---
name: "libfsntfs"
section: "3"
platform: "linux"
package: "libfsntfs-dev"
version: "20240501-1+b1"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/libfsntfs"
---

# libfsntfs(3)

Library to access the Windows New Technology File System (NTFS) format

## NAME

**libfsntfs.h** – Library to access the Windows New Technology File System (NTFS) format

## SYNOPSIS

**#include \<libfsntfs.h\>**

Support functions

*const* *char* *\**\

**libfsntfs\_get\_version**(*void*);

*int*\

**libfsntfs\_get\_access\_flags\_read**(*void*);

*int*\

**libfsntfs\_get\_codepage**(*int \*codepage*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_set\_codepage**(*int codepage*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_check\_volume\_signature**(*const char \*filename*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_check\_mft\_metadata\_file\_signature**(*const char \*filename*, *libfsntfs\_error\_t \*\*error*);

Available when compiled with wide character string support:

*int*\

**libfsntfs\_check\_volume\_signature\_wide**(*const wchar\_t \*filename*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_check\_mft\_metadata\_file\_signature\_wide**(*const wchar\_t \*filename*, *libfsntfs\_error\_t \*\*error*);

Available when compiled with libbfio support:

*int*\

**libfsntfs\_check\_volume\_signature\_file\_io\_handle**(*libbfio\_handle\_t \*file\_io\_handle*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_check\_mft\_metadata\_file\_signature\_file\_io\_handle**(*libbfio\_handle\_t \*file\_io\_handle*, *libfsntfs\_error\_t \*\*error*);

Notify functions

*void*\

**libfsntfs\_notify\_set\_verbose**(*int verbose*);

*int*\

**libfsntfs\_notify\_set\_stream**(*FILE \*stream*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_notify\_stream\_open**(*const char \*filename*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_notify\_stream\_close**(*libfsntfs\_error\_t \*\*error*);

Error functions

*void*\

**libfsntfs\_error\_free**(*libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_error\_fprint**(*libfsntfs\_error\_t \*error*, *FILE \*stream*);

