dissect.ntfs.stream#

Module Contents#

Classes#

CompressedRunlistStream

Specialized RunlistStream for reading NTFS compressed streams.
class dissect.ntfs.stream.CompressedRunlistStream(fh: BinaryIO, runlist: list[tuple[int, int]], size: int, cluster_size: int, compression_unit: int)#

Bases: dissect.util.stream.RunlistStream

Specialized RunlistStream for reading NTFS compressed streams.

Parameters:

  • fh – The source file-like object.

  • runlist – The runlist for this stream in block units.

  • size – The size of the stream. This can be smaller than the total sum of blocks (to account for slack space).

  • compression_unit – The compression unit of for this stream.

property runlist: list[tuple[int, int]]#