Reference documentation and code samples for the Chronicle V1 API class Google::Backstory::NtfsFileMetadata.
NTFS-specific file metadata.
Inherits
- Object
Extended By
- Google::Protobuf::MessageExts::ClassMethods
Includes
- Google::Protobuf::MessageExts
Methods
#change_time
def change_time() -> ::Google::Protobuf::Timestamp
Returns
- (::Google::Protobuf::Timestamp) — NTFS MFT entry changed timestamp.
#change_time=
def change_time=(value) -> ::Google::Protobuf::Timestamp
Parameter
- value (::Google::Protobuf::Timestamp) — NTFS MFT entry changed timestamp.
Returns
- (::Google::Protobuf::Timestamp) — NTFS MFT entry changed timestamp.
#filename_access_time
def filename_access_time() -> ::Google::Protobuf::Timestamp
Returns
- (::Google::Protobuf::Timestamp) — NTFS $FILE_NAME attribute accessed timestamp.
#filename_access_time=
def filename_access_time=(value) -> ::Google::Protobuf::Timestamp
Parameter
- value (::Google::Protobuf::Timestamp) — NTFS $FILE_NAME attribute accessed timestamp.
Returns
- (::Google::Protobuf::Timestamp) — NTFS $FILE_NAME attribute accessed timestamp.
#filename_change_time
def filename_change_time() -> ::Google::Protobuf::Timestamp
Returns
- (::Google::Protobuf::Timestamp) — NTFS $FILE_NAME attribute changed timestamp.
#filename_change_time=
def filename_change_time=(value) -> ::Google::Protobuf::Timestamp
Parameter
- value (::Google::Protobuf::Timestamp) — NTFS $FILE_NAME attribute changed timestamp.
Returns
- (::Google::Protobuf::Timestamp) — NTFS $FILE_NAME attribute changed timestamp.
#filename_create_time
def filename_create_time() -> ::Google::Protobuf::Timestamp
Returns
- (::Google::Protobuf::Timestamp) — NTFS $FILE_NAME attribute created timestamp.
#filename_create_time=
def filename_create_time=(value) -> ::Google::Protobuf::Timestamp
Parameter
- value (::Google::Protobuf::Timestamp) — NTFS $FILE_NAME attribute created timestamp.
Returns
- (::Google::Protobuf::Timestamp) — NTFS $FILE_NAME attribute created timestamp.
#filename_modify_time
def filename_modify_time() -> ::Google::Protobuf::Timestamp
Returns
- (::Google::Protobuf::Timestamp) — NTFS $FILE_NAME attribute modified timestamp.
#filename_modify_time=
def filename_modify_time=(value) -> ::Google::Protobuf::Timestamp
Parameter
- value (::Google::Protobuf::Timestamp) — NTFS $FILE_NAME attribute modified timestamp.
Returns
- (::Google::Protobuf::Timestamp) — NTFS $FILE_NAME attribute modified timestamp.
#usn_journal
def usn_journal() -> ::Array<::Google::Backstory::UsnJournal>
Returns
- (::Array<::Google::Backstory::UsnJournal>) — NTFS USN journal.
#usn_journal=
def usn_journal=(value) -> ::Array<::Google::Backstory::UsnJournal>
Parameter
- value (::Array<::Google::Backstory::UsnJournal>) — NTFS USN journal.
Returns
- (::Array<::Google::Backstory::UsnJournal>) — NTFS USN journal.