Functions — github.com/Kudaes/MFTool

hub / github.com/Kudaes/MFTool / functions

Functions82 in github.com/Kudaes/MFTool

⨍ Functions 82 ◇ Types & classes 28

↓ 24 callersFunctionget_mft_entry_copy

(index: usize)

data/src/lib.rs:503

↓ 15 callersFunctionget_ntfs_data

()

data/src/lib.rs:489

↓ 10 callersMethodfile_reference

(&self)

data/src/lib.rs:401

↓ 9 callersMethodparent_record_number

(&self)

data/src/lib.rs:259

↓ 7 callersFunctioncompare_ntfs_names

Compare two NTFS names in a case-insensitive manner using $UpCase. Returns: - `Ordering::Less` if `a` < `b` - `Ordering::Equal` if `a` == `b` - `Orde

utils/src/lib.rs:190

↓ 7 callersMethodnext_mft_entry_index

(&self)

data/src/lib.rs:198

↓ 6 callersFunctionget_file_full_path

Returns the absolute path of the directory containing the specified file, without including the file name. # Returns Absolute path of the directory a

parser/src/lib.rs:752

↓ 6 callersFunctionget_mft_len

()

data/src/lib.rs:514

↓ 6 callersFunctionset_file_pointer_ex_file_begin

(offset: i64, handle: HANDLE)

utils/src/lib.rs:150

↓ 5 callersFunctionget_data_run_list_from_entry

Extracts the data run list of the non-resident unnamed $DATA attribute from an MFT entry. The returned list is **not** sorted by first VCN. # Paramet

parser/src/lib.rs:238

↓ 5 callersFunctionget_data_run_list_from_non_resident_attribute

Parses the data run list from a non-resident attribute and appends the runs to `data_run_list`. # Parameters - `non_resident_attribute`: Pointer to t

parser/src/lib.rs:314

↓ 5 callersFunctioniter_mft_entries

()

data/src/lib.rs:519

↓ 5 callersFunctionsearch_file_name_in_index_i30

Traverses the `$I30` index B+ tree of an MFT entry to find a file name. # Parameters - `mft_entry`: Raw content of the MFT entry. - `name_to_search`:

parser/src/lib.rs:1621

↓ 5 callersFunctionsearch_filename_in_mft_entry_by_str

Searches for a file name in an MFT entry using case-insensitive comparison. If `get_all_names` is `true`, retrieves all names from the entry. If `file

parser/src/lib.rs:1525

↓ 5 callersFunctionshow_info_mft_entry_by_index

(index: usize)

parser/src/lib.rs:2611

↓ 4 callersFunctionentry_has_reparse_point

(mft_entry: &Vec<u8>)

parser/src/lib.rs:2896

↓ 4 callersFunctionget_base_record_index

(mft_entry: &Vec<u8>)

parser/src/lib.rs:3078

↓ 4 callersFunctionget_file_content

Retrieves the content of the unnamed `$DATA` attribute from an MFT entry, returning it decompressed if necessary. # Parameters - `mft_entry`: Raw con

parser/src/lib.rs:854

↓ 4 callersFunctionlist_files_from_mft_entry

Lists all files in a directory by reading the `$I30` index of its MFT entry. # Parameters - `mft_entry`: Raw content of the MFT entry representing th

parser/src/lib.rs:2106

↓ 4 callersFunctionuntangle_reparse_point

Retrieves the content of a file associated with an MFT entry containing a `reparse_point` attribute. If `retrieve_target` is `true`, returns the targe

parser/src/lib.rs:2955

↓ 3 callersFunctionassign_name

(fd: &mut FileData, namespace: u8, name: String)

utils/src/lib.rs:68

↓ 3 callersMethodfiletime_to_datetime

(&self, filetime: u64)

data/src/lib.rs:231

↓ 3 callersFunctionfix_sequence_number

We replace USN by the corresponding value in USA Works both for Index Allocation Block and File Record

parser/src/lib.rs:2873

↓ 3 callersFunctionhandle_strings

(strs: &Vec<String>)

utils/src/lib.rs:119

↓ 3 callersFunctionutf16_ptr_to_string

(ptr: &[u16], length: usize)

utils/src/lib.rs:85

↓ 2 callersMethodapply

(&self, data: &mut [u8])

data/src/lib.rs:551

↓ 2 callersFunctionget_data_run_list_from_resident_attribute_list_index_allocation_i30

