Accessing NTFS Attributes from AbstractFile

Get help with module writing or platform code changes.

Moderator: carrier

Accessing NTFS Attributes from AbstractFile

Postby int3grate » Mon Aug 10, 2015 9:31 pm

I apologize in advance if this is a dumb question... I've spent a few hours digging through the API documentation, and I don't see an obvious way to reach the NTFS attributes on an AbstractFile object. I'd like to access the data runs for TSK_FS_ATTR_TYPE_NTFS_DATA attributes. I've got an image that uses some interesting data hiding techniques (from a CTF at Defcon), and I'd like to write a python injest module to extract the hidden data.
Posts: 1
Joined: Mon Aug 10, 2015 9:23 pm

Return to Autopsy Developers Corner

Who is online

Users browsing this forum: No registered users and 1 guest