#[non_exhaustive]pub struct Inode {Show 14 fields
pub version: UfsVersion,
pub mode: u16,
pub file_type: FileType,
pub nlink: u16,
pub uid: u32,
pub gid: u32,
pub size: u64,
pub blocks: u64,
pub atime: Timespec,
pub mtime: Timespec,
pub ctime: Timespec,
pub birthtime: Option<Timespec>,
pub direct: [u64; 12],
pub indirect: [u64; 3],
/* private fields */
}Expand description
A decoded UFS inode — the metadata and block-pointer arrays a forensic tool
needs. Carries the union (superset) of the UFS1 and UFS2 dinode fields;
UFS1-absent fields (birthtime) are None. #[non_exhaustive] so later
phases add fields without a breaking change.
Fields (Non-exhaustive)§
This struct is marked as non-exhaustive
Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.version: UfsVersionThe on-disk version this inode was decoded as.
mode: u16di_mode — file type (IFMT) plus permission bits.
file_type: FileTypeThe file type decoded from di_mode & IFMT.
nlink: u16di_nlink — hard-link count.
uid: u32di_uid — owning user id.
gid: u32di_gid — owning group id.
size: u64di_size — file length in bytes.
blocks: u64di_blocks — count of 512-byte sectors actually held.
atime: Timespecdi_atime — last access time.
mtime: Timespecdi_mtime — last data-modification time.
ctime: Timespecdi_ctime — last inode-change time.
birthtime: Option<Timespec>di_birthtime — inode creation time (UFS2 only; None on UFS1).
direct: [u64; 12]di_db[UFS_NDADDR] — direct block pointers (fragment addresses). For a
fast (inline) symlink these bytes hold the target instead — see
Self::symlink_target.
indirect: [u64; 3]di_ib[UFS_NIADDR] — single/double/triple indirect block pointers
(fragment addresses).
Implementations§
Source§impl Inode
impl Inode
Sourcepub fn parse(
data: &[u8],
version: UfsVersion,
endian: Endian,
) -> Result<Self, UfsError>
pub fn parse( data: &[u8], version: UfsVersion, endian: Endian, ) -> Result<Self, UfsError>
Decode a single dinode from data, which must begin at the dinode (a
256-byte UFS2 or 128-byte UFS1 record). version and endian come from
the superblock. maxsymlinklen is fs_maxsymlinklen, the inline-symlink
threshold; pass it so a symlink whose target fits inline is decoded from
the block-pointer bytes. Use read_inode to locate and decode by inode
number; this is the lower-level decode over already-located bytes.
Reads through bounds-checked helpers, so a short data never panics —
missing tail bytes read as 0. It still fails loud when data is too
short to hold the whole dinode, so a truncated buffer is reported rather
than silently zero-filled.
§Errors
UfsError::Truncated if data is shorter than the dinode for this
version.
Sourcepub fn parse_with_maxsymlink(
data: &[u8],
version: UfsVersion,
endian: Endian,
maxsymlinklen: i32,
) -> Result<Self, UfsError>
pub fn parse_with_maxsymlink( data: &[u8], version: UfsVersion, endian: Endian, maxsymlinklen: i32, ) -> Result<Self, UfsError>
Decode a dinode using an explicit fs_maxsymlinklen (the inline-symlink
threshold from the superblock). Self::parse calls this with the
format default (120); read_inode passes the superblock’s value.
§Errors
UfsError::Truncated if data is shorter than the dinode.
Sourcepub fn is_regular(&self) -> bool
pub fn is_regular(&self) -> bool
true when this inode is a regular file.
Sourcepub fn is_symlink(&self) -> bool
pub fn is_symlink(&self) -> bool
true when this inode is a symbolic link.
Sourcepub fn symlink_target(&self) -> Option<&[u8]>
pub fn symlink_target(&self) -> Option<&[u8]>
The inline fast-symlink target bytes, when this inode is a symlink whose
target is stored inline (di_size <= fs_maxsymlinklen). None for
non-symlinks and for slow symlinks whose target lives in a data block
(those are resolved by reading the block in a later phase). The bytes are
the raw path, not NUL-terminated.