*int*\

**libfsntfs\_error\_sprint**(*libfsntfs\_error\_t \*error*, *char \*string*, *size\_t size*);

*int*\

**libfsntfs\_error\_backtrace\_fprint**(*libfsntfs\_error\_t \*error*, *FILE \*stream*);

*int*\

**libfsntfs\_error\_backtrace\_sprint**(*libfsntfs\_error\_t \*error*, *char \*string*, *size\_t size*);

Volume functions

*int*\

**libfsntfs\_volume\_initialize**(*libfsntfs\_volume\_t \*\*volume*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_free**(*libfsntfs\_volume\_t \*\*volume*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_signal\_abort**(*libfsntfs\_volume\_t \*volume*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_open**(*libfsntfs\_volume\_t \*volume*, *const char \*filename*, *int access\_flags*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_close**(*libfsntfs\_volume\_t \*volume*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_has\_bitlocker\_drive\_encryption**(*libfsntfs\_volume\_t \*volume*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_has\_volume\_shadow\_snapshots**(*libfsntfs\_volume\_t \*volume*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_get\_bytes\_per\_sector**(*libfsntfs\_volume\_t \*volume*, *uint16\_t \*bytes\_per\_sector*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_get\_cluster\_block\_size**(*libfsntfs\_volume\_t \*volume*, *size32\_t \*cluster\_block\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_get\_mft\_entry\_size**(*libfsntfs\_volume\_t \*volume*, *size32\_t \*mft\_entry\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_get\_index\_entry\_size**(*libfsntfs\_volume\_t \*volume*, *size32\_t \*index\_entry\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_get\_utf8\_name\_size**(*libfsntfs\_volume\_t \*volume*, *size\_t \*utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_get\_utf8\_name**(*libfsntfs\_volume\_t \*volume*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_get\_utf16\_name\_size**(*libfsntfs\_volume\_t \*volume*, *size\_t \*utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_get\_utf16\_name**(*libfsntfs\_volume\_t \*volume*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_get\_version**(*libfsntfs\_volume\_t \*volume*, *uint8\_t \*major\_version*, *uint8\_t \*minor\_version*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_get\_flags**(*libfsntfs\_volume\_t \*volume*, *uint16\_t \*flags*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_get\_serial\_number**(*libfsntfs\_volume\_t \*volume*, *uint64\_t \*serial\_number*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_get\_root\_directory**(*libfsntfs\_volume\_t \*volume*, *libfsntfs\_file\_entry\_t \*\*file\_entry*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_get\_number\_of\_file\_entries**(*libfsntfs\_volume\_t \*volume*, *uint64\_t \*number\_of\_file\_entries*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_get\_file\_entry\_by\_index**(*libfsntfs\_volume\_t \*volume*, *uint64\_t mft\_entry\_index*, *libfsntfs\_file\_entry\_t \*\*file\_entry*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_get\_file\_entry\_by\_utf8\_path**(*libfsntfs\_volume\_t \*volume*, *const uint8\_t \*utf8\_string*, *size\_t utf8\_string\_length*, *libfsntfs\_file\_entry\_t \*\*file\_entry*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_get\_file\_entry\_by\_utf16\_path**(*libfsntfs\_volume\_t \*volume*, *const uint16\_t \*utf16\_string*, *size\_t utf16\_string\_length*, *libfsntfs\_file\_entry\_t \*\*file\_entry*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_get\_usn\_change\_journal**(*libfsntfs\_volume\_t \*volume*, *libfsntfs\_usn\_change\_journal\_t \*\*usn\_change\_journal*, *libfsntfs\_error\_t \*\*error*);

Available when compiled with wide character string support:

*int*\

**libfsntfs\_volume\_open\_wide**(*libfsntfs\_volume\_t \*volume*, *const wchar\_t \*filename*, *int access\_flags*, *libfsntfs\_error\_t \*\*error*);

Available when compiled with libbfio support:

*int*\

**libfsntfs\_volume\_open\_file\_io\_handle**(*libfsntfs\_volume\_t \*volume*, *libbfio\_handle\_t \*file\_io\_handle*, *int access\_flags*, *libfsntfs\_error\_t \*\*error*);

