GoFor_MFT_Parser

package module

Go to main page

Versions in this module

v0

v0.2.1

Oct 12, 2019

v0.2.0

Oct 11, 2019

Changes in this version

type UnresolvedDirectoryTree

+ func (unresolvedDirectoryTree UnresolvedDirectoryTree) Resolve() (directoryTree DirectoryTree)

v0.1.1

Oct 10, 2019

Changes in this version

type FileNameAttribute

+ FileNamespace string

+ ParentDirRecordNumber uint64

v0.1.0

Oct 8, 2019

Changes in this version

+ func ParseMFT(inputFile *os.File, writer ResultWriter, streamer io.Writer, ...)

+ func ParseMftRecords(reader io.Reader, bytesPerCluster int64, directoryTree DirectoryTree, ...)

+ type CsvResultWriter struct

+ func (csvResultWriter *CsvResultWriter) ResultWriter(streamer io.Writer, outputChannel *chan UsefulMftFields, ...)

+ type DataAttribute struct

+ FlagResident bool

+ NonResidentDataAttribute NonResidentDataAttribute

+ ResidentDataAttribute ResidentDataAttribute

+ TotalSize uint8

+ type DataRun struct

+ AbsoluteOffset int64

+ Length int64

+ type DataRuns map[int]DataRun

+ type DirectoryTree map[uint64]string

+ func BuildDirectoryTree(reader io.Reader) (directoryTree DirectoryTree, err error)

+ type FileNameAttribute struct

+ FileName string

+ FileNameFlags FileNameFlags

+ FnAccessed time.Time

+ FnChanged time.Time

+ FnCreated time.Time

+ FnModified time.Time

+ LogicalFileSize uint64

+ PhysicalFileSize uint64

+ type FileNameAttributes []FileNameAttribute

+ type FileNameFlags struct

+ Archive bool

+ Compressed bool

+ Device bool

+ Directory bool

+ Encrypted bool

+ Hidden bool

+ IndexView bool

+ Normal bool

+ NotContentIndexed bool

+ Offline bool

+ ReadOnly bool

+ Reparse bool

+ Sparse bool

+ System bool

+ Temporary bool

+ type MasterFileTableRecord struct

+ DataAttribute DataAttribute

+ FileNameAttributes []FileNameAttribute

+ RecordHeader RecordHeader

+ StandardInformationAttributes StandardInformationAttribute

+ type NonResidentDataAttribute struct

+ DataRuns DataRuns

+ type RawAttributes []rawAttribute

+ func (rawAttributes RawAttributes) Parse(bytesPerCluster int64) (fileNameAttributes FileNameAttributes, ...)

+ type RawDataAttribute []byte

+ func (rawDataAttribute RawDataAttribute) Parse(bytesPerCluster int64) (nonResidentDataAttribute NonResidentDataAttribute, ...)

+ type RawDataRuns []byte

+ func (rawDataRuns RawDataRuns) Parse(bytesPerCluster int64) (dataRuns DataRuns, err error)

+ type RawFileNameAttribute []byte

+ func (rawFileNameAttribute RawFileNameAttribute) Parse() (filenameAttribute FileNameAttribute, err error)

+ type RawFilenameFlags []byte

+ func (flagBytes RawFilenameFlags) Parse() (fileNameFlags FileNameFlags)

+ type RawFilenameNameSpaceFlag byte

+ func (fileNamespaceFlag RawFilenameNameSpaceFlag) Parse() (fileNameSpace string)

+ type RawMasterFileTableRecord []byte

+ func (rawMftRecord RawMasterFileTableRecord) GetRawAttributes(recordHeader RecordHeader) (rawAttributes RawAttributes, err error)

+ func (rawMftRecord RawMasterFileTableRecord) GetRawRecordHeader() (rawRecordHeader RawRecordHeader, err error)

+ func (rawMftRecord RawMasterFileTableRecord) IsThisADirectory() (result bool, err error)

+ func (rawMftRecord RawMasterFileTableRecord) IsThisAnMftRecord() (result bool, err error)

+ func (rawMftRecord RawMasterFileTableRecord) Parse(bytesPerCluster int64) (mftRecord MasterFileTableRecord, err error)

+ type RawNonResidentDataAttribute []byte

+ func (rawNonResidentDataAttribute RawNonResidentDataAttribute) Parse(bytesPerCluster int64) (nonResidentDataAttributes NonResidentDataAttribute, err error)

+ type RawRecordHeader []byte

+ func (rawRecordHeader RawRecordHeader) GetRawRecordHeaderFlags() (rawRecordHeaderFlag RawRecordHeaderFlag, err error)

+ func (rawRecordHeader RawRecordHeader) Parse() (recordHeader RecordHeader, err error)

+ type RawRecordHeaderFlag byte

+ func (rawRecordHeaderFlag RawRecordHeaderFlag) Parse() (recordHeaderFlags RecordHeaderFlags)

+ type RawResidencyFlag byte

+ func (byteToCheck RawResidencyFlag) Parse() (flagResidency bool)

+ type RawResidentDataAttribute []byte

+ func (rawResidentDataAttribute RawResidentDataAttribute) Parse() (residentDataAttribute ResidentDataAttribute, err error)

+ type RawStandardInformationAttribute []byte

+ func (rawStandardInformationAttribute RawStandardInformationAttribute) Parse() (standardInformationAttribute StandardInformationAttribute, err error)

+ type RecordHeader struct

+ AttributesOffset uint16

+ Flags RecordHeaderFlags

+ RecordNumber uint32

+ type RecordHeaderFlags struct

+ FlagDeleted bool

+ FlagDirectory bool

+ type ResidentDataAttribute []byte

+ type ResultWriter interface

+ ResultWriter func(streamer io.Writer, outputChannel *chan UsefulMftFields, ...)

+ type StandardInformationAttribute struct

+ FlagResident bool

+ SiAccessed time.Time

+ SiChanged time.Time

+ SiCreated time.Time

+ SiModified time.Time

+ type UnresolvedDirectoryTree map[uint64]directory

+ func BuildUnresolvedDirectoryTree(reader io.Reader) (unresolvedDirectoryTree UnresolvedDirectoryTree, err error)

+ type UsefulMftFields struct

+ DeletedFlag bool

+ DirectoryFlag bool

+ FileName string

+ FilePath string

+ FnAccessed time.Time

+ FnChanged time.Time

+ FnCreated time.Time

+ FnModified time.Time

+ FullPath string

+ HiddenFlag bool

+ PhysicalFileSize uint64

+ ReadOnlyFlag bool

+ RecordNumber uint32

+ SiAccessed time.Time

+ SiChanged time.Time

+ SiCreated time.Time

+ SiModified time.Time

+ SystemFlag bool

+ func GetUsefulMftFields(mftRecord MasterFileTableRecord, directoryTree DirectoryTree) (useFulMftFields UsefulMftFields)

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL