def mft_altered_time(self):
return reverse_hexlify_int(self.mft_altered_time_raw)
def file_reference_sequence_number(self):
return reverse_hexlify_int(self.file_reference_number_raw[6:8])
def creation_time(self):
return reverse_hexlify_int(self.creation_time_raw)
def __init__(self, data=None, offset_bytes=None):
record_length = reverse_hexlify_int(data[0:4])
self.data = data[0:record_length]
self.offset_bytes = offset_bytes
self.file_attributes_object = FileAttributesFlag(self.file_attributes)
def file_reference_mft_entry(self):
return reverse_hexlify_int(self.file_reference_number_raw[0:6])
def maximum_number_of_versions(self):
return reverse_hexlify_int(self.maximum_number_of_versions_raw)
def class_id(self):
return reverse_hexlify_int(self.class_id_raw)
def source_info(self):
return reverse_hexlify_int(self.source_info_raw)
def security_id(self):
return reverse_hexlify_int(self.security_id_raw)
def timestamp(self):
return reverse_hexlify_int(self.timestamp_raw)
def reason(self):
return reverse_hexlify_int(self.reason_raw)
def usn(self):
return reverse_hexlify_int(self.usn_raw)
def minor_version(self):
return reverse_hexlify_int(self.minor_version_raw)
def record_length(self):
return reverse_hexlify_int(self.record_length_raw)
def file_accessed_time(self):
return reverse_hexlify_int(self.file_accessed_time_raw)
def file_attributes(self):
return reverse_hexlify_int(self.file_attributes_raw)
def flags(self):
return reverse_hexlify_int(self.flags_raw)
def file_name_length(self):
return reverse_hexlify_int(self.file_name_length_raw)
def version_number(self):
return reverse_hexlify_int(self.version_number_raw)
def file_name_offset(self):
return reverse_hexlify_int(self.file_name_offset_raw)
def owner_id(self):
return reverse_hexlify_int(self.owner_id_raw)
def __new__(cls, data, offset_bytes):
major_version = reverse_hexlify_int(data[4:6])
if major_version == 2:
return UsnRecordV2(data, offset_bytes)