ntfs

Documentation

Index

• type MFTEntry
  • func NewMftEntry(h *parser.MFTHighlight) *MFTEntry
• type MFTProcessor
  • func (MFTProcessor) Run(in string, _ *processors.Config, out writer.IManager) processors.PError

Types

type MFTEntry

type MFTEntry struct {
	EntryNumber                         int64
	InUse                               bool
	ParentEntryNumber                   uint64
	FullPath                            string
	FileName                            string
	FileSize                            int64
	ReferenceCount                      int64
	IsDir                               bool
	CreatedStandardInformation          string
	CreatedFileName                     string
	LastModifiedStandardInformation     string
	LastModifiedFileName                string
	LastRecordChangeStandardInformation string
	LastRecordChangeFileName            string
	LastAccessStandardInformation       string
	LastAccessFileName                  string
}

func NewMftEntry

func NewMftEntry(h *parser.MFTHighlight) *MFTEntry

type MFTProcessor

type MFTProcessor struct {
	processors.Default
}

func (MFTProcessor) Run

func (MFTProcessor) Run(in string, _ *processors.Config, out writer.IManager) processors.PError