parse-reparsepoint
Python program to parse out and display reparse point info present in an NTFS MFT entry
Overview
This project takes a raw NTFS image and an MFT entry number. It then:
- Finds the MFT entry corresponding to the number
- Checks if it belongs to a reparse point
- Analyzes any info it can find in regards to the reparse point
It currently has the ability to resolve the meaning of any reparse tag listed in the Microsoft documentation, and can retrieve information from the reparse data section of the following types of reparse points:
- OneDrive Cloud-only files
- Symbolic Links
- Windows Mount Points
Installation
This project can be installed with pip using the following command:
python3 -m pip install parse-reparsepoint
Usage
usage: parse-reparsepoint [-h] -f FILE -m MFT_ENTRY
Parse reparse point
options:
-h, --help show this help message and exit
-f FILE, --file FILE Path to file
-m MFT_ENTRY, --mft-entry MFT_ENTRY MFT entry to parse
example:
parse-reparsepoint -f Windows-10-Dev.raw -m 247645
1 maintainer
Metadata
1 maintainer
Release files for parse-reparsepoint 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| parse-reparsepoint-0.1.0.tar.gz | 46.2 kB | Without provenance | Details for parse-reparsepoint-0.1.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| parse_reparsepoint-0.1.0-py3-none-any.whl | Python 3 | none | any | Details for parse_reparsepoint-0.1.0-py3-none-any.whl |
Total release size: 80.2 kB
Release files / parse-reparsepoint-0.1.0.tar.gz
| Download URL | parse-reparsepoint-0.1.0.tar.gz |
|---|---|
| Size | 46.2 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
ffbf078eeee41052008f93885f3aac166b6d78051aab81217779a7e9b410c141
|
|
BLAKE2b-256 checksum How to use checksums |
951dde04582878efa2e68d1816ef3a9a706120797030810f92eb023d67342058
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/4.0.2 CPython/3.10.12
|
Release files / parse_reparsepoint-0.1.0-py3-none-any.whl
| Download URL | parse_reparsepoint-0.1.0-py3-none-any.whl |
|---|---|
| Size | 34.0 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
2dbc0f164a86405da7e5046e7752a72f15a84ee9d2840d1cf870b3aed498691c
|
|
BLAKE2b-256 checksum How to use checksums |
e329294c621c7a1604b129ed20e99f58f5472998cc47778108f74dd52fb43180
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/4.0.2 CPython/3.10.12
|
Security for parse-reparsepoint 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.
