ntfs

Documentation

Overview

alloc.go

flush.go

Package ntfs implements a read-only NTFS 3.1 volume driver that operates directly on partition data without OS involvement. It is vendored from carbon-os/diskimg/ntfs; the backend is io.ReaderAt (not *os.File), and the write methods remain but are stubbed to fail, so images are never modified.

On-disk structures supported:

• Boot sector BPB (bytes-per-sector, sectors-per-cluster, MFT location)
• Master File Table records with Update Sequence Array (fixup) handling
• Resident and non-resident attributes with runlist decoding
• $I30 directory B-tree indices (INDEX_ROOT + INDEX_ALLOCATION)
• Symlinks and junction points via $REPARSE_POINT
• Cluster bitmap ($Bitmap) and MFT record bitmap for allocation

Write operations update MFT records and the cluster bitmap in-place. The NTFS journal ($LogFile) is not replayed on open; Unmount marks the volume clean. Run ntfsfix(8) or chkdsk /f if strict journal replay is required after an unclean shutdown of the image.

read.go

write.go

Index

• func Open(f io.ReaderAt, partOff, partSize int64) (*ntfsVolume, error)

Functions

func Open

func Open(f io.ReaderAt, partOff, partSize int64) (*ntfsVolume, error)

Open mounts the NTFS partition starting at partOff within the read-only backend f.