dissect.ntfs.usnjrnl#

Module Contents#

Classes#

UsnJrnl

Parse the USN journal from a file-like object of the $UsnJrnl:$J stream.

UsnRecord

Parse a USN record from a file-like object and offset.

class dissect.ntfs.usnjrnl.UsnJrnl(fh: BinaryIO, ntfs: dissect.ntfs.ntfs.NTFS | None = None)#

Parse the USN journal from a file-like object of the $UsnJrnl:$J stream.

Parameters:
  • fh – A file-like object of the $UsnJrnl:$J stream.

  • ntfs – An optional NTFS class instance, used for resolving file paths.

records() Iterator[UsnRecord]#

Yield all parsed USN records.

Only yields version 2 USN records, other record versions are ignored.

class dissect.ntfs.usnjrnl.UsnRecord(usnjrnl: UsnJrnl, fh: BinaryIO, offset: int)#

Parse a USN record from a file-like object and offset.

Parameters:
  • usnjrnl – The UsnJrnl class this record is parsed from.

  • fh – The file-like object to parse a USN record from.

  • offset – The offset to parse a USN record at.

property timestamp: datetime.datetime#
property timestamp_ns: int#
__repr__() str#

Return repr(self).

__getattr__(attr: str) Any#
file() dissect.ntfs.mft.MftRecord | None#
parent() dissect.ntfs.mft.MftRecord | None#
full_path() str#