Module Import alias Import alias ImportFrom alias ImportFrom alias ImportFrom alias ImportFrom alias ImportFrom alias ImportFrom alias ImportFrom alias ImportFrom alias ImportFrom alias ImportFrom alias ImportFrom alias ImportFrom alias Assign NameStore Call AttributeLoad NameLoad attr Str ClassDef bases NameLoad body FunctionDef arguments args NameParam NameParam defaults Str body Expr Call AttributeLoad Call NameLoad NameLoad NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad decorator_list FunctionDef arguments args NameParam defaults body Return BinOpMod Str TupleLoad AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr decorator_list decorator_list ClassDef bases NameLoad body Pass decorator_list ClassDef bases NameLoad body Pass decorator_list ClassDef bases NameLoad body Pass decorator_list ClassDef bases NameLoad body Expr Str FunctionDef arguments args NameParam defaults body Raise Call NameLoad decorator_list FunctionDef arguments args NameParam defaults body Expr Str Raise Call NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body Raise Call NameLoad decorator_list FunctionDef arguments args NameParam defaults body Raise Call NameLoad decorator_list decorator_list ClassDef bases NameLoad body FunctionDef arguments args NameParam NameParam defaults body Assign AttributeStore NameLoad attr NameLoad decorator_list FunctionDef arguments args NameParam defaults body Assign NameStore ListLoad For NameStore Call AttributeLoad AttributeLoad NameLoad attr attr body Expr Call AttributeLoad NameLoad attr Call AttributeLoad NameLoad attr Return NameLoad decorator_list FunctionDef arguments args NameParam defaults body Return Call AttributeLoad Call AttributeLoad AttributeLoad NameLoad attr attr attr decorator_list FunctionDef arguments args NameParam defaults body Return Call AttributeLoad Call AttributeLoad AttributeLoad NameLoad attr attr attr decorator_list FunctionDef arguments args NameParam defaults body Return Call AttributeLoad Call AttributeLoad AttributeLoad NameLoad attr attr attr decorator_list FunctionDef arguments args NameParam defaults body Return Call AttributeLoad Call AttributeLoad AttributeLoad NameLoad attr attr attr decorator_list FunctionDef arguments args NameParam defaults body Return Call AttributeLoad Call AttributeLoad AttributeLoad NameLoad attr attr attr decorator_list FunctionDef arguments args NameParam defaults body Return Call AttributeLoad Call AttributeLoad AttributeLoad NameLoad attr attr attr decorator_list FunctionDef arguments args NameParam defaults body Return Call AttributeLoad Call AttributeLoad AttributeLoad NameLoad attr attr attr decorator_list FunctionDef arguments args NameParam defaults body Return Call AttributeLoad Call AttributeLoad AttributeLoad NameLoad attr attr attr decorator_list FunctionDef arguments args NameParam defaults body Return Call AttributeLoad AttributeLoad NameLoad attr attr decorator_list FunctionDef arguments args NameParam defaults body Return Call AttributeLoad AttributeLoad NameLoad attr attr decorator_list FunctionDef arguments args NameParam defaults body If Call AttributeLoad NameLoad attr body Return Num orelse Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr If CompareIsNot NameLoad NameLoad body If CompareEq Call AttributeLoad NameLoad attr Num body Assign NameStore Call NameLoad Call AttributeLoad NameLoad attr orelse Assign NameStore Call AttributeLoad NameLoad attr orelse Assign NameStore Call AttributeLoad Call AttributeLoad AttributeLoad NameLoad attr attr attr Return NameLoad decorator_list decorator_list ClassDef bases NameLoad NameLoad body FunctionDef arguments args NameParam NameParam NameParam defaults body Expr Call AttributeLoad NameLoad attr NameLoad Expr Call AttributeLoad NameLoad attr NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad decorator_list FunctionDef arguments args NameParam defaults body Return Call AttributeLoad Call AttributeLoad AttributeLoad NameLoad attr attr attr decorator_list FunctionDef arguments args NameParam defaults body Return Call AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam defaults body Return BinOpMod Str Call AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad Return SubscriptLoad NameLoad Slice NameLoad BinOpAdd NameLoad NameLoad decorator_list FunctionDef arguments args NameParam defaults body Return Call AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr decorator_list decorator_list ClassDef bases NameLoad body Pass decorator_list ClassDef bases NameLoad body Expr Str FunctionDef arguments args NameParam defaults body Raise Call NameLoad decorator_list FunctionDef arguments args NameParam defaults body Raise Call NameLoad decorator_list FunctionDef arguments args NameParam defaults body Raise Call NameLoad decorator_list FunctionDef arguments args NameParam defaults body Raise Call NameLoad decorator_list