Read segments backwards

dissect/ntfs/mft.py

@@ -121,14 +121,17 @@ def get(self, ref: Union[int, str, Instance], root: Optional[MftRecord] = None)
             raise TypeError(f"Invalid MFT reference: {ref!r}")
 
     def segments(self, start: int = 0, end: int = -1) -> Iterator[MftRecord]:
-        """Yield all valid MFT records, regardless if they're allocated or not."""
+        """Yield all valid MFT records, regardless if they're allocated or not.
+
+        Args:
+            start: The starting segment number.
+            end: The ending segment number.
+        """
         record_size = self.ntfs._record_size if self.ntfs else DEFAULT_RECORD_SIZE
         end = (self.get(FILE_NUMBER_MFT).size() // record_size) if end == -1 else end
+        step = 1 if start <= end else -1
 
-        if start > end:
-            raise Error("The start segment cannot be higher than the end segment number")
-
-        for segment in range(start, end + 1):
+        for segment in range(start, end + step, step):
             try:
                 yield self.get(segment)
             except Error:

tests/test_mft.py

@@ -83,12 +83,14 @@ def test_mft_record() -> None:
 
 def test_mft_records_segment_number(mft_bin: BinaryIO) -> None:
     fs = NTFS(mft=mft_bin)
-
     assert fs.mft
-    assert len(list(fs.mft.segments())) == 37
 
-    records = list(fs.mft.segments(0, 4))
+    records_forward = list(fs.mft.segments(0, 4))
+    assert len(records_forward) == 5
+    assert records_forward[0].filename == "$MFT"
+    assert records_forward[4].filename == "$AttrDef"
 
-    assert len(records) == 5
-    assert records[0].filename == "$MFT"
-    assert records[4].filename == "$AttrDef"
+    records_backwards = list(fs.mft.segments(4, 0))
+    assert len(records_backwards) == 5
+    assert records_backwards[0].filename == "$AttrDef"
+    assert records_backwards[4].filename == "$MFT"