Struct MftRecordHeader 

pub struct MftRecordHeader {

    pub signature: [u8; 4],
    pub usa_offset: u16,
    pub usa_count: u16,
    pub lsn: u64,
    pub sequence_number: u16,
    pub hard_link_count: u16,
    pub first_attribute_offset: u16,
    pub flags: u16,
    pub used_size: u32,
    pub allocated_size: u32,
    pub base_record: u64,
    pub next_attr_id: u16,
    pub record_number: u32,
}

Parsed MFT file-record-segment header.

Fields

signature: [u8; 4]

Record signature: FILE (normal) or BAAD (chkdsk marked it corrupt).

usa_offset: u16

Byte offset of the Update Sequence Array within the record.

usa_count: u16

Number of u16 entries in the USA (1 USN + one original per sector).

lsn: u64

$LogFile sequence number of the last change to this record.

sequence_number: u16

Reuse counter — incremented each time this record number is reallocated.

hard_link_count: u16

Number of hard links ($FILE_NAME attributes) to this record.

first_attribute_offset: u16

Byte offset of the first attribute.

flags: u16

Record flags (see is_in_use / is_directory).

used_size: u32

Bytes of the record actually used.

allocated_size: u32

Bytes allocated to the record (the record size).

base_record: u64

File reference to the base record (0 when this is the base record).

next_attr_id: u16

Id to assign to the next attribute added.

record_number: u32

This record’s own number (Windows XP and later).

Implementations

impl MftRecordHeader

pub fn is_in_use(&self) -> bool

true if the record is currently allocated (in use).

pub fn is_directory(&self) -> bool

true if the record describes a directory.

pub fn is_base_record(&self) -> bool

true if this is a base record (not an extension/child record).

pub fn is_corrupt(&self) -> bool

true if chkdsk marked this record corrupt (BAAD signature).

pub fn parse(buf: &[u8]) -> Result<MftRecordHeader>

Parse a record header from the start of a record buffer.

Does not apply the fixup (the header fields all precede the first sector boundary). Validates the FILE/BAAD signature.

Errors

NtfsError::TooShort if buf is smaller than the header, or NtfsError::BadRecordSignature for an unrecognised signature.

Trait Implementations

impl Clone for MftRecordHeader

fn clone(&self) -> MftRecordHeader

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MftRecordHeader

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for MftRecordHeader

impl PartialEq for MftRecordHeader

fn eq(&self, other: &MftRecordHeader) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for MftRecordHeader