usnrs 0.2.1

A tool and library to parse USN Journal files
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

extern crate usnrs;

use clap::{arg, Parser, ValueEnum};
use usnrs::Usn;

#[derive(Parser)]
struct Args {
    /// UsnJrnl:$J file to parse
    file: String,

    /// Path to a $MFT file. If present, resolves full paths to files
    #[arg(long)]
    mft: Option<String>,

    /// Start offset
    #[arg(long)]
    start: Option<u64>,

    /// Output format
    #[arg(short, long)]
    format: Option<OutputFormat>,
}

#[derive(Copy, Clone, PartialEq, Eq, PartialOrd, Ord, ValueEnum)]
enum OutputFormat {
    Default,
    Bodyfile,
    Debug,
}

fn main() {
    let args = Args::parse();

    let usn = if let Some(mft_path) = args.mft {
        Usn::from_usn_with_mft(&args.file, args.start, &mft_path).unwrap()
    }
    else {
        Usn::from_usn(&args.file, args.start).unwrap()
    };

    for (filename, entry) in usn {
        let line = match args.format.unwrap_or(OutputFormat::Default) {
            OutputFormat::Default => {
                format!(
                    "{} | {} | {} | {}",
                    entry.time(),
                    filename,
                    entry.attributes(),
                    entry.reasons()
                )
            }
            OutputFormat::Bodyfile => {
                format!(
                    "0|{} (USN: {})|{}-{}|0|0|0|0|{}|{}|{}|{}",
                    filename,
                    entry.reasons(),
                    entry.mft_entry_num(),
                    entry.sequence_num(),
                    entry.unix_timestamp(),
                    entry.unix_timestamp(),
                    entry.unix_timestamp(),
                    entry.unix_timestamp()
                )
            }
            OutputFormat::Debug => {
                format!("{:?}", entry)
            }
        };
        println!("{}", line);
    }
}