Revert "Add versioning to MFT extension classes"

This reverts commit 1d20e65759.
This commit is contained in:
David McDonald
2025-04-03 17:56:16 -05:00
parent ebbbe913dc
commit 41de562e55
2 changed files with 3 additions and 36 deletions
@@ -49,21 +49,6 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface):
component=timeliner.TimeLinerInterface,
version=(1, 0, 0),
),
requirements.VersionRequirement(
name="mft_entry",
component=mft.MFTEntry,
version=(1, 0, 0),
),
requirements.VersionRequirement(
name="mft_filename",
component=mft.MFTFileName,
version=(1, 0, 0),
),
requirements.VersionRequirement(
name="mft_attribute",
component=mft.MFTAttribute,
version=(1, 0, 0),
),
requirements.VersionRequirement(
name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0)
),
@@ -5,20 +5,14 @@
import logging
from typing import Dict, Iterator, List, Optional, Tuple
from volatility3 import framework
from volatility3.framework import constants, exceptions, interfaces, objects
vollog = logging.getLogger(__name__)
class MFTEntry(objects.StructType, interfaces.configuration.VersionableInterface):
class MFTEntry(objects.StructType):
"""This represents the base MFT Record"""
_version = (1, 0, 0)
_required_framework_version = (2, 26, 0)
framework.require_interface_version(*_required_framework_version)
def __init__(
self,
context: interfaces.context.ContextInterface,
@@ -150,15 +144,9 @@ class MFTEntry(objects.StructType, interfaces.configuration.VersionableInterface
yield attr
class MFTFileName(objects.StructType, interfaces.configuration.VersionableInterface):
class MFTFileName(objects.StructType):
"""This represents an MFT $FILE_NAME Attribute"""
_version = (1, 0, 0)
_required_framework_version = (2, 26, 0)
framework.require_interface_version(*_required_framework_version)
def get_full_name(self) -> objects.String:
output = self.Name.cast(
"string", encoding="utf16", max_length=self.NameLength * 2, errors="replace"
@@ -166,15 +154,9 @@ class MFTFileName(objects.StructType, interfaces.configuration.VersionableInterf
return output
class MFTAttribute(objects.StructType, interfaces.configuration.VersionableInterface):
class MFTAttribute(objects.StructType):
"""This represents an MFT ATTRIBUTE"""
_version = (1, 0, 0)
_required_framework_version = (2, 26, 0)
framework.require_interface_version(*_required_framework_version)
def get_resident_filename(self) -> Optional[objects.String]:
# 4MB chosen as cutoff instead of 4KB to allow for recovery from format /L created file systems
# Length as 512 as its 256*2, which is the maximum size for an entire file path, so this is even generous