Merge branch 'master' into quick_fixes

Signed-off-by: Benjamin Cance <[email protected]>

Author: rowingdude

CHANGES.md

@@ -1,7 +1,26 @@
 
-# AnalyzeMFT Change Log
+## Versions 3.0.2 and 3.0.3 (2024-09-04)
 
-This document lists the changes and version history for the AnalyzeMFT script and component scripts.
+### Changes
+- Brought back XML, JSON outputs
+- Added optional Excel output (requires openpyxl)
+- Restored type hints
+- Tinkered a little more with the attribute specific functions
+
+### Fixes
+- Fixed a minor CSV formatting error where path names weren't being correctly parsed.
+
+### To do
+- Fix the root path file name - currently the parser picks up everything after the `C:\`, I'd like to have the target drive letter also
+- Add verbose and very verbose output to accompany debug
+- Create tests for each class, module, and output type.
+- Finish migrating the `MFTRecord.To_CSV()` functionality to `FileWriters.WriteCSV()` 
+   - Should I be making a new module called `Output_Format`, thus invoking items like `Output_Format.TO_CSV()` .. seems like a lot of work for marginal gain.
+- Better utilize Python built-ins like `@dataclass` and `@staticmethod` on items that would be equivalent to C's `enums` and `structs`.
+- Sort out the documentation and steps to implement a SQLite or PostgreSQL database and use that as an output format. 
+
+### Big thanks!
+To my wife, Jessica, for giving me the motivation to pick this project back up and get it back to a stable, working state. Also thank you to the Reddit Arduino community for helping me consolidate my thoughts on this and some other projects.
 
 ## Version 3.0.1 (2024-09-03)
 

analyzeMFT.py

@@ -1,13 +1,11 @@
-import asyncio
 import sys
+import asyncio
 from src.analyzeMFT.cli import main
 
 # Adds the current directory to the path to ensure our file calls are consistent.
 sys.path.insert(0, os.path.abspath(os.path.join(os.path.dirname(__file__), 'src')))
 
 if __name__ == "__main__":
     if sys.platform == "win32":
-        # This sets the event loop policy to use the ProactorEventLoop on Windows
-        asyncio.set_event_loop_policy(asyncio.WindowsProactorEventLoopPolicy())
-    
+        asyncio.set_event_loop_policy(asyncio.WindowsSelectorEventLoopPolicy())
     asyncio.run(main())

requirements-dev.txt

@@ -0,0 +1,4 @@
+pytest
+pytest-cov
+pytest-mock
+pytest-asyncio

requirements.txt

@@ -0,0 +1 @@
+openpyxl==3.0.10

src/analyzeMFT/cli.py

@@ -41,18 +41,43 @@ async def main():
 
     (options, args) = parser.parse_args()
 
-    if not options.filename or not options.output_file:
+    if not options.filename:
         parser.print_help()
+        print("\nError: No input file specified. Use -f or --file to specify an MFT file.")
+        sys.exit(1)
+
+    if not options.output_file:
+        parser.print_help()
+        print("\nError: No output file specified. Use -o or --output to specify an output file.")
         sys.exit(1)
 
     # Default to CSV if no format specified
     if not options.export_format:
         options.export_format = "csv"  
 
+
     analyzer = MftAnalyzer(options.filename, options.output_file, options.debug, options.very_debug, 
                            options.verbosity, options.compute_hashes, options.export_format)
     await analyzer.analyze()
     print(f"Analysis complete. Results written to {options.output_file}")
 
+    try:
+        analyzer = MftAnalyzer(options.filename, options.output_file, options.debug, options.compute_hashes, options.export_format)
+        await analyzer.analyze()
+        print(f"Analysis complete. Results written to {options.output_file}")
+    except FileNotFoundError:
+        print(f"Error: The file '{options.filename}' was not found.")
+        sys.exit(1)
+    except PermissionError:
+        print(f"Error: Permission denied when trying to read '{options.filename}' or write to '{options.output_file}'.")
+        sys.exit(1)
+    except Exception as e:
+        print(f"An unexpected error occurred: {str(e)}")
+        if options.debug:
+            import traceback
+            traceback.print_exc()
+        sys.exit(1)
+ master
+
 if __name__ == "__main__":
     asyncio.run(main())

src/analyzeMFT/mft_record.py

@@ -4,9 +4,11 @@
 import zlib
 from .constants import *
 from .windows_time import WindowsTime
+
 from typing import Dict, Set, List, Optional, Any, Union
 
 
+
 class MftRecord:
     def __init__(self, raw_record: bytes, compute_hashes: bool = False) -> None:
         self.raw_record = raw_record