From 36718063832b1edf41e85f286bfdd054753bfe16 Mon Sep 17 00:00:00 2001
From: Imanol-Mikel Barba Sabariego <imanol@imanol-laptop>
Date: Mon, 24 Oct 2016 16:06:36 +0200
Subject: [PATCH] MFT module completed

---
 .idea/workspace.xml                    | 105 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-----------------------------------------------
 __pycache__/tomb.cpython-34.pyc        | Bin 0 -> 490 bytes
 modules/__pycache__/mft.cpython-34.pyc | Bin 840 -> 0 bytes
 modules/mft.py                         |   9 +++++++--
 tomb.py                                |  12 ++++++++++++
 5 files changed, 77 insertions(+), 49 deletions(-)
 create mode 100644 __pycache__/tomb.cpython-34.pyc
 create mode 100644 tomb.py

diff --git a/.idea/workspace.xml b/.idea/workspace.xml
index 6d5b456..2a01b66 100644
--- a/.idea/workspace.xml
+++ b/.idea/workspace.xml
@@ -2,15 +2,9 @@
 <project version="4">
   <component name="ChangeListManager">
     <list default="true" id="33419617-7da8-422e-9ac6-68e0b317ebf8" name="Default" comment="">
-      <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/runcmd.py" />
-      <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/scripts/list_ntfs.sh" />
+      <change type="NEW" beforePath="" afterPath="$PROJECT_DIR$/tomb.py" />
       <change type="MODIFICATION" beforePath="$PROJECT_DIR$/.idea/workspace.xml" afterPath="$PROJECT_DIR$/.idea/workspace.xml" />
-      <change type="MODIFICATION" beforePath="$PROJECT_DIR$/digger.py" afterPath="$PROJECT_DIR$/digger.py" />
-      <change type="MODIFICATION" beforePath="$PROJECT_DIR$/module.py" afterPath="$PROJECT_DIR$/module.py" />
       <change type="MODIFICATION" beforePath="$PROJECT_DIR$/modules/mft.py" afterPath="$PROJECT_DIR$/modules/mft.py" />
-      <change type="MODIFICATION" beforePath="$PROJECT_DIR$/modulevar.py" afterPath="$PROJECT_DIR$/modulevar.py" />
-      <change type="MODIFICATION" beforePath="$PROJECT_DIR$/scripts/digger.sh" afterPath="$PROJECT_DIR$/scripts/digger.sh" />
-      <change type="MODIFICATION" beforePath="$PROJECT_DIR$/vars/ntfsvol.py" afterPath="$PROJECT_DIR$/vars/ntfsvol.py" />
     </list>
     <ignored path="gravedigger.iws" />
     <ignored path=".idea/workspace.xml" />
@@ -48,18 +42,20 @@
       <file leaf-file-name="digger.py" pinned="false" current-in-tab="false">
         <entry file="file://$PROJECT_DIR$/digger.py">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="-152">
-              <caret line="7" column="0" selection-start-line="7" selection-start-column="0" selection-end-line="7" selection-end-column="23" />
-              <folding />
+            <state relative-caret-position="-190">
+              <caret line="11" column="0" selection-start-line="11" selection-start-column="0" selection-end-line="11" selection-end-column="0" />
+              <folding>
+                <element signature="e#25#38#0" expanded="true" />
+              </folding>
             </state>
           </provider>
         </entry>
       </file>
-      <file leaf-file-name="runcmd.py" pinned="false" current-in-tab="true">
+      <file leaf-file-name="runcmd.py" pinned="false" current-in-tab="false">
         <entry file="file://$PROJECT_DIR$/runcmd.py">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="38">
-              <caret line="2" column="18" selection-start-line="2" selection-start-column="18" selection-end-line="2" selection-end-column="18" />
+            <state relative-caret-position="76">
+              <caret line="4" column="22" selection-start-line="4" selection-start-column="22" selection-end-line="4" selection-end-column="22" />
               <folding />
             </state>
           </provider>
@@ -97,11 +93,23 @@
           </provider>
         </entry>
       </file>
-      <file leaf-file-name="mft.py" pinned="false" current-in-tab="false">
+      <file leaf-file-name="mft.py" pinned="false" current-in-tab="true">
         <entry file="file://$PROJECT_DIR$/modules/mft.py">
           <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="285">
-              <caret line="15" column="52" selection-start-line="15" selection-start-column="52" selection-end-line="15" selection-end-column="52" />
+            <state relative-caret-position="190">
+              <caret line="10" column="25" selection-start-line="10" selection-start-column="25" selection-end-line="10" selection-end-column="25" />
+              <folding>
+                <element signature="e#0#25#0" expanded="true" />
+              </folding>
+            </state>
+          </provider>
+        </entry>
+      </file>
+      <file leaf-file-name="tomb.py" pinned="false" current-in-tab="false">
+        <entry file="file://$PROJECT_DIR$/tomb.py">
+          <provider selected="true" editor-type-id="text-editor">
+            <state relative-caret-position="190">
+              <caret line="10" column="25" selection-start-line="10" selection-start-column="25" selection-end-line="10" selection-end-column="25" />
               <folding />
             </state>
           </provider>
@@ -127,16 +135,6 @@
           </provider>
         </entry>
       </file>
-      <file leaf-file-name="dig.service" pinned="false" current-in-tab="false">
-        <entry file="file://$PROJECT_DIR$/scripts/dig.service">
-          <provider selected="true" editor-type-id="text-editor">
-            <state relative-caret-position="133">
-              <caret line="7" column="35" selection-start-line="7" selection-start-column="35" selection-end-line="7" selection-end-column="35" />
-              <folding />
-            </state>
-          </provider>
-        </entry>
-      </file>
     </leaf>
   </component>
   <component name="FileTemplateManagerImpl">
@@ -161,8 +159,9 @@
