Documentation ¶
Overview ¶
Package ntfs provides read-only NTFS file system access.
This package is a work in progress and is not yet suitable for use.
Index ¶
- Constants
- Variables
- type Attribute
- type AttributeListEntry
- type AttributeRecordHeader
- type Bitmap
- type BootRecord
- type File
- type FileName
- type FileRecordSegmentHeader
- type FileReference
- type GUID
- type IndexAllocation
- type IndexRoot
- type MFT
- type MultiSectorHeader
- type NonresidentAttributeRecordHeader
- type ObjectID
- type ParameterBlock
- type Reader
- type ResidentAttributeRecordHeader
- type SegmentReference
- type StandardInformation
- type VCN
- type VolumeInformation
Constants ¶
const AttributeRecordHeaderLength = 16
AttributeRecordHeaderLength is the length of an attribute header in bytes, excluding its resident or non-resident portion.
const BootRecordLength = 84
BootRecordLength is the length of a volume boot record in bytes.
const FileNameHeaderLength = 66
FileNameHeaderLength is the length of a file name header in bytes.
const FileRecordSegmentHeaderLength = 42
FileRecordSegmentHeaderLength is the length of a file record segment header in bytes.
const IndexAllocationMinLength = 66
IndexAllocationMinLength is the minimum length of an $INDEX_ALLOCATION attribute in bytes.
const IndexRootMinLength = 16
IndexRootMinLength is the minimum length of an $INDEX_ROOT attribute in bytes.
const MultiSectorHeaderLength = 8
MultiSectorHeaderLength is the length of a multi-sector header in bytes.
const NonresidentAttributeRecordHeaderLength = 48
NonresidentAttributeRecordHeaderLength is the length of the non-resident portion of an attribute header in bytes.
const ObjectIDMinLength = 16
ObjectIDMinLength is the minimum length of an object ID attribute in bytes.
const ParameterBlockLength = 73
ParameterBlockLength is the length of an NTFS parameter block in bytes.
const ResidentAttributeRecordHeaderLength = 8
ResidentAttributeRecordHeaderLength is the length of the resident portion of an attribute header in bytes.
const SegmentReferenceLength = 8
SegmentReferenceLength is the length of a segment reference in bytes.
const StandardInformationMinLength = 48
StandardInformationMinLength is the minimum length of a standard information attribute in bytes.
const VolumeInformationLength = 12
VolumeInformationLength is the length of a volume information record in bytes.
Variables ¶
var ( // ErrInvalidLabel is returned when creating a new reader with invalid // NTFS data. ErrInvalidLabel = errors.New("volume boot record does not contain a valid NTFS file system label") // ErrTruncatedData is returned when attempting to read data from a buffer // or reader with insufficient data. ErrTruncatedData = errors.New("insufficient or truncated data") // ErrInvalidUnicode is returned when attempting to decode invalid unicode // data. This happens when the unicode data being processed has an odd // number of bytes, exceeds a specified maximum length, or is located // beyond the bounds of its containing record. ErrInvalidUnicode = errors.New("invalid unicode data") // ErrAttributeNameOutOfBounds is returned when an attribute name exceeds // the the bounds of its containing record. // // This typically is indicative of MFT corruption. ErrAttributeNameOutOfBounds = errors.New("attribute name data exceeds the bounds of its file record segment") // ErrAttributeValueOutOfBounds is returned when an attribute's value // exceeds the bounds of its containing record. // // This typically is indicative of MFT corruption. ErrAttributeValueOutOfBounds = errors.New("attribute value exceeds the bounds of its file record segment") // ErrFileNameOutOfBounds is returned when a the value of a file name attribute // exceeds the bounds of its containing record. // // This typically is indicative of MFT corruption. ErrFileNameOutOfBounds = errors.New("file name value exceeds the bounds of its file record segment") )
var ( // Label is the OEM ID of NTFS file system boot records. Label = [8]byte{'N', 'T', 'F', 'S', ' ', ' ', ' ', ' '} )
Functions ¶
This section is empty.
Types ¶
type Attribute ¶
type Attribute struct { Header AttributeRecordHeader Resident ResidentAttributeRecordHeader // When in resident form Nonresident NonresidentAttributeRecordHeader // When in non-resident form Name string ResidentValue []byte }
Attribute holds file attribute data.
func (*Attribute) ResidentValueString ¶
ResidentValueString returns the value of resident attributes as a string.
