dissect.target.plugins.filesystem.ntfs.utils

Module Contents

Classes

InformationType

Generic enumeration.

Functions

get_drive_letter	Retrieve the drive letter from the loaded mounts
get_volume_identifier	Return the filesystem guid if available
get_owner_and_group
get_record_size	Gets the size for a specific record

Attributes

DRIVE_LETTER_RE

dissect.target.plugins.filesystem.ntfs.utils.DRIVE_LETTER_RE

class dissect.target.plugins.filesystem.ntfs.utils.InformationType

Bases: enum.Enum

Generic enumeration.

Derive from this class to define new enumerations.

STANDARD_INFORMATION

FILE_INFORMATION

ALTERNATE_DATA_STREAM

dissect.target.plugins.filesystem.ntfs.utils.get_drive_letter(target: dissect.target.Target, filesystem: dissect.target.filesystems.ntfs.NtfsFilesystem)

Retrieve the drive letter from the loaded mounts

When the drive letter is not available for that filesystem it returns empty.

dissect.target.plugins.filesystem.ntfs.utils.get_volume_identifier(fs: dissect.target.filesystems.ntfs.NtfsFilesystem) → str

Return the filesystem guid if available

dissect.target.plugins.filesystem.ntfs.utils.get_owner_and_group(entry: dissect.ntfs.mft.MftRecord, fs: dissect.target.filesystems.ntfs.NtfsFilesystem) → Tuple[str | None, str | None]

dissect.target.plugins.filesystem.ntfs.utils.get_record_size(record: dissect.ntfs.mft.MftRecord, name: str = '') → int | None

Gets the size for a specific record