FunctionDef arguments args NameParam defaults body Expr Str Raise Call NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Expr Str Raise Call NameLoad decorator_list FunctionDef arguments args NameParam defaults body Raise Call NameLoad decorator_list decorator_list ClassDef bases NameLoad body Pass decorator_list ClassDef bases NameLoad body Pass decorator_list ClassDef bases NameLoad NameLoad body FunctionDef arguments args NameParam NameParam NameParam defaults body Expr Call AttributeLoad NameLoad attr NameLoad Expr Call AttributeLoad NameLoad attr NameLoad NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad decorator_list FunctionDef arguments args NameParam defaults body Return Call AttributeLoad Call AttributeLoad AttributeLoad NameLoad attr attr attr decorator_list FunctionDef arguments args NameParam defaults body Assign NameStore ListLoad For NameStore Call AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr body If Call AttributeLoad NameLoad attr body Expr Call AttributeLoad NameLoad attr Call NameLoad AttributeLoad NameLoad attr NameLoad orelse Expr Call AttributeLoad NameLoad attr Call NameLoad AttributeLoad NameLoad attr NameLoad Return NameLoad decorator_list FunctionDef arguments args NameParam defaults body Return Call NameLoad Lambda arguments args NameParam defaults Call NameLoad NameLoad NameLoad Call AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam defaults body Return Call NameLoad Lambda arguments args NameParam defaults Call NameLoad NameLoad NameLoad Call AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam defaults body Return Call AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam defaults body Return BinOpMod Str Call AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam NameParam defaults body Assign NameStore Call AttributeLoad NameLoad attr For NameStore Call AttributeLoad NameLoad attr body If CompareGt Call NameLoad Call AttributeLoad NameLoad attr Num body Expr Call AttributeLoad NameLoad attr Str Call AttributeLoad NameLoad attr Call AttributeLoad NameLoad attr For NameStore Call AttributeLoad NameLoad attr body If CompareEq NameLoad Call AttributeLoad NameLoad attr body Return NameLoad Raise Call NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Expr Str If CompareIn Str NameLoad body If CompareIn Str NameLoad body Raise Call NameLoad NameLoad Return Call AttributeLoad NameLoad attr Str orelse If CompareIn Str NameLoad body If CompareIn Str NameLoad body Raise Call NameLoad NameLoad Return Call AttributeLoad NameLoad attr Str orelse Return TupleLoad NameLoad Str Str decorator_list FunctionDef arguments args NameParam NameParam defaults body Expr Call AttributeLoad NameLoad attr Str NameLoad Assign TupleStore NameStore NameStore NameStore Call AttributeLoad NameLoad attr NameLoad If CompareEq NameLoad Str body Return Call AttributeLoad NameLoad attr NameLoad orelse If CompareEq NameLoad Str body Return NameLoad Assign NameStore Call AttributeLoad NameLoad attr NameLoad If UnaryOpNot Call NameLoad NameLoad NameLoad body Raise Call NameLoad Return Call AttributeLoad NameLoad attr NameLoad decorator_list FunctionDef arguments args NameParam defaults body Return Call AttributeLoad AttributeLoad NameLoad attr attr AttributeLoad NameLoad attr decorator_list decorator_list ClassDef bases NameLoad body Expr Str FunctionDef arguments args NameParam defaults body Raise Call NameLoad decorator_list decorator_list ClassDef bases NameLoad body FunctionDef arguments args NameParam NameParam defaults body Expr Call AttributeLoad Call NameLoad NameLoad NameLoad attr NameLoad Num Expr Call AttributeLoad NameLoad attr Str Str keyword Num keyword Num Expr Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad NameLoad attr Str Str keyword Num Expr Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad NameLoad attr Str Str keyword Num Expr Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad NameLoad attr Str Str Expr Call AttributeLoad NameLoad attr Str Str keyword Num Expr Call AttributeLoad NameLoad attr Str Str decorator_list decorator_list ClassDef bases NameLoad body Expr Str FunctionDef arguments args NameParam NameParam NameParam defaults body Expr Call AttributeLoad Call NameLoad NameLoad NameLoad attr Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Return SubscriptLoad AttributeLoad NameLoad attr Slice BinOpMult NameLoad AttributeLoad NameLoad attr BinOpMult BinOpAdd NameLoad Num AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body Return SubscriptLoad AttributeLoad NameLoad attr Slice BinOpMult NameLoad AttributeLoad NameLoad attr BinOpMult NameLoad AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam defaults body Return BinOpDiv Call NameLoad AttributeLoad NameLoad attr AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam defaults body Return AttributeLoad NameLoad attr decorator_list decorator_list Assign