wxtla 0.3.1

Wired eXploring Target Layer Accessor
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58

//! NTFS filesystem driver and probe registration.

mod attribute_list;
mod boot_sector;
mod driver;
mod filesystem;
mod index;
mod record;
mod reparse;
mod runlist;
mod stream;

pub use attribute_list::{NtfsAttributeListEntry, parse_attribute_list};
pub use boot_sector::NtfsBootSector;
pub use driver::NtfsDriver;
pub use filesystem::{NtfsDataStreamInfo, NtfsFileSystem};
pub use reparse::{NtfsReparsePointInfo, NtfsReparsePointKind};

use self::boot_sector::BOOT_SECTOR_SIZE;
use crate::{
  FormatDescriptor, FormatKind, FormatProbe, ProbeConfidence, ProbeContext, ProbeMatch,
  ProbeRegistry, ProbeResult, Result,
};

/// NTFS filesystem descriptor.
pub const DESCRIPTOR: FormatDescriptor =
  FormatDescriptor::new("filesystem.ntfs", FormatKind::FileSystem);

inventory::submit! {
  crate::formats::FormatInventoryEntry::new(DESCRIPTOR, register_probes)
}

fn register_probes(registry: &mut ProbeRegistry) {
  registry.register(NtfsProbe);
}

struct NtfsProbe;

impl FormatProbe for NtfsProbe {
  fn descriptor(&self) -> FormatDescriptor {
    DESCRIPTOR
  }

  fn probe(&self, context: &ProbeContext<'_>) -> Result<ProbeResult> {
    let Ok(header) = context.header(BOOT_SECTOR_SIZE) else {
      return Ok(ProbeResult::rejected());
    };
    if boot_sector::NtfsBootSector::from_bytes(&header).is_ok() {
      Ok(ProbeResult::matched(ProbeMatch::new(
        DESCRIPTOR,
        ProbeConfidence::Exact,
        "ntfs boot sector geometry is valid",
      )))
    } else {
      Ok(ProbeResult::rejected())
    }
  }
}