mft2bodyfile 0.6.8

parses an $MFT file to bodyfile (stdout)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108

use mft::MftEntry;
use std::collections::HashMap;
use winstructs::ntfs::mft_reference::MftReference;
use crate::intern::CompleteMftEntry;
use usnjrnl::CommonUsnRecord;

pub struct ParentInfo {
    pub full_path: String,
    pub is_allocated: bool,
    pub reference: Option<MftReference>
}

pub struct PreprocessedMft {
    complete_entries: HashMap<MftReference, CompleteMftEntry>
}

impl Default for PreprocessedMft {
    fn default() -> Self {
        Self {
            complete_entries: HashMap::new()
        }
    }
}

impl PreprocessedMft {
    pub fn add_entry(&mut self, entry: MftEntry) {
        let reference = MftReference::new(entry.header.record_number, entry.header.sequence);

        if PreprocessedMft::is_base_entry(&entry) {
            match self.complete_entries.get_mut(&reference) {
                Some(e) => e.set_base_entry(reference, entry),
                None => {
                    let ce = CompleteMftEntry::from_base_entry(reference, entry);
                    let _ = self.complete_entries.insert(reference, ce);
                }
            }
        } else if entry.is_allocated() { /* && ! PreprocessedMft::is_base_entry(&entry) */
            //
            // ignore unallocated nonbase entries
            //
            let base_reference = entry.header.base_reference;
            match self.complete_entries.get_mut(&base_reference) {
                Some(e) => {
                    e.add_nonbase_entry(entry);
                }
                None => {
                    let ce = CompleteMftEntry::from_nonbase_entry(reference, entry);
                    let _ = self.complete_entries.insert(base_reference, ce);
                }
            }
        }
    }

    pub fn add_usnjrnl_records(&mut self, reference: MftReference, records: Vec<CommonUsnRecord>) {
        match self.complete_entries.get_mut(&reference) {
            Some(e) => {
                e.add_usnjrnl_records(records);
            }
            None => {
                let ce = CompleteMftEntry::from_usnjrnl_records(reference, records);
                let _ = self.complete_entries.insert(reference, ce);
            }
        }
    }

    pub fn is_base_entry(entry: &MftEntry) -> bool {
        entry.header.base_reference.entry == 0 && entry.header.base_reference.sequence == 0
    }

    pub fn get_full_path(&self, reference: &MftReference) -> ParentInfo {
        if let Some(entry) = self.complete_entries.get(reference) {
            return ParentInfo {
                full_path: entry.get_full_path(self),
                is_allocated: entry.is_allocated(),
                reference: Some(*reference)
            }
        }

        // if the parent folder was already deleted, the sequence number is incremented
        let deleted_ref = MftReference::new(reference.entry, reference.sequence + 1);
        if let Some(entry) = self.complete_entries.get(&deleted_ref) {
            if ! entry.is_allocated() {
                return ParentInfo {
                    full_path: entry.get_full_path(self),
                    is_allocated: entry.is_allocated(),
                    reference: Some(deleted_ref)
                }
            }
        }

        return ParentInfo {
            full_path: format!("/$OrphanFiles"),
            is_allocated: false,
            reference: None
        }
    }

    pub fn bodyfile_lines_count(&self) -> usize {
        self.complete_entries.values().map(|e| e.bodyfile_lines_count()).sum()
    }
    
    pub fn iter_entries<'a>(&'a self, usnjrnl_longflags: bool) -> Box<dyn Iterator<Item=String> + 'a>{
        Box::new(self.complete_entries
            .values()
            .map(move |c| c.bodyfile_lines(self, usnjrnl_longflags))
            .flatten())
    }
}