Source code for dfvfs.vfs.ntfs_data_stream

# -*- coding: utf-8 -*-
"""The NTFS data stream implementation."""

from dfvfs.lib import definitions
from dfvfs.vfs import data_stream
from dfvfs.vfs import extent


[docs] class NTFSDataStream(data_stream.DataStream): """File system data stream that uses pyfsntfs."""
[docs] def __init__(self, file_entry, fsntfs_data_stream): """Initializes a NTFS data stream. Args: file_entry (FileEntry): file entry. fsntfs_data_stream (pyfsntfs.data_stream): NTFS data stream. """ super(NTFSDataStream, self).__init__(file_entry) self._fsntfs_data_stream = fsntfs_data_stream if fsntfs_data_stream: self._name = fsntfs_data_stream.name
[docs] def GetExtents(self): """Retrieves the extents. Returns: list[Extent]: the extents of the data stream. """ if not self._fsntfs_data_stream: return super(NTFSDataStream, self).GetExtents() extents = [] for extent_index in range(self._fsntfs_data_stream.number_of_extents): extent_offset, extent_size, extent_flags = ( self._fsntfs_data_stream.get_extent(extent_index)) if extent_flags & 0x1: extent_type = definitions.EXTENT_TYPE_SPARSE else: extent_type = definitions.EXTENT_TYPE_DATA data_stream_extent = extent.Extent( extent_type=extent_type, offset=extent_offset, size=extent_size) extents.append(data_stream_extent) return extents