dissect.ntfs.usnjrnl

Module Contents

Classes

UsnJrnl	Parse the USN journal from a file-like object of the $UsnJrnl:$J stream.
UsnRecord	Parse a USN record from a file-like object and offset.

class dissect.ntfs.usnjrnl.UsnJrnl(fh: BinaryIO, ntfs: dissect.ntfs.ntfs.NTFS | None = None)

Parse the USN journal from a file-like object of the $UsnJrnl:$J stream.

Parameters:

• fh – A file-like object of the $UsnJrnl:$J stream.

• ntfs – An optional NTFS class instance, used for resolving file paths.

records() → Iterator[UsnRecord]

Yield all parsed USN records.

Only yields version 2 USN records, other record versions are ignored.

class dissect.ntfs.usnjrnl.UsnRecord(usnjrnl: UsnJrnl, fh: BinaryIO, offset: int)

Parse a USN record from a file-like object and offset.

Parameters:

• usnjrnl – The UsnJrnl class this record is parsed from.

• fh – The file-like object to parse a USN record from.

• offset – The offset to parse a USN record at.

property timestamp: datetime.datetime

property timestamp_ns: int

__repr__() → str

Return repr(self).

__getattr__(attr: str) → Any

file() → dissect.ntfs.mft.MftRecord | None

parent() → dissect.ntfs.mft.MftRecord | None

full_path() → str