Struct mft::entry::EntryHeader

pub struct EntryHeader {
    pub signature: [u8; 4],
    pub usa_offset: u16,
    pub usa_size: u16,
    pub metadata_transaction_journal: u64,
    pub sequence: u16,
    pub hard_link_count: u16,
    pub first_attribute_record_offset: u16,
    pub flags: EntryFlags,
    pub used_entry_size: u32,
    pub total_entry_size: u32,
    pub base_reference: MftReference,
    pub first_attribute_id: u16,
    pub record_number: u64,
}

https://docs.microsoft.com/en-us/windows/desktop/devnotes/file-record-segment-header The MFT entry can be filled entirely with 0-byte values.

Fields

signature: [u8; 4]

MULTI_SECTOR_HEADER The signature. This value is a convenience to the user. This is either "BAAD" or "FILE"

usa_offset: u16

The offset to the update sequence array, from the start of this structure. The update sequence array must end before the last USHORT value in the first sector.

usa_size: u16

metadata_transaction_journal: u64

Metadata transaction journal sequence number (Reserved1 in windows docs) Contains a $LogFile Sequence Number (LSN) (metz)

sequence: u16

The sequence number. This value is incremented each time that a file record segment is freed; it is 0 if the segment is not used. The SequenceNumber field of a file reference must match the contents of this field; if they do not match, the file reference is incorrect and probably obsolete.

hard_link_count: u16

first_attribute_record_offset: u16

The offset of the first attribute record, in bytes.

flags: EntryFlags

used_entry_size: u32

Contains the number of bytes of the MFT entry that are in use

total_entry_size: u32

base_reference: MftReference

A file reference to the base file record segment for this file. If this is the base file record, the value is 0. See MFT_SEGMENT_REFERENCE.

first_attribute_id: u16

record_number: u64

Methods

impl EntryHeader

pub fn from_reader<R: Read>(
    reader: &mut R,
    entry_id: u64
) -> Result<EntryHeader>

Reads an entry from a stream, will error if the entry is empty (zeroes) Since the entry id is not present in the header, it should be provided by the caller.

Trait Implementations

impl Clone for EntryHeader

fn clone(&self) -> EntryHeader

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EntryHeader

fn fmt(&self, f: &mut Formatter) -> Result

Formats the value using the given formatter.

impl Serialize for EntryHeader

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error> where
    __S: Serializer, 

Serialize this value into the given Serde serializer.