Versions in this module Expand all Collapse all v0 v0.2.0 Apr 4, 2024 Changes in this version + const ATTR_TYPE_ATTRIBUTE_LIST + const ATTR_TYPE_DATA + const ATTR_TYPE_FILE_NAME + const ATTR_TYPE_INDEX_ALLOCATION + const ATTR_TYPE_INDEX_ROOT + const ATTR_TYPE_STANDARD_INFORMATION + const DefaultMaxLinks + const DoNotIncludeShortNames + const IncludeShortNames + const MAX_ATTR_NAME_LENGTH + const MAX_DECOMPRESSED_FILE + const MAX_FILENAME_LENGTH + const MAX_IDX_SIZE + const MAX_MFT_ENTRY_SIZE + const MAX_RUNLIST_SIZE + const MAX_USN_RECORD_SCAN_SIZE + const WILDCARD_STREAM_ID + const WILDCARD_STREAM_NAME + var EntryTooShortError = errors.New("EntryTooShortError") + var FILE_NOT_FOUND_ERROR = errors.New("File not found.") + var STATS = Stats + var ShortReadError = errors.New("ShortReadError") + func CapInt32(v int32, max int32) int32 + func CapInt64(v int64, max int64) int64 + func CapUint16(v uint16, max uint16) uint16 + func CapUint32(v uint32, max uint32) uint32 + func CapUint64(v uint64, max uint64) uint64 + func CopySlice(in []string) []string + func DebugRawRuns(runs []*Run) + func DlvBreak() + func GetHardLinks(ntfs *NTFSContext, mft_id uint64, max int) [][]string + func IsCompressed(flags *EntryFlags) bool + func IsCompressedOrSparse(flags *EntryFlags) bool + func IsFixed(item interface{}, offset int64) bool + func IsSparse(flags *EntryFlags) bool + func ParseMFTFileWithOptions(ctx context.Context, reader io.ReaderAt, size int64, cluster_size int64, ...) chan *MFTHighlight + func ParseUSN(ctx context.Context, ntfs_ctx *NTFSContext, starting_offset int64) chan *USN_RECORD + func PrintStack() + func ReverseStringSlice(s []string) + func SetDebug() + func VtoP(reader interface{}, offset int64) int64 + func WatchUSN(ctx context.Context, ntfs_ctx *NTFSContext, period int) chan *USN_RECORD type Attribute + Resident bool + type EntryFlags uint64 + func (self EntryFlags) DebugString() string + type FNSummary struct + Name string + NameType string + ParentEntryNumber uint64 + ParentSequenceNumber uint16 type FileInfo + FNBtime time.Time + FNMtime time.Time + SequenceNumber uint16 type FilenameInfo + ParentEntryNumber uint64 + ParentSequenceNumber uint16 + type FixedUpReader struct + func (self FixedUpReader) IsFixed(offset int64) bool + func (self FixedUpReader) VtoP(offset int64) int64 type Flags + func (self Flags) Values() []string + type Flusher interface + Flush func() + type FreeList struct + func (self *FreeList) Get() []byte + func (self *FreeList) Put(in []byte) + type InodeFormatter struct + func (self *InodeFormatter) Inode(mft_id uint32, attr_type_id uint64, attr_id uint16, name string) string + type IsFixedReader interface + IsFixed func(offset int64) bool type LRU + func (self *LRU) DebugString() string + func (self *LRU) Touch(key int) + type MFTEntryCache struct + func NewMFTEntryCache(ntfs *NTFSContext) *MFTEntryCache + func (self *MFTEntryCache) GetSummary(id uint64) (*MFTEntrySummary, error) + type MFTEntrySummary struct + Filenames []FNSummary + Sequence uint16 type MFTHighlight + Copied bool + FileNames []string + HasADS bool + Inode string + LogFileSeqNum uint64 + ParentSequenceNumber uint16 + SIFlags string + SI_Lt_FN bool + SequenceNumber uint16 + USecZeros bool + func (self *MFTHighlight) Components() []string + func (self *MFTHighlight) Copy() *MFTHighlight + func (self *MFTHighlight) FileNameTypes() string + func (self *MFTHighlight) Links() []string type MFT_ENTRY + func GetFixedUpMFTEntry(ntfs *NTFSContext, reader io.ReaderAt, offset int64) (*MFT_ENTRY, error) type MappedReader + func (self *MappedReader) IsFixed(offset int64) bool + func (self *MappedReader) VtoP(offset int64) int64 type NTFSContext + MFTReader io.ReaderAt + func (self *NTFSContext) Close() + func (self *NTFSContext) Copy() *NTFSContext + func (self *NTFSContext) GetMFTSummary(id uint64) (*MFTEntrySummary, error) + func (self *NTFSContext) Purge() + func (self *NTFSContext) SetOptions(options Options) type NTFSFileInformation + Hardlinks []string + SequenceNumber uint16 type NTFSProfile + Off_USN_RECORD_V2_FileAttributes int64 + Off_USN_RECORD_V2_FileNameLength int64 + Off_USN_RECORD_V2_FileNameOffset int64 + Off_USN_RECORD_V2_FileReferenceNumberID int64 + Off_USN_RECORD_V2_FileReferenceNumberSequence int64 + Off_USN_RECORD_V2_MajorVersion int64 + Off_USN_RECORD_V2_MinorVersion int64 + Off_USN_RECORD_V2_ParentFileReferenceNumberID int64 + Off_USN_RECORD_V2_ParentFileReferenceNumberSequence int64 + Off_USN_RECORD_V2_Reason int64 + Off_USN_RECORD_V2_RecordLength int64 + Off_USN_RECORD_V2_SecurityId int64 + Off_USN_RECORD_V2_SourceInfo int64 + Off_USN_RECORD_V2_TimeStamp int64 + Off_USN_RECORD_V2_Usn int64 + func (self *NTFSProfile) USN_RECORD_V2(reader io.ReaderAt, offset int64) *USN_RECORD_V2 type NTFS_ATTRIBUTE + func GetAllVCNs(ntfs *NTFSContext, mft_entry *MFT_ENTRY, attr_type uint64, ...) []*NTFS_ATTRIBUTE + func NewNTFS_ATTRIBUTE(Reader io.ReaderAt, Offset int64, Profile *NTFSProfile) *NTFS_ATTRIBUTE + type OffsetReader struct + Offset int64 + Reader io.ReaderAt + func (self *OffsetReader) ReadAt(buf []byte, offset int64) (int, error) + type Options struct + IncludeShortNames bool + MaxDirectoryDepth int + MaxLinks int + PrefixComponents []string + func GetDefaultOptions() Options type PagedReader + func (self *PagedReader) Flush() + func (self *PagedReader) IsFixed(offset int64) bool + func (self *PagedReader) VtoP(offset int64) int64 type RangeReader + func NewUncompressedRangeReader(runs []*Run, cluster_size int64, disk_reader io.ReaderAt, is_sparse bool) *RangeReader + func (self *RangeReader) IsFixed(offset int64) bool + func (self *RangeReader) VtoP(offset int64) int64 + type Recorder struct + func NewRecorder(path string, reader io.ReaderAt) *Recorder + func (self *Recorder) ReadAt(buf []byte, offset int64) (int, error) type Run + Offset int64 + type RunInfo struct + ClusterSize int64 + CompressedLength int64 + FromOffset int64 + IsSparse bool + Length int64 + Level int + Reader string + ToOffset int64 + Type string + func DebugRuns(stream RangeReaderAt, level int) []*RunInfo + func (self RunInfo) String() string + type Stats struct + ATTRIBUTE_LIST_ENTRY int + FILE_NAME int + FixUpDiskMFTEntry int + MFT_ENTRY int + MFT_ENTRY_attributes int + MFT_ENTRY_filenames int + NTFSContext int + NTFS_ATTRIBUTE int + STANDARD_INFORMATION int + func (self *Stats) DebugString() string + func (self *Stats) Inc_ATTRIBUTE_LIST_ENTRY() + func (self *Stats) Inc_FILE_NAME() + func (self *Stats) Inc_FixUpDiskMFTEntry() + func (self *Stats) Inc_MFT_ENTRY() + func (self *Stats) Inc_MFT_ENTRY_attributes() + func (self *Stats) Inc_MFT_ENTRY_filenames() + func (self *Stats) Inc_NTFSContext() + func (self *Stats) Inc_NTFS_ATTRIBUTE() + func (self *Stats) Inc_STANDARD_INFORMATION() + type USN_RECORD struct + func NewUSN_RECORD(ntfs *NTFSContext, reader io.ReaderAt, offset int64) *USN_RECORD + func (self *USN_RECORD) DebugString() string + func (self *USN_RECORD) FileAttributes() []string + func (self *USN_RECORD) Filename() string + func (self *USN_RECORD) FullPath() string + func (self *USN_RECORD) Links() []string + func (self *USN_RECORD) Next(max_offset int64) *USN_RECORD + func (self *USN_RECORD) Reason() []string + func (self *USN_RECORD) SourceInfo() []string + func (self *USN_RECORD) Validate() bool + type USN_RECORD_V2 struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func (self *USN_RECORD_V2) DebugString() string + func (self *USN_RECORD_V2) FileAttributes() *Flags + func (self *USN_RECORD_V2) FileNameLength() uint16 + func (self *USN_RECORD_V2) FileNameOffset() uint16 + func (self *USN_RECORD_V2) FileReferenceNumberID() uint64 + func (self *USN_RECORD_V2) FileReferenceNumberSequence() uint64 + func (self *USN_RECORD_V2) MajorVersion() uint16 + func (self *USN_RECORD_V2) MinorVersion() uint16 + func (self *USN_RECORD_V2) ParentFileReferenceNumberID() uint64 + func (self *USN_RECORD_V2) ParentFileReferenceNumberSequence() uint64 + func (self *USN_RECORD_V2) Reason() *Flags + func (self *USN_RECORD_V2) RecordLength() uint32 + func (self *USN_RECORD_V2) SecurityId() uint32 + func (self *USN_RECORD_V2) Size() int + func (self *USN_RECORD_V2) SourceInfo() *Flags + func (self *USN_RECORD_V2) TimeStamp() *WinFileTime + func (self *USN_RECORD_V2) Usn() uint64 + type Visitor struct + IncludeShortNames bool + Max int + Paths [][]string + Prefix []string + func (self *Visitor) Add(idx int, depth int) int + func (self *Visitor) AddComponent(idx int, component string) + func (self *Visitor) Components() [][]string + type VtoPer interface + VtoP func(offset int64) int64 v0.1.1 Sep 21, 2020 Changes in this version + var COMPRESSED_MASK = uint16(1 << 15) + var LZNT1_debug = false + var NTFS_DEBUG *bool + var SIGNATURE_MASK = uint16(3 << 12) + var SIZE_MASK = uint16(1<<12) - 1 + func BootstrapMFT(ntfs *NTFSContext) (io.ReaderAt, error) + func Debug(arg interface{}) + func DebugPrint(fmt_str