NameStore Num Assign NameStore Num Assign NameStore Num Assign NameStore Num Assign NameStore Num Assign NameStore Num Assign NameStore Num Assign NameStore Num Assign NameStore Num Assign NameStore Num Assign NameStore Num Assign NameStore Num Assign NameStore Num Assign NameStore Num Assign NameStore Num Assign NameStore Num Assign NameStore Num ClassDef bases NameLoad body Expr Str Assign NameStore NameLoad FunctionDef arguments args NameParam NameParam NameParam defaults body Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr ListComp TupleLoad NameLoad NameLoad comprehension TupleStore NameStore NameStore Call AttributeLoad AttributeLoad NameLoad attr attr Assign AttributeStore NameLoad attr NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Assign NameStore Num If CompareLt NameLoad Num body Assign NameStore BinOpAdd Call NameLoad NameLoad NameLoad For TupleStore NameStore NameStore AttributeLoad NameLoad attr body Assign NameStore BinOpMult NameLoad Call AttributeLoad AttributeLoad NameLoad attr attr If CompareLtELt NameLoad NameLoad BinOpAdd NameLoad NameLoad body Assign NameStore BinOpSub NameLoad NameLoad Assign NameStore SubscriptLoad AttributeLoad NameLoad attr Index NameLoad Return SubscriptLoad NameLoad Index NameLoad AugAssignAdd NameStore NameLoad Raise Call NameLoad BinOpMod Str TupleLoad NameLoad Call NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam NameParam defaults body Expr Str Assign NameStore ListLoad Assign NameStore Num Assign NameStore NameLoad Expr Call AttributeLoad NameLoad attr Str Call NameLoad NameLoad Call NameLoad NameLoad If CompareEq NameLoad AttributeLoad NameLoad attr body Assign NameStore Call NameLoad NameLoad If CompareLt NameLoad Num body Assign NameStore BinOpAdd Call NameLoad NameLoad NameLoad If CompareLt NameLoad Num body Assign NameStore BinOpAdd Call NameLoad NameLoad NameLoad If CompareGt Call NameLoad NameLoad NameLoad Call NameLoad NameLoad body Raise Call NameLoad BinOpMod Str TupleLoad NameLoad NameLoad Call NameLoad NameLoad For TupleStore NameStore NameStore AttributeLoad NameLoad attr body Expr Call AttributeLoad NameLoad attr Str Call NameLoad BinOpMult NameLoad Call AttributeLoad AttributeLoad NameLoad attr attr Call NameLoad BinOpMult NameLoad Call AttributeLoad AttributeLoad NameLoad attr attr Assign NameStore BinOpMult NameLoad Call AttributeLoad AttributeLoad NameLoad attr attr If UnaryOpNot NameLoad body If CompareLtELt NameLoad NameLoad BinOpAdd NameLoad NameLoad body If CompareLtE NameLoad BinOpAdd NameLoad NameLoad body Assign NameStore BinOpSub NameLoad NameLoad Assign NameStore BinOpSub NameLoad NameLoad Assign NameStore SubscriptLoad AttributeLoad NameLoad attr Slice NameLoad BinOpAdd NameLoad NameLoad Return SubscriptLoad NameLoad Slice NameLoad NameLoad orelse Assign NameStore BinOpSub NameLoad NameLoad Assign NameStore SubscriptLoad AttributeLoad NameLoad attr Index NameLoad Expr Call AttributeLoad NameLoad attr SubscriptLoad NameLoad Slice NameLoad orelse If CompareLtELt NameLoad NameLoad BinOpAdd NameLoad NameLoad body Assign NameStore BinOpSub NameLoad NameLoad Assign NameStore SubscriptLoad AttributeLoad NameLoad attr Slice NameLoad BinOpAdd NameLoad NameLoad Expr Call AttributeLoad NameLoad attr SubscriptLoad NameLoad Slice NameLoad Return Call AttributeLoad Str attr NameLoad orelse Assign NameStore SubscriptLoad AttributeLoad NameLoad attr Index NameLoad Expr Call AttributeLoad NameLoad attr NameLoad AugAssignAdd NameStore NameLoad Return Call AttributeLoad Str attr NameLoad decorator_list FunctionDef arguments args NameParam defaults body If CompareIsNot AttributeLoad NameLoad attr NameLoad body Return AttributeLoad NameLoad attr Assign NameStore Num For TupleStore NameStore NameStore AttributeLoad NameLoad attr body Expr Call AttributeLoad NameLoad attr Str Call NameLoad NameLoad Call NameLoad NameLoad AugAssignAdd NameStore BinOpMult NameLoad Call AttributeLoad AttributeLoad NameLoad attr attr Assign AttributeStore NameLoad attr NameLoad Return NameLoad decorator_list decorator_list ClassDef bases NameLoad body FunctionDef arguments args NameParam NameParam NameParam defaults NameLoad body Expr Call AttributeLoad Call NameLoad NameLoad NameLoad attr Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr NameLoad Assign AttributeStore NameLoad attr Call NameLoad AttributeLoad NameLoad attr If CompareIsNot NameLoad NameLoad body Assign AttributeStore NameLoad attr NameLoad orelse Assign AttributeStore NameLoad attr BinOpMult Call AttributeLoad AttributeLoad NameLoad attr attr Call AttributeLoad AttributeLoad NameLoad attr attr Assign AttributeStore NameLoad attr Call NameLoad AttributeLoad NameLoad attr AttributeLoad NameLoad attr Assign AttributeStore NameLoad attr Call AttributeLoad NameLoad attr Str TryExcept body Assign NameStore Call AttributeLoad NameLoad attr Assign NameStore SubscriptLoad