#[non_exhaustive]pub struct RawPage {
pub page_number: u32,
pub page_flags: u32,
pub previous_page: u32,
pub next_page: u32,
pub father_data_page: u32,
pub object_id: u32,
pub available_data_size: u16,
pub available_page_tag: u16,
pub bytes: Vec<u8>,
}Expand description
One page read out of the ESE database. Header parsed; page-body bytes retained so downstream (a future B-tree walker) can decode tags on demand.
Fields (Non-exhaustive)§
This struct is marked as non-exhaustive
Struct { .. } syntax; cannot be matched against without a wildcard ..; and struct update syntax will not work.page_number: u321-indexed page number.
page_flags: u32Bitmask of page_flag flags.
previous_page: u32Page number of the previous sibling in the B-tree chain (0 = none).
next_page: u32Page number of the next sibling in the B-tree chain (0 = none).
father_data_page: u32Father Data Page (the parent B-tree node’s page number).
object_id: u32Object identifier this page belongs to (the FDP object ID).
available_data_size: u16Available data size (bytes free for new tags on this page).
available_page_tag: u16Number of tag entries on this page.
bytes: Vec<u8>The full page bytes (retained so B-tree/tag decoders can work on top).
Implementations§
Source§impl RawPage
impl RawPage
Sourcepub fn parse(
page_number: u32,
bytes: &[u8],
page_size: u32,
) -> Result<Self, Error>
pub fn parse( page_number: u32, bytes: &[u8], page_size: u32, ) -> Result<Self, Error>
Parse a page’s header. The layout differs between the “old” (pre-Vista, page-size- specific) and “new” (post-Vista, standard 40-byte header) formats. v0.1 supports the new format that Server 2008+ NTDS.dit uses.
New-format page header (40 bytes):
0..8 XOR checksum (u32 pair) + ECC checksum
8..12 page number (or 0 for pre-Vista format where number is implicit)
12..20 modified time (u64)
20..24 previous page
24..28 next page
28..32 father data page
32..34 available data size
34..36 available uncommitted data size
36..38 available data offset
38..40 available page tag
40..44 page flagsobject_id sits at 44..48 in the new format’s extended fields.