Skip to content

Commit

Permalink
Revert "Read MFT records based on segment numbers"
Browse files Browse the repository at this point in the history
This reverts commit a89a68b.
  • Loading branch information
Zawadidone committed Apr 9, 2024
1 parent a89a68b commit a01c824
Show file tree
Hide file tree
Showing 2 changed files with 6 additions and 40 deletions.
33 changes: 6 additions & 27 deletions dissect/ntfs/mft.py
Original file line number Diff line number Diff line change
Expand Up @@ -46,9 +46,6 @@ class Mft:
def __init__(self, fh: BinaryIO, ntfs: Optional[NTFS] = None):
self.fh = fh
self.ntfs = ntfs
self.record_size = self.ntfs._record_size if self.ntfs else DEFAULT_RECORD_SIZE
self.mft_size = self.get(FILE_NUMBER_MFT).size()
self.last_segment_number = self.mft_size // self.record_size

self.get = lru_cache(4096)(self.get)

Expand Down Expand Up @@ -113,7 +110,9 @@ def get(self, ref: Union[int, str, Instance], root: Optional[MftRecord] = None)
ref = segment_reference(ref)

if isinstance(ref, int):
record = MftRecord.from_fh(self.fh, ref * self.record_size, ntfs=self.ntfs)
record_size = self.ntfs._record_size if self.ntfs else DEFAULT_RECORD_SIZE

record = MftRecord.from_fh(self.fh, ref * record_size, ntfs=self.ntfs)
record.segment = ref
return record
elif isinstance(ref, str):
Expand All @@ -123,30 +122,10 @@ def get(self, ref: Union[int, str, Instance], root: Optional[MftRecord] = None)

def segments(self) -> Iterator[MftRecord]:
"""Yield all valid MFT records, regardless if they're allocated or not."""
record_size = self.ntfs._record_size if self.ntfs else DEFAULT_RECORD_SIZE
mft_size = self.get(FILE_NUMBER_MFT).size()

for segment in range(self.last_segment_number):
try:
yield self.get(segment)
except Error:
continue
except EOFError:
break

def segments_by_range(self, start: int, end: int) -> Iterator[MftRecord]:
"""Yield all valid MFT records within the specified segment range, regardless if they're allocated or not.
Args:
start (int): The starting segment number.
end (int): The ending segment number.
Raises:
Error: If the start segment number is higher than the end segment number.
"""

if start > end:
raise Error("The start segment cannot be higher than the end segment number")

for segment in range(start, end + 1):
for segment in range(mft_size // record_size):
try:
yield self.get(segment)
except Error:
Expand Down
13 changes: 0 additions & 13 deletions tests/test_mft.py
Original file line number Diff line number Diff line change
Expand Up @@ -79,16 +79,3 @@ def test_mft_record() -> None:
record = mft.get(0)
assert record.filename == "$MFT"
assert record.filenames() == ["$MFT"]


def test_mft_records_segment_number(mft_bin: BinaryIO) -> None:
fs = NTFS(mft=mft_bin)

assert fs.mft
assert len(list(fs.mft.segments())) == 37

records = list(fs.mft.segments_by_range(0, 4))

assert len(records) == 5
assert records[0].filename == "$MFT"
assert records[4].filename == "$AttrDef"

0 comments on commit a01c824

Please sign in to comment.