o
    àý°jñÂ  ã                   @   s°  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
mZmZ d dlmZ d dlmZ d dlmZ d dlmZmZ d	Zd Zd	Zd
ZdZdZdZdZdZdZdZdZ dZ!dZ"dZ#dZ$dZ%dZ&dZ'dZ(dZ)dZ*dZ+dZ,d Z-dZ.dZ/d Z0dZ1dZ2d!Z3d"Z4d#Z5dZ6dZ7d!Z8d	Z9d
Z:dZ;dZ<dZ=d$Z>d%Z?d&Z@dZAd'ZBdZCd(ZDd)ZEd*ZFd+ZGd ZHdZIdZJd ZKd!ZLd,ZMd-ZNd.ZOd"ZPd/ZQd0ZRd1ZSd ZTdZUd ZVdZWd ZXdZYdZZd2Z[G d3d4„ d4eƒZ\G d5d6„ d6eƒZ]G d7d8„ d8eƒZ^G d9d:„ d:eƒZ_G d;d<„ d<eƒZ`G d=d>„ d>eƒZaG d?d@„ d@eƒZbG dAdB„ dBeƒZcG dCdD„ dDeƒZdG dEdF„ dFeƒZeG dGdH„ dHeƒZfG dIdJ„ dJeƒZgG dKdL„ dLeƒZhG dMdN„ dNeƒZiG dOdP„ dPeƒZjG dQdR„ dReƒZkdSdT„ ZlG dUdV„ dVƒZmG dWdX„ dXemƒZnG dYdZ„ dZemƒZoG d[d\„ d\eoƒZpG d]d^„ d^ƒZqG d_d`„ d`ƒZrG dadb„ dbƒZsG dcdd„ ddƒZtG dedf„ dfƒZuG dgdh„ dhƒZvG didj„ djƒZwG dkdl„ dlƒZxG dmdn„ dnƒZyG dodp„ dpejzƒZ{dqdr„ Z|e}dsk�rÖe|ƒ  e ~d¡ dS dS )té    )Údivision)Úprint_functionN)ÚPY2Ú	text_type)Údatetime)Úlogger)Úversion)Ú	StructureÚhexdumpé   é    é0   é@   éP   é`   ép   é€   é�   é    é°   éÀ   éÐ   éà   éð   é   i   l   ÿÿ é   éÿ   i @  i €  é   é   é   é   iÿÿ é   i   i   i    i·  i§1  i   i    é   é   é   é	   é
   é   éÿÿ  c                   @   ó   e Zd ZdZdS )ÚNTFS_BPB))ÚBytesPerSectorú<H=0)ÚSectorsPerClusterúB=0)ÚReservedSectorsr,   ©ÚReservedú3s=b"")Ú	Reserved2ú2s=b"")ÚMediaDescriptionr.   )Ú	Reserved3r4   )Ú	Reserved4r,   )Ú	Reserved5r,   )Ú	Reserved6ú<L=0)Ú	Reserved7ú4s=b""N©Ú__name__Ú
__module__Ú__qualname__Ú	structure© rB   rB   ú‰/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/ntfs-read.pyr*   …   ó    r*   c                   @   r)   )ÚNTFS_EXTENDED_BPB)
)r1   r<   )ÚTotalSectorsú<Q=0)ÚMFTClusterNumberrG   )ÚMFTMirrClusterNumberrG   )ÚClusterPerFileRecordzb=0)r3   r2   )ÚClusterPerIndexBufferz<b=0)r6   r2   )ÚVolumeSerialNumberú8s=b"")ÚCheckSumr<   Nr=   rB   rB   rB   rC   rE   ”   rD   rE   c                   @   r)   )ÚNTFS_BOOT_SECTOR))ÚJmpInstrr2   )ÚOEM_IDrM   )ÚBPBz25s=b"")ÚExtendedBPBz48s=b"")Ú	Bootstrapz426s=b"")ÚEOSr,   Nr=   rB   rB   rB   rC   rO   ¢   rD   rO   c                   @   r)   )ÚNTFS_MFT_RECORD))Ú
MagicLabelr<   ©Ú	USROffsetr,   ©ÚUSRSizer,   )Ú	LogSeqNumrG   )ÚSeqNumr,   )Ú	LinkCountr,   )ÚAttributesOffsetr,   ©ÚFlagsr,   )Ú
BytesInUser:   )ÚBytesAllocatedr:   )ÚBaseMftRecordrG   )ÚNextAttrInstancer,   ©r1   r,   )ÚRecordNumberr:   Nr=   rB   rB   rB   rC   rV   ¬   rD   rV   c                   @   s   e Zd ZdZdZdS )ÚNTFS_ATTRIBUTE_RECORD)©ÚTyper:   )ÚLengthr:   )ÚNonResidentr.   )Ú
NameLengthr.   )Ú
NameOffsetr,   r`   )ÚInstancer,   rB   N)r>   r?   r@   Ú	commonHdrrA   rB   rB   rB   rC   rh   ¾   s    	rh   c                   @   r)   )Ú"NTFS_ATTRIBUTE_RECORD_NON_RESIDENT))Ú	LowestVCNrG   )Ú
HighestVCNrG   )ÚDataRunsOffsetr,   )ÚCompressionUnitr,   )Ú	Reserved1z4s=""©ÚAllocatedSizerG   ©ÚDataSizerG   )ÚInitializedSizerG   Nr=   rB   rB   rB   rC   rq   Ê   rD   rq   c                   @   r)   )ÚNTFS_ATTRIBUTE_RECORD_RESIDENT))ÚValueLenr:   )ÚValueOffsetr,   ©ra   r.   )r1   r.   Nr=   rB   rB   rB   rC   r|   ×   rD   r|   c                   @   r)   )ÚNTFS_FILE_NAME_ATTR))ÚParentDirectoryrG   ©ÚCreationTimerG   ©ÚLastDataChangeTimerG   ©ÚLastMftChangeTimerG   ©ÚLastAccessTimerG   rw   ry   ©ÚFileAttributesr:   )ÚEaSizer:   )ÚFileNameLenr.   )ÚFileNameTyper.   )Ú	_FileNamez
_-FileNamezself["FileNameLen"]*2)ÚFileNameú:Nr=   rB   rB   rB   rC   r€   ß   rD   r€   c                   @   r)   )ÚNTFS_STANDARD_INFORMATION)r‚   r„   r†   rˆ   rŠ   Nr=   rB   rB   rB   rC   r’   ð   rD   r’   c                   @   r)   )ÚNTFS_INDEX_HEADER))ÚEntriesOffsetr:   )ÚIndexLengthr:   )rx   r:   r   r0   Nr=   rB   rB   rB   rC   r“   ù   rD   r“   c                   @   ó"   e Zd ZdddddddeffZdS )	ÚNTFS_INDEX_ROOTri   )ÚCollationRuler:   )ÚIndexBlockSizer:   )ÚClustersPerIndexBlockr.   r0   ÚIndexr‘   N©r>   r?   r@   r“   rA   rB   rB   rB   rC   r—     ó    úr—   c                   @   r–   )	ÚNTFS_INDEX_ALLOCATION)ÚMagicr<   rX   rZ   )ÚLsnrG   )ÚIndexVcnrG   r›   r‘   Nrœ   rB   rB   rB   rC   rž     r�   rž   c                   @   r)   )ÚNTFS_INDEX_ENTRY_HEADER))ÚIndexedFilerG   )rk   r,   )Ú	KeyLengthr,   r`   rf   Nr=   rB   rB   rB   rC   r¢     rD   r¢   c                   @   s$   e Zd ZdZddefddddfZdS )	ÚNTFS_INDEX_ENTRYr    ÚEntryHeaderr‘   )Ú_Keyz_-Keyz self["EntryHeader"]["KeyLength"])ÚKeyr‘   )Ú_Vcnz_-Vcnz$(self["EntryHeader"]["Flags"] & 1)*8)ÚVcnr‘   N)r>   r?   r@   Ú	alignmentr¢   rA   rB   rB   rB   rC   r¥      s    ûr¥   c                   @   r)   )ÚNTFS_DATA_RUN))ÚLCNz<q=0)ÚClustersrG   )ÚStartVCNrG   )ÚLastVCNrG   Nr=   rB   rB   rB   rC   r¬   *  rD   r¬   c                   @   r)   )ÚNTFS_ATTRIBUTE_LIST_ENTRY))ÚAttributeTyper:   )ÚEntryLengthr,   )ÚAttributeNameLengthr.   )ÚAttributeNameOffsetr.   )ÚStartingVCNrG   )ÚBaseFileRecordrG   )ÚAttributeIDr,   Nr=   rB   rB   rB   rC   r±   2  rD   r±   c                 C   s   | d8 } | d } | S )Nl     }*{Gíi€–˜ rB   )ÚtrB   rB   rC   ÚgetUnixTime=  s   rº   c                   @   óD   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Z	dS )Ú	Attributec                 C   sl   d | _ |j| _t|ƒ| _| jd dkr2| jd tkr4|| jd d … d | jd d …  d¡| _ d S d S d S )Nrm   r   rj   rn   r   úutf-16le)ÚAttributeNameÚ
