mft 0.8.0

A Fast (and safe) parser for the Windows Master File Table (MFT) format
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155

use crate::attribute::{FileAttributeFlags, MftAttributeType};
use crate::entry::EntryFlags;
use crate::{MftAttribute, MftEntry, MftParser};

use serde::Serialize;

use jiff::Timestamp;
use std::io::{Read, Seek};
use std::path::PathBuf;

/// Used for CSV output
#[derive(Serialize)]
#[serde(rename_all = "PascalCase")]
pub struct FlatMftEntryWithName {
    pub signature: String,

    pub entry_id: u64,
    pub sequence: u16,

    pub base_entry_id: u64,
    pub base_entry_sequence: u16,

    pub hard_link_count: u16,
    pub flags: EntryFlags,

    /// The size of the file, in bytes.
    pub used_entry_size: u32,
    pub total_entry_size: u32,

    /// The size of the file, if available, from the X80 attribute.
    /// Will be 0 if no $DATA attribute is found.
    pub file_size: u64,

    /// Indicates whether the record is a directory.
    pub is_a_directory: bool,
    /// Indicates whether the record has the `ALLOCATED` bit turned off.
    pub is_deleted: bool,

    /// Indicates whether the record has alternate data streams.
    pub has_alternate_data_streams: bool,

    /// All of these fields are present for entries that have an 0x10 attribute.
    pub standard_info_flags: Option<FileAttributeFlags>,
    #[serde(serialize_with = "crate::utils::serialize_option_timestamp")]
    pub standard_info_last_modified: Option<Timestamp>,
    #[serde(serialize_with = "crate::utils::serialize_option_timestamp")]
    pub standard_info_last_access: Option<Timestamp>,
    #[serde(serialize_with = "crate::utils::serialize_option_timestamp")]
    pub standard_info_created: Option<Timestamp>,
    /// All of these fields are present for entries that have an 0x30 attribute.
    pub file_name_flags: Option<FileAttributeFlags>,
    #[serde(serialize_with = "crate::utils::serialize_option_timestamp")]
    pub file_name_last_modified: Option<Timestamp>,
    #[serde(serialize_with = "crate::utils::serialize_option_timestamp")]
    pub file_name_last_access: Option<Timestamp>,
    #[serde(serialize_with = "crate::utils::serialize_option_timestamp")]
    pub file_name_created: Option<Timestamp>,

    /// Written with `\` separators on every platform.
    #[serde(serialize_with = "crate::utils::serialize_windows_path")]
    pub full_path: PathBuf,

    // These come after `FullPath` so the earlier columns keep their positions.
    #[serde(serialize_with = "crate::utils::serialize_option_timestamp")]
    pub standard_info_last_mft_modified: Option<Timestamp>,
    #[serde(serialize_with = "crate::utils::serialize_option_timestamp")]
    pub file_name_last_mft_modified: Option<Timestamp>,
}

impl FlatMftEntryWithName {
    pub fn from_entry(
        entry: &MftEntry,
        parser: &mut MftParser<impl Read + Seek>,
    ) -> FlatMftEntryWithName {
        let full_path = parser
            .get_full_path_for_entry(entry)
            .expect("I/O Err")
            .unwrap_or_default();
        let extensions = parser.get_extension_entries(entry);
        Self::from_entry_with_path(entry, &extensions, full_path)
    }

    /// Same as [`FlatMftEntryWithName::from_entry`], for callers that already resolved the
    /// entry's full path and read its extension records (see
    /// [`MftParser::get_extension_entries`]).
    pub fn from_entry_with_path(
        entry: &MftEntry,
        extensions: &[MftEntry],
        full_path: PathBuf,
    ) -> FlatMftEntryWithName {
        let entry_attributes: Vec<MftAttribute> = std::iter::once(entry)
            .chain(extensions)
            .flat_map(|record| {
                record.iter_attributes_matching(Some(vec![
                    MftAttributeType::FileName,
                    MftAttributeType::StandardInformation,
                    MftAttributeType::DATA,
                ]))
            })
            .filter_map(Result::ok)
            .collect();

        let file_name = entry_attributes
            .iter()
            .find(|a| a.header.type_code == MftAttributeType::FileName)
            .and_then(|a| a.data.as_file_name())
            .cloned();

        let standard_info = entry_attributes
            .iter()
            .find(|a| a.header.type_code == MftAttributeType::StandardInformation)
            .and_then(|a| a.data.as_standard_info())
            .cloned();

        // The unnamed stream, or a named one if there is none. Records that continue a stream
        // started elsewhere don't hold its size.
        let file_size = entry_attributes
            .iter()
            .filter(|a| a.header.type_code == MftAttributeType::DATA && !a.header.is_continuation())
            .min_by_key(|a| !a.header.name.is_empty())
            .map_or(0, |a| a.header.value_size());

        let has_ads = entry_attributes
            .iter()
            .any(|a| a.header.type_code == MftAttributeType::DATA && !a.header.name.is_empty());

        FlatMftEntryWithName {
            entry_id: entry.header.record_number,
            signature: String::from_utf8(entry.header.signature.to_ascii_uppercase())
                .expect("It should be either FILE or BAAD (valid utf-8)"),
            sequence: entry.header.sequence,
            hard_link_count: entry.header.hard_link_count,
            flags: entry.header.flags.clone(),
            used_entry_size: entry.header.used_entry_size,
            total_entry_size: entry.header.total_entry_size,
            base_entry_id: entry.header.base_reference.entry,
            base_entry_sequence: entry.header.base_reference.sequence,
            is_a_directory: entry.is_dir(),
            is_deleted: !entry.header.flags.contains(EntryFlags::ALLOCATED),
            has_alternate_data_streams: has_ads,
            standard_info_flags: standard_info.as_ref().map(|i| i.file_flags.clone()),
            standard_info_last_modified: standard_info.as_ref().map(|i| i.modified),
            standard_info_last_access: standard_info.as_ref().map(|i| i.accessed),
            standard_info_created: standard_info.as_ref().map(|i| i.created),
            file_name_flags: file_name.as_ref().map(|i| i.flags.clone()),
            file_name_last_modified: file_name.as_ref().map(|i| i.modified),
            file_name_last_access: file_name.as_ref().map(|i| i.accessed),
            file_name_created: file_name.as_ref().map(|i| i.created),
            standard_info_last_mft_modified: standard_info.as_ref().map(|i| i.mft_modified),
            file_name_last_mft_modified: file_name.as_ref().map(|i| i.mft_modified),
            file_size,
            full_path,
        }
    }
}