Module mft 

Initial full-volume index source: raw $MFT scan via ntfs-reader. Holds the measurement spike (spike_scan) and the whole-$MFT reference scanner used as the streaming scanner’s equivalence gate.

Re-exports

pub use crate::scan::ScanStats;

pub use crate::scan::scan_volume;

Structs

SpikeStats

Measurements from a full $MFT scan of one volume.

Enums

MftError

Failure modes of a raw $MFT volume scan.

Functions

current_working_set

Current working set — the steady-state number the RAM gate cares about (the peak includes transient scan buffers).

memory_counters 🔒

peak_working_set

Peak working set of the current process, in bytes (0 if the query fails).

pick_name 🔒

Pick the display name: prefer Win32 / Win32+DOS namespaces, fall back to POSIX, ignore DOS-only short names. Unlike ntfs-reader’s get_best_file_name, reparse-point names are kept — junctions and symlinks are indexed as plain entries.

scan_volume_reference

Full initial scan: read the volume’s $MFT and build the in-memory index. drive is a drive letter spec like C:.

spike_scan

Scan one volume’s $MFT end to end and report measurements. drive is a drive letter spec like C:.