File entry functions

*int*\

**libfsntfs\_file\_entry\_free**(*libfsntfs\_file\_entry\_t \*\*file\_entry*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_is\_empty**(*libfsntfs\_file\_entry\_t \*file\_entry*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_is\_allocated**(*libfsntfs\_file\_entry\_t \*file\_entry*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_is\_corrupted**(*libfsntfs\_file\_entry\_t \*file\_entry*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_file\_reference**(*libfsntfs\_file\_entry\_t \*file\_entry*, *uint64\_t \*file\_reference*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_base\_record\_file\_reference**(*libfsntfs\_file\_entry\_t \*file\_entry*, *uint64\_t \*file\_reference*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_parent\_file\_reference**(*libfsntfs\_file\_entry\_t \*file\_entry*, *uint64\_t \*parent\_file\_reference*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_parent\_file\_reference\_by\_attribute\_index**(*libfsntfs\_file\_entry\_t \*file\_entry*, *int attribute\_index*, *uint64\_t \*parent\_file\_reference*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_journal\_sequence\_number**(*libfsntfs\_file\_entry\_t \*file\_entry*, *uint64\_t \*journal\_sequence\_number*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_creation\_time**(*libfsntfs\_file\_entry\_t \*file\_entry*, *uint64\_t \*filetime*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_modification\_time**(*libfsntfs\_file\_entry\_t \*file\_entry*, *uint64\_t \*filetime*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_access\_time**(*libfsntfs\_file\_entry\_t \*file\_entry*, *uint64\_t \*filetime*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_entry\_modification\_time**(*libfsntfs\_file\_entry\_t \*file\_entry*, *uint64\_t \*filetime*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_file\_attribute\_flags**(*libfsntfs\_file\_entry\_t \*file\_entry*, *uint32\_t \*file\_attribute\_flags*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_utf8\_name\_size**(*libfsntfs\_file\_entry\_t \*file\_entry*, *size\_t \*utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_utf8\_name**(*libfsntfs\_file\_entry\_t \*file\_entry*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_utf16\_name\_size**(*libfsntfs\_file\_entry\_t \*file\_entry*, *size\_t \*utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_utf16\_name**(*libfsntfs\_file\_entry\_t \*file\_entry*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_name\_attribute\_index**(*libfsntfs\_file\_entry\_t \*file\_entry*, *int \*attribute\_index*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_utf8\_name\_size\_by\_attribute\_index**(*libfsntfs\_file\_entry\_t \*file\_entry*, *int attribute\_index*, *size\_t \*utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_utf8\_name\_by\_attribute\_index**(*libfsntfs\_file\_entry\_t \*file\_entry*, *int attribute\_index*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_utf16\_name\_size\_by\_attribute\_index**(*libfsntfs\_file\_entry\_t \*file\_entry*, *int attribute\_index*, *size\_t \*utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_utf16\_name\_by\_attribute\_index**(*libfsntfs\_file\_entry\_t \*file\_entry*, *int attribute\_index*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_utf8\_path\_hint\_size**(*libfsntfs\_file\_entry\_t \*file\_entry*, *int attribute\_index*, *size\_t \*utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_utf8\_path\_hint**(*libfsntfs\_file\_entry\_t \*file\_entry*, *int attribute\_index*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_utf16\_path\_hint\_size**(*libfsntfs\_file\_entry\_t \*file\_entry*, *int attribute\_index*, *size\_t \*utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_utf16\_path\_hint**(*libfsntfs\_file\_entry\_t \*file\_entry*, *int attribute\_index*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_utf8\_symbolic\_link\_target\_size**(*libfsntfs\_file\_entry\_t \*file\_entry*, *size\_t \*utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_utf8\_symbolic\_link\_target**(*libfsntfs\_file\_entry\_t \*file\_entry*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_utf16\_symbolic\_link\_target\_size**(*libfsntfs\_file\_entry\_t \*file\_entry*, *size\_t \*utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_utf16\_symbolic\_link\_target**(*libfsntfs\_file\_entry\_t \*file\_entry*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_security\_descriptor\_size**(*libfsntfs\_file\_entry\_t \*file\_entry*, *size\_t \*data\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_security\_descriptor**(*libfsntfs\_file\_entry\_t \*file\_entry*, *uint8\_t \*data*, *size\_t data\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_number\_of\_attributes**(*libfsntfs\_file\_entry\_t \*file\_entry*, *int \*number\_of\_attributes*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_attribute\_by\_index**(*libfsntfs\_file\_entry\_t \*file\_entry*, *int attribute\_index*, *libfsntfs\_attribute\_t \*\*attribute*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_has\_directory\_entries\_index**(*libfsntfs\_file\_entry\_t \*file\_entry*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_has\_default\_data\_stream**(*libfsntfs\_file\_entry\_t \*file\_entry*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_is\_symbolic\_link**(*libfsntfs\_file\_entry\_t \*file\_entry*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_number\_of\_alternate\_data\_streams**(*libfsntfs\_file\_entry\_t \*file\_entry*, *int \*number\_of\_alternate\_data\_streams*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_alternate\_data\_stream\_by\_index**(*libfsntfs\_file\_entry\_t \*file\_entry*, *int alternate\_data\_stream\_index*, *libfsntfs\_data\_stream\_t \*\*alternate\_data\_stream*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_has\_alternate\_data\_stream\_by\_utf8\_name**(*libfsntfs\_file\_entry\_t \*file\_entry*, *const uint8\_t \*utf8\_string*, *size\_t utf8\_string\_length*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_has\_alternate\_data\_stream\_by\_utf16\_name**(*libfsntfs\_file\_entry\_t \*file\_entry*, *const uint16\_t \*utf16\_string*, *size\_t utf16\_string\_length*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_alternate\_data\_stream\_by\_utf8\_name**(*libfsntfs\_file\_entry\_t \*file\_entry*, *const uint8\_t \*utf8\_string*, *size\_t utf8\_string\_length*, *libfsntfs\_data\_stream\_t \*\*alternate\_data\_stream*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_alternate\_data\_stream\_by\_utf16\_name**(*libfsntfs\_file\_entry\_t \*file\_entry*, *const uint16\_t \*utf16\_string*, *size\_t utf16\_string\_length*, *libfsntfs\_data\_stream\_t \*\*alternate\_data\_stream*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_number\_of\_sub\_file\_entries**(*libfsntfs\_file\_entry\_t \*file\_entry*, *int \*number\_of\_sub\_file\_entries*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_sub\_file\_entry\_by\_index**(*libfsntfs\_file\_entry\_t \*file\_entry*, *int sub\_file\_entry\_index*, *libfsntfs\_file\_entry\_t \*\*sub\_file\_entry*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_sub\_file\_entry\_by\_utf8\_name**(*libfsntfs\_file\_entry\_t \*file\_entry*, *const uint8\_t \*utf8\_string*, *size\_t utf8\_string\_length*, *libfsntfs\_file\_entry\_t \*\*sub\_file\_entry*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_sub\_file\_entry\_by\_utf16\_name**(*libfsntfs\_file\_entry\_t \*file\_entry*, *const uint16\_t \*utf16\_string*, *size\_t utf16\_string\_length*, *libfsntfs\_file\_entry\_t \*\*sub\_file\_entry*, *libfsntfs\_error\_t \*\*error*);

