mft 0.7.0

A Fast (and safe) parser for the Windows Master File Table (MFT) format
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

use std::io::{Read, Seek};

use crate::attribute::MftAttributeType;
use crate::err::Result;
use crate::utils;
use serde::{Serialize, ser};

/// Placeholder attribute for currently unparsed attributes.
#[derive(Serialize, Clone, Debug)]
pub struct RawAttribute {
    pub attribute_type: MftAttributeType,
    #[serde(serialize_with = "data_as_hex")]
    pub data: Vec<u8>,
}

impl RawAttribute {
    pub fn from_stream<S: Read + Seek>(
        stream: &mut S,
        attribute_type: MftAttributeType,
        data_size: usize,
    ) -> Result<Self> {
        let mut data = vec![0_u8; data_size];

        stream.read_exact(&mut data)?;

        Ok(RawAttribute {
            attribute_type,
            data,
        })
    }
}

fn data_as_hex<S>(x: &[u8], s: S) -> std::result::Result<S::Ok, S::Error>
where
    S: ser::Serializer,
{
    s.serialize_str(&utils::to_hex_string(x))
}