Enum FileOperation 

pub enum FileOperation {
    Create,
    Delete,
    Rename,
    IndexInsert,
    IndexDelete,
    AttributeCreate,
    AttributeDelete,
    Resize,
    DataWrite,
    BitmapAllocation,
    TransactionControl,
    TableDump,
    Noop,
    Unknown(u16, u16),
}

A higher-level file operation reconstructed from a $LogFile LFS record’s (redo, undo) operation pair.

The taxonomy follows the structural mutation each redo opcode performs (see the module docs for the per-opcode source citations). It is deliberately coarse: one variant per class of on-disk effect a forensic timeline cares about, not one per raw opcode (that vocabulary is LogOp).

Variants

Create

A file record segment was initialized — a new MFT entry, i.e. file/dir creation (InitializeFileRecordSegment, redo 0x02).

Delete

A file record segment was freed — file/dir deletion (DeallocateFileRecordSegment, redo 0x03).

Rename

A $FILE_NAME in a directory index was updated in place — a rename / move (or an in-index timestamp/size update). UpdateFileNameRoot (0x13) / UpdateFileNameAllocation (0x14), each self-paired.

IndexInsert

A name was inserted into a directory index — the create side of a link/rename. AddIndexEntryRoot (0x0C) / AddIndexEntryAllocation (0x0E).

IndexDelete

A name was removed from a directory index — the delete side of an unlink/rename. DeleteIndexEntryRoot (0x0D) / DeleteIndexEntryAllocation (0x0F).

AttributeCreate

A new attribute was added to a file record (CreateAttribute, 0x05).

AttributeDelete

An attribute was removed from a file record (DeleteAttribute, 0x06).

Resize

An attribute’s logical/allocated/initialized sizes changed — a file resize (SetNewAttributeSizes, 0x0B).

DataWrite

Attribute data (resident or non-resident) was written: a content update, run-list / VCN mapping change, or index-buffer write. UpdateResidentValue (0x07), UpdateNonResidentValue (0x08), UpdateMappingPairs (0x09), WriteEndOfFileRecordSegment (0x04), WriteEndOfIndexBuffer (0x10), SetIndexEntryVcnRoot (0x11), SetIndexEntryVcnAllocation (0x12), UpdateRecordDataRoot (0x21), UpdateRecordDataAllocation (0x22).

BitmapAllocation

A cluster/MFT-allocation bitmap bit was set, cleared, or clusters marked dirty — space (de)allocation. SetBitsInNonResidentBitMap (0x15), ClearBitsInNonResidentBitMap (0x16), DeleteDirtyClusters (0x0A).

TransactionControl

Transaction-boundary control, not an on-disk file mutation: EndTopLevelAction (0x18), PrepareTransaction (0x19), CommitTransaction (0x1A), ForgetTransaction (0x1B), CompensationLogRecord (0x01).

TableDump

A restart-area / open-attribute-table / dirty-page / transaction-table dump or hot-fix — log housekeeping that records no file change. HotFix (0x17), OpenNonResidentAttribute (0x1C), OpenAttributeTableDump (0x1D), AttributeNamesDump (0x1E), DirtyPageTableDump (0x1F), TransactionTableDump (0x20).

Noop

A no-op log record (Noop, redo 0x00 with no undo effect).

Unknown(u16, u16)

The (redo, undo) opcode pair is not a recognised file operation. The raw codes are surfaced verbatim — (redo_code, undo_code) — so an investigator can identify the operation themselves (never dropped).

Implementations

impl FileOperation

pub fn classify(record: &LogRecord) -> Self

Classify a single decoded LFS LogRecord into its file operation.

The redo opcode names the operation; the undo opcode is the inverse the recovery pass would apply. A Noop redo paired with a substantive undo (the form NTFS uses to log a pure deallocation) is classified by the undo. Any pair outside the documented map yields FileOperation::Unknown carrying both raw codes.

Trait Implementations

impl Clone for FileOperation

fn clone(&self) -> FileOperation

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Copy for FileOperation

impl Debug for FileOperation

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for FileOperation

impl PartialEq for FileOperation

fn eq(&self, other: &FileOperation) -> bool

Equality operator ==.

fn ne(&self, other: &Rhs) -> bool

Inequality operator !=.

impl StructuralPartialEq for FileOperation