NtfsRecord

final class ntoseye.NtfsRecord

Subclass of BaseRecord.

One NTFS blackbox record.

property break_reason: int | None

An oplock break’s reason: 1 NtfsFsdSetInformation to 5 NtfsFsdWrite.

property breaking_process_name: str | None

property irp: int

property kind: int

1 slow I/O timeout, 2 oplock break timeout.

property length: int

property owner_process_name: str | None

property scb: int

property thread: int | None

A slow I/O timeout’s waiting thread.