Metadata-Version: 2.4
Name: mftparser
Version: 1.6.0
Summary: package for parsing mft from volume. a python wheel
Author-email: Colby Saigeon <cole.saigeon@gmail.com>
License-Expression: MIT
Project-URL: Homepage, https://github.com/dreadwrr/pyparsec
Project-URL: Issues, https://github.com/dreadwrr/pyparsec/issues
Classifier: Programming Language :: Python :: 3
Classifier: Operating System :: Microsoft :: Windows
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
Dynamic: license-file

![alt text](https://raw.githubusercontent.com/dreadwrr/pyparsec/main/wlv.png)

A Python extension for parsing the MFT on Windows 10 / Windows 11.
Returns a list of tuples for all active entries on the volume.
Requires administrator privileges.

## Install
pip install mftparser

## Parameters
- `drive` — drive letter e.g. `"C:"` (default `"C:"`)
- `only_active` — if `False`,  return all entries (default `True`)
- `microseconds` — if `True`, return timestamps as epoch microseconds (default `False`, returns NTFS ticks)
- `cutoff` — takes timestamp format `"2026-05-10T07:33:12"` or `"2026-05-10 07:33:12"` in system time. return entries only from that time onward

# Functions
## mftparser.ScanVolume("C:", only_active=True, microseconds=False) <br><br>
 
## mftparser.ntfs_to_us(ts)
> ntfs ticks to epoch microseconds

## mftparser.ntfs_to_ns(ts)
> ntfs ticks to epoch nanoseconds

## recno, seq = mftparser.frn_to_entry(frn)
> file reference number to record number and sequence

## frn = mftparser.entry_to_frn(recno, seq)
> record number and sequence to a file reference number