*ssize\_t*\

**libfsntfs\_file\_entry\_read\_buffer**(*libfsntfs\_file\_entry\_t \*file\_entry*, *void \*buffer*, *size\_t buffer\_size*, *libfsntfs\_error\_t \*\*error*);

*ssize\_t*\

**libfsntfs\_file\_entry\_read\_buffer\_at\_offset**(*libfsntfs\_file\_entry\_t \*file\_entry*, *void \*buffer*, *size\_t buffer\_size*, *off64\_t offset*, *libfsntfs\_error\_t \*\*error*);

*off64\_t*\

**libfsntfs\_file\_entry\_seek\_offset**(*libfsntfs\_file\_entry\_t \*file\_entry*, *off64\_t offset*, *int whence*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_offset**(*libfsntfs\_file\_entry\_t \*file\_entry*, *off64\_t \*offset*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_size**(*libfsntfs\_file\_entry\_t \*file\_entry*, *size64\_t \*size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_number\_of\_extents**(*libfsntfs\_file\_entry\_t \*file\_entry*, *int \*number\_of\_extents*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_entry\_get\_extent\_by\_index**(*libfsntfs\_file\_entry\_t \*file\_entry*, *int extent\_index*, *off64\_t \*extent\_offset*, *size64\_t \*extent\_size*, *uint32\_t \*extent\_flags*, *libfsntfs\_error\_t \*\*error*);

Attribute functions

*int*\

**libfsntfs\_attribute\_free**(*libfsntfs\_attribute\_t \*\*attribute*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_attribute\_get\_type**(*libfsntfs\_attribute\_t \*attribute*, *uint32\_t \*type*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_attribute\_get\_data\_flags**(*libfsntfs\_attribute\_t \*attribute*, *uint16\_t \*data\_flags*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_attribute\_get\_utf8\_name\_size**(*libfsntfs\_attribute\_t \*attribute*, *size\_t \*utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_attribute\_get\_utf8\_name**(*libfsntfs\_attribute\_t \*attribute*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_attribute\_get\_utf16\_name\_size**(*libfsntfs\_attribute\_t \*attribute*, *size\_t \*utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_attribute\_get\_utf16\_name**(*libfsntfs\_attribute\_t \*attribute*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_attribute\_get\_data\_vcn\_range**(*libfsntfs\_attribute\_t \*attribute*, *uint64\_t \*data\_first\_vcn*, *uint64\_t \*data\_last\_vcn*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_attribute\_get\_data\_size**(*libfsntfs\_attribute\_t \*attribute*, *size64\_t \*data\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_attribute\_get\_valid\_data\_size**(*libfsntfs\_attribute\_t \*attribute*, *size64\_t \*valid\_data\_size*, *libfsntfs\_error\_t \*\*error*);

