dissect.target.plugins.filesystem.ntfs.utils

Module Contents

Classes

InformationType

Valid information types.

Functions

get_drive_letter	Retrieve the drive letter from the loaded mounts
get_volume_identifier	Return the filesystem GUID or serial, if available.
get_owner_and_group
get_record_size	Gets the size for a specific record.

Attributes

DRIVE_LETTER_RE

dissect.target.plugins.filesystem.ntfs.utils.DRIVE_LETTER_RE

class dissect.target.plugins.filesystem.ntfs.utils.InformationType

Bases: enum.Enum

Valid information types.

STANDARD_INFORMATION

FILE_INFORMATION

ALTERNATE_DATA_STREAM

dissect.target.plugins.filesystem.ntfs.utils.get_drive_letter(target: dissect.target.target.Target, filesystem: dissect.target.filesystems.ntfs.NtfsFilesystem) → str

Retrieve the drive letter from the loaded mounts

When the drive letter is not available for that filesystem it returns empty.

dissect.target.plugins.filesystem.ntfs.utils.get_volume_identifier(fs: dissect.target.filesystems.ntfs.NtfsFilesystem) → str | None

Return the filesystem GUID or serial, if available.

dissect.target.plugins.filesystem.ntfs.utils.get_owner_and_group(entry: dissect.ntfs.mft.MftRecord, fs: dissect.target.filesystems.ntfs.NtfsFilesystem) → tuple[str | None, str | None]

dissect.target.plugins.filesystem.ntfs.utils.get_record_size(record: dissect.ntfs.mft.MftRecord, name: str = '') → int | None

Gets the size for a specific record.