How to check for hidden files & folders on NTFS partition using python on linux?

Question

I am using NTFS partition on linux machine. I want to identify hidden files and folders on my NTFS partition on linux using python.

How can I achieve this using python. Any code snippet / links would be appreciated.

Thanks.

Answer 1

Assuming you are using ntfs-3g to mount your NTFS partitions on linux (this is default on most current linux distributions).

You will need to read file extended attributes (see attr(5)), you can use pyxattr for this. NTFS attributes are stored in system.ntfs_attrib extended attribute as a set of flags which values are documented in ntfs-3g documentation.

Here is a sample code to read and decode NTFS file system attributes and use them to filter files:

import os, struct, xattr

# values from http://www.tuxera.com/community/ntfs-3g-advanced/extended-attributes/
attributes = ['readonly', 'hidden', 'system', 'unknown',
              'unknown', 'archive', 'unknown', 'unknown',
              'temp', 'unknown', 'unknown', 'compressed_dir',
              'offline', 'not_content_indexed' ] + ['unknown']*18

def ntfs_attr(path):
    attr = struct.unpack("i", xattr.get(path, "system.ntfs_attrib"))[0]
    for shift, attribute in enumerate(attributes):
        if (attr >> shift) & 1 == 1:
            yield attribute

def main():
    import sys
    if len(sys.argv) != 3:
        print "Usage: %s path attribute" % sys.argv[0]
        a = set(attributes)
        a.remove('unknown')
        print "where attribute is one of:", ' '.join(a)
        sys.exit(1)

    path = sys.argv[1]
    attribute = sys.argv[2]
    print "Files with %s attribute in %s:" % (attribute, path)
    for filename in os.listdir(path):
        fullname = os.path.join(path, filename)
        if attribute in ntfs_attr(fullname):
            print fullname


if __name__ == '__main__':
    main()

Answer 2

There seems to be no python interface for NTFS attributes under linux.

NTFS-3G supports NTFS file attributes and exposes them for the linux tools getfattr and setfattr to read and set.

You can use python's subprocess to invoke getfattr and then parse the output.

Note: on my ubuntu system i had to install the package attr to get the commands getfattr and setfattr.