Vault 7: Projects

This publication series is about specific projects related to the Vault 7 main publication.

Elements
char FSName[ mexfs_mfts_size ]
Contains the name of the BadMFS file system. Currently this name is
restricted to being less
than 10 characters, and is not necessarily null terminated.
QWORD TotalSize
Size in bytes of the entire BadMFS volume.
QWORD CurrentSize
Size in bytes of the space currently used on the BadMFS volume.
DWORD NumberOfFiles
Number of files created by a user. This does not include the MFT which is at
the beginning of any BadMFS volume.
Remarks
In the case of a multi-threaded / multi-process environment the information
contained in
BadMFS_FSINFO will be highly volatile. A BadMFS_FSINFO structure appears
at the start of any
BadMFS volume, immediately followed by the BadMFS MFT. This structure is
used to update
any user created instance of a BadMFS_FSINFO structure, which may be
populated by
a call to bmfsPartitionInfo().

e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh