x0C+0x08
x:12,f:Obj. Id & gt; 0x
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
$OPENFILENUM:={$10,8},x:24,f:%X
=
$10:=$25+0x5E
$11:=$25+0x54
$11:={$11,1}*2
IF 0x5E+$11 & gt; $26
$11:=$26-0x5E
ENDIF
{$10,$11},x:18,f:U
ELSEIF $28=0x10
IF $26 & gt; =0x18
$10:=$25+0x10
x:12,f:Cluster & gt; 0x
$OPENCLUSTER:={$10,8},x:24,f:%X
ENDIF
ENDIF
ENDIF
=
$23:=$23-1
ENDWHILE
$XOFS:=7
$OFFSET:=$24
$21:={0x10,4}
$23:={0x14,4}
IF $23 & gt; 0 AND $21+4 & lt; =$12
$10:=$OFFSET+$21
$63:=TOGGLE:$10,x:0,f:Entries Offsets
=
IF $63
WHILE $23 & gt; 0 AND $21+4 & lt; =$12
x:4,f:0x
$10:=$OFFSET+$1
$10,x:6,f:%X:
x:12,f: & gt; 0x
$GOTORECOFS:=$OFFSET+{$21,4}
{$21,4},x:16,f:%X
$21:=$21+4
$23:=$23-1
=
ENDWHILE
ENDIF
ENDIF
ENDIF
ELSEIF $63
{$5,$6},x:12,f:CXm
ELSE
$10:=$5+0x20
$11:=$7+8
IF $8 & gt; =2 AND {$7,2}=0x0510
x:12,f:Label:
{$5,$6},x:18,f:U
ELSEIF $8 & gt; =4 AND {$7,4}=0x020030 AND $6 & gt; =0x20
x:12,f:Obj. Id & gt; 0x
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
$5:=$5+0x08
$OPENFILENUM:={$5,8},x:24,f:%X
ELSEIF (NOT $59 OR $6=0x30) AND {$5,8} AND $6 & gt; =0x28 AND {$10,8}=0x0808020000
x:12,f:Page & gt; 0x
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
$OPENCLUSTER:={$5,8},x:24,f:%X
ELSEIF ($60=2) OR ($60=4)
x:12,f:Page & gt; 0x
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
$5:=$5+0x20
$OPENCLUSTER:={$5,8},x:24,f:%X
ELSEIF $60 & gt; =0x500 AND $8=0x0E AND {$11,6}=0x38 AND $6 & gt; =0x60 AND {$5,4}=0
$10:=$5+0x0C+0x08
x:12,f:Obj. Id & gt; 0x
$OPENTEMPLATE:='{2bf504cd-5185-ff23-a9bc-929a1abdcf79}'
$OPENFILENUM:={$10,8},x:24,f:%X
=
$10:=$5+0x5E
$11:=$5+0x54
$11:={$11,1}*2
IF 0x5E+$11 & gt; $6
$11:=$6-0x5E
ENDIF
{$10,$11},x:18,f:U
ENDIF
=
ENDIF
$3:=$3-1
ENDWHILE
$XOFS:=1
$OFFSET:=$4
$1:={0x10,4}
$3:={0x14,4}
IF $3 & gt; 0 AND $1+4 & lt; =$RECSIZE
$10:=$OFFSET+$1
$63:=TOGGLE:$10,x:0,f:Entries Offsets
=
IF $63
WHILE $3 & gt; 0 AND $1+4 & lt; =$RECSIZE
x:4,f:0x
$10:=$OFFSET+$1
$10,x:6,f:%X:
x:12,f: & gt; 0x
$GOTORECOFS:=$OFFSET+{$1,4}
{$1,4},x:16,f:%X
$1:=$1+4
$3:=$3-1
=
ENDWHILE
ENDIF
ENDIF
ENDIF
[APFS Node]
guid:{d9e4fb83-4991-9aa6-7d0e-929edde456ed}
CALCSIZESTART
IF $1 & lt; =0
;recsize is not given
IF (({0x18,4} & 0xffff) = 1) AND ({0x20,4}=0x4253584E)
$1:= {0x24,4}
ENDIF
ENDIF
IF ({0x24,4} & gt; =512) AND ({0x24,4} & lt; =0x100000)
