diff options
author | Omer BenAmram <omerbenamram@gmail.com> | 2019-09-16 21:45:08 +0300 |
---|---|---|
committer | GitHub <noreply@github.com> | 2019-09-16 21:45:08 +0300 |
commit | eaedebf1a0331ed09f72093cef6f007a8c8ffd91 (patch) | |
tree | 7d9bcb0c15667db51e1527c3fcd241cd5223055a | |
parent | 2effe8323703abd6d4532e50dab7c10ba9f98f84 (diff) | |
parent | 65785ba2fc5dcf5589dfad40d5693d3bba1e6369 (diff) |
Merge pull request #20 from forensicmatt/master
Added MftEntry::from_buffer_skip_fixup()
-rw-r--r-- | src/entry.rs | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/src/entry.rs b/src/entry.rs index a4e3919..f1b2a63 100644 --- a/src/entry.rs +++ b/src/entry.rs @@ -187,6 +187,28 @@ impl MftEntry { }) } + /// Initializes an MFT Entry from a buffer but skips checking and fixing the + /// fixup array. This will throw InvalidEntrySignature error if the entry header + /// is not valid. + pub fn from_buffer_skip_fixup(buffer: Vec<u8>, entry_number: u64) -> Result<MftEntry> { + let mut cursor = Cursor::new(&buffer); + // Get Header + let entry_header = EntryHeader::from_reader(&mut cursor, entry_number)?; + trace!("Number of sectors: {:#?}", entry_header); + + ensure!( + entry_header.is_valid(), + err::InvalidEntrySignature { + bad_sig: entry_header.signature.to_vec() + } + ); + + Ok(MftEntry { + header: entry_header, + data: buffer, + }) + } + /// Retrieves most human-readable representation of a file path entry. /// Will prefer `Win32` file name attributes, and fallback to `Dos` paths. pub fn find_best_name_attribute(&self) -> Option<FileNameAttr> { |