string, v ...interface{}) + func DebugString(arg interface{}, indent string) string + func FixUpDiskMFTEntry(mft *MFT_ENTRY) (io.ReaderAt, error) + func GetFullPath(ntfs *NTFSContext, mft_entry *MFT_ENTRY) (string, error) + func LZNT1Decompress(in []byte) ([]byte, error) + func LZNT1Printf(fmt_str string, args ...interface{}) + func ParseArray_byte(profile *NTFSProfile, reader io.ReaderAt, offset int64, count int) []byte + func ParseInt32(reader io.ReaderAt, offset int64) int32 + func ParseInt64(reader io.ReaderAt, offset int64) int64 + func ParseInt8(reader io.ReaderAt, offset int64) int8 + func ParseMFTFile(ctx context.Context, reader io.ReaderAt, size int64, cluster_size int64, ...) chan *MFTHighlight + func ParseMFTId(mft_id string) (mft_idx int64, attr int64, id int64, err error) + func ParseSignature(reader io.ReaderAt, offset int64, length int64) string + func ParseString(reader io.ReaderAt, offset int64, length int64) string + func ParseTerminatedString(reader io.ReaderAt, offset int64) string + func ParseTerminatedUTF16String(reader io.ReaderAt, offset int64) string + func ParseUTF16String(reader io.ReaderAt, offset int64, length int64) string + func ParseUint16(reader io.ReaderAt, offset int64) uint16 + func ParseUint32(reader io.ReaderAt, offset int64) uint32 + func ParseUint64(reader io.ReaderAt, offset int64) uint64 + func ParseUint8(reader io.ReaderAt, offset int64) byte + func Printf(fmt_str string, args ...interface{}) + func RangeSize(rng RangeReaderAt) int64 + func UTF16BytesToUTF8(b []byte, o binary.ByteOrder) string + type ATTRIBUTE_LIST_ENTRY struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func (self *ATTRIBUTE_LIST_ENTRY) Attribute_id() uint16 + func (self *ATTRIBUTE_LIST_ENTRY) Attributes(ntfs *NTFSContext, mft_entry *MFT_ENTRY, attr *NTFS_ATTRIBUTE) []*NTFS_ATTRIBUTE + func (self *ATTRIBUTE_LIST_ENTRY) DebugString() string + func (self *ATTRIBUTE_LIST_ENTRY) GetAttribute(ntfs *NTFSContext) (*NTFS_ATTRIBUTE, error) + func (self *ATTRIBUTE_LIST_ENTRY) Length() uint16 + func (self *ATTRIBUTE_LIST_ENTRY) MftReference() uint64 + func (self *ATTRIBUTE_LIST_ENTRY) Name_length() byte + func (self *ATTRIBUTE_LIST_ENTRY) Offset_to_name() byte + func (self *ATTRIBUTE_LIST_ENTRY) Size() int + func (self *ATTRIBUTE_LIST_ENTRY) Starting_vcn() uint64 + func (self *ATTRIBUTE_LIST_ENTRY) Type() uint32 + type Attribute struct + Id uint64 + Inode string + Name string + Size int64 + Type string + TypeId uint64 + type Debugger interface + DebugString func() string + type Enumeration struct + Name string + Value uint64 + func (self Enumeration) DebugString() string + type EvictCallback func(key int, value interface{}) + type FILE_NAME struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func (self *FILE_NAME) Allocated_size() uint64 + func (self *FILE_NAME) Created() *WinFileTime + func (self *FILE_NAME) DebugString() string + func (self *FILE_NAME) File_accessed() *WinFileTime + func (self *FILE_NAME) File_modified() *WinFileTime + func (self *FILE_NAME) FilenameSize() uint64 + func (self *FILE_NAME) Flags() *Flags + func (self *FILE_NAME) MftReference() uint64 + func (self *FILE_NAME) Mft_modified() *WinFileTime + func (self *FILE_NAME) Name() string + func (self *FILE_NAME) NameType() *Enumeration + func (self *FILE_NAME) Reparse_value() uint32 + func (self *FILE_NAME) Seq_num() uint16 + func (self *FILE_NAME) Size() int + type FileInfo struct + AllocatedSize int64 + Atime time.Time + Btime time.Time + Ctime time.Time + ExtraNames []string + IsDir bool + IsSlack bool + MFTId string + Mtime time.Time + Name string + NameType string + Size int64 + SlackOffset int64 + func ExtractI30List(ntfs *NTFSContext, mft_entry *MFT_ENTRY) []*FileInfo + func ExtractI30ListFromStream(ntfs *NTFSContext, reader io.ReaderAt, stream_size int64) []*FileInfo + func ListDir(ntfs *NTFSContext, root *MFT_ENTRY) []*FileInfo + func Stat(ntfs *NTFSContext, node_mft *MFT_ENTRY) []*FileInfo + type FilenameInfo struct + Name string + Times TimeStamps + Type string + type Flags struct + Names map[string]bool + Value uint64 + func (self Flags) DebugString() string + func (self Flags) IsSet(flag string) bool + type GUID struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func (self *GUID) Data1() uint32 + func (self *GUID) Data2() uint16 + func (self *GUID) Data3() uint16 + func (self *GUID) Data4() []byte + func (self *GUID) DebugString() string + func (self *GUID) Size() int + func (self