如何在linux上使用python检查NTFS分区上的隐藏文件和文件夹？

Question

I am using NTFS partition on linux machine. I want to identify hidden files and folders on my NTFS partition on linux using python .

How can I achieve this using python . Any code snippet / links would be appreciated.

Thanks.

Answer 1

Assuming you are using ntfs-3g to mount your NTFS partitions on linux (this is default on most current linux distributions).

You will need to read file extended attributes (see attr(5) ), you can use pyxattr for this. NTFS attributes are stored in system.ntfs_attrib extended attribute as a set of flags which values are documented in ntfs-3g documentation .

Here is a sample code to read and decode NTFS file system attributes and use them to filter files:

import os, struct, xattr

# values from http://www.tuxera.com/community/ntfs-3g-advanced/extended-attributes/
attributes = ['readonly', 'hidden', 'system', 'unknown',
              'unknown', 'archive', 'unknown', 'unknown',
              'temp', 'unknown', 'unknown', 'compressed_dir',
              'offline', 'not_content_indexed' ] + ['unknown']*18

def ntfs_attr(path):
    attr = struct.unpack("i", xattr.get(path, "system.ntfs_attrib"))[0]
    for shift, attribute in enumerate(attributes):
        if (attr >> shift) & 1 == 1:
            yield attribute

def main():
    import sys
    if len(sys.argv) != 3:
        print "Usage: %s path attribute" % sys.argv[0]
        a = set(attributes)
        a.remove('unknown')
        print "where attribute is one of:", ' '.join(a)
        sys.exit(1)

    path = sys.argv[1]
    attribute = sys.argv[2]
    print "Files with %s attribute in %s:" % (attribute, path)
    for filename in os.listdir(path):
        fullname = os.path.join(path, filename)
        if attribute in ntfs_attr(fullname):
            print fullname


if __name__ == '__main__':
    main()

Answer 2

There seems to be no python interface for NTFS attributes under linux.

NTFS-3G supports NTFS file attributes and exposes them for the linux tools getfattr and setfattr to read and set.

You can use python's subprocess to invoke getfattr and then parse the output.

Note: on my ubuntu system i had to install the package attr to get the commands getfattr and setfattr .

Answer 3

If your question is not limited to Python, you can try my example implemented in shell script.

This is also based on system.ntfs_attrib_be attribute in NTFS-3G. If you are just going to use it and don't care about how it is implemented (in Python or shell), just download it, install getfattr and setfattr from your distro, and use it.

https://gist.github.com/Explorer09/ac4bf6838c271a9968b3