NTFSVolumerh   ÚAttributeHeaderÚENDÚdecode©ÚselfÚiNodeÚdatarB   rB   rC   Ú__init__D  s   
0ÿzAttribute.__init__c                 C   ó
   | j d S ©Nra   ©rÀ   ©rÄ   rB   rB   rC   ÚgetFlagsK  ó   
zAttribute.getFlagsc                 C   ó   | j S ©N)r¾   rË   rB   rB   rC   ÚgetNameN  ó   zAttribute.getNamec                 C   rÈ   )Nrl   rÊ   rË   rB   rB   rC   ÚisNonResidentQ  rÍ   zAttribute.isNonResidentc                 C   ó
   | j  ¡ S rÏ   )rÀ   ÚdumprË   rB   rB   rC   rÔ   T  rÍ   zAttribute.dumpc                 C   rÈ   )Nrk   rÊ   rË   rB   rB   rC   ÚgetTotalSizeW  rÍ   zAttribute.getTotalSizec                 C   rÈ   ©Nrj   rÊ   rË   rB   rB   rC   ÚgetTypeZ  rÍ   zAttribute.getTypeN)
r>   r?   r@   rÇ   rÌ   rÐ   rÒ   rÔ   rÕ   r×   rB   rB   rB   rC   r¼   C  s    r¼   c                   @   s<   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ ZdS )ÚAttributeResidentc                 C   s\   t  d|j ¡ t | ||¡ t|t| jƒd … ƒ| _|| jd d … d | jd … | _	d S )Nz#Inside AttributeResident: iNode: %sr~   r}   )
ÚloggingÚdebugÚINodeNumberr¼   rÇ   r|   ÚlenrÀ   ÚResidentHeaderÚ	AttrValuerÃ   rB   rB   rC   rÇ   ^  s   &zAttributeResident.__init__c                 C   rÓ   rÏ   )rÝ   rÔ   rË   rB   rB   rC   rÔ   d  rÍ   zAttributeResident.dumpc                 C   rÈ   rÉ   )rÝ   rË   rB   rB   rC   rÌ   g  rÍ   zAttributeResident.getFlagsc                 C   rÎ   rÏ   )rÞ   rË   rB   rB   rC   ÚgetValuej  rÑ   zAttributeResident.getValuec                 C   s(   t  d||f ¡ | j|d … d |… S )Nú#Inside Read: offset: %d, length: %d)rÙ   rÚ   rÞ   ©rÄ   ÚoffsetÚlengthrB   rB   rC   Úreadm  s   zAttributeResident.readc                 C   ó
   t | jƒS rÏ   )rÜ   rÞ   rË   rB   rB   rC   ÚgetDataSizeq  rÍ   zAttributeResident.getDataSizeN)	r>   r?   r@   rÇ   rÔ   rÌ   rß   rä   ræ   rB   rB   rB   rC   rØ   ]  s    rØ   c                   @   óL   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
dS )ÚAttributeNonResidentc                 C   sŽ   t  d|j ¡ t | ||¡ || _t|t| jƒd … ƒ| _	|| j	d d … d | j	d … | _
g | _d| _| j	d | _| j	d | _|  ¡  d S )Nz&Inside AttributeNonResident: iNode: %srt   rx   r   rz   r{   )rÙ   rÚ   rÛ   r¼   rÇ   Ú_raw_attr_datarq   rÜ   rÀ   ÚNonResidentHeaderrÞ   ÚDataRunsÚClusterSizeÚ	data_sizeÚinitialized_sizeÚparseDataRunsrÃ   rB   rB   rC   rÇ   u  s   "zAttributeNonResident.__init__c                 C   rÓ   rÏ   )rê   rÔ   rË   rB   rB   rC   rÔ   ‚  rÍ   zAttributeNonResident.dumpc                 C   rÎ   rÏ   )rí   rË   rB   rB   rC   ræ   …  rÑ   z AttributeNonResident.getDataSizec                 C   ó   d S rÏ   rB   rË   rB   rB   rC   rß   ˆ  ó   zAttributeNonResident.getValuec                 C   s”  | j }|du r	dS d}d}|rÄ|dd… dkrÆt|ƒdk rdS |d }|dd… }|d@ }|d? }t|ƒ|k r9dS t d|d|…  dd¡¡d }||d… }tƒ }||d	< ||d
< || d |d< |dkrwd|d< t d|d
 |d |¡ n7t|ƒ|k rdS |d|… }	|	d d@ r’|	 dd¡}	n|	 dd¡}	t d|	¡d }
||d… }||
7 }||d< | j 	|¡ ||7 }|rÈ|dd… dksdS dS dS dS )z4Parse data run descriptors from the attribute value.Nr   r   ó    é   r   ú<Qr    r®   r¯   r°   éÿÿÿÿr­   z"Sparse run: VCN %d-%d, clusters %dr   ó   ÿz<q)
rÞ   rÜ   ÚstructÚunpackÚljustr¬   rÙ   rÚ   rë   Úappend)rÄ   rÆ   ÚvcnÚprevLcnÚheaderÚlengthBytesÚoffsetBytesÚclusterCountÚdrÚ
offsetDataÚlcnDeltarB   rB   rC   rï   ‹  sH    $Öz"AttributeNonResident.parseDataRunsc                 C   sª   t  d||f ¡ |dkrd| | j S | jj || j d¡ | jj || j ¡}t|ƒ|| j k rK|| jj || j t|ƒ ¡7 }t|ƒ|| j k s2t|ƒdkrSd S |S )Nz(Inside ReadClusters: clusters:%d, lcn:%drõ   rò   r   )rÙ   rÚ   rì   r¿   ÚvolumeFDÚseekrä   rÜ   )rÄ   ÚclustersÚlcnÚbufrB   rB   rC   ÚreadClustersÀ  s    ÿz!AttributeNonResident.readClustersc           
      C   sÊ   t  d||f ¡ d}|}| jD ]R}|dkr |S ||d kr q||d k r) |S |d | d }t||ƒ}|d dkr?d}n
|d ||d   }|  ||¡}	|	d	u rV |S ||	7 }||8 }||7 }q|S )
zERead clusters starting at VCN, spanning multiple data runs if needed.z*Inside ReadVCN: vcn: %d, numOfClusters: %dó    r   r°   r¯   r   r­   rõ   N)rÙ   rÚ   rë   Úminr	  )
rÄ   rû   ÚnumOfClustersr  ÚclustersLeftr  ÚclustersInRunÚclustersToReadr  ÚtmpBufrB   rB   rC   ÚreadVCNÎ  s2   
éð
ü
zAttributeNonResident.readVCNc                 C   sH  t  d||f ¡ || jkrdS t|| j| ƒ}| jjd | jjd  | _d}|}|}|dkr|| j }|| j }| j| }||krEd}	nd|| | j d | j  }	|  ||	¡}
|
s\n#|
||| … }||7 }|t|ƒ7 }|t|ƒ8 }t|ƒdkr{n|dks/|sƒdS | j	|t|ƒ k r¢t
d| j	| ƒ}|d|… dt|ƒ|   }|S )	zRRead bytes from non-resident attribute, respecting data_size and initialized_size.rà   r
  r+   r-   r   r   Nrò   )rÙ   rÚ   rí   r  r¿   rR   rì   r  rÜ   rî   Úmax)rÄ   râ   rã   r  Ú	curOffsetÚ	bytesLeftrû   Ú	vcnOffsetÚbytesInFirstClusterr  ÚclusterDataÚchunkÚ
validBytesrB   rB   rC   rä   ñ  s>   



