:py:mod:`dissect.ntfs.ntfs`
===========================

.. py:module:: dissect.ntfs.ntfs


Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.ntfs.ntfs.NTFS




.. py:class:: NTFS(fh: Optional[BinaryIO] = None, boot: Optional[BinaryIO] = None, mft: Optional[BinaryIO] = None, usnjrnl: Optional[BinaryIO] = None, sds: Optional[BinaryIO] = None)


   Implementation for Microsoft NTFS.

   This implementation supports parsing NTFS from either a full NTFS volume or from separate files.
   If you have a file-like object of an NTFS volume, simply pass it as the fh argument. If you have separate
   file-like objects for things like ``$BOOT`` or ``$MFT``, pass those as the boot and mft arguments.
   The separate arguments take precedence over parsing from the volume file-like object.

   :param fh: A file-like object for the volume to use for parsing NTFS. This is where "data on disk" is read from.
   :param boot: A file-like object for the ``$BOOT`` file.
   :param mft: A file-like object for the ``$MFT`` file.
   :param usnjrnl: A file-like object for the ``$Extend/$Usnjrnl:$J`` file.
   :param sds: A file-like object for the ``$Secure:$SDS`` file.

   .. py:method:: serial() -> Optional[int]


   .. py:method:: volume_name() -> Optional[str]