pub struct MftEntry {
pub header: EntryHeader,
pub data: Vec<u8>,
pub valid_fixup: Option<bool>,
}
Fields§
§header: EntryHeader
§data: Vec<u8>
§valid_fixup: Option<bool>
Valid fixup allows you to check if the fixup value in the entry’s blocks matched the fixup array value. It is optional because in the case of from_buffer_skip_fixup(), no fixup is even checked, thus, valid_fixup is None
Implementations§
source§impl MftEntry
impl MftEntry
sourcepub fn from_buffer(buffer: Vec<u8>, entry_number: u64) -> Result<MftEntry>
pub fn from_buffer(buffer: Vec<u8>, entry_number: u64) -> Result<MftEntry>
Initializes an MFT Entry from a buffer. Since the parser is the entity responsible for knowing the entry size, we take ownership of the buffer instead of trying to read it from stream.
sourcepub fn from_buffer_skip_fixup(
buffer: Vec<u8>,
entry_number: u64
) -> Result<MftEntry>
pub fn from_buffer_skip_fixup( buffer: Vec<u8>, entry_number: u64 ) -> Result<MftEntry>
Initializes an MFT Entry from a buffer but skips checking and fixing the fixup array. This will throw InvalidEntrySignature error if the entry header is not valid.
sourcepub fn find_best_name_attribute(&self) -> Option<FileNameAttr>
pub fn find_best_name_attribute(&self) -> Option<FileNameAttr>
Retrieves most human-readable representation of a file path entry.
Will prefer Win32
file name attributes, and fallback to Dos
paths.
pub fn is_allocated(&self) -> bool
pub fn is_dir(&self) -> bool
sourcepub fn iter_attributes(&self) -> impl Iterator<Item = Result<MftAttribute>> + '_
pub fn iter_attributes(&self) -> impl Iterator<Item = Result<MftAttribute>> + '_
Returns an iterator over all the attributes of the entry.
sourcepub fn iter_attributes_matching(
&self,
types: Option<Vec<MftAttributeType>>
) -> impl Iterator<Item = Result<MftAttribute>> + '_
pub fn iter_attributes_matching( &self, types: Option<Vec<MftAttributeType>> ) -> impl Iterator<Item = Result<MftAttribute>> + '_
Returns an iterator over the attributes in the list given in types
, skips other attributes.