Crate mft 

Re-exports

pub use attribute::MftAttribute;

pub use attribute::x10::StandardInfoAttr;

pub use attribute::x30::FileNameAttr;

pub use crate::mft::MftParser;

pub use entry::EntryHeader;

pub use entry::MftEntry;

pub use utf16::Utf16LeStr;

Modules

attribute

bodyfile

Sleuth Kit bodyfile output, for timelining with mactime and similar tools.

csv

entry

err

mft

ntfs

utf16

Macros

impl_serialize_for_bitflags

Structs

Timestamp

An instant in time represented as the number of nanoseconds since the Unix epoch.

Functions

serialize_option_timestamp

serialize_option_windows_path

Same as serialize_windows_path, for an optional path.

serialize_timestamp

Serializes a timestamp as RFC 3339 in UTC with 100ns precision, e.g. 2007-06-30T12:50:52.2523952Z.

serialize_windows_path

Serializes a path with \ separators, see windows_path.

windows_filetime_to_timestamp

Converts a Windows FILETIME (100ns intervals since 1601-01-01 UTC) to a timestamp, keeping the full 100ns resolution.

windows_path

Formats a path resolved by crate::MftParser::get_full_path_for_entry with \ separators, the way Windows writes NTFS paths, whatever the host platform.