Skip to content

Commit 1127470

Browse files
williballenthinwilliballenthin
authored
Merge pull request #80 from ajnelson-nist/exercise_tree_mft_py
Exercise `list_mft.py` and `tree_mft.py` with extracted MFT
2 parents 7a83154 + c046457 commit 1127470

15 files changed

+5194
-101
lines changed

‎indxparse/list_mft.py

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ def format_bodyfile(
103103
attributes_text = ""
104104
if len(attributes) > 0:
105105
attributes_text = " (%s)" % (", ".join(attributes))
106-
return "0|%s|%s|0|%d|0|%s|%s|%s|%s|%s\n" % (
106+
return "0|%s|%s|0|%d|0|%s|%s|%s|%s|%s" % (
107107
path + attributes_text,
108108
inode,
109109
owner_id,
@@ -193,7 +193,7 @@ def output_mft_record(
193193
# si
194194
if si:
195195
try:
196-
print(format_bodyfile(path, size, inode, si_index, si, tags), end=" ")
196+
print(format_bodyfile(path, size, inode, si_index, si, tags))
197197
except UnicodeEncodeError:
198198
print("# failed to print: %s" % (list(path)))
199199

@@ -203,7 +203,7 @@ def output_mft_record(
203203
if not record.is_active():
204204
tags.append("inactive")
205205
try:
206-
print(format_bodyfile(path, size, inode, si_index, fn, tags), end=" ")
206+
print(format_bodyfile(path, size, inode, si_index, fn, tags))
207207
except UnicodeEncodeError:
208208
print("# failed to print: %s" % (list(path)))
209209

@@ -217,7 +217,6 @@ def output_mft_record(
217217
format_bodyfile(
218218
path + ":" + ads[0], ads[1], inode, si_index, si or {}, tags
219219
),
220-
end=" ",
221220
)
222221
except UnicodeEncodeError:
223222
print("# failed to print: %s" % (list(path)))
@@ -230,7 +229,6 @@ def output_mft_record(
230229
format_bodyfile(
231230
path + "\\" + indx[0], indx[1], MREF(indx[2]), 0, indx[3], tags
232231
),
233-
end=" ",
234232
)
235233
except UnicodeEncodeError:
236234
print("# failed to print: %s" % (list(path)))
@@ -242,7 +240,6 @@ def output_mft_record(
242240
format_bodyfile(
243241
path + "\\" + indx[0], indx[1], MREF(indx[2]), 0, indx[3], tags
244242
),
245-
end=" ",
246243
)
247244
except UnicodeEncodeError:
248245
print("# failed to print: %s" % (list(path)))

‎tests/Makefile

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,8 @@ all: \
2121

2222
.PHONY: \
2323
all-console_scripts \
24-
all-list_mft
24+
all-list_mft \
25+
all-tree_mft
2526

2627
# TODO: This list of unimplemented tests lines up with setup.cfg.
2728
# * all-INDXParse
@@ -31,18 +32,25 @@ all: \
3132
# * all-extract_mft_record_slack
3233
# * all-fuse-mft
3334
# * all-get_file_info
34-
# * all-tree_mft
3535
all-console_scripts: \
36-
all-list_mft
36+
all-list_mft \
37+
all-tree_mft
3738

3839
all-list_mft:
3940
$(MAKE) \
4041
--directory list_mft
4142

43+
all-tree_mft:
44+
$(MAKE) \
45+
--directory tree_mft
46+
4247
check: \
4348
all
4449

4550
clean:
51+
@$(MAKE) \
52+
--directory tree_mft \
53+
clean
4654
@$(MAKE) \
4755
--directory list_mft \
4856
clean

