inspect

package
v0.0.0-...-eb4ac69 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: May 3, 2018 License: MIT Imports: 9 Imported by: 0

Documentation

Index

Constants

View Source 
const BUFFER_SIZE int64 = 100 * 1024 * 1024
View Source 
const STATE_FORMAT_NAME = "States"

Variables

This section is empty.

Functions

func FindPositionsWithPattern 

func FindPositionsWithPattern(name string, pattern []byte, patterns ...[]byte) ([][]int64, error)

func FindPositionsWithType 

func FindPositionsWithType(name string, rectype core.RecordType, rectypes ...core.RecordType) ([][]int64, error)

func Scan 

func Scan(name string, destination *os.File) error

Types

type FileFrequencies 

type FileFrequencies map[FilePair]uint

func (FileFrequencies) Add 

func (self FileFrequencies) Add(parent data.FileRef, name string) bool

type FilePair 

type FilePair struct {
	Parent data.FileRef
	Name   string
}

type IStateRecord 

type IStateRecord interface {
	data.IDataRecord

	GetType() StateRecordType
	GetHeader() *core.RecordHeader
	GetMftId() string
	SetMft(state *StateMft)
	GetAttributeDesc(attr *StateAttribute) (*core.AttributeDesc, error)
	GetAttribute(pos int64) *StateAttribute
	GetAttributes(attr core.AttributeType, others ...core.AttributeType) []*StateAttribute
	Init(disk *core.DiskIO) (bool, error)
}

type IStateStreamItem 

type IStateStreamItem interface {
	Index() int
	Offset() int64
	Record() IStateRecord
}

type NtfsDisk 

type NtfsDisk struct {
	// contains filtered or unexported fields
}

func OpenNtfsDisk 

func OpenNtfsDisk(name string, mft_shift int64) (*NtfsDisk, error)

func (*NtfsDisk) Close 

func (self *NtfsDisk) Close() error

func (*NtfsDisk) FindIndex 

func (self *NtfsDisk) FindIndex(position int64) data.FileIndex

func (*NtfsDisk) GetAttributeValue 

func (self *NtfsDisk) GetAttributeValue(desc *core.AttributeDesc, read bool) (*core.AttributeValue, error)

func (*NtfsDisk) GetDisk 

func (self *NtfsDisk) GetDisk() *core.DiskIO

func (*NtfsDisk) GetFileRecordFilename 

func (self *NtfsDisk) GetFileRecordFilename(record *core.FileRecord) (string, error)

func (*NtfsDisk) InitState 

func (self *NtfsDisk) InitState(state IStateRecord) (bool, error)

func (*NtfsDisk) ReadFileRecord 

func (self *NtfsDisk) ReadFileRecord(index int64, record *core.FileRecord) error

func (*NtfsDisk) ReadFileRecordFromRef 

func (self *NtfsDisk) ReadFileRecordFromRef(ref data.FileRef, record *core.FileRecord) error

func (*NtfsDisk) ReadRecordHeader 

func (self *NtfsDisk) ReadRecordHeader(index int64, header *core.RecordHeader) error

func (*NtfsDisk) ReadRecordHeaderFromRef 

func (self *NtfsDisk) ReadRecordHeaderFromRef(ref data.FileRef, header *core.RecordHeader) error

func (*NtfsDisk) SetMftShift 

func (self *NtfsDisk) SetMftShift(shift int64) error

func (*NtfsDisk) SetStart 

func (self *NtfsDisk) SetStart(start int64) error

type StateAttribute 

type StateAttribute struct {
	BasePosition   int64
	RecordPosition int64
	Header         core.AttributeHeader
	RunList        core.RunList
}

type StateBase 

type StateBase struct {
	Position int64
	MftId    string
	// contains filtered or unexported fields
}

func (*StateBase) GetAttribute 

func (self *StateBase) GetAttribute(int64) *StateAttribute

func (*StateBase) GetAttributeDesc 

func (self *StateBase) GetAttributeDesc(*StateAttribute) (*core.AttributeDesc, error)

