dissect.target.plugins.filesystem.ntfs.mft_timeline

Module Contents

Classes

MftTimelinePlugin

NTFS MFT timeline plugin.
class dissect.target.plugins.filesystem.ntfs.mft_timeline.MftTimelinePlugin(target: dissect.target.target.Target)

Bases: dissect.target.plugin.Plugin

NTFS MFT timeline plugin.

check_compatible() → None

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

mft_timeline(ignore_dos: bool = False) → collections.abc.Iterator[str]

Return the MFT records of all NTFS filesystems in a human readable format (unsorted) (deprecated, use mft.timeline).

The Master File Table (MFT) contains metadata about every file and folder on a NFTS filesystem.

If the filesystem is part of a virtual NTFS filesystem (a VirtualFilesystem with the MFT properties added to it through a “fake” NtfsFilesystem), the paths returned in the MFT records are based on the mount point of the VirtualFilesystem. This ensures that the proper original drive letter is used when available. When no drive letter can be determined, the path will show as e.g. \$fs$\fs0.

References