### Install libfsntfs Binaries

Source: https://github.com/libyal/libfsntfs/wiki/Building

Install the compiled libfsntfs binaries. By default, they are installed in /usr/local. Use --prefix=/usr to change the installation directory.

```bash
sudo make install
```

--------------------------------

### Build and Install Python Bindings using setup.py

Source: https://github.com/libyal/libfsntfs/wiki/Building

Builds and installs the Python bindings for libfsntfs using the setup.py script. This is useful for creating Python-only distributions.

```bash
python setup.py build
sudo python setup.py install
```

--------------------------------

### Install Build Dependencies on Fedora

Source: https://github.com/libyal/libfsntfs/wiki/Building

Install the necessary build tools and libraries for Fedora-based systems.

```bash
sudo dnf install git autoconf automake gettext-devel libtool pkg-config
```

--------------------------------

### Install Build Dependencies on Debian/Ubuntu

Source: https://github.com/libyal/libfsntfs/wiki/Building

Install the necessary build tools and libraries for Debian-based systems like Ubuntu.

```bash
sudo apt install git autoconf automake autopoint libtool pkg-config
```

--------------------------------

### Install libfsntfs Build Files using DESTDIR

Source: https://github.com/libyal/libfsntfs/wiki/Building

Installs the built files into a temporary directory using DESTDIR to ensure correct library paths for distribution. This is crucial for dylib path correctness.

```bash
make install DESTDIR=$PWD/tmp
```

--------------------------------

### Install Build Dependencies on macOS

Source: https://github.com/libyal/libfsntfs/wiki/Building

Install the necessary build tools and libraries on macOS using MacPorts. Ensure XCode command line tools or an equivalent are installed.

```bash
sudo port install git autoconf automake gettext libtool pkgconfig
```

--------------------------------

### Create macOS Package (.pkg)

Source: https://github.com/libyal/libfsntfs/wiki/Building

Builds a macOS installer package (.pkg) using pkgbuild. Ensure the root directory ($PWD/tmp) contains the installed files and license information.

```bash
pkgbuild --root $PWD/tmp --identifier com.github.libyal.libfsntfs --version <version> --ownership recommended ../libfsntfs-<version>.pkg
```

--------------------------------

### Enable Static Executables

Source: https://github.com/libyal/libfsntfs/wiki/Building

Add this option to enable the creation of static executables during the configure step. Ensure static versions of glibc, libcrypto, and fuse are installed.

```bash
./configure --enable-static-executables=yes
```

--------------------------------

### Install Debian Package

Source: https://github.com/libyal/libfsntfs/wiki/Building

Installs a specific Debian package file for libfsntfs. Replace placeholders with actual version and architecture.

```bash
sudo dpkg -i libfsntfs_<version>-1_<arch>.deb
```

--------------------------------

### Open NTFS Volume via Path and File-like Object (Python)

Source: https://context7.com/libyal/libfsntfs/llms.txt

Demonstrates opening an NTFS volume using pyfsntfs. The first example opens directly from a file path, printing volume metadata. The second example shows opening from a file-like object at a specific byte offset, useful for accessing partitions within a disk image.

```python
# Python — open via path and via file-like object (e.g. at a partition offset)
import pyfsntfs

# --- Direct path open ---
vol = pyfsntfs.volume()
vol.open("/mnt/images/ntfs.raw")

print("Volume name:", vol.name)
print("Serial number:", hex(vol.serial_number))
print("Bytes/sector:", vol.bytes_per_sector)
print("Cluster size:", vol.cluster_block_size)
print("MFT entry size:", vol.mft_entry_size)
print("MFT entries:", vol.number_of_file_entries)
vol.close()

# --- Open from file-like object at a byte offset (e.g. sector 2048, 512 bytes/sector) ---
OFFSET = 2048 * 512
with open("/mnt/images/disk.raw", "rb") as f:
    f.seek(OFFSET)
    vol2 = pyfsntfs.volume()
    vol2.open_file_object(f)
    print("Opened at offset, name:", vol2.name)
    vol2.close()

```

--------------------------------

### Access pyfsntfs Help

Source: https://github.com/libyal/libfsntfs/wiki/Python-development

Import the pyfsntfs module and use the built-in help() function to get detailed information about the library and its components.

```python
import pyfsntfs

help(pyfsntfs)
```

```python
help(pyfsntfs.None)
```

--------------------------------

### Enable Python Bindings

Source: https://github.com/libyal/libfsntfs/wiki/Building

Add this option to enable the build of Python bindings. Ensure Python development files (e.g., python3-dev or python3-devel) are installed.

```bash
./configure --enable-python
```

--------------------------------

### Install RPM Package

Source: https://github.com/libyal/libfsntfs/wiki/Building

Installs a specific RPM package file for libfsntfs. Replace placeholders with actual version and architecture.

```bash
sudo rpm -ivh libfsntfs-<version>-1.<arch>.rpm
```

--------------------------------

### Create macOS Disk Image (.dmg)

Source: https://github.com/libyal/libfsntfs/wiki/Building

Creates a distributable disk image (.dmg) containing the macOS installer package. The HFS+ filesystem is used.

```bash
hdiutil create ../libfsntfs-<version>.dmg -srcfolder ../libfsntfs-<version>.pkg -fs HFS+
```

--------------------------------

### Install Debian Build Dependencies

Source: https://github.com/libyal/libfsntfs/wiki/Building

Installs necessary packages for building libfsntfs using Debian package tools. Run this command on a Debian-based system.

```bash
sudo apt install autotools-dev build-essential debhelper dh-autoreconf dh-python fakeroot pkg-config libssl-dev libfuse-dev python3-dev python3-setuptools
```

--------------------------------

### Install Red Hat Build Dependencies

Source: https://github.com/libyal/libfsntfs/wiki/Building

Installs necessary packages for building libfsntfs using Red Hat package tools (dnf).

```bash
dnf install rpm-build openssl-devel fuse-devel python3-devel
```

--------------------------------

### Convert Visual Studio Solution to 2010 Format with x64 Support

Source: https://github.com/libyal/libfsntfs/wiki/Building

Use the msvscpp-convert script to convert Visual Studio 2008 solution files to 2010 format and automatically add x64 settings. Ensure Python is installed on the build machine.

```bash
msvscpp-convert.py --extend-with-x64 --output-format 2010 msvscpp\libfsntfs.sln
```

--------------------------------

### Include Headers for libfsntfs C Development

Source: https://github.com/libyal/libfsntfs/wiki/C-development

Include these standard C headers and the libfsntfs header for development. Ensure libfsntfs is correctly installed.

```c
#include <stdlib.h>
#include <stdio.h>

#include <libfsntfs.h>
```

--------------------------------

### Configure and Build libfsntfs with GCC

Source: https://github.com/libyal/libfsntfs/wiki/Building

Configure the build with default settings and compile the libfsntfs source code using GCC. Ensure build tools and optional dependencies like OpenSSL and FUSE are installed.

```bash
./configure
make
```

--------------------------------

### fsntfsinfo Command-Line Usage

Source: https://context7.com/libyal/libfsntfs/llms.txt

Examples of using the fsntfsinfo command-line tool to display NTFS volume information, including summary, verbose, partition offset, and body file output.

```bash
# ---- fsntfsinfo ----

# Print volume information summary
fsntfsinfo /mnt/images/ntfs.raw

# Verbose output (includes debug-level detail)
fsntfsinfo -v /mnt/images/ntfs.raw

# Specify a partition offset (sector 2048, 512 bytes/sector = 1048576 bytes)
fsntfsinfo -o 1048576 /mnt/images/disk.raw

# Body file output (TSK mactime format) for timeline analysis
fsntfsinfo -B bodyfile.txt /mnt/images/ntfs.raw

```

--------------------------------

### Extract Source Distribution Package

Source: https://github.com/libyal/libfsntfs/wiki/Building

Use this command to extract the source distribution package. Ensure you have tar installed.

```bash
tar xfv libfsntfs-experimental-<version>.tar.gz
```

--------------------------------

### GCC Compilation Error Example

Source: https://github.com/libyal/libfsntfs/wiki/Troubleshooting

Indicates a compilation failure with GCC. Examine config.log for specific error messages, such as undeclared identifiers.

```text
error: command 'gcc' failed with exit status 1
```

```text
libclocale_locale.c:358:7: error: 'LOCALE_NAME_USER_DEFAULT' undeclared (first use in this function)
```

--------------------------------

### Ignore Specific Test Set

Source: https://github.com/libyal/libfsntfs/wiki/Testing

An example line within an ignore file, specifying that the 'basic' test set should be ignored.

```bash
basic
```

--------------------------------

### Run Tool with GDB Debugger

Source: https://github.com/libyal/libfsntfs/wiki/Troubleshooting

Launches a tool under the GNU Debugger (gdb) to investigate crashes. This command starts the debugger, runs the executable, and waits for it to crash.

```bash
gdb --ex r --args 
```

--------------------------------

### Copy License Files for macOS Package

Source: https://github.com/libyal/libfsntfs/wiki/Building

Copies essential license and documentation files into the installation directory within the temporary build folder. This is required for distribution packages.

```bash
mkdir -p $PWD/tmp/usr/share/doc/libfsntfs
cp AUTHORS COPYING COPYING.LESSER NEWS README $PWD/tmp/usr/share/doc/libfsntfs
```

--------------------------------

### Specify Ignore File for Test Profile

Source: https://github.com/libyal/libfsntfs/wiki/Testing

Example of an ignore file path for the libfsntfs test profile. This file lists test sets to be excluded from the run.

```bash
tests/input/.libfsntfs/ignore
```

--------------------------------

### Visual Studio Runtime Error Example

Source: https://github.com/libyal/libfsntfs/wiki/Troubleshooting

A runtime error on Windows indicating a procedure entry point could not be located in KERNEL32.DLL. This often occurs when running an executable built with a newer Visual Studio version on an older, unsupported Windows version.

```text
The procedure entry point DecodePointer could not be located in the dynamic link library KERNEL32.DLL
```