‎tests/list_mft/7-ntfs-undel.dd.bodyfile

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
0|\\$ORPHAN\$MFT|0|0|256|0|39936|1078084677|1078084677|1078084677|1078084677
2+
0|\\$ORPHAN\$MFT (filename)|0|0|256|0|39936|1078084677|1078084677|1078084677|1078084677
3+
0|\\$ORPHAN\$MFTMirr|1|0|256|0|4096|1078084677|1078084677|1078084677|1078084677
4+
0|\\$ORPHAN\$MFTMirr (filename)|1|0|256|0|4096|1078084677|1078084677|1078084677|1078084677
5+
0|\\$ORPHAN\$LogFile|2|0|256|0|2097152|1078084677|1078084677|1078084677|1078084677
6+
0|\\$ORPHAN\$LogFile (filename)|2|0|256|0|2097152|1078084677|1078084677|1078084677|1078084677
7+
0|\\$ORPHAN\$Volume|3|0|0|0|0|1078084677|1078084677|1078084677|1078084677
8+
0|\\$ORPHAN\$Volume (filename)|3|0|0|0|0|1078084677|1078084677|1078084677|1078084677
9+
0|\\$ORPHAN\$AttrDef|4|0|0|0|2560|1078084677|1078084677|1078084677|1078084677
10+
0|\\$ORPHAN\$AttrDef (filename)|4|0|0|0|2560|1078084677|1078084677|1078084677|1078084677
11+
0|\\|5|0|0|0|0|1078085971|1078085971|1078085971|1078084677
12+
0|\\ (filename)|5|0|0|0|0|1078084677|1078084677|1078084677|1078084677
13+
0|\\$ORPHAN\$Bitmap|6|0|256|0|752|1078084677|1078084677|1078084677|1078084677
14+
0|\\$ORPHAN\$Bitmap (filename)|6|0|256|0|752|1078084677|1078084677|1078084677|1078084677
15+
0|\\$ORPHAN\$Boot|7|0|0|0|8192|1078084677|1078084677|1078084677|1078084677
16+
0|\\$ORPHAN\$Boot (filename)|7|0|0|0|8192|1078084677|1078084677|1078084677|1078084677
17+
0|\\$ORPHAN\$BadClus|8|0|256|0|6160384|1078084677|1078084677|1078084677|1078084677
18+
0|\\$ORPHAN\$BadClus (filename)|8|0|256|0|6160384|1078084677|1078084677|1078084677|1078084677
19+
0|\\$ORPHAN\$BadClus:$Bad|8|0|256|0|6160384|1078084677|1078084677|1078084677|1078084677
20+
0|\\$ORPHAN\$Secure|9|0|257|0|263140|1078084677|1078084677|1078084677|1078084677
21+
0|\\$ORPHAN\$Secure (filename)|9|0|257|0|263140|0|0|0|-62135596800
22+
0|\\$ORPHAN\$Secure:$SDS|9|0|257|0|263140|1078084677|1078084677|1078084677|1078084677
23+
0|\\$ORPHAN\$UpCase|10|0|256|0|131072|1078084677|1078084677|1078084677|1078084677
24+
0|\\$ORPHAN\$UpCase (filename)|10|0|256|0|131072|1078084677|1078084677|1078084677|1078084677
25+
0|\\$ORPHAN\$Extend|11|0|257|0|0|1078084677|1078084677|1078084677|1078084677
26+
0|\\$ORPHAN\$Extend (filename)|11|0|257|0|0|1078084677|1078084677|1078084677|1078084677
27+
0|\\$ORPHAN\$Extend\$ObjId (indx)|0|0|0|0|281474976710681|1078084684|1078084684|1078084684|1078084684
28+
0|\\$ORPHAN\$Extend\$Quota (indx)|0|0|0|0|281474976710680|1078084684|1078084684|1078084684|1078084684
29+
0|\\$ORPHAN\$Extend\$Reparse (indx)|0|0|0|0|281474976710682|1078084684|1078084684|1078084684|1078084684
30+
0|\\??|12|0|0|0|0|1078084677|1078084677|1078084677|1078084677
31+
0|\\??|13|0|0|0|0|1078084677|1078084677|1078084677|1078084677
32+
0|\\??|14|0|0|0|0|1078084677|1078084677|1078084677|1078084677
33+
0|\\??|15|0|0|0|0|1078084677|1078084677|1078084677|1078084677
34+
0|\\$ORPHAN\mult1.dat|32|0|260|0|0|1078084897|1078084897|1078084897|1078084897
35+
0|\\$ORPHAN\mult1.dat (filename)|32|0|260|0|0|1078084897|1078084897|1078084897|1078084897
36+
0|\\$ORPHAN\$MFT|0|0|256|0|39936|1078084677|1078084677|1078084677|1078084677
37+
0|\\$ORPHAN\$MFT (filename)|0|0|256|0|39936|1078084677|1078084677|1078084677|1078084677
38+
0|\\$ORPHAN\$MFTMirr|1|0|256|0|4096|1078084677|1078084677|1078084677|1078084677
39+
0|\\$ORPHAN\$MFTMirr (filename)|1|0|256|0|4096|1078084677|1078084677|1078084677|1078084677
40+
0|\\$ORPHAN\$LogFile|2|0|256|0|2097152|1078084677|1078084677|1078084677|1078084677