         <option value="$PROJECT_DIR$/scripts/digger.sh" />
         <option value="$PROJECT_DIR$/runcmd.py" />
         <option value="$PROJECT_DIR$/vars/ntfsvol.py" />
-        <option value="$PROJECT_DIR$/modules/mft.py" />
         <option value="$PROJECT_DIR$/scripts/list_ntfs.sh" />
+        <option value="$PROJECT_DIR$/tomb.py" />
+        <option value="$PROJECT_DIR$/modules/mft.py" />
       </list>
     </option>
   </component>
@@ -577,14 +576,6 @@
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/digger.py">
-      <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="-152">
-          <caret line="7" column="0" selection-start-line="7" selection-start-column="0" selection-end-line="7" selection-end-column="23" />
-          <folding />
-        </state>
-      </provider>
-    </entry>
     <entry file="file://$PROJECT_DIR$/scripts/digger.sh">
       <provider selected="true" editor-type-id="text-editor">
         <state relative-caret-position="133">
@@ -593,18 +584,18 @@
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/module.py">
+    <entry file="file://$PROJECT_DIR$/scripts/list_ntfs.sh">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="304">
-          <caret line="16" column="58" selection-start-line="16" selection-start-column="58" selection-end-line="16" selection-end-column="58" />
+        <state relative-caret-position="38">
+          <caret line="2" column="83" selection-start-line="2" selection-start-column="83" selection-end-line="2" selection-end-column="83" />
           <folding />
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/modules/mft.py">
+    <entry file="file://$PROJECT_DIR$/runcmd.py">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="285">
-          <caret line="15" column="52" selection-start-line="15" selection-start-column="52" selection-end-line="15" selection-end-column="52" />
+        <state relative-caret-position="76">
+          <caret line="4" column="22" selection-start-line="4" selection-start-column="22" selection-end-line="4" selection-end-column="22" />
           <folding />
         </state>
       </provider>
@@ -619,21 +610,41 @@
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/scripts/list_ntfs.sh">
+    <entry file="file://$PROJECT_DIR$/module.py">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="38">
-          <caret line="2" column="83" selection-start-line="2" selection-start-column="83" selection-end-line="2" selection-end-column="83" />
+        <state relative-caret-position="304">
+          <caret line="16" column="58" selection-start-line="16" selection-start-column="58" selection-end-line="16" selection-end-column="58" />
           <folding />
         </state>
       </provider>
     </entry>
-    <entry file="file://$PROJECT_DIR$/runcmd.py">
+    <entry file="file://$PROJECT_DIR$/digger.py">
       <provider selected="true" editor-type-id="text-editor">
-        <state relative-caret-position="38">
-          <caret line="2" column="18" selection-start-line="2" selection-start-column="18" selection-end-line="2" selection-end-column="18" />
+        <state relative-caret-position="-190">
+          <caret line="11" column="0" selection-start-line="11" selection-start-column="0" selection-end-line="11" selection-end-column="0" />
+          <folding>
+            <element signature="e#25#38#0" expanded="true" />
+          </folding>
+        </state>
+      </provider>
+    </entry>
+    <entry file="file://$PROJECT_DIR$/tomb.py">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="190">
+          <caret line="10" column="25" selection-start-line="10" selection-start-column="25" selection-end-line="10" selection-end-column="25" />
           <folding />
         </state>
       </provider>
     </entry>
+    <entry file="file://$PROJECT_DIR$/modules/mft.py">
+      <provider selected="true" editor-type-id="text-editor">
+        <state relative-caret-position="190">
+          <caret line="10" column="25" selection-start-line="10" selection-start-column="25" selection-end-line="10" selection-end-column="25" />
+          <folding>
+            <element signature="e#0#25#0" expanded="true" />
+          </folding>
+        </state>
+      </provider>
+    </entry>
   </component>
 </project>
\ No newline at end of file
diff --git a/__pycache__/tomb.cpython-34.pyc b/__pycache__/tomb.cpython-34.pyc
new file mode 100644
index 0000000..4e8a3e4
Binary files /dev/null and b/__pycache__/tomb.cpython-34.pyc differ
diff --git a/modules/__pycache__/mft.cpython-34.pyc b/modules/__pycache__/mft.cpython-34.pyc
index 4ebbb03..edffb1d 100644
Binary files a/modules/__pycache__/mft.cpython-34.pyc and b/modules/__pycache__/mft.cpython-34.pyc differ
diff --git a/modules/mft.py b/modules/mft.py
index dd42588..61e334f 100644
--- a/modules/mft.py
+++ b/modules/mft.py
@@ -1,4 +1,6 @@
 from module import Module
+from runcmd import runProcess
+import tomb
 
 def getInstance():
     return MFTModule()
@@ -12,6 +14,9 @@ class MFTModule(Module):
         self.vars = {}
 
     def run(self):
-        for x in self.vars:
-            print(x + ": " + str(self.vars[x].value))
+        for vol in self.vars['ntfsvol'].value:
+            result = runProcess(["icat","/dev/" + vol,"0"])
+            mftbin = open(tomb.getPath() + "mft/" + vol + ".bin",'wb')
+            mftbin.write(result[0])
+            mftbin.close()
 
diff --git a/tomb.py b/tomb.py
new file mode 100644
index 0000000..df3276a
--- /dev/null
+++ b/tomb.py
@@ -0,0 +1,12 @@
+import os
+
+__ROOT_PATH__ = "/bones/"
+
+def __getTomb__():
+    return "test"
+
+def getPath():
+    path = __ROOT_PATH__ + __getTomb__() + "/"
+    if not os.path.exists(path):
+        os.makedirs(path)
+    return path
\ No newline at end of file
--
libgit2 0.22.2