2.2 WIN32_STREAM_ID
The WIN32_STREAM_ID structure is a header that precedes each backup stream in the NT backup file. This header identifies the type of backup stream, its size, and other attributes. The structure is as follows.
|
|
|
|
|
|
|
|
|
|
1 |
|
|
|
|
|
|
|
|
|
2 |
|
|
|
|
|
|
|
|
|
3 |
|
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
dwStreamId |
|||||||||||||||||||||||||||||||
|
dwStreamAttributes |
|||||||||||||||||||||||||||||||
|
Size |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
|
dwStreamNameSize |
|||||||||||||||||||||||||||||||
|
cStreamName (variable) |
|||||||||||||||||||||||||||||||
|
... |
|||||||||||||||||||||||||||||||
dwStreamId (4 bytes): A 32-bit, unsigned integer that indicates the type of data in this backup stream. The value of this field MUST be one of the following.
-
Value
Meaning
ALTERNATE_DATA
0x00000004
Alternative data streams.
DATA
0x00000001
Standard data.
EA_DATA
0x00000002
Extended attribute data.
LINK
0x00000005
Hard link information.
OBJECT_ID
0x00000007
Object identifiers.
REPARSE_DATA
0x00000008
Reparse points.
SECURITY_DATA
0x00000003
Security descriptor data.
SPARSE_BLOCK
0x00000009
Data in a sparse file.
TXFS_DATA
0x0000000A
Transactional file system.
GHOSTED_FILE_EXTENTS
0x0000000B
Ghosted Extents.
dwStreamAttributes (4 bytes): A 32-bit, unsigned long integer that indicates properties of the backup stream. The value of this field MUST be the bitwise OR of zero or more of the following. Other bits are unused and MUST be 0 and ignored on receipt.
-
Value
Meaning
STREAM_NORMAL_ATTRIBUTE
0x00000000
This backup stream has no special attributes.
STREAM_CONTAINS_SECURITY
0x00000002
The backup stream contains security information. This attribute applies only to backup stream of type SECURITY_DATA.
STREAM_SPARSE_ATTRIBUTE
0x00000008
The backup stream is part of a sparse file stream. This attribute applies only to backup stream of type DATA, ALTERNATE_DATA, and SPARSE_BLOCK.
STREAM_CONTAINS_GHOSTED_FILE_EXTENTS
0x00000010
The backup stream contains ghosted extents. This attribute applies only to backup stream of type DATA.
Size (8 bytes): A 64-bit, unsigned integer that specifies the length of the data portion of the backup stream; this length MUST NOT include the length of the header. The next backup stream within the NT backup file, if any, MUST start at Size + dwStreamNameSize bytes beyond the end of this WIN32_STREAM_ID structure. Note that the alternate stream name, whose size is dwStreamNameSize bytes, is part of the header for the purposes of calculating the position of the next WIN32_STREAM_ID structure.
dwStreamNameSize (4 bytes): A 32-bit, unsigned integer that specifies the length of the alternate stream name, in bytes. The value of this field MUST be 0 for all dwStreamId values other than ALTERNATE_DATA. For StreamID ALTERNATE_DATA, the value of this field MUST be in the range 0–65536, and it MUST be an integral multiple of two.
cStreamName (variable): A Unicode string that specifies the name of the alternate stream. This string MUST NOT be null-terminated.
Size bytes of data MUST follow the header. The meaning of the data depends on the dwStreamId value and is specified in the following sections.