
    [
#g[                         d dl mZ d dlmZmZmZ  G d dej                        Z G d dej                        Z G d dej                        Z	y	)
    )Optional)objects	constants
exceptionsc                       e Zd ZdZdefdZy)MFTEntryz#This represents the base MFT Recordreturnc                 B    | j                   j                  ddd      }|S )Nstring   zlatin-1)
max_lengthencoding)	Signaturecast)self	signatures     f/home/panchajanya/Development/work/volatility3/volatility3/framework/symbols/windows/extensions/mft.pyget_signaturezMFTEntry.get_signature   s#    NN''Q'S	    N)__name__
__module____qualname____doc__strr    r   r   r   r   
   s    -s r   r   c                       e Zd ZdZdefdZy)MFTFileNamez+This represents an MFT $FILE_NAME Attributer	   c                 ^    | j                   j                  dd| j                  dz  d      }|S )Nr   utf16   replace)r   r   errors)Namer   
NameLength)r   outputs     r   get_full_namezMFTFileName.get_full_name   s2    w4??Q3Fy   
 r   N)r   r   r   r   r   r&   r   r   r   r   r      s    5s r   r   c                   4    e Zd ZdZdee   fdZdee   fdZy)MFTAttributez This represents an MFT ATTRIBUTEr	   c                    | j                   j                  dkD  s| j                   j                  dkD  ry 	 | j                  j	                  | j
                  j                  j                  t        j                        d   t        j                  z   dz   | j
                  j                  | j
                  j                  | j                   j                  z   | j                   j                  dz  dd      }|S # t        j                  $ r Y y w xY w)	N  @ i   r   r   r    r!   r   )
layer_nameoffsetr   r"   r   )Attr_HeaderContentOffsetr$   _contextobjectvol	type_namesplitr   BANGr+   r,   
NameOffsetr   InvalidAddressException)r   names     r   get_resident_filenamez"MFTAttribute.get_resident_filename   s     **X5**S0	==''""((8;innLxW88..xx)9)9)D)DD++66:   ( D K11 		s   C C6 6DDc                 >   | j                   j                  dkD  s| j                   j                  dkD  ry 	 | j                  j	                  | j
                  j                  j                  t        j                        d   t        j                  z   dz   | j
                  j                  | j
                  j                  | j                   j                  z   | j
                  j                  | j                   j                        }|S # t        j                  $ r Y y w xY w)Nr*   r   bytes)r+   r,   native_layer_namelength)r-   r.   ContentLengthr/   r0   r1   r2   r3   r   r4   r+   r,   r;   r   r6   )r   bytesobjs     r   get_resident_filecontentz%MFTAttribute.get_resident_filecontent6   s     **X5--8
	}}++""((8;innLwV88..xx)9)9)G)GG"&(("<"<''55 , H O11 		s   CD DDN)	r   r   r   r   r   r   r8   r:   r?   r   r   r   r(   r(      s%    *x} .(5/ r   r(   N)
typingr   volatility3.frameworkr   r   r   
StructTyper   r   r(   r   r   r   <module>rC      sF   
  @ @w!! '$$ .7%% .r   