dissect.target 3.19.dev24__tar.gz → 3.19.dev25__tar.gz

{dissect_target-3.19.dev24/dissect.target.egg-info → dissect_target-3.19.dev25}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev24
+Version: 3.19.dev25
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.19.dev24 → dissect_target-3.19.dev25}/dissect/target/plugins/filesystem/ntfs/mft.py

@@ -1,9 +1,10 @@
 import logging
-from typing import Callable
+from typing import Callable, Iterator
 
 from dissect.ntfs.attr import Attribute
 from dissect.ntfs.c_ntfs import FILE_RECORD_SEGMENT_IN_USE
 from dissect.ntfs.mft import MftRecord
+from flow.record import Record
 from flow.record.fieldtypes import windows_path
 
 from dissect.target.exceptions import UnsupportedPluginError
@@ -53,7 +54,6 @@ FilesystemStdRecord = TargetRecordDescriptor(
     ],
 )
 
-
 FilesystemFilenameCompactRecord = TargetRecordDescriptor(
     "filesystem/ntfs/mft/filename/compact",
     [
@@ -90,6 +90,21 @@ FilesystemFilenameRecord = TargetRecordDescriptor(
     ],
 )
 
+FilesystemMACBRecord = TargetRecordDescriptor(
+    "filesystem/ntfs/mft/macb",
+    [
+        ("datetime", "ts"),
+        ("string", "macb"),
+        ("uint32", "filename_index"),
+        ("uint32", "segment"),
+        ("path", "path"),
+        ("string", "owner"),
+        ("filesize", "filesize"),
+        ("boolean", "resident"),
+        ("boolean", "inuse"),
+        ("string", "volume_uuid"),
+    ],
+)
 
 RECORD_TYPES = {
     InformationType.STANDARD_INFORMATION: FilesystemStdRecord,
@@ -118,7 +133,12 @@ class MftPlugin(Plugin):
         ]
     )
     @arg("--compact", action="store_true", help="compacts the MFT entry timestamps into a single record")
-    def mft(self, compact: bool = False):
+    @arg(
+        "--macb",
+        action="store_true",
+        help="compacts the MFT entry timestamps into aggregated records with MACB bitfield",
+    )
+    def mft(self, compact: bool = False, macb: bool = False):
         """Return the MFT records of all NTFS filesystems.
 
         The Master File Table (MFT) contains primarily metadata about every file and folder on a NFTS filesystem.
@@ -133,10 +153,19 @@ class MftPlugin(Plugin):
             - https://docs.microsoft.com/en-us/windows/win32/fileio/master-file-table
         """
 
-        if compact:
+        record_formatter = formatter
+
+        def noaggr(records: list[Record]) -> Iterator[Record]:
+            yield from records
+
+        aggr = noaggr
+
+        if compact and macb:
+            raise ValueError("--macb and --compact are mutually exclusive")
+        elif compact:
             record_formatter = compacted_formatter
-        else:
-            record_formatter = formatter
+        elif macb:
+            aggr = macb_aggr
 
         for fs in self.target.filesystems:
             if fs.__type__ != "ntfs":
@@ -167,17 +196,19 @@ class MftPlugin(Plugin):
 
