ntfs

package module
v0.0.0-...-2776432 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Jul 4, 2018 License: MIT Imports: 16 Imported by: 0

README

ntfs

GoDoc

NTFS file system library written in Go (work in progress, supporting v3)

This package is a work in progress and is not yet suitable for use.

Documentation

Overview

Package ntfs provides read-only NTFS file system access.

This package is a work in progress and is not yet suitable for use.

Index

Constants

View Source 
const AttributeRecordHeaderLength = 16

AttributeRecordHeaderLength is the length of an attribute header in bytes, excluding its resident or non-resident portion.

View Source 
const BootRecordLength = 84

BootRecordLength is the length of a volume boot record in bytes.

View Source 
const FileNameHeaderLength = 66

FileNameHeaderLength is the length of a file name header in bytes.

View Source 
const FileRecordSegmentHeaderLength = 42

FileRecordSegmentHeaderLength is the length of a file record segment header in bytes.

View Source 
const IndexAllocationMinLength = 66

IndexAllocationMinLength is the minimum length of an $INDEX_ALLOCATION attribute in bytes.

View Source 
const IndexRootMinLength = 16

IndexRootMinLength is the minimum length of an $INDEX_ROOT attribute in bytes.

View Source 
const MultiSectorHeaderLength = 8

MultiSectorHeaderLength is the length of a multi-sector header in bytes.

View Source 
const NonresidentAttributeRecordHeaderLength = 48

NonresidentAttributeRecordHeaderLength is the length of the non-resident portion of an attribute header in bytes.

View Source 
const ObjectIDMinLength = 16

ObjectIDMinLength is the minimum length of an object ID attribute in bytes.

View Source 
const ParameterBlockLength = 73

ParameterBlockLength is the length of an NTFS parameter block in bytes.

View Source 
const ResidentAttributeRecordHeaderLength = 8

ResidentAttributeRecordHeaderLength is the length of the resident portion of an attribute header in bytes.

View Source 
const SegmentReferenceLength = 8

SegmentReferenceLength is the length of a segment reference in bytes.

View Source 
const StandardInformationMinLength = 48

StandardInformationMinLength is the minimum length of a standard information attribute in bytes.

View Source 
const VolumeInformationLength = 12

VolumeInformationLength is the length of a volume information record in bytes.

Variables

View Source 
var (
	// ErrInvalidLabel is returned when creating a new reader with invalid
	// NTFS data.
	ErrInvalidLabel = errors.New("volume boot record does not contain a valid NTFS file system label")

	// ErrTruncatedData is returned when attempting to read data from a buffer
	// or reader with insufficient data.
	ErrTruncatedData = errors.New("insufficient or truncated data")

	// ErrInvalidUnicode is returned when attempting to decode invalid unicode
	// data. This happens when the unicode data being processed has an odd
	// number of bytes, exceeds a specified maximum length, or is located
	// beyond the bounds of its containing record.
	ErrInvalidUnicode = errors.New("invalid unicode data")

	// ErrAttributeNameOutOfBounds is returned when an attribute name exceeds
	// the the bounds of its containing record.
	//
	// This typically is indicative of MFT corruption.
	ErrAttributeNameOutOfBounds = errors.New("attribute name data exceeds the bounds of its file record segment")

	// ErrAttributeValueOutOfBounds is returned when an attribute's value
	// exceeds the bounds of its containing record.
	//
	// This typically is indicative of MFT corruption.
	ErrAttributeValueOutOfBounds = errors.New("attribute value exceeds the bounds of its file record segment")

	// ErrFileNameOutOfBounds is returned when a the value of a file name attribute
	// exceeds the bounds of its containing record.
	//
	// This typically is indicative of MFT corruption.
	ErrFileNameOutOfBounds = errors.New("file name value exceeds the bounds of its file record segment")
)
View Source 
var (
	// Label is the OEM ID of NTFS file system boot records.
	Label = [8]byte{'N', 'T', 'F', 'S', ' ', ' ', ' ', ' '}
)

Functions

This section is empty.

Types

type Attribute 

type Attribute struct {
	Header        AttributeRecordHeader
	Resident      ResidentAttributeRecordHeader    // When in resident form
	Nonresident   NonresidentAttributeRecordHeader // When in non-resident form
	Name          string
	ResidentValue []byte
}

Attribute holds file attribute data.

func (*Attribute) ResidentValueString 

func (attr *Attribute) ResidentValueString() (string, error)

ResidentValueString returns the value of resident attributes as a string.