If the attribute is non-resident an empty string will be returned.
func (*Attribute) UnmarshalBinary ¶
UnmarshalBinary unmarshals the little-endian binary representation of an attribute record into attr.
type AttributeListEntry ¶
type AttributeListEntry struct { TypeCode attrtype.Code RecordLength uint16 AttributeNameLength uint16 AttributeNameOffset uint16 LowestVCN VCN SegmentReference SegmentReference AttributeName [1]uint16 // UTF-16 array of varying length // contains filtered or unexported fields }
AttributeListEntry stores an entry in an attribute list.
type AttributeRecordHeader ¶
type AttributeRecordHeader struct { TypeCode attrtype.Code RecordLength uint32 // The length of the attribute header, including its resident or nonresident header FormCode attrform.Code NameLength uint8 NameOffset uint16 Flags attrflag.Flag Instance uint16 }
AttributeRecordHeader holds information about an attribute record, which may be resident or non-resident.
https://msdn.microsoft.com/library/bb470039
func (*AttributeRecordHeader) Resident ¶
func (header *AttributeRecordHeader) Resident() bool
Resident returns true if the attribute record header precedes resident attribute data.
func (*AttributeRecordHeader) UnmarshalBinary ¶
func (header *AttributeRecordHeader) UnmarshalBinary(data []byte) error
UnmarshalBinary unmarshals the little-endian binary representation of an attribute record header into header.
The provided data must be at least 16 bytes long.
type Bitmap ¶
type Bitmap []byte
Bitmap stores a series of bits.
func (*Bitmap) UnmarshalBinary ¶
UnmarshalBinary unmarshals the little-endian binary representation of a bitmap attributre into bitmap.
type BootRecord ¶
type BootRecord struct { JumpInstruction [3]byte OEMID [8]byte ParameterBlock }
BootRecord is the NTFS volume boot record present in the first sector of a volume.
func (*BootRecord) ReadFrom ¶
func (boot *BootRecord) ReadFrom(r io.Reader) (n int64, err error)
ReadFrom reads 84 bytes of volume boot record data from r into boot.
func (*BootRecord) UnmarshalBinary ¶
func (boot *BootRecord) UnmarshalBinary(data []byte) error
UnmarshalBinary unmarshals the little-endian binary representation of volume boot record data into boot.
The provided data must be at least 84 bytes long.
type File ¶
type File struct { Header FileRecordSegmentHeader Attributes []Attribute }
File represents a file within an NTFS master file table.
type FileName ¶
type FileName struct { ParentDirectory FileReference FileNameLength uint8 Flags filenameflag.Flag Value string // contains filtered or unexported fields }
FileName stores file name attribute information.
https://msdn.microsoft.com/library/bb470123
func (*FileName) UnmarshalBinary ¶
UnmarshalBinary unmarshals the little-endian binary representation of a file name record into entry.
type FileRecordSegmentHeader ¶
type FileRecordSegmentHeader struct { MultiSectorHeader SequenceNumber uint16 FirstAttributeOffset uint16 // relative to the start of the header Flags uint16 BaseFileRecordSegment FileReference // contains filtered or unexported fields }
FileRecordSegmentHeader stores file record segment information. It is present at the start of each file record, and is immediately followed by the update sequence array.
https://msdn.microsoft.com/library/bb470124
func (*FileRecordSegmentHeader) ReadFrom ¶
func (header *FileRecordSegmentHeader) ReadFrom(r io.Reader) (n int64, err error)
ReadFrom reads 42 bytes of file record segment header data from r into header.
func (*FileRecordSegmentHeader) UnmarshalBinary ¶
func (header *FileRecordSegmentHeader) UnmarshalBinary(data []byte) error
UnmarshalBinary unmarshals the little-endian binary representation of a file record segment header into header.
