add initial support for $I30 index records #11

jleaniz · 2021-11-19T17:20:29Z

Added a data structure definition file and supporting class/methods for NTFS INDX directory records

joachimmetz · 2021-11-21T08:47:37Z

dtformats/indx_directory_entry.py

+
+from dtformats import data_format
+from dtformats.errors import ParseError
+


using the l2t/Plaso style guide here: please add an additional white line

joachimmetz · 2021-11-21T08:48:51Z

dtformats/indx_directory_entry.py

@@ -0,0 +1,144 @@
+# -*- coding: utf-8 -*-
+"""INDX entries """


Are these NTFS $I30 index entries? Note that NTFS support different types of index entries as well, so please be as specific as possible here.

joachimmetz · 2021-11-21T08:49:22Z

dtformats/indx_directory_entry.py

+import os
+
+from dtformats import data_format
+from dtformats.errors import ParseError


Please don't import classes directly see https://github.com/log2timeline/l2tdocs/blob/main/process/Style-guide.md

joachimmetz · 2021-11-21T08:50:00Z

dtformats/indx_directory_entry.py

+  """
+
+  _FABRIC = data_format.BinaryDataFile.ReadDefinitionFile(
+    'indx_directory_entry.yml')


style nit: 4 space continuation indentation (repeat elsewhere as well)

joachimmetz · 2021-11-21T08:50:42Z

dtformats/indx_directory_entry.py

+    'indx_directory_entry.yml')
+
+  _DEBUG_INDX_ENTRY_HEADER = [
+    ('signature', 'signature', ''),


missing debug value print function

joachimmetz

Left some comment, PTAL at the style guide

joachimmetz · 2021-11-21T08:51:49Z

dtformats/indx_directory_entry.py

+from dtformats import data_format
+from dtformats.errors import ParseError
+
+class INDXRecord(data_format.BinaryDataFile):


Limit the use of abbreviation, for international audiences these lead to unnecessary additional confusion

joachimmetz · 2021-11-21T08:52:19Z

dtformats/indx_directory_entry.py

+      ('filename', 'filename', '_FormatString')]
+
+  def PrintRecord(self, record):
+    """


style consistency nit: start on the first line directly after """

joachimmetz · 2021-11-21T08:52:39Z

dtformats/indx_directory_entry.py

+    Args:
+        record (index_dir_entry): An index_dir_entry structure.
+    """
+    if record is not None:


why not if not record ?

I will change this to if record -- I am checking if record has a value other than None

joachimmetz · 2021-11-21T08:52:59Z

dtformats/indx_directory_entry.py

+          record.index_key_data, self._DEBUG_FILE_NAME_ATTR)
+
+
+  def _ParseIndexEntryHeader(self, file_object):


missing docstring

joachimmetz · 2021-11-21T08:53:09Z

dtformats/indx_directory_entry.py

+          record, self._DEBUG_INDX_DIR_RECORD)
+        self._DebugPrintStructureObject(
+          record.index_key_data, self._DEBUG_FILE_NAME_ATTR)
+


remove 1 white line

joachimmetz · 2021-11-21T08:53:58Z

dtformats/indx_directory_entry.yml

@@ -0,0 +1,158 @@
+name: index_record


index_record > ntfs_i30_index

joachimmetz · 2021-11-21T08:54:53Z

dtformats/indx_directory_entry.yml

@@ -0,0 +1,158 @@
+name: index_record
+type: format
+description: Index Directory Entry


(change to something in line with) NTFS $I30 index, which contains directory entries

joachimmetz · 2021-11-21T08:55:26Z

dtformats/indx_directory_entry.yml

+name: index_record
+type: format
+description: Index Directory Entry
+urls: ["https://github.com/libyal/libfsntfs/blob/83c2f4ce3d16b5535eae9de767adc93fff724004/documentation/New%20Technologies%20File%20System%20(NTFS).asciidoc#index"]


please pin to main (latest version of the documentation)

joachimmetz · 2021-11-21T08:56:34Z

dtformats/indx_directory_entry.yml

+description: Index Directory Entry
+urls: ["https://github.com/libyal/libfsntfs/blob/83c2f4ce3d16b5535eae9de767adc93fff724004/documentation/New%20Technologies%20File%20System%20(NTFS).asciidoc#index"]
+metadata:
+  authors: ['Joachim Metz <[email protected]>', 'Juan Leaniz <[email protected]']


for multiple entries use:

authors: - Juan Leaniz <[email protected]'