func (*StateBase) GetAttributes 

func (self *StateBase) GetAttributes(core.AttributeType, ...core.AttributeType) []*StateAttribute

func (*StateBase) GetHeader 

func (self *StateBase) GetHeader() *core.RecordHeader

func (*StateBase) GetMftId 

func (self *StateBase) GetMftId() string

func (*StateBase) GetPosition 

func (self *StateBase) GetPosition() int64

func (*StateBase) GetType 

func (self *StateBase) GetType() StateRecordType

func (*StateBase) Init 

func (self *StateBase) Init(*core.DiskIO) (bool, error)

func (*StateBase) Print 

func (self *StateBase) Print()

func (*StateBase) SetMft 

func (self *StateBase) SetMft(state *StateMft)

func (*StateBase) String 

func (self *StateBase) String() string

type StateDirEntry 

type StateDirEntry struct {
	BasePosition   int64
	RecordPosition int64
	Parent         data.FileRef
	Header         core.DirectoryEntryExtendedHeader
	Name           string
}

type StateFileRecord 

type StateFileRecord struct {
	StateBase

	Header     core.FileRecord
	Reference  data.FileRef
	Parent     data.FileRef
	Name       string
	Names      []string
	Attributes []*StateAttribute
}

func (*StateFileRecord) GetAttribute 

func (self *StateFileRecord) GetAttribute(pos int64) *StateAttribute

func (*StateFileRecord) GetAttributeDesc 

func (self *StateFileRecord) GetAttributeDesc(attr *StateAttribute) (*core.AttributeDesc, error)

func (*StateFileRecord) GetAttributes 

func (self *StateFileRecord) GetAttributes(attr core.AttributeType, others ...core.AttributeType) []*StateAttribute

func (*StateFileRecord) GetEncodingCode 

func (self *StateFileRecord) GetEncodingCode() string

func (*StateFileRecord) GetHeader 

func (self *StateFileRecord) GetHeader() *core.RecordHeader

func (*StateFileRecord) GetLabel 

func (self *StateFileRecord) GetLabel() string

func (*StateFileRecord) GetName 

func (self *StateFileRecord) GetName() string

func (*StateFileRecord) GetParent 

func (self *StateFileRecord) GetParent() data.FileRef

func (*StateFileRecord) GetType 

func (self *StateFileRecord) GetType() StateRecordType

func (*StateFileRecord) HasName 

func (self *StateFileRecord) HasName() bool

func (*StateFileRecord) Init 

func (self *StateFileRecord) Init(disk *core.DiskIO) (bool, error)

func (*StateFileRecord) IsDir 

func (self *StateFileRecord) IsDir() bool

func (*StateFileRecord) MarshalBinary 

func (self *StateFileRecord) MarshalBinary() ([]byte, error)

func (*StateFileRecord) Print 

func (self *StateFileRecord) Print()

func (*StateFileRecord) SetName 

func (self *StateFileRecord) SetName(name string)

func (*StateFileRecord) String 

func (self *StateFileRecord) String() string

func (*StateFileRecord) UnmarshalBinary 

func (self *StateFileRecord) UnmarshalBinary(data []byte) error

type StateIndexRecord 

type StateIndexRecord struct {
	StateBase

	RecordRef data.FileRef
	Header    core.IndexBlockHeader
	Entries   []*StateDirEntry
}

func (*StateIndexRecord) GetAttribute 

func (self *StateIndexRecord) GetAttribute(int64) *StateAttribute

func (*StateIndexRecord) GetAttributeDesc 

func (self *StateIndexRecord) GetAttributeDesc(*StateAttribute) (*core.AttributeDesc, error)

func (*StateIndexRecord) GetAttributes 

func (self *StateIndexRecord) GetAttributes(core.AttributeType, ...core.AttributeType) []*StateAttribute

func (*StateIndexRecord) GetEncodingCode 

func (self *StateIndexRecord) GetEncodingCode() string

func (*StateIndexRecord) GetHeader 

func (self *StateIndexRecord) GetHeader() *core.RecordHeader

func (*StateIndexRecord) GetLabel 

func (self *StateIndexRecord) GetLabel() string

func (*StateIndexRecord) GetType 

func (self *StateIndexRecord) GetType() StateRecordType

func (*StateIndexRecord) Init 

func (self *StateIndexRecord) Init(disk *core.DiskIO) (bool, error)

