mbr

Documentation

Index

• type Chs
  • func (k *Chs) B2() (value uint8)
  • func (k *Chs) B3() (value uint8)
  • func (k *Chs) Cylinder() (value int64)
  • func (k *Chs) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)
  • func (k *Chs) Head() (value uint8)
  • func (k *Chs) Parent() *PartitionEntry
  • func (k *Chs) Root() *MbrPartitionTable
  • func (k *Chs) Sector() (value int64)
• type MBRFs
  • func New(decoder io.ReadSeeker) (*MBRFs, error)
  • func (m *MBRFs) Name() string
  • func (m *MBRFs) Open(name string) (forensicfs.ForensicItem, error)
• type MbrPartitionTable
  • func (k *MbrPartitionTable) BootSignature() (value []byte)
  • func (k *MbrPartitionTable) BootstrapCode() (value []byte)
  • func (k *MbrPartitionTable) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)
  • func (k *MbrPartitionTable) Parent() *MbrPartitionTable
  • func (k *MbrPartitionTable) Partitions() (value [4]PartitionEntry)
  • func (k *MbrPartitionTable) Root() *MbrPartitionTable
• type Partition
  • func NewPartition(name int, partition *PartitionEntry) *Partition
  • func (m *Partition) Attributes() map[string]interface{}
  • func (m *Partition) Name() string
  • func (m *Partition) Size() int64
• type PartitionEntry
  • func (k *PartitionEntry) ChsEnd() (value *Chs)
  • func (k *PartitionEntry) ChsStart() (value *Chs)
  • func (k *PartitionEntry) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)
  • func (k *PartitionEntry) LbaStart() (value uint32)
  • func (k *PartitionEntry) NumSectors() (value uint32)
  • func (k *PartitionEntry) Parent() *MbrPartitionTable
  • func (k *PartitionEntry) PartitionType() (value uint8)
  • func (k *PartitionEntry) Root() *MbrPartitionTable
  • func (k *PartitionEntry) Status() (value uint8)
• type Root
  • func (m *Root) Attributes() map[string]interface{}
  • func (m *Root) Name() string
  • func (m *Root) Readdirnames(count int) ([]string, error)

Types

type Chs

type Chs struct {
	// contains filtered or unexported fields
}

func (*Chs) B2

func (k *Chs) B2() (value uint8)

func (*Chs) B3

func (k *Chs) B3() (value uint8)

func (*Chs) Cylinder

func (k *Chs) Cylinder() (value int64)

func (*Chs) Decode

func (k *Chs) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)

func (*Chs) Head

func (k *Chs) Head() (value uint8)

func (*Chs) Parent

func (k *Chs) Parent() *PartitionEntry

func (*Chs) Root

func (k *Chs) Root() *MbrPartitionTable

func (*Chs) Sector

func (k *Chs) Sector() (value int64)

type MBRFs

type MBRFs struct {
	// contains filtered or unexported fields
}

func New

func New(decoder io.ReadSeeker) (*MBRFs, error)

func (*MBRFs) Name

func (m *MBRFs) Name() string

Name returns the filesystem name

func (*MBRFs) Open

func (m *MBRFs) Open(name string) (forensicfs.ForensicItem, error)

Open returns a afero.File for the given location

type MbrPartitionTable

type MbrPartitionTable struct {
	// contains filtered or unexported fields
}

MBR (Master Boot Record) partition table is a traditional way of

MS-DOS to partition larger hard disc drives into distinct partitions.

This table is stored in the end of the boot sector (first sector) of the drive, after the bootstrap code. Original DOS 2.0 specification allowed only 4 partitions per disc, but DOS 3.2 introduced concept of "extended partitions", which work as nested extra "boot records" which are pointed to by original ("primary") partitions in MBR.

func (*MbrPartitionTable) BootSignature

func (k *MbrPartitionTable) BootSignature() (value []byte)

func (*MbrPartitionTable) BootstrapCode

func (k *MbrPartitionTable) BootstrapCode() (value []byte)

func (*MbrPartitionTable) Decode

func (k *MbrPartitionTable) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)

func (*MbrPartitionTable) Parent

func (k *MbrPartitionTable) Parent() *MbrPartitionTable

func (*MbrPartitionTable) Partitions

func (k *MbrPartitionTable) Partitions() (value [4]PartitionEntry)

func (*MbrPartitionTable) Root

func (k *MbrPartitionTable) Root() *MbrPartitionTable

type Partition

type Partition struct {
	forensicfs.ForensicFileDefaults
	*io.SectionReader
	// contains filtered or unexported fields
}

func NewPartition

func NewPartition(name int, partition *PartitionEntry) *Partition

func (*Partition) Attributes

func (m *Partition) Attributes() map[string]interface{}

func (*Partition) Name

func (m *Partition) Name() string

func (*Partition) Size

func (m *Partition) Size() int64

type PartitionEntry

type PartitionEntry struct {
	// contains filtered or unexported fields
}

func (*PartitionEntry) ChsEnd

func (k *PartitionEntry) ChsEnd() (value *Chs)

func (*PartitionEntry) ChsStart

func (k *PartitionEntry) ChsStart() (value *Chs)

func (*PartitionEntry) Decode

func (k *PartitionEntry) Decode(reader io.ReadSeeker, ancestors ...interface{}) (err error)

func (*PartitionEntry) LbaStart

func (k *PartitionEntry) LbaStart() (value uint32)

func (*PartitionEntry) NumSectors

func (k *PartitionEntry) NumSectors() (value uint32)

func (*PartitionEntry) Parent

func (k *PartitionEntry) Parent() *MbrPartitionTable

func (*PartitionEntry) PartitionType

func (k *PartitionEntry) PartitionType() (value uint8)

func (*PartitionEntry) Root

func (k *PartitionEntry) Root() *MbrPartitionTable

func (*PartitionEntry) Status

func (k *PartitionEntry) Status() (value uint8)

type Root

type Root struct {
	forensicfs.ForensicFolderDefaults
	// contains filtered or unexported fields
}

func (*Root) Attributes

func (m *Root) Attributes() map[string]interface{}

func (*Root) Name

func (m *Root) Name() string

Name always returns / for MBR roots

func (*Root) Readdirnames

func (m *Root) Readdirnames(count int) ([]string, error)

Readdir lists all partitions in the MBR