41+
0|\\$ORPHAN\$LogFile (filename)|2|0|256|0|2097152|1078084677|1078084677|1078084677|1078084677
42+
0|\\$ORPHAN\$Volume|3|0|0|0|0|1078084677|1078084677|1078084677|1078084677
43+
0|\\$ORPHAN\$Volume (filename)|3|0|0|0|0|1078084677|1078084677|1078084677|1078084677
44+
0|\\$ORPHAN\$Quota|24|0|257|0|0|1078084684|1078084684|1078084684|1078084684
45+
0|\\$ORPHAN\$Quota (filename)|24|0|257|0|0|1078084684|1078084684|1078084684|1078084684
46+
0|\\$ORPHAN\$ObjId|25|0|257|0|0|1078084684|1078084684|1078084684|1078084684
47+
0|\\$ORPHAN\$ObjId (filename)|25|0|257|0|0|1078084684|1078084684|1078084684|1078084684
48+
0|\\$ORPHAN\$ObjId\ (indx)|0|0|0|0|3670048|0|-11560031107|0|0
49+
0|\\$ORPHAN\$Reparse|26|0|257|0|0|1078084684|1078084684|1078084684|1078084684
50+
0|\\$ORPHAN\$Reparse (filename)|26|0|257|0|0|1078084684|1078084684|1078084684|1078084684
51+
0|\\$ORPHAN\System Volume Information|27|0|258|0|0|1078085916|1078084751|1078084751|1078084750
52+
0|\\$ORPHAN\System Volume Information (filename)|27|0|258|0|0|1078084750|1078084750|1078084750|1078084750
53+
0|\\$ORPHAN\System Volume Information\tracking.log (indx)|20480|0|0|0|562949953421340|1078085172|1078085172|1078085172|1078084750
54+
0|\\$ORPHAN\tracking.log|28|0|259|0|20480|1078085172|1078085172|1078085172|1078084750
55+
0|\\$ORPHAN\tracking.log (filename)|28|0|259|0|20480|1078084751|1078084751|1078084751|1078084750
56+
0|\\$ORPHAN\frag1.dat (inactive)|29|0|260|0|1584|1078084840|1078084840|1078084840|1078084817
57+
0|\\$ORPHAN\frag1.dat (filename, inactive)|29|0|260|0|1584|1078084817|1078084817|1078084817|1078084817
58+
0|\\$ORPHAN\frag2.dat (inactive)|30|0|260|0|3873|1078084974|1078084974|1078084974|1078084829
59+
0|\\$ORPHAN\frag2.dat (filename, inactive)|30|0|260|0|3873|1078084829|1078084829|1078084829|1078084829
60+
0|\\$ORPHAN\sing1.dat (inactive)|31|0|260|0|780|1078084884|1078084884|1078084884|1078084884
61+
0|\\$ORPHAN\sing1.dat (filename, inactive)|31|0|260|0|780|1078084884|1078084884|1078084884|1078084884
62+
0|\\$ORPHAN\mult1.dat (inactive)|32|0|260|0|1234|1078084942|1078084942|1078084942|1078084897
63+
0|\\$ORPHAN\mult1.dat (filename, inactive)|32|0|260|0|1234|1078084897|1078084897|1078084897|1078084897
64+
0|\\$ORPHAN\mult1.dat:ADS (inactive)|32|0|260|0|1234|1078084942|1078084942|1078084942|1078084897
65+
0|\\$ORPHAN\dir1 (inactive)|33|0|261|0|0|1078084980|1078084980|1078084980|1078084980
66+
0|\\$ORPHAN\dir1 (filename, inactive)|33|0|261|0|0|1078084980|1078084980|1078084980|1078084980
67+
0|\\$ORPHAN\dir2 (inactive)|34|0|261|0|0|1078084983|1078084983|1078084983|1078084983
68+
0|\\$ORPHAN\dir2 (filename, inactive)|34|0|261|0|0|1078084983|1078084983|1078084983|1078084983
69+
0|\\$ORPHAN\frag3.dat (inactive)|35|0|260|0|2027|1078085029|1078085029|1078085029|1078085004
70+
0|\\$ORPHAN\frag3.dat (filename, inactive)|35|0|260|0|2027|1078085004|1078085004|1078085004|1078085004
71+
0|\\$ORPHAN\mult2.dat (inactive)|36|0|260|0|1715|1078085018|1078085018|1078085018|1078085018
72+
0|\\$ORPHAN\mult2.dat (filename, inactive)|36|0|260|0|1715|1078085018|1078085018|1078085018|1078085018
73+
0|\\$ORPHAN\res1.dat (inactive)|37|0|260|0|0|1078085137|1078085137|1078085137|1078085137
74+
0|\\$ORPHAN\res1.dat (filename, inactive)|37|0|260|0|0|1078085137|1078085137|1078085137|1078085137
75+
0|\\$ORPHAN\sing2.dat (inactive)|38|0|260|0|1005|1078085055|1078085055|1078085055|1078085055
76+
0|\\$ORPHAN\sing2.dat (filename, inactive)|38|0|260|0|1005|1078085055|1078085055|1078085055|1078085055

