dissect.target.plugins.filesystem.ntfs.utils
#
Module Contents#
Classes#
Generic enumeration. |
Functions#
Retrieve the drive letter from the loaded mounts |
|
Return the filesystem guid if available |
|
Gets the size for a specific record |
- class dissect.target.plugins.filesystem.ntfs.utils.InformationType#
Bases:
enum.Enum
Generic enumeration.
Derive from this class to define new enumerations.
- STANDARD_INFORMATION#
- FILE_INFORMATION#
- ALTERNATE_DATA_STREAM#
- dissect.target.plugins.filesystem.ntfs.utils.get_drive_letter(target: dissect.target.Target, filesystem: dissect.target.filesystems.ntfs.NtfsFilesystem)#
Retrieve the drive letter from the loaded mounts
When the drive letter is not available for that filesystem it returns empty.
- dissect.target.plugins.filesystem.ntfs.utils.get_volume_identifier(fs: dissect.target.filesystems.ntfs.NtfsFilesystem) str #
Return the filesystem guid if available
- dissect.target.plugins.filesystem.ntfs.utils.get_owner_and_group(entry: dissect.ntfs.mft.MftRecord, fs: dissect.target.filesystems.ntfs.NtfsFilesystem) Tuple[str | None, str | None] #
- dissect.target.plugins.filesystem.ntfs.utils.get_record_size(record: dissect.ntfs.mft.MftRecord, name: str = '') int | None #
Gets the size for a specific record