dissect.ntfs.index#

Module Contents#

Classes#

Match

Generic enumeration.

Index

Open an index with he given name on the given MFT record.

IndexRoot

Represents the $INDEX_ROOT.

IndexBuffer

Represent an index buffer in $INDEX_ALLOCATION.

IndexEntry

Parse and interact with index entries.
class dissect.ntfs.index.Match#

Bases: enum.Enum

Generic enumeration.

Derive from this class to define new enumerations.

Less#
Equal#
Greater#
class dissect.ntfs.index.Index(record: dissect.ntfs.mft.MftRecord, name: str)#

Open an index with he given name on the given MFT record.

Parameters:

name – The index to open.

Raises:

FileNotFoundError – If no index with that name can be found.

__iter__() → Iterator[IndexEntry]#
index_buffer(vcn: int) → IndexBuffer#

Return the IndexBuffer at the specified cluster number.

Parameters:

vcn – The virtual cluster number within the index allocation to read.

Raises:

FileNotFoundError – If this index has no index allocation.

search(value: Any, exact: bool = True, cmp: Callable[[IndexEntry, Any], Match] | None = None) → IndexEntry#

Perform a binary search on this index.

Returns the matching node if performing an exact search. Otherwise return the first match that is greater than the search value.

Parameters:

  • value – The key to search.

  • exact – Result must be an exact match.

  • cmp – Optional custom comparator function.

Raises:

  • NotImplementedError – If there is no collation (comparator) function for the collation rule of this index.

  • KeyError – If an exact match was requested but not found.

entries() → Iterator[IndexEntry]#

Yield all IndexEntry’s in this Index.

class dissect.ntfs.index.IndexRoot(index: Index, fh: BinaryIO)#

Represents the $INDEX_ROOT.

Parameters:

  • index – The Index` class instance this IndexRoot belongs to.

  • fh – The file-like object to parse an index root on.

property attribute_type: dissect.ntfs.c_ntfs.ATTRIBUTE_TYPE_CODE#

Return the indexed attribute type.

property collation_rule: dissect.ntfs.c_ntfs.COLLATION#

Return the collation rule.

property bytes_per_index_buffer: int#

Return the size of an index buffer in the index allocation in bytes.

property clusters_per_index_buffer: int#

Return the size of an index buffer in the index allocation in clusters.

entries() → Iterator[IndexEntry]#

Yield all IndexEntry’s in this IndexRoot.

class dissect.ntfs.index.IndexBuffer(index: Index, fh: BinaryIO, offset: int, size: int)#

Represent an index buffer in $INDEX_ALLOCATION.

Parameters:

  • index – The Index class instance this IndexRoot belongs to.

  • fh – The file-like object of $INDEX_ALLOCATION.

  • offset – The offset in bytes to the index buffer on the file-like object we want to read.

  • size – The size of the index buffer in bytes.

Raises:

  • EOFError – If there’s not enough data available to read an index buffer.

  • BrokenIndexError – If the index buffer doesn’t start with the expected magic value.

entries() → Iterator[IndexEntry]#

Yield all IndexEntry’s in this IndexBuffer.

class dissect.ntfs.index.IndexEntry(index: Index, fh: BinaryIO, offset: int)#

Parse and interact with index entries.

Parameters:

  • index – The Index class instance this IndexEntry belongs to.

  • fh – The file-like object to parse an index entry on.

  • offset – The offset in the file-like object to parse an index entry at.

property is_end: bool#

Return whether this entry marks the end.

property is_node: bool#

Return whether this entry is a node.

property node_vcn: int#

Return the node VCN if this entry is a node.

property length: int#

Return the length of this index entry.

property key_length: int#

Return the length of this index entry.

dereference() → dissect.ntfs.mft.MftRecord#

Dereference this IndexEntry to the MFT record it points to.

Note that the file reference is a union with the data part so only access this if you know the entry has a file reference and not a data part.

Raises:

MftNotAvailableError – If no MFT is available.

key() → bytes#

Return the index key of this entry.

data() → bytes#

Return the data part of this entry.

Note that the data part is a union with the file reference, so only access this if you know the entry has data and not a file reference.

attribute() → dissect.ntfs.attr.AttributeRecord | None#

Return the dissect.ntfs.attr.AttributeRecord of the attribute contained in this entry.