GUID) AsString() string + type GenericRun struct + End int64 + Offset int64 + Reader io.ReaderAt + type INDEX_NODE_HEADER struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func (self *INDEX_NODE_HEADER) DebugString() string + func (self *INDEX_NODE_HEADER) GetRecords(ntfs *NTFSContext) []*INDEX_RECORD_ENTRY + func (self *INDEX_NODE_HEADER) Offset_to_end_index_entry() uint32 + func (self *INDEX_NODE_HEADER) Offset_to_index_entry() uint32 + func (self *INDEX_NODE_HEADER) ScanSlack(ntfs *NTFSContext) []*INDEX_RECORD_ENTRY + func (self *INDEX_NODE_HEADER) Size() int + func (self *INDEX_NODE_HEADER) SizeOfEntriesAlloc() int32 + type INDEX_RECORD_ENTRY struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func (self *INDEX_RECORD_ENTRY) DebugString() string + func (self *INDEX_RECORD_ENTRY) File() *FILE_NAME + func (self *INDEX_RECORD_ENTRY) FilenameOffset() uint16 + func (self *INDEX_RECORD_ENTRY) Flags() uint32 + func (self *INDEX_RECORD_ENTRY) IsValid() bool + func (self *INDEX_RECORD_ENTRY) MftReference() uint64 + func (self *INDEX_RECORD_ENTRY) Seq_num() uint16 + func (self *INDEX_RECORD_ENTRY) Size() int + func (self *INDEX_RECORD_ENTRY) SizeOfIndexEntry() uint16 + type INDEX_ROOT struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func (self *INDEX_ROOT) Collation_rule() uint32 + func (self *INDEX_ROOT) DebugString() string + func (self *INDEX_ROOT) Idx_size_c() uint32 + func (self *INDEX_ROOT) Idxalloc_size_b() uint32 + func (self *INDEX_ROOT) Node() *INDEX_NODE_HEADER + func (self *INDEX_ROOT) Size() int + func (self *INDEX_ROOT) Type() uint32 + type LRU struct + func NewLRU(size int, onEvict EvictCallback) (*LRU, error) + func (c *LRU) Add(key int, value interface{}) (evicted bool) + func (c *LRU) Contains(key int) (ok bool) + func (c *LRU) Get(key int) (value interface{}, ok bool) + func (c *LRU) GetOldest() (key int, value interface{}, ok bool) + func (c *LRU) Keys() []int + func (c *LRU) Len() int + func (c *LRU) Peek(key int) (value interface{}, ok bool) + func (c *LRU) Purge() + func (c *LRU) Remove(key int) (present bool) + func (c *LRU) RemoveOldest() (key int, value interface{}, ok bool) + type LimitedReader struct + N int64 + func (self LimitedReader) ReadAt(buff []byte, off int64) (int, error) + type MFTHighlight struct + Created0x10 time.Time + Created0x30 time.Time + EntryNumber int64 + FileName string + FileSize int64 + FullPath string + InUse bool + IsDir bool + LastAccess0x10 time.Time + LastAccess0x30 time.Time + LastModified0x10 time.Time + LastModified0x30 time.Time + LastRecordChange0x10 time.Time + LastRecordChange0x30 time.Time + ParentEntryNumber uint64 + ReferenceCount int64 + type MFT_ENTRY struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func (self *MFT_ENTRY) Attribute_offset() uint16 + func (self *MFT_ENTRY) Base_record_reference() uint64 + func (self *MFT_ENTRY) DebugString() string + func (self *MFT_ENTRY) Dir(ntfs *NTFSContext) []*INDEX_RECORD_ENTRY + func (self *MFT_ENTRY) DirNodes(ntfs *NTFSContext) []*INDEX_NODE_HEADER + func (self *MFT_ENTRY) Display(ntfs *NTFSContext) string + func (self *MFT_ENTRY) EnumerateAttributes(ntfs *NTFSContext) []*NTFS_ATTRIBUTE + func (self *MFT_ENTRY) FileName(ntfs *NTFSContext) []*FILE_NAME + func (self *MFT_ENTRY) Fixup_count() uint16 + func (self *MFT_ENTRY) Fixup_offset() uint16 + func (self *MFT_ENTRY) Flags() *Flags + func (self *MFT_ENTRY) GetAttribute(ntfs *NTFSContext, attr_type, id int64) (*NTFS_ATTRIBUTE, error) + func (self *MFT_ENTRY) GetDirectAttribute(ntfs *NTFSContext, attr_type uint64, attr_id uint16) (*NTFS_ATTRIBUTE, error) + func (self *MFT_ENTRY) IsDir(ntfs *NTFSContext) bool + func (self *MFT_ENTRY) Link_count() uint16 + func (self *MFT_ENTRY) Logfile_sequence_number() uint64 + func (self *MFT_ENTRY) Magic() *Signature + func (self *MFT_ENTRY) Mft_entry_allocated() uint16 + func (self *MFT_ENTRY) Mft_entry_size() uint16 + func (self *MFT_ENTRY) Next_attribute_id() uint16 + func (self *MFT_ENTRY) Open(ntfs *NTFSContext, filename string) (*MFT_ENTRY, error) + func (self *MFT_ENTRY) Record_number() uint32 + func (self *MFT_ENTRY) Sequence_value() uint16 + func (self *MFT_ENTRY) Size() int + func (self *MFT_ENTRY) StandardInformation(ntfs *NTFSContext) (*STANDARD_INFORMATION, error) + type MapReader struct + Runs []*GenericRun + func (self *MapReader) ReadAt(buf []byte, offset int64) (int, error) + type MappedReader struct + ClusterSize int64 + CompressedLength int64 + FileOffset int64 + IsSparse