NameLoad Index Num handlers ExceptHandler type NameLoad name NameStore body Expr Call AttributeLoad NameLoad attr Str NameLoad TryExcept body Assign NameStore Call AttributeLoad NameLoad attr Assign NameStore SubscriptLoad NameLoad Index Num handlers ExceptHandler type NameLoad name NameStore body Expr Call AttributeLoad NameLoad attr Str NameLoad Raise Call NameLoad Str If CompareGt Call NameLoad NameLoad BinOpMult BinOpMult Num Num Num body Assign AttributeStore NameLoad attr NameLoad orelse Assign AttributeStore NameLoad attr SubscriptLoad NameLoad Slice Assign AttributeStore NameLoad attr Call NameLoad AttributeLoad NameLoad attr TryExcept body Assign NameStore Call AttributeLoad NameLoad attr NameLoad handlers ExceptHandler type NameLoad body Expr Call AttributeLoad NameLoad attr Str Raise Call NameLoad Str decorator_list FunctionDef arguments args NameParam NameParam defaults body If CompareEq Call AttributeLoad NameLoad attr Num body Return Call AttributeLoad NameLoad attr orelse Return Call NameLoad AttributeLoad NameLoad attr Call AttributeLoad NameLoad attr decorator_list FunctionDef arguments args NameParam defaults body Expr Call AttributeLoad NameLoad attr Str Call NameLoad BinOpMult Call AttributeLoad AttributeLoad NameLoad attr attr Num Assign NameStore SubscriptLoad AttributeLoad NameLoad attr Index Call AttributeLoad AttributeLoad NameLoad attr attr Assign NameStore Call NameLoad NameLoad Num NameLoad keyword NameLoad Assign NameStore Call AttributeLoad NameLoad attr Return Call AttributeLoad NameLoad attr NameLoad decorator_list FunctionDef arguments args NameParam defaults body Expr Call AttributeLoad NameLoad attr Str Call NameLoad BinOpMult Call AttributeLoad AttributeLoad NameLoad attr attr Num Assign NameStore SubscriptLoad AttributeLoad NameLoad attr Index Call AttributeLoad AttributeLoad NameLoad attr attr Assign NameStore Call NameLoad NameLoad BinOpMult NameLoad NameLoad NameLoad keyword NameLoad Assign NameStore Call AttributeLoad NameLoad attr Return Call AttributeLoad NameLoad attr NameLoad decorator_list FunctionDef arguments args NameParam defaults body Return Call NameLoad NameLoad Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Expr Call AttributeLoad NameLoad attr Str NameLoad Return Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Return Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Expr Str If CompareEq Call AttributeLoad NameLoad attr Num body Raise Call NameLoad Str Assign NameStore Call AttributeLoad NameLoad attr If UnaryOpNot NameLoad body Raise Call NameLoad Str Assign NameStore Call NameLoad Call AttributeLoad NameLoad attr Assign NameStore Call NameLoad Call AttributeLoad NameLoad attr TryExcept body Assign NameStore Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad handlers ExceptHandler type TupleLoad AttributeLoad NameLoad attr NameLoad body Raise Call NameLoad Str If CompareNotEq Call AttributeLoad NameLoad attr NameLoad body Raise Call NameLoad Str Return Call NameLoad NameLoad NameLoad decorator_list FunctionDef arguments args NameParam NameParam defaults body Assign NameStore Dict If UnaryOpNot Call AttributeLoad NameLoad attr body Return Call AttributeLoad NameLoad attr TryExcept body Assign NameStore Call AttributeLoad NameLoad attr AttributeLoad NameLoad attr Assign NameStore Call NameLoad Call AttributeLoad NameLoad attr NameLoad Num Assign NameStore NameLoad For NameStore Call AttributeLoad NameLoad attr body For NameStore Call AttributeLoad Call AttributeLoad NameLoad attr attr body Assign NameStore Call NameLoad Call AttributeLoad Call AttributeLoad NameLoad attr attr If BoolOpAnd CompareEq NameLoad NameLoad CompareEq Call AttributeLoad Call AttributeLoad NameLoad attr attr Str body Continue Assign SubscriptStore NameLoad Index NameLoad Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad handlers ExceptHandler type NameLoad body Assign NameStore Call AttributeLoad NameLoad attr AttributeLoad NameLoad attr Assign NameStore Call NameLoad Call AttributeLoad NameLoad attr NameLoad Num Assign NameStore NameLoad For NameStore Call AttributeLoad Call AttributeLoad NameLoad attr attr body Assign NameStore Call NameLoad Call AttributeLoad Call AttributeLoad NameLoad attr attr If BoolOpAnd CompareEq NameLoad NameLoad CompareEq Call AttributeLoad Call AttributeLoad NameLoad attr attr Str body Continue Assign SubscriptStore NameLoad Index NameLoad Call AttributeLoad AttributeLoad NameLoad attr attr NameLoad Return Call AttributeLoad NameLoad attr decorator_list decorator_list FunctionDef arguments args defaults body Import alias ImportFrom alias ImportFrom alias ImportFrom alias Expr Call AttributeLoad NameLoad attr keyword AttributeLoad NameLoad attr With Call NameLoad SubscriptLoad AttributeLoad NameLoad attr Index Num NameStore body Assign NameStore Call NameLoad NameLoad Call NameLoad SubscriptLoad AttributeLoad NameLoad attr Index Num Assign NameStore Call NameLoad NameLoad Assign NameStore Call AttributeLoad NameLoad attr Expr Call AttributeLoad NameLoad attr Str NameLoad For NameStore Call AttributeLoad NameLoad attr body Expr Call AttributeLoad NameLoad attr Str Call AttributeLoad NameLoad attr Assign NameStore Call AttributeLoad NameLoad attr Str Expr Call AttributeLoad NameLoad attr Str NameLoad decorator_list If CompareEq NameLoad Str body Expr Call NameLoad