--------------------------------

### libfsntfs_volume_initialize and libfsntfs_volume_open (C)

Source: https://context7.com/libyal/libfsntfs/llms.txt

Demonstrates how to initialize an NTFS volume, open it from a raw image file, and retrieve various metadata including name, version, flags, serial number, sector/cluster sizes, and MFT entry count. It also shows how to check for BitLocker and VSS support.

```APIDOC
## libfsntfs_volume_initialize / libfsntfs_volume_open

### Description
Initializes an NTFS volume structure, opens a specified NTFS volume from a file path, and retrieves various metadata about the volume.

### C API

#### `libfsntfs_volume_initialize(libfsntfs_volume_t **volume, libfsntfs_error_t **error)`
Initializes a volume structure.

#### `libfsntfs_volume_open(libfsntfs_volume_t *volume, const char *path, uint32_t flags, libfsntfs_error_t **error)`
Opens an NTFS volume from a given path with specified flags.

#### `libfsntfs_volume_get_utf8_name(libfsntfs_volume_t *volume, uint8_t *buffer, size32_t buffer_size, libfsntfs_error_t **error)`
Retrieves the volume name.

#### `libfsntfs_volume_get_version(libfsntfs_volume_t *volume, uint8_t *major, uint8_t *minor, libfsntfs_error_t **error)`
Retrieves the NTFS major and minor version.

#### `libfsntfs_volume_get_flags(libfsntfs_volume_t *volume, uint16_t *flags, libfsntfs_error_t **error)`
Retrieves the volume flags.

#### `libfsntfs_volume_get_serial_number(libfsntfs_volume_t *volume, uint64_t *serial_number, libfsntfs_error_t **error)`
Retrieves the volume serial number.

#### `libfsntfs_volume_get_bytes_per_sector(libfsntfs_volume_t *volume, uint16_t *bytes_per_sector, libfsntfs_error_t **error)`
Retrieves the number of bytes per sector.

#### `libfsntfs_volume_get_cluster_block_size(libfsntfs_volume_t *volume, size32_t *cluster_block_size, libfsntfs_error_t **error)`
Retrieves the cluster block size.

#### `libfsntfs_volume_get_number_of_file_entries(libfsntfs_volume_t *volume, uint64_t *n_entries, libfsntfs_error_t **error)`
Retrieves the total number of MFT entries.

#### `libfsntfs_volume_has_bitlocker_drive_encryption(libfsntfs_volume_t *volume, libfsntfs_error_t **error)`
Checks if the volume has BitLocker drive encryption.

#### `libfsntfs_volume_has_volume_shadow_snapshots(libfsntfs_volume_t *volume, libfsntfs_error_t **error)`
Checks if the volume has Volume Shadow Snapshots.

#### `libfsntfs_volume_close(libfsntfs_volume_t *volume, libfsntfs_error_t **error)`
Closes the opened volume.

#### `libfsntfs_volume_free(libfsntfs_volume_t **volume, libfsntfs_error_t **error)`
Frees the volume structure.

### Request Example
```c
#include <stdio.h>
#include <stdlib.h>
#include <libfsntfs.h>

int main(void)
{
    libfsntfs_volume_t  *volume     = NULL;
    libfsntfs_error_t   *error      = NULL;
    uint8_t              name[256];
    uint8_t              major, minor;
    uint16_t             flags;
    uint64_t             serial;
    uint16_t             bps;
    size32_t             cluster;
    uint64_t             n_entries;
    int                  result;

    if (libfsntfs_volume_initialize(&volume, &error) != 1) {
        libfsntfs_error_fprint(error, stderr);
        libfsntfs_error_free(&error);
        return EXIT_FAILURE;
    }

    if (libfsntfs_volume_open(volume, "/mnt/images/ntfs.raw",
                              LIBFSNTFS_OPEN_READ, &error) != 1) {
        libfsntfs_error_fprint(error, stderr);
        libfsntfs_error_free(&error);
        libfsntfs_volume_free(&volume, NULL);
        return EXIT_FAILURE;
    }

    /* Volume name */
    result = libfsntfs_volume_get_utf8_name(volume, name, sizeof(name), &error);
    if (result == 1)
        printf("Volume name: %s\n", (char *)name);

    /* NTFS format version */
    libfsntfs_volume_get_version(volume, &major, &minor, &error);
    printf("NTFS version: %u.%u\n", major, minor);

    /* Volume flags */
    libfsntfs_volume_get_flags(volume, &flags, &error);
    printf("Volume flags: 0x%04x\n", flags);

    /* Serial number */
    libfsntfs_volume_get_serial_number(volume, &serial, &error);
    printf("Serial number: 0x%016llx\n", (unsigned long long)serial);

    /* Geometry */
    libfsntfs_volume_get_bytes_per_sector(volume, &bps, &error);
    libfsntfs_volume_get_cluster_block_size(volume, &cluster, &error);
    printf("Bytes/sector: %u  Cluster size: %u\n", bps, cluster);

    /* Total MFT entries */
    libfsntfs_volume_get_number_of_file_entries(volume, &n_entries, &error);
    printf("MFT entries: %llu\n", (unsigned long long)n_entries);

    /* BitLocker / VSS checks */
    printf("BitLocker: %s\n",
           libfsntfs_volume_has_bitlocker_drive_encryption(volume, &error) == 1
           ? "yes" : "no");
    printf("VSS: %s\n",
           libfsntfs_volume_has_volume_shadow_snapshots(volume, &error) == 1
           ? "yes" : "no");

    libfsntfs_volume_close(volume, &error);
    libfsntfs_volume_free(&volume, &error);
    return EXIT_SUCCESS;
}
```
```

