|
|
|
@ -20,6 +20,7 @@ type MFTFile struct {
|
|
|
|
|
Path string
|
|
|
|
|
ModTime time.Time
|
|
|
|
|
Size uint64
|
|
|
|
|
Aszie uint64
|
|
|
|
|
IsDir bool
|
|
|
|
|
Node uint64
|
|
|
|
|
}
|
|
|
|
@ -69,16 +70,20 @@ func GetFileListsByMftFn(driver string, fn func(string, bool) bool) ([]MFTFile,
|
|
|
|
|
parent := uint64(0)
|
|
|
|
|
for _, v := range record.Attributes {
|
|
|
|
|
if v.Type == mft.AttributeTypeFileName {
|
|
|
|
|
if file.Name != "" {
|
|
|
|
|
continue
|
|
|
|
|
name := utf16.DecodeString(v.Data[66:], binary.LittleEndian)
|
|
|
|
|
if len(file.Name) < len(name) && len(name) > 0 {
|
|
|
|
|
if len(name) > 2 && name[len(name)-2] == '~' {
|
|
|
|
|
continue
|
|
|
|
|
}
|
|
|
|
|
file.Name = name
|
|
|
|
|
}
|
|
|
|
|
file.Name = utf16.DecodeString(v.Data[66:], binary.LittleEndian)
|
|
|
|
|
if file.Name != "" {
|
|
|
|
|
parent = binutil.NewLittleEndianReader(v.Data[:8]).Uint64(0)
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
if v.Type == mft.AttributeTypeData {
|
|
|
|
|
file.Size = v.ActualSize
|
|
|
|
|
file.Aszie = v.AllocatedSize
|
|
|
|
|
}
|
|
|
|
|
if v.Type == mft.AttributeTypeStandardInformation {
|
|
|
|
|
if len(v.Data) < 48 {
|
|
|
|
@ -168,16 +173,20 @@ func GetFileListsFromMftFileFn(filepath string, fn func(string, bool) bool) ([]M
|
|
|
|
|
parent := uint64(0)
|
|
|
|
|
for _, v := range record.Attributes {
|
|
|
|
|
if v.Type == mft.AttributeTypeFileName {
|
|
|
|
|
if file.Name != "" {
|
|
|
|
|
continue
|
|
|
|
|
name := utf16.DecodeString(v.Data[66:], binary.LittleEndian)
|
|
|
|
|
if len(file.Name) < len(name) && len(name) > 0 {
|
|
|
|
|
if len(name) > 2 && name[len(name)-2] == '~' {
|
|
|
|
|
continue
|
|
|
|
|
}
|
|
|
|
|
file.Name = name
|
|
|
|
|
}
|
|
|
|
|
file.Name = utf16.DecodeString(v.Data[66:], binary.LittleEndian)
|
|
|
|
|
if file.Name != "" {
|
|
|
|
|
parent = binutil.NewLittleEndianReader(v.Data[:8]).Uint64(0)
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
if v.Type == mft.AttributeTypeData {
|
|
|
|
|
file.Size = v.ActualSize
|
|
|
|
|
file.Aszie = v.AllocatedSize
|
|
|
|
|
}
|
|
|
|
|
if v.Type == mft.AttributeTypeStandardInformation {
|
|
|
|
|
if len(v.Data) < 48 {
|
|
|
|
|