1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
|
// Copyright 2021 Colin Finck <colin@reactos.org>
// SPDX-License-Identifier: GPL-2.0-or-later
use crate::attribute::NtfsAttributes;
use crate::error::{NtfsError, Result};
use crate::ntfs::Ntfs;
use crate::record::RecordHeader;
use binread::io::{Read, Seek, SeekFrom};
use binread::{BinRead, BinReaderExt};
use bitflags::bitflags;
#[repr(u64)]
pub enum KnownNtfsFile {
MFT = 0,
MFTMirr = 1,
LogFile = 2,
Volume = 3,
AttrDef = 4,
RootDirectory = 5,
Bitmap = 6,
Boot = 7,
BadClus = 8,
Secure = 9,
UpCase = 10,
Extend = 11,
}
#[allow(unused)]
#[derive(BinRead, Debug)]
struct FileRecordHeader {
record_header: RecordHeader,
sequence_number: u16,
hard_link_count: u16,
first_attribute_offset: u16,
flags: u16,
used_size: u32,
allocated_size: u32,
base_file_record: u64,
next_attribute_number: u16,
}
bitflags! {
pub struct NtfsFileFlags: u16 {
/// Record is in use.
const IN_USE = 0x0001;
/// Record is a directory.
const IS_DIRECTORY = 0x0002;
}
}
pub struct NtfsFile<'n> {
ntfs: &'n Ntfs,
header: FileRecordHeader,
position: u64,
}
impl<'n> NtfsFile<'n> {
pub(crate) fn new<T>(ntfs: &'n Ntfs, fs: &mut T, position: u64) -> Result<Self>
where
T: Read + Seek,
{
fs.seek(SeekFrom::Start(position))?;
let header = fs.read_le::<FileRecordHeader>()?;
let file = Self {
ntfs,
header,
position,
};
file.validate_signature()?;
Ok(file)
}
pub fn allocated_size(&self) -> u32 {
self.header.allocated_size
}
pub fn attributes(&self) -> NtfsAttributes<'n> {
NtfsAttributes::new(self.ntfs, &self)
}
pub(crate) fn first_attribute_offset(&self) -> u16 {
self.header.first_attribute_offset
}
/// Returns flags set for this NTFS file as specified by [`NtfsFileFlags`].
pub fn flags(&self) -> NtfsFileFlags {
NtfsFileFlags::from_bits_truncate(self.header.flags)
}
pub fn hard_link_count(&self) -> u16 {
self.header.hard_link_count
}
pub fn position(&self) -> u64 {
self.position
}
pub fn sequence_number(&self) -> u16 {
self.header.sequence_number
}
pub fn used_size(&self) -> u32 {
self.header.used_size
}
fn validate_signature(&self) -> Result<()> {
let signature = &self.header.record_header.signature;
let expected = b"FILE";
if signature == expected {
Ok(())
} else {
Err(NtfsError::InvalidNtfsFileSignature {
position: self.position,
expected,
actual: *signature,
})
}
}
}
|