‎tests/list_mft/out.json renamed to ‎tests/list_mft/7-ntfs-undel.dd.json

File renamed without changes.

‎tests/list_mft/7-ntfs-undel.dd.mft.bodyfile

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
0|\\\$MFT|0|0|256|0|39936|1078084677|1078084677|1078084677|1078084677
2+
0|\\\$MFT (filename)|0|0|256|0|39936|1078084677|1078084677|1078084677|1078084677
3+
0|\\\$MFTMirr|1|0|256|0|4096|1078084677|1078084677|1078084677|1078084677
4+
0|\\\$MFTMirr (filename)|1|0|256|0|4096|1078084677|1078084677|1078084677|1078084677
5+
0|\\\$LogFile|2|0|256|0|2097152|1078084677|1078084677|1078084677|1078084677
6+
0|\\\$LogFile (filename)|2|0|256|0|2097152|1078084677|1078084677|1078084677|1078084677
7+
0|\\\$Volume|3|0|0|0|0|1078084677|1078084677|1078084677|1078084677
8+
0|\\\$Volume (filename)|3|0|0|0|0|1078084677|1078084677|1078084677|1078084677
9+
0|\\\$AttrDef|4|0|0|0|2560|1078084677|1078084677|1078084677|1078084677
10+
0|\\\$AttrDef (filename)|4|0|0|0|2560|1078084677|1078084677|1078084677|1078084677
11+
0|\\|5|0|0|0|0|1078085971|1078085971|1078085971|1078084677
12+
0|\\ (filename)|5|0|0|0|0|1078084677|1078084677|1078084677|1078084677
13+
0|\\\$Bitmap|6|0|256|0|752|1078084677|1078084677|1078084677|1078084677
14+
0|\\\$Bitmap (filename)|6|0|256|0|752|1078084677|1078084677|1078084677|1078084677
15+
0|\\\$Boot|7|0|0|0|8192|1078084677|1078084677|1078084677|1078084677
16+
0|\\\$Boot (filename)|7|0|0|0|8192|1078084677|1078084677|1078084677|1078084677
17+
0|\\\$BadClus|8|0|256|0|6160384|1078084677|1078084677|1078084677|1078084677
18+
0|\\\$BadClus (filename)|8|0|256|0|6160384|1078084677|1078084677|1078084677|1078084677
19+
0|\\\$BadClus:$Bad|8|0|256|0|6160384|1078084677|1078084677|1078084677|1078084677
20+
0|\\\$Secure|9|0|257|0|263140|1078084677|1078084677|1078084677|1078084677
21+
0|\\\$Secure (filename)|9|0|257|0|263140|0|0|0|-62135596800
22+
0|\\\$Secure:$SDS|9|0|257|0|263140|1078084677|1078084677|1078084677|1078084677
23+
0|\\\$UpCase|10|0|256|0|131072|1078084677|1078084677|1078084677|1078084677
24+
0|\\\$UpCase (filename)|10|0|256|0|131072|1078084677|1078084677|1078084677|1078084677
25+
0|\\\$Extend|11|0|257|0|0|1078084677|1078084677|1078084677|1078084677
26+
0|\\\$Extend (filename)|11|0|257|0|0|1078084677|1078084677|1078084677|1078084677
27+
0|\\\$Extend\$ObjId (indx)|0|0|0|0|281474976710681|1078084684|1078084684|1078084684|1078084684
28+
0|\\\$Extend\$Quota (indx)|0|0|0|0|281474976710680|1078084684|1078084684|1078084684|1078084684
29+
0|\\\$Extend\$Reparse (indx)|0|0|0|0|281474976710682|1078084684|1078084684|1078084684|1078084684
30+
0|\\\$Extend\$Quota|24|0|257|0|0|1078084684|1078084684|1078084684|1078084684
31+
0|\\\$Extend\$Quota (filename)|24|0|257|0|0|1078084684|1078084684|1078084684|1078084684
32+
0|\\\$Extend\$ObjId|25|0|257|0|0|1078084684|1078084684|1078084684|1078084684
33+
0|\\\$Extend\$ObjId (filename)|25|0|257|0|0|1078084684|1078084684|1078084684|1078084684
