Initial version of $MFT parser #316

Initial version of $MFT parser.

Requires: 258650043

[Joachim Metz, 2015-09-15 20:56:20]

Code updated.

[onager, 2015-09-18 09:21:20]

https://codereview.appspot.com/264250043/diff/20001/plaso/events/file_system_...
File plaso/events/file_system_events.py (right):

https://codereview.appspot.com/264250043/diff/20001/plaso/events/file_system_...
plaso/events/file_system_events.py:52: name: string containing the name, set to
None if not available.
The filename?

https://codereview.appspot.com/264250043/diff/20001/plaso/parsers/ntfs.py
File plaso/parsers/ntfs.py (right):

https://codereview.appspot.com/264250043/diff/20001/plaso/parsers/ntfs.py#new...
plaso/parsers/ntfs.py:83: logging.warning((
Change to parser error - also in rest of file.

https://codereview.appspot.com/264250043/diff/20001/plaso/parsers/ntfs.py#new...
plaso/parsers/ntfs.py:91: mft_entry.file_reference,
mft_attribute.attribute_type,
This large block of repeated code for event creation is pretty ugly - can you
refactor it to be a little less verbose?

https://codereview.appspot.com/264250043/diff/20001/plaso/parsers/ntfs.py#new...
plaso/parsers/ntfs.py:146: pass
Why pass here? No error emitted? A comment as to why no action is necessary
would be nice

https://codereview.appspot.com/264250043/diff/20001/plaso/parsers/ntfs.py#new...
plaso/parsers/ntfs.py:156: pass
Why pass here? No error emitted?

https://codereview.appspot.com/264250043/diff/20001/tests/parsers/ntfs.py
File tests/parsers/ntfs.py (right):

https://codereview.appspot.com/264250043/diff/20001/tests/parsers/ntfs.py#new...
tests/parsers/ntfs.py:1: #!/usr/bin/python
Please add tests for:
1) Distributed link tracking events
2) Overflow exception handling

[Joachim Metz, 2015-09-18 19:24:53]

https://codereview.appspot.com/264250043/diff/20001/plaso/events/file_system_...
File plaso/events/file_system_events.py (right):

https://codereview.appspot.com/264250043/diff/20001/plaso/events/file_system_...
plaso/events/file_system_events.py:52: name: string containing the name, set to
None if not available.
On 2015/09/18 09:21:19, onager wrote:
> The filename?

Yeah but only in the case of $FILE_NAME, but seeing it is not used for something
else I'll make this more specific.

https://codereview.appspot.com/264250043/diff/20001/plaso/parsers/ntfs.py
File plaso/parsers/ntfs.py (right):

https://codereview.appspot.com/264250043/diff/20001/plaso/parsers/ntfs.py#new...
plaso/parsers/ntfs.py:83: logging.warning((
On 2015/09/18 09:21:20, onager wrote:
> Change to parser error - also in rest of file.

Acknowledged.

https://codereview.appspot.com/264250043/diff/20001/plaso/parsers/ntfs.py#new...
plaso/parsers/ntfs.py:91: mft_entry.file_reference,
mft_attribute.attribute_type,
need to think about this more first; might be hard without adding unnecessary
redirection.

https://codereview.appspot.com/264250043/diff/20001/plaso/parsers/ntfs.py#new...
plaso/parsers/ntfs.py:146: pass
On 2015/09/18 09:21:20, onager wrote:
> Why pass here? No error emitted? A comment as to why no action is necessary
> would be nice

Acknowledged.

https://codereview.appspot.com/264250043/diff/20001/plaso/parsers/ntfs.py#new...
plaso/parsers/ntfs.py:156: pass
On 2015/09/18 09:21:20, onager wrote:
> Why pass here? No error emitted?

Acknowledged.

https://codereview.appspot.com/264250043/diff/20001/tests/parsers/ntfs.py
File tests/parsers/ntfs.py (right):

https://codereview.appspot.com/264250043/diff/20001/tests/parsers/ntfs.py#new...
tests/parsers/ntfs.py:1: #!/usr/bin/python
1) Distributed link tracking events

need to find a shareable test file or mock it

2) Overflow exception handling

Ack, I'll also double check if these exception are still needed

[Joachim Metz, 2015-09-23 07:04:49]

https://codereview.appspot.com/264250043/diff/20001/tests/parsers/ntfs.py
File tests/parsers/ntfs.py (right):

https://codereview.appspot.com/264250043/diff/20001/tests/parsers/ntfs.py#new...
tests/parsers/ntfs.py:1: #!/usr/bin/python
I've added comments for now.

[Joachim Metz, 2015-09-23 07:08:11]

Code updated.

[Joachim Metz, 2015-09-23 07:10:14]

Code updated.

[Joachim Metz, 2015-09-24 03:03:48]

Code updated.

[onager, 2015-09-28 12:08:49]

https://codereview.appspot.com/264250043/diff/80001/plaso/events/file_system_...
File plaso/events/file_system_events.py (right):

https://codereview.appspot.com/264250043/diff/80001/plaso/events/file_system_...
plaso/events/file_system_events.py:30: file_system_type: the filesystem this
timestamp is extracted from.
As a string? As a enum?

https://codereview.appspot.com/264250043/diff/80001/plaso/events/file_system_...
plaso/events/file_system_events.py:45: $FILE_NAME.
Any reference for the list of valid attributes?

[Joachim Metz, 2015-09-29 06:33:11]

https://codereview.appspot.com/264250043/diff/80001/plaso/events/file_system_...
File plaso/events/file_system_events.py (right):

https://codereview.appspot.com/264250043/diff/80001/plaso/events/file_system_...
plaso/events/file_system_events.py:30: file_system_type: the filesystem this
timestamp is extracted from.
On 2015/09/28 12:08:49, onager wrote:
> As a string? As a enum?

Done.

https://codereview.appspot.com/264250043/diff/80001/plaso/events/file_system_...
plaso/events/file_system_events.py:45: $FILE_NAME.
Not sure what you mean. I can provide a list of common attributes but "valid"
no. I fail to see why that is relevant here?

https://codereview.appspot.com/264250043/diff/80001/tests/parsers/ntfs.py
File tests/parsers/ntfs.py (right):

https://codereview.appspot.com/264250043/diff/80001/tests/parsers/ntfs.py#new...
tests/parsers/ntfs.py:131: # TODO: add test for overflow exception handling.
Overflow exception handling will be hard to test. The overflow exception is
raise when the integer is > ULLONG_MAX or > ULONG_MAX

which should be 0xffffffffffffffff on a 64-bit platform.

This exception therefore should only be raised when pyfsntfs has been
incorrectly build.

[Joachim Metz, 2015-09-29 06:34:51]

Code updated.

[onager, 2015-09-29 07:18:34]

On 2015/09/29 06:34:51, Joachim Metz wrote:
> Code updated.

LGTM