dissect.target.plugins.filesystem.ntfs.mft_timeline

Module Contents

Classes

Extras

MftTimelinePlugin

NTFS MFT timeline plugin.

Functions

format_none_value

Format the value if it is None

format_info

Attributes

FORMAT_INFO

dissect.target.plugins.filesystem.ntfs.mft_timeline.format_none_value(value: Any) → str | Any

Format the value if it is None

class dissect.target.plugins.filesystem.ntfs.mft_timeline.Extras
in_use: bool | None = None
resident: bool | None = None
owner: str | None = None
size: int | None = None
serial: int | None = None
volume_uuid: str | None = None
format() → str
dissect.target.plugins.filesystem.ntfs.mft_timeline.FORMAT_INFO
dissect.target.plugins.filesystem.ntfs.mft_timeline.format_info(segment: int, path: str, extras: Extras, info: dissect.ntfs.attr.FileName | dissect.ntfs.attr.StandardInformation, info_type: dissect.target.plugins.filesystem.ntfs.utils.InformationType, idx: str = '') → Iterator[str]
class dissect.target.plugins.filesystem.ntfs.mft_timeline.MftTimelinePlugin(target: dissect.target.Target)

Bases: dissect.target.plugin.Plugin

NTFS MFT timeline plugin.

check_compatible() → None

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

mft_timeline(ignore_dos: bool = False) → Iterator[str]

Return the MFT records of all NTFS filesystems in a human readable format (unsorted).

The Master File Table (MFT) contains metadata about every file and folder on a NFTS filesystem.

If the filesystem is part of a virtual NTFS filesystem (a VirtualFilesystem with the MFT properties added to it through a “fake” NtfsFilesystem), the paths returned in the MFT records are based on the mount point of the VirtualFilesystem. This ensures that the proper original drive letter is used when available. When no drive letter can be determined, the path will show as e.g. \$fs$\fs0.

References