$ATTRIBUTE\_LIST attribute functions

*int*\

**libfsntfs\_attribute\_list\_attribute\_get\_number\_of\_entries**(*libfsntfs\_attribute\_t \*attribute*, *int \*number\_of\_entries*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_attribute\_list\_attribute\_get\_entry\_by\_index**(*libfsntfs\_attribute\_t \*attribute*, *int entry\_index*, *libfsntfs\_attribute\_list\_entry\_t \*\*entry*, *libfsntfs\_error\_t \*\*error*);

Attribute list entry functions

*int*\

**libfsntfs\_attribute\_list\_entry\_free**(*libfsntfs\_attribute\_list\_entry\_t \*\*attribute\_list\_entry*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_attribute\_list\_entry\_get\_attribute\_type**(*libfsntfs\_attribute\_list\_entry\_t \*attribute\_list\_entry*, *uint32\_t \*attribute\_type*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_attribute\_list\_entry\_get\_file\_reference**(*libfsntfs\_attribute\_list\_entry\_t \*attribute\_list\_entry*, *uint64\_t \*file\_reference*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_attribute\_list\_entry\_get\_utf8\_name\_size**(*libfsntfs\_attribute\_list\_entry\_t \*attribute\_list\_entry*, *size\_t \*utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_attribute\_list\_entry\_get\_utf8\_name**(*libfsntfs\_attribute\_list\_entry\_t \*attribute\_list\_entry*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_attribute\_list\_entry\_get\_utf16\_name\_size**(*libfsntfs\_attribute\_list\_entry\_t \*attribute\_list\_entry*, *size\_t \*utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_attribute\_list\_entry\_get\_utf16\_name**(*libfsntfs\_attribute\_list\_entry\_t \*attribute\_list\_entry*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

$FILE\_NAME attribute functions

*int*\

**libfsntfs\_file\_name\_attribute\_get\_parent\_file\_reference**(*libfsntfs\_attribute\_t \*attribute*, *uint64\_t \*parent\_file\_reference*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_name\_attribute\_get\_creation\_time**(*libfsntfs\_attribute\_t \*attribute*, *uint64\_t \*filetime*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_name\_attribute\_get\_modification\_time**(*libfsntfs\_attribute\_t \*attribute*, *uint64\_t \*filetime*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_name\_attribute\_get\_access\_time**(*libfsntfs\_attribute\_t \*attribute*, *uint64\_t \*filetime*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_name\_attribute\_get\_entry\_modification\_time**(*libfsntfs\_attribute\_t \*attribute*, *uint64\_t \*filetime*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_name\_attribute\_get\_file\_attribute\_flags**(*libfsntfs\_attribute\_t \*attribute*, *uint32\_t \*file\_attribute\_flags*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_name\_attribute\_get\_name\_space**(*libfsntfs\_attribute\_t \*attribute*, *uint8\_t \*name\_space*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_name\_attribute\_get\_utf8\_name\_size**(*libfsntfs\_attribute\_t \*attribute*, *size\_t \*utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_name\_attribute\_get\_utf8\_name**(*libfsntfs\_attribute\_t \*attribute*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_name\_attribute\_get\_utf16\_name\_size**(*libfsntfs\_attribute\_t \*attribute*, *size\_t \*utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_file\_name\_attribute\_get\_utf16\_name**(*libfsntfs\_attribute\_t \*attribute*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

