mft2bodyfile 0.6.4

parses an $MFT file to bodyfile (stdout)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40


use mft::attribute::x10::StandardInfoAttr;
use mft::attribute::x30::FileNameAttr;

pub struct TimestampTuple {
    accessed: i64,
    mft_modified: i64,
    modified: i64,
    created: i64,
}

impl From<&FileNameAttr> for TimestampTuple {
    fn from(attr: &FileNameAttr) -> TimestampTuple {
        TimestampTuple {
            accessed: attr.accessed.timestamp(),
            mft_modified: attr.mft_modified.timestamp(),
            modified: attr.modified.timestamp(),
            created: attr.created.timestamp()
        }
    }
}


impl From<&StandardInfoAttr> for TimestampTuple {
    fn from(attr: &StandardInfoAttr) -> TimestampTuple {
        TimestampTuple {
            accessed: attr.accessed.timestamp(),
            mft_modified: attr.mft_modified.timestamp(),
            modified: attr.modified.timestamp(),
            created: attr.created.timestamp()
        }
    }
}

impl TimestampTuple {
    pub fn accessed(&self) -> i64 {self.accessed}
    pub fn mft_modified(&self) -> i64 {self.mft_modified}
    pub fn modified(&self) -> i64 {self.modified}
    pub fn created(&self) -> i64 {self.created}
}