Bases: rawdisk.util.rawstruct.RawStruct
Represents NTFS Bootsector
Bases: rawdisk.util.rawstruct.RawStruct
Bios parameter block.
Bases: object
Represents NTFS Master File Table (MFT)
Bases: rawdisk.util.rawstruct.RawStruct
Represents MFT attribute header.
type (uint): Attribute type. length (uint): Attribute length (including this header). non_resident_flag (ubyte): Non-resident flag (0 - resident, 1 - otherwise). length_of_name (ubyte): If attribute has name, this is name length in bytes. offset_to_name (ushort): Offset to attribute’s name in bytes. attr_name (unicode): Attribuet’s name (if it has one). flags (ushort): The attribute flags (COMPRESSION_MASK (0x00FF), SPARSE (0x8000), ENCRYPTED (0x4000)). identifier (ushort): The unique identifier for this attribute in the file record.
Resident attribute: attr_length (uint): The size of the attribute value, in bytes. attr_offset (ushort): The offset to the value from the start of the attribute record, in bytes. indexed (ubyte): Indexed flag??
Non-resident attribute: lowest_vcn (ulonglong): The lowest virtual cluster number (VCN) covered by this attribute record. highest_vcn (ulonglong): The highest VCN covered by this attribute record. data_run_offset (ushort): The offset to the mapping pairs array from the start of the attribute record, in bytes. comp_unit_size (ushort): Compression unit size = 2 x clusters. 0 implies uncompressed. alloc_size (ulonglong): The allocated size of the file, in bytes. This value is an even multiple of the cluster size. This member is not valid if the LowestVcn member is nonzero. real_size (ulonglong): The file size (highest byte that can be read plus 1), in bytes. This member is not valid if LowestVcn is nonzero. data_size (ulonglong): The valid data length (highest initialized byte plus 1), in bytes. This value is rounded to the nearest cluster boundary. This member is not valid if LowestVcn is nonzero.
Bases: rawdisk.util.rawstruct.RawStruct
Base class for all MFT attributes.
Returns Initialized attribute object based on attr_type (eg. MftAttrStandardInformation)
Bases: rawdisk.plugins.filesystems.ntfs.mft_attribute.MftAttr
Bases: rawdisk.plugins.filesystems.ntfs.mft_attribute.MftAttr
Bases: rawdisk.plugins.filesystems.ntfs.mft_attribute.MftAttr
Bases: rawdisk.plugins.filesystems.ntfs.mft_attribute.MftAttr
Bases: rawdisk.plugins.filesystems.ntfs.mft_attribute.MftAttr
Bases: rawdisk.plugins.filesystems.ntfs.mft_attribute.MftAttr
Bases: rawdisk.plugins.filesystems.ntfs.mft_attribute.MftAttr
Bases: rawdisk.plugins.filesystems.ntfs.mft_attribute.MftAttr
Bases: rawdisk.plugins.filesystems.ntfs.mft_attribute.MftAttr
Bases: rawdisk.plugins.filesystems.ntfs.mft_attribute.MftAttr
Bases: rawdisk.plugins.filesystems.ntfs.mft_attribute.MftAttr
$STANDARD_INFORMATION attribute
Bases: rawdisk.plugins.filesystems.ntfs.mft_attribute.MftAttr
Bases: rawdisk.plugins.filesystems.ntfs.mft_attribute.MftAttr
Bases: rawdisk.util.rawstruct.RawStruct
Represents MFT table entry.
Bases: rawdisk.util.rawstruct.RawStruct
Represents MFT entry header.
Bases: rawdisk.plugins.categories.IFilesystemPlugin
Filesystem plugin for NTFS partition.
Verifies NTFS filesystem signature.
Returns NtfsVolume object.
Registers this plugin with FilesystemDetector as gpt plugin, with type guid {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7} and as mbr plugin with type id 0x07
Bases: rawdisk.filesystems.volume.Volume
Represents NTFS volume.
Loads NTFS volume information