$OBJECT\_ID attribute functions

*int*\

**libfsntfs\_object\_identifier\_attribute\_get\_droid\_file\_identifier**(*libfsntfs\_attribute\_t \*attribute*, *uint8\_t \*guid*, *size\_t size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_object\_identifier\_attribute\_get\_birth\_droid\_volume\_identifier**(*libfsntfs\_attribute\_t \*attribute*, *uint8\_t \*guid*, *size\_t size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_object\_identifier\_attribute\_get\_birth\_droid\_file\_identifier**(*libfsntfs\_attribute\_t \*attribute*, *uint8\_t \*guid*, *size\_t size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_object\_identifier\_attribute\_get\_birth\_droid\_domain\_identifier**(*libfsntfs\_attribute\_t \*attribute*, *uint8\_t \*guid*, *size\_t size*, *libfsntfs\_error\_t \*\*error*);

$REPARSE\_POINT attribute functions

*int*\

**libfsntfs\_reparse\_point\_attribute\_get\_tag**(*libfsntfs\_attribute\_t \*attribute*, *uint32\_t \*tag*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_reparse\_point\_attribute\_get\_compression\_method**(*libfsntfs\_attribute\_t \*attribute*, *uint32\_t \*compression\_method*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_reparse\_point\_attribute\_get\_utf8\_substitute\_name\_size**(*libfsntfs\_attribute\_t \*attribute*, *size\_t \*utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_reparse\_point\_attribute\_get\_utf8\_substitute\_name**(*libfsntfs\_attribute\_t \*attribute*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_reparse\_point\_attribute\_get\_utf16\_substitute\_name\_size**(*libfsntfs\_attribute\_t \*attribute*, *size\_t \*utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_reparse\_point\_attribute\_get\_utf16\_substitute\_name**(*libfsntfs\_attribute\_t \*attribute*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_reparse\_point\_attribute\_get\_utf8\_print\_name\_size**(*libfsntfs\_attribute\_t \*attribute*, *size\_t \*utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_reparse\_point\_attribute\_get\_utf8\_print\_name**(*libfsntfs\_attribute\_t \*attribute*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_reparse\_point\_attribute\_get\_utf16\_print\_name\_size**(*libfsntfs\_attribute\_t \*attribute*, *size\_t \*utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_reparse\_point\_attribute\_get\_utf16\_print\_name**(*libfsntfs\_attribute\_t \*attribute*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

$SECURITY\_DESCRIPTOR attribute functions

*int*\

**libfsntfs\_security\_descriptor\_attribute\_get\_security\_descriptor\_size**(*libfsntfs\_attribute\_t \*attribute*, *size\_t \*data\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_security\_descriptor\_attribute\_get\_security\_descriptor**(*libfsntfs\_attribute\_t \*attribute*, *uint8\_t \*data*, *size\_t data\_size*, *libfsntfs\_error\_t \*\*error*);

$STANDARD\_INFORMATION attribute functions

*int*\

**libfsntfs\_standard\_information\_attribute\_get\_creation\_time**(*libfsntfs\_attribute\_t \*attribute*, *uint64\_t \*filetime*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_standard\_information\_attribute\_get\_modification\_time**(*libfsntfs\_attribute\_t \*attribute*, *uint64\_t \*filetime*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_standard\_information\_attribute\_get\_access\_time**(*libfsntfs\_attribute\_t \*attribute*, *uint64\_t \*filetime*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_standard\_information\_attribute\_get\_entry\_modification\_time**(*libfsntfs\_attribute\_t \*attribute*, *uint64\_t \*filetime*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_standard\_information\_attribute\_get\_file\_attribute\_flags**(*libfsntfs\_attribute\_t \*attribute*, *uint32\_t \*file\_attribute\_flags*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_standard\_information\_attribute\_get\_owner\_identifier**(*libfsntfs\_attribute\_t \*attribute*, *uint32\_t \*owner\_identifier*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_standard\_information\_attribute\_get\_security\_descriptor\_identifier**(*libfsntfs\_attribute\_t \*attribute*, *uint32\_t \*security\_descriptor\_identifier*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_standard\_information\_attribute\_get\_update\_sequence\_number**(*libfsntfs\_attribute\_t \*attribute*, *uint64\_t \*update\_sequence\_number*, *libfsntfs\_error\_t \*\*error*);

