Fix splitting `NtfsFileReference` into record and sequence numbers.

3 files changed, 13 insertions, 9 deletions

diff --git a/src/file_reference.rs b/src/file_reference.rs
index 337d7c5..aa18764 100644
--- a/src/file_reference.rs
+++ b/src/file_reference.rs
@@ -1,21 +1,22 @@
 // Copyright 2021 Colin Finck <colin@reactos.org>
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+use binread::io::{Read, Seek};
 use binread::BinRead;
 
-#[derive(BinRead, Clone, Debug)]
-pub struct NtfsFileReference(u64);
+#[derive(BinRead, Clone, Copy, Debug)]
+pub struct NtfsFileReference([u8; 8]);
 
 impl NtfsFileReference {
-    pub(crate) const fn new(file_reference_data: u64) -> Self {
-        Self(file_reference_data)
+    pub(crate) const fn new(file_reference_bytes: [u8; 8]) -> Self {
+        Self(file_reference_bytes)
     }
 
     pub fn file_record_number(&self) -> u64 {
-        self.0 >> 16
+        u64::from_le_bytes(self.0) & 0xffff_ffff_ffff
     }
 
     pub fn sequence_number(&self) -> u16 {
-        self.0 as u16
+        (u64::from_le_bytes(self.0) >> 48) as u16
     }
 }
diff --git a/src/index_entry.rs b/src/index_entry.rs
index 1f5660f..804a5d6 100644
--- a/src/index_entry.rs
+++ b/src/index_entry.rs
@@ -134,8 +134,7 @@ where
     {
         // The "file_reference_data" is at the same position as the `data_offset`, `data_length`, and `padding` fields.
         // There can either be extra data or a file reference!
-        let file_reference_data = LittleEndian::read_u64(self.slice);
-        NtfsFileReference::new(file_reference_data)
+        NtfsFileReference::new(self.slice[..mem::size_of::<u64>()].try_into().unwrap())
     }
 
     pub fn flags(&self) -> NtfsIndexEntryFlags {
diff --git a/src/structured_values/file_name.rs b/src/structured_values/file_name.rs
index ad7787e..72b528a 100644
--- a/src/structured_values/file_name.rs
+++ b/src/structured_values/file_name.rs
@@ -29,7 +29,7 @@ const NAME_MAX_SIZE: usize = (u8::MAX as usize) * mem::size_of::<u16>();
 #[allow(unused)]
 #[derive(BinRead, Clone, Debug)]
 struct FileNameHeader {
-    parent_directory_ref: NtfsFileReference,
+    parent_directory_reference: NtfsFileReference,
     creation_time: NtfsTime,
     modification_time: NtfsTime,
     mft_record_modification_time: NtfsTime,
@@ -104,6 +104,10 @@ impl NtfsFileName {
         NtfsFileNamespace::n(self.header.namespace).unwrap()
     }
 
+    pub fn parent_directory_reference(&self) -> NtfsFileReference {
+        self.header.parent_directory_reference
+    }
+
     fn read_name(&mut self, data: &[u8]) {
         debug_assert!(self.name.is_empty());
         let start = FILE_NAME_HEADER_SIZE;