add initial support for $I30 index records by jleaniz · Pull Request #11 · libyal/dtformats

jleaniz · 2021-11-19T17:20:29Z

Added a data structure definition file and supporting class/methods for NTFS INDX directory records

joachimmetz · 2021-11-21T08:47:37Z

+
+from dtformats import data_format
+from dtformats.errors import ParseError
+


using the l2t/Plaso style guide here: please add an additional white line

joachimmetz · 2021-11-21T08:48:51Z

@@ -0,0 +1,144 @@
+# -*- coding: utf-8 -*-
+"""INDX entries """


Are these NTFS $I30 index entries? Note that NTFS support different types of index entries as well, so please be as specific as possible here.

joachimmetz · 2021-11-21T08:49:22Z

+import os
+
+from dtformats import data_format
+from dtformats.errors import ParseError


Please don't import classes directly see https://github.com/log2timeline/l2tdocs/blob/main/process/Style-guide.md

joachimmetz · 2021-11-21T08:50:00Z

+  """
+
+  _FABRIC = data_format.BinaryDataFile.ReadDefinitionFile(
+    'indx_directory_entry.yml')


style nit: 4 space continuation indentation (repeat elsewhere as well)

joachimmetz · 2021-11-21T08:50:42Z

+    'indx_directory_entry.yml')
+
+  _DEBUG_INDX_ENTRY_HEADER = [
+    ('signature', 'signature', ''),


missing debug value print function

joachimmetz

Left some comment, PTAL at the style guide

joachimmetz · 2021-11-21T08:51:49Z

+from dtformats import data_format
+from dtformats.errors import ParseError
+
+class INDXRecord(data_format.BinaryDataFile):


Limit the use of abbreviation, for international audiences these lead to unnecessary additional confusion

joachimmetz · 2021-11-21T08:52:19Z

+      ('filename', 'filename', '_FormatString')]
+
+  def PrintRecord(self, record):
+    """


style consistency nit: start on the first line directly after """

joachimmetz · 2021-11-21T08:52:39Z

+    Args:
+        record (index_dir_entry): An index_dir_entry structure.
+    """
+    if record is not None:


why not if not record ?

I will change this to if record -- I am checking if record has a value other than None

joachimmetz · 2021-11-21T08:52:59Z

+          record.index_key_data, self._DEBUG_FILE_NAME_ATTR)
+
+
+  def _ParseIndexEntryHeader(self, file_object):


missing docstring

joachimmetz · 2021-11-21T08:53:09Z

+          record, self._DEBUG_INDX_DIR_RECORD)
+        self._DebugPrintStructureObject(
+          record.index_key_data, self._DEBUG_FILE_NAME_ATTR)
+


remove 1 white line

joachimmetz · 2021-11-21T08:53:58Z

@@ -0,0 +1,158 @@
+name: index_record


index_record > ntfs_i30_index

joachimmetz · 2021-11-21T08:54:53Z

@@ -0,0 +1,158 @@
+name: index_record
+type: format
+description: Index Directory Entry


(change to something in line with) NTFS $I30 index, which contains directory entries

joachimmetz · 2021-11-21T08:55:26Z

+name: index_record
+type: format
+description: Index Directory Entry
+urls: ["https://github.com/libyal/libfsntfs/blob/83c2f4ce3d16b5535eae9de767adc93fff724004/documentation/New%20Technologies%20File%20System%20(NTFS).asciidoc#index"]


please pin to main (latest version of the documentation)

joachimmetz · 2021-11-21T08:56:34Z

+description: Index Directory Entry
+urls: ["https://github.com/libyal/libfsntfs/blob/83c2f4ce3d16b5535eae9de767adc93fff724004/documentation/New%20Technologies%20File%20System%20(NTFS).asciidoc#index"]
+metadata:
+  authors: ['Joachim Metz <joachim.metz@gmail.com>', 'Juan Leaniz <juan.leaniz@gmail.com']


for multiple entries use:

authors: - Juan Leaniz <juan.leaniz@gmail.com'

However you can remove me at this point since I did not author this file

joachimmetz · 2021-11-21T08:57:43Z

+- name: index_node_flags
+  data_type: uint32
+---
+name: index_dir_entry


don't abbreviate

… into add-indx-support

jleaniz · 2021-11-22T21:07:03Z

Renamed .py and .yml file names to use non-abbreviated names. Addressed style and other comments.

jleaniz · 2021-12-08T19:34:04Z

@joachimmetz PTAL, minor changes

jleaniz added 2 commits November 19, 2021 17:11

add initial support for index I30 records

5fd5d97

add initial support for $I30 index records

cd92890

joachimmetz self-assigned this Nov 21, 2021

joachimmetz self-requested a review November 21, 2021 08:46

joachimmetz reviewed Nov 21, 2021

View reviewed changes

joachimmetz requested changes Nov 21, 2021

View reviewed changes

jleaniz added 3 commits November 22, 2021 20:48

new formatting method and code style changes

5066fee

Merge branch 'add-indx-support' of https://github.com/jleaniz/dtformats…

0ea0966

… into add-indx-support

remove old files

40a44a5

jleaniz requested a review from joachimmetz November 22, 2021 21:07

jleaniz added 2 commits December 6, 2021 14:09

updated tests and fixed style issues

0f93c9a

fix formatting

7a8b5f8

joachimmetz force-pushed the main branch 3 times, most recently from 1ebe12b to 4524810 Compare February 15, 2022 20:54

joachimmetz force-pushed the main branch from ef54ff2 to fe264cf Compare February 12, 2023 16:39

joachimmetz force-pushed the main branch 8 times, most recently from 85d9b05 to 00df5f2 Compare May 21, 2023 08:26

joachimmetz force-pushed the main branch 6 times, most recently from a6c6c05 to 4116264 Compare May 28, 2023 13:36

joachimmetz force-pushed the main branch 6 times, most recently from 05669cf to f36ac18 Compare June 3, 2023 11:18

joachimmetz force-pushed the main branch 13 times, most recently from 5e1c1c1 to 7f03eae Compare June 11, 2023 11:19

joachimmetz force-pushed the main branch 2 times, most recently from f152369 to 2d1d66b Compare June 18, 2023 17:17

joachimmetz force-pushed the main branch 2 times, most recently from 817df43 to 4b73068 Compare January 4, 2024 05:09

joachimmetz force-pushed the main branch from 7a6c4bc to e0caebc Compare March 10, 2024 09:07


		from dtformats import data_format
		from dtformats.errors import ParseError

		record.index_key_data, self._DEBUG_FILE_NAME_ATTR)


		def _ParseIndexEntryHeader(self, file_object):

Uh oh!

Conversation

jleaniz commented Nov 19, 2021

Uh oh!

joachimmetz Nov 21, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

joachimmetz Nov 21, 2021 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

joachimmetz left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jleaniz commented Nov 22, 2021

Uh oh!

jleaniz commented Dec 8, 2021

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

joachimmetz Nov 21, 2021 •

edited

Loading

joachimmetz Nov 21, 2021 •

edited

Loading