vbr

README

VBR-Parser

This library can parse an NTFS volume boot record byte slice to pull out the necessary information to collect data from an NTFS volume.

Documentation

Index

• type RawVolumeBootRecord
  • func (rawVolumeBootRecord RawVolumeBootRecord) Parse() (vbr VolumeBootRecord, err error)
• type VolumeBootRecord

Types

type RawVolumeBootRecord

type RawVolumeBootRecord []byte

RawVolumeBootRecord is a []byte alias containing bytes of a raw volume boot record. Used as a receiver for Parse().

func (RawVolumeBootRecord) Parse

func (rawVolumeBootRecord RawVolumeBootRecord) Parse() (vbr VolumeBootRecord, err error)

Parse parses a byte slice containing an NTFS volume boot record (VBR)

type VolumeBootRecord

type VolumeBootRecord struct {
	VolumeLetter           string
	BytesPerSector         int64
	SectorsPerCluster      int64
	BytesPerCluster        int64
	MftByteOffset          int64
	MftRecordSize          int64
	ClustersPerIndexRecord int64
}

VolumeBootRecord contains relevant data about an NTFS volume