Struct mft::entry::EntryHeader

pub struct EntryHeader {

    pub signature: [u8; 4],
    pub usa_offset: u16,
    pub usa_size: u16,
    pub metadata_transaction_journal: u64,
    pub sequence: u16,
    pub hard_link_count: u16,
    pub first_attribute_record_offset: u16,
    pub flags: EntryFlags,
    pub used_entry_size: u32,
    pub total_entry_size: u32,
    pub base_reference: MftReference,
    pub first_attribute_id: u16,
    pub record_number: u64,
}

https://docs.microsoft.com/en-us/windows/desktop/devnotes/file-record-segment-header The MFT entry can be filled entirely with 0-byte values.

Fields

signature: [u8; 4]

MULTI_SECTOR_HEADER The signature. This value is a convenience to the user. This is either “BAAD”, “FILE”, or “\x00\x00\x00\x00”

usa_offset: u16

The offset to the update sequence array, from the start of this structure. The update sequence array must end before the last USHORT value in the first sector.

usa_size: u16

metadata_transaction_journal: u64

Metadata transaction journal sequence number (Reserved1 in windows docs) Contains a $LogFile Sequence Number (LSN) (metz)

sequence: u16

The sequence number. This value is incremented each time that a file record segment is freed; it is 0 if the segment is not used. The SequenceNumber field of a file reference must match the contents of this field; if they do not match, the file reference is incorrect and probably obsolete.

hard_link_count: u16

first_attribute_record_offset: u16

The offset of the first attribute record, in bytes.

flags: EntryFlags

used_entry_size: u32

Contains the number of bytes of the MFT entry that are in use

total_entry_size: u32

base_reference: MftReference

A file reference to the base file record segment for this file. If this is the base file record, the value is 0. See MFT_SEGMENT_REFERENCE.

first_attribute_id: u16

record_number: u64

Implementations

impl EntryHeader

pub fn from_reader<R: Read>(reader: &mut R, entry_id: u64) -> Result<EntryHeader>

Reads an entry from a stream, will error if the entry is empty (zeroes) Since the entry id is not present in the header, it should be provided by the caller.

pub fn is_valid(&self) -> bool

pub fn zero() -> Self

Trait Implementations

impl Clone for EntryHeader

fn clone(&self) -> EntryHeader

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for EntryHeader

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Serialize for EntryHeader

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>where __S: Serializer,

Serialize this value into the given Serde serializer.