êzAttributeNonResident.readN)r>   r?   r@   rÇ   rÔ   ræ   rß   rï   r	  r  rä   rB   rB   rB   rC   rè   t  s    5#rè   c                       sV   e Zd Zedd„ ƒZedd„ ƒZedd„ ƒZedd„ ƒZd‡ fd
d„	Zdd„ Z	‡  Z
S )ÚNonResidentDataAttributec                 C   s<   |dkrd S |j D ]}|d  |7  < |d  |7  < q	d S )Nr   r¯   r°   )rë   )ÚclsÚattrÚ	start_vcnr  rB   rB   rC   Ú_shift_runs#  s   
þz$NonResidentDataAttribute._shift_runsc                 C   s   |j d |j d fS )Nrz   r{   )rê   )r  r  rB   rB   rC   Ú_base_sizes+  s   z$NonResidentDataAttribute._base_sizesc                 C   s6   |d ur	|||fS |d \}}|   |¡\}}|||fS ©Nr   )r  )r  Ú	collectedÚ	base_attrÚbase_data_sizeÚbase_initialized_sizeÚ_rB   rB   rC   Ú_ensure_base/  s
   

z%NonResidentDataAttribute._ensure_basec                 C   s~   g }d}d}d}|D ].}|j  |j¡}	|	 t|¡}
|
du rq
| ||
f¡ |jdkr8|
}t|
tƒr8|  	|
¡\}}q
||||fS )zJCollect $DATA attributes from extent records, identifying the base extent.Nr   )
r¿   ÚgetINodeÚMftRecordNumberÚsearchAttributeÚDATArú   r¶   Ú
isinstancerè   r  )r  rÅ   ÚmatchesÚattribute_namer!  r"  r#  r$  ÚentryÚextension_inoder  rB   rB   rC   Ú_collect_extents7  s    

€z)NonResidentDataAttribute._collect_extentsNc                    s¬   t |ƒ}|s
tdƒ‚|jdd„ d� |  |||¡\}}}}|s#tdƒ‚|  ||||¡\}}}tt| ƒ ||j¡ t	|ƒdkrM|d \}	}
|  
| |	j¡ dS |  |||¡ dS )	a   
        Build a unified $DATA stream from multiple attribute list entries.

        Args:
            iNode: Owning inode for volume access
            entries: AttributeListEntry items for the target $DATA stream
            attribute_name: Stream name (None for default $DATA)
        zNo $DATA extents foundc                 S   rÎ   rÏ   )r¶   )ÚerB   rB   rC   Ú<lambda>[  s    z3NonResidentDataAttribute.__init__.<locals>.<lambda>©ÚkeyzNo usable $DATA extents foundr   r   N)ÚlistÚ
ValueErrorÚsortr0  r&  Úsuperr  rÇ   ré   rÜ   r  r¶   Ú_merge_extents_from_collected)rÄ   rÅ   Úentriesr-  r,  r!  r"  r#  r$  r.  r%  ©Ú	__class__rB   rC   rÇ   M  s"   	ÿ
ÿz!NonResidentDataAttribute.__init__c           	      C   sœ   g }|D ]6\}}t |tƒsq|jD ](}tƒ }|d |d< |d |d< |d |j |d< |d |j |d< | |¡ qq|jdd„ d� || _|| _|| _dS )	z:Merge data runs from multiple extents into unified stream.r­   r®   r¯   r°   c                 S   s   | d S )Nr¯   rB   )r  rB   rB   rC   r2  „  s    zHNonResidentDataAttribute._merge_extents_from_collected.<locals>.<lambda>r3  N)	r+  rè   rë   r¬   r¶   rú   r7  rí   rî   )	rÄ   r!  rí   Ú	init_sizeÚmerged_runsr.  r  r  Únew_drrB   rB   rC   r9  u  s    

