dissect.ntfs 3.10.dev5__tar.gz → 3.11.dev2__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {dissect.ntfs-3.10.dev5/dissect.ntfs.egg-info → dissect_ntfs-3.11.dev2}/PKG-INFO +6 -3
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/dissect/ntfs/c_ntfs.py +3 -4
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/dissect/ntfs/mft.py +4 -6
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/dissect/ntfs/secure.py +1 -2
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/dissect/ntfs/util.py +6 -5
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2/dissect.ntfs.egg-info}/PKG-INFO +6 -3
- dissect_ntfs-3.11.dev2/dissect.ntfs.egg-info/requires.txt +6 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/pyproject.toml +8 -2
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/tox.ini +6 -4
- dissect.ntfs-3.10.dev5/dissect.ntfs.egg-info/requires.txt +0 -2
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/COPYRIGHT +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/LICENSE +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/MANIFEST.in +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/README.md +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/dissect/ntfs/__init__.py +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/dissect/ntfs/attr.py +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/dissect/ntfs/exceptions.py +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/dissect/ntfs/index.py +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/dissect/ntfs/ntfs.py +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/dissect/ntfs/stream.py +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/dissect/ntfs/usnjrnl.py +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/dissect.ntfs.egg-info/SOURCES.txt +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/dissect.ntfs.egg-info/dependency_links.txt +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/dissect.ntfs.egg-info/top_level.txt +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/setup.cfg +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/tests/__init__.py +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/tests/conftest.py +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/tests/data/boot_2m.bin.gz +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/tests/data/mft.bin.gz +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/tests/data/ntfs.bin.gz +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/tests/data/ntfs_fragmented_mft.csv.gz +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/tests/data/sds.bin.gz +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/tests/data/sds_complex.bin.gz +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/tests/docs/Makefile +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/tests/docs/conf.py +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/tests/docs/index.rst +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/tests/test_attr.py +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/tests/test_index.py +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/tests/test_mft.py +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/tests/test_ntfs.py +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/tests/test_secure.py +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/tests/test_usnjrnl.py +0 -0
- {dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/tests/test_util.py +0 -0
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.1
|
|
2
2
|
Name: dissect.ntfs
|
|
3
|
-
Version: 3.
|
|
3
|
+
Version: 3.11.dev2
|
|
4
4
|
Summary: A Dissect module implementing a parser for the NTFS file system, used by the Windows operating system
|
|
5
5
|
Author-email: Dissect Team <dissect@fox-it.com>
|
|
6
6
|
License: Affero General Public License v3
|
|
@@ -22,8 +22,11 @@ Requires-Python: ~=3.9
|
|
|
22
22
|
Description-Content-Type: text/markdown
|
|
23
23
|
License-File: LICENSE
|
|
24
24
|
License-File: COPYRIGHT
|
|
25
|
-
Requires-Dist: dissect.cstruct<4.
|
|
26
|
-
Requires-Dist: dissect.util<4
|
|
25
|
+
Requires-Dist: dissect.cstruct<5,>=4.dev
|
|
26
|
+
Requires-Dist: dissect.util<4,>=3
|
|
27
|
+
Provides-Extra: dev
|
|
28
|
+
Requires-Dist: dissect.cstruct<5.0.dev,>=4.0.dev; extra == "dev"
|
|
29
|
+
Requires-Dist: dissect.util<4.0.dev,>=3.0.dev; extra == "dev"
|
|
27
30
|
|
|
28
31
|
# dissect.ntfs
|
|
29
32
|
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import struct
|
|
2
2
|
|
|
3
|
-
from dissect import cstruct
|
|
3
|
+
from dissect.cstruct import cstruct
|
|
4
4
|
|
|
5
5
|
ntfs_def = """
|
|
6
6
|
/* ================ Generic stuff ================ */
|
|
@@ -552,8 +552,7 @@ typedef struct {
|
|
|
552
552
|
} USN_RECORD_V4;
|
|
553
553
|
"""
|
|
554
554
|
|
|
555
|
-
c_ntfs = cstruct.