func (*StateIndexRecord) MarshalBinary 

func (self *StateIndexRecord) MarshalBinary() ([]byte, error)

func (*StateIndexRecord) Print 

func (self *StateIndexRecord) Print()

func (*StateIndexRecord) String 

func (self *StateIndexRecord) String() string

func (*StateIndexRecord) UnmarshalBinary 

func (self *StateIndexRecord) UnmarshalBinary(data []byte) error

type StateMft 

type StateMft struct {
	StateBase

	Header     core.FileRecord
	RunList    core.RunList
	PartOrigin int64
}

func (*StateMft) GetAttribute 

func (self *StateMft) GetAttribute(int64) *StateAttribute

func (*StateMft) GetAttributeDesc 

func (self *StateMft) GetAttributeDesc(*StateAttribute) (*core.AttributeDesc, error)

func (*StateMft) GetAttributes 

func (self *StateMft) GetAttributes(core.AttributeType, ...core.AttributeType) []*StateAttribute

func (*StateMft) GetEncodingCode 

func (self *StateMft) GetEncodingCode() string

func (*StateMft) GetHeader 

func (self *StateMft) GetHeader() *core.RecordHeader

func (*StateMft) GetLabel 

func (self *StateMft) GetLabel() string

func (*StateMft) GetReference 

func (self *StateMft) GetReference(file *StateFileRecord) data.FileRef

func (*StateMft) GetType 

func (self *StateMft) GetType() StateRecordType

func (*StateMft) Init 

func (self *StateMft) Init(disk *core.DiskIO) (bool, error)

func (*StateMft) IsMft 

func (self *StateMft) IsMft() bool

func (*StateMft) IsMirror 

func (self *StateMft) IsMirror(disk *NtfsDisk) (bool, error)

func (*StateMft) MarshalBinary 

func (self *StateMft) MarshalBinary() ([]byte, error)

func (*StateMft) Print 

func (self *StateMft) Print()

func (*StateMft) String 

func (self *StateMft) String() string

func (*StateMft) UnmarshalBinary 

func (self *StateMft) UnmarshalBinary(data []byte) error

type StateReader 

type StateReader struct {
	// contains filtered or unexported fields
}

func MakeStateReader 

func MakeStateReader(file *os.File) (*StateReader, error)

func OpenStateReader 

func OpenStateReader(filename string) (*StateReader, error)

func (*StateReader) Close 

func (self *StateReader) Close() error

func (*StateReader) GetCount 

func (self *StateReader) GetCount() int

func (*StateReader) GetIndexCount 

func (self *StateReader) GetIndexCount() int

func (*StateReader) GetRecordAt 

func (self *StateReader) GetRecordAt(index int) (IStateRecord, error)

func (*StateReader) MakeStream 

func (self *StateReader) MakeStream() (StateStream, error)

func (*StateReader) ReadRecord 

func (self *StateReader) ReadRecord(position int64) (IStateRecord, error)

type StateRecordType 

type StateRecordType uint8
const (
	STATE_RECORD_TYPE_NONE StateRecordType = iota
	STATE_RECORD_TYPE_ERROR
	STATE_RECORD_TYPE_FILE
	STATE_RECORD_TYPE_INDEX
	STATE_RECORD_TYPE_MFT
)

type StateStream 

type StateStream <-chan IStateStreamItem

func (StateStream) Close 

func (self StateStream) Close() error

type StateWriter 

type StateWriter struct {
	// contains filtered or unexported fields
}

func MakeStateWriter 

func MakeStateWriter(file *os.File) (*StateWriter, error)

func OpenStateWriter 

func OpenStateWriter(filename string) (*StateWriter, error)

func (*StateWriter) Close 

func (self *StateWriter) Close() (err error)

func (*StateWriter) Write 

func (self *StateWriter) Write(rec IStateRecord) error

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.