ù	
z6NonResidentDataAttribute._merge_extents_from_collectedrÏ   )r>   r?   r@   Úclassmethodr  r  r&  r0  rÇ   r9  Ú__classcell__rB   rB   r;  rC   r  "  s    



(r  c                   @   ó,   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	S )
ÚAttributeStandardInfoc                 C   ó"   t  d¡ || _t| jjƒ| _d S )NzInside AttributeStandardInfo)rÙ   rÚ   r¼   r’   rÞ   ÚStandardInfo©rÄ   Ú	attributerB   rB   rC   rÇ   ‹  ó   
zAttributeStandardInfo.__init__c                 C   rÈ   ©Nr‹   )rE  rË   rB   rB   rC   ÚgetFileAttributes�  rÍ   z'AttributeStandardInfo.getFileAttributesc                 C   s&   | j d dkrt t| j d ƒ¡S dS )Nr…   r   )rE  r   Úfromtimestamprº   rË   rB   rB   rC   ÚgetFileTime“  s   z!AttributeStandardInfo.getFileTimec                 C   rÓ   rÏ   )rE  rÔ   rË   rB   rB   rC   rÔ   ™  rÍ   zAttributeStandardInfo.dumpN)r>   r?   r@   rÇ   rJ  rL  rÔ   rB   rB   rB   rC   rC  Š  s
    rC  c                   @   r»   )ÚAttributeFileNamec                 C   rD  )NzInside AttributeFileName)rÙ   rÚ   r¼   r€   rÞ   ÚFileNameRecordrF  rB   rB   rC   rÇ   �  rH  zAttributeFileName.__init__c                 C   rÈ   )NrŽ   ©rN  rË   rB   rB   rC   ÚgetFileNameType¢  rÍ   z!AttributeFileName.getFileNameTypec                 C   rÈ   rI  rO  rË   rB   rB   rC   rJ  ¥  rÍ   z#AttributeFileName.getFileAttributesc                 C   s   | j d  d¡S )Nr�   r½   )rN  rÂ   rË   rB   rB   rC   ÚgetFileName¨  ó   zAttributeFileName.getFileNamec                 C   rÈ   )Nrz   rO  rË   rB   rB   rC   ÚgetFileSize«  rÍ   zAttributeFileName.getFileSizec                 C   rÈ   rI  rO  rË   rB   rB   rC   rÌ   ®  rÍ   zAttributeFileName.getFlagsc                 C   rÓ   rÏ   )rN  rÔ   rË   rB   rB   rC   rÔ   ±  rÍ   zAttributeFileName.dumpN)
r>   r?   r@   rÇ   rP  rJ  rQ  rS  rÌ   rÔ   rB   rB   rB   rC   rM  œ  s    rM  c                   @   s$   e Zd Zdd„ Zdd„ Zdd„ ZdS )ÚAttributeIndexAllocationc                 C   s   t  d¡ || _d S )NzInside AttributeIndexAllocation)rÙ   rÚ   r¼   rF  rB   rB   rC   rÇ   µ  s   

z!AttributeIndexAllocation.__init__c                 C   s,   t | j ¡ ƒ | jjD ]}t | ¡ ƒ qd S rÏ   )Úprintr¼   rÔ   rë   ©rÄ   ÚirB   rB   rC   rÔ   ¹  s   ÿzAttributeIndexAllocation.dumpc                 C   s   | j  ||¡S rÏ   )r¼   rä   rá   rB   rB   rC   rä   ¾  ó   zAttributeIndexAllocation.readN)r>   r?   r@   rÇ   rÔ   rä   rB   rB   rB   rC   rT  ´  s    rT  c                   @   rB  )
ÚAttributeIndexRootc                 C   s.   t  d¡ || _t|jƒ| _g | _|  ¡  d S )NzInside AttributeIndexRoot)rÙ   rÚ   r¼   r—   rÞ   ÚIndexRootRecordÚIndexEntriesÚparseIndexEntriesrF  rB   rB   rC   rÇ   Ã  s
   
zAttributeIndexRoot.__init__c                 C   sJ   | j jt| jƒd … }	 t|ƒ}| j |¡ | ¡ rd S || ¡ d … }qrÏ   )	r¼   rÞ   rÜ   rZ  Ú
IndexEntryr[  rú   Ú
isLastNodeÚgetSize)rÄ   rÆ   ÚierB   rB   rC   r\  Ê  s   ûz$AttributeIndexRoot.parseIndexEntriesc                 C   s"   | j  ¡  | jD ]}| ¡  qd S rÏ   )rZ  rÔ   r[  rV  rB   rB   rC   rÔ   Ó  s   


ÿzAttributeIndexRoot.dumpc                 C   rÈ   rÖ   )rZ  rË   rB   rB   rC   r×   Ø  rÍ   zAttributeIndexRoot.getTypeN)r>   r?   r@   rÇ   r\  rÔ   r×   rB   rB   rB   rC   rY  Â  s
    	rY  c                   @   rç   )r]  c                 C   s   t |ƒ| _d S rÏ   )r¥   r.  )rÄ   r.  rB   rB   rC   rÇ   Ü  rX  zIndexEntry.__init__c                 C   ó   | j d d t@ S ©Nr¦   ra   )r.  ÚINDEX_ENTRY_NODErË   rB   rB   rC   Ú	isSubNodeß  ó   zIndexEntry.isSubNodec                 C   ra  rb  )r.  ÚINDEX_ENTRY_ENDrË   rB   rB   rC   r^  â  re  zIndexEntry.isLastNodec                 C   s   t  d| jd ¡d S )Nrô   rª   r   )r÷   rø   r.  rË   rB   rB   rC   ÚgetVCNå  s   zIndexEntry.getVCNc                 C   rå   rÏ   )rÜ   r.  rË   rB   rB   rC   r_  è  rÍ   zIndexEntry.getSizec                 C   rÈ   )Nr¨   ©r.  rË   rB   rB   rC   ÚgetKeyë  rÍ   zIndexEntry.getKeyc                 C   s   | j d d d@ S )Nr¦   r£   ì   ÿÿÿ rh  rË   rB   rB   rC   ÚgetINodeNumberî  re  zIndexEntry.getINodeNumberc                 C   s   | j  ¡  d S rÏ   )r.  rÔ   rË   rB   rB   rC   rÔ   ñ  rX  zIndexEntry.dumpN)r>   r?   r@   rÇ   rd  r^  rg  r_  ri  rk  rÔ   rB   rB   rB   rC   r]  Û  s    r]  c                   @   s   e Zd Zdd„ ZdS )ÚAttributeListEntryc                 C   s¦   t |ƒ| _| jd | _| jd | _| jd | _| jd | _| jd }|d@ | _|d? d@ | _d | _| jd	 }|d
krQ| jd }||||d  … }| 	d¡| _d S d S )Nr²   r³   r¶   r¸   r·   rj  r   r(   r´   r   rµ   r   r½   )
r±   r¦   r²   r³   r¶   r¸   r(  ÚMftSequenceNumberr¾   rÂ   )rÄ   Ú
entry_dataÚ
raw_recordÚname_lenÚname_offsetÚ
name_bytesrB   rB   rC   rÇ   õ  s   




