Skip to content

Commit

Permalink
Allow full path reassembly in USN parser to be disabled
Browse files Browse the repository at this point in the history
  • Loading branch information
scudette committed Aug 15, 2024
1 parent 6720a66 commit fe12be3
Show file tree
Hide file tree
Showing 3 changed files with 15 additions and 0 deletions.
7 changes: 7 additions & 0 deletions parser/context.go
Original file line number Diff line number Diff line change
Expand Up @@ -83,6 +83,13 @@ func (self *NTFSContext) SetOptions(options Options) {
self.options = options
}

func (self *NTFSContext) GetOptions() *Options {
self.mu.Lock()
defer self.mu.Unlock()

return &self.options
}

func (self *NTFSContext) Close() {
if debug {
fmt.Printf(STATS.DebugString())
Expand Down
4 changes: 4 additions & 0 deletions parser/options.go
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,10 @@ type Options struct {
// These path components will be added in front of each link
// generated.
PrefixComponents []string

// Disable resolution of USN paths through the MFT. This is useful
// when there is no MFT to look at.
DisableFullPathResolution bool
}

func GetDefaultOptions() Options {
Expand Down
4 changes: 4 additions & 0 deletions parser/usn.go
Original file line number Diff line number Diff line change
Expand Up @@ -87,6 +87,10 @@ func (self *USN_RECORD) Links() []string {
}

func (self *USN_RECORD) _Links(depth int) []string {
if self.context.GetOptions().DisableFullPathResolution {
return []string{self.Filename()}
}

// Since this record could have meant a file deletion event
// then resolving the actual MFT entry to a full path is less
// reliable. It is more reliable to resolve the parent path,
Expand Down

0 comments on commit fe12be3

Please sign in to comment.