Struct MftEntry 

pub struct MftEntry {

    pub entry_number: u64,
    pub sequence_number: u16,
    pub filename: String,
    pub parent_entry: u64,
    pub parent_sequence: u16,
    pub is_directory: bool,
    pub is_in_use: bool,
    pub si_created: Option<DateTime<Utc>>,
    pub si_modified: Option<DateTime<Utc>>,
    pub si_mft_modified: Option<DateTime<Utc>>,
    pub si_accessed: Option<DateTime<Utc>>,
    pub fn_created: Option<DateTime<Utc>>,
    pub fn_modified: Option<DateTime<Utc>>,
    pub fn_mft_modified: Option<DateTime<Utc>>,
    pub fn_accessed: Option<DateTime<Utc>>,
    pub full_path: String,
    pub file_size: u64,
    pub has_ads: bool,
}

Parsed MFT entry with fields relevant to USN Journal correlation.

Fields

entry_number: u64

sequence_number: u16

filename: String

parent_entry: u64

parent_sequence: u16

is_directory: bool

is_in_use: bool

si_created: Option<DateTime<Utc>>

$STANDARD_INFORMATION timestamps (user-modifiable).

si_modified: Option<DateTime<Utc>>

si_mft_modified: Option<DateTime<Utc>>

si_accessed: Option<DateTime<Utc>>

fn_created: Option<DateTime<Utc>>

$FILE_NAME timestamps (harder to modify, more trustworthy).

fn_modified: Option<DateTime<Utc>>

fn_mft_modified: Option<DateTime<Utc>>

fn_accessed: Option<DateTime<Utc>>

full_path: String

Full path resolved from MFT parent chain.

file_size: u64

File size from $DATA attribute.

has_ads: bool

Whether this entry has alternate data streams.

Trait Implementations

impl Clone for MftEntry

fn clone(&self) -> MftEntry

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for MftEntry

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.