--------------------------------

### C: Walk NTFS Volume Root Directory and Access Files

Source: https://context7.com/libyal/libfsntfs/llms.txt

Demonstrates how to initialize an NTFS volume, retrieve the root directory, and access files by path or MFT index. Includes reading file metadata and data. Ensure the image path is correct.

```c
#include <stdio.h>
#include <stdlib.h>
#include <libfsntfs.h>

void print_entry(libfsntfs_file_entry_t *entry)
{
    uint8_t  name[512];
    uint64_t ctime, mtime;
    int      n_sub, i;
    libfsntfs_file_entry_t *sub = NULL;
    libfsntfs_error_t      *error = NULL;

    if (libfsntfs_file_entry_get_utf8_name(entry, name, sizeof(name), &error) == 1)
        printf("  %s\n", (char *)name);

    libfsntfs_file_entry_get_creation_time(entry, &ctime, &error);
    libfsntfs_file_entry_get_modification_time(entry, &mtime, &error);
    printf("    created=0x%llx  modified=0x%llx\n",
           (unsigned long long)ctime, (unsigned long long)mtime);

    /* Recurse one level into directories */
    libfsntfs_file_entry_get_number_of_sub_file_entries(entry, &n_sub, &error);
    for (i = 0; i < n_sub; i++) {
        if (libfsntfs_file_entry_get_sub_file_entry_by_index(
                entry, i, &sub, &error) == 1) {
            uint8_t sub_name[512];
            if (libfsntfs_file_entry_get_utf8_name(
                    sub, sub_name, sizeof(sub_name), &error) == 1)
                printf("    child: %s\n", (char *)sub_name);
            libfsntfs_file_entry_free(&sub, NULL);
        }
    }
}

int main(void)
{
    libfsntfs_volume_t     *volume = NULL;
    libfsntfs_file_entry_t *root   = NULL;
    libfsntfs_file_entry_t *entry  = NULL;
    libfsntfs_error_t      *error  = NULL;

    libfsntfs_volume_initialize(&volume, &error);
    libfsntfs_volume_open(volume, "/mnt/images/ntfs.raw",
                          LIBFSNTFS_OPEN_READ, &error);

    /* Root directory */
    libfsntfs_volume_get_root_directory(volume, &root, &error);
    printf("Root directory:\n");
    print_entry(root);
    libfsntfs_file_entry_free(&root, NULL);

    /* Access by path */
    if (libfsntfs_volume_get_file_entry_by_utf8_path(
            volume, (const uint8_t *)"\\Windows\\System32\\ntoskrnl.exe",
            30, &entry, &error) == 1) {
        printf("\nntoskrnl.exe found:\n");
        print_entry(entry);

        /* Read file data */
        uint8_t  buf[4096];
        ssize_t  nread;
        size64_t size;
        libfsntfs_file_entry_get_size(entry, &size, &error);
        printf("  size: %llu bytes\n", (unsigned long long)size);

        nread = libfsntfs_file_entry_read_buffer_at_offset(
                    entry, buf, sizeof(buf), 0, &error);
        printf("  read %zd bytes from offset 0\n", nread);
        printf("  MZ magic: %02x %02x\n", buf[0], buf[1]);

        libfsntfs_file_entry_free(&entry, NULL);
    }

    /* Access by MFT index */
    libfsntfs_volume_get_file_entry_by_index(volume, 0, &entry, &error); /* $MFT */
    uint64_t ref;
    libfsntfs_file_entry_get_file_reference(entry, &ref, &error);
    printf("\n$MFT file reference: 0x%llx\n", (unsigned long long)ref);
    libfsntfs_file_entry_free(&entry, NULL);

    libfsntfs_volume_close(volume, &error);
    libfsntfs_volume_free(&volume, &error);
    return EXIT_SUCCESS;
}

```

--------------------------------

### List and Read Alternate Data Streams in C

Source: https://context7.com/libyal/libfsntfs/llms.txt

Demonstrates how to list all alternate data streams attached to a file entry by index, retrieve their names and sizes, read their content, and look up specific streams by name. Requires libfsntfs library.

```c
#include <stdio.h>
#include <stdlib.h>
#include <libfsntfs.h>

int main(void)
{
    libfsntfs_volume_t      *volume = NULL;
    libfsntfs_file_entry_t  *entry  = NULL;
    libfsntfs_data_stream_t *stream = NULL;
    libfsntfs_error_t       *error  = NULL;
    int      n_ads, i;
    uint8_t  sname[256];
    size64_t ssize;
    uint8_t  buf[1024];
    ssize_t  nread;

    libfsntfs_volume_initialize(&volume, &error);
    libfsntfs_volume_open(volume, "/mnt/images/ntfs.raw",
                          LIBFSNTFS_OPEN_READ, &error);

    /* Look up a file known to have ADS */
    if (libfsntfs_volume_get_file_entry_by_utf8_path(
            volume, (const uint8_t *)"\\secret.txt", 11,
            &entry, &error) != 1) {
        fprintf(stderr, "File not found\n");
        goto cleanup;
    }

    printf("Has default data stream: %s\n",
           libfsntfs_file_entry_has_default_data_stream(entry, &error) == 1
           ? "yes" : "no");

    libfsntfs_file_entry_get_number_of_alternate_data_streams(
        entry, &n_ads, &error);
    printf("Alternate data streams: %d\n", n_ads);

    for (i = 0; i < n_ads; i++) {
        libfsntfs_file_entry_get_alternate_data_stream_by_index(
            entry, i, &stream, &error);

        libfsntfs_data_stream_get_utf8_name(
            stream, sname, sizeof(sname), &error);
        libfsntfs_data_stream_get_size(stream, &ssize, &error);
        printf("  ADS[%d] name=%s  size=%llu\n",
               i, (char *)sname, (unsigned long long)ssize);

        /* Read first 1 KB */
        nread = libfsntfs_data_stream_read_buffer_at_offset(
                    stream, buf, sizeof(buf), 0, &error);
        printf("  read %zd bytes\n", nread);

        /* Extent info */
        int n_ext;
        libfsntfs_data_stream_get_number_of_extents(stream, &n_ext, &error);
        printf("  extents: %d\n", n_ext);

        libfsntfs_data_stream_free(&stream, NULL);
    }

    /* Lookup ADS by name */
    if (libfsntfs_file_entry_has_alternate_data_stream_by_utf8_name(
            entry,
            (const uint8_t *)"Zone.Identifier", 15, &error) == 1) {
        printf("Zone.Identifier stream present (downloaded file).\n");
        libfsntfs_file_entry_get_alternate_data_stream_by_utf8_name(
            entry, (const uint8_t *)"Zone.Identifier", 15,
            &stream, &error);
        nread = libfsntfs_data_stream_read_buffer_at_offset(
                    stream, buf, sizeof(buf), 0, &error);
        buf[nread > 0 ? nread : 0] = '\0';
        printf("Zone.Identifier content:\n%s\n", (char *)buf);
        libfsntfs_data_stream_free(&stream, NULL);
    }

cleanup:
    if (entry) libfsntfs_file_entry_free(&entry, NULL);
    libfsntfs_volume_close(volume, &error);
    libfsntfs_volume_free(&volume, &error);
    return EXIT_SUCCESS;
}

