mft2bodyfile 0.6.9

parses an $MFT file to bodyfile (stdout)
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49


use mft::attribute::x10::StandardInfoAttr;
use mft::attribute::x30::FileNameAttr;
use chrono::{DateTime, Utc};
use std::cmp;

pub struct TimestampTuple {
    accessed: i64,
    mft_modified: i64,
    modified: i64,
    created: i64,
}

impl TimestampTuple {
    fn win32_to_unix_timestamp(win32_ts: &DateTime<Utc>) -> i64 {
        /* any values below 0 cannot be used as unix timestamp */
        cmp::max(0, win32_ts.timestamp())
    }
}

impl From<&FileNameAttr> for TimestampTuple {
    fn from(attr: &FileNameAttr) -> TimestampTuple {
        TimestampTuple {
            accessed: Self::win32_to_unix_timestamp(&attr.accessed),
            mft_modified: Self::win32_to_unix_timestamp(&attr.mft_modified),
            modified: Self::win32_to_unix_timestamp(&attr.modified),
            created: Self::win32_to_unix_timestamp(&attr.created)
        }
    }
}


impl From<&StandardInfoAttr> for TimestampTuple {
    fn from(attr: &StandardInfoAttr) -> TimestampTuple {
        TimestampTuple {
            accessed: Self::win32_to_unix_timestamp(&attr.accessed),
            mft_modified: Self::win32_to_unix_timestamp(&attr.mft_modified),
            modified: Self::win32_to_unix_timestamp(&attr.modified),
            created: Self::win32_to_unix_timestamp(&attr.created)
        }
    }
}

impl TimestampTuple {
    pub fn accessed(&self) -> i64 {self.accessed}
    pub fn mft_modified(&self) -> i64 {self.mft_modified}
    pub fn modified(&self) -> i64 {self.modified}
    pub fn created(&self) -> i64 {self.created}
}