GoFor_MFT_Parser

type AttributeInfo struct {
	AttributeType  byte
	AttributeBytes []byte
}

type DataAttributes struct {
	TotalSize                 uint8
	FlagResident              bool
	ResidentDataAttributes    ResidentDataAttributes
	NonResidentDataAttributes NonResidentDataAttributes
}

type DataRun struct {
	AbsoluteOffset int64
	Length         int64
}

type Directory struct {
	DirectoryName      string
	ParentRecordNumber uint64
}

type DirectoryList map[uint64]Directory

type FileNameAttributes struct {
	FnCreated               string
	FnModified              string
	FnAccessed              string
	FnChanged               string
	FlagResident            bool
	FlagNamed               bool
	NamedSize               byte
	AttributeSize           uint32
	ParentDirRecordNumber   uint64
	ParentDirSequenceNumber uint16
	LogicalFileSize         uint64
	PhysicalFileSize        uint64
	FileNameFlags           FileNameFlags
	FileNameLength          byte
	FileNamespace           string
	FileName                string
}

type FileNameFlags struct {
	ReadOnly          bool
	Hidden            bool
	System            bool
	Archive           bool
	Device            bool
	Normal            bool
	Temporary         bool
	Sparse            bool
	Reparse           bool
	Compressed        bool
	Offline           bool
	NotContentIndexed bool
	Encrypted         bool
	Directory         bool
	IndexView         bool
}

type MappedDirectories map[uint64]string

type MasterFileTableRecord struct {
	BytesPerCluster               int64
	RecordHeader                  RecordHeader
	StandardInformationAttributes StandardInformationAttributes
	FileNameAttributes            []FileNameAttributes
	DataAttributes                DataAttributes
	MftRecordBytes                []byte
	AttributeInfo                 []AttributeInfo
}

type MftFile struct {
	FileHandle        *os.File
	MappedDirectories map[uint64]string
	OutputChannel     chan MasterFileTableRecord
}

type NonResidentDataAttributes struct {
	StartingVCN   int
	EndingVCN     int
	OffsetDataRun int8
	AllocatedSize uint64
	RealSize      uint64
	DataRuns      map[int]DataRun
}

type RawDataRun struct {
	NumberOrder      int
	ClusterOffset    int64
	NumberOfClusters int64
}

type RawDataRunList map[int]RawDataRun

type RecordHeader struct {
	AttributesOffset uint16
	RecordNumber     uint32
	FlagDeleted      bool
	FlagDirectory    bool
}

type ResidentDataAttributes struct {
	ResidentData []byte
}

type StandardInformationAttributes struct {
	SiCreated    string
	SiModified   string
	SiAccessed   string
	SiChanged    string
	FlagResident bool
}