Struct Attribute 

pub struct Attribute {
    pub type_code: u32,
    pub length: u32,
    pub non_resident: bool,
    pub name: Option<String>,
    pub flags: u16,
    pub attribute_id: u16,
    pub offset: usize,
    pub body: AttributeBody,
}

A parsed MFT attribute (common header + body discriminant).

Fields

type_code: u32

Attribute type code (e.g. 0x80 for $DATA).

length: u32

Total on-disk length of this attribute, including its header.

non_resident: bool

true when the value is stored out-of-line via a runlist.

name: Option<String>

Decoded attribute name (e.g. an ADS stream name), or None when unnamed.

flags: u16

Attribute flags (compressed / encrypted / sparse).

attribute_id: u16

Attribute id, unique within the record.

offset: usize

Byte offset of this attribute within the record.

body: AttributeBody

Resident or non-resident body.

Implementations

impl Attribute

pub fn is_compressed(&self) -> bool

true if the attribute is compressed.

pub fn compression_unit(&self) -> u16

The compression-unit size as a power of two clusters (NTFS 2^n; 0 means no compression unit / resident). A compressed $DATA stores its data in 2^compression_unit-cluster units.

pub fn is_encrypted(&self) -> bool

true if the attribute is encrypted (EFS).

pub fn is_sparse(&self) -> bool

true if the attribute is sparse.

pub fn type_name(&self) -> Option<&'static str>

Canonical $NAME of this attribute type, if known.

pub fn resident_content<'a>(&self, record: &'a [u8]) -> Option<&'a [u8]>

For a resident attribute, its value bytes within record. Returns None for non-resident attributes or if the slice is out of bounds.

Trait Implementations

impl Clone for Attribute

fn clone(&self) -> Attribute

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for Attribute

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Eq for Attribute

impl PartialEq for Attribute

fn eq(&self, other: &Attribute) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl StructuralPartialEq for Attribute