34+
0|\\\$Extend\$ObjId\ (indx)|0|0|0|0|3670048|0|-11560031107|0|0
35+
0|\\\$Extend\$Reparse|26|0|257|0|0|1078084684|1078084684|1078084684|1078084684
36+
0|\\\$Extend\$Reparse (filename)|26|0|257|0|0|1078084684|1078084684|1078084684|1078084684
37+
0|\\\System Volume Information|27|0|258|0|0|1078085916|1078084751|1078084751|1078084750
38+
0|\\\System Volume Information (filename)|27|0|258|0|0|1078084750|1078084750|1078084750|1078084750
39+
0|\\\System Volume Information\tracking.log (indx)|20480|0|0|0|562949953421340|1078085172|1078085172|1078085172|1078084750
40+
0|\\\System Volume Information\tracking.log|28|0|259|0|20480|1078085172|1078085172|1078085172|1078084750
41+
0|\\\System Volume Information\tracking.log (filename)|28|0|259|0|20480|1078084751|1078084751|1078084751|1078084750
42+
0|\\\frag1.dat (inactive)|29|0|260|0|1584|1078084840|1078084840|1078084840|1078084817
43+
0|\\\frag1.dat (filename, inactive)|29|0|260|0|1584|1078084817|1078084817|1078084817|1078084817
44+
0|\\\frag2.dat (inactive)|30|0|260|0|3873|1078084974|1078084974|1078084974|1078084829
45+
0|\\\frag2.dat (filename, inactive)|30|0|260|0|3873|1078084829|1078084829|1078084829|1078084829
46+
0|\\\sing1.dat (inactive)|31|0|260|0|780|1078084884|1078084884|1078084884|1078084884
47+
0|\\\sing1.dat (filename, inactive)|31|0|260|0|780|1078084884|1078084884|1078084884|1078084884
48+
0|\\\mult1.dat (inactive)|32|0|260|0|1234|1078084942|1078084942|1078084942|1078084897
49+
0|\\\mult1.dat (filename, inactive)|32|0|260|0|1234|1078084897|1078084897|1078084897|1078084897
50+
0|\\\mult1.dat:ADS (inactive)|32|0|260|0|1234|1078084942|1078084942|1078084942|1078084897
51+
0|\\\dir1 (inactive)|33|0|261|0|0|1078084980|1078084980|1078084980|1078084980
52+
0|\\\dir1 (filename, inactive)|33|0|261|0|0|1078084980|1078084980|1078084980|1078084980
53+
0|\\$ORPHAN\dir2 (inactive)|34|0|261|0|0|1078084983|1078084983|1078084983|1078084983
54+
0|\\$ORPHAN\dir2 (filename, inactive)|34|0|261|0|0|1078084983|1078084983|1078084983|1078084983
55+
0|\\$ORPHAN\frag3.dat (inactive)|35|0|260|0|2027|1078085029|1078085029|1078085029|1078085004
56+
0|\\$ORPHAN\frag3.dat (filename, inactive)|35|0|260|0|2027|1078085004|1078085004|1078085004|1078085004
57+
0|\\$ORPHAN\mult2.dat (inactive)|36|0|260|0|1715|1078085018|1078085018|1078085018|1078085018
58+
0|\\$ORPHAN\mult2.dat (filename, inactive)|36|0|260|0|1715|1078085018|1078085018|1078085018|1078085018
59+
0|\\\res1.dat (inactive)|37|0|260|0|0|1078085137|1078085137|1078085137|1078085137
60+
0|\\\res1.dat (filename, inactive)|37|0|260|0|0|1078085137|1078085137|1078085137|1078085137
61+
0|\\$ORPHAN\sing2.dat (inactive)|38|0|260|0|1005|1078085055|1078085055|1078085055|1078085055
62+
0|\\$ORPHAN\sing2.dat (filename, inactive)|38|0|260|0|1005|1078085055|1078085055|1078085055|1078085055

0 commit comments

Comments
 (0)