def __init__(self, data):
attribute_length = int(reverse_hexlify(data[4:8]), 16)
self.data = data[:attribute_length]
def fixup_array_n_entries(self):
return int(reverse_hexlify(self.fixup_array_n_entries_raw), 16)
def mft_mirror_starting_cluster(self):
# Value resembles the amount of clusters from the start of the partition
return int(reverse_hexlify(self.mft_mirror_starting_cluster_raw), 16)
def bytes_per_sector(self):
return int(reverse_hexlify(self.bytes_per_sector_raw), 16)
def flags(self):
return int(reverse_hexlify(self.flags_raw), 16)
def file_reference_to_base_record(self):
return int(reverse_hexlify(self.file_reference_to_base_record_raw), 16)
def attribute_content_initialized_size(self):
return int(
reverse_hexlify(self.attribute_content_initialized_size_raw), 16)
def link_count(self):
return int(reverse_hexlify(self.link_count_raw), 16)
def compression_unit_size(self):
# not checked yet if this is correct. see blz 257
return int(reverse_hexlify(self.compression_unit_size_raw), 16)
def attribute_content_actual_size(self):
return int(reverse_hexlify(self.attribute_content_actual_size_raw), 16)
def runlist_offset(self):
return int(reverse_hexlify(self.runlist_offset_raw), 16)
def runlist_ending_vcn(self):
return int(reverse_hexlify(self.runlist_starting_vcn_raw), 16)
def content_offset(self):
return int(reverse_hexlify(self.content_offset_raw), 16)
def lsn(self):
return int(reverse_hexlify(self.lsn_raw), 16)
def type(self):
return int(reverse_hexlify(self.type_raw), 16)
def sequence_value(self):
return int(reverse_hexlify(self.sequence_value_raw), 16)
def attribute_length(self):
return int(reverse_hexlify(self.attribute_length_raw), 16)
def first_attribute_offset(self):
return int(reverse_hexlify(self.first_attribute_offset_raw), 16)
def non_resident_flag(self):
return int(reverse_hexlify(self.non_resident_flag_raw), 16)
def mft_entry_allocated_size(self):
return int(reverse_hexlify(self.mft_entry_allocated_size_raw), 16)
def name_offset(self):
return int(reverse_hexlify(self.name_offset_raw), 16)
def next_attribute_id(self):
return int(reverse_hexlify(self.next_attribute_id_raw), 16)
def attribute_identifier(self):
return int(reverse_hexlify(self.attribute_identifier_raw), 16)
def serial_number(self):
return reverse_hexlify(self.serial_number_raw).decode()
def fixup_array_offset(self):
return int(reverse_hexlify(self.fixup_array_offset_raw), 16)
def total_number_of_sectors(self):
return int(reverse_hexlify(self.total_number_of_sectors_raw), 16)
def content_size(self):
return int(reverse_hexlify(self.content_size_raw), 16)
