:py:mod:`dissect.ntfs.ntfs`
===========================

.. py:module:: dissect.ntfs.ntfs


Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.ntfs.ntfs.NTFS




.. py:class:: NTFS(fh: BinaryIO | None = None, boot: BinaryIO | None = None, mft: BinaryIO | None = None, usnjrnl: BinaryIO | None = None, sds: BinaryIO | None = None)

   Implementation for Microsoft NTFS.

   This implementation supports parsing NTFS from either a full NTFS volume or from separate files.
   If you have a file-like object of an NTFS volume, simply pass it as the fh argument. If you have separate
   file-like objects for things like ``$BOOT`` or ``$MFT``, pass those as the boot and mft arguments.
   The separate arguments take precedence over parsing from the volume file-like object.

   :param fh: A file-like object for the volume to use for parsing NTFS. This is where "data on disk" is read from.
   :param boot: A file-like object for the ``$BOOT`` file.
   :param mft: A file-like object for the ``$MFT`` file.
   :param usnjrnl: A file-like object for the ``$Extend/$Usnjrnl:$J`` file.
   :param sds: A file-like object for the ``$Secure:$SDS`` file.


   .. py:attribute:: fh
      :value: None



   .. py:attribute:: sector_size_shift


   .. py:attribute:: cluster_size_shift


   .. py:attribute:: mft
      :value: None



   .. py:attribute:: secure
      :value: None



   .. py:attribute:: usnjrnl
      :value: None



   .. py:property:: serial
      :type: int | None



   .. py:property:: volume_name
      :type: str | None