N/A N/A sys N/A logging ntfs.BinaryParser hex_dump ntfs.BinaryParser Block ntfs.BinaryParser OverrunBufferException ntfs.mft.MFT MREF ntfs.mft.MFT MSEQNO ntfs.mft.MFT MFTRecord ntfs.mft.MFT ATTR_TYPE ntfs.mft.MFT INDEX_ROOT ntfs.mft.MFT MFTEnumerator ntfs.mft.MFT MFT_RECORD_SIZE ntfs.mft.MFT INDEX_ALLOCATION ntfs.mft.MFT AttributeNotFoundError N/A g_logger N/A N/A logging getLogger ntfs.filesystem FileSystemError N/A Exception N/A __init__ N/A N/A self msg N/A no details N/A N/A N/A N/A N/A super FileSystemError self __init__ self N/A N/A self _msg msg N/A __str__ N/A N/A self N/A N/A N/A N/A %s(%s) N/A N/A N/A self __class__ __name__ N/A self _msg N/A N/A CorruptNTFSFilesystemError N/A FileSystemError N/A N/A N/A NoParentError N/A FileSystemError N/A N/A N/A UnsupportedPathError N/A FileSystemError N/A N/A N/A File N/A object N/A N/A 
    interface
     get_name N/A N/A self N/A N/A N/A N/A NotImplementedError N/A get_parent_directory N/A N/A self N/A N/A N/A 
        @raise NoParentError:
         N/A N/A NotImplementedError N/A read N/A N/A self offset length N/A N/A N/A N/A NotImplementedError N/A get_full_path N/A N/A self N/A N/A N/A N/A NotImplementedError N/A N/A NTFSFileMetadataMixin N/A object N/A __init__ N/A N/A self record N/A N/A N/A N/A self _record record N/A get_filenames N/A N/A self N/A N/A N/A ret N/A N/A fn N/A N/A N/A self _record filename_informations N/A N/A N/A N/A ret append N/A N/A fn filename N/A ret N/A get_si_created_timestamp N/A N/A self N/A N/A N/A N/A N/A N/A N/A N/A self _record standard_information created_time N/A get_si_accessed_timestamp N/A N/A self N/A N/A N/A N/A N/A N/A N/A N/A self _record standard_information accessed_time N/A get_si_changed_timestamp N/A N/A self N/A N/A N/A N/A N/A N/A N/A N/A self _record standard_information changed_time N/A get_si_modified_timestamp N/A N/A self N/A N/A N/A N/A N/A N/A N/A N/A self _record standard_information modified_time N/A get_fn_created_timestamp N/A N/A self N/A N/A N/A N/A N/A N/A N/A N/A self _record filename_information created_time N/A get_fn_accessed_timestamp N/A N/A self N/A N/A N/A N/A N/A N/A N/A N/A self _record filename_information accessed_time N/A get_fn_changed_timestamp N/A N/A self N/A N/A N/A N/A N/A N/A N/A N/A self _record filename_information changed_time N/A get_fn_modified_timestamp N/A N/A self N/A N/A N/A N/A N/A N/A N/A N/A self _record filename_information modified_time N/A is_file N/A N/A self N/A N/A N/A N/A N/A N/A self _record is_file N/A is_directory N/A N/A self N/A N/A N/A N/A N/A N/A self _record is_directory N/A get_size N/A N/A self N/A N/A N/A N/A N/A self is_directory N/A N/A 0 N/A N/A data_attribute N/A N/A N/A self _record data_attribute N/A N/A data_attribute None N/A N/A N/A N/A N/A data_attribute non_resident 0 N/A N/A size N/A len N/A N/A data_attribute value N/A N/A size N/A N/A data_attribute data_size N/A N/A size N/A N/A N/A N/A N/A self _record filename_information logical_size N/A size N/A N/A NTFSFile N/A File NTFSFileMetadataMixin N/A __init__ N/A N/A self filesystem mft_record N/A N/A N/A N/A N/A File __init__ self N/A N/A N/A NTFSFileMetadataMixin __init__ self mft_record N/A N/A self _fs filesystem N/A N/A self _record mft_record N/A get_name N/A N/A self N/A N/A N/A N/A N/A N/A N/A N/A self _record filename_information filename N/A get_parent_directory N/A N/A self N/A N/A N/A N/A N/A N/A self _fs get_record_parent N/A self _record N/A __str__ N/A N/A self N/A N/A N/A N/A File(name: %s) N/A N/A self get_name N/A read N/A N/A self offset length N/A N/A N/A data_attribute N/A N/A N/A self _record data_attribute N/A data N/A N/A N/A self _fs get_attribute_data data_attribute N/A N/A data N/A offset N/A offset length N/A get_full_path N/A N/A self N/A N/A N/A N/A N/A N/A self _fs get_record_path N/A self _record N/A N/A ChildNotFoundError N/A Exception N/A N/A N/A Directory N/A object N/A N/A 
    interface
     get_name N/A N/A self N/A N/A N/A N/A NotImplementedError N/A get_children N/A N/A self N/A N/A N/A N/A NotImplementedError N/A get_files N/A N/A self N/A N/A N/A N/A NotImplementedError N/A get_directories N/A N/A self N/A N/A N/A N/A NotImplementedError N/A get_parent_directory N/A N/A self N/A N/A N/A 
        @raise NoParentError:
         N/A N/A NotImplementedError N/A get_child N/A N/A self name N/A N/A N/A 
        @raise ChildNotFoundError: if the given filename is not found.
