:py:mod:`dissect.target.plugins.filesystem.ntfs.utils`
======================================================

.. py:module:: dissect.target.plugins.filesystem.ntfs.utils




Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.target.plugins.filesystem.ntfs.utils.InformationType



Functions
~~~~~~~~~

.. autoapisummary::
   :nosignatures:

   dissect.target.plugins.filesystem.ntfs.utils.get_drive_letter
   dissect.target.plugins.filesystem.ntfs.utils.get_volume_identifier
   dissect.target.plugins.filesystem.ntfs.utils.get_owner_and_group
   dissect.target.plugins.filesystem.ntfs.utils.get_record_size



Attributes
~~~~~~~~~~

.. autoapisummary::

   dissect.target.plugins.filesystem.ntfs.utils.DRIVE_LETTER_RE


.. py:data:: DRIVE_LETTER_RE

.. py:class:: InformationType

   Bases: :py:obj:`enum.Enum`


   Valid information types.


   .. py:attribute:: STANDARD_INFORMATION


   .. py:attribute:: FILE_INFORMATION


   .. py:attribute:: ALTERNATE_DATA_STREAM


.. py:function:: get_drive_letter(target: dissect.target.target.Target, filesystem: dissect.target.filesystems.ntfs.NtfsFilesystem) -> str

   Retrieve the drive letter from the loaded mounts

   When the drive letter is not available for that filesystem it returns empty.


.. py:function:: get_volume_identifier(fs: dissect.target.filesystems.ntfs.NtfsFilesystem) -> str | None

   Return the filesystem GUID or serial, if available.


.. py:function:: get_owner_and_group(entry: dissect.ntfs.mft.MftRecord, fs: dissect.target.filesystems.ntfs.NtfsFilesystem) -> tuple[str | None, str | None]

.. py:function:: get_record_size(record: dissect.ntfs.mft.MftRecord, name: str = '') -> int | None

   Gets the size for a specific record.