mirror of
https://github.com/volatilityfoundation/volatility3.git
synced 2026-09-06 17:57:38 +02:00
Revert "Add versioning to MFT extension classes"
This reverts commit 1d20e65759.
This commit is contained in:
@@ -49,21 +49,6 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
|
||||
component=timeliner.TimeLinerInterface,
|
||||
version=(1, 0, 0),
|
||||
),
|
||||
requirements.VersionRequirement(
|
||||
name="mft_entry",
|
||||
component=mft.MFTEntry,
|
||||
version=(1, 0, 0),
|
||||
),
|
||||
requirements.VersionRequirement(
|
||||
name="mft_filename",
|
||||
component=mft.MFTFileName,
|
||||
version=(1, 0, 0),
|
||||
),
|
||||
requirements.VersionRequirement(
|
||||
name="mft_attribute",
|
||||
component=mft.MFTAttribute,
|
||||
version=(1, 0, 0),
|
||||
),
|
||||
requirements.VersionRequirement(
|
||||
name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0)
|
||||
),
|
||||
|
||||
@@ -5,20 +5,14 @@
|
||||
import logging
|
||||
from typing import Dict, Iterator, List, Optional, Tuple
|
||||
|
||||
from volatility3 import framework
|
||||
from volatility3.framework import constants, exceptions, interfaces, objects
|
||||
|
||||
vollog = logging.getLogger(__name__)
|
||||
|
||||
|
||||
class MFTEntry(objects.StructType, interfaces.configuration.VersionableInterface):
|
||||
class MFTEntry(objects.StructType):
|
||||
"""This represents the base MFT Record"""
|
||||
|
||||
_version = (1, 0, 0)
|
||||
_required_framework_version = (2, 26, 0)
|
||||
|
||||
framework.require_interface_version(*_required_framework_version)
|
||||
|
||||
def __init__(
|
||||
self,
|
||||
context: interfaces.context.ContextInterface,
|
||||
@@ -150,15 +144,9 @@ class MFTEntry(objects.StructType, interfaces.configuration.VersionableInterface
|
||||
yield attr
|
||||
|
||||
|
||||
class MFTFileName(objects.StructType, interfaces.configuration.VersionableInterface):
|
||||
class MFTFileName(objects.StructType):
|
||||
"""This represents an MFT $FILE_NAME Attribute"""
|
||||
|
||||
_version = (1, 0, 0)
|
||||
|
||||
_required_framework_version = (2, 26, 0)
|
||||
|
||||
framework.require_interface_version(*_required_framework_version)
|
||||
|
||||
def get_full_name(self) -> objects.String:
|
||||
output = self.Name.cast(
|
||||
"string", encoding="utf16", max_length=self.NameLength * 2, errors="replace"
|
||||
@@ -166,15 +154,9 @@ class MFTFileName(objects.StructType, interfaces.configuration.VersionableInterf
|
||||
return output
|
||||
|
||||
|
||||
class MFTAttribute(objects.StructType, interfaces.configuration.VersionableInterface):
|
||||
class MFTAttribute(objects.StructType):
|
||||
"""This represents an MFT ATTRIBUTE"""
|
||||
|
||||
_version = (1, 0, 0)
|
||||
|
||||
_required_framework_version = (2, 26, 0)
|
||||
|
||||
framework.require_interface_version(*_required_framework_version)
|
||||
|
||||
def get_resident_filename(self) -> Optional[objects.String]:
|
||||
# 4MB chosen as cutoff instead of 4KB to allow for recovery from format /L created file systems
|
||||
# Length as 512 as its 256*2, which is the maximum size for an entire file path, so this is even generous
|
||||
|
||||
Reference in New Issue
Block a user