Module volume_io 

Raw volume access: \\.\C:-style handles, the NTFS update-sequence fixup, and the logical→physical run map of the $MFT data stream.

Structs

RunMap 🔒

Logical-byte → physical-byte mapping of the $MFT data stream.

Constants

SECTOR 🔒

Functions

apply_fixup 🔒

Apply the NTFS update sequence array in place. Returns false when the sector check bytes don’t match (torn/corrupt record).

mft_layout 🔒

Volume geometry + the $MFT data-run map — the bootstrap shared by the full scan and the I/O probe (record 0 → the $MFT’s own data runs).

open_raw_volume 🔒