$RECSIZE:= $1
ELSE
$RECSIZE:= 4096
ENDIF
CALCSIZEEND
$1:= $RECSIZE
IF $2 & lt; =0
;partition offset is not given
IF (({0x18,4} & 0xffff) = 1) AND ({0x20,4}=0x4253584E)
$2:= $RECDEVOFS
ENDIF
ENDIF
$partofs:= $2
$XOFS:= 1
$expanded:= TOGGLE:0,x:0
x:4,f:obj_phys
$XOFS:= 5
$objtype:= {0x18,4} & 0xffff
$storagetype:= {0x18,4} & 0xc0000000
IF $expanded
=
x:0,f:o_cksum
{8},x:10,f:%X
=
x:0,f:o_oid
{8},x:10,f:%X
=
ELSE
$NEXTOFS:=0x08
{8},x:10,f:%X
=
ENDIF
x:0,f:o_xid
{8},x:10,f:%X
=
x:0,f:o_type
{4},x:10,f:%X
IF $objtype=1
x:26,f:NX_SUPERBLOCK
ELSEIF $objtype=2
x:26,f:BTREE
ELSEIF $objtype=3
x:26,f:BTREE_NODE
ELSEIF $objtype=5
x:26,f:SPACEMAN
ELSEIF $objtype=0xB
x:26,f:OMAP
ELSEIF $objtype=0xC
x:26,f:CHECKPOINT_MAP
ELSEIF $objtype=0xD
x:26,f:FS
ELSEIF $objtype=0x11
x:26,f:NX_REAPER
ENDIF
IF $storagetype=0
x:42,f:OBJ_VIRTUAL
ELSEIF $storagetype=0x80000000
x:42,f:OBJ_EPHEMERAL
ELSEIF $storagetype=0x40000000
x:42,f:OBJ_PHYSICAL
ELSE
x:42,c:8,f:OBJ_ERRTYPE
ENDIF
=
;#define OBJ_VIRTUAL 0x00000000
;#define OBJ_EPHEMERAL 0x80000000
;#define OBJ_PHYSICAL 0x40000000
;#define OBJ_NOHEADER 0x20000000
;#define OBJ_ENCRYPTED 0x10000000
;#define OBJ_NONPERSISTENT 0x08000000
$subtype:={$NEXTOFS,4}
IF $expanded
x:0,f:o_subtype
{4},x:10,f:%X
=
ENDIF
$XOFS:=1
$NEXTOFS:=0x20
IF $objtype=1
;NX_SUPERBLOCK
$xt:=24
x:0,f:nx_magic ( " NXSB " )
{4},x:$xt,f:%4c
=
x:0,f:nx_block_size
{4},x:$xt,f:%u
=
x:0,f:nx_block_count
{8},x:$xt,f:%u
=
x:0,f:nx_features 0x
{8},x:$xt,f:%X
=
x:0,f:nx_ro_compat_features 0x
{8},x:$xt,f:%X
=
x:0,f:nx_incompat_features 0x
{8},x:$xt,f:%X
=
x:0,f:nx_uuid
{16},x:$xt-6,f:CXm
=
x:0,f:nx_next_oid 0x
{8},x:$xt,f:%X
=
x:0,f:nx_next_xid 0x
{8},x:$xt,f:%X
=
x:0,f:nx_xp_desc_blocks 0x
{4},x:$xt,f:%X
=
x:0,f:nx_xp_data_blocks 0x
{4},x:$xt,f:%X
=
x:0,f:nx_xp_desc_base 0x
{8},x:$xt,f:%X
=
x:0,f:nx_xp_data_base 0x
{8},x:$xt,f:%X
=
$OPENTEMPLATE:='{d9e4fb83-4991-9aa6-7d0e-929edde456ed}'
$OPENDEVOFS:=$partofs+(2+{$NEXTOFS,4})*$RECSIZE
x:0,f:nx_xp_desc_next & gt; 0x
{4},x:$xt,f:%X
=
x:0,f:nx_xp_data_next 0x
{4},x:$xt,f:%X
=
x:0,f:nx_xp_desc_index 0x
{4},x:$xt,f:%X
=
x:0,f:nx_xp_desc_len 0x
{4},x:$xt,f:%X
=
x:0,f:nx_xp_data_index 0x
{4},x:$xt,f:%X
=
x:0,f:nx_xp_data_len 0x
{4},x:$xt,f:%X
=
x:0,f:nx_spaceman_oid 0x