```

--------------------------------

### Update Library Cache on Linux

Source: https://github.com/libyal/libfsntfs/wiki/Building

After installation on Linux, update the dynamic library cache to ensure the system can find the newly installed libfsntfs.so.

```bash
sudo ldconfig
```

--------------------------------

### MinGW Build with Custom Environment

Source: https://github.com/libyal/libfsntfs/wiki/Building

A shell script to set up the build environment for MinGW, specifying compiler and linker paths, and then configuring and building the library.

```bash
#!/bin/sh
CC=/opt/local/bin/i386-mingw32-gcc
CXX=/opt/local/bin/i386-mingw32-g++
AR=/opt/local/bin/i386-mingw32-ar
OBJDUMP=/opt/local/bin/i386-mingw32-objdump
RANLIB=/opt/local/bin/i386-mingw32-ranlib
STRIP=/opt/local/bin/i386-mingw32-strip
MINGWFLAGS="-mwin32 -mconsole -march=i586 "
CFLAGS="$MINGWFLAGS"
CXXFLAGS="$MINGWFLAGS"

CC=$CC CXX=$CXX AR=$AR OBJDUMP=$OBJDUMP RANLIB=$RANLIB STRIP=$STRIP ./configure --host=i586-mingw32msvc --prefix=/opt/local/i386-mingw32 --enable-winapi=yes
CC=$CC CXX=$CXX AR=$AR OBJDUMP=$OBJDUMP RANLIB=$RANLIB STRIP=$STRIP CFLAGS="$CFLAGS" CXXFLAGS="$CXXFLAGS" make
```

--------------------------------

### Build libfsntfs with MSBuild

Source: https://github.com/libyal/libfsntfs/wiki/Building

Use MSBuild from the command line to build the libfsntfs solution. Ensure Visual Studio environment variables are set first.

```bash
C:\Program Files\Microsoft Visual Studio 9.0\VC\bin\vcvars32.bat
msbuild msvscpp\libfsntfs.sln /p:Configuration=Release;Platform=Win32
```

--------------------------------

### Cygwin Build Output

Source: https://github.com/libyal/libfsntfs/wiki/Building

These are the expected DLL and executable files after a successful build using Cygwin.

```text
libfsntfs/.libs/cygfsntfs-0.dll
```

```text
fsntfstools/.libs/fsntfsinfo.exe
```

```text
fsntfstools/.libs/fsntfsmount.exe
```

--------------------------------

### Configure and Build libfsntfs for macOS

Source: https://github.com/libyal/libfsntfs/wiki/Building

Configures the build with a specific prefix and enables Python bindings. 'make' compiles the library. Use --prefix=/usr/local for System Integrity Protection.

```bash
./configure --prefix=/usr/local --enable-python --with-pyprefix
make
```

--------------------------------

### Get Library Version and Check NTFS Signatures (Python)

Source: https://context7.com/libyal/libfsntfs/llms.txt

This Python code shows how to get the pyfsntfs version and check for NTFS volume signatures. The `check_volume_signature` function returns a boolean indicating if the file is an NTFS volume.

```python
import pyfsntfs

print("pyfsntfs version:", pyfsntfs.get_version())

# Check signature
result = pyfsntfs.check_volume_signature("/mnt/images/disk.raw")
print("Is NTFS volume:", result)   # True or False

```

--------------------------------

### Building libfsntfs with GCC

Source: https://context7.com/libyal/libfsntfs/llms.txt

Instructions for building the libfsntfs library using GCC on Linux, including enabling Python support and verbose output.

```bash
# Build with GCC (Linux)
./configure --enable-python --enable-verbose-output
make && sudo make install

```

--------------------------------

### Get pyfsntfs Version

Source: https://github.com/libyal/libfsntfs/wiki/Python-development

Use the get_version() function to retrieve the version of the underlying libfsntfs library. This function returns a Unicode string.

```python
pyfsntfs.get_version()
```

--------------------------------

### MinGW Build Output

Source: https://github.com/libyal/libfsntfs/wiki/Building

These are the expected DLL and executable files after a successful build using MinGW with WINAPI support.

```text
libfsntfs/.libs/libfsntfs-1.dll
```

```text
fsntfstools/.libs/fsntfsinfo.exe
```

```text
fsntfstools/.libs/fsntfsmount.exe
```

--------------------------------

### MinGW Build without Auto-detection

Source: https://github.com/libyal/libfsntfs/wiki/Building

Alternative configure command for MinGW builds if mingw32-configure is not available. This explicitly sets the host and prefix.

```bash
./configure --host=i386-mingw32 --prefix=/opt/local/i386-mingw32 --enable-winapi=yes
make
```

--------------------------------

### List Partitions with fdisk

Source: https://github.com/libyal/libfsntfs/wiki/Mounting

Use fdisk to list partition information for a block device or a raw disk image. This helps in identifying the correct offset for mounting.

```bash
sudo fdisk -l /dev/sda
```

```bash
fdisk -l image.raw
```

--------------------------------

### Clone and Prepare Git Repository

Source: https://github.com/libyal/libfsntfs/wiki/Building

Clone the libfsntfs repository and prepare the source for building. This includes synchronizing library dependencies and generating build files using autotools.

```bash
git clone https://github.com/libyal/libfsntfs.git
cd libfsntfs/
./synclibs.sh
./autogen.sh
```

--------------------------------

### Check Library Paths in dylib

Source: https://github.com/libyal/libfsntfs/wiki/Building

Verifies the dynamic library paths embedded within the libfsntfs dylib file. This is useful for ensuring correct installation and distribution.

```bash
otool -LT tmp/usr/lib/libfsntfs.1.dylib
```

