:py:mod:`dissect.ntfs.attr` =========================== .. py:module:: dissect.ntfs.attr Module Contents --------------- Classes ~~~~~~~ .. autoapisummary:: dissect.ntfs.attr.Attribute dissect.ntfs.attr.AttributeHeader dissect.ntfs.attr.AttributeRecord dissect.ntfs.attr.AttributeList dissect.ntfs.attr.StandardInformation dissect.ntfs.attr.FileName dissect.ntfs.attr.ReparsePoint Attributes ~~~~~~~~~~ .. autoapisummary:: dissect.ntfs.attr.ATTRIBUTE_CLASS_MAP .. py:class:: Attribute(header: AttributeHeader, record: Optional[dissect.ntfs.mft.MftRecord] = None) Parse and interact with MFT attributes. Wrapper for an :class:`AttributeHeader` and :class:`AttributeRecord` combination. :param record: The MFT record this attribute belongs to. :param header: The AttributeHeader for this Attribute. .. py:property:: type :type: dissect.ntfs.c_ntfs.ATTRIBUTE_TYPE_CODE Return the attribute type. .. py:property:: resident :type: bool Return whether this attribute is resident or not. .. py:property:: name :type: str Return the name of this attribute. .. py:attribute:: __slots__ :value: ('record', 'header', 'attribute') .. py:method:: __getattr__(attr: str) -> Any .. py:method:: __repr__() -> str Return repr(self). .. py:method:: from_fh(fh: BinaryIO, record: Optional[dissect.ntfs.mft.MftRecord] = None) -> Attribute :classmethod: Parse an attribute from a file-like object. :param fh: The file-like object to parse an attribute from. :param record: The MFT record this attribute belongs to. .. py:method:: from_bytes(data: bytes, record: Optional[dissect.ntfs.mft.MftRecord] = None) -> Attribute :classmethod: Parse an attribute from bytes. :param data: The bytes to parse. :param record: The MFT record this attribute belongs to. .. py:method:: dataruns() -> list[tuple[int, int]] Return the dataruns of this attribute, if non-resident. :raises TypeError: If attribute is resident. .. py:method:: open() -> BinaryIO Open a file-like object for this attribute's data. :raises VolumeNotAvailableError: If no volume is available. .. py:method:: data() -> bytes Read and return all the data of this attribute. :raises VolumeNotAvailableError: If no volume is available. .. py:class:: AttributeHeader(fh: BinaryIO, offset: int, record: Optional[dissect.ntfs.mft.MftRecord] = None) Parse attribute headers. :param record: The MFT record this attribute belongs to. :param fh: The file-like object to parse an attribute header from. :param offset: The offset in the file-like object to parse an attribute header from. .. py:property:: type :type: dissect.ntfs.c_ntfs.ATTRIBUTE_TYPE_CODE Return the attribute type. .. py:property:: resident :type: bool Return whether this attribute is resident or not. .. py:property:: record_length :type: int Return the record length of this attribute. .. py:property:: name :type: str Return the name of this attribute. .. py:property:: flags :type: int Return the attribute flags. .. py:property:: size :type: int Return the data size of this attribute. .. py:property:: allocated_size :type: Optional[int] Return the allocated size if non-resident, else None. .. py:property:: lowest_vcn :type: Optional[int] Return the lowest VCN if non-resident, else None. .. py:property:: highest_vcn :type: Optional[int] Return the highest VCN if non-resident, else None. .. py:property:: compression_unit :type: Optional[int] Return the compression unit if non-resident, else None. .. py:attribute:: __slots__ :value: ('record', 'fh', 'offset', 'header') .. py:method:: __repr__() -> str Return repr(self). .. py:method:: from_bytes(data: bytes, record: Optional[dissect.ntfs.mft.MftRecord] = None) -> AttributeHeader :classmethod: Parse an attribute header from bytes. :param data: The bytes to parse. :param record: The MFT record this attribute belongs to. .. py:method:: dataruns() -> list[tuple[int, int]] Return the dataruns of this attribute, if non-resident. :raises TypeError: If attribute is resident. .. py:method:: open() -> BinaryIO Open a file-like object for this attribute's data. :raises VolumeNotAvailableError: If no volume is available. .. py:method:: data() -> bytes Read and return all the data of this attribute. :raises VolumeNotAvailableError: If no volume is available. .. py:class:: AttributeRecord(fh: BinaryIO, record: Optional[dissect.ntfs.mft.MftRecord] = None) Parse attribute records. :param record: The MFT record this attribute belongs to. :param fh: The file-like object to parse an attribute record from. .. py:attribute:: __slots__ :value: ('record',) .. py:method:: from_fh(fh: BinaryIO, attr_type: dissect.ntfs.c_ntfs.ATTRIBUTE_TYPE_CODE, record: Optional[dissect.ntfs.mft.MftRecord] = None) -> AttributeRecord :classmethod: Parse an attribute from a file-like object. Selects a more specific :class:`AttributeRecord` class if one is available for the given attribute type. :param fh: The file-like object to parse an attribute from. :param attr_type: The attribute type to parse. :param record: The MFT record this attribute belongs to. .. py:class:: AttributeList(fh: BinaryIO, record: Optional[dissect.ntfs.mft.MftRecord] = None) Bases: :py:obj:`AttributeRecord` Specific :class:`AttributeRecord` parser for ``$ATTRIBUTE_LIST``. .. py:attribute:: __slots__ :value: ('entries',) .. py:method:: __repr__() -> str Return repr(self). .. py:method:: attributes() -> Iterator[Attribute] Iterate all entries within this ``$ATTRIBUTE_LIST`` and yield all embedded attributes. .. py:class:: StandardInformation(fh: BinaryIO, record: Optional[dissect.ntfs.mft.MftRecord] = None) Bases: :py:obj:`AttributeRecord` Specific :class:`AttributeRecord` parser for ``$STANDARD_INFORMATION``. .. py:property:: creation_time :type: datetime.datetime Return the ``$STANDARD_INFORMATION`` ``CreationTime``. .. py:property:: creation_time_ns :type: int Return the ``$STANDARD_INFORMATION`` ``CreationTime`` in nanoseconds. .. py:property:: last_modification_time :type: datetime.datetime Return the ``$STANDARD_INFORMATION`` ``LastModificationTime``. .. py:property:: last_modification_time_ns :type: int Return the ``$STANDARD_INFORMATION`` ``LastModificationTime`` in nanoseconds. .. py:property:: last_change_time :type: datetime.datetime Return the ``$STANDARD_INFORMATION`` ``LastChangeTime``. .. py:property:: last_change_time_ns :type: int Return the ``$STANDARD_INFORMATION`` ``LastChangeTime`` in nanoseconds. .. py:property:: last_access_time :type: datetime.datetime Return the ``$STANDARD_INFORMATION`` ``LastAccessTime``. .. py:property:: last_access_time_ns :type: int Return the ``$STANDARD_INFORMATION`` ``LastAccessTime`` in nanoseconds. .. py:property:: file_attributes :type: int Return the ``$STANDARD_INFORMATION`` ``FileAttributes``. .. py:property:: owner_id :type: int Return the ``$STANDARD_INFORMATION`` ``OwnerId``. .. py:property:: security_id :type: int Return the ``$STANDARD_INFORMATION`` ``SecurityId``. .. py:attribute:: __slots__ :value: ('attr',) .. py:method:: __repr__() -> str Return repr(self). .. py:class:: FileName(fh: BinaryIO, record: Optional[dissect.ntfs.mft.MftRecord] = None) Bases: :py:obj:`AttributeRecord` Specific :class:`AttributeRecord` parser for ``$FILE_NAME``. .. py:property:: creation_time :type: datetime.datetime Return the ``$FILE_NAME``file ``CreationTime``. .. py:property:: creation_time_ns :type: int Return the ``$FILE_NAME`` file ``CreationTime`` in nanoseconds. .. py:property:: last_modification_time :type: datetime.datetime Return the ``$FILE_NAME`` file ``LastModificationTime``. .. py:property:: last_modification_time_ns :type: int Return the ``$FILE_NAME`` file ``LastModificationTime`` in nanoseconds. .. py:property:: last_change_time :type: datetime.datetime Return the ``$FILE_NAME`` file ``LastChangeTime``. .. py:property:: last_change_time_ns :type: int Return the ``$FILE_NAME`` file ``LastChangeTime`` in nanoseconds. .. py:property:: last_access_time :type: datetime.datetime Return the ``$FILE_NAME`` file ``LastAccessTime``. .. py:property:: last_access_time_ns :type: int Return the ``$FILE_NAME`` file ``LastAccessTime`` in nanoseconds. .. py:property:: file_size :type: int Return the ``$FILE_NAME`` file ``FileSize``. .. py:property:: file_attributes :type: int Return the ``$FILE_NAME`` file ``FileAttributes``. .. py:property:: flags :type: int Return the ``$FILE_NAME`` flags, which can be either ``FILE_NAME_NTFS`` or ``FILE_NAME_DOS``. .. py:property:: file_name :type: str Return the file name string stored in this ``$FILE_NAME`` attribute. .. py:attribute:: __slots__ :value: ('attr',) .. py:method:: __repr__() -> str Return repr(self). .. py:method:: full_path() -> str Use the parent directory reference to try to generate a full path from this file name. .. py:class:: ReparsePoint(fh: BinaryIO, record: Optional[dissect.ntfs.mft.MftRecord] = None) Bases: :py:obj:`AttributeRecord` Specific :class:`AttributeRecord` parser for ``$REPARSE_POINT``. .. py:property:: tag :type: dissect.ntfs.c_ntfs.IO_REPARSE_TAG .. py:property:: substitute_name :type: Optional[str] .. py:property:: print_name :type: Optional[str] .. py:property:: absolute :type: bool .. py:property:: relative :type: bool .. py:attribute:: __slots__ :value: ('attr', 'tag_header', 'buffer') .. py:method:: __repr__() -> str Return repr(self). .. py:data:: ATTRIBUTE_CLASS_MAP