Struct DirEntry 

pub struct DirEntry {

    pub sid: u32,
    pub name: String,
    pub object_type: u8,
    pub color: u8,
    pub left: u32,
    pub right: u32,
    pub child: u32,
    pub clsid: [u8; 16],
    pub state_bits: u32,
    pub create_time: u64,
    pub modify_time: u64,
    pub start_sector: u32,
    pub stream_size: u64,
}

A decoded 128-byte directory entry. Every field is read with bounds checks; a truncated entry yields zeroed / empty fields rather than a panic.

Fields

sid: u32

Index of this entry in the directory array (its stream id / SID).

name: String

UTF-16LE name, lossily decoded and trimmed at the declared name length.

object_type: u8

Raw object-type byte (0x00/0x01/0x02/0x05).

color: u8

Raw colour byte (0x00 red / 0x01 black).

left: u32

Left-sibling SID, or forensicnomicon::olecf::NOSTREAM.

right: u32

Right-sibling SID, or NOSTREAM.

child: u32

Child SID (storages only), or NOSTREAM.

clsid: [u8; 16]

16-byte class id, verbatim.

state_bits: u32

User-defined state bits.

create_time: u64

Creation FILETIME (raw u64).

modify_time: u64

Modification FILETIME (raw u64).

start_sector: u32

Starting sector id of the entry’s stream (or mini-stream for the root).

stream_size: u64

Declared stream size in bytes.

Implementations

impl DirEntry

pub fn is_allocated(&self) -> bool

True if this entry’s object type marks it as a live stream or storage (0x01/0x02/0x05) rather than an unallocated 0x00 slot.

pub fn is_stream(&self) -> bool

True for a stream object (0x02).

Trait Implementations

impl Clone for DirEntry

fn clone(&self) -> DirEntry

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for DirEntry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for DirEntry

impl PartialEq for DirEntry

fn eq(&self, other: &DirEntry) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for DirEntry