Metadata-Version: 2.4
Name: mftparser
Version: 1.6.1
Summary: package for parsing mft from volume. a python wheel
Author-email: Colby Saigeon <cole.saigeon@gmail.com>
License-Expression: MIT
Project-URL: Changelog, https://github.com/dreadwrr/pyparsec/blob/main/CHANGELOG.md
Project-URL: Homepage, https://github.com/dreadwrr/pyparsec
Project-URL: Issues, https://github.com/dreadwrr/pyparsec/issues
Classifier: Programming Language :: Python :: 3
Classifier: Operating System :: Microsoft :: Windows
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Dynamic: license-file

![alt text](https://raw.githubusercontent.com/dreadwrr/pyparsec/main/wlv.png)

A Python extension for parsing the MFT on Windows 10 / Windows 11.
Returns a list of tuples for all active entries on the volume.
This can be used to find new or modified files efficiently as its not necessary to walk the file system.

Requires administrator privileges.

## Install
pip install mftparser

## Parameters
- `drive` — drive letter e.g. `"C:"` (default `"C:"`)
- `only_active` — if `False`,  return all entries (default `True`)
- `microseconds` — if `True`, return timestamps as epoch microseconds (default `False`, returns NTFS ticks)
- `cutoff` — takes timestamp format `"2026-05-10T07:33:12"` or `"2026-05-10 07:33:12"` in system time. return entries only from that time onward

# Functions
## results = mftparser.ScanVolume("C:", only_active=True, microseconds=False) <br><br>
> returns tuple with 18 fields per entry

recno, sequence_num, parent_recno, parent_sequence, in_use, path, name, size, hardlinks, is_dir, is_hardlink, has_ads, file_attribs, mod_time, creation_time, mft_mod, access_time, last_usn = results

or

( <br>
    recno, sequence_num, parent_recno, parent_sequence, <br>
    in_use, path, name, size, hardlinks, <br>
    is_dir, is_hardlink, has_ads, file_attribs, <br>
    mod_time, creation_time, mft_mod, access_time, last_usn <br>
) = results
 
## mftparser.ntfs_to_us(ts)
> ntfs ticks to epoch microseconds

## mftparser.ntfs_to_ns(ts)
> ntfs ticks to epoch nanoseconds

## recno, seq = mftparser.frn_to_entry(frn)
> file reference number to record number and sequence

## frn = mftparser.entry_to_frn(recno, seq)
> record number and sequence to a file reference number

# Example
```
results = mftparser.ScanVolume()
print(len(results))
for entry in results:
    is_dir = entry[9]
    if is_dir:
        continue
    ...
```
