:py:mod:`dissect.target.plugins.filesystem.ntfs.utils`
======================================================

.. py:module:: dissect.target.plugins.filesystem.ntfs.utils


Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.target.plugins.filesystem.ntfs.utils.InformationType



Functions
~~~~~~~~~

.. autoapisummary::
   :nosignatures:

   dissect.target.plugins.filesystem.ntfs.utils.get_drive_letter
   dissect.target.plugins.filesystem.ntfs.utils.get_volume_identifier
   dissect.target.plugins.filesystem.ntfs.utils.get_owner_and_group
   dissect.target.plugins.filesystem.ntfs.utils.get_record_size



Attributes
~~~~~~~~~~

.. autoapisummary::

   dissect.target.plugins.filesystem.ntfs.utils.DRIVE_LETTER_RE


.. py:data:: DRIVE_LETTER_RE

   

.. py:class:: InformationType


   Bases: :py:obj:`enum.Enum`

   Generic enumeration.

   Derive from this class to define new enumerations.

   .. py:attribute:: STANDARD_INFORMATION

      

   .. py:attribute:: FILE_INFORMATION

      

   .. py:attribute:: ALTERNATE_DATA_STREAM

      


.. py:function:: get_drive_letter(target: dissect.target.Target, filesystem: dissect.target.filesystems.ntfs.NtfsFilesystem)

   Retrieve the drive letter from the loaded mounts

   When the drive letter is not available for that filesystem it returns empty.


.. py:function:: get_volume_identifier(fs: dissect.target.filesystems.ntfs.NtfsFilesystem) -> str

   Return the filesystem guid if available


.. py:function:: get_owner_and_group(entry: dissect.ntfs.mft.MftRecord, fs: dissect.target.filesystems.ntfs.NtfsFilesystem) -> Tuple[Optional[str], Optional[str]]


.. py:function:: get_record_size(record: dissect.ntfs.mft.MftRecord, name: str = '') -> Optional[int]

   Gets the size for a specific record