dissect.ntfs#
A Dissect module implementing a parser for the NTFS file system, used by the Windows operating system.
Installation#
dissect.ntfs
is available on PyPI.
$ pip install dissect.ntfs
This module is also automatically installed if you install the dissect
package.
Usage#
This package is a library with no CLI tools, so you can only interact with it from Python. For example, to print a directory listing of the root directory and read a file:
from dissect.ntfs import NTFS
fh = open_ntfs_volume() # i.e. using dissect.volume
fs = NTFS(fh)
print(fs.get("/").listdir())
file_fh = fs.get("/file.txt").open() # This is just another file-like object
print(file_fh.read())
Reference#
For more details, please refer to the API documentation of dissect.ntfs
.