pub struct LogRecord {
pub page_offset: usize,
pub this_lsn: u64,
pub client_previous_lsn: u64,
pub client_undo_next_lsn: u64,
pub record_type: u32,
pub transaction_id: u32,
pub redo_op: LogOp,
pub undo_op: LogOp,
pub target_attribute: u16,
pub mft_cluster_index: u16,
pub target_vcn: u64,
}Expand description
One decoded LFS log record from a $LogFile RCRD page.
Combines the Log File Service record header (this/previous/undo LSNs, record
type, transaction id) with the NTFS log-record operation descriptor that
forms the record’s client data: the redo/undo LogOp, the target
attribute (an index into the Open Attribute Table), and the target VCN.
Fields§
§page_offset: usizeByte offset of this record within its RecordPage’s data.
this_lsn: u64This record’s log sequence number (LFS record header, offset 0x00).
client_previous_lsn: u64The client’s previous LSN (offset 0x08).
client_undo_next_lsn: u64The client’s undo-next LSN (offset 0x10).
record_type: u32LFS record type (offset 0x20): normal log record vs restart/checkpoint.
transaction_id: u32Transaction identifier (offset 0x24).
redo_op: LogOpThe redo operation (NTFS log-record offset 0x30 — the client data start).
undo_op: LogOpThe undo operation (offset 0x32).
target_attribute: u16Index into the Open Attribute Table identifying the target (offset 0x3C).
mft_cluster_index: u16MFT cluster index of the target (offset 0x44).
target_vcn: u64Target VCN (offset 0x48).