dissect-ntfs

library3.16pypypiunverified

A Dissect module implementing a parser for the NTFS file system, used by the Windows operating system. This library provides functionality to read and parse NTFS volumes, including support for MFT, attributes, data runs, and resident/non-resident files. The current version is 3.16, with frequent updates aligned with the Dissect project's release cadence. Requires Python >=3.10.

devops security

pip install dissect-ntfs

INSTALL

IMPORT

SIG · DISSECT-NTFS

dissect-ntfs

devopspythonv3.16

harness data pending

Install & Compatibility

Where this runs

No compatibility data collected yet for this library.

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

Ntfs

✓ from dissect.ntfs import Ntfs

✗ from dissect.ntfs import Ntfs

Open an NTFS volume from a raw disk image and list the root directory.

import io from dissect.ntfs import Ntfs # Create an NTFS filesystem object from a raw volume/image file-like object with open('ntfs_volume.dd', 'rb') as fh: ntfs = Ntfs(fh) for volume in ntfs.volumes(): for entry in volume.ls('/'): print(f'{entry.name} - {entry.size}')

Debug

Known issues

gotchaThe package name contains a hyphen, but the Python module uses dots (e.g., 'dissect.ntfs'). Doing 'import dissect-ntfs' is a syntax error; use 'from dissect.ntfs import ...'.

fix

Use 'from dissect.ntfs import Ntfs' (or other submodules).

affects: all

gotchaThe Ntfs class expects a file-like object pointing to the start of the NTFS volume, not a partition or disk image with a partition table. If you pass a full disk image, you must first parse the partition table and extract the NTFS partition.

fix

Use dissect.volume to handle partition tables, or manually slice the correct byte offset for the NTFS partition.

affects: all

deprecatedThe 'ntfs.mft' module's API has changed in version 3.0. Old code using 'Ntfs().mft' directly may break.

fix

Update to use 'Ntfs(fh).volumes()[0].mft' instead.

affects: <3.0

Upgrade

Version history

3.16latest on PyPI · released Feb 24, 2026

Audit

Dependencies

dissect.cstructrequiredUsed for parsing binary structures and data definitions.

dissect.utilrequiredProvides utility functions and stream utilities used by dissect-ntfs.

flow.recordoptionalOptional dependency for record serialization and output.

dissect.volumeoptionalOptional dependency for volume-level operations (e.g., accessing disk images).

Agent activity

30 hits · last 30 days

node

OpenAI (training)

Resources

No resource links recorded.