ýzAttributeListEntry.__init__N)r>   r?   r@   rÇ   rB   rB   rB   rC   rl  ô  s    rl  c                   @   s(   e Zd ZdZdd„ Zdd„ Zdd„ ZdS )	ÚAttributeListzBParses ATTRIBUTE_LIST attribute (can be resident or non-resident).c                 C   s   || _ g | _|  ¡  d S rÏ   )rG  ÚEntriesÚ_parseEntriesrF  rB   rB   rC   rÇ     s   zAttributeList.__init__c                 C   s®   t | jdƒr| j ¡ dur| j ¡ }n
| j d| j ¡ ¡}|s!dS d}|t|ƒk rU||d… }t|ƒdk r7dS t|ƒ}|jdkrBdS | j 	|¡ ||j7 }|t|ƒk s)dS dS )z+Parse attribute list entries from raw data.rß   Nr   é   )
ÚhasattrrG  rß   rä   ræ   rÜ   rl  r³   rt  rú   )rÄ   rÆ   râ   rn  Ú
list_entryrB   rB   rC   ru    s    

øzAttributeList._parseEntriesc                 C   rÎ   rÏ   )rt  rË   rB   rB   rC   Ú
getEntries#  rÑ   zAttributeList.getEntriesN)r>   r?   r@   Ú__doc__rÇ   ru  ry  rB   rB   rB   rC   rs    s
    rs  c                   @   sŽ   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
d#dd„Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zd d!„ Zd"S )$ÚINODEc                 C   sF   || _ d | _i | _d | _d | _d| _d | _d | _d| _d| _	d| _
d S r   )r¿   rÛ   Ú
AttributesÚAttributesRawÚAttributesLastPosr‹   r…   r�   ÚFileSizeÚ_walk_root_countÚ_walk_subnode_count)rÄ   r¿   rB   rB   rC   rÇ   '  s   
zINODE.__init__c                 C   ó
   | j t@ S rÏ   )r‹   ÚFILE_ATTR_I30_INDEX_PRESENTrË   rB   rB   rC   ÚisDirectory7  rÍ   zINODE.isDirectoryc                 C   r‚  rÏ   )r‹   ÚFILE_ATTR_COMPRESSEDrË   rB   rB   rC   ÚisCompressed:  rÍ   zINODE.isCompressedc                 C   r‚  rÏ   )r‹   ÚFILE_ATTR_ENCRYPTEDrË   rB   rB   rC   ÚisEncrypted=  rÍ   zINODE.isEncryptedc                 C   r‚  rÏ   )r‹   ÚFILE_ATTR_SPARSE_FILErË   rB   rB   rC   ÚisSparse@  rÍ   zINODE.isSparsec              
   C   s†   | j d ur?| jd urAztd|  ¡ | j  d¡| j| jf ƒ W d S  ty> } zt d| j	t
|ƒf ¡ W Y d }~d S d }~ww d S d S )Nz%s %s %15d %s ú z-Exception when trying to display inode %d: %s)r…   r�   rU  ÚgetPrintableAttributesÚ	isoformatr  Ú	ExceptionrÙ   ÚerrorrÛ   Ústr)rÄ   r1  rB   rB   rC   ÚdisplayNameC  s   *&€ÿüzINODE.displayNamec                 C   s¬   d}| j t@ r|d7 }n|d7 }| j t@ r|d7 }n|d7 }| j t@ r(|d7 }n|d7 }|  ¡ r5|d7 }n|d7 }|  ¡ rB|d7 }n|d7 }|  ¡ rP|d7 }|S |d7 }|S )	NÚ Údú-ÚhÚSÚCÚEÚs)r‹   rƒ  ÚFILE_ATTR_HIDDENÚFILE_ATTR_SYSTEMr†  rˆ  rŠ  )rÄ   ÚmaskrB   rB   rC   rŒ  K  s*   







ÿzINODE.getPrintableAttributesc                 C   s6  |   td ¡}|d ur&t|ƒ}|| jt< |  j| ¡ O  _| ¡ | _|| jt< |   td ¡}|d ur^t	|ƒ}| 
¡ tkrS| ¡ | _| ¡ | _|  j| ¡ O  _|| jt< n|   td d¡}|d us0|   td ¡}|d urqt|ƒ}|| jt< |   td¡}|d ur„t|ƒ}|| jt< |   td¡}|d ur™t|ƒ}|| jt< d S d S )NTz$I30)r)  ÚSTANDARD_INFORMATIONrC  r|  r‹   rJ  rL  r…   Ú	FILE_NAMErM  rP  ÚFILE_NAME_DOSrQ  r�   rS  r  ÚATTRIBUTE_LISTrs  ÚINDEX_ALLOCATIONrT  Ú
INDEX_ROOTrY  )rÄ   r  ÚsiÚfnÚalÚiaÚirrB   rB   rC   ÚparseAttributesg  s>   





ø

þzINODE.parseAttributesFc           
         sp  t  d|ˆ f ¡ d }|du r| j}n| j}	 t|ƒdkr d }nGt| |ƒ}| ¡ tkr.d }n9| ¡ dkr7d }n0| ¡ |kr^| 	¡ ˆ kr^| 
¡ dkrOt| |ƒ}nt| |ƒ}|| ¡ d … | _n	|| ¡ d … }q|d u r¶t| jv r¶| jt }|tkr–‡ fdd„| ¡ D ƒ}zt| |ˆ ƒW S  ty•   Y d S w | ¡ D ]}|j|krµ|jˆ krµ| j |j¡}	|	 |ˆ ¡  S qš|S )Nz,Inside searchAttribute: type: 0x%x, name: %sTr    r   r   c                    s$   g | ]}|j tkr|jˆ kr|‘qS rB   )r²   r*  r¾   )Ú.0r.  ©ÚattributeNamerB   rC   Ú
<listcomp>¸  s
    ÿz)INODE.searchAttribute.<locals>.<listcomp>)rÙ   rÚ   r~  r}  rÜ   r¼   r×   rÁ   rÕ   rÐ   rÒ   rè   rØ   r   r|  r*  ry  r  r6  r²   r¾   r¿   r'  r(  r)  )
rÄ   ÚattributeTyper«  ÚfindNextÚrecordrÆ   Ú	attr_listr:  r.  r/  rB   rª  rC   r)  Ž  sR   

