:py:mod:`dissect.target.filesystems.ntfs`
=========================================

.. py:module:: dissect.target.filesystems.ntfs


Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.target.filesystems.ntfs.NtfsFilesystem
   dissect.target.filesystems.ntfs.NtfsFilesystemEntry




.. py:class:: NtfsFilesystem(fh: Optional[BinaryIO] = None, boot: Optional[BinaryIO] = None, mft: Optional[BinaryIO] = None, usnjrnl: Optional[BinaryIO] = None, sds: Optional[BinaryIO] = None, *args, **kwargs)


   Bases: :py:obj:`dissect.target.filesystem.Filesystem`

   Base class for filesystems.

   .. py:attribute:: __type__
      :value: 'ntfs'

      

   .. py:method:: get(path: str) -> NtfsFilesystemEntry

      Retrieve a :class:`FilesystemEntry` from the filesystem.

      :param path: The path which we want to retrieve.

      :returns: A :class:`FilesystemEntry` for the path.



.. py:class:: NtfsFilesystemEntry(fs: NtfsFilesystem, path: str, entry: Optional[dissect.ntfs.MftRecord] = None, index_entry: Optional[dissect.ntfs.IndexEntry] = None)


   Bases: :py:obj:`dissect.target.filesystem.FilesystemEntry`

   Base class for filesystem entries.

   .. py:method:: dereference() -> dissect.ntfs.MftRecord


   .. py:method:: get(path: str) -> NtfsFilesystemEntry

      Retrieve a :class:`FilesystemEntry` relative to this entry.

      :param path: The path relative to this filesystem entry.

      :returns: A relative :class:`FilesystemEntry`.


   .. py:method:: open(name: str = '') -> BinaryIO

      Open this filesystem entry.

      :returns: A file-like object. Resolves symlinks when possible


   .. py:method:: iterdir() -> Iterator[str]

      Iterate over the contents of a directory, return them as strings.

      :returns: An iterator of directory entries as path strings.


   .. py:method:: scandir() -> Iterator[NtfsFilesystemEntry]

      Iterate over the contents of a directory, yields :class:`FilesystemEntry`.

      :returns: An iterator of :class:`FilesystemEntry`.


   .. py:method:: is_dir(follow_symlinks: bool = True) -> bool

      Determine if this entry is a directory.

      :param follow_symlinks: Whether to resolve the entry if it is a symbolic link.

      :returns: ``True`` if the entry is a directory or a symbolic link to a directory, return ``False``
                otherwise.
                If ``follow_symlinks`` is ``False``, return ``True`` only if the entry is a directory (without
                following symlinks).


   .. py:method:: is_file(follow_symlinks: bool = True) -> bool

      Determine if this entry is a file.

      :param follow_symlinks: Whether to resolve the entry if it is a symbolic link.

      :returns: ``True`` if the entry is a file or a symbolic link to a file, return ``False`` otherwise.
                If ``follow_symlinks`` is ``False``, return ``True`` only if the entry is a file (without
                following symlinks).


   .. py:method:: is_symlink() -> bool

      Determine whether this entry is a symlink.

      :returns: ``True`` if the entry is a symbolic link, ``False`` otherwise.


   .. py:method:: readlink() -> str

      Read the link where this entry points to, return the resulting path as string.

      If it is a symlink and returns the entry that corresponds to that path.
      This means it follows the path a link points to, it tries to do it recursively.

      :returns: The path the link points to.


   .. py:method:: stat(follow_symlinks: bool = True) -> dissect.target.helpers.fsutil.stat_result

      Determine the stat information of this entry.

      If the entry is a symlink and ``follow_symlinks`` is ``True``, it gets resolved, attempting to stat
      the path where it points to.

      :param follow_symlinks: Whether to resolve the symbolic link if this entry is a symbolic link.

      :returns: The stat information of this entry.


   .. py:method:: lstat() -> dissect.target.helpers.fsutil.stat_result

      Determine the stat information of this entry, **without** resolving the symlinks.

      When it detects a symlink, it will stat the information of the symlink, not the path it points to.

      :returns: The stat information of this entry.


   .. py:method:: attr() -> dissect.ntfs.util.AttributeMap

      The attributes related to this entry, resolving any symlinks.

      If the entry is a symbolic link, it will attempt to resolve it first.
      Resulting in the attr information of the entry it points to.

      :returns: The attributes of this entry.


   .. py:method:: lattr() -> dissect.ntfs.util.AttributeMap

      The attributes related to this current entry, **without** resolving links.

      :returns: The attributes of this entry.