|
|
556
|
-
c_ntfs.load(ntfs_def)
|
|
555
|
+
c_ntfs = cstruct().load(ntfs_def)
|
|
557
556
|
|
|
558
557
|
# Useful enums and flags
|
|
559
558
|
ATTRIBUTE_TYPE_CODE = c_ntfs.ATTRIBUTE_TYPE_CODE
|
|
@@ -614,7 +613,7 @@ INDEX_ENTRY_NODE = 0x01
|
|
|
614
613
|
INDEX_ENTRY_END = 0x02
|
|
615
614
|
|
|
616
615
|
|
|
617
|
-
def segment_reference(reference:
|
|
616
|
+
def segment_reference(reference: c_ntfs._MFT_SEGMENT_REFERENCE) -> int:
|
|
618
617
|
"""Helper to calculate the complete segment number from a cstruct MFT segment reference.
|
|
619
618
|
|
|
620
619
|
Args:
|
|
@@ -6,8 +6,6 @@ from io import BytesIO
|
|
|
6
6
|
from operator import itemgetter
|
|
7
7
|
from typing import TYPE_CHECKING, Any, BinaryIO, Iterator, Optional, Union
|
|
8
8
|
|
|
9
|
-
from dissect.cstruct import Instance
|
|
10
|
-
|
|
11
9
|
from dissect.ntfs.attr import Attribute, AttributeHeader
|
|
12
10
|
from dissect.ntfs.c_ntfs import (
|
|
13
11
|
ATTRIBUTE_TYPE_CODE,
|
|
@@ -91,11 +89,11 @@ class Mft:
|
|
|
91
89
|
|
|
92
90
|
return node
|
|
93
91
|
|
|
94
|
-
def get(self, ref: Union[int, str,
|
|
92
|
+
def get(self, ref: Union[int, str, c_ntfs._MFT_SEGMENT_REFERENCE], root: Optional[MftRecord] = None) -> MftRecord:
|
|
95
93
|
"""Retrieve an MFT record using a variety of methods.
|
|
96
94
|
|
|
97
95
|
Supported references are:
|
|
98
|
-
- ``_MFT_SEGMENT_REFERENCE`` cstruct
|
|
96
|
+
- ``_MFT_SEGMENT_REFERENCE`` cstruct structure
|
|
99
97
|
- integer segment number
|
|
100
98
|
- string file path
|
|
101
99
|
|
|
@@ -106,7 +104,7 @@ class Mft:
|
|
|
106
104
|
Raises:
|
|
107
105
|
TypeError: If the reference is of an unsupported type.
|
|
108
106
|
"""
|
|
109
|
-
if isinstance(ref,
|
|
107
|
+
if isinstance(ref, c_ntfs._MFT_SEGMENT_REFERENCE):
|
|
110
108
|
ref = segment_reference(ref)
|
|
111
109
|
|
|
112
110
|
if isinstance(ref, int):
|
|
@@ -153,7 +151,7 @@ class MftRecord:
|
|
|
153
151
|
self.segment: Optional[int] = None
|
|
154
152
|
self.offset: Optional[int] = None
|
|
155
153
|
self.data: Optional[bytes] = None
|
|
156
|
-
self.header: Optional[
|
|
154
|
+
self.header: Optional[c_ntfs._FILE_RECORD_SEGMENT_HEADER] = None
|
|
157
155
|
|
|
158
156
|
def __repr__(self) -> str:
|
|
159
157
|
return f"<MftRecord {self.segment}#{self.header.SequenceNumber}>"
|
|
@@ -4,7 +4,6 @@ import io
|
|
|
4
4
|
from typing import BinaryIO, Iterator
|
|
5
5
|
from uuid import UUID
|
|
6
6
|
|
|
7
|
-
from dissect.cstruct import Instance
|
|
8
7
|
from dissect.util.sid import read_sid
|
|
9
8
|
|
|
10
9
|
from dissect.ntfs.c_ntfs import ACE_OBJECT_FLAGS, ACE_TYPE, c_ntfs
|
|
@@ -39,7 +38,7 @@ class Secure:
|
|
|
39
38
|
if not hasattr(self.sds, "size"):
|
|
40
39
|
self.sds.size = self.sds.seek(0, io.SEEK_END)
|
|
41
40
|
|
|
42
|
-
def _iter_entries(self, offset: int = 0) -> Iterator[
|
|
41
|
+
def _iter_entries(self, offset: int = 0) -> Iterator[c_ntfs._SECURITY_DESCRIPTOR_HEADER]:
|
|
43
42
|
"""Iterate over all SDS entries, optionally starting from a specific offset.
