Versions in this module Expand all Collapse all v0 v0.0.1 Feb 11, 2020 Changes in this version + func ConvertFileTime(timeValue uint64) time.Time + func DataRunsToFragments(runs []DataRun, bytesPerCluster int) []fragment.Fragment + type Attribute struct + ActualSize uint64 + AllocatedSize uint64 + AttributeId int + Data []byte + Flags AttributeFlags + Name string + Resident bool + Type AttributeType + func ParseAttribute(b []byte) (Attribute, error) + func ParseAttributes(b []byte) ([]Attribute, error) + type AttributeFlags uint16 + const AttributeFlagsCompressed + const AttributeFlagsEncrypted + const AttributeFlagsSparse + func (f *AttributeFlags) Is(c AttributeFlags) bool + type AttributeListEntry struct + AttributeId uint16 + BaseRecordReference FileReference + Name string + StartingVCN uint64 + Type AttributeType + func ParseAttributeList(b []byte) ([]AttributeListEntry, error) + type AttributeType uint32 + const AttributeTypeAttributeList + const AttributeTypeBitmap + const AttributeTypeData + const AttributeTypeEA + const AttributeTypeEAInformation + const AttributeTypeFileName + const AttributeTypeIndexAllocation + const AttributeTypeIndexRoot + const AttributeTypeLoggedUtilityStream + const AttributeTypeObjectId + const AttributeTypePropertySet + const AttributeTypeReparsePoint + const AttributeTypeSecurityDescriptor + const AttributeTypeStandardInformation + const AttributeTypeTerminator + const AttributeTypeVolumeInformation + const AttributeTypeVolumeName + func (at AttributeType) Name() string + type CollationType uint32 + const CollationTypeBinary + const CollationTypeFileName + const CollationTypeNtofsSecurityHash + const CollationTypeNtofsSid + const CollationTypeNtofsULong + const CollationTypeNtofsUlongs + const CollationTypeUnicodeString + type DataRun struct + LengthInClusters uint64 + OffsetCluster int64 + func ParseDataRuns(b []byte) ([]DataRun, error) + type FileAttribute uint32 + const FileAttributeArchive + const FileAttributeCompressed + const FileAttributeDevice + const FileAttributeEncrypted + const FileAttributeHidden + const FileAttributeNormal + const FileAttributeNotContentIndexed + const FileAttributeOffline + const FileAttributeReadOnly + const FileAttributeReparsePoint + const FileAttributeSparseFile + const FileAttributeSystem + const FileAttributeTemporary + func (a *FileAttribute) Is(c FileAttribute) bool + type FileName struct + ActualSize uint64 + AllocatedSize uint64 + Creation time.Time + ExtendedData uint32 + FileLastModified time.Time + Flags FileAttribute + LastAccess time.Time + MftLastModified time.Time + Name string + Namespace FileNameNamespace + ParentFileReference FileReference + func ParseFileName(b []byte) (FileName, error) + type FileNameNamespace byte + const FileNameNamespaceDos + const FileNameNamespacePosix + const FileNameNamespaceWin32 + const FileNameNamespaceWin32Dos + type FileReference struct + RecordNumber uint64 + SequenceNumber uint16 + func ParseFileReference(b []byte) (FileReference, error) + type IndexEntry struct + FileName FileName + FileReference FileReference + Flags uint32 + SubNodeVCN uint64 + type IndexRoot struct + AttributeType AttributeType + BytesPerRecord uint32 + ClustersPerRecord uint32 + CollationType CollationType + Entries []IndexEntry + Flags uint32 + func ParseIndexRoot(b []byte) (IndexRoot, error) + type Record struct + ActualSize uint32 + AllocatedSize uint32 + Attributes []Attribute + BaseRecordReference FileReference + FileReference FileReference + Flags RecordFlag + HardLinkCount int + LogFileSequenceNumber uint64 + NextAttributeId int + Signature []byte + func ParseRecord(b []byte) (Record, error) + func (r *Record) FindAttributes(attrType AttributeType) []Attribute + type RecordFlag uint16 + const RecordFlagInExtend + const RecordFlagInUse + const RecordFlagIsDirectory + const RecordFlagIsIndex + func (f *RecordFlag) Is(c RecordFlag) bool + type StandardInformation struct + ClassId uint32 + Creation time.Time + FileAttributes FileAttribute + FileLastModified time.Time + LastAccess time.Time + MaximumNumberOfVersions uint32 + MftLastModified time.Time + OwnerId uint32 + QuotaCharged uint64 + SecurityId uint32 + UpdateSequenceNumber uint64 + VersionNumber uint32 + func ParseStandardInformation(b []byte) (StandardInformation, error)