dissect.ntfs.usnjrnl
#
Module Contents#
Classes#
Parse the USN journal from a file-like object of the $UsnJrnl:$J stream. |
|
Parse a USN record from a file-like object and offset. |
- class dissect.ntfs.usnjrnl.UsnJrnl(fh: BinaryIO, ntfs: Optional[dissect.ntfs.ntfs.NTFS] = None)#
Parse the USN journal from a file-like object of the $UsnJrnl:$J stream.
- Parameters:
fh – A file-like object of the $UsnJrnl:$J stream.
ntfs – An optional NTFS class instance, used for resolving file paths.
- class dissect.ntfs.usnjrnl.UsnRecord(usnjrnl: UsnJrnl, fh: BinaryIO, offset: int)#
Parse a USN record from a file-like object and offset.
- Parameters:
usnjrnl – The
UsnJrnl
class this record is parsed from.fh – The file-like object to parse a USN record from.
offset – The offset to parse a USN record at.
- property timestamp: datetime.datetime#
- property timestamp_ns: int#
- __repr__() str #
Return repr(self).
- __getattr__(attr: str) Any #
- file() Optional[dissect.ntfs.mft.MftRecord] #
- parent() Optional[dissect.ntfs.mft.MftRecord] #
- full_path() str #