--------------------------------

### Build Debian Packages

Source: https://github.com/libyal/libfsntfs/wiki/Building

Copies the debian directory and then builds the Debian packages for libfsntfs. Ensure you are in the source directory.

```bash
cp -rf dpkg debian
dpkg-buildpackage -rfakeroot
```

--------------------------------

### Get Library Version and Check Signatures

Source: https://context7.com/libyal/libfsntfs/llms.txt

Provides functions to retrieve the library version and to check if a given file or path contains an NTFS volume signature or is a standalone MFT metadata file.

```APIDOC
## libfsntfs_get_version / pyfsntfs.get_version()

### Description
Returns the library version string and provides helpers for checking NTFS volume and MFT metadata file signatures before opening.

### C API
#### Function: `libfsntfs_get_version()`
Returns the library version string.

#### Function: `libfsntfs_check_volume_signature(path, error)`
Checks whether a file is an NTFS volume before opening it.
- **path** (string) - Required - The path to the file to check.
- **error** (libfsntfs_error_t**) - Required - Pointer to an error handle.
Returns `1` if the file contains an NTFS volume signature, `0` if not, and `-1` on error.

#### Function: `libfsntfs_check_mft_metadata_file_signature(path, error)`
Checks for a standalone MFT metadata file.
- **path** (string) - Required - The path to the file to check.
- **error** (libfsntfs_error_t**) - Required - Pointer to an error handle.
Returns `1` if the file is an MFT metadata file, `0` if not, and `-1` on error.

### Python Bindings (`pyfsntfs`)
#### Function: `pyfsntfs.get_version()`
Returns the library version string.

#### Function: `pyfsntfs.check_volume_signature(path)`
Checks whether a file is an NTFS volume before opening it.
- **path** (string) - Required - The path to the file to check.
Returns `True` if the file contains an NTFS volume signature, `False` otherwise.
```

--------------------------------

### Open NTFS Volume and Read Metadata (C)

Source: https://context7.com/libyal/libfsntfs/llms.txt

Initializes and opens an NTFS volume from a raw image file, then reads and prints various metadata including name, version, flags, serial number, sector/cluster sizes, and MFT entry count. Also checks for BitLocker and VSS support. Ensure the volume is properly closed and freed.

```c
#include <stdio.h>
#include <stdlib.h>
#include <libfsntfs.h>

int main(void)
{
    libfsntfs_volume_t  *volume     = NULL;
    libfsntfs_error_t   *error      = NULL;
    uint8_t              name[256];
    uint8_t              major, minor;
    uint16_t             flags;
    uint64_t             serial;
    uint16_t             bps;
    size32_t             cluster;
    uint64_t             n_entries;
    int                  result;

    if (libfsntfs_volume_initialize(&volume, &error) != 1) {
        libfsntfs_error_fprint(error, stderr);
        libfsntfs_error_free(&error);
        return EXIT_FAILURE;
    }

    if (libfsntfs_volume_open(volume, "/mnt/images/ntfs.raw",
                              LIBFSNTFS_OPEN_READ, &error) != 1) {
        libfsntfs_error_fprint(error, stderr);
        libfsntfs_error_free(&error);
        libfsntfs_volume_free(&volume, NULL);
        return EXIT_FAILURE;
    }

    /* Volume name */
    result = libfsntfs_volume_get_utf8_name(volume, name, sizeof(name), &error);
    if (result == 1)
        printf("Volume name: %s\n", (char *)name);

    /* NTFS format version */
    libfsntfs_volume_get_version(volume, &major, &minor, &error);
    printf("NTFS version: %u.%u\n", major, minor);

    /* Volume flags */
    libfsntfs_volume_get_flags(volume, &flags, &error);
    printf("Volume flags: 0x%04x\n", flags);

    /* Serial number */
    libfsntfs_volume_get_serial_number(volume, &serial, &error);
    printf("Serial number: 0x%016llx\n", (unsigned long long)serial);

    /* Geometry */
    libfsntfs_volume_get_bytes_per_sector(volume, &bps, &error);
    libfsntfs_volume_get_cluster_block_size(volume, &cluster, &error);
    printf("Bytes/sector: %u  Cluster size: %u\n", bps, cluster);

    /* Total MFT entries */
    libfsntfs_volume_get_number_of_file_entries(volume, &n_entries, &error);
    printf("MFT entries: %llu\n", (unsigned long long)n_entries);

    /* BitLocker / VSS checks */
    printf("BitLocker: %s\n",
           libfsntfs_volume_has_bitlocker_drive_encryption(volume, &error) == 1
           ? "yes" : "no");
    printf("VSS: %s\n",
           libfsntfs_volume_has_volume_shadow_snapshots(volume, &error) == 1
           ? "yes" : "no");

    libfsntfs_volume_close(volume, &error);
    libfsntfs_volume_free(&volume, &error);
    return EXIT_SUCCESS;
}

```

--------------------------------

### pyfsntfs.volume() (Python)

Source: https://context7.com/libyal/libfsntfs/llms.txt

Shows how to open an NTFS volume using the pyfsntfs library, either directly from a file path or from a file-like object at a specific byte offset. It also demonstrates accessing volume attributes like name, serial number, and cluster size.

```APIDOC
## pyfsntfs.volume()

### Description
Provides an interface to open and access NTFS volumes in Python. Volumes can be opened directly via a file path or from a file-like object, allowing for operations at specific offsets within a disk image.

### Python API

#### `pyfsntfs.volume()`
Constructor for the volume object.

#### `volume.open(path)`
Opens an NTFS volume from a given file path.

#### `volume.open_file_object(file_object)`
Opens an NTFS volume from a file-like object.

#### Attributes
- **name**: (str) The name of the volume.
- **serial_number**: (int) The serial number of the volume.
- **bytes_per_sector**: (int) The number of bytes per sector.
- **cluster_block_size**: (int) The size of a cluster block in bytes.
- **mft_entry_size**: (int) The size of an MFT entry in bytes.
- **number_of_file_entries**: (int) The total number of MFT entries.

#### `volume.close()`
Closes the opened volume.

### Request Example
```python
# Python — open via path and via file-like object (e.g. at a partition offset)
import pyfsntfs

