def get_record(self, record_num):
"""
@raises OverrunBufferException: if the record_num is beyond the end of the MFT.
@raises InvalidRecordException: if the record appears invalid (incorrect magic header).
"""
if self._record_cache.exists(record_num):
self._record_cache.touch(record_num)
return self._record_cache.get(record_num)
record_buf = self.get_record_buf(record_num)
if read_dword(record_buf, 0x0) != 0x454C4946:
raise InvalidRecordException("record_num: %d" % record_num)
record = MFTRecord(record_buf, 0, False, inode=record_num)
self._record_cache.insert(record_num, record)
return record
def get_record(self, record_num):
"""
@raises OverrunBufferException: if the record_num is beyond the end of the MFT.
@raises InvalidRecordException: if the record appears invalid (incorrect magic header).
"""
if self._record_cache.exists(record_num):
self._record_cache.touch(record_num)
return self._record_cache.get(record_num)
record_buf = self.get_record_buf(record_num)
if read_dword(record_buf, 0x0) != 0x454C4946:
raise InvalidRecordException("record_num: %d" % record_num)
record = MFTRecord(record_buf, 0, False, inode=record_num)
self._record_cache.insert(record_num, record)
return record
def structure_size(buf, offset, parent):
s = read_dword(buf, offset + 0x4)
return s + (8 - (s % 8))
def structure_size(buf, offset, parent):
return read_dword(buf, offset + 0x8)
def structure_size(buf, offset, parent):
s = read_dword(buf, offset + 0x4)
return s + (8 - (s % 8))
def structure_size(buf, offset, parent):
return read_dword(buf, offset + 0x8)