|
|
44
43
|
|
|
45
44
|
Args:
|
|
@@ -4,7 +4,7 @@ import struct
|
|
|
4
4
|
from collections import UserDict
|
|
5
5
|
from typing import TYPE_CHECKING, Any, BinaryIO, Optional, Union
|
|
6
6
|
|
|
7
|
-
from dissect.cstruct import
|
|
7
|
+
from dissect.cstruct import Enum
|
|
8
8
|
from dissect.util.stream import RunlistStream
|
|
9
9
|
|
|
10
10
|
from dissect.ntfs.c_ntfs import (
|
|
@@ -13,6 +13,7 @@ from dissect.ntfs.c_ntfs import (
|
|
|
13
13
|
FILE_NUMBER_ROOT,
|
|
14
14
|
SECTOR_SHIFT,
|
|
15
15
|
SECTOR_SIZE,
|
|
16
|
+
c_ntfs,
|
|
16
17
|
segment_reference,
|
|
17
18
|
)
|
|
18
19
|
from dissect.ntfs.exceptions import FilenameNotAvailableError, VolumeNotAvailableError
|
|
@@ -38,18 +39,18 @@ class AttributeMap(UserDict):
|
|
|
38
39
|
""" # noqa: E501
|
|
39
40
|
|
|
40
41
|
def __getattr__(self, attr: str) -> AttributeCollection:
|
|
41
|
-
if attr in ATTRIBUTE_TYPE_CODE:
|
|
42
|
+
if attr in ATTRIBUTE_TYPE_CODE.__members__:
|
|
42
43
|
return self[ATTRIBUTE_TYPE_CODE[attr]]
|
|
43
44
|
|
|
44
45
|
return super().__getattribute__(attr)
|
|
45
46
|
|
|
46
47
|
def __getitem__(self, item: Union[ATTRIBUTE_TYPE_CODE, int]) -> AttributeCollection:
|
|
47
|
-
if isinstance(item,
|
|
48
|
+
if isinstance(item, Enum):
|
|
48
49
|
item = item.value
|
|
49
50
|
return self.data.get(item, AttributeCollection())
|
|
50
51
|
|
|
51
52
|
def __contains__(self, key: Union[ATTRIBUTE_TYPE_CODE, int]) -> bool:
|
|
52
|
-
if isinstance(key,
|
|
53
|
+
if isinstance(key, Enum):
|
|
53
54
|
key = key.value
|
|
54
55
|
return super().__contains__(key)
|
|
55
56
|
|
|
@@ -234,7 +235,7 @@ def ensure_volume(ntfs: NTFS) -> None:
|
|
|
234
235
|
raise VolumeNotAvailableError()
|
|
235
236
|
|
|
236
237
|
|
|
237
|
-
def get_full_path(mft: Mft, name: str, parent:
|
|
238
|
+
def get_full_path(mft: Mft, name: str, parent: c_ntfs._MFT_SEGMENT_REFERENCE, seen: set[str] = None) -> str:
|
|
238
239
|
"""Walk up parent file references to construct a full path.
|
|
239
240
|
|
|
240
241
|
Args:
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
Metadata-Version: 2.1
|
|
2
2
|
Name: dissect.ntfs
|
|
3
|
-
Version: 3.