         N/A N/A NotImplementedError N/A get_full_path N/A N/A self N/A N/A N/A N/A NotImplementedError N/A N/A PathDoesNotExistError N/A Exception N/A N/A N/A DirectoryDoesNotExistError N/A PathDoesNotExistError N/A N/A N/A NTFSDirectory N/A Directory NTFSFileMetadataMixin N/A __init__ N/A N/A self filesystem mft_record N/A N/A N/A N/A N/A Directory __init__ self N/A N/A N/A NTFSFileMetadataMixin __init__ self mft_record N/A N/A self _fs filesystem N/A N/A self _record mft_record N/A get_name N/A N/A self N/A N/A N/A N/A N/A N/A N/A N/A self _record filename_information filename N/A get_children N/A N/A self N/A N/A N/A ret N/A N/A child N/A N/A N/A self _fs get_record_children N/A self _record N/A N/A N/A N/A child is_directory N/A N/A N/A N/A ret append N/A NTFSDirectory N/A self _fs child N/A N/A N/A N/A ret append N/A NTFSFile N/A self _fs child N/A ret N/A get_files N/A N/A self N/A N/A N/A N/A filter N/A N/A N/A c N/A N/A isinstance c NTFSFile N/A N/A self get_children N/A get_directories N/A N/A self N/A N/A N/A N/A filter N/A N/A N/A c N/A N/A isinstance c NTFSDirectory N/A N/A self get_children N/A get_parent_directory N/A N/A self N/A N/A N/A N/A N/A N/A self _fs get_record_parent N/A self _record N/A __str__ N/A N/A self N/A N/A N/A N/A Directory(name: %s) N/A N/A self get_name N/A get_child N/A N/A self name N/A N/A N/A name_lower N/A N/A name lower N/A child N/A N/A self get_children N/A N/A N/A N/A len N/A N/A child get_filenames 1 N/A N/A N/A N/A g_logger debug file names: %s -> %s N/A N/A child get_name N/A N/A child get_filenames N/A fn N/A N/A child get_filenames N/A N/A N/A name_lower N/A N/A fn lower N/A N/A child N/A N/A ChildNotFoundError N/A _split_path N/A N/A self path N/A N/A N/A 
        Hack to try to support both types of file system paths:
          - forward slash, /etc
          - backslash, C:\windows\system32

        Linux uses forward slashes, so we'd like that when working with FUSE.
        The original file system used backslashes, so we'd also like that.

        This is a poor attempt at doing both:
          - detect which slash type is in use
          - don't support both at the same time

        This works like string.partition(PATH_SEPARATOR)
         N/A N/A \ path N/A N/A N/A / path N/A N/A N/A UnsupportedPathError path N/A N/A N/A path partition \ N/A N/A N/A / path N/A N/A N/A \ path N/A N/A N/A UnsupportedPathError path N/A N/A N/A path partition / N/A N/A N/A path N/A get_path_entry N/A N/A self path N/A N/A N/A N/A N/A g_logger debug get_path_entry: path: %s path N/A N/A imm slash rest N/A N/A self _split_path path N/A N/A slash N/A N/A N/A N/A self get_child path N/A N/A N/A rest N/A N/A self N/A child N/A N/A self get_child imm N/A N/A N/A isinstance child NTFSDirectory N/A N/A N/A DirectoryDoesNotExistError N/A N/A N/A child get_path_entry rest N/A get_full_path N/A N/A self N/A N/A N/A N/A N/A N/A self _fs get_record_path N/A self _record N/A N/A Filesystem N/A object N/A N/A 
    interface
     get_root_directory N/A N/A self N/A N/A N/A N/A NotImplementedError N/A N/A NTFSVBR N/A Block N/A __init__ N/A N/A self volume N/A N/A N/A N/A N/A N/A super NTFSVBR self __init__ volume 0 N/A N/A N/A self declare_field byte jump offset 0 count 3 N/A N/A N/A self declare_field qword oem_id N/A N/A N/A self declare_field word bytes_per_sector N/A N/A N/A self declare_field byte sectors_per_cluster N/A N/A N/A self declare_field word reserved_sectors N/A N/A N/A self declare_field byte zero0 count 3 N/A N/A N/A self declare_field word unused0 N/A N/A N/A self declare_field byte media_descriptor N/A N/A N/A self declare_field word zero1 N/A N/A N/A self declare_field word sectors_per_track N/A N/A N/A self declare_field word number_of_heads N/A N/A N/A self declare_field dword hidden_sectors N/A N/A N/A self declare_field dword unused1 N/A N/A N/A self declare_field dword unused2 N/A N/A N/A self declare_field qword total_sectors N/A N/A N/A self declare_field qword mft_lcn N/A N/A N/A self declare_field qword mftmirr_lcn N/A N/A N/A self declare_field dword clusters_per_file_record_segment N/A N/A N/A self declare_field byte clusters_per_index_buffer N/A N/A N/A self declare_field byte unused3 count 3 N/A N/A N/A self declare_field qword volume_serial_number N/A N/A N/A self declare_field dword checksum N/A N/A N/A self declare_field byte bootstrap_code count 426 N/A N/A N/A self declare_field word end_of_sector N/A N/A ClusterAccessor N/A object N/A N/A 
    index volume data using `cluster_size` units
     __init__ N/A N/A self volume cluster_size N/A N/A N/A N/A N/A N/A super ClusterAccessor self __init__ N/A N/A self _volume volume N/A N/A self _cluster_size cluster_size N/A __getitem__ N/A N/A self index N/A N/A N/A N/A N/A self _volume N/A N/A index N/A self _cluster_size N/A N/A index 1 N/A self _cluster_size N/A __getslice__ N/A N/A self start end N/A N/A N/A N/A N/A self _volume N/A N/A start N/A self _cluster_size N/A end N/A self _cluster_size N/A __len__ N/A N/A self N/A N/A N/A N/A N/A len N/A self _volume N/A self _cluster_size N/A get_cluster_size N/A N/A self N/A N/A N/A N/A self _cluster_size N/A N/A N/A INODE_MFT 0 N/A INODE_MFTMIRR 1 N/A INODE_LOGFILE 2 N/A INODE_VOLUME 3 N/A INODE_ATTR_DEF 4 N/A INODE_ROOT 5 N/A INODE_BITMAP 6 N/A INODE_BOOT 7 N/A INODE_BADCLUS 8 N/A INODE_SECURE 9 N/A INODE_UPCASE 10 N/A INODE_EXTEND 11 N/A INODE_RESERVED0 12 N/A INODE_RESERVED1 13 N/A INODE_RESERVED2 14 N/A INODE_RESERVED3 15 N/A INODE_FIRST_USER 16 NonResidentAttributeData N/A object N/A N/A 
    expose a potentially non-continuous set of data runs as a single
      logical buffer

    once constructed, use this like a bytestring.
    you can unpack from it, slice it, etc.

