Struct MftData 

pub struct MftData {
    pub entries: Vec<MftEntry>,
    pub by_entry: HashMap<u64, usize>,
    pub by_key: HashMap<EntryKey, usize>,
}

Parsed $MFT data for correlation.

Fields

entries: Vec<MftEntry>

All parsed entries.

by_entry: HashMap<u64, usize>

Map: entry_number -> index in entries vec (for current allocation).

by_key: HashMap<EntryKey, usize>

Map: (entry, sequence) -> index (sequence-aware lookup).

Implementations

impl MftData

pub fn parse(data: &[u8]) -> Result<Self>

Parse raw $MFT data.

Errors

Currently infallible — malformed records are skipped rather than surfaced as errors — but the signature is fallible to leave room for future fatal conditions.

pub fn seed_rewind(&self) -> RewindEngine

Seed a RewindEngine with the current MFT state.

pub fn detect_timestomping(&self) -> Vec<&MftEntry>

Detect potential timestomping: $SI created before $FN created.

pub fn get_by_entry(&self, entry_number: u64) -> Option<&MftEntry>

Get entry by entry number (current allocation).

pub fn get_by_key(&self, key: &EntryKey) -> Option<&MftEntry>

Get entry by (entry, sequence) pair.