
    Xf|                         d dl mZmZmZ  G d dej                  Z G d dej                  Z G d dej                  ZdS )	    )objects	constants
exceptionsc                       e Zd ZdZdefdZdS )MFTEntryz#This represents the base MFT Recordreturnc                 @    | j                             ddd          }|S )Nstring   zlatin-1)
max_lengthencoding)	Signaturecast)self	signatures     f/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/windows/extensions/mft.pyget_signaturezMFTEntry.get_signature   s$    N''Q'SS	    N)__name__
__module____qualname____doc__strr    r   r   r   r      s5        --s      r   r   c                       e Zd ZdZdefdZdS )MFTFileNamez+This represents an MFT $FILE_NAME Attributer   c                 R    | j                             dd| j        dz  d          }|S )Nr
   utf16   replace)r   r   errors)Namer   
NameLength)r   outputs     r   get_full_namezMFTFileName.get_full_name   s3    w4?Q3Fy   
 
 r   N)r   r   r   r   r   r%   r   r   r   r   r      s5        55s      r   r   c                   *    e Zd ZdZdefdZdefdZdS )MFTAttributez This represents an MFT ATTRIBUTEr   c                 J   	 | j                             | j        j                            t
          j                  d         t
          j        z   dz   | j        j        | j        j        | j	        j
        z   | j	        j        dz  dd          }|S # t          j        $ r Y d S w xY w)Nr   r
   r   r    r   )
layer_nameoffsetr   r!   r   )_contextobjectvol	type_namesplitr   BANGr)   r*   Attr_Header
NameOffsetr#   r   InvalidAddressException)r   names     r   get_resident_filenamez"MFTAttribute.get_resident_filename   s    	=''"((88;inLxW8.x)9)DD+6:   (  D K1 	 	 	44	s   BB B"!B"c                 V   	 | j                             | j        j                            t
          j                  d         t
          j        z   dz   | j        j        | j        j        | j	        j
        z   | j        j        | j	        j                  }|S # t          j        $ r Y d S w xY w)Nr   bytes)r)   r*   native_layer_namelength)r+   r,   r-   r.   r/   r   r0   r)   r*   r1   ContentOffsetr8   ContentLengthr   r3   )r   bytesobjs     r   get_resident_filecontentz%MFTAttribute.get_resident_filecontent,   s    
	}++"((88;inLwV8.x)9)GG"&("<'5 ,  H O1 	 	 	44	s   BB B('B(N)r   r   r   r   r   r5   r7   r=   r   r   r   r'   r'      sP        **s    %      r   r'   N)volatility3.frameworkr   r   r   
StructTyper   r   r'   r   r   r   <module>r@      s   
 A @ @ @ @ @ @ @ @ @    w!       '$       7%     r   