From 41de562e550424a43fecbebf5f6560be3ec66571 Mon Sep 17 00:00:00 2001 From: David McDonald Date: Thu, 3 Apr 2025 17:56:16 -0500 Subject: [PATCH] Revert "Add versioning to MFT extension classes" This reverts commit 1d20e6575908e118ad71746ff9d64b6cd5d23d9f. --- .../framework/plugins/windows/mftscan.py | 15 ------------ .../symbols/windows/extensions/mft.py | 24 +++---------------- 2 files changed, 3 insertions(+), 36 deletions(-) diff --git a/volatility3/framework/plugins/windows/mftscan.py b/volatility3/framework/plugins/windows/mftscan.py index cb4b880d5..f50801c70 100644 --- a/volatility3/framework/plugins/windows/mftscan.py +++ b/volatility3/framework/plugins/windows/mftscan.py @@ -49,21 +49,6 @@ class MFTScan(interfaces.plugins.PluginInterface, timeliner.TimeLinerInterface): component=timeliner.TimeLinerInterface, version=(1, 0, 0), ), - requirements.VersionRequirement( - name="mft_entry", - component=mft.MFTEntry, - version=(1, 0, 0), - ), - requirements.VersionRequirement( - name="mft_filename", - component=mft.MFTFileName, - version=(1, 0, 0), - ), - requirements.VersionRequirement( - name="mft_attribute", - component=mft.MFTAttribute, - version=(1, 0, 0), - ), requirements.VersionRequirement( name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0) ), diff --git a/volatility3/framework/symbols/windows/extensions/mft.py b/volatility3/framework/symbols/windows/extensions/mft.py index 32261c4ff..4c5be81ee 100644 --- a/volatility3/framework/symbols/windows/extensions/mft.py +++ b/volatility3/framework/symbols/windows/extensions/mft.py @@ -5,20 +5,14 @@ import logging from typing import Dict, Iterator, List, Optional, Tuple -from volatility3 import framework from volatility3.framework import constants, exceptions, interfaces, objects vollog = logging.getLogger(__name__) -class MFTEntry(objects.StructType, interfaces.configuration.VersionableInterface): +class MFTEntry(objects.StructType): """This represents the base MFT Record""" - _version = (1, 0, 0) - _required_framework_version = (2, 26, 0) - - framework.require_interface_version(*_required_framework_version) - def __init__( self, context: interfaces.context.ContextInterface, @@ -150,15 +144,9 @@ class MFTEntry(objects.StructType, interfaces.configuration.VersionableInterface yield attr -class MFTFileName(objects.StructType, interfaces.configuration.VersionableInterface): +class MFTFileName(objects.StructType): """This represents an MFT $FILE_NAME Attribute""" - _version = (1, 0, 0) - - _required_framework_version = (2, 26, 0) - - framework.require_interface_version(*_required_framework_version) - def get_full_name(self) -> objects.String: output = self.Name.cast( "string", encoding="utf16", max_length=self.NameLength * 2, errors="replace" @@ -166,15 +154,9 @@ class MFTFileName(objects.StructType, interfaces.configuration.VersionableInterf return output -class MFTAttribute(objects.StructType, interfaces.configuration.VersionableInterface): +class MFTAttribute(objects.StructType): """This represents an MFT ATTRIBUTE""" - _version = (1, 0, 0) - - _required_framework_version = (2, 26, 0) - - framework.require_interface_version(*_required_framework_version) - def get_resident_filename(self) -> Optional[objects.String]: # 4MB chosen as cutoff instead of 4KB to allow for recovery from format /L created file systems # Length as 512 as its 256*2, which is the maximum size for an entire file path, so this is even generous