{8},x:$xt,f:%X
=
$OPENTEMPLATE:='{d9e4fb83-4991-9aa6-7d0e-929edde456ed}'
$OPENDEVOFS:=$partofs+{$NEXTOFS,8}*$RECSIZE
x:0,f:nx_omap_oid & gt; 0x
{8},x:$xt,f:%X
=
x:0,f:nx_reaper_oid 0x
{8},x:$xt,f:%X
=
x:0,f:nx_test_type 0x
{4},x:$xt,f:%X
=
$count:={$NEXTOFS,4}
x:0,f:nx_max_file_systems 0x
{4},x:$xt,f:%X
=
$i:=0
WHILE ($i & lt; $count) AND ($NEXTOFS+0x08 & lt; =$RECSIZE)
$i,x:0,f:nx_fs_oid[%u]
$i:=$i+1
x:$xt-2,f:0x
{8},x:$xt,f:%X
=
ENDWHILE
x:0,f:...
ELSEIF $objtype=0xC
;CHECKPOINT_MAP
x:0,f:cpm_flags 0x
{4},x:14,f:%X
=
x:0,f:cpm_count
$count:={$NEXTOFS,4}
{4},x:14,f:%u
=
$i:=0
WHILE $i & lt; $count AND $NEXTOFS+0x28 & lt; =$RECSIZE
$i,x:4,f:cpm_map[%u]
$i:=$i+1
$expanded:=TOGGLE:$NEXTOFS,x:0
$entryofs:=$NEXTOFS
=
IF $expanded
$XOFS:=$XOFS+4
$objtype:={$NEXTOFS,4} & 0xffff
$storagetype:={$NEXTOFS,4} & 0xc0000000
x:0,f:cpm_type 0x
{4},x:14,f:%X
IF $objtype=1
x:26,f:NX_SUPERBLOCK
ELSEIF $objtype=2
x:26,f:BTREE
ELSEIF $objtype=5
x:26,f:SPACEMAN
ELSEIF $objtype=0xC
x:26,f:CHECKPOINT_MAP
ELSEIF $objtype=0x11
x:26,f:NX_REAPER
ENDIF
IF $storagetype=0
x:42,f:OBJ_VIRTUAL
ELSEIF $storagetype=0x80000000
x:42,f:OBJ_EPHEMERAL
ELSEIF $storagetype=0x40000000
x:42,f:OBJ_PHYSICAL
ELSE
x:42,c:8,f:OBJ_ERRTYPE
ENDIF
=
x:0,f:cpm_subtype 0x
{4},x:14,f:%X
=
x:0,f:cpm_size 0x
{4},x:14,f:%X
=
x:0,f:cpm_pad 0x
{4},x:14,f:%X
=
x:0,f:cpm_fs_oid 0x
{8},x:14,f:%X
=
x:0,f:cpm_oid 0x
{8},x:14,f:%X
=
$OPENTEMPLATE:='{d9e4fb83-4991-9aa6-7d0e-929edde456ed}'
$OPENDEVOFS:=$partofs+{$NEXTOFS,8}*$RECSIZE
x:0,f:cpm_paddr & gt; 0x
{8},x:14,f:%X
=
$XOFS:=$XOFS-4
ENDIF
$NEXTOFS:=$entryofs+0x28
ENDWHILE
ELSEIF $objtype=0x2 OR $objtype=0x3
;B-tree node
$xt:=24
x:0,f:btn_flags 0x
$flags:={$NEXTOFS,2}
$valsofs:=$RECSIZE
{2},x:$xt,f:%X
IF $flags & 0x1
x:$xt+6,f:ROOT
$valsofs:=$valsofs-0x28
ENDIF
IF $flags & 0x2
x:$xt+11,f:LEAF
ENDIF
IF $flags & 0x4
x:$xt+16,f:FIX_KVS
ENDIF
IF $flags & 0x8000
x:$xt+24,c:8,f:CHK_INVAL
ENDIF
=
x:0,f:btn_level 0x
{2},x:$xt,f:%X
=
$nkeys:={$NEXTOFS,4}
x:0,f:btn_nkeys
{4},x:$xt,f:%u
=
$tocofs:={$NEXTOFS,2}
x:0,f:btn_table_space.off 0x
{2},x:$xt,f:%X
=
$keysofs:=$tocofs+{$NEXTOFS,2}
x:0,f:btn_table_space.len 0x
{2},x:$xt,f:%X
=
x:0,f:btn_free_space.off 0x
{2},x:$xt,f:%X
=
x:0,f:btn_free_space.len 0x
{2},x:$xt,f:%X
=
x:0,f:btn_key_free_list.off 0x
{2},x:$xt,f:%X
=
x:0,f:btn_key_free_list.len 0x
{2},x:$xt,f:%X
=
x:0,f:btn_val_free_list.off 0x
{2},x:$xt,f:%X
=
x:0,f:btn_val_free_list.len 0x
{2},x:$xt,f:%X
=
$dataofs:=$NEXTOFS
$keysofs:=$dataofs+$keysofs
$NEXTOFS:=$dataofs+$tocofs
$expanded:=TOGGLE:$NEXTOFS,x:0
x:4,f:TOC
=
IF $expanded
$i:=0
$XOFS:=$XOFS+4
WHILE $i & lt; $nkeys
$i:=$i+1
IF $flags & 0x4
IF $NEXTOFS+4 & gt; $RECSIZE
BREAK
ENDIF
x:0,f:k:
{2},x:2,f:%X
x:8,f:v:
{2},x:10,f:%X
ELSE
IF $NEXTOFS+8 & gt; $RECSIZE
BREAK
ENDIF
x:0,f:k.off:
{2},x:6,f:%X
x:12,f:k.len:
{2},x:18,f:%X
x:24,f:v.off:
{2},x:30,f:%X
x:36,f:v.len:
{2},x:42,f:%X
ENDIF
=
ENDWHILE
$XOFS:=$XOFS-4
ENDIF
$NEXTOFS:=$dataofs+$tocofs
;$expanded:=TOGGLE:$NEXTOFS,x:0
;IF $expanded
$i:=0
$xk:=0
IF $flags & 0x4
x:0,f:kofs vofs
$xk:=10
ELSE
x:0,f:kofs/l vofs/l
$xk:=16
ENDIF
IF $subtype=0xB AND $flags & 0x2
x:$xk,f:ok_oid ok_xid ov_flags ov_size ov_paddr
ELSEIF $subtype=0xB
x:$xk,f:ok_oid ok_xid obj_id
ELSEIF $subtype=0xE
x:$xk,f:obj_id type
ENDIF
=
WHILE $i & lt; $nkeys
;$i,x:0,f:key[%d]
$i:=$i+1
$keyofs:=0
$valofs:=0
$valsz:=0
IF $flags & 0x4
IF $NEXTOFS+4 & gt; $RECSIZE
=
BREAK
ENDIF
$keyofs:=$keysofs+{2}
$keyofs,x:0,f:%X
$valofs:={2}
IF ($valofs=0xffff)
$valofs:=-1
x:5,f:-
ELSE
$valofs:=$valsofs-$valofs
$valofs,x:5,f:%X
ENDIF
ELSE
IF $NEXTOFS+8 & gt; $RECSIZE
=
BREAK
ENDIF
$keyofs:=$keysofs+{2}
$keysz:={2}
$valofs:=$valsofs-{2}
$valsz:={2}
$keyofs|$keysz & lt; & lt; 32,x:0,f:%X/%X
$valofs|$valsz & lt; & lt; 32,x:8,f:%X/%X
ENDIF
IF $subtype=0xB
{$keyofs,8},x:10,f:%X
{$keyofs+8,8},x:26,f:%X
IF $flags & 0x2
{$valofs,4},x:42,f:%X
{$valofs+4,4},x:51,f:%X
$OPENTEMPLATE:='{d9e4fb83-4991-9aa6-7d0e-929edde456ed}'
$OPENDEVOFS:=$partofs+{$valofs+8,8}*$RECSIZE
x:59,f: & gt;
{$valofs+8,8},x:60,f:%X
ELSE
$OPENTEMPLATE:='{d9e4fb83-4991-9aa6-7d0e-929edde456ed}'
$OPENDEVOFS:=$partofs+{$valofs,8}*$RECSIZE
x:43,f: & gt;
{$valofs,8},x:44,f:%X
ENDIF
ELSEIF $subtype=0xE
{$keyofs:0,60},x:$xk,f:%X
{$keyofs:60,4},x:$xk+16,f:%X
$etype:={$keyofs:60,4}
$nlen:=0
IF $etype=5
x:$xk+18,f: & gt;
$OPENFILENUM:={$keyofs+8,8},x:$xk+19,f:%X
ELSEIF $etype=8
{$keyofs+8,8},x:$xk+22,f:%X
ENDIF
IF ($flags & 0x2)=0
x:59,f: & gt;
$OPENVOLPAGE:={$valofs,8},x:60,f:%X
ELSEIF $etype=5
{$valofs,8},x:$xk+30,f:%X
$l:={$valofs+8,2}