# --- Direct path open ---
vol = pyfsntfs.volume()
vol.open("/mnt/images/ntfs.raw")

print("Volume name:", vol.name)
print("Serial number:", hex(vol.serial_number))
print("Bytes/sector:", vol.bytes_per_sector)
print("Cluster size:", vol.cluster_block_size)
print("MFT entry size:", vol.mft_entry_size)
print("MFT entries:", vol.number_of_file_entries)
vol.close()

# --- Open from file-like object at a byte offset (e.g. sector 2048, 512 bytes/sector) ---
OFFSET = 2048 * 512
with open("/mnt/images/disk.raw", "rb") as f:
    f.seek(OFFSET)
    vol2 = pyfsntfs.volume()
    vol2.open_file_object(f)
    print("Opened at offset, name:", vol2.name)
    vol2.close()
```
```

--------------------------------

### macOS Python Bindings Configuration

Source: https://github.com/libyal/libfsntfs/wiki/Building

Configure the build to use a specific Python version on macOS by setting CFLAGS and LDFLAGS. The --with-pyprefix option tells configure to use Python to determine the installation prefix.

```bash
CFLAGS=-I/Library/Frameworks/Python.framework/Versions/2.7/include/ \
LDFLAGS=-L/Library/Frameworks/Python.framework/Versions/2.7/lib/ \
./configure --enable-python --with-pyprefix
```

--------------------------------

### Initialize and Open Standalone $MFT Metadata File (C)

Source: https://context7.com/libyal/libfsntfs/llms.txt

Opens a standalone $MFT metadata file for reading. Use this when only the MFT has been preserved or exported, without a full volume image. It allows enumeration of MFT entries and access to file entry details.

```c
#include <stdio.h>
#include <stdlib.h>
#include <libfsntfs.h>

int main(void)
{
    libfsntfs_mft_metadata_file_t *mft   = NULL;
    libfsntfs_file_entry_t        *entry = NULL;
    libfsntfs_error_t             *error = NULL;
    uint8_t   vol_name[256];
    uint8_t   major, minor;
    uint16_t  flags;
    uint64_t  n_entries, i;
    uint8_t   name[512];
    int       result;

    if (libfsntfs_mft_metadata_file_initialize(&mft, &error) != 1)
        goto on_error;

    if (libfsntfs_mft_metadata_file_open(
            mft, "/evidence/$MFT", LIBFSNTFS_OPEN_READ, &error) != 1)
        goto on_error;

    /* Volume metadata embedded in MFT */
    result = libfsntfs_mft_metadata_file_get_utf8_volume_name(
                 mft, vol_name, sizeof(vol_name), &error);
    if (result == 1)
        printf("Volume name: %s\n", (char *)vol_name);

    libfsntfs_mft_metadata_file_get_volume_version(mft, &major, &minor, &error);
    printf("NTFS version: %u.%u\n", major, minor);

    libfsntfs_mft_metadata_file_get_volume_flags(mft, &flags, &error);
    printf("Volume flags: 0x%04x\n", flags);

    libfsntfs_mft_metadata_file_get_number_of_file_entries(mft, &n_entries, &error);
    printf("Total MFT entries: %llu\n", (unsigned long long)n_entries);

    /* Walk first 20 allocated entries */
    for (i = 0; i < 20 && i < n_entries; i++) {
        if (libfsntfs_mft_metadata_file_get_file_entry_by_index(
                mft, i, &entry, &error) != 1)
            continue;

        if (libfsntfs_file_entry_is_allocated(entry, &error) != 1) {
            libfsntfs_file_entry_free(&entry, NULL);
            continue;
        }

        if (libfsntfs_file_entry_get_utf8_name(
                entry, name, sizeof(name), &error) == 1)
            printf("  [%llu] %s\n", (unsigned long long)i, (char *)name);

        libfsntfs_file_entry_free(&entry, NULL);
    }

on_error:
    if (error) {
        libfsntfs_error_fprint(error, stderr);
        libfsntfs_error_free(&error);
    }
    if (mft) {
        libfsntfs_mft_metadata_file_close(mft, NULL);
        libfsntfs_mft_metadata_file_free(&mft, NULL);
    }
    return EXIT_SUCCESS;
}