Extracts data runs from `INDEX_ALLOCATION` attributes named `$I30` listed in a resident attribute list and appends them to `run_entries`. The runs are

parser/src/lib.rs:600

↓ 2 callersFunctionis_directory

(mft_entry: &Vec<u8>)

utils/src/lib.rs:208

↓ 2 callersFunctionis_hidden

(mft_entry: &Vec<u8>)

utils/src/lib.rs:197

↓ 2 callersFunctionlist_files_from_index_root

Retrieves all file names contained in an index root attribute and adds them to `listed_files`. # Parameters - `index_root`: Pointer to the index root

parser/src/lib.rs:2416

↓ 2 callersFunctionread_data_run_clusters

Reads the content of the clusters referenced by a single data run. # Parameters - `data_run`: Data run to read from. # Returns `Some(Vec<u8>)` with

parser/src/lib.rs:1120

↓ 2 callersFunctionread_file_from_mft

Reads and decompresses the content of a file located in the specified parent directory. # Parameters - `input_directory`: Path of the parent director

parser/src/lib.rs:1217

↓ 2 callersFunctionsearch_file_index_root_i30

Searches the `$I30` index root attribute entries for a matching file name or retrieves the VCN of the next index entry to analyze. # Parameters - `in

parser/src/lib.rs:1931

↓ 2 callersFunctionset_target

Opens a handle to the specified NTFS volume and rebuilds the in-memory MFT cache. Accepts any path format supported by `CreateFile`. If empty, refresh

parser/src/lib.rs:23

↓ 2 callersFunctionsort_and_print_all_directories

(listed_files: &mut HashMap<u64, DirectoryFilesList>)

parser/src/lib.rs:3053

↓ 2 callersFunctionto_upper

Converts a utf16 char using the UPCASE table. If no conversion is possible, it returns the same char

utils/src/lib.rs:175

↓ 1 callersMethodbase_record_index

(&self)

data/src/lib.rs:143

↓ 1 callersFunctionbuild_regex_matcher

(user_input: &str)

utils/src/lib.rs:57

↓ 1 callersFunctiondecompress_lznt1_unit

(unit_stored: &[u8], unit_size: usize)

parser/src/lib.rs:2732

↓ 1 callersMethodfrn128_be_bytes

Build the exact 16 bytes expected by fsutil (and NtCreateFile): - first 8 bytes to zero - then 8 bytes with FRN64 in big-endian

data/src/lib.rs:126

↓ 1 callersMethodfrn64

(&self)

data/src/lib.rs:118

↓ 1 callersMethodfsutil_id_hex

Print that buffer as a 32-digit hex string, Equal output to what fsutil shows you (without the "0x" at the start).

data/src/lib.rs:135

↓ 1 callersFunctionget_data_run_list_from_entry_index_allocation

Extracts the data run list from the `INDEX_ALLOCATION` attribute named `$I30` of an MFT entry. The returned list is **not** sorted by first VCN. # Pa

parser/src/lib.rs:663

↓ 1 callersFunctionget_data_run_list_from_non_resident_attribute_list

Extracts and combines the data run lists of all unnamed $DATA attributes from a non-resident attribute list. The resulting data run list is **not sort

parser/src/lib.rs:450

↓ 1 callersFunctionget_data_run_list_from_resident_attribute_list

Extracts and combines the data run lists of all unnamed $DATA attributes from a resident attribute list. The resulting list is **not sorted by first V

parser/src/lib.rs:532

↓ 1 callersFunctionget_file_content_resident_data

Retrieves the content of a file stored in a resident `$DATA` attribute within the MFT entry. # Parameters - `mft_entry`: Raw content of the MFT entry

parser/src/lib.rs:937

↓ 1 callersFunctionget_index_allocation_content

Retrieves the content of all index allocation blocks referenced by the data run list of an `INDEX_ALLOCATION` attribute. # Parameters - `data_run_lis

parser/src/lib.rs:979

↓ 1 callersFunctionget_index_allocation_content_single_vector

Retrieves the content of all index allocation blocks referenced by the data run list of an `INDEX_ALLOCATION` attribute, returning the data combined i