    implementation note: this is likely a good place to optimize
     N/A __unpackable__ True __init__ N/A N/A self clusters runlist N/A N/A N/A N/A self _clusters clusters N/A N/A self _runlist runlist N/A N/A self _runentries N/A N/A a b N/A N/A a b N/A N/A N/A self _runlist runs N/A N/A self _len None N/A __getitem__ N/A N/A self index N/A N/A N/A current_run_start_offset 0 N/A N/A index 0 N/A N/A index N/A N/A len self index N/A N/A cluster_offset num_clusters N/A self _runentries N/A N/A run_length N/A num_clusters N/A N/A N/A self _clusters get_cluster_size N/A N/A current_run_start_offset index N/A current_run_start_offset run_length N/A N/A i N/A index current_run_start_offset N/A cluster N/A N/A self _clusters N/A cluster_offset N/A N/A cluster N/A i N/A current_run_start_offset run_length N/A N/A IndexError N/A %d is greater than the non resident attribute data length %s N/A index N/A len self N/A __getslice__ N/A N/A self start end N/A N/A N/A 
        TODO: there are some pretty bad inefficiencies here, i believe
         N/A ret N/A N/A current_run_start_offset 0 N/A have_found_start False N/A N/A N/A g_logger debug NonResidentAttributeData: getslice: start: %s end: %s N/A hex start N/A hex end N/A N/A end N/A sys maxint N/A N/A end N/A len self N/A N/A end 0 N/A N/A end N/A N/A len self end N/A N/A start 0 N/A N/A start N/A N/A len self start N/A N/A N/A max start end N/A len self N/A N/A N/A IndexError N/A (%d, %d) is greater than the non resident attribute data length %s N/A start end N/A len self N/A N/A cluster_offset num_clusters N/A self _runentries N/A N/A N/A N/A g_logger debug NonResidentAttributeData: getslice: runentry: start: %s len: %s N/A hex N/A cluster_offset N/A N/A N/A self _clusters get_cluster_size N/A hex N/A num_clusters N/A N/A N/A self _clusters get_cluster_size N/A run_length N/A num_clusters N/A N/A N/A self _clusters get_cluster_size N/A N/A have_found_start N/A N/A N/A current_run_start_offset start N/A current_run_start_offset run_length N/A N/A N/A end N/A current_run_start_offset run_length N/A N/A i N/A start current_run_start_offset N/A j N/A end current_run_start_offset N/A cluster N/A N/A self _clusters N/A cluster_offset N/A cluster_offset num_clusters N/A N/A cluster N/A i j N/A N/A i N/A start current_run_start_offset N/A cluster N/A N/A self _clusters N/A cluster_offset N/A N/A N/A ret append N/A cluster N/A i N/A N/A N/A current_run_start_offset end N/A current_run_start_offset run_length N/A N/A j N/A end current_run_start_offset N/A cluster N/A N/A self _clusters N/A cluster_offset N/A cluster_offset num_clusters N/A N/A N/A ret append N/A cluster N/A j N/A N/A N/A join ret N/A N/A cluster N/A N/A self _clusters N/A cluster_offset N/A N/A N/A ret append cluster N/A current_run_start_offset run_length N/A N/A N/A join ret N/A __len__ N/A N/A self N/A N/A N/A N/A N/A self _len None N/A N/A N/A self _len N/A ret 0 N/A N/A cluster_start num_clusters N/A self _runentries N/A N/A N/A N/A g_logger debug NonResidentAttributeData: len: run: cluster: %s len: %s N/A hex cluster_start N/A hex num_clusters N/A ret N/A num_clusters N/A N/A N/A self _clusters get_cluster_size N/A N/A self _len ret N/A ret N/A N/A NTFSFilesystem N/A object N/A __init__ N/A N/A self volume cluster_size N/A None N/A N/A N/A N/A N/A super NTFSFilesystem self __init__ N/A N/A self _volume volume N/A N/A self _cluster_size cluster_size N/A N/A self _vbr N/A NTFSVBR N/A self _volume N/A N/A cluster_size None N/A N/A N/A self _cluster_size cluster_size N/A N/A N/A self _cluster_size N/A N/A N/A N/A self _vbr bytes_per_sector N/A N/A N/A self _vbr sectors_per_cluster N/A N/A self _clusters N/A ClusterAccessor N/A self _volume N/A self _cluster_size N/A N/A self _logger N/A N/A logging getLogger NTFSFilesystem N/A N/A N/A b N/A N/A self get_mft_buffer N/A _ N/A b N/A -1 N/A N/A N/A OverrunBufferException N/A e N/A N/A N/A N/A g_logger warning failed to read MFT from image, will fall back to MFTMirr: %s e N/A N/A N/A b N/A N/A self get_mftmirr_buffer N/A _ N/A b N/A -1 N/A N/A N/A OverrunBufferException N/A e N/A N/A N/A N/A g_logger error failed to read MFTMirr from image: %s e N/A N/A CorruptNTFSFilesystemError failed to read MFT or MFTMirr from image N/A N/A N/A len b N/A N/A 1024 1024 500 N/A N/A N/A self _mft_data b N/A N/A N/A