Changes for handling $FILE_NAME attribute #19 (#23)

log2timeline · Dec 29, 2021 · 81b7aa2 · 81b7aa2
1 parent 1201bda
commit 81b7aa2
Showing 1 changed file with 11 additions and 1 deletion.
diff --git a/dfimagetools/file_entry_lister.py b/dfimagetools/file_entry_lister.py
@@ -230,9 +230,19 @@ def GetBodyfileEntries(self, file_entry, path_segments):
             owner_identifier, group_identifier, size, access_time,
             modification_time, change_time, creation_time])
 
+    parent_file_reference = None
+    if file_entry.type_indicator == dfvfs_definitions.TYPE_INDICATOR_NTFS:
+      mft_attribute = getattr(file_entry.path_spec, 'mft_attribute', None)
+      if mft_attribute:
+        fsntfs_file_entry = file_entry.GetNTFSFileEntry()
+        parent_file_reference = (
+            fsntfs_file_entry.get_parent_file_reference_by_attribute_index(
+                mft_attribute))
+
     for attribute in file_entry.attributes:
       if isinstance(attribute, dfvfs_ntfs_attribute.FileNameNTFSAttribute):
-        if attribute.name == file_entry.name:
+        if (attribute.name == file_entry.name and
+            attribute.parent_file_reference == parent_file_reference):
           attribute_name_value = '{0:s} ($FILE_NAME)'.format(
               file_entry_name_value)