:py:mod:`dissect.target.plugins.filesystem.ntfs.mft_timeline`
=============================================================

.. py:module:: dissect.target.plugins.filesystem.ntfs.mft_timeline




Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.target.plugins.filesystem.ntfs.mft_timeline.MftTimelinePlugin




.. py:class:: MftTimelinePlugin(target: dissect.target.target.Target)

   Bases: :py:obj:`dissect.target.plugin.Plugin`


   NTFS MFT timeline plugin.


   .. py:method:: check_compatible() -> None

      Perform a compatibility check with the target.

      This function should return ``None`` if the plugin is compatible with the current target (``self.target``).
      For example, check if a certain file exists. Otherwise it should raise an
      :class:`UnsupportedPluginError`.

      :raises UnsupportedPluginError: If the plugin could not be loaded.



   .. py:method:: mft_timeline(ignore_dos: bool = False) -> collections.abc.Iterator[str]

      Return the MFT records of all NTFS filesystems in a human readable format (unsorted) (deprecated, use mft.timeline).

      The Master File Table (MFT) contains metadata about every file and folder on a NFTS filesystem.

      If the filesystem is part of a virtual NTFS filesystem (a ``VirtualFilesystem`` with the MFT properties
      added to it through a "fake" ``NtfsFilesystem``), the paths returned in the MFT records are based on the
      mount point of the ``VirtualFilesystem``. This ensures that the proper original drive letter is used when
      available.
      When no drive letter can be determined, the path will show as e.g. ``\$fs$\fs0``.

      .. rubric:: References

      - https://docs.microsoft.com/en-us/windows/win32/fileio/master-file-table