Struct ntfs::NtfsAttribute

pub struct NtfsAttribute<'n, 'f> { /* private fields */ }

A single NTFS Attribute of an NtfsFile.

Not to be confused with NtfsFileAttributeFlags.

This structure is returned by the NtfsAttributesRaw iterator as well as NtfsAttributeItem::to_attribute.

Reference: https://flatcap.github.io/linux-ntfs/ntfs/concepts/attribute_header.html

Implementations

impl<'n, 'f> NtfsAttribute<'n, 'f>

pub fn attribute_length(&self) -> u32

Returns the length of this NTFS Attribute, in bytes.

This denotes the length of the attribute structure on disk. Apart from various headers, this structure also includes the name and, for resident attributes, the actual value.

pub fn flags(&self) -> NtfsAttributeFlags

Returns flags set for this attribute as specified by NtfsAttributeFlags.

pub fn instance(&self) -> u16

Returns the identifier of this attribute that is unique within the NtfsFile.

pub fn is_resident(&self) -> bool

Returns true if this is a resident attribute, i.e. one where its value is part of the attribute structure.

pub fn name(&self) -> Result<NtfsString<'f>>

Gets the name of this NTFS Attribute (if any) and returns it wrapped in an NtfsString.

Note that most NTFS attributes have no name and are distinguished by their types. Use NtfsAttribute::ty to get the attribute type.

pub fn name_length(&self) -> usize

Returns the length of the name of this NTFS Attribute, in bytes.

An attribute name has a maximum length of 255 UTF-16 code points (510 bytes). It is always part of the attribute itself and hence also of the length returned by NtfsAttribute::attribute_length.

pub fn position(&self) -> u64

Returns the absolute position of this NTFS Attribute within the filesystem, in bytes.

pub fn resident_structured_value<S>(&self) -> Result<S> where
    S: NtfsStructuredValueFromResidentAttributeValue<'n, 'f>, 

Attempts to parse the value data as the given resident structured value type and returns that.

This is a fast path for attributes that are always resident. It doesn’t need a reference to the filesystem reader.

This function first checks that the attribute is of the required type for that structured value and if it’s a resident attribute. It returns with an error if that is not the case. It also returns an error for any parsing problem.

pub fn structured_value<T, S>(&self, fs: &mut T) -> Result<S> where
    T: Read + Seek,
    S: NtfsStructuredValue<'n, 'f>, 

Attempts to parse the value data as the given structured value type and returns that.

This function first checks that the attribute is of the required type for that structured value. It returns with an error if that is not the case. It also returns an error for any parsing problem.

pub fn ty(&self) -> Result<NtfsAttributeType>

Returns the type of this NTFS Attribute, or NtfsError::UnsupportedAttributeType if it’s an unknown type.

pub fn value(&self) -> Result<NtfsAttributeValue<'n, 'f>>

Returns an NtfsAttributeValue structure to read the value of this NTFS Attribute.

pub fn value_length(&self) -> u64

Returns the length of the value data of this NTFS Attribute, in bytes.

Trait Implementations

impl<'n, 'f> Clone for NtfsAttribute<'n, 'f>

fn clone(&self) -> NtfsAttribute<'n, 'f>

Returns a copy of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl<'n, 'f> Debug for NtfsAttribute<'n, 'f>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.