Esempi in Python per MFTRecord.get_all_string

Esempio n. 1

File: inspect_record.py Progetto: unazed/python-ntfs

def main(record_filename):
    logging.basicConfig(level=logging.DEBUG)
    #logging.getLogger("ntfs.mft").setLevel(logging.INFO)

    with Mmap(record_filename) as buf:
        record = MFTRecord(buf, 0, None)
        print("=== MFT Record Header")
        print(record.get_all_string())

        for attribute in record.attributes():
            print("=== Attribute Header (type: {:s}) at offset {:s}".format(
                Attribute.TYPES[attribute.type()], hex(attribute.offset())))
            print(attribute.get_all_string())

            if attribute.type() == ATTR_TYPE.STANDARD_INFORMATION:
                print("=== STANDARD INFORMATION value")
                si = StandardInformation(attribute.value(), 0, None)
                print(si.get_all_string())

            elif attribute.type() == ATTR_TYPE.FILENAME_INFORMATION:
                print("=== FILENAME INFORMATION value")
                fn = FilenameAttribute(attribute.value(), 0, None)
                print(fn.get_all_string())

Esempio n. 2

File: inspect_record.py Progetto: glassdfir/python-ntfs

def main(record_filename):
    logging.basicConfig(level=logging.DEBUG)
    #logging.getLogger("ntfs.mft").setLevel(logging.INFO)

    with Mmap(record_filename) as buf:
        record = MFTRecord(buf, 0, None)
        print("=== MFT Record Header")
        print(record.get_all_string())

        for attribute in record.attributes():
            print("=== Attribute Header (type: {:s}) at offset {:s}".format(
                Attribute.TYPES[attribute.type()],
                hex(attribute.offset())))
            print(attribute.get_all_string())

            if attribute.type() == ATTR_TYPE.STANDARD_INFORMATION:
                print("=== STANDARD INFORMATION value")
                si = StandardInformation(attribute.value(), 0, None)
                print(si.get_all_string())

            elif attribute.type() == ATTR_TYPE.FILENAME_INFORMATION:
                print("=== FILENAME INFORMATION value")
                fn = FilenameAttribute(attribute.value(), 0, None)
                print(fn.get_all_string())