vbr

package module

v1.1.2 Latest Latest Go to latest Published: May 2, 2020 License: MIT Imports: 5 Imported by: 0

Details

Valid go.mod file

The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
Redistributable license

Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
Tagged version

Modules with tagged versions give importers more predictable builds.
Stable version

When a project reaches major version v1 it is considered stable.
Learn more about best practices

Repository

github.com/Go-Forensics/VBR-Parser

Links

Open Source Insights

README ¶

VBR-Parser

This library can parse an NTFS volume boot record byte slice to pull out the necessary information to collect data from an NTFS volume.

Documentation ¶

Index ¶

type RawVolumeBootRecord
- func (rawVolumeBootRecord RawVolumeBootRecord) Parse() (vbr VolumeBootRecord, err error)
type VolumeBootRecord

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type RawVolumeBootRecord ¶

type RawVolumeBootRecord []byte

RawVolumeBootRecord is a []byte alias containing bytes of a raw volume boot record. Used as a receiver for Parse().

func (RawVolumeBootRecord) Parse ¶

func (rawVolumeBootRecord RawVolumeBootRecord) Parse() (vbr VolumeBootRecord, err error)

Parse parses a byte slice containing an NTFS volume boot record (VBR)

type VolumeBootRecord ¶

type VolumeBootRecord struct {
	VolumeLetter           string
	BytesPerSector         int64
	SectorsPerCluster      int64
	BytesPerCluster        int64
	MftByteOffset          int64
	MftRecordSize          int64
	ClustersPerIndexRecord int64
}

VolumeBootRecord contains relevant data about an NTFS volume

Source Files ¶

View all Source files

vbr.go

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL