Struct mft::csv::FlatMftEntryWithName

source ·

pub struct FlatMftEntryWithName {Show 22 fields
    pub signature: String,
    pub entry_id: u64,
    pub sequence: u16,
    pub base_entry_id: u64,
    pub base_entry_sequence: u16,
    pub hard_link_count: u16,
    pub flags: EntryFlags,
    pub used_entry_size: u32,
    pub total_entry_size: u32,
    pub file_size: u64,
    pub is_a_directory: bool,
    pub is_deleted: bool,
    pub has_alternate_data_streams: bool,
    pub standard_info_flags: Option<FileAttributeFlags>,
    pub standard_info_last_modified: Option<DateTime<Utc>>,
    pub standard_info_last_access: Option<DateTime<Utc>>,
    pub standard_info_created: Option<DateTime<Utc>>,
    pub file_name_flags: Option<FileAttributeFlags>,
    pub file_name_last_modified: Option<DateTime<Utc>>,
    pub file_name_last_access: Option<DateTime<Utc>>,
    pub file_name_created: Option<DateTime<Utc>>,
    pub full_path: PathBuf,
}

Expand description

Used for CSV output

Fields§

§signature: String§entry_id: u64§sequence: u16§base_entry_id: u64§base_entry_sequence: u16§hard_link_count: u16§flags: EntryFlags§used_entry_size: u32

The size of the file, in bytes.

§total_entry_size: u32§file_size: u64

The size of the file, if available, from the X80 attribute. Will be 0 if no $DATA attribute is found.

§is_a_directory: bool

Indicates whether the record is a directory.

§is_deleted: bool

Indicates whether the record has the ALLOCATED bit turned off.

§has_alternate_data_streams: bool

Indicates whether the record has alternate data streams.

§standard_info_flags: Option<FileAttributeFlags>

All of these fields are present for entries that have an 0x10 attribute.

§standard_info_last_modified: Option<DateTime<Utc>>§standard_info_last_access: Option<DateTime<Utc>>§standard_info_created: Option<DateTime<Utc>>§file_name_flags: Option<FileAttributeFlags>

All of these fields are present for entries that have an 0x30 attribute.

§file_name_last_modified: Option<DateTime<Utc>>§file_name_last_access: Option<DateTime<Utc>>§file_name_created: Option<DateTime<Utc>>§full_path: PathBuf