If the attribute is non-resident an empty string will be returned.

func (*Attribute) UnmarshalBinary 

func (attr *Attribute) UnmarshalBinary(data []byte) error

UnmarshalBinary unmarshals the little-endian binary representation of an attribute record into attr.

type AttributeListEntry 

type AttributeListEntry struct {
	TypeCode            attrtype.Code
	RecordLength        uint16
	AttributeNameLength uint16
	AttributeNameOffset uint16
	LowestVCN           VCN
	SegmentReference    SegmentReference

	AttributeName [1]uint16 // UTF-16 array of varying length
	// contains filtered or unexported fields
}

AttributeListEntry stores an entry in an attribute list.

type AttributeRecordHeader 

type AttributeRecordHeader struct {
	TypeCode     attrtype.Code
	RecordLength uint32 // The length of the attribute header, including its resident or nonresident header
	FormCode     attrform.Code
	NameLength   uint8
	NameOffset   uint16
	Flags        attrflag.Flag
	Instance     uint16
}

AttributeRecordHeader holds information about an attribute record, which may be resident or non-resident.

https://msdn.microsoft.com/library/bb470039

func (*AttributeRecordHeader) Resident 

func (header *AttributeRecordHeader) Resident() bool

Resident returns true if the attribute record header precedes resident attribute data.

func (*AttributeRecordHeader) UnmarshalBinary 

func (header *AttributeRecordHeader) UnmarshalBinary(data []byte) error

UnmarshalBinary unmarshals the little-endian binary representation of an attribute record header into header.

The provided data must be at least 16 bytes long.

type Bitmap 

type Bitmap []byte

Bitmap stores a series of bits.

func (Bitmap) String 

func (bitmap Bitmap) String() string

String returns a description of the bitmap.

func (*Bitmap) UnmarshalBinary 

func (bitmap *Bitmap) UnmarshalBinary(data []byte) error

UnmarshalBinary unmarshals the little-endian binary representation of a bitmap attributre into bitmap.

type BootRecord 

type BootRecord struct {
	JumpInstruction [3]byte
	OEMID           [8]byte
	ParameterBlock
}

BootRecord is the NTFS volume boot record present in the first sector of a volume.

func (*BootRecord) ReadFrom 

func (boot *BootRecord) ReadFrom(r io.Reader) (n int64, err error)

ReadFrom reads 84 bytes of volume boot record data from r into boot.

func (*BootRecord) UnmarshalBinary 

func (boot *BootRecord) UnmarshalBinary(data []byte) error

UnmarshalBinary unmarshals the little-endian binary representation of volume boot record data into boot.

The provided data must be at least 84 bytes long.

type File 

type File struct {
	Header     FileRecordSegmentHeader
	Attributes []Attribute
}

File represents a file within an NTFS master file table.

type FileName 

type FileName struct {
	ParentDirectory FileReference

	FileNameLength uint8
	Flags          filenameflag.Flag
	Value          string
	// contains filtered or unexported fields
}

FileName stores file name attribute information.

https://msdn.microsoft.com/library/bb470123

func (*FileName) UnmarshalBinary 

func (entry *FileName) UnmarshalBinary(data []byte) error

UnmarshalBinary unmarshals the little-endian binary representation of a file name record into entry.

type FileRecordSegmentHeader 

type FileRecordSegmentHeader struct {
	MultiSectorHeader

	SequenceNumber uint16

	FirstAttributeOffset uint16 // relative to the start of the header
	Flags                uint16

	BaseFileRecordSegment FileReference
	// contains filtered or unexported fields
}

FileRecordSegmentHeader stores file record segment information. It is present at the start of each file record, and is immediately followed by the update sequence array.

https://msdn.microsoft.com/library/bb470124

func (*FileRecordSegmentHeader) ReadFrom 

func (header *FileRecordSegmentHeader) ReadFrom(r io.Reader) (n int64, err error)

ReadFrom reads 42 bytes of file record segment header data from r into header.

func (*FileRecordSegmentHeader) UnmarshalBinary 

func (header *FileRecordSegmentHeader) UnmarshalBinary(data []byte) error

UnmarshalBinary unmarshals the little-endian binary representation of a file record segment header into header.

