From 789fb57d9871967a5026e900abab9bb69d683351 Mon Sep 17 00:00:00 2001 From: Colin Finck Date: Mon, 9 Aug 2021 22:03:42 +0200 Subject: Fix splitting `NtfsFileReference` into record and sequence numbers. --- src/file_reference.rs | 13 +++++++------ src/index_entry.rs | 3 +-- src/structured_values/file_name.rs | 6 +++++- 3 files changed, 13 insertions(+), 9 deletions(-) diff --git a/src/file_reference.rs b/src/file_reference.rs index 337d7c5..aa18764 100644 --- a/src/file_reference.rs +++ b/src/file_reference.rs @@ -1,21 +1,22 @@ // Copyright 2021 Colin Finck // SPDX-License-Identifier: GPL-2.0-or-later +use binread::io::{Read, Seek}; use binread::BinRead; -#[derive(BinRead, Clone, Debug)] -pub struct NtfsFileReference(u64); +#[derive(BinRead, Clone, Copy, Debug)] +pub struct NtfsFileReference([u8; 8]); impl NtfsFileReference { - pub(crate) const fn new(file_reference_data: u64) -> Self { - Self(file_reference_data) + pub(crate) const fn new(file_reference_bytes: [u8; 8]) -> Self { + Self(file_reference_bytes) } pub fn file_record_number(&self) -> u64 { - self.0 >> 16 + u64::from_le_bytes(self.0) & 0xffff_ffff_ffff } pub fn sequence_number(&self) -> u16 { - self.0 as u16 + (u64::from_le_bytes(self.0) >> 48) as u16 } } diff --git a/src/index_entry.rs b/src/index_entry.rs index 1f5660f..804a5d6 100644 --- a/src/index_entry.rs +++ b/src/index_entry.rs @@ -134,8 +134,7 @@ where { // The "file_reference_data" is at the same position as the `data_offset`, `data_length`, and `padding` fields. // There can either be extra data or a file reference! - let file_reference_data = LittleEndian::read_u64(self.slice); - NtfsFileReference::new(file_reference_data) + NtfsFileReference::new(self.slice[..mem::size_of::()].try_into().unwrap()) } pub fn flags(&self) -> NtfsIndexEntryFlags { diff --git a/src/structured_values/file_name.rs b/src/structured_values/file_name.rs index ad7787e..72b528a 100644 --- a/src/structured_values/file_name.rs +++ b/src/structured_values/file_name.rs @@ -29,7 +29,7 @@ const NAME_MAX_SIZE: usize = (u8::MAX as usize) * mem::size_of::(); #[allow(unused)] #[derive(BinRead, Clone, Debug)] struct FileNameHeader { - parent_directory_ref: NtfsFileReference, + parent_directory_reference: NtfsFileReference, creation_time: NtfsTime, modification_time: NtfsTime, mft_record_modification_time: NtfsTime, @@ -104,6 +104,10 @@ impl NtfsFileName { NtfsFileNamespace::n(self.header.namespace).unwrap() } + pub fn parent_directory_reference(&self) -> NtfsFileReference { + self.header.parent_directory_reference + } + fn read_name(&mut self, data: &[u8]) { debug_assert!(self.name.is_empty()); let start = FILE_NAME_HEADER_SIZE; -- cgit v1.2.3