INDXParse: Expose script version as module variable

Signed-off-by: Alex Nelson <ajnelson@cs.ucsc.edu>
INDXParse: Insert standard index class in class hierarchy

Signed-off-by: Justin Tracey <j2tracey@gmail.com>
Signed-off-by: Alex Nelson <ajnelson@cs.ucsc.edu>
Signed-off-by: Erik Steggall <esteggall@soe.ucsc.edu>
INDXParse: Upgrade usage check from doc-warning to assertion

A warning in the index entry next() documentation, that has_next()
should be called, may be missed in development.  Instead, an assertion
ensures that has_next() is true before mis-parsings can occur.

Signed-off-by: Justin Tracey <j2tracey@gmail.com>
Signed-off-by: Alex Nelson <ajnelson@cs.ucsc.edu>
Signed-off-by: Erik Steggall <esteggall@soe.ucsc.edu>
INDXParse: Allow for other INDX types in API

Signed-off-by: Justin Tracey <j2tracey@gmail.com>
Signed-off-by: Alex Nelson <ajnelson@cs.ucsc.edu>
Signed-off-by: Erik Steggall <esteggall@soe.ucsc.edu>
INDXParse: Support additional INDX types

NTFS indexes are also used in the file system's security database.
These additional classes parse the index allocation attributes of the
$Secure file. They have been tested on the CFREDS "Hacking" and M57
"Charlie, Nov. 16" file systems, available at:

<http://www.cfreds.nist.gov/Hacking_Case.html>
<http://digitalcorpora.org/corpora/scenarios/m57-patents-scenario>

Signed-off-by: Justin Tracey <j2tracey@gmail.com>
Signed-off-by: Alex Nelson <ajnelson@cs.ucsc.edu>
Signed-off-by: Erik Steggall <esteggall@soe.ucsc.edu>
INDXParse: Use class fields instead of repeating hard-coded values

Signed-off-by: Alex Nelson <ajnelson@cs.ucsc.edu>
Signed-off-by: Justin Tracey <j2tracey@gmail.com>
Signed-off-by: Erik Steggall <esteggall@soe.ucsc.edu>
INDXParse: Fix null block bug

In testing security index additions to INDXParse, the M57 "Terry, Dec.
11 #2" (last image of series, and Windows Vista) file system includes a
solid block of 0-value bytes at the end of a security index, when
extracted with an up-to-date Sleuth Kit icat.  This patch adds a
tolerance check for such a null block, in any NTFX index.

The "Terry" images are available at:

<http://digitalcorpora.org/corpora/scenarios/m57-patents-scenario>

Signed-off-by: Alex Nelson <ajnelson@cs.ucsc.edu>
Signed-off-by: Justin Tracey <j2tracey@gmail.com>
Signed-off-by: Erik Steggall <esteggall@soe.ucsc.edu>
Merge pull request #6 from ajnelson/add_other_indx_types

Add other indx types
fix bug arising when i split out binary parser. make attribute info more understandable in 'info' mode. make argparse slightly more readable
implement ACE structures
cleanup hacky code that tested subclasses
add SDS file structure. cleanup get_all_string method
fix offset bug. make SDS printing faster. format get_all_string method
implement most of the INDEX structs using Block notation.