However you can remove me at this point since I did not author this file

joachimmetz · 2021-11-21T08:57:43Z

dtformats/indx_directory_entry.yml

+- name: index_node_flags
+  data_type: uint32
+---
+name: index_dir_entry


don't abbreviate

… into add-indx-support

jleaniz · 2021-11-22T21:07:03Z

Renamed .py and .yml file names to use non-abbreviated names. Addressed style and other comments.

jleaniz · 2021-12-08T19:34:04Z

@joachimmetz PTAL, minor changes

jleaniz added 2 commits November 19, 2021 17:11

add initial support for index I30 records

5fd5d97

add initial support for $I30 index records

cd92890

joachimmetz self-assigned this Nov 21, 2021

joachimmetz self-requested a review November 21, 2021 08:46

joachimmetz reviewed Nov 21, 2021

View reviewed changes

joachimmetz requested changes Nov 21, 2021

View reviewed changes

jleaniz added 3 commits November 22, 2021 20:48

new formatting method and code style changes

5066fee

Merge branch 'add-indx-support' of https://github.com/jleaniz/dtformats…

0ea0966

… into add-indx-support

remove old files

40a44a5

jleaniz requested a review from joachimmetz November 22, 2021 21:07

jleaniz added 2 commits December 6, 2021 14:09

updated tests and fixed style issues

0f93c9a

fix formatting

7a8b5f8

joachimmetz force-pushed the main branch 3 times, most recently from 1ebe12b to 4524810 Compare February 15, 2022 20:54

joachimmetz force-pushed the main branch from ef54ff2 to fe264cf Compare February 12, 2023 16:39

joachimmetz force-pushed the main branch 8 times, most recently from 85d9b05 to 00df5f2 Compare May 21, 2023 08:26

joachimmetz force-pushed the main branch 6 times, most recently from a6c6c05 to 4116264 Compare May 28, 2023 13:36

joachimmetz force-pushed the main branch 6 times, most recently from 05669cf to f36ac18 Compare June 3, 2023 11:18

joachimmetz force-pushed the main branch 13 times, most recently from 5e1c1c1 to 7f03eae Compare June 11, 2023 11:19

joachimmetz force-pushed the main branch 2 times, most recently from f152369 to 2d1d66b Compare June 18, 2023 17:17

joachimmetz force-pushed the main branch 2 times, most recently from 817df43 to 4b73068 Compare January 4, 2024 05:09

joachimmetz force-pushed the main branch from 7a6c4bc to e0caebc Compare March 10, 2024 09:07

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

add initial support for $I30 index records #11

add initial support for $I30 index records #11

jleaniz commented Nov 19, 2021

joachimmetz Nov 21, 2021 •

edited

Loading

joachimmetz Nov 21, 2021

joachimmetz Nov 21, 2021

joachimmetz Nov 21, 2021 •

edited

Loading

joachimmetz Nov 21, 2021

joachimmetz left a comment

joachimmetz Nov 21, 2021

joachimmetz Nov 21, 2021

joachimmetz Nov 21, 2021

jleaniz Nov 22, 2021

joachimmetz Nov 21, 2021

joachimmetz Nov 21, 2021

joachimmetz Nov 21, 2021

joachimmetz Nov 21, 2021

joachimmetz Nov 21, 2021

joachimmetz Nov 21, 2021

joachimmetz Nov 21, 2021

jleaniz commented Nov 22, 2021

jleaniz commented Dec 8, 2021


		from dtformats import data_format
		from dtformats.errors import ParseError

		record.index_key_data, self._DEBUG_FILE_NAME_ATTR)


		def _ParseIndexEntryHeader(self, file_object):

add initial support for $I30 index records #11

Are you sure you want to change the base?

add initial support for $I30 index records #11

Conversation

jleaniz commented Nov 19, 2021

joachimmetz Nov 21, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

joachimmetz Nov 21, 2021 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

joachimmetz left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jleaniz commented Nov 22, 2021

jleaniz commented Dec 8, 2021

joachimmetz Nov 21, 2021 •

edited

Loading

joachimmetz Nov 21, 2021 •

edited

Loading