I have been trying to make sense of a code snippet for past some days. You can find the gist here
Overview
The code reads MFT of a Windows drive, creates a struct of maps of files in the MFT. Then it goes on reading the USN Journal to detect what has changed of those files.
Problem
There are some logical operations happening in the script. I can understand what the code part is doing but why is it doing so is what has been haunting me for past couple of days. I stumbled upon various Windows docs like this but even then, it did not make much sense to me.
For example -
switch mode & (O_RDONLY | O_WRONLY | O_RDWR) {
case O_RDONLY:
access = GENERIC_READ
case O_WRONLY:
access = GENERIC_WRITE
case O_RDWR:
access = GENERIC_READ | GENERIC_WRITE
}
if mode&O_CREAT != 0 {
access |= GENERIC_WRITE
}
if mode&O_APPEND != 0 {
access &^= GENERIC_WRITE
access |= FILE_APPEND_DATA
}
Why are we doing these logical operations? There are other instances of such parts in the code also. If anyone can point me to the direction or help me why these operations are done, it'd be really helpful. Thanks