The provided data must be at least 42 bytes long.
type FileReference ¶
type FileReference = SegmentReference
FileReference is a reference to a file in the master file table.
type IndexAllocation ¶
type IndexAllocation struct { ParentDirectory FileReference FileNameLength uint8 Value string // contains filtered or unexported fields }
IndexAllocation stores $INDEX_ALLOCATION attribute information.
https://msdn.microsoft.com/library/bb470123
func (*IndexAllocation) UnmarshalBinary ¶
func (index *IndexAllocation) UnmarshalBinary(data []byte) error
UnmarshalBinary unmarshals the little-endian binary representation of an $INDEX_ALLOCATION attribute into index.
type IndexRoot ¶
type IndexRoot struct { AttrType attrtype.Code // 0:4 The type of attributes being indexed CollationRule collation.Rule // 4:8 BytesPerIndexRecord uint32 // 8:12 BlocksPerIndexRecord uint8 // 12:13 In sectors if BPIR < ClusterSize, otherwise clusters // contains filtered or unexported fields }
IndexRoot stores $INDEX_ROOT attribute information.
func (*IndexRoot) UnmarshalBinary ¶
UnmarshalBinary unmarshals the little-endian binary representation of an $INDEX_ROOT attribute into index.
type MFT ¶
type MFT struct { SectorSize int64 // In bytes ClusterSize int64 // In bytes RecordSize int64 // In bytes BaseAddr int64 // In bytes }
MFT provides access to the master file table of an NTFS filesystem.
type MultiSectorHeader ¶
type MultiSectorHeader struct { Signature [4]byte // Identifies the type of data, i.e. "FILE" or "INDX" UpdateSequenceArrayOffset uint16 UpdateSequenceArraySize uint16 }
MultiSectorHeader specifies the location and size of an update sequence array.
https://msdn.microsoft.com/library/bb470212
func (*MultiSectorHeader) UnmarshalBinary ¶
func (header *MultiSectorHeader) UnmarshalBinary(data []byte) error
UnmarshalBinary unmarshals the little-endian binary representation of a mutli-sector header into hdr.
The provided data must be at least 73 bytes long.
type NonresidentAttributeRecordHeader ¶
type NonresidentAttributeRecordHeader struct { LowestVCN VCN HighestVCN VCN MappingPairsOffset uint16 CompressionUnit uint16 AllocatedLength int64 // Total bytes allocated DataLength int64 // Total bytes of actual data (the "file size") InitializedLength int64 // Total bytes initialized CompressedLength int64 // Total bytes compressed // contains filtered or unexported fields }
NonresidentAttributeRecordHeader holds information about the non-resident
form of an attribute record.
func (*NonresidentAttributeRecordHeader) UnmarshalBinary ¶
func (header *NonresidentAttributeRecordHeader) UnmarshalBinary(data []byte) error
UnmarshalBinary unmarshals the little-endian binary representation of the non-resident portion of an attribute record header into header.
The provided data must be at least 8 bytes long.
type ObjectID ¶
ObjectID holds object ID attribute data.
func (*ObjectID) UnmarshalBinary ¶
UnmarshalBinary unmarshals the little-endian binary representation of an object ID attribute into id.
The provided data must be at least 16 bytes long.
type ParameterBlock ¶
type ParameterBlock struct { // DOS 2.0 parameter block BytesPerSector uint16 // 0:2 The logical block size SectorsPerCluster uint8 // 2:3 The cluster size (must be power of 2 greater than 0) MediaDescriptor media.Descriptor // 10:11 TotalSectors uint64 // 29:37 Number of sectors in the volume (one less than partition table entry) MFT uint64 // 37:45 Logical cluster number of $MFT MFTMirror uint64 // 45:53 Logical cluster number of $MFT mirror ClustersPerFileRecordSegment int8 // 53:54 if < 0, MFT record size = 2^n ClustersPerIndexBlock int8 // 57:58 VolumeSerialNumber uint64 // 61:69 Checksum uint32 // 69:73 // contains filtered or unexported fields }
ParameterBlock is the 73-byte BIOS parameter block that forms part of an NFTS boot record.
func (*ParameterBlock) ClusterSize ¶
func (block *ParameterBlock) ClusterSize() int
ClusterSize returns the size of an NTFS cluster in bytes.
func (*ParameterBlock) FileRecordSize ¶
func (block *ParameterBlock) FileRecordSize() int
FileRecordSize returns the size of a file record segment in bytes.
func (*ParameterBlock) IndexBlockSize ¶
func (block *ParameterBlock) IndexBlockSize() int
IndexBlockSize returns the size of an index block in bytes.
func (*ParameterBlock) ReadFrom ¶
func (block *ParameterBlock) ReadFrom(r io.Reader) (n int64, err error)
ReadFrom reads 73 bytes of BIOS parameter block data from r into block.
func (*ParameterBlock) UnmarshalBinary ¶
func (block *ParameterBlock) UnmarshalBinary(data []byte) error
UnmarshalBinary unmarshals the little-endian binary representation of BIOS parameter block data into block.