æ

ÿÿ€zINODE.searchAttributec           
      C   s  t  d¡ t d||d d … d d… ¡d }||d d d … d |d d … }t|ƒ}d}td|d dƒD ]>}|| jjd 7 }t d||d … d d… ¡d }	|	|krat  d||	f ¡  d S || ||< ||d  ||d < |d7 }q7t	r}d	 
|¡S t|ƒS )
NzInside PerformFixUp...z<HrY   r   r   r[   z)Magic number 0x%x doesn't match with 0x%xr   r’  )rÙ   rÚ   r÷   rø   r5  Úranger¿   Ú
SectorSizer�  r   ÚjoinÚbytes)
rÄ   r¯  r  Ú
numSectorsÚmagicNumÚsequenceArrayÚdataListÚindexrW  Ú	lastBytesrB   rB   rC   ÚPerformFixUpÈ  s"   
$$ 

zINODE.PerformFixUpc                 C   sÄ   g }t | jv r`| jt  }| || jj | jj¡}|r`t|ƒ}| jj| jj }|  |||¡}|d u r3g S |t|ƒtt	ƒ ƒ |d d  d … }	 t
|ƒ}| |¡ | ¡ rW	 |S || ¡ d … }qG|S )Nr›   r”   )r¡  r|  rä   r¿   r™   rž   r²  r»  rÜ   r“   r]  rú   r^  r_  )rÄ   rû   r[  r¦  rÆ   ÚiaRecÚsectorsPerIBr`  rB   rB   rC   ÚparseIndexBlocksè  s(   

&
ÿûzINODE.parseIndexBlocksc                 C   s„   t  d| ¡ |  |¡}g }|D ]/}| ¡ r ||  | ¡ ¡7 }qt| ¡ ƒdkr?| ¡ dkr?t	| ¡ ƒ}|d t
kr?| |¡ q|S )NzInside walkSubNodes: vcn %sr   r   rŽ   )rÙ   rÚ   r¾  rd  ÚwalkSubNodesrg  rÜ   ri  rk  r€   rŸ  rú   )rÄ   rû   r:  Úfilesr.  r¤  rB   rB   rC   r¿  ý  s   

€zINODE.walkSubNodesc                 C   sö   t  d¡ g }d| _d| _t| jv ry| jt }| ¡ t@ rw|jD ]T}| 	¡ rCt  d| 
¡ ¡ |  | 
¡ ¡}|  jt|ƒ7  _||7 }q t| ¡ ƒdkrt| ¡ dkrtt| ¡ ƒ}|d tkrtt  d|d  d¡¡ |  jd	7  _| |¡ q |S d S d S )
NzInside Walk... r   z/walk: INDEX_ROOT entry points to subnode VCN %dr   rŽ   z walk: INDEX_ROOT inline entry %sr�   r½   r   )rÙ   rÚ   r€  r�  r¢  r|  r×   rž  r[  rd  rg  r¿  rÜ   ri  rk  r€   rŸ  rÂ   rú   )rÄ   rÀ  r§  r`  Ú	sub_filesr¤  rB   rB   rC   Úwalk  s.   





€òz
INODE.walkc                 C   s¢   dd„ }|   |¡}|D ]C}||ƒ}|d ur:||kr|  S ||k r9| ¡ r6|  | ¡ |¡}|d ur5|  S q d S q| ¡ rN|  | ¡ |¡}|d urN|  S qd S )Nc                 S   óJ   t |  ¡ ƒdkr#|  ¡ dkr#t|  ¡ ƒ}|d tkr#|d  d¡ ¡ S d S ©Nr   r   rŽ   r�   r½   ©rÜ   ri  rk  r€   rŸ  rÂ   Úupper©r.  r¤  rB   rB   rC   rQ  0  ó
   z+INODE.findFirstSubNode.<locals>.getFileName)r¾  rd  ÚfindFirstSubNoderg  )rÄ   rû   ÚtoSearchrQ  r:  r`  ÚnameÚresrB   rB   rC   rÉ  /  s*   
ÿù	€îzINODE.findFirstSubNodec                 C   sÖ   dd„ }t | ¡ ƒ}t| jv re| jt }| ¡ t@ sddkrg|jD ]G}||ƒ}|d urP||kr3|  S ||k rO| ¡ rL|  | 	¡ |¡}|d urK|  S q! d S q!| ¡ rd|  | 	¡ |¡}|d urd|  S q!d S d S d S )Nc                 S   rÃ  rÄ  rÅ  rÇ  rB   rB   rC   rQ  P  rÈ  z$INODE.findFirst.<locals>.getFileNamer   )
r   rÆ  r¢  r|  r×   rž  r[  rd  rÉ  rg  )rÄ   ÚfileNamerQ  rÊ  r§  r`  rË  rÌ  rB   rB   rC   Ú	findFirstM  s4   


ÿù	€ëzINODE.findFirstc                 C   s   | j t|dd�S )NF)r®  )r)  r*  )rÄ   rË  rB   rB   rC   Ú	getStreamp  rR  zINODE.getStreamN)F)r>   r?   r@   rÇ   r„  r†  rˆ  rŠ  r‘  rŒ  r¨  r)  r»  r¾  r¿  rÂ  rÉ  rÎ  rÏ  rB   rB   rB   rC   r{  &  s"    
': #r{  c                   @   rB  )
ÚNTFSc                 C   sH   || _ d | _d | _d | _d | _d | _d | _d | _d | _d | _	|  
¡  d S rÏ   )Ú_NTFS__volumeNameÚ_NTFS__bootSectorÚ_NTFS__MFTStartr  rR   rS   Ú
RecordSizer™   r²  ÚMFTINodeÚmountVolume)rÄ   Ú
volumeNamerB   rB   rC   rÇ   u  s   zNTFS.__init__c                 C   sT   t  d¡ t| jdƒ| _|  ¡  |  t¡| _| j 	t
d ¡}|d u r(| `d | _d S d S )NzMounting volume...Úrb)rÙ   rÚ   ÚopenrÑ  r  ÚreadBootSectorr'  ÚFILE_MFTrÕ  r)  r*  )rÄ   r  rB   rB   rC   rÖ  ‚  s   

