Class NTFS

source code

A class to manage the NTFS filesystem parser.

Instance Methods

__init__(self, address_space, session=None)
x.__init__(...) initializes x; see help(type(x)) for signature

source code

MFTEntryByName(self, path)
Return the MFT entry by traversing the path.

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Properties
Inherited from `object`: `__class__`

Method Details

init(self, address_space, session=None)
(Constructor)

source code

x.__init__(...) initializes x; see help(type(x)) for signature

Overrides: object.__init__: (inherited documentation)

MFTEntryByName(self, path)

source code

Return the MFT entry by traversing the path.

We support both / and \ as path separators. Path matching is case
insensitive.

Raises IOError if path is not found.

Returns:
  a tuple of (path, MFT_ENTRY) where path is the case corrected path.

Class NTFS

__init__(self, address_space, session=None) (Constructor)

MFTEntryByName(self, path)

init(self, address_space, session=None)
(Constructor)