parser/src/lib.rs:1052

↓ 1 callersFunctionget_mft_entry_standard_attribute

Retrieves the `STANDARD_INFORMATION` attribute from an MFT entry. # Parameters - `mft_entry`: Raw content of the MFT entry. # Returns `Some(Standard

parser/src/lib.rs:720

↓ 1 callersFunctionget_parent_directory_recursive

Recursively retrieves the name of a parent directory by its MFT index, preferring the Win32 name over the DOS name, and appends it to `parts`. # Para

parser/src/lib.rs:768

↓ 1 callersFunctionlist_files_from_directory

Lists all files in a directory by traversing its `$I30` index. # Parameters - `full_path`: Absolute path of the target directory. # Returns `Some(Ha

parser/src/lib.rs:1988

↓ 1 callersFunctionlist_files_from_index_root_extended_mft_entry

Auxiliar function to list all files in a INDEX ROOT attribute from an extended file record. # Parameters - `mft_entry`: Raw content of the MFT entry

parser/src/lib.rs:2358

↓ 1 callersFunctionparse_args

(input: &str)

utils/src/lib.rs:10

↓ 1 callersFunctionparse_upcase

Parses the content of the $UpCase MFT entry and stores it in memory. # Parameters - `upcase_entry`: Raw content of the $UpCase MFT entry.

parser/src/lib.rs:209

↓ 1 callersFunctionprint_help

()

utils/src/lib.rs:37

↓ 1 callersFunctionprint_strings

(strs: &Vec<String>)

utils/src/lib.rs:144

↓ 1 callersFunctionprocess_units

For my future self: The file content is divided into compression units, which comprise as many clusters as indicated by clusters_per_unit. The id

parser/src/lib.rs:2776

↓ 1 callersFunctionpush_mft_entry

(entry: &mut ContentWrapper)

data/src/lib.rs:497

↓ 1 callersFunctionread_all_mft_entries

Builds the in-memory cache by reading the MFT using the data runs from MFT entry 0. # Parameters - `data_runs`: Data run list for MFT entry 0.

parser/src/lib.rs:168

↓ 1 callersFunctionread_mft_entry_by_index

Retrieves a copy of an MFT entry by its index. # Parameters - `index`: Index of the MFT entry. # Returns `Some(Vec<u8>)` with the entry content if f

parser/src/lib.rs:1185

↓ 1 callersFunctionrebuild_mft

()

parser/src/lib.rs:65

↓ 1 callersFunctionresolve_relative_path

(current_path: &str, relative_target: &str)

utils/src/lib.rs:96

↓ 1 callersFunctionsearch_file_name_index_root_extended_mft_entry

Auxiliar function that searches a file name in the `$I30` index root attribute of an extended file record or retrieves the VCN of the next index entry

parser/src/lib.rs:1871

↓ 1 callersFunctionsearch_filename_in_attribute_list_by_str

(attribute_list: *mut ResidentAttributeHeader, file_to_search: &str, parent_record: u64, get_all_names: bool,

parser/src/lib.rs:1416

↓ 1 callersFunctionsearch_filename_in_mft_entry_by_regex

Retrieves all file names from an MFT entry that match the given regular expression. # Parameters - `mft_entry`: Raw content of the MFT entry. - `rege

parser/src/lib.rs:1338

↓ 1 callersFunctionsearch_filename_in_mft_entry_by_str_aux

(mft_entry: &Vec<u8>, file_to_search: &str, parent_record: u64, get_all_names: bool, file_names: &mut HashMap<

parser/src/lib.rs:1453

↓ 1 callersFunctionset_ntfs_data

(data: NTFSVolumeDataBuffer)

data/src/lib.rs:483

↓ 1 callersFunctionshow_hidden_entries

Displays information about unused MFT entries.

parser/src/lib.rs:2723

↓ 1 callersFunctionshow_info_mft_entry

(input_directory: &str, name_to_search: &str)

parser/src/lib.rs:2467

↓ 1 callersFunctionshow_info_mft_entry_by_index_minimal

(index: usize)

parser/src/lib.rs:2686

↓ 1 callersFunctionshow_info_mft_entry_by_regex

(input_file_name: Regex, only_hidden: bool, verbose: bool)

parser/src/lib.rs:2554

Method_sequence_number

Methodlength_field_bytes

Methodmodification_time

Methodoffset_field_bytes

(&self)

data/src/lib.rs:434

Methodsequence_number

(&self)

data/src/lib.rs:202