ýzNTFS.mountVolumec                 C   s@  t  d| j ¡ | j dd¡ | j d¡}t|ƒdk r)|| j d¡7 }t|ƒdk st|ƒ| _t	| jd ƒ| _
t| jd ƒ| _| j
d | _| j
d | j
d  | jd  | _| jd	 dkrl| j
d | j
d  | jd	  | _n	d
| jd	  > | _| jd dkr�| j
d | j
d  | jd  | _n	d
| jd  > | _t  d| j ¡ d S )NzReading Boot Sector for %sr   r!   rR   rS   r+   r-   rH   rJ   r   rK   zMFT should start at position %d)rÙ   rÚ   rÑ  r  r  rä   rÜ   rO   rÒ  r*   rR   rE   rS   r²  rÓ  rÔ  r™   )rÄ   rÆ   rB   rB   rC   rÚ  Ž  s$   ÿ
 ""zNTFS.readBootSectorc                 C   sD  t  d| ¡ t| ƒ}| j}| jr4|tkr4| j td ¡}|d u r)t  d| ¡ |S | 	|| j | j¡}n-| j
|| j  }| j |d¡ | j 	|¡}t|ƒ|k ra|| j 	|t|ƒ ¡7 }t|ƒ|k sO|rit|ƒ|k rrt  d| ¡ |S t|ƒ}| ||| j| j ¡}|d u rŽt  d| ¡ |S ||_||d | d … |_| ¡  |S )NzTrying to fetch inode %dz,Cannot find MFT $DATA attribute for inode %dr   z&Failed to read MFT record for inode %dzFixUp failed for inode %dr_   )rÙ   rÚ   r{  rÔ  rÕ  Ú
FIXED_MFTSr)  r*  r�  rä   rÓ  r  r  rÜ   rV   r»  r²  rÛ   r}  r¨  )rÄ   ÚiNodeNumÚnewINodeÚ	recordLenr  r¯  ÚdiskPositionÚ	mftRecordrB   rB   rC   r'  ¦  s6   ÿzNTFS.getINodeN)r>   r?   r@   rÇ   rÖ  rÚ  r'  rB   rB   rB   rC   rÐ  t  s
    rÐ  c                   @   s¢   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zd(dd„Zdd„ Zdd„ Zdd„ Zd)dd „Zd!d"„ Zd*d$d%„Zd&d'„ Zd#S )+Ú	MiniShellc                 C   s`   t j | ¡ || _t|ƒ| _| j t¡| _d| _	d| _
| j| _g | _d| _|  dd¡ d| _d S )Nz\>zType help for list of commandsú\r’  F)ÚcmdÚCmdrÇ   Ú
volumePathrÐ  Úvolumer'  Ú	FILE_RootÚ	rootINodeÚpromptÚintroÚcurrentINodeÚ
completionÚpwdÚdo_lsÚlast_output)rÄ   rç  rB   rB   rC   rÇ   Í  s   

zMiniShell.__init__c                 C   rð   rÏ   rB   rË   rB   rB   rC   Ú	emptylineÚ  rñ   zMiniShell.emptylinec              
   C   s\   d}z
t j | |¡}W |S  ty- } ztjddd� t t|ƒ¡ W Y d }~|S d }~ww )NFz
Exception:T)Úexc_info)rä  rå  ÚonecmdrŽ  rÙ   rÚ   r�  r�  )rÄ   r™  ÚretValr1  rB   rB   rC   ró  Ý  s   ü€üzMiniShell.onecmdc                 C   s   dS )NTrB   ©rÄ   ÚlinerB   rB   rC   Údo_exitç  rñ   zMiniShell.do_exitc                 C   s    t  |¡ ¡ }t|ƒ || _d S rÏ   )ÚosÚpopenrä   rU  rð  )rÄ   rö  ÚoutputrB   rB   rC   Údo_shellê  s   
zMiniShell.do_shellc                 C   s   t dƒ d S )Na‘  
 cd {path} - changes the current directory to {path}
 pwd - shows current remote directory
 ls  - lists all the files in the current directory
 lcd - change local directory
 get {filename} - downloads the filename from the current path
 cat {filename} - prints the contents of filename
 hexdump {filename} - hexdumps the contents of filename
 exit - terminates the server process (and this session)

)rU  rõ  rB   rB   rC   Údo_helpï  s   zMiniShell.do_helpc                 C   s2   |dkrt t ¡ ƒ d S t |¡ t t ¡ ƒ d S )Nr’  )rU  rø  ÚgetcwdÚchdirrõ  rB   rB   rC   Údo_lcdü  s   
zMiniShell.do_lcdc                 C   sâ   |  dd¡}| j}t t | j|¡¡}|| jkrd S t ||g¡}||kr.|  t |¡¡}n|  |¡}|d u rAt d¡ || _d S | 	¡ dkrQt d¡ || _d S || _
|  dd¡ t | j|¡| _t | j¡| _| jd | _d S )	Nú/rã  zDirectory not foundr   zNot a directory!r’  Fú>)Úreplacerî  ÚntpathÚnormpathr³  ÚcommonprefixÚfindPathNamerÙ   r�  r„  rì  rï  rê  )rÄ   rö  ÚpÚoldpwdÚnewPathÚcommonrÌ  rB   rB   rC   Údo_cd  s,   



zMiniShell.do_cdc                 C   sf   |dkr| j S | j}| d¡}|D ]}|dkr| j }q| |¡}|d u r(|  S | j | ¡ ¡}q|S )Nrã  r’  )ré  rì  ÚsplitrÎ  rç  r'  rk  )rÄ   ÚpathNameÚtmpINodeÚpartsÚpartrÌ  rB   rB   rC   r     s   

zMiniShell.findPathNamec                 C   s   t | jƒ d S rÏ   )rU  rî  rõ  rB   rB   rC   Údo_pwd1  rX  zMiniShell.do_pwdTc                 C   s²   | j  ¡ }|d u rg }t d| jt|ƒ| j j| j j¡ g | _|D ]6}t	| j
ƒ}|d |_|d |_t t|d ƒ¡|_|d  d¡|_|du rK| ¡  | j |j| ¡ f¡ q d S )Nz=ls summary for %s: total=%d index_root=%d index_allocation=%dr‹   rz   r…   r�   r½   T)rì  rÂ  rÙ   rÚ   rî  rÜ   r€  r�  rí  r{  rç  r‹   r  r   rK  rº   r…   rÂ   r�   r‘  rú   r„  )rÄ   rö  Údisplayr:  r.  ÚinoderB   rB   rC   rï  4  s*   
û


