Crate ntfs

A low-level NTFS filesystem library implemented in Rust.

NTFS is the primary filesystem in all versions of Windows (since Windows NT 3.1 in 1993). This crate is geared towards the NTFS 3.x versions used in Windows 2000 up to the current Windows 11. However, the basics are expected to be compatible to even earlier versions.

The crate is no_std-compatible and therefore usable from firmware level code up to user-mode applications.

Getting started

1. Create an Ntfs structure from a reader by calling Ntfs::new.
2. Retrieve the NtfsFile of the root directory via Ntfs::root_directory.
3. Dig into its attributes via NtfsFile::attributes, go even deeper via NtfsFile::attributes_raw or use one of the convenience functions, like NtfsFile::directory_index, NtfsFile::info or NtfsFile::name.

Example

The following example dumps the names of all files and folders in the root directory of a given NTFS filesystem.
The list is directly taken from the NTFS index, hence it’s sorted in ascending order with respect to NTFS’s understanding of case-insensitive string comparison.

let mut ntfs = Ntfs::new(&mut fs).unwrap();
let root_dir = ntfs.root_directory(&mut fs).unwrap();
let index = root_dir.directory_index(&mut fs).unwrap();
let mut iter = index.entries();

while let Some(entry) = iter.next(&mut fs) {
    let entry = entry.unwrap();
    let file_name = entry.key().unwrap();
    println!("{}", file_name.name());
}

Check out the docs, the tests, and the supplied ntfs-shell application for more examples on how to use the ntfs library.

Modules

• attribute_value
  Readers for attribute value types.
• indexes
  Various types of NTFS indexes and traits to work with them.
• structured_values
  Various types of NTFS Attribute structured values.
• types
  Supplementary helper types.

Structs

• Ntfs
  Root structure describing an NTFS filesystem.
• NtfsAttribute
  A single NTFS Attribute of an NtfsFile.
• NtfsAttributeFlags
  Flags returned by NtfsAttribute::flags.
• NtfsAttributeItem
  Item returned by the NtfsAttributes iterator.
• NtfsAttributes
  Iterator over all attributes of an NtfsFile, returning an NtfsAttributeItem for each entry.
• NtfsAttributesAttached
  Iterator over all attributes of an NtfsFile, returning an NtfsAttributeItem for each entry, implementing Iterator and FusedIterator.
• NtfsAttributesRaw
  Iterator over all top-level attributes of an NtfsFile, returning an NtfsAttribute for each entry, implementing Iterator and FusedIterator.
• NtfsFile
  A single NTFS File Record.
• NtfsFileFlags
  Flags returned by NtfsFile::flags.
• NtfsFileReference
  Absolute reference to a File Record on the filesystem, composed out of a File Record Number and a Sequence Number.
• NtfsGuid
  A Globally Unique Identifier (GUID), used for Object IDs in NTFS.
• NtfsIndex
  Helper structure to iterate over all entries of an index or find a specific one.
• NtfsIndexEntries
  Iterator over all index entries of an index, sorted ascending by the index key, returning an NtfsIndexEntry for each entry.
• NtfsIndexEntry
  A single entry of an NTFS index.
• NtfsIndexEntryFlags
  Flags returned by NtfsIndexEntry::flags.
• NtfsIndexFinder
  Helper structure to efficiently find an entry in an index, created by NtfsIndex::finder.
• NtfsIndexNodeEntries
  Iterator over all index entries of a single index node, sorted ascending by the index key, returning an NtfsIndexEntry for each entry.
• NtfsIndexRecord
  A single NTFS Index Record.
• NtfsTime
  An NTFS timestamp, used for expressing file times.

Enums

• KnownNtfsFileRecordNumber
  A list of standardized NTFS File Record Numbers.
• NtfsAttributeType
  All known NTFS Attribute types.
• NtfsError
  Central error type of ntfs.

Traits

• NtfsReadSeek
  Trait to read/seek in a source by the help of a temporarily passed mutable reference to the filesystem reader.
• UpcaseOrd
  Trait for a case-insensitive ordering with respect to the $UpCase table read from the filesystem.

Type Definitions

• Result
  Central result type of ntfs.