INDXParse: Expose script version as module variable

Signed-off-by: Alex Nelson <ajnelson@cs.ucsc.edu>
INDXParse: Insert standard index class in class hierarchy

Signed-off-by: Justin Tracey <j2tracey@gmail.com>
Signed-off-by: Alex Nelson <ajnelson@cs.ucsc.edu>
Signed-off-by: Erik Steggall <esteggall@soe.ucsc.edu>
INDXParse: Upgrade usage check from doc-warning to assertion

A warning in the index entry next() documentation, that has_next()
should be called, may be missed in development.  Instead, an assertion
ensures that has_next() is true before mis-parsings can occur.

Signed-off-by: Justin Tracey <j2tracey@gmail.com>
Signed-off-by: Alex Nelson <ajnelson@cs.ucsc.edu>
Signed-off-by: Erik Steggall <esteggall@soe.ucsc.edu>
INDXParse: Allow for other INDX types in API

Signed-off-by: Justin Tracey <j2tracey@gmail.com>
Signed-off-by: Alex Nelson <ajnelson@cs.ucsc.edu>
Signed-off-by: Erik Steggall <esteggall@soe.ucsc.edu>
INDXParse: Support additional INDX types

NTFS indexes are also used in the file system's security database.
These additional classes parse the index allocation attributes of the
$Secure file. They have been tested on the CFREDS "Hacking" and M57
"Charlie, Nov. 16" file systems, available at:

<http://www.cfreds.nist.gov/Hacking_Case.html>
<http://digitalcorpora.org/corpora/scenarios/m57-patents-scenario>

Signed-off-by: Justin Tracey <j2tracey@gmail.com>
Signed-off-by: Alex Nelson <ajnelson@cs.ucsc.edu>
Signed-off-by: Erik Steggall <esteggall@soe.ucsc.edu>
INDXParse: Use class fields instead of repeating hard-coded values

Signed-off-by: Alex Nelson <ajnelson@cs.ucsc.edu>
Signed-off-by: Justin Tracey <j2tracey@gmail.com>
Signed-off-by: Erik Steggall <esteggall@soe.ucsc.edu>
INDXParse: Fix null block bug

In testing security index additions to INDXParse, the M57 "Terry, Dec.
11 #2" (last image of series, and Windows Vista) file system includes a
solid block of 0-value bytes at the end of a security index, when
extracted with an up-to-date Sleuth Kit icat.  This patch adds a
tolerance check for such a null block, in any NTFX index.

The "Terry" images are available at:

<http://digitalcorpora.org/corpora/scenarios/m57-patents-scenario>

Signed-off-by: Alex Nelson <ajnelson@cs.ucsc.edu>
Signed-off-by: Justin Tracey <j2tracey@gmail.com>
Signed-off-by: Erik Steggall <esteggall@soe.ucsc.edu>
Merge pull request #6 from ajnelson/add_other_indx_types

Add other indx types