The provided data must be at least 73 bytes long.
type Reader ¶
type Reader struct {
// contains filtered or unexported fields
}
Reader is an NTFS file system reader that supports NTFS file system versions 3.0 and 3.1. It reads data from an underlying io.ReadSeeker that must not include partition table data.
func NewReader ¶
func NewReader(rs io.ReadSeeker) (*Reader, error)
NewReader returns a new NTFS filesystem reader that reads from rs. It will read the volume boot record before returning. If it cannot read the volume boot record from rs, an error will be returned.
func (*Reader) BootRecord ¶
func (r *Reader) BootRecord() BootRecord
BootRecord returns a copy of the volume boot record.
type ResidentAttributeRecordHeader ¶
type ResidentAttributeRecordHeader struct { ValueLength uint32 ValueOffset uint16 // contains filtered or unexported fields }
ResidentAttributeRecordHeader holds information about the resident form of an attribute record.
func (*ResidentAttributeRecordHeader) UnmarshalBinary ¶
func (header *ResidentAttributeRecordHeader) UnmarshalBinary(data []byte) error
UnmarshalBinary unmarshals the little-endian binary representation of an attribute record header into header.
The provided data must be at least 8 bytes long.
type SegmentReference ¶
type SegmentReference struct { SegmentNumberLowPart uint32 SegmentNumberHighPart uint16 SequenceNumber uint16 }
SegmentReference stores an address in the master file table.
https://msdn.microsoft.com/library/bb470211
func (*SegmentReference) IsZero ¶
func (ref *SegmentReference) IsZero() bool
IsZero returns true if the segment reference is zero.
func (*SegmentReference) UnmarshalBinary ¶
func (ref *SegmentReference) UnmarshalBinary(data []byte) error
UnmarshalBinary unmarshals the little-endian binary representation of a segment reference into ref.
The provided data must be at least 8 bytes long.
type StandardInformation ¶
type StandardInformation struct { FileCreation time.Time FileModification time.Time MFTModification time.Time FileRead time.Time DOSFilePermissions uint32 MaxVersions uint32 VersionNumber uint32 ClassID uint32 OwnerID uint32 SecurityID uint32 QuotaCharged uint64 USN uint64 }
StandardInformation holds standard attribute data.
https://msdn.microsoft.com/library/bb545266
func (*StandardInformation) String ¶
func (info *StandardInformation) String() string
String returns a description of the standard information.
func (*StandardInformation) UnmarshalBinary ¶
func (info *StandardInformation) UnmarshalBinary(data []byte) error
UnmarshalBinary unmarshals the little-endian binary representation of a standard information attribute into info.
The provided data must be at least 48 bytes long.
type VolumeInformation ¶
type VolumeInformation struct { VersionMajor uint8 VersionMinor uint8 Flags volumeflag.Flag // contains filtered or unexported fields }
VolumeInformation holds volume information about an NTFS volume.
func (*VolumeInformation) String ¶
func (info *VolumeInformation) String() string
String returns a description of the volume information.
func (*VolumeInformation) UnmarshalBinary ¶
func (info *VolumeInformation) UnmarshalBinary(data []byte) error
UnmarshalBinary unmarshals the little-endian binary representation of a volume information record into info.
The provided data must be at least 16 bytes long.
Source Files ¶
- attribute.go
- attributelistentry.go
- attributerecord.go
- bitmap.go
- bootrecord.go
- constants.go
- doc.go
- file.go
- filename.go
- filerecord.go
- filereference.go
- filetime.go
- guid.go
- indexallocation.go
- indexroot.go
- mft.go
- multisectorheader.go
- ntfs.go
- objectid.go
- parameterblock.go
- standardinformation.go
- unicode.go
- vcn.go
- volumeinformation.go