README
¶
bodyfile
bodyfile is a Golang library used to parse and process bodyfile that can be generated by various tools like list_mft.py, regrippy and so on (mostly Forensics tools).
This library was built to support timeliner, an enhanced mactime-like.
Documentation
¶
Index ¶
Constants ¶
View Source
const ( AccessTime = 1 << iota ModificationTime ChangeTime CreationTime )
These constants are used as a bitmap in Entry.MatchingTimestamps, it is useful to know which timestamp matched the filter.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Entry ¶
type Entry struct {
// MD5|name|inode|mode_as_string|UID|GID|size|atime|mtime|ctime|crtime
MD5 string
Name string
Inode string
Mode string
UID int
GID int
Size int64
AccessTime time.Time
ModificationTime time.Time
ChangeTime time.Time
CreationTime time.Time
MatchingTimestamp int
}
Entry represents one line of the bodyfile
type Reader ¶
type Reader struct {
Strict bool
// contains filtered or unexported fields
}
Reader is the reading object
func NewStrictReader ¶
NewStrictReader instantiates a new Reader object with the Strict mode enabled
func (*Reader) Next ¶
func (r *Reader) Next() (*TimeStampedEntry, error)
Next returns the next sorted elements
type TimeStampedEntry ¶
TimeStampedEntry is a wrapper around Entry to add an outer timestamp used for the sorted array
Source Files
Click to show internal directories.
Click to hide internal directories.