Erik Schamper
Erik Schamper
Thanks for reporting this. We could probably swap the default out for an argument (or fall back to without it if it fails and notify the user). I'll see if...
Hi @Kafow! That is indeed correct and something we wish to clean up. It hasn't been an issue for us so far because most of our use-cases for `dissect.target` are...
This will also require a small change in `dissect.ntfs`: https://github.com/fox-it/dissect.ntfs/blob/d6c039c6b4959a5d1ea5b012673813d2ce91693a/dissect/ntfs/mft.py#L123-L134 Overall should be a pretty easy and good addition!
That should be deterministic, yes.
You can divide the MFT file size by the segment/record size.
You can take a look at the calculation done in the segments method itself: https://github.com/fox-it/dissect.ntfs/blob/main/dissect/ntfs/mft.py#L128-L129
We have two main features planned that aid this functionality: - Ability for filesystem implementations to mark files in a directory listing as "deleted" - This depends on #649 -...
I have made a lot of suggested changes with https://github.com/fox-it/dissect.cstruct/pull/72/commits/7c93f22dd11f51a4e035ee5e84693aa10c34b986
There was a small booboo with merging/tagging, apologies for that! The transition from v3 -> v4 should be fairly minimal for most use-cases. It's functionally backwards compatible, the major changes...
This looks very fixable. Probably requires dealing with casts in the expression parser though. @sMezaOrellana can you perhaps recommend the best way to add this to your parser?