Crate ntfs

A low-level NTFS filesystem library implemented in Rust.

NTFS is the primary filesystem in all versions of Windows (since Windows NT 3.1 in 1993). This crate is geared towards the NTFS 3.x versions used in Windows 2000 up to the current Windows 11. However, the basics are expected to be compatible to even earlier versions.

The crate is no_std-compatible and therefore usable from firmware level code up to user-mode applications.

Getting started

1. Create an Ntfs structure from a reader by calling Ntfs::new.
2. Retrieve the NtfsFile of the root directory via Ntfs::root_directory.
3. Dig into its attributes via NtfsFile::attributes, go even deeper via NtfsFile::attributes_raw or use one of the convenience functions, like NtfsFile::directory_index, NtfsFile::info or NtfsFile::name.

Example

The following example dumps the names of all files and folders in the root directory of a given NTFS filesystem.
The list is directly taken from the NTFS index, hence it’s sorted in ascending order with respect to NTFS’s understanding of case-insensitive string comparison.

let mut ntfs = Ntfs::new(&mut fs).unwrap();
let root_dir = ntfs.root_directory(&mut fs).unwrap();
let index = root_dir.directory_index(&mut fs).unwrap();
let mut iter = index.entries();

while let Some(entry) = iter.next(&mut fs) {
    let entry = entry.unwrap();
    let file_name = entry.key().unwrap();
    println!("{}", file_name.name());
}

Check out the docs, the tests, and the supplied ntfs-shell application for more examples on how to use the ntfs library.

Modules

attribute_value

Readers for attribute value types.

indexes

Various types of NTFS indexes and traits to work with them.

structured_values

Various types of NTFS Attribute structured values.

types

Supplementary helper types.

Structs

Ntfs

Root structure describing an NTFS filesystem.

NtfsAttribute

A single NTFS Attribute of an NtfsFile.

NtfsAttributeFlags

Flags returned by NtfsAttribute::flags.

NtfsAttributeItem

Item returned by the NtfsAttributes iterator.

NtfsAttributes

Iterator over all attributes of an NtfsFile, returning an NtfsAttributeItem for each entry.

NtfsAttributesAttached

Iterator over all attributes of an NtfsFile, returning an NtfsAttributeItem for each entry, implementing Iterator and FusedIterator.

NtfsAttributesRaw

Iterator over all top-level attributes of an NtfsFile, returning an NtfsAttribute for each entry, implementing Iterator and FusedIterator.

NtfsFile

A single NTFS File Record.

NtfsFileFlags

Flags returned by NtfsFile::flags.

NtfsFileReference

Absolute reference to a File Record on the filesystem, composed out of a File Record Number and a Sequence Number.

NtfsGuid

A Globally Unique Identifier (GUID), used for Object IDs in NTFS.

NtfsIndex

Helper structure to iterate over all entries of an index or find a specific one.

NtfsIndexEntries

Iterator over all index entries of an index, sorted ascending by the index key, returning an NtfsIndexEntry for each entry.

NtfsIndexEntry

A single entry of an NTFS index.

NtfsIndexEntryFlags

Flags returned by NtfsIndexEntry::flags.

NtfsIndexFinder

Helper structure to efficiently find an entry in an index, created by NtfsIndex::finder.

NtfsIndexNodeEntries

Iterator over all index entries of a single index node, sorted ascending by the index key, returning an NtfsIndexEntry for each entry.

NtfsIndexRecord

A single NTFS Index Record.

NtfsString

Zero-copy representation of a string stored in an NTFS filesystem structure.

NtfsTime

An NTFS timestamp, used for expressing file times.

Enums

KnownNtfsFileRecordNumber

A list of standardized NTFS File Record Numbers.

NtfsAttributeType

All known NTFS Attribute types.

NtfsError

Central error type of ntfs.

Traits

NtfsReadSeek

Trait to read/seek in a source by the help of a temporarily passed mutable reference to the filesystem reader.

UpcaseOrd

Trait for a case-insensitive ordering with respect to the $UpCase table read from the filesystem.

Type Definitions

Result

Central result type of ntfs.