$VOLUME\_INFORMATION attribute functions

*int*\

**libfsntfs\_volume\_information\_attribute\_get\_version**(*libfsntfs\_attribute\_t \*attribute*, *uint8\_t \*major\_version*, *uint8\_t \*minor\_version*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_information\_attribute\_get\_flags**(*libfsntfs\_attribute\_t \*attribute*, *uint16\_t \*flags*, *libfsntfs\_error\_t \*\*error*);

$VOLUME\_NAME attribute functions

*int*\

**libfsntfs\_volume\_name\_attribute\_get\_utf8\_name\_size**(*libfsntfs\_attribute\_t \*attribute*, *size\_t \*utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_name\_attribute\_get\_utf8\_name**(*libfsntfs\_attribute\_t \*attribute*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_name\_attribute\_get\_utf16\_name\_size**(*libfsntfs\_attribute\_t \*attribute*, *size\_t \*utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_volume\_name\_attribute\_get\_utf16\_name**(*libfsntfs\_attribute\_t \*attribute*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

Data stream functions

*int*\

**libfsntfs\_data\_stream\_free**(*libfsntfs\_data\_stream\_t \*\*data\_stream*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_data\_stream\_get\_utf8\_name\_size**(*libfsntfs\_data\_stream\_t \*data\_stream*, *size\_t \*utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_data\_stream\_get\_utf8\_name**(*libfsntfs\_data\_stream\_t \*data\_stream*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_data\_stream\_get\_utf16\_name\_size**(*libfsntfs\_data\_stream\_t \*data\_stream*, *size\_t \*utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_data\_stream\_get\_utf16\_name**(*libfsntfs\_data\_stream\_t \*data\_stream*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*ssize\_t*\

**libfsntfs\_data\_stream\_read\_buffer**(*libfsntfs\_data\_stream\_t \*data\_stream*, *void \*buffer*, *size\_t buffer\_size*, *libfsntfs\_error\_t \*\*error*);

*ssize\_t*\

**libfsntfs\_data\_stream\_read\_buffer\_at\_offset**(*libfsntfs\_data\_stream\_t \*data\_stream*, *void \*buffer*, *size\_t buffer\_size*, *off64\_t offset*, *libfsntfs\_error\_t \*\*error*);

*off64\_t*\

**libfsntfs\_data\_stream\_seek\_offset**(*libfsntfs\_data\_stream\_t \*data\_stream*, *off64\_t offset*, *int whence*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_data\_stream\_get\_offset**(*libfsntfs\_data\_stream\_t \*data\_stream*, *off64\_t \*offset*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_data\_stream\_get\_size**(*libfsntfs\_data\_stream\_t \*data\_stream*, *size64\_t \*size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_data\_stream\_get\_number\_of\_extents**(*libfsntfs\_data\_stream\_t \*data\_stream*, *int \*number\_of\_extents*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_data\_stream\_get\_extent\_by\_index**(*libfsntfs\_data\_stream\_t \*data\_stream*, *int extent\_index*, *off64\_t \*extent\_offset*, *size64\_t \*extent\_size*, *uint32\_t \*extent\_flags*, *libfsntfs\_error\_t \*\*error*);