IF $l & gt; 0
{$valofs+10,$l},x:$xk+39,f:u
ENDIF
ELSEIF $etype=6
{$valofs,4},x:$xk+22,f:%X
ELSEIF $etype=8
{$valofs,8},x:$xk+36,f:%X
$OPENDEVOFS:=$partofs+{$valofs+8,8}*$RECSIZE
x:$xk+51,f: & gt;
{$valofs+8,8},x:$xk+52,f:%X
ELSEIF $etype=9
x:$xk+18,f: & gt;
$OPENFILENUM:={$valofs,8},x:$xk+19,f:%X
{$keyofs+8,4},x:$xk+35,f:%08X
$l:={$keyofs+8,2} & 0x3ff
IF $l & gt; 0
{$keyofs+12,$l},x:$xk+44,f:u
ENDIF
ELSEIF $etype=3
x:$xk+18,f: & gt;
$OPENFILENUM:={$valofs,8},x:$xk+19,f:%X
$exp:=TOGGLE:$valofs,x:$xk+35
$xv:=$xk+35
IF $exp
=
x:$xv-14,f:private_id:
{$valofs+8,8},x:$xv,f:%X
=
x:$xv-14,f:create_time:
{$valofs+0x10,8},x:$xv,f:%X
=
x:$xv-14,f:mod_time:
{$valofs+0x18,8},x:$xv,f:%X
=
x:$xv-14,f:change_time:
{$valofs+0x20,8},x:$xv,f:%X
=
x:$xv-14,f:access_time:
{$valofs+0x28,8},x:$xv,f:%X
=
x:$xv-14,f:intern_flags:
{$valofs+0x30,8},x:$xv,f:%X
=
x:$xv-14,f:n_child/link:
{$valofs+0x38,4},x:$xv,f:%X
=
x:$xv-14,f:def_prot_cls:
{$valofs+0x3C,4},x:$xv,f:%X
=
x:$xv-14,f:wr_gen_count:
{$valofs+0x40,4},x:$xv,f:%X
=
x:$xv-14,f:bsd_flags:
{$valofs+0x44,4},x:$xv,f:%X
=
x:$xv-14,f:owner:
{$valofs+0x48,4},x:$xv,f:%X
=
x:$xv-14,f:group:
{$valofs+0x4C,4},x:$xv,f:%X
=
x:$xv-14,f:mode:
{$valofs+0x50,2},x:$xv,f:%X
=
x:$xv-14,f:pad1:
{$valofs+0x52,2},x:$xv,f:%X
=
x:$xv-14,f:pad2:
{$valofs+0x54,8},x:$xv,f:%X
ENDIF
IF ($valsz & gt; 0x60)
$v:=$valofs+0x5C
IF $exp
=
x:$xv-14,f:xf_num_exts:
{$v,2},x:$xv,f:%X
=
x:$xv-14,f:xf_used_data:
{$v+2,2},x:$xv,f:%X
ENDIF
$_vnum:={$v,2}
$_vsz:=$valsz-0x60
$v:=$v+4
$_dofs:=$v
$_dxofs:=$_vnum*4
WHILE ($_vsz & gt; =4) AND ($_vnum & gt; 0)
IF $exp
=
x:$xv-12,f:x_type:
{$v,1},x:$xv+2,f:%X
=
x:$xv-12,f:x_flags:
{$v+1,1},x:$xv+2,f:%X
=
x:$xv-12,f:x_size:
{$v+2,2},x:$xv+2,f:%X
ENDIF
IF {$v,1} = 4
$_x:=$xv+9
IF $exp
=
x:$xv-10,f:name:
$_x:=$xv+2
ENDIF
{$_dofs+$_dxofs,{$v+2,2}},x:$_x,f:u
ENDIF
$_dxofs:=($_dxofs+{$v+2,2}+7) & ~7
$_vsz:=$_vsz-4
$_vnum:=$_vnum-1
$v:=$v+4
ENDWHILE
ENDIF
ELSE
x:$xk+18,f: & gt;
$OPENFILENUM:={$valofs,8},x:$xk+19,f:%X
ENDIF
ENDIF
=
ENDWHILE
;ENDIF
ELSEIF $objtype=0xB
;OMAP
$xt:=24
x:0,f:om_flags 0x
{4},x:$xt,f:%X
=
x:0,f:om_snapshot 0x
{4},x:$xt,f:%X
=
x:0,f:om_treetype 0x
{4},x:$xt,f:%X
=
x:0,f:om_snapshot_treetype 0x
{4},x:$xt,f:%X
=
$OPENTEMPLATE:='{d9e4fb83-4991-9aa6-7d0e-929edde456ed}'