                         for path in record.full_paths():
                             path = f"{drive_letter}{path}"
-                            yield from self.mft_records(
-                                drive_letter=drive_letter,
-                                record=record,
-                                segment=record.segment,
-                                path=path,
-                                owner=owner,
-                                size=size,
-                                resident=resident,
-                                inuse=inuse,
-                                volume_uuid=volume_uuid,
-                                record_formatter=record_formatter,
+                            yield from aggr(
+                                self.mft_records(
+                                    drive_letter=drive_letter,
+                                    record=record,
+                                    segment=record.segment,
+                                    path=path,
+                                    owner=owner,
+                                    size=size,
+                                    resident=resident,
+                                    inuse=inuse,
+                                    volume_uuid=volume_uuid,
+                                    record_formatter=record_formatter,
+                                )
                             )
                     except Exception as e:
                         self.target.log.warning("An error occured parsing MFT segment %d: %s", record.segment, str(e))
@@ -275,3 +306,33 @@ def formatter(attr: Attribute, record_type: InformationType, **kwargs):
         ("A", attr.last_access_time),
     ]:
         yield record_desc(ts=timestamp, ts_type=type, **kwargs)
+
+
+def macb_aggr(records: list[Record]) -> Iterator[Record]:
+    def macb_set(bitfield, index, letter):
+        return bitfield[:index] + letter + bitfield[index + 1 :]
+
+    macbs = []
+    for record in records:
+        found = False
+
+        offset_std = int(record._desc.name == "filesystem/ntfs/mft/std") * 5
+        offset_ads = (int(record.ads) * 10) if offset_std == 0 else 0
+
+        field = "MACB".find(record.ts_type) + offset_std + offset_ads
+        for macb in macbs:
+            if macb.ts == record.ts:
+                macb.macb = macb_set(macb.macb, field, record.ts_type)
+                found = True
+                break
+
+        if found:
+            continue
+
+        macb = FilesystemMACBRecord.init_from_record(record)
+        macb.macb = "..../..../...."
+        macb.macb = macb_set(macb.macb, field, record.ts_type)
+
+        macbs.append(macb)
+
+    yield from macbs

{dissect_target-3.19.dev24 → dissect_target-3.19.dev25/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev24
+Version: 3.19.dev25
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.19.dev24 → dissect_target-3.19.dev25}/tests/plugins/filesystem/ntfs/test_mft.py

@@ -1,13 +1,20 @@
 import re
+from random import randrange
 from unittest.mock import Mock
 
 import pytest
 from dissect.ntfs.c_ntfs import ATTRIBUTE_TYPE_CODE
 from dissect.ntfs.exceptions import Error
 
+from dissect.target import Target
 from dissect.target.filesystem import VirtualFilesystem
 from dissect.target.filesystems.ntfs import NtfsFilesystem
-from dissect.target.plugins.filesystem.ntfs.mft import MftPlugin
+from dissect.target.plugins.filesystem.ntfs.mft import (
+    FilesystemFilenameRecord,
+    FilesystemStdRecord,
+    MftPlugin,
+    macb_aggr,
+)
 from dissect.target.plugins.filesystem.ntfs.mft_timeline import MftTimelinePlugin
 from dissect.target.plugins.filesystem.ntfs.utils import (
     get_drive_letter,
@@ -170,6 +177,40 @@ def test_mft_plugin_entries(target_win, compact):
     assert len(mft_data) == check_output_amount(76, compact)
 
 
+def test_mft_plugin_macb(target_win: Target) -> None:
+    load_mft_plugin(target_win)
+    mft_data = list(target_win.mft(macb=True))
+    path = None
+    ts = None
+    macb = None
+    field = "MACB/MACB/MACB"
+    for record in mft_data:
+        assert record.macb != macb or record.ts != ts or record.path != path
+        for bit in [0, 1, 2, 3, 5, 6, 7, 9, 10, 11, 12]:
+            assert record.macb[bit : bit + 1] in (field[bit : bit + 1], ".")
+        path = record.path
+        macb = record.macb
+        ts = record.ts
+
+
+def test_mft_plugin_macb_nodup() -> None:
+    # test whether you can never have duplicates
+
+    def make_ts(tss: set) -> int:
+        ts = randrange(1, 10)
+        tss.add(ts)
+        return ts
+
+    for _ in range(0, 100):
+        tss = set()
+        records = []
+        for ts_type in ["M", "A", "C", "B"]:
+            records.append(FilesystemStdRecord(path="a.txt", ts=make_ts(tss), ts_type=ts_type))
+            records.append(FilesystemFilenameRecord(path="a.txt", ts=make_ts(tss), ts_type=ts_type, ads=False))
+            records.append(FilesystemFilenameRecord(path="a.txt", ts=make_ts(tss), ts_type=ts_type, ads=True))
+        assert len(list(macb_aggr(records))) == len(tss)
+
+
 def test_mft_plugin_disk_label(target_win):
     load_mft_plugin(target_win)
     target_win.fs.mounts = {"c:": target_win.filesystems[0]}