MFT metadata file functions

*int*\

**libfsntfs\_mft\_metadata\_file\_initialize**(*libfsntfs\_mft\_metadata\_file\_t \*\*mft\_metadata\_file*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_mft\_metadata\_file\_free**(*libfsntfs\_mft\_metadata\_file\_t \*\*mft\_metadata\_file*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_mft\_metadata\_file\_open**(*libfsntfs\_mft\_metadata\_file\_t \*mft\_metadata\_file*, *const char \*filename*, *int access\_flags*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_mft\_metadata\_file\_close**(*libfsntfs\_mft\_metadata\_file\_t \*mft\_metadata\_file*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_mft\_metadata\_file\_get\_utf8\_volume\_name\_size**(*libfsntfs\_mft\_metadata\_file\_t \*mft\_metadata\_file*, *size\_t \*utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_mft\_metadata\_file\_get\_utf8\_volume\_name**(*libfsntfs\_mft\_metadata\_file\_t \*mft\_metadata\_file*, *uint8\_t \*utf8\_string*, *size\_t utf8\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_mft\_metadata\_file\_get\_utf16\_volume\_name\_size**(*libfsntfs\_mft\_metadata\_file\_t \*mft\_metadata\_file*, *size\_t \*utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_mft\_metadata\_file\_get\_utf16\_volume\_name**(*libfsntfs\_mft\_metadata\_file\_t \*mft\_metadata\_file*, *uint16\_t \*utf16\_string*, *size\_t utf16\_string\_size*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_mft\_metadata\_file\_get\_volume\_version**(*libfsntfs\_mft\_metadata\_file\_t \*mft\_metadata\_file*, *uint8\_t \*major\_version*, *uint8\_t \*minor\_version*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_mft\_metadata\_file\_get\_volume\_flags**(*libfsntfs\_mft\_metadata\_file\_t \*mft\_metadata\_file*, *uint16\_t \*flags*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_mft\_metadata\_file\_get\_number\_of\_file\_entries**(*libfsntfs\_mft\_metadata\_file\_t \*mft\_metadata\_file*, *uint64\_t \*number\_of\_file\_entries*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_mft\_metadata\_file\_get\_file\_entry\_by\_index**(*libfsntfs\_mft\_metadata\_file\_t \*mft\_metadata\_file*, *uint64\_t mft\_entry\_index*, *libfsntfs\_file\_entry\_t \*\*file\_entry*, *libfsntfs\_error\_t \*\*error*);

Available when compiled with wide character string support:

*int*\

**libfsntfs\_mft\_metadata\_file\_open\_wide**(*libfsntfs\_mft\_metadata\_file\_t \*mft\_metadata\_file*, *const wchar\_t \*filename*, *int access\_flags*, *libfsntfs\_error\_t \*\*error*);

Available when compiled with libbfio support:

*int*\

**libfsntfs\_mft\_metadata\_file\_open\_file\_io\_handle**(*libfsntfs\_mft\_metadata\_file\_t \*mft\_metadata\_file*, *libbfio\_handle\_t \*file\_io\_handle*, *int access\_flags*, *libfsntfs\_error\_t \*\*error*);

USN change journal functions

*int*\

**libfsntfs\_usn\_change\_journal\_free**(*libfsntfs\_usn\_change\_journal\_t \*\*usn\_change\_journal*, *libfsntfs\_error\_t \*\*error*);

*int*\

**libfsntfs\_usn\_change\_journal\_get\_offset**(*libfsntfs\_usn\_change\_journal\_t \*usn\_change\_journal*, *off64\_t \*offset*, *libfsntfs\_error\_t \*\*error*);

*ssize\_t*\

**libfsntfs\_usn\_change\_journal\_read\_usn\_record**(*libfsntfs\_usn\_change\_journal\_t \*usn\_change\_journal*, *uint8\_t \*usn\_record\_data*, *size\_t usn\_record\_data\_size*, *libfsntfs\_error\_t \*\*error*);

## DESCRIPTION

The **libfsntfs\_get\_version**() function is used to retrieve the library version.

## RETURN VALUES

Most of the functions return NULL or -1 on error, dependent on the return type. For the actual return values see "libfsntfs.h".

## ENVIRONMENT

None

## FILES

None

## NOTES

libfsntfs can be compiled with wide character support (wchar\_t).

To compile libfsntfs with wide character support use: *./configure* *--enable-wide-character-type=yes*\
  or define: *\_UNICODE*\
  or *UNICODE*\
  during compilation.

*LIBFSNTFS\_WIDE\_CHARACTER\_TYPE*\
  in libfsntfs/features.h can be used to determine if libfsntfs was compiled with wide character support.

## BUGS

Please report bugs of any kind on the project issue tracker: https://github.com/libyal/libfsntfs/issues

## AUTHOR

These man pages are generated from "libfsntfs.h".

## COPYRIGHT

Copyright (C) 2010-2024, Joachim Metz \<joachim.metz@gmail.com\>.

This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

## SEE ALSO

the libfsntfs.h include file