self _mft_data N/A b N/A N/A N/A self _enumerator N/A MFTEnumerator N/A self _mft_data N/A N/A N/A _ N/A N/A self get_record INODE_FIRST_USER N/A N/A N/A OverrunBufferException N/A N/A N/A N/A g_logger error overrun reading first user MFT record N/A N/A CorruptNTFSFilesystemError failed to read first user record (MFT not large enough) N/A get_attribute_data N/A N/A self attribute N/A N/A N/A N/A N/A N/A attribute non_resident 0 N/A N/A N/A N/A attribute value N/A N/A N/A NonResidentAttributeData N/A self _clusters N/A N/A attribute runlist N/A get_mft_buffer N/A N/A self N/A N/A N/A N/A N/A g_logger debug mft: %s N/A hex N/A N/A N/A N/A self _vbr mft_lcn 4096 N/A mft_chunk N/A N/A self _clusters N/A N/A N/A N/A self _vbr mft_lcn N/A mft_mft_record N/A MFTRecord mft_chunk 0 None inode INODE_MFT N/A mft_data_attribute N/A N/A mft_mft_record data_attribute N/A N/A N/A self get_attribute_data mft_data_attribute N/A get_mftmirr_buffer N/A N/A self N/A N/A N/A N/A N/A g_logger debug mft mirr: %s N/A hex N/A N/A N/A N/A self _vbr mftmirr_lcn 4096 N/A mftmirr_chunk N/A N/A self _clusters N/A N/A N/A N/A self _vbr mftmirr_lcn N/A mftmirr_mft_record N/A MFTRecord mftmirr_chunk N/A INODE_MFTMIRR MFT_RECORD_SIZE None inode INODE_MFTMIRR N/A mftmirr_data_attribute N/A N/A mftmirr_mft_record data_attribute N/A N/A N/A self get_attribute_data mftmirr_data_attribute N/A get_root_directory N/A N/A self N/A N/A N/A N/A NTFSDirectory self N/A N/A N/A self _enumerator get_record INODE_ROOT N/A get_record N/A N/A self record_number N/A N/A N/A N/A N/A g_logger debug get_record: %d record_number N/A N/A N/A N/A self _enumerator get_record record_number N/A get_record_path N/A N/A self record N/A N/A N/A N/A N/A N/A self _enumerator get_path record N/A get_record_parent N/A N/A self record N/A N/A N/A 
        @raises NoParentError: on various error conditions
         N/A N/A N/A N/A record mft_record_number 5 N/A N/A N/A NoParentError Root directory has no parent N/A fn N/A N/A record filename_information N/A N/A fn N/A N/A N/A NoParentError File has no filename attribute N/A parent_record_num N/A MREF N/A N/A fn mft_parent_reference N/A parent_seq_num N/A MSEQNO N/A N/A fn mft_parent_reference N/A N/A N/A parent_record N/A N/A N/A self _enumerator get_record parent_record_num N/A N/A N/A N/A N/A BinaryParser OverrunBufferException InvalidRecordException N/A N/A N/A NoParentError Invalid parent MFT record N/A N/A N/A N/A parent_record sequence_number parent_seq_num N/A N/A N/A NoParentError Invalid parent MFT record (bad sequence number) N/A N/A NTFSDirectory self parent_record N/A get_record_children N/A N/A self record N/A N/A N/A ret N/A N/A N/A N/A N/A record is_directory N/A N/A N/A N/A ret values N/A N/A N/A indx_alloc_attr N/A N/A record attribute N/A ATTR_TYPE INDEX_ALLOCATION N/A indx_alloc N/A INDEX_ALLOCATION N/A N/A self get_attribute_data indx_alloc_attr 0 N/A indx indx_alloc N/A block N/A N/A indx blocks N/A N/A entry N/A N/A N/A N/A block index entries N/A N/A ref N/A MREF N/A N/A N/A N/A entry header mft_reference N/A N/A N/A ref INODE_ROOT N/A N/A N/A N/A N/A entry filename_information filename . N/A N/A N/A N/A ret N/A ref N/A N/A N/A self _enumerator get_record ref N/A N/A N/A AttributeNotFoundError N/A N/A indx_root_attr N/A N/A record attribute N/A ATTR_TYPE INDEX_ROOT N/A indx_root N/A INDEX_ROOT N/A N/A self get_attribute_data indx_root_attr 0 N/A indx indx_root N/A entry N/A N/A N/A N/A indx index entries N/A N/A ref N/A MREF N/A N/A N/A N/A entry header mft_reference N/A N/A N/A ref INODE_ROOT N/A N/A N/A N/A N/A entry filename_information filename . N/A N/A N/A N/A ret N/A ref N/A N/A N/A self _enumerator get_record ref N/A N/A N/A ret values N/A N/A main N/A N/A N/A N/A N/A sys ntfs.volume FlatVolume ntfs.BinaryParser Mmap ntfs.mft.MFT MFTEnumerator N/A N/A N/A logging basicConfig level N/A logging DEBUG N/A N/A Mmap N/A N/A sys argv N/A 1 buf N/A N/A v N/A FlatVolume buf N/A int N/A N/A sys argv N/A 2 N/A fs N/A NTFSFilesystem v N/A root N/A N/A fs get_root_directory N/A N/A N/A g_logger info root dir: %s root N/A c N/A N/A root get_children N/A N/A N/A N/A g_logger info   - %s N/A N/A c get_name N/A sys32 N/A N/A root get_path_entry windows\system32 N/A N/A N/A g_logger info sys32: %s sys32 N/A N/A N/A __name__ __main__ N/A N/A N/A main