$OPENDEVOFS:=$partofs+{$NEXTOFS,8}*$RECSIZE
x:0,f:om_tree_oid & gt; 0x
{8},x:$xt,f:%X
=
x:0,f:om_scanpshot_tree_oid 0x
{8},x:$xt,f:%X
=
x:0,f:om_most_recent_snap 0x
{8},x:$xt,f:%X
=
x:0,f:om_pending_revert_min 0x
{8},x:$xt,f:%X
=
x:0,f:om_pending_revert_max 0x
{8},x:$xt,f:%X
ELSEIF $objtype=0xD
;FS
$xt:= 32
x:0,f:apfs_magic ( " APSB " )
{4},x:$xt,f:%4c
=
x:0,f:apfs_fs_index
{4},x:$xt,f:%u
=
x:0,f:apfs_features 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_ro_compat_features 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_incompat_features 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_unmount_time 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_fs_reserve_block_count 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_fs_quota_block_count 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_fs_alloc_count 0x
{8},x:$xt,f:%X
=
;x:0,f:apfs_meta_crypto
;{0x14}
$NEXTOFS:=$NEXTOFS+0x14
;=
x:0,f:apfs_root_tree_type 0x
{4},x:$xt,f:%X
=
x:0,f:apfs_extentref_tree_type 0x
{4},x:$xt,f:%X
=
x:0,f:apfs_snap_meta_tree_type 0x
{4},x:$xt,f:%X
=
$OPENTEMPLATE:='{d9e4fb83-4991-9aa6-7d0e-929edde456ed}'
$OPENDEVOFS:=$partofs+{$NEXTOFS,8}*$RECSIZE
x:0,f:apfs_omap_oid & gt; 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_root_tree_oid 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_extentref_tree_oid 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_snap_meta_tree_oid 0x
{8},x:$xt,f:%X
=
;apfs_revert_to_xid: QWORD;
;apfs_revert_to_sblock_oid: QWORD;
$NEXTOFS:= $NEXTOFS + 16
x:0,f:apfs_next_obj_oid 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_num_files 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_num_directories 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_num_symlinks 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_num_other_fsobjects 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_num_snapshots 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_total_blocks_alloced 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_total_blocks_freed 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_vol_uuid
{16},x:$xt-6,f:CXm
=
x:0,f:apfs_last_mod_time 0x
{8},x:$xt,f:%X
=
x:0,f:apfs_fs_flags 0x
{8},x:$xt,f:%X
=
;apfs_formatted_by: apfs_modified_by_t;
