Struct mft::entry::EntryHeader
source · pub struct EntryHeader {Show 13 fields
pub signature: [u8; 4],
pub usa_offset: u16,
pub usa_size: u16,
pub metadata_transaction_journal: u64,
pub sequence: u16,
pub hard_link_count: u16,
pub first_attribute_record_offset: u16,
pub flags: EntryFlags,
pub used_entry_size: u32,
pub total_entry_size: u32,
pub base_reference: MftReference,
pub first_attribute_id: u16,
pub record_number: u64,
}
Expand description
https://docs.microsoft.com/en-us/windows/desktop/devnotes/file-record-segment-header The MFT entry can be filled entirely with 0-byte values.
Fields§
§signature: [u8; 4]
MULTI_SECTOR_HEADER The signature. This value is a convenience to the user. This is either “BAAD”, “FILE”, or “\x00\x00\x00\x00”
usa_offset: u16
The offset to the update sequence array, from the start of this structure. The update sequence array must end before the last USHORT value in the first sector.
usa_size: u16
§metadata_transaction_journal: u64
Metadata transaction journal sequence number (Reserved1 in windows docs) Contains a $LogFile Sequence Number (LSN) (metz)
sequence: u16
The sequence number. This value is incremented each time that a file record segment is freed; it is 0 if the segment is not used. The SequenceNumber field of a file reference must match the contents of this field; if they do not match, the file reference is incorrect and probably obsolete.
hard_link_count: u16
§first_attribute_record_offset: u16
The offset of the first attribute record, in bytes.
flags: EntryFlags
§used_entry_size: u32
Contains the number of bytes of the MFT entry that are in use
total_entry_size: u32
§base_reference: MftReference
A file reference to the base file record segment for this file. If this is the base file record, the value is 0. See MFT_SEGMENT_REFERENCE.
first_attribute_id: u16
§record_number: u64
Implementations§
source§impl EntryHeader
impl EntryHeader
sourcepub fn from_reader<R: Read>(reader: &mut R, entry_id: u64) -> Result<EntryHeader>
pub fn from_reader<R: Read>(reader: &mut R, entry_id: u64) -> Result<EntryHeader>
Reads an entry from a stream, will error if the entry is empty (zeroes) Since the entry id is not present in the header, it should be provided by the caller.
pub fn is_valid(&self) -> bool
pub fn zero() -> Self
Trait Implementations§
source§impl Clone for EntryHeader
impl Clone for EntryHeader
source§fn clone(&self) -> EntryHeader
fn clone(&self) -> EntryHeader
1.0.0 · source§fn clone_from(&mut self, source: &Self)
fn clone_from(&mut self, source: &Self)
source
. Read more