1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
|
# RustyMft
MFT to JSON
## Example output
``` json
{
"header": {
"signature": 1162627398,
"usa_offset": 48,
"usa_size": 3,
"logfile_sequence_number": "1094958",
"sequence": 1,
"hard_link_count": 1,
"fst_attr_offset": 56,
"flags": "ALLOCATED",
"entry_size_real": 808,
"entry_size_allocated": 1024,
"base_reference": "0",
"next_attribute_id": 7,
"record_number": 47,
"update_sequence_value": 0
},
"attr_standard_info": [
{
"created": "2017-04-20 00:39:37.541",
"modified": "2017-04-20 00:40:33.724",
"mft_modified": "2017-04-20 00:40:33.724",
"accessed": "2017-04-20 00:39:37.541",
"file_flags": 32,
"max_version": 0,
"version": 0,
"class_id": 0,
"owner_id": 0,
"security_id": 268,
"quota": "0",
"usn": "11120"
}
],
"attr_filename": [
{
"parent": "281474976710695",
"created": "2017-04-20 00:39:37.541",
"modified": "2017-04-20 00:39:37.541",
"mft_modified": "2017-04-20 00:40:05.118",
"accessed": "2017-04-20 00:39:37.541",
"logical_size": "0",
"physical_size": "0",
"flags": 32,
"reparse_value": 0,
"name_length": 228,
"namespace": 0,
"name": "time_for_a_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super_super__super_super_super_super_super_super_super_super_longname.txt"
}
]
}
```
|