;apfs_modified_by: [APFS_MAX_HIST] of apfs_modified_by_t;
$NEXTOFS:=$NEXTOFS + 9 * (32+16)
x:0,f:apfs_volname
{256},x:$xt,f:u
=
;apfs_next_doc_id {4}
;apfs_role {2}
;reserved {2}
;apfs_root_to_xid {8}
;apfs_er_state_oid {8}
ENDIF
DMDE 3.8 - DM Disk Editor and Data Recovery Software
Copyright (C) 2005-2020 Dmitry Sidorov
http://dmde.com/
http://softdm.com/
END-USER LICENSE AGREEMENT
This End-User License Agreement ( " EULA " ) is a legal agreement
between you (either a natural person or juridical entity) and
the SOFTWARE author Dmitry Sidorov. By using the SOFTWARE you
agree to all terms of the EULA.
1. GRANT OF LICENSE
1.0. EDITIONS
The scope of granted rights depends on the EDITION (license type)
and the number of license copies provided for you.
The EDITION, the number of copies, and the number of supported OS
platforms is specified in your license order. For the EDITION, the
number of copies, and the license end date see also the SOFTWARE
" About " box (access is through the menu " Help " ). If the number of
copies is not specified expressly then one (1) license is provided.
If the license end date is not specified then there is no time limit.
1.1. FREE EDITION
For FREE EDITION only the paragraphs 1.1, 5, and 6 are applied.
An unlimited number of FREE EDITION copies may be used for non-
commercial purposes including educational purposes of institutions
and evaluation purposes. Only files from the current panel may be
recovered and no more than 4000 files at a time (per command call).
You may reproduce and distribute FREE EDITION copies under the
following set of conditions only: the SOFTWARE is obtained directly
from the SOFTWARE author or on the SOFTWARE websites; keys and other
components of other EDITIONS are not transmitted; the composition
and components of the SOFTWARE are not changed (except for
reversible transcoding); the SOFTWARE origin, authorship, terms of
this EULA are available to the end user explicitly. FREE EDITION may
be included in free and paid packages.
1.2.1. EDITIONS " EXPRESS " AND " PERSONAL " : PERSONAL USE ONLY
With the editions " EXPRESS " and " PERSONAL " , you may use the SOFTWARE
for personal non-commercial purposes only. The usage in
organizations and any direct or indirect benefit are prohibited.
1.2.2. STANDARD EDITION: USE FOR OWN NEEDS ONLY
With STANDARD EDITION, you may use the SOFTWARE as a person or
organization for own needs only. Data recovery services for third
parties are prohibited. In particular, any organization or its
employee or other person providing data recovery services may not
use the SOFTWARE.
1.3. RIGHTS TO RUN AND KEEP SOFTWARE COPIES
You may simultaneously run instances of the SOFTWARE within the
number of provided license copies (the number of unfinished processes
must not exceed the number of license copies).
In total, you may create and keep two (2) SOFTWARE copies more than
the number of license copies. A single copy may include multiple
SOFTWARE versions in the same data storage.
2. ACTIVATION
Activation associates the SOFTWARE run to a specific computer
hardware configuration and unlocks full SOFTWARE functionality.
Activation requires sending a hardware identification code to
SOFTWARE activation sites to obtain an unlocking code.
Activation may be rejected if you run the SOFTWARE on more than
three (3) hardware configurations per year per license copy. The
CPU or motherboard change (including ROM-stored serial number
change), the use of additional virtualization imply the change
of hardware. Some other hardware or software changes may require
additional (allowed) SOFTWARE reactivation.
If the license expires, you may continue using the SOFTWARE
in the previous environment, however, no support, including
reactivation, is provided.
3. SOFTWARE UPDATES
If the existing version support discontinues you may use the
succeeding available version, and the newer agreement replaces the
previous one in those stipulations only which clarify the terms and
explicitly enhance your rights. In other cases updates may be used
entirely under the terms of new supplied license agreements only.
You may use previous available SOFTWARE versions under the terms
of this EULA too. However running previous versions (considering the
number before the first dot) is regarded as a run on a different
hardware assuming the restrictions of the paragraph 2.
4. SOFTWARE UPGRADES
Upgrade is a change of a complete set, the number of license copies,
or the EDITION. To apply the SOFTWARE upgrade, you must first have a
license that is eligible for the upgrade. Upon the upgrade, the new
agreement supersedes the previous one, and you may no longer use keys
and other components provided under the previous license.
5. DESCRIPTION OF OTHER RIGHTS AND LIMITATIONS
You may not use the SOFTWARE otherwise than expressly provided by
law, this EULA, and additional agreements with the SOFTWARE author.
This EULA does not grant you rights to create derivative work, to
reverse engineer, decompile, disassemble, or otherwise study the
SOFTWARE code, nor to sell, rent, lease or sublicense the SOFTWARE.
Violation of any EULA terms automatically terminates the EULA and
your rights to use the SOFTWARE.
The SOFTWARE author retains all the rights of the author.
6. LIMITED WARRANTY
THE AUTHOR OF THE SOFTWARE EXPRESSLY DISCLAIMS ANY WARRANTY FOR
THE SOFTWARE. THE SOFTWARE AND ANY RELATED DOCUMENTATION IS
PROVIDED " AS IS " WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED WARRANTIES
OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR
NON-INFRINGEMENT. THE ENTIRE RISK ARISING OUT OF USE OR
PERFORMANCE OF THE SOFTWARE REMAINS WITH YOU. IN NO EVENT SHALL
THE AUTHOR OF THE SOFTWARE BE LIABLE FOR ANY DAMAGES WHATSOEVER
ARISING OUT OF USE OR INABILITY TO USE THE SOFTWARE (INCLUDING
BUT NOT LIMITED TO ANY DATA LOSS OR DISTORTION, LOSS OF BUSINESS
PROFITS, BUSINESS INTERRUPTION, LOSS OF BUSINESS INFORMATION,
PERSONAL INJURY, LOSS OF PRIVACY OR OTHER PECUNIARY OR OTHER
LOSS WHATSOEVER), EVEN IF THE AUTHOR HAS BEEN ADVISED OF THE
POSSIBILITY OF SUCH DAMAGES.