```

--------------------------------

### Read USN Records from Change Journal (C)

Source: https://context7.com/libyal/libfsntfs/llms.txt

Retrieves the NTFS USN change journal from a volume and reads raw USN records sequentially. This is useful for tracking file system changes. The example reads up to 10 records.

```c
#include <stdio.h>
#include <stdlib.h>
#include <libfsntfs.h>

int main(void)
{
    libfsntfs_volume_t           *volume  = NULL;
    libfsntfs_usn_change_journal_t *journal = NULL;
    libfsntfs_error_t            *error   = NULL;
    uint8_t  record_data[65536];
    ssize_t  nread;
    off64_t  offset;
    int      result;

    libfsntfs_volume_initialize(&volume, &error);
    libfsntfs_volume_open(volume, "/mnt/images/ntfs.raw",
                          LIBFSNTFS_OPEN_READ, &error);

    result = libfsntfs_volume_get_usn_change_journal(
                 volume, &journal, &error);
    if (result != 1) {
        printf("No USN change journal found.\n");
        goto cleanup;
    }

    libfsntfs_usn_change_journal_get_offset(journal, &offset, &error);
    printf("Journal starts at offset: %lld\n", (long long)offset);

    /* Read records sequentially until EOF */
    int count = 0;
    while ((nread = libfsntfs_usn_change_journal_read_usn_record(
                        journal, record_data, sizeof(record_data),
                        &error)) > 0) {
        count++;
        /* The raw USN_RECORD_V2 structure starts at record_data */
        /* First 4 bytes = record length (little-endian uint32) */
        uint32_t rec_len = (uint32_t)record_data[0]
                         | ((uint32_t)record_data[1] << 8)
                         | ((uint32_t)record_data[2] << 16)
                         | ((uint32_t)record_data[3] << 24);
        printf("USN record %d: length=%u\n", count, rec_len);
        if (count >= 10) break;   /* just show first 10 */
    }
    printf("Read %d USN records.\n", count);

cleanup:
    if (journal) libfsntfs_usn_change_journal_free(&journal, NULL);
    libfsntfs_volume_close(volume, &error);
    libfsntfs_volume_free(&volume, &error);
    return EXIT_SUCCESS;
}

```

--------------------------------

### Prepare Git Repository with PowerShell on Windows

Source: https://github.com/libyal/libfsntfs/wiki/Building

Clone the libfsntfs repository and prepare the source for building using Windows PowerShell scripts. This is an alternative to autogen.sh for Windows environments.

```powershell
git clone https://github.com/libyal/libfsntfs.git
cd libfsntfs\
.\synclibs.ps1
.\autogen.ps1
```

--------------------------------

### Get Library Version and Check NTFS Signatures (C)

Source: https://context7.com/libyal/libfsntfs/llms.txt

This C code demonstrates how to retrieve the libfsntfs library version and check if a file contains an NTFS volume signature or is a standalone MFT metadata file. Ensure libfsntfs is included and linked.

```c
#include <stdio.h>
#include <stdlib.h>
#include <libfsntfs.h>

int main(void)
{
    libfsntfs_error_t *error = NULL;
    int result;

    /* Print library version */
    printf("libfsntfs version: %s\n", libfsntfs_get_version());

    /* Check whether a file is an NTFS volume before opening it */
    result = libfsntfs_check_volume_signature("/mnt/images/disk.raw", &error);
    if (result == 1) {
        printf("File contains an NTFS volume signature.\n");
    } else if (result == 0) {
        printf("Not an NTFS volume.\n");
    } else {
        libfsntfs_error_fprint(error, stderr);
        libfsntfs_error_free(&error);
        return EXIT_FAILURE;
    }

    /* Check for a standalone MFT metadata file */
    result = libfsntfs_check_mft_metadata_file_signature("/evidence/$MFT", &error);
    if (result == 1) {
        printf("File is an MFT metadata file.\n");
    }
    return EXIT_SUCCESS;
}

```

--------------------------------

### Python: Enumerate NTFS Volume, Read File Content, Check Allocation

Source: https://context7.com/libyal/libfsntfs/llms.txt

Shows how to use pyfsntfs to open an NTFS volume, list root directory contents, retrieve files by path or MFT index, and read file data. Verifies file properties like size and allocation status.

```python
import pyfsntfs

vol = pyfsntfs.volume()
vol.open("/mnt/images/ntfs.raw")

# Root directory children
root = vol.get_root_directory()
print("Root has", root.number_of_sub_file_entries, "sub-entries")
for i in range(root.number_of_sub_file_entries):
    child = root.get_sub_file_entry(i)
    print(" ", child.name, "| created:", child.creation_time)

# Lookup by path
entry = vol.get_file_entry_by_path("\\Windows\\System32\\ntoskrnl.exe")
if entry:
    print("\nntoskrnl.exe")
    print("  size:", entry.size)
    print("  allocated:", entry.is_allocated())
    print("  is symlink:", entry.is_symbolic_link())
    print("  attributes:", entry.number_of_attributes)
    data = entry.read(4096)             # reads from default $DATA stream
    print("  first 2 bytes:", data[:2]) # b'MZ'

# Lookup by MFT index (0 = $MFT itself)
mft_entry = vol.get_file_entry(0)
print("\n$MFT name:", mft_entry.name)
print("$MFT file reference:", hex(mft_entry.file_reference))
print("$MFT extents:", mft_entry.number_of_extents)
for i in range(mft_entry.number_of_extents):
    ext = mft_entry.get_extent(i)      # (offset, size, flags)
    print("  extent", i, "offset:", ext[0], "size:", ext[1])

vol.close()

```

--------------------------------

### Detect and Resolve Symbolic Links/Reparse Points with Python

Source: https://context7.com/libyal/libfsntfs/llms.txt

Detects if a file entry is a symbolic link and retrieves its target path. Also inspects reparse point attributes to get tags, substitute names, and print names. Requires pyfsntfs library.

```python
# Python — detect and resolve symbolic links / reparse points
import pyfsntfs

vol = pyfsntfs.volume()
vol.open("/mnt/images/ntfs.raw")

entry = vol.get_file_entry_by_path("\\Documents and Settings")
if entry:
    print("Is symlink:", entry.is_symbolic_link())
    if entry.is_symbolic_link():
        print("Target:", entry.symbolic_link_target)

    # Inspect each attribute
    for i in range(entry.number_of_attributes):
        attr = entry.get_attribute(i)
        # REPARSE_POINT type = 0xC0
        if attr.attribute_type == 0xC0:
            print("Reparse tag:", hex(attr.get_tag()))
            print("Substitute name:", attr.get_substitute_name())
            print("Print name:", attr.get_print_name())

vol.close()
```