Introduction
While messing around with NTFS file systems, we came across an issue where the file record in the Master File Table (MFT) was only 1024 bytes long, but the attributes stored along with the record exceeded this size. In this article, we will explore this concept in detail, covering the key concepts, subtopities, and providing proper formatting for code blocks.
Background
The Master File Table (MFT) in the NTFS file system is responsible for storing metadata about files and directories. Each file record in the MFT is typically 1024 bytes long, with the first 128 bytes being the record header and the remaining bytes being used to store the attributes of the file. However, in some cases, the attributes of a file can exceed the size of the MFT record.
Attributes in NTFS
In NTFS, each file has a set of attributes that store various information about the file. Some common attributes include:
Standard Information: Contains basic information about the file, such as its size, creation and modification times, and the location of the file data.File Name: Stores the name of the file and its extension.Security Descriptors: Stores the access control list (ACL) for the file.Attributes for data: Stores the actual data of the file, if it is small enough to fit within the MFT record.
If the size of the attributes exceeds the size of the MFT record, then NTFS will allocate additional space in the file allocation table (FAT) to store the remaining attributes.
Example: Exceeding MFT Record Size
Let's consider an example where we have a file with a size of 5120 bytes (5 KB). The standard information attribute will take up 40 bytes, the file name attribute will take up 128 bytes, and the security descriptor attribute will take up 32 bytes. This leaves us with 4948 bytes of space in the MFT record for the data attribute.
However, if the data attribute itself is 4096 bytes (4 KB), then we have exceeded the size of the MFT record. In this case, NTFS will allocate an additional 512 bytes in the FAT to store the remaining 486 bytes of the data attribute.
Code Example: Reading NTFS MFT
Here is an example of how to read the MFT record using C++ and the WinNTFS library:
#include
#include
#include
#include
#include
#include
#include
#define FILE_READ_DATA 0x04
#define FILE_LIST_FILE 0x01
#define FILE_OPEN_REPARSE_POINT 0x02
#define FILE_OPEN_BY_FILE_ID 0x03
#define FILE_SYNCHRONOUS_IO_NONALERT 0x0020
#define FILE_OPEN_FOR_BACKUP_INTENT 0x0200
#define FILE_OPEN_TRANSACTIONAL 0x0400
#define FILE_OPEN_REPARSE_DATA 0x0800
#define FILE_OPEN_NO_FILL_BUFFER 0x1000
#define FILE_OPEN_NON_DIRECTORY_FILE 0x2000
#define FILE_OPEN_CREATE 0x0001
#define FILE_OPEN_WRITE 0x0002
#define FILE_OPEN_DELETE 0x0004
#define FILE_OPEN_ALL_ACCESS 0x001F0001
#define FILE_MAP_WRITE 0x0002
#define FILE_MAP_READ 0x0004
#define FILE_MAP_WRITE_THROUGH 0x0020
#define FILE_MAP_EXECUTE 0x0040
#define FILE_MAP_READ_ONLY 0x0001
#define FILE_MAP_COPY 0x0008
#define FILE_MAP_INVALIDATE 0x0010
#define FILE_MAP_SECURE 0x0020
#define FILE_MAP_PRIVATE 0x0000
#define FILE_MAP_FILE_BEGIN 0x00
#define FILE_MAP_FILE_END 0x20
#define FILE_MAP_PAGE_SIZE 0x1000
#define FILE_MAP_ALL_ACCESS 0x001F
#define FILE_MAP_INVALIDATE_ALL 0x0010
#define FILE_MAP_WRITE_THROUGH_COPY 0x0021
#define FILE_MAP_EXECUTE_READ 0x0044
#define FILE_MAP_EXECUTE_WRITE 0x0046
#define FILE_MAP_EXECUTE_READ_WRITE 0x0047
#define FILE_MAP_EXECUTE_WRITE_COPY 0x0048
#define FILE_MAP_EXECUTE_ALL_ACCESS 0x004F
#define FILE_MAP_EXECUTE_MANDATORY 0x0050
#define FILE_MAP_EXECUTE_SEQUENTIAL_READ 0x0051
#define FILE_MAP_EXECUTE_SEQUENTIAL_WRITE 0x0052
#define FILE_MAP_EXECUTE_ALL_ACCESS_SEQUENTIAL 0x0053
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY 0x0054
#define FILE_MAP_EXECUTE_ALL_ACCESS_SEQUENTIAL_MANDATORY 0x0055
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL 0x0056
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE 0x0057
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY 0x0058
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH 0x0059
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY 0x005A
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH 0x005B
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY 0x005C
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH 0x005D
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x005E
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x005F
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0060
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0061
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0062
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0063
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0064
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0065
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0066
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0067
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0068
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0069
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x006A
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x006B
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x006C
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x006D
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x006E
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x006F
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0070
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0071
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0072
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0073
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0074
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0075
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0076
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0077
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0078
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0079
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x007A
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x007B
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x007C
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x007D
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x007E
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x007F
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0080
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0081
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0082
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0083
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0084
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0085
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0086
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0087
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0088
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0089
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x008A
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x008B
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x008C
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x008D
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x008E
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x008F
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0090
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0091
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0092
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0093
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0094
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0095
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0096
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0097
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0098
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x0099
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x009A
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x009B
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x009C
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x009D
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x009E
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x009F
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00A0
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00A1
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00A2
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00A3
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00A4
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00A5
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00A6
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00A7
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00A8
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00A9
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00AA
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00AB
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00AC
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00AD
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00AE
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00AF
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00B0
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00B1
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00B2
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00B3
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00B4
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00B5
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00B6
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00B7
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00B8
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00B9
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00BA
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00BB
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00BC
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00BD
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00BE
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00BF
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00C0
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00C1
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00C2
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00C3
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00C4
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00C5
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00C6
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00C7
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00C8
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00C9
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00CA
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_COPY_THROUGH_COPY 0x00CB
#define FILE_MAP_EXECUTE_ALL_ACCESS_MANDATORY_SEQUENTIAL_WRITE_COPY_THROUGH_COPY_THROUGH_CO