øzMiniShell.do_lsc                 C   s   | j ||||dd�S )Nr   )Úinclude©Úcomplete_get©rÄ   Útextrö  ÚbegidxÚendidxrB   rB   rC   Úcomplete_cdJ  s   zMiniShell.complete_cdc                 C   ó   |   ||||¡S rÏ   r  r  rB   rB   rC   Úcomplete_catM  rR  zMiniShell.complete_catc                 C   r  rÏ   r  r  rB   rB   rC   Úcomplete_hexdumpP  rR  zMiniShell.complete_hexdumpr   c           	         sV   g }|dkr	d}nt }| jD ]}|d |kr| |d ¡ qˆ r)‡ fdd„|D ƒS |S )Nr   r   c                    s"   g | ]}|  ¡  ˆ   ¡ ¡r|‘qS rB   )rÆ  Ú
startswith)r©  Úitem©r  rB   rC   r¬  `  s    þÿz*MiniShell.complete_get.<locals>.<listcomp>)rƒ  rí  rú   )	rÄ   r  rö  r  r  r  Úitemsrœ  rW  rB   r!  rC   r  S  s   
€
ÿzMiniShell.complete_getc                 C   s   | j |td�S )N©Úcommand)Údo_catr
   rõ  rB   rB   rC   Ú
do_hexdumpg  rX  zMiniShell.do_hexdumpNc              	   C   sL  |d u rt tjdtjƒj}| dd¡}t t | j|¡¡}|  	|¡}|d u r-t
 d¡ d S | ¡ dkr:t
 d¡ d S | ¡ sB| ¡ rIt
 d¡ d S | d ¡}|d u rYt
 d¡ d S | ¡ }|dkrht
 d	¡ d S d
}d}||k r�t||| ƒ}	| ||	¡}
|
s€nz||
ƒ W n ttfy’   Y d S w |t|
ƒ7 }||k spt
 d| ¡ d S )NÚbufferr   rã  z
Not found!r   zIt's a directory!z,Cannot handle compressed/encrypted files! :(zCannot read file stream!z0 bytes read (empty file)i    z%d bytes read)ÚgetattrÚsysÚstdoutÚwriter  r  r  r³  rî  r  rÙ   r�  r„  r†  rˆ  rÏ  ræ   Úinfor  rä   ÚBrokenPipeErrorÚOSErrorrÜ   )rÄ   rö  r$  r  rÌ  ÚstreamÚdataSizeÚ	chunkSizerâ   ÚtoReadr  rB   rB   rC   r%  j  sJ   






ÿ÷zMiniShell.do_catc                 C   sL   |  dd¡}t t | j|¡¡}tt |¡dƒ}| j||jd� | 	¡  d S )Nr   rã  Úwbr#  )
r  r  r  r³  rî  rÙ  Úbasenamer%  r+  Úclose)rÄ   rö  r  ÚfhrB   rB   rC   Údo_get“  s
   zMiniShell.do_get)T)r   rÏ   )r>   r?   r@   rÇ   rñ  ró  r÷  rû  rü  rÿ  r  r  r  rï  r  r  r  r  r&  r%  r7  rB   rB   rB   rC   râ  Ì  s&    



)râ  c                  C   sÄ   t tjƒ tjddd�} | jdddd� | jddd	d� | jd
ddd� | jdddd� ttjƒdkr<|  	¡  t 
d¡ |  ¡ }t |j|j¡ t|jƒ}|jd ur\| d|j ¡ d S | ¡  d S )NTzNTFS explorer (read-only))Úadd_helpÚdescriptionrç  Ústorez1NTFS volume to open (e.g. \\.\C: or /dev/disk1s1))ÚactionÚhelpz-extractz5extracts pathname (e.g. \windows\system32\config\sam)z-debugÚ
store_truezTurn DEBUG output ONz-tsz&Adds timestamp to every logging outputr   zget %s)rU  r   ÚBANNERÚargparseÚArgumentParserÚadd_argumentrÜ   r)  ÚargvÚ
print_helpÚexitÚ
parse_argsr   ÚinitÚtsrÚ   râ  rç  Úextractró  Úcmdloop)ÚparserÚoptionsÚshellrB   rB   rC   Úmainš  s   



rM  Ú__main__)Ú
__future__r   r   rø  r)  rÙ   r÷   r?  rä  r  Úsixr   r   r   Úimpacket.examplesr   Úimpacketr   Úimpacket.structurer	   r
   rÜ  ÚUNUSEDr�  r   rž  Ú	OBJECT_IDÚSECURITY_DESCRIPTORÚVOLUME_NAMEÚVOLUME_INFORMATIONr*  r¢  r¡  ÚBITMAPÚREPARSE_POINTÚEA_INFORMATIONÚEAÚPROPERTY_SETÚLOGGED_UTILITY_STREAMÚFIRST_USER_DEFINED_ATTRIBUTErÁ   ÚATTR_IS_COMPRESSEDÚATTR_COMPRESSION_MASKÚATTR_IS_ENCRYPTEDÚATTR_IS_SPARSEÚFILE_NAME_POSIXÚFILE_NAME_WIN32rŸ  ÚFILE_NAME_WIN32_AND_DOSÚMFT_RECORD_IN_USEÚMFT_RECORD_IS_DIRECTORYÚMFT_RECORD_IS_4ÚMFT_RECORD_IS_VIEW_INDEXÚMFT_REC_SPACE_FILLERÚFILE_ATTR_READONLYrš  r›  ÚFILE_ATTR_DIRECTORYÚFILE_ATTR_ARCHIVEÚFILE_ATTR_DEVICEÚFILE_ATTR_NORMALÚFILE_ATTR_TEMPORARYr‰  ÚFILE_ATTR_REPARSE_POINTr…  ÚFILE_ATTR_OFFLINEÚFILE_ATTR_NOT_CONTENT_INDEXEDr‡  ÚFILE_ATTR_VALID_FLAGSÚFILE_ATTR_VALID_SET_FLAGSrƒ  ÚFILE_ATTR_VIEW_INDEX_PRESENTrÛ  ÚFILE_MFTMirrÚFILE_LogFileÚFILE_VolumeÚFILE_AttrDefrè  ÚFILE_BitmapÚ	FILE_BootÚFILE_BadClusÚFILE_SecureÚFILE_UpCaseÚFILE_ExtendÚSMALL_INDEXÚLARGE_INDEXÚ	LEAF_NODEÚ
INDEX_NODEÚ	NODE_MASKrc  rf  ÚINDEX_ENTRY_SPACE_FILLERr*   rE   rO   rV   rh   rq   r|   r€   r’   r“   r—   rž   r¢   r¥   r¬   r±   rº   r¼   rØ   rè   r  rC  rM  rT  rY  r]  rl  rs  r{  rÐ  rå  râ  rM  r>   rD  rB   rB   rB   rC   Ú<module>   sú   
		
	
 /h!  PX O
þ