Versions in this module Expand all Collapse all v0 v0.6.5 May 2, 2020 Changes in this version + func ParseMFT(volumeLetter string, inputFile *os.File, writer ResultWriter, ...) + func ParseMftRecords(reader io.Reader, bytesPerCluster int64, directoryTree DirectoryTree, ...) + type AttributeListAttribute struct + MFTReferenceRecordNumber uint32 + Type byte + type AttributeListAttributes []AttributeListAttribute + type CsvResultWriter struct + func (csvResultWriter *CsvResultWriter) ResultWriter(streamer io.Writer, outputChannel *chan UsefulMftFields, ...) + type DataAttribute struct + FlagResident bool + NonResidentDataAttribute NonResidentDataAttribute + ResidentDataAttribute ResidentDataAttribute + TotalSize uint8 + type DataRun struct + AbsoluteOffset int64 + Length int64 + type DataRuns map[int]DataRun + type DirectoryTree map[uint32]string + func BuildDirectoryTree(reader io.Reader, volumeLetter string) (directoryTree DirectoryTree, err error) + type FileNameAttribute struct + AttributeSize uint32 + FileName string + FileNameFlags FileNameFlags + FileNameLength byte + FileNamespace string + FlagResident bool + FnAccessed time.Time + FnChanged time.Time + FnCreated time.Time + FnModified time.Time + LogicalFileSize uint64 + NameLength NameLength + ParentDirRecordNumber uint32 + ParentDirSequenceNumber uint16 + PhysicalFileSize uint64 + type FileNameAttributes []FileNameAttribute + type FileNameFlags struct + Archive bool + Compressed bool + Device bool + Directory bool + Encrypted bool + Hidden bool + IndexView bool + Normal bool + NotContentIndexed bool + Offline bool + ReadOnly bool + Reparse bool + Sparse bool + System bool + Temporary bool + type MasterFileTableRecord struct + AttributeList AttributeListAttributes + DataAttribute DataAttribute + FileNameAttributes []FileNameAttribute + RecordHeader RecordHeader + StandardInformationAttributes StandardInformationAttribute + type NameLength struct + FlagNamed bool + NamedSize byte + type NonResidentDataAttribute struct + DataRuns DataRuns + type RawAttributeListAttribute []byte + func (rawAttributeListAttribute RawAttributeListAttribute) Parse() (attributeListAttributes AttributeListAttributes, err error) + type RawAttributes []rawAttribute + func (rawAttributes RawAttributes) Parse(bytesPerCluster int64) (fileNameAttributes FileNameAttributes, ...) + type RawDataAttribute []byte + func (rawDataAttribute RawDataAttribute) Parse(bytesPerCluster int64) (nonResidentDataAttribute NonResidentDataAttribute, ...) + type RawDataRuns []byte + func (rawDataRuns RawDataRuns) Parse(bytesPerCluster int64) (dataRuns DataRuns, err error) + type RawFileNameAttribute []byte + func (rawFileNameAttribute RawFileNameAttribute) Parse() (filenameAttribute FileNameAttribute, err error) + type RawFilenameFlags []byte + func (flagBytes RawFilenameFlags) Parse() (fileNameFlags FileNameFlags) + type RawFilenameNameSpaceFlag byte + func (fileNamespaceFlag RawFilenameNameSpaceFlag) Parse() (fileNameSpace string) + type RawMasterFileTableRecord []byte + func (rawMftRecord RawMasterFileTableRecord) GetRawAttributes(recordHeader RecordHeader) (rawAttributes RawAttributes, err error) + func (rawMftRecord RawMasterFileTableRecord) GetRawRecordHeader() (rawRecordHeader RawRecordHeader, err error) + func (rawMftRecord RawMasterFileTableRecord) IsThisADirectory() (result bool, err error) + func (rawMftRecord RawMasterFileTableRecord) IsThisAnMftRecord() (result bool, err error) + func (rawMftRecord RawMasterFileTableRecord) Parse(bytesPerCluster int64) (mftRecord MasterFileTableRecord, err error) + type RawNonResidentDataAttribute []byte + func (rawNonResidentDataAttribute RawNonResidentDataAttribute) Parse(bytesPerCluster int64) (nonResidentDataAttributes NonResidentDataAttribute, err error) + type RawRecordHeader []byte + func (rawRecordHeader RawRecordHeader) GetRawRecordHeaderFlags() (rawRecordHeaderFlag RawRecordHeaderFlag, err error) + func (rawRecordHeader RawRecordHeader) Parse() (recordHeader RecordHeader, err error) + type RawRecordHeaderFlag byte + func (rawRecordHeaderFlag RawRecordHeaderFlag) Parse() (recordHeaderFlags RecordHeaderFlags) + type RawResidencyFlag byte + func (byteToCheck RawResidencyFlag) Parse() (flagResidency bool) + type RawResidentDataAttribute []byte + func (rawResidentDataAttribute RawResidentDataAttribute) Parse() (residentDataAttribute ResidentDataAttribute, err error) + type RawStandardInformationAttribute []byte + func (rawStandardInformationAttribute RawStandardInformationAttribute) Parse() (standardInformationAttribute StandardInformationAttribute, err error) + type RecordHeader struct + AttributesOffset uint16 + Flags RecordHeaderFlags + RecordNumber uint32 + type RecordHeaderFlags struct + FlagDeleted bool + FlagDirectory bool + type ResidentDataAttribute []byte + type ResultWriter interface + ResultWriter func(streamer io.Writer, outputChannel *chan UsefulMftFields, ...) + type StandardInformationAttribute struct + FlagResident bool + SiAccessed time.Time + SiChanged time.Time + SiCreated time.Time + SiModified time.Time + type UnResolvedDirectory struct + DirectoryName string + ParentRecordNumber uint32 + RecordNumber uint32 + func ConvertRawMFTRecordToDirectory(rawMftRecord RawMasterFileTableRecord) (directory UnResolvedDirectory, err error) + type UnresolvedDirectoryTree map[uint32]UnResolvedDirectory + func BuildUnresolvedDirectoryTree(reader io.Reader) (unresolvedDirectoryTree UnresolvedDirectoryTree, err error) + func (unresolvedDirectoryTree UnresolvedDirectoryTree) Resolve(volumeLetter string) (directoryTree DirectoryTree, err error) + type UsefulMftFields struct + DeletedFlag bool + DirectoryFlag bool + FileName string + FilePath string + FnAccessed time.Time + FnChanged time.Time + FnCreated time.Time + FnModified time.Time + FullPath string + HiddenFlag bool + PhysicalFileSize uint64 + ReadOnlyFlag bool + RecordNumber uint32 + SiAccessed time.Time + SiChanged time.Time + SiCreated time.Time + SiModified time.Time + SystemFlag bool + func GetUsefulMftFields(mftRecord MasterFileTableRecord, directoryTree DirectoryTree) (useFulMftFields UsefulMftFields)