bool + Length int64 + Reader io.ReaderAt + TargetOffset int64 + func MakeMappedReader(runs []Run, disk_reader io.ReaderAt, cluster_size, compression_unit_size int64) []*MappedReader + func (self *MappedReader) Decompress(reader io.ReaderAt, cluster_size int64) ([]byte, error) + func (self *MappedReader) Ranges() []Range + func (self *MappedReader) ReadAt(buff []byte, off int64) (int, error) + func (self MappedReader) DebugString() string + type NTFSContext struct + Boot *NTFS_BOOT_SECTOR + ClusterSize int64 + DiskReader io.ReaderAt + Profile *NTFSProfile + RecordSize int64 + RootMFT *MFT_ENTRY + func GetNTFSContext(image io.ReaderAt, offset int64) (*NTFSContext, error) + func (self *NTFSContext) GetMFT(id int64) (*MFT_ENTRY, error) + func (self *NTFSContext) GetRecordSize() int64 + type NTFSFileInformation struct + Allocated bool + Attributes []*Attribute + Filenames []*FilenameInfo + FullPath string + IsDir bool + MFTID int64 + SI_Times *TimeStamps + Size int64 + func ModelMFTEntry(ntfs *NTFSContext, mft_entry *MFT_ENTRY) (*NTFSFileInformation, error) + type NTFSProfile struct + Off_ATTRIBUTE_LIST_ENTRY_Attribute_id int64 + Off_ATTRIBUTE_LIST_ENTRY_Length int64 + Off_ATTRIBUTE_LIST_ENTRY_MftReference int64 + Off_ATTRIBUTE_LIST_ENTRY_Name_length int64 + Off_ATTRIBUTE_LIST_ENTRY_Offset_to_name int64 + Off_ATTRIBUTE_LIST_ENTRY_Starting_vcn int64 + Off_ATTRIBUTE_LIST_ENTRY_Type int64 + Off_FILE_NAME_Allocated_size int64 + Off_FILE_NAME_Created int64 + Off_FILE_NAME_File_accessed int64 + Off_FILE_NAME_File_modified int64 + Off_FILE_NAME_FilenameSize int64 + Off_FILE_NAME_Flags int64 + Off_FILE_NAME_MftReference int64 + Off_FILE_NAME_Mft_modified int64 + Off_FILE_NAME_NameType int64 + Off_FILE_NAME_Reparse_value int64 + Off_FILE_NAME_Seq_num int64 + Off_FILE_NAME__length_of_name int64 + Off_FILE_NAME_name int64 + Off_GUID_Data1 int64 + Off_GUID_Data2 int64 + Off_GUID_Data3 int64 + Off_GUID_Data4 int64 + Off_INDEX_NODE_HEADER_Offset_to_end_index_entry int64 + Off_INDEX_NODE_HEADER_Offset_to_index_entry int64 + Off_INDEX_NODE_HEADER_SizeOfEntriesAlloc int64 + Off_INDEX_RECORD_ENTRY_File int64 + Off_INDEX_RECORD_ENTRY_FilenameOffset int64 + Off_INDEX_RECORD_ENTRY_Flags int64 + Off_INDEX_RECORD_ENTRY_MftReference int64 + Off_INDEX_RECORD_ENTRY_Seq_num int64 + Off_INDEX_RECORD_ENTRY_SizeOfIndexEntry int64 + Off_INDEX_ROOT_Collation_rule int64 + Off_INDEX_ROOT_Idx_size_c int64 + Off_INDEX_ROOT_Idxalloc_size_b int64 + Off_INDEX_ROOT_Node int64 + Off_INDEX_ROOT_Type int64 + Off_MFT_ENTRY_Attribute_offset int64 + Off_MFT_ENTRY_Base_record_reference int64 + Off_MFT_ENTRY_Fixup_count int64 + Off_MFT_ENTRY_Fixup_offset int64 + Off_MFT_ENTRY_Flags int64 + Off_MFT_ENTRY_Link_count int64 + Off_MFT_ENTRY_Logfile_sequence_number int64 + Off_MFT_ENTRY_Magic int64 + Off_MFT_ENTRY_Mft_entry_allocated int64 + Off_MFT_ENTRY_Mft_entry_size int64 + Off_MFT_ENTRY_Next_attribute_id int64 + Off_MFT_ENTRY_Record_number int64 + Off_MFT_ENTRY_Sequence_value int64 + Off_NTFS_ATTRIBUTE_Actual_size int64 + Off_NTFS_ATTRIBUTE_Allocated_size int64 + Off_NTFS_ATTRIBUTE_Attribute_id int64 + Off_NTFS_ATTRIBUTE_Compression_unit_size int64 + Off_NTFS_ATTRIBUTE_Content_offset int64 + Off_NTFS_ATTRIBUTE_Content_size int64 + Off_NTFS_ATTRIBUTE_Flags int64 + Off_NTFS_ATTRIBUTE_Initialized_size int64 + Off_NTFS_ATTRIBUTE_Length int64 + Off_NTFS_ATTRIBUTE_Resident int64 + Off_NTFS_ATTRIBUTE_Runlist_offset int64 + Off_NTFS_ATTRIBUTE_Runlist_vcn_end int64 + Off_NTFS_ATTRIBUTE_Runlist_vcn_start int64 + Off_NTFS_ATTRIBUTE_Type int64 + Off_NTFS_ATTRIBUTE_name_length int64 + Off_NTFS_ATTRIBUTE_name_offset int64 + Off_NTFS_BOOT_SECTOR_Index_record_size int64 + Off_NTFS_BOOT_SECTOR_Magic int64 + Off_NTFS_BOOT_SECTOR_Oemname int64 + Off_NTFS_BOOT_SECTOR_Sector_size int64 + Off_NTFS_BOOT_SECTOR_Serial int64 + Off_NTFS_BOOT_SECTOR__cluster_size int64 + Off_NTFS_BOOT_SECTOR__mft_cluster int64 + Off_NTFS_BOOT_SECTOR__mft_record_size int64 + Off_NTFS_BOOT_SECTOR__mirror_mft_cluster int64 + Off_NTFS_BOOT_SECTOR__volume_size int64 + Off_NTFS_RESIDENT_ATTRIBUTE_Attribute_id int64 + Off_NTFS_RESIDENT_ATTRIBUTE_Length int64 + Off_NTFS_RESIDENT_ATTRIBUTE_Name_length int64 + Off_NTFS_RESIDENT_ATTRIBUTE_Name_offset int64 + Off_NTFS_RESIDENT_ATTRIBUTE_Resident int64 + Off_NTFS_RESIDENT_ATTRIBUTE_Type int64 + Off_NTFS_RESIDENT_ATTRIBUTE_content_offset int64 + Off_NTFS_RESIDENT_ATTRIBUTE_content_size int64 + Off_STANDARD_INDEX_HEADER_Fixup_count int64 + Off_STANDARD_INDEX_HEADER_Fixup_offset int64 + Off_STANDARD_INDEX_HEADER_LogFileSeqNum int64 + Off_STANDARD_INDEX_HEADER_MagicNumber int64 + Off_STANDARD_INDEX_HEADER_Node int64 + Off_STANDARD_INDEX_HEADER_VcnOfINDX int64 + Off_STANDARD_INFORMATION_Class_id int64 + Off_STANDARD_INFORMATION_Create_time int64 + Off_STANDARD_INFORMATION_File_accessed_time int64 + Off_STANDARD_INFORMATION_File_altered_time int64 + Off_STANDARD_INFORMATION_Flags int64 + Off_STANDARD_INFORMATION_Max_versions int64 + Off_STANDARD_INFORMATION_Mft_altered_time int64 + Off_STANDARD_INFORMATION_Owner_id int64 + Off_STANDARD_INFORMATION_Quota int64 + Off_STANDARD_INFORMATION_Sid int64 + Off_STANDARD_INFORMATION_Usn int64 + Off_STANDARD_INFORMATION_Version int64 + Off_VSS_CATALOG_ENTRY_1_EntryType int64 + Off_VSS_CATALOG_ENTRY_2_CreationTime int64 + Off_VSS_CATALOG_ENTRY_2_EntryType int64 + Off_VSS_CATALOG_ENTRY_2_StoreGUID int64 + Off_VSS_CATALOG_ENTRY_2_VolumeSize int64 + Off_VSS_CATALOG_ENTRY_3_AllocatedSize int64 + Off_VSS_CATALOG_ENTRY_3_EntryType int64 + Off_VSS_CATALOG_ENTRY_3_NTFSFileReference int64 + Off_VSS_CATALOG_ENTRY_3_StoreBitmapOffset int64 + Off_VSS_CATALOG_ENTRY_3_StoreBlockListOffset int64 + Off_VSS_CATALOG_ENTRY_3_StoreBlockRangeListOffset int64 + Off_VSS_CATALOG_ENTRY_3_StoreGUID int64 + Off_VSS_CATALOG_ENTRY_3_StoreHeaderOffset int64 + Off_VSS_CATALOG_ENTRY_3_StorePreviousBitmapOffset int64 + Off_VSS_CATALOG_HEADER_CurrentOffset int64 + Off_VSS_CATALOG_HEADER_Identifier int64 + Off_VSS_CATALOG_HEADER_NextOffset int64 + Off_VSS_CATALOG_HEADER_RecordType int64 + Off_VSS_CATALOG_HEADER_RelativeOffset int64 + Off_VSS_CATALOG_HEADER_Version int64 + Off_VSS_STORE_BLOCK_HEADER_CurrentOffset int64 + Off_VSS_STORE_BLOCK_HEADER_Identifier int64 + Off_VSS_STORE_BLOCK_HEADER_NextOffset int64 + Off_VSS_STORE_BLOCK_HEADER_RecordType int64 + Off_VSS_STORE_BLOCK_HEADER_RelativeOffset int64 + Off_VSS_STORE_BLOCK_HEADER_SizeOfStore int64 + Off_VSS_STORE_BLOCK_HEADER_Version int64 + Off_VSS_STORE_INFORMATION_AttributeFlags int64 + Off_VSS_STORE_INFORMATION_ShadowCopyGUID int64 + Off_VSS_STORE_INFORMATION_ShadowCopySetGUID int64 + Off_VSS_STORE_INFORMATION_SnapshotContext int64 + Off_VSS_VOLUME_HEADER_CatalogOffset int64 + Off_VSS_VOLUME_HEADER_CurrentOffset int64 + Off_VSS_VOLUME_HEADER_Identifier int64 + Off_VSS_VOLUME_HEADER_MaxSize int64 + Off_VSS_VOLUME_HEADER_RecordType int64 + Off_VSS_VOLUME_HEADER_ShadowVolumeGUID int64 + Off_VSS_VOLUME_HEADER_Version int64 + Off_VSS_VOLUME_HEADER_VolumeGUID int64 + func NewNTFSProfile() *NTFSProfile + func (self *NTFSProfile) ATTRIBUTE_LIST_ENTRY(reader io.ReaderAt, offset int64) *ATTRIBUTE_LIST_ENTRY + func (self *NTFSProfile) FILE_NAME(reader io.ReaderAt, offset int64) *FILE_NAME + func (self *NTFSProfile) GUID(reader io.ReaderAt, offset int64) *GUID + func (self *NTFSProfile) INDEX_NODE_HEADER(reader io.ReaderAt, offset int64) *INDEX_NODE_HEADER + func (self *NTFSProfile) INDEX_RECORD_ENTRY(reader io.ReaderAt, offset int64) *INDEX_RECORD_ENTRY + func (self *NTFSProfile) INDEX_ROOT(reader io.ReaderAt, offset int64) *INDEX_ROOT + func (self *NTFSProfile) MFT_ENTRY(reader io.ReaderAt, offset int64) *MFT_ENTRY + func (self *NTFSProfile) NTFS_ATTRIBUTE(reader io.ReaderAt, offset int64) *NTFS_ATTRIBUTE + func (self *NTFSProfile) NTFS_BOOT_SECTOR(reader io.ReaderAt, offset int64) *NTFS_BOOT_SECTOR + func (self *NTFSProfile) NTFS_RESIDENT_ATTRIBUTE(reader io.ReaderAt, offset int64) *NTFS_RESIDENT_ATTRIBUTE + func (self *NTFSProfile) STANDARD_INDEX_HEADER(reader io.ReaderAt, offset int64) *STANDARD_INDEX_HEADER + func (self *NTFSProfile) STANDARD_INFORMATION(reader io.ReaderAt, offset int64) *STANDARD_INFORMATION + func (self *NTFSProfile) VSS_CATALOG_ENTRY_1(reader io.ReaderAt, offset int64) *VSS_CATALOG_ENTRY_1 + func (self *NTFSProfile) VSS_CATALOG_ENTRY_2(reader io.ReaderAt, offset int64) *VSS_CATALOG_ENTRY_2 + func (self *NTFSProfile) VSS_CATALOG_ENTRY_3(reader io.ReaderAt, offset int64) *VSS_CATALOG_ENTRY_3 + func (self *NTFSProfile) VSS_CATALOG_HEADER(reader io.ReaderAt, offset int64) *VSS_CATALOG_HEADER + func (self *NTFSProfile) VSS_STORE_BLOCK_HEADER(reader io.ReaderAt, offset int64) *VSS_STORE_BLOCK_HEADER + func (self *NTFSProfile) VSS_STORE_INFORMATION(reader io.ReaderAt, offset int64) *VSS_STORE_INFORMATION + func (self *NTFSProfile) VSS_VOLUME_HEADER(reader io.ReaderAt, offset int64) *VSS_VOLUME_HEADER + func (self *NTFSProfile) WinFileTime(reader io.ReaderAt, offset