dissect.target.plugins.filesystem.ntfs.utils#

Module Contents#

Classes#

InformationType

Generic enumeration.

Functions#

get_drive_letter

Retrieve the drive letter from the loaded mounts

get_volume_identifier

Return the filesystem guid if available

get_owner_and_group

get_record_size

Gets the size for a specific record

Attributes#

dissect.target.plugins.filesystem.ntfs.utils.DRIVE_LETTER_RE#
class dissect.target.plugins.filesystem.ntfs.utils.InformationType#

Bases: enum.Enum

Generic enumeration.

Derive from this class to define new enumerations.

STANDARD_INFORMATION#
FILE_INFORMATION#
ALTERNATE_DATA_STREAM#
dissect.target.plugins.filesystem.ntfs.utils.get_drive_letter(target: dissect.target.Target, filesystem: dissect.target.filesystems.ntfs.NtfsFilesystem)#

Retrieve the drive letter from the loaded mounts

When the drive letter is not available for that filesystem it returns empty.

dissect.target.plugins.filesystem.ntfs.utils.get_volume_identifier(fs: dissect.target.filesystems.ntfs.NtfsFilesystem) str#

Return the filesystem guid if available

dissect.target.plugins.filesystem.ntfs.utils.get_owner_and_group(entry: dissect.ntfs.mft.MftRecord, fs: dissect.target.filesystems.ntfs.NtfsFilesystem) Tuple[str | None, str | None]#
dissect.target.plugins.filesystem.ntfs.utils.get_record_size(record: dissect.ntfs.mft.MftRecord, name: str = '') int | None#

Gets the size for a specific record