Index index by Group index by Distribution index by Vendor index by creation date index by Name Mirrors Help Search

analyzeMFT-2.0.4-lp152.3.3 RPM for noarch

From OpenSuSE Leap 15.2 for noarch

Name: analyzeMFT Distribution: openSUSE Leap 15.2
Version: 2.0.4 Vendor: openSUSE
Release: lp152.3.3 Build date: Sun Mar 1 11:12:31 2020
Group: Development/Libraries/Python Build host: lamb02
Size: 80390 Source RPM: analyzeMFT-2.0.4-lp152.3.3.src.rpm
Packager: https://bugs.opensuse.org
Url: https://github.com/dkovar/analyzeMFT
Summary: A Python tool to deconstruct the Windows NTFS $MFT file
 
analyzeMFT.py is designed to fully parse the MFT file from an NTFS filesystem and present the results as accurately as possible in a format that allows further analysis with other tools. At present, it parses the attributes from a $MFT file to produce the following output:

    Record Number
    Good - if the entry is valid
    Active - if the entry is active
    Record type - the type of record
    Record Sequence - the sequence number for the record
    Parent Folder Record Number
    Parent Folder Sequence Number
    For the standard information attribute:
        Creation date
        Modification date
        Access date
        Entry date
    For up to four file name records:
        File name
        Creation date
        Modification date
        Access date
        Entry date
        Object ID
        Birth Volume ID
        Birth Object ID
        Birth Domain ID
    And flags to show if each of the following attributes is present:
        Standard Information, Attribute List, Filename, Object ID, Volume Name, Volume Info, Data, Index Root, Index Allocation, Bitmap, Reparse Point, EA Information, EA, Property Set, Logged Utility Stream
    Notes/Log - Field used to log any significant events or observations relating to this record
        std-fn-shift - Populated if anomaly detection is turned on. Y/N. Y indicates that the FN create date is later than the STD create date.
        usec-zero - Populated if anomaly detection is turned on. Y/N. Y indicates that the STD create date's microsecond value is zero.

For each entry in the MFT a record is written to an output file in CSV format.

Major contributions from Matt Sabourin.

Provides

Requires

License

CPL-1.0

Changelog

* Thu Sep 11 2014 Greg.Freemyer@gmail.com
  - update to v2.0.4
    * converted to a module
    * setup for pypi
  - updated Url and Source fields
  - use newly available python setup.py install
  - updated %files section since this is now a more traditional python package
* Sat Feb 18 2012 Greg.Freemyer@gmail.com
  - initial package submission
      A Python tool to deconstruct the Windows NTFS $MFT file

Files

/usr/bin/analyzeMFT.py
/usr/lib/python2.7/site-packages/analyzeMFT-2.0.4-py2.7.egg-info
/usr/lib/python2.7/site-packages/analyzemft
/usr/lib/python2.7/site-packages/analyzemft/__init__.py
/usr/lib/python2.7/site-packages/analyzemft/__init__.pyc
/usr/lib/python2.7/site-packages/analyzemft/mft.py
/usr/lib/python2.7/site-packages/analyzemft/mft.pyc
/usr/lib/python2.7/site-packages/analyzemft/mftsession.py
/usr/lib/python2.7/site-packages/analyzemft/mftsession.pyc
/usr/lib/python2.7/site-packages/analyzemft/mftutils.py
/usr/lib/python2.7/site-packages/analyzemft/mftutils.pyc
/usr/lib/python2.7/site-packages/analyzemft/test
/usr/lib/python2.7/site-packages/analyzemft/test/__init__.py
/usr/lib/python2.7/site-packages/analyzemft/test/__init__.pyc
/usr/share/doc/packages/analyzeMFT
/usr/share/doc/packages/analyzeMFT/CHANGES.txt
/usr/share/doc/packages/analyzeMFT/LICENSE.txt
/usr/share/doc/packages/analyzeMFT/README.txt

Generated by rpm2html 1.8.1

Fabrice Bellet, Tue Apr 9 11:50:38 2024