dissect.target.filesystems.ntfs

Module Contents

Classes

NtfsFilesystem	Base class for filesystems.
NtfsFilesystemEntry	Base class for filesystem entries.

class dissect.target.filesystems.ntfs.NtfsFilesystem(fh: BinaryIO | None = None, boot: BinaryIO | None = None, mft: BinaryIO | None = None, usnjrnl: BinaryIO | None = None, sds: BinaryIO | None = None, *args, **kwargs)

Bases: dissect.target.filesystem.Filesystem

Base class for filesystems.

__type__ = 'ntfs'

get(path: str) → NtfsFilesystemEntry

Retrieve a FilesystemEntry from the filesystem.

Parameters:

path – The path which we want to retrieve.

Returns:

A FilesystemEntry for the path.

class dissect.target.filesystems.ntfs.NtfsFilesystemEntry(fs: NtfsFilesystem, path: str, entry: dissect.ntfs.MftRecord | None = None, index_entry: dissect.ntfs.IndexEntry | None = None)

Bases: dissect.target.filesystem.FilesystemEntry

Base class for filesystem entries.

dereference() → dissect.ntfs.MftRecord

get(path: str) → NtfsFilesystemEntry

Retrieve a FilesystemEntry relative to this entry.

Parameters:

path – The path relative to this filesystem entry.

Returns:

A relative FilesystemEntry.

open(name: str = '') → BinaryIO

Open this filesystem entry.

Returns:

A file-like object. Resolves symlinks when possible

iterdir() → Iterator[str]

Iterate over the contents of a directory, return them as strings.

Returns:

An iterator of directory entries as path strings.

scandir() → Iterator[NtfsFilesystemEntry]

Iterate over the contents of a directory, return them as FilesystemEntry’s.

Returns:

An iterator of directory entries as FilesystemEntry’s.

is_dir(follow_symlinks: bool = True) → bool

Determine if this entry is a directory.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a directory or a symbolic link to a directory, return False otherwise. If follow_symlinks is False, return True only if the entry is a directory (without following symlinks).

is_file(follow_symlinks: bool = True) → bool

Determine if this entry is a file.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a file or a symbolic link to a file, return False otherwise. If follow_symlinks is False, return True only if the entry is a file (without following symlinks).

is_symlink() → bool

Determine whether this entry is a symlink.

Returns:

True if the entry is a symbolic link, False otherwise.

readlink() → str

Read the link where this entry points to, return the resulting path as string.

If it is a symlink and returns the entry that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Returns:

The path the link points to.

stat(follow_symlinks: bool = True) → dissect.target.helpers.fsutil.stat_result

Determine the stat information of this entry.

If the entry is a symlink and follow_symlinks is True, it gets resolved, attempting to stat the path where it points to.

Parameters:

follow_symlinks – Whether to resolve the symbolic link if this entry is a symbolic link.

Returns:

The stat information of this entry.

lstat() → dissect.target.helpers.fsutil.stat_result

Determine the stat information of this entry, without resolving the symlinks.

When it detects a symlink, it will stat the information of the symlink, not the path it points to.

Returns:

The stat information of this entry.

attr() → dissect.ntfs.util.AttributeMap

The attributes related to this entry, resolving any symlinks.

If the entry is a symbolic link, it will attempt to resolve it first. Resulting in the attr information of the entry it points to.

Returns:

The attributes of this entry.

lattr() → dissect.ntfs.util.AttributeMap

The attributes related to this current entry, without resolving links.

Returns:

The attributes of this entry.