`dissect.target.plugins.filesystem.ntfs.utils`#

Module Contents#

Generic enumeration.

`get_drive_letter`	Retrieve the drive letter from the loaded mounts
`get_volume_identifier`	Return the filesystem guid if available
`get_owner_and_group`
`get_record_size`	Gets the size for a specific record

class dissect.target.plugins.filesystem.ntfs.utils.InformationType#

Bases: enum.Enum

Generic enumeration.

Derive from this class to define new enumerations.

dissect.target.plugins.filesystem.ntfs.utils.get_drive_letter(target: dissect.target.Target, filesystem: dissect.target.filesystems.ntfs.NtfsFilesystem)#

Retrieve the drive letter from the loaded mounts

When the drive letter is not available for that filesystem it returns empty.

dissect.target.plugins.filesystem.ntfs.utils.get_volume_identifier(fs: dissect.target.filesystems.ntfs.NtfsFilesystem) → str#: Return the filesystem guid if available

dissect.target.plugins.filesystem.ntfs.utils.get_owner_and_group(entry: dissect.ntfs.mft.MftRecord, fs: dissect.target.filesystems.ntfs.NtfsFilesystem) → Tuple[Optional[str], Optional[str]]#

dissect.target.plugins.filesystem.ntfs.utils.get_record_size(record: dissect.ntfs.mft.MftRecord, name: str = '') → Optional[int]#: Gets the size for a specific record