The provided data must be at least 42 bytes long.

type FileReference 

type FileReference = SegmentReference

FileReference is a reference to a file in the master file table.

type GUID 

type GUID = uuid.UUID

GUID is a 16-byte array.

type IndexAllocation 

type IndexAllocation struct {
	ParentDirectory FileReference

	FileNameLength uint8
	Value          string
	// contains filtered or unexported fields
}

IndexAllocation stores $INDEX_ALLOCATION attribute information.

https://msdn.microsoft.com/library/bb470123

func (*IndexAllocation) UnmarshalBinary 

func (index *IndexAllocation) UnmarshalBinary(data []byte) error

UnmarshalBinary unmarshals the little-endian binary representation of an $INDEX_ALLOCATION attribute into index.

type IndexRoot 

type IndexRoot struct {
	AttrType             attrtype.Code  //  0:4 The type of attributes being indexed
	CollationRule        collation.Rule //  4:8
	BytesPerIndexRecord  uint32         //  8:12
	BlocksPerIndexRecord uint8          // 12:13 In sectors if BPIR < ClusterSize, otherwise clusters
	// contains filtered or unexported fields
}

IndexRoot stores $INDEX_ROOT attribute information.

func (*IndexRoot) String 

func (index *IndexRoot) String() string

String returns a description of the volume information.

func (*IndexRoot) UnmarshalBinary 

func (index *IndexRoot) UnmarshalBinary(data []byte) error

UnmarshalBinary unmarshals the little-endian binary representation of an $INDEX_ROOT attribute into index.

type MFT 

type MFT struct {
	SectorSize  int64 // In bytes
	ClusterSize int64 // In bytes
	RecordSize  int64 // In bytes
	BaseAddr    int64 // In bytes
}

MFT provides access to the master file table of an NTFS filesystem.

func (*MFT) File 

func (mft *MFT) File(r io.ReadSeeker, id int64) (*File, error)

File retrieves information about the file identified by id.

type MultiSectorHeader 

type MultiSectorHeader struct {
	Signature                 [4]byte // Identifies the type of data, i.e. "FILE" or "INDX"
	UpdateSequenceArrayOffset uint16
	UpdateSequenceArraySize   uint16
}

MultiSectorHeader specifies the location and size of an update sequence array.

https://msdn.microsoft.com/library/bb470212

func (*MultiSectorHeader) UnmarshalBinary 

func (header *MultiSectorHeader) UnmarshalBinary(data []byte) error

UnmarshalBinary unmarshals the little-endian binary representation of a mutli-sector header into hdr.

The provided data must be at least 73 bytes long.

type NonresidentAttributeRecordHeader 

type NonresidentAttributeRecordHeader struct {
	LowestVCN          VCN
	HighestVCN         VCN
	MappingPairsOffset uint16
	CompressionUnit    uint16

	AllocatedLength   int64 // Total bytes allocated
	DataLength        int64 // Total bytes of actual data (the "file size")
	InitializedLength int64 // Total bytes initialized
	CompressedLength  int64 // Total bytes compressed
	// contains filtered or unexported fields
}

NonresidentAttributeRecordHeader holds information about the non-resident 

form of an attribute record.

func (*NonresidentAttributeRecordHeader) UnmarshalBinary 

func (header *NonresidentAttributeRecordHeader) UnmarshalBinary(data []byte) error

UnmarshalBinary unmarshals the little-endian binary representation of the non-resident portion of an attribute record header into header.

The provided data must be at least 8 bytes long.

type ObjectID 

type ObjectID struct {
	Value         GUID
	BirthVolumeID GUID
	BirthObjectID GUID
	DomainID      GUID
}

ObjectID holds object ID attribute data.

func (*ObjectID) String 

func (id *ObjectID) String() string

String returns a description of the object ID.

func (*ObjectID) UnmarshalBinary 

func (id *ObjectID) UnmarshalBinary(data []byte) error

UnmarshalBinary unmarshals the little-endian binary representation of an object ID attribute into id.

The provided data must be at least 16 bytes long.

type ParameterBlock 

type ParameterBlock struct {
	// DOS 2.0 parameter block
	BytesPerSector    uint16 //  0:2  The logical block size
	SectorsPerCluster uint8  //  2:3  The cluster size (must be power of 2 greater than 0)

	MediaDescriptor media.Descriptor // 10:11

	TotalSectors                 uint64 // 29:37 Number of sectors in the volume (one less than partition table entry)
	MFT                          uint64 // 37:45 Logical cluster number of $MFT
	MFTMirror                    uint64 // 45:53 Logical cluster number of $MFT mirror
	ClustersPerFileRecordSegment int8   // 53:54 if < 0, MFT record size = 2^n

	ClustersPerIndexBlock int8 // 57:58

	VolumeSerialNumber uint64 // 61:69
	Checksum           uint32 // 69:73
	// contains filtered or unexported fields
}

ParameterBlock is the 73-byte BIOS parameter block that forms part of an NFTS boot record.

func (*ParameterBlock) ClusterSize 

func (block *ParameterBlock) ClusterSize() int

ClusterSize returns the size of an NTFS cluster in bytes.

func (*ParameterBlock) FileRecordSize 

func (block *ParameterBlock) FileRecordSize() int

FileRecordSize returns the size of a file record segment in bytes.

func (*ParameterBlock) IndexBlockSize 

func (block *ParameterBlock) IndexBlockSize() int

IndexBlockSize returns the size of an index block in bytes.

func (*ParameterBlock) ReadFrom 

func (block *ParameterBlock) ReadFrom(r io.Reader) (n int64, err error)

ReadFrom reads 73 bytes of BIOS parameter block data from r into block.

func (*ParameterBlock) UnmarshalBinary 

func (block *ParameterBlock) UnmarshalBinary(data []byte) error

UnmarshalBinary unmarshals the little-endian binary representation of BIOS parameter block data into block.

The provided data must be at least 73 bytes long.

type Reader 

type Reader struct {
	// contains filtered or unexported fields
}

Reader is an NTFS file system reader that supports NTFS file system versions 3.0 and 3.1. It reads data from an underlying io.ReadSeeker that must not include partition table data.

func NewReader 

func NewReader(rs io.ReadSeeker) (*Reader, error)

NewReader returns a new NTFS filesystem reader that reads from rs. It will read the volume boot record before returning. If it cannot read the volume boot record from rs, an error will be returned.

func (*Reader) BootRecord 

func (r *Reader) BootRecord() BootRecord

BootRecord returns a copy of the volume boot record.

type ResidentAttributeRecordHeader 

type ResidentAttributeRecordHeader struct {
	ValueLength uint32
	ValueOffset uint16
	// contains filtered or unexported fields
}

ResidentAttributeRecordHeader holds information about the resident form of an attribute record.

func (*ResidentAttributeRecordHeader) UnmarshalBinary 

func (header *ResidentAttributeRecordHeader) UnmarshalBinary(data []byte) error

UnmarshalBinary unmarshals the little-endian binary representation of an attribute record header into header.

The provided data must be at least 8 bytes long.

type SegmentReference 

type SegmentReference struct {
	SegmentNumberLowPart  uint32
	SegmentNumberHighPart uint16
	SequenceNumber        uint16
}

SegmentReference stores an address in the master file table.

https://msdn.microsoft.com/library/bb470211

func (*SegmentReference) IsZero 

func (ref *SegmentReference) IsZero() bool

IsZero returns true if the segment reference is zero.

func (*SegmentReference) UnmarshalBinary 

func (ref *SegmentReference) UnmarshalBinary(data []byte) error

UnmarshalBinary unmarshals the little-endian binary representation of a segment reference into ref.

The provided data must be at least 8 bytes long.

type StandardInformation 

type StandardInformation struct {
	FileCreation       time.Time
	FileModification   time.Time
	MFTModification    time.Time
	FileRead           time.Time
	DOSFilePermissions uint32
	MaxVersions        uint32
	VersionNumber      uint32
	ClassID            uint32
	OwnerID            uint32
	SecurityID         uint32
	QuotaCharged       uint64
	USN                uint64
}

StandardInformation holds standard attribute data.

https://msdn.microsoft.com/library/bb545266

func (*StandardInformation) String 

func (info *StandardInformation) String() string

String returns a description of the standard information.

func (*StandardInformation) UnmarshalBinary 

func (info *StandardInformation) UnmarshalBinary(data []byte) error

UnmarshalBinary unmarshals the little-endian binary representation of a standard information attribute into info.

The provided data must be at least 48 bytes long.

type VCN 

type VCN uint64

VCN is a virtual cluster number.

type VolumeInformation 

type VolumeInformation struct {
	VersionMajor uint8
	VersionMinor uint8
	Flags        volumeflag.Flag
	// contains filtered or unexported fields
}

VolumeInformation holds volume information about an NTFS volume.

func (*VolumeInformation) String 

func (info *VolumeInformation) String() string

String returns a description of the volume information.

func (*VolumeInformation) UnmarshalBinary 

func (info *VolumeInformation) UnmarshalBinary(data []byte) error

UnmarshalBinary unmarshals the little-endian binary representation of a volume information record into info.

The provided data must be at least 16 bytes long.

Source Files

View all Source files

Directories

Path Synopsis
cmd
ntfslayout

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.