int64) *WinFileTime + type NTFS_ATTRIBUTE struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func (self *NTFS_ATTRIBUTE) Actual_size() uint64 + func (self *NTFS_ATTRIBUTE) Allocated_size() uint64 + func (self *NTFS_ATTRIBUTE) Attribute_id() uint16 + func (self *NTFS_ATTRIBUTE) Compression_unit_size() uint16 + func (self *NTFS_ATTRIBUTE) Content_offset() uint16 + func (self *NTFS_ATTRIBUTE) Content_size() uint32 + func (self *NTFS_ATTRIBUTE) Data(ntfs *NTFSContext) io.ReaderAt + func (self *NTFS_ATTRIBUTE) DataSize() int64 + func (self *NTFS_ATTRIBUTE) DebugString() string + func (self *NTFS_ATTRIBUTE) Flags() *Flags + func (self *NTFS_ATTRIBUTE) Initialized_size() uint64 + func (self *NTFS_ATTRIBUTE) IsResident() bool + func (self *NTFS_ATTRIBUTE) Length() uint32 + func (self *NTFS_ATTRIBUTE) Name() string + func (self *NTFS_ATTRIBUTE) PrintStats(ntfs *NTFSContext) string + func (self *NTFS_ATTRIBUTE) Resident() *Enumeration + func (self *NTFS_ATTRIBUTE) RunList() []Run + func (self *NTFS_ATTRIBUTE) Runlist_offset() uint16 + func (self *NTFS_ATTRIBUTE) Runlist_vcn_end() uint64 + func (self *NTFS_ATTRIBUTE) Runlist_vcn_start() uint64 + func (self *NTFS_ATTRIBUTE) Size() int + func (self *NTFS_ATTRIBUTE) Type() *Enumeration + type NTFS_BOOT_SECTOR struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func (self *NTFS_BOOT_SECTOR) BlockCount() int64 + func (self *NTFS_BOOT_SECTOR) ClusterSize() int64 + func (self *NTFS_BOOT_SECTOR) DebugString() string + func (self *NTFS_BOOT_SECTOR) Index_record_size() byte + func (self *NTFS_BOOT_SECTOR) IsValid() error + func (self *NTFS_BOOT_SECTOR) Magic() uint16 + func (self *NTFS_BOOT_SECTOR) Oemname() string + func (self *NTFS_BOOT_SECTOR) RecordSize() int64 + func (self *NTFS_BOOT_SECTOR) Sector_size() uint16 + func (self *NTFS_BOOT_SECTOR) Serial() string + func (self *NTFS_BOOT_SECTOR) Size() int + type NTFS_RESIDENT_ATTRIBUTE struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func (self *NTFS_RESIDENT_ATTRIBUTE) Attribute_id() uint16 + func (self *NTFS_RESIDENT_ATTRIBUTE) DebugString() string + func (self *NTFS_RESIDENT_ATTRIBUTE) Length() uint32 + func (self *NTFS_RESIDENT_ATTRIBUTE) Name_length() byte + func (self *NTFS_RESIDENT_ATTRIBUTE) Name_offset() uint16 + func (self *NTFS_RESIDENT_ATTRIBUTE) Resident() *Enumeration + func (self *NTFS_RESIDENT_ATTRIBUTE) Size() int + func (self *NTFS_RESIDENT_ATTRIBUTE) Type() *Enumeration + type NullReader struct + func (self *NullReader) ReadAt(buf []byte, offset int64) (int, error) + type PagedReader struct + Hits int64 + Miss int64 + func NewPagedReader(reader io.ReaderAt, pagesize int64, cache_size int) (*PagedReader, error) + func (self *PagedReader) ReadAt(buf []byte, offset int64) (int, error) + type Range struct + IsSparse bool + Length int64 + Offset int64 + type RangeReader struct + func NewCompressedRangeReader(runs []Run, cluster_size int64, disk_reader io.ReaderAt, ...) *RangeReader + func NewRangeReader(runs []Run, disk_reader io.ReaderAt, cluster_size, compression_unit_size int64) *RangeReader + func (self *RangeReader) DebugString() string + func (self *RangeReader) Ranges() []Range + func (self *RangeReader) ReadAt(buf []byte, file_offset int64) (int, error) + type RangeReaderAt interface + Ranges func() []Range + func GetDataForPath(ntfs *NTFSContext, path string) (RangeReaderAt, error) + func OpenStream(ntfs *NTFSContext, mft_entry *MFT_ENTRY, attr_type uint64, attr_id uint16) (RangeReaderAt, error) + type Run struct + Length int64 + RelativeUrnOffset int64 + type STANDARD_INDEX_HEADER struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func DecodeSTANDARD_INDEX_HEADER(ntfs *NTFSContext, reader io.ReaderAt, offset int64, length int64) (*STANDARD_INDEX_HEADER, error) + func (self *STANDARD_INDEX_HEADER) DebugString() string + func (self *STANDARD_INDEX_HEADER) Fixup_count() uint16 + func (self *STANDARD_INDEX_HEADER) Fixup_offset() uint16 + func (self *STANDARD_INDEX_HEADER) LogFileSeqNum() uint64 + func (self *STANDARD_INDEX_HEADER) MagicNumber() *Signature + func (self *STANDARD_INDEX_HEADER) Node() *INDEX_NODE_HEADER + func (self *STANDARD_INDEX_HEADER) Size() int + func (self *STANDARD_INDEX_HEADER) VcnOfINDX() uint64 + type STANDARD_INFORMATION struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func (self *STANDARD_INFORMATION) Class_id() uint32 + func (self *STANDARD_INFORMATION) Create_time() *WinFileTime + func (self *STANDARD_INFORMATION) DebugString() string + func (self *STANDARD_INFORMATION) File_accessed_time() *WinFileTime + func (self *STANDARD_INFORMATION) File_altered_time() *WinFileTime + func (self *STANDARD_INFORMATION) Flags() *Flags + func (self *STANDARD_INFORMATION) Max_versions() uint32 + func (self *STANDARD_INFORMATION) Mft_altered_time() *WinFileTime + func (self *STANDARD_INFORMATION) Owner_id() uint32 + func (self *STANDARD_INFORMATION) Quota() uint64 + func (self *STANDARD_INFORMATION) Sid() uint32 + func (self *STANDARD_INFORMATION) Size() int + func (self *STANDARD_INFORMATION) Usn() uint32 + func (self *STANDARD_INFORMATION) Version() uint32 + type Signature struct + func (self Signature) IsValid() bool + type TimeStamps struct + AccessedTime time.Time + CreateTime time.Time + FileModifiedTime time.Time + MFTModifiedTime time.Time + type VSS_CATALOG_ENTRY_1 struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func (self *VSS_CATALOG_ENTRY_1) DebugString() string + func (self *VSS_CATALOG_ENTRY_1) EntryType() int64 + func (self *VSS_CATALOG_ENTRY_1) Size() int + type VSS_CATALOG_ENTRY_2 struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func (self *VSS_CATALOG_ENTRY_2) CreationTime() *WinFileTime + func (self *VSS_CATALOG_ENTRY_2) DebugString() string + func (self *VSS_CATALOG_ENTRY_2) EntryType() int64 + func (self *VSS_CATALOG_ENTRY_2) Size() int + func (self *VSS_CATALOG_ENTRY_2) StoreGUID() *GUID + func (self *VSS_CATALOG_ENTRY_2) VolumeSize() int64 + type VSS_CATALOG_ENTRY_3 struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func (self *VSS_CATALOG_ENTRY_3) AllocatedSize() int64 + func (self *VSS_CATALOG_ENTRY_3) DebugString() string + func (self *VSS_CATALOG_ENTRY_3) EntryType() int64 + func (self *VSS_CATALOG_ENTRY_3) NTFSFileReference() int64 + func (self *VSS_CATALOG_ENTRY_3) Size() int + func (self *VSS_CATALOG_ENTRY_3) StoreBitmapOffset() int64 + func (self *VSS_CATALOG_ENTRY_3) StoreBlockListOffset() int64 + func (self *VSS_CATALOG_ENTRY_3) StoreBlockRangeListOffset() int64 + func (self *VSS_CATALOG_ENTRY_3) StoreGUID() *GUID + func (self *VSS_CATALOG_ENTRY_3) StoreHeaderOffset() int64 + func (self *VSS_CATALOG_ENTRY_3) StorePreviousBitmapOffset() int64 + type VSS_CATALOG_HEADER struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func (self *VSS_CATALOG_HEADER) CurrentOffset() int64 + func (self *VSS_CATALOG_HEADER) DebugString() string + func (self *VSS_CATALOG_HEADER) Identifier() *GUID + func (self *VSS_CATALOG_HEADER) NextOffset() int64 + func (self *VSS_CATALOG_HEADER) RecordType() uint32 + func (self *VSS_CATALOG_HEADER) RelativeOffset() int64 + func (self *VSS_CATALOG_HEADER) Size() int + func (self *VSS_CATALOG_HEADER) Version() uint32 + type VSS_STORE_BLOCK_HEADER struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func (self *VSS_STORE_BLOCK_HEADER) CurrentOffset() int64 + func (self *VSS_STORE_BLOCK_HEADER) DebugString() string + func (self *VSS_STORE_BLOCK_HEADER) Identifier() *GUID + func (self *VSS_STORE_BLOCK_HEADER) NextOffset() int64 + func (self *VSS_STORE_BLOCK_HEADER) RecordType() *Enumeration + func (self *VSS_STORE_BLOCK_HEADER) RelativeOffset() int64 + func (self *VSS_STORE_BLOCK_HEADER) Size() int + func (self *VSS_STORE_BLOCK_HEADER) SizeOfStore() int64 + func (self *VSS_STORE_BLOCK_HEADER) Version() uint32 + type VSS_STORE_INFORMATION struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func (self *VSS_STORE_INFORMATION) AttributeFlags() *Flags + func (self *VSS_STORE_INFORMATION) DebugString() string + func (self *VSS_STORE_INFORMATION) ShadowCopyGUID() *GUID + func (self *VSS_STORE_INFORMATION) ShadowCopySetGUID() *GUID + func (self *VSS_STORE_INFORMATION) Size() int + func (self *VSS_STORE_INFORMATION) SnapshotContext() uint32 + type VSS_VOLUME_HEADER struct + Offset int64 + Profile *NTFSProfile + Reader io.ReaderAt + func (self *VSS_VOLUME_HEADER) CatalogOffset() int64 + func (self *VSS_VOLUME_HEADER) CurrentOffset() int64 + func (self *VSS_VOLUME_HEADER) DebugString() string + func (self *VSS_VOLUME_HEADER) Identifier() *GUID + func (self *VSS_VOLUME_HEADER) MaxSize() uint64 + func (self *VSS_VOLUME_HEADER) RecordType() uint32 + func (self *VSS_VOLUME_HEADER) ShadowVolumeGUID() *GUID + func (self *VSS_VOLUME_HEADER) Size() int + func (self *VSS_VOLUME_HEADER) Version() uint32 + func (self *VSS_VOLUME_HEADER) VolumeGUID() *GUID + type WinFileTime struct + func (self *WinFileTime) DebugString() string + func (self *WinFileTime) GoString() string