From 60547dab12688c7ee73c6e748eed24d017fbe194 Mon Sep 17 00:00:00 2001 From: Colin Finck Date: Fri, 17 Sep 2021 19:34:32 +0200 Subject: Add some more convenience functions and fix comments. --- src/attribute.rs | 6 ++++++ src/file.rs | 15 +++++++++++---- src/structured_values/file_name.rs | 8 ++++++-- 3 files changed, 23 insertions(+), 6 deletions(-) diff --git a/src/attribute.rs b/src/attribute.rs index 17eb855..42762a1 100644 --- a/src/attribute.rs +++ b/src/attribute.rs @@ -145,6 +145,12 @@ impl<'n, 'f> NtfsAttribute<'n, 'f> { )) } + /// Returns the identifier of this attribute that is unique within the [`NtfsFile`]. + pub fn instance(&self) -> u16 { + let start = self.offset + offset_of!(NtfsAttributeHeader, instance); + LittleEndian::read_u16(&self.file.record_data()[start..]) + } + /// Returns `true` if this is a resident attribute, i.e. one where its value /// is part of the attribute structure. pub fn is_resident(&self) -> bool { diff --git a/src/file.rs b/src/file.rs index 097eff0..27d6a29 100644 --- a/src/file.rs +++ b/src/file.rs @@ -3,6 +3,7 @@ use crate::attribute::{NtfsAttribute, NtfsAttributeType, NtfsAttributes}; use crate::error::{NtfsError, Result}; +use crate::file_reference::NtfsFileReference; use crate::index::NtfsIndex; use crate::indexes::NtfsFileNameIndex; use crate::ntfs::Ntfs; @@ -40,8 +41,8 @@ struct FileRecordHeader { flags: u16, used_size: u32, allocated_size: u32, - base_file_record: u64, - next_attribute_number: u16, + base_file_record: NtfsFileReference, + next_attribute_instance: u16, } bitflags! { @@ -154,7 +155,7 @@ impl<'n> NtfsFile<'n> { where T: Read + Seek, { - if !self.flags().contains(NtfsFileFlags::IS_DIRECTORY) { + if !self.is_directory() { return Err(NtfsError::NotADirectory { position: self.position(), }); @@ -210,6 +211,10 @@ impl<'n> NtfsFile<'n> { attribute.resident_structured_value::() } + pub fn is_directory(&self) -> bool { + self.flags().contains(NtfsFileFlags::IS_DIRECTORY) + } + /// Convenience function to get the $FILE_NAME attribute of this file (see [`NtfsFileName`]). /// /// This internally calls [`NtfsFile::attributes`] to iterate through the file's @@ -219,10 +224,12 @@ impl<'n> NtfsFile<'n> { attribute.resident_structured_value::() } - pub(crate) fn ntfs(&self) -> &'n Ntfs { + /// Returns the [`Ntfs`] object associated to this file. + pub fn ntfs(&self) -> &'n Ntfs { self.record.ntfs() } + /// Returns the absolute byte position of this file record in the NTFS filesystem. pub fn position(&self) -> u64 { self.record.position() } diff --git a/src/structured_values/file_name.rs b/src/structured_values/file_name.rs index 19a1e08..237c923 100644 --- a/src/structured_values/file_name.rs +++ b/src/structured_values/file_name.rs @@ -78,6 +78,11 @@ impl NtfsFileName { NtfsFileAttributeFlags::from_bits_truncate(self.header.file_attributes) } + pub fn is_directory(&self) -> bool { + self.file_attributes() + .contains(NtfsFileAttributeFlags::IS_DIRECTORY) + } + pub fn mft_record_modification_time(&self) -> NtfsTime { self.header.mft_record_modification_time } @@ -98,8 +103,7 @@ impl NtfsFileName { self.header.name_length as usize * mem::size_of::() } - /// Returns the namespace this name belongs to, or [`NtfsError::UnsupportedFileNamespace`] - /// if it's an unknown namespace. + /// Returns the [`NtfsFileNamespace`] of this file name. pub fn namespace(&self) -> NtfsFileNamespace { NtfsFileNamespace::n(self.header.namespace).unwrap() } -- cgit v1.2.3