|
|
3
|
+
Version: 3.11.dev2
|
|
4
4
|
Summary: A Dissect module implementing a parser for the NTFS file system, used by the Windows operating system
|
|
5
5
|
Author-email: Dissect Team <dissect@fox-it.com>
|
|
6
6
|
License: Affero General Public License v3
|
|
@@ -22,8 +22,11 @@ Requires-Python: ~=3.9
|
|
|
22
22
|
Description-Content-Type: text/markdown
|
|
23
23
|
License-File: LICENSE
|
|
24
24
|
License-File: COPYRIGHT
|
|
25
|
-
Requires-Dist: dissect.cstruct<4.
|
|
26
|
-
Requires-Dist: dissect.util<4
|
|
25
|
+
Requires-Dist: dissect.cstruct<5,>=4.dev
|
|
26
|
+
Requires-Dist: dissect.util<4,>=3
|
|
27
|
+
Provides-Extra: dev
|
|
28
|
+
Requires-Dist: dissect.cstruct<5.0.dev,>=4.0.dev; extra == "dev"
|
|
29
|
+
Requires-Dist: dissect.util<4.0.dev,>=3.0.dev; extra == "dev"
|
|
27
30
|
|
|
28
31
|
# dissect.ntfs
|
|
29
32
|
|
|
@@ -25,8 +25,8 @@ classifiers = [
|
|
|
25
25
|
"Topic :: Utilities",
|
|
26
26
|
]
|
|
27
27
|
dependencies = [
|
|
28
|
-
"dissect.cstruct>=
|
|
29
|
-
"dissect.util>=3
|
|
28
|
+
"dissect.cstruct>=4.dev,<5",
|
|
29
|
+
"dissect.util>=3,<4",
|
|
30
30
|
]
|
|
31
31
|
dynamic = ["version"]
|
|
32
32
|
|
|
@@ -35,6 +35,12 @@ homepage = "https://dissect.tools"
|
|
|
35
35
|
documentation = "https://docs.dissect.tools/en/latest/projects/dissect.ntfs"
|
|
36
36
|
repository = "https://github.com/fox-it/dissect.ntfs"
|
|
37
37
|
|
|
38
|
+
[project.optional-dependencies]
|
|
39
|
+
dev = [
|
|
40
|
+
"dissect.cstruct>=4.0.dev,<5.0.dev",
|
|
41
|
+
"dissect.util>=3.0.dev,<4.0.dev",
|
|
42
|
+
]
|
|
43
|
+
|
|
38
44
|
[tool.black]
|
|
39
45
|
line-length = 120
|
|
40
46
|
|
|
@@ -5,12 +5,14 @@ envlist = lint, py3, pypy3
|
|
|
5
5
|
# locally installed tox to have a minimum version 3.3.0. This means the names
|
|
6
6
|
# of the configuration options are still according to the tox 3.x syntax.
|
|
7
7
|
minversion = 4.4.3
|
|
8
|
-
# This version of virtualenv will install setuptools version
|
|
9
|
-
#
|
|
10
|
-
# pyproject.toml file (PEP-517/PEP-518/PEP-621)
|
|
11
|
-
|
|
8
|
+
# This version of virtualenv will install setuptools version 68.2.2 and pip
|
|
9
|
+
# 23.3.1. These versions fully support python projects defined only through a
|
|
10
|
+
# pyproject.toml file (PEP-517/PEP-518/PEP-621). This pip version also support
|
|
11
|
+
# the proper version resolving with (sub-)dependencies defining dev extra's.
|
|
12
|
+
requires = virtualenv>=20.24.6
|
|
12
13
|
|
|
13
14
|
[testenv]
|
|
15
|
+
extras = dev
|
|
14
16
|
deps =
|
|
15
17
|
pytest
|
|
16
18
|
pytest-cov
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
{dissect.ntfs-3.10.dev5 → dissect_ntfs-3.11.dev2}/dissect.ntfs.egg-info/dependency_links.txt
RENAMED
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|
|
File without changes
|