|
5 | 5 | import logging |
6 | 6 | from typing import Dict, Iterator, List, Optional, Tuple |
7 | 7 |
|
8 | | -from volatility3 import framework |
9 | 8 | from volatility3.framework import constants, exceptions, interfaces, objects |
10 | 9 |
|
11 | 10 | vollog = logging.getLogger(__name__) |
12 | 11 |
|
13 | 12 |
|
14 | | -class MFTEntry(objects.StructType, interfaces.configuration.VersionableInterface): |
| 13 | +class MFTEntry(objects.StructType): |
15 | 14 | """This represents the base MFT Record""" |
16 | 15 |
|
17 | | - _version = (1, 0, 0) |
18 | | - _required_framework_version = (2, 26, 0) |
19 | | - |
20 | | - framework.require_interface_version(*_required_framework_version) |
21 | | - |
22 | 16 | def __init__( |
23 | 17 | self, |
24 | 18 | context: interfaces.context.ContextInterface, |
@@ -150,31 +144,19 @@ def alternate_data_streams(self) -> Iterator["MFTAttribute"]: |
150 | 144 | yield attr |
151 | 145 |
|
152 | 146 |
|
153 | | -class MFTFileName(objects.StructType, interfaces.configuration.VersionableInterface): |
| 147 | +class MFTFileName(objects.StructType): |
154 | 148 | """This represents an MFT $FILE_NAME Attribute""" |
155 | 149 |
|
156 | | - _version = (1, 0, 0) |
157 | | - |
158 | | - _required_framework_version = (2, 26, 0) |
159 | | - |
160 | | - framework.require_interface_version(*_required_framework_version) |
161 | | - |
162 | 150 | def get_full_name(self) -> objects.String: |
163 | 151 | output = self.Name.cast( |
164 | 152 | "string", encoding="utf16", max_length=self.NameLength * 2, errors="replace" |
165 | 153 | ) |
166 | 154 | return output |
167 | 155 |
|
168 | 156 |
|
169 | | -class MFTAttribute(objects.StructType, interfaces.configuration.VersionableInterface): |
| 157 | +class MFTAttribute(objects.StructType): |
170 | 158 | """This represents an MFT ATTRIBUTE""" |
171 | 159 |
|
172 | | - _version = (1, 0, 0) |
173 | | - |
174 | | - _required_framework_version = (2, 26, 0) |
175 | | - |
176 | | - framework.require_interface_version(*_required_framework_version) |
177 | | - |
178 | 160 | def get_resident_filename(self) -> Optional[objects.String]: |
179 | 161 | # 4MB chosen as cutoff instead of 4KB to allow for recovery from format /L created file systems |
180 | 162 | # Length as 512 as its 256*2, which is the maximum size for an entire file path, so this is even generous |
|
0 commit comments