Skip to content

Commit 41de562

Browse files
committed
Revert "Add versioning to MFT extension classes"
This reverts commit 1d20e65.
1 parent ebbbe91 commit 41de562

File tree

2 files changed

+3
-36
lines changed

2 files changed

+3
-36
lines changed

volatility3/framework/plugins/windows/mftscan.py

Lines changed: 0 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -49,21 +49,6 @@ def get_requirements(cls):
4949
component=timeliner.TimeLinerInterface,
5050
version=(1, 0, 0),
5151
),
52-
requirements.VersionRequirement(
53-
name="mft_entry",
54-
component=mft.MFTEntry,
55-
version=(1, 0, 0),
56-
),
57-
requirements.VersionRequirement(
58-
name="mft_filename",
59-
component=mft.MFTFileName,
60-
version=(1, 0, 0),
61-
),
62-
requirements.VersionRequirement(
63-
name="mft_attribute",
64-
component=mft.MFTAttribute,
65-
version=(1, 0, 0),
66-
),
6752
requirements.VersionRequirement(
6853
name="yarascanner", component=yarascan.YaraScanner, version=(2, 1, 0)
6954
),

volatility3/framework/symbols/windows/extensions/mft.py

Lines changed: 3 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -5,20 +5,14 @@
55
import logging
66
from typing import Dict, Iterator, List, Optional, Tuple
77

8-
from volatility3 import framework
98
from volatility3.framework import constants, exceptions, interfaces, objects
109

1110
vollog = logging.getLogger(__name__)
1211

1312

14-
class MFTEntry(objects.StructType, interfaces.configuration.VersionableInterface):
13+
class MFTEntry(objects.StructType):
1514
"""This represents the base MFT Record"""
1615

17-
_version = (1, 0, 0)
18-
_required_framework_version = (2, 26, 0)
19-
20-
framework.require_interface_version(*_required_framework_version)
21-
2216
def __init__(
2317
self,
2418
context: interfaces.context.ContextInterface,
@@ -150,31 +144,19 @@ def alternate_data_streams(self) -> Iterator["MFTAttribute"]:
150144
yield attr
151145

152146

153-
class MFTFileName(objects.StructType, interfaces.configuration.VersionableInterface):
147+
class MFTFileName(objects.StructType):
154148
"""This represents an MFT $FILE_NAME Attribute"""
155149

156-
_version = (1, 0, 0)
157-
158-
_required_framework_version = (2, 26, 0)
159-
160-
framework.require_interface_version(*_required_framework_version)
161-
162150
def get_full_name(self) -> objects.String:
163151
output = self.Name.cast(
164152
"string", encoding="utf16", max_length=self.NameLength * 2, errors="replace"
165153
)
166154
return output
167155

168156

169-
class MFTAttribute(objects.StructType, interfaces.configuration.VersionableInterface):
157+
class MFTAttribute(objects.StructType):
170158
"""This represents an MFT ATTRIBUTE"""
171159

172-
_version = (1, 0, 0)
173-
174-
_required_framework_version = (2, 26, 0)
175-
176-
framework.require_interface_version(*_required_framework_version)
177-
178160
def get_resident_filename(self) -> Optional[objects.String]:
179161
# 4MB chosen as cutoff instead of 4KB to allow for recovery from format /L created file systems
180162
# Length as 512 as its 256*2, which is the maximum size for an entire file path, so this is even generous

0 commit comments

Comments
 (0)