---
id: dissect-ntfs
version: "3.16"
license: AGPL-3.0-or-later
license_treatment: agpl
maintenance: active
---

# dissect.ntfs — A Dissect module implementing a parser for the NTFS file system, used by the Windows operating system

License: agpl · Maintenance: active · Downloads: 86.1K/mo

## What it is and what it does

dissect.ntfs is a parser module for the NTFS file system, part of the larger Dissect framework for digital forensics and incident response. It provides programmatic access to NTFS structures, allowing developers to read and analyze Windows file systems at the binary level. The module is built on top of dissect.cstruct for binary data parsing and dissect.util for utility functions, keeping dependencies minimal and focused.

Typical use cases include forensic analysis of Windows systems, automated extraction of file metadata and content from NTFS volumes, and integration into larger investigation workflows. The module is designed for developers and information security professionals who need to parse NTFS data programmatically rather than through standard OS file access.

Use it for:

- Forensic analysis of Windows disk images or NTFS volumes in incident response investigations
- Automated extraction of file metadata, timestamps, and content from NTFS file systems
- Integration into security tools and frameworks that need to analyze Windows storage structures
- Recovery or analysis of deleted files and unallocated space in NTFS volumes
- Parsing NTFS structures in cross-platform or headless environments without Windows OS

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Parses and reads NTFS file systems, the primary file system used by Windows operating systems, enabling programmatic access to NTFS structures and data.

Yes, if you need to parse NTFS file systems programmatically for forensics, security analysis, or incident response. The package is actively maintained, has low install friction, and is part of a mature framework. The AGPL-3.0-or-later license is a consideration for proprietary projects but is standard for open-source security tools. No known vulnerabilities.

## Install

pip install dissect-ntfs
uv add dissect-ntfs
poetry add dissect-ntfs

## Installing dissect.ntfs

Before you install: Low friction installation as a pure-Python wheel with only two lightweight Dissect framework dependencies (dissect.cstruct and dissect.util). Actively maintained with recent commits and stable production status.

License in practice: Licensed under AGPL-3.0-or-later, which requires that any modifications or derivative works using this package must also be released under AGPL-3.0 or a compatible later version. This is a strong copyleft license suitable for open-source projects but may restrict commercial or proprietary use.

Quickstart:

pip install dissect.ntfs

from dissect.ntfs import NTFS

with open('/path/to/ntfs/image', 'rb') as f:
    ntfs = NTFS(f)
    # Access NTFS structures and data

Requires Python 3.10 or later; intended for use with NTFS file system images or volumes.

Verify before relying:

- Specific NTFS features or versions supported (e.g., NTFS 3.1, compression, encryption handling)
- Performance characteristics when parsing large or fragmented NTFS volumes
- Compatibility with NTFS variants (exFAT, ReFS) or edge cases

## Package facts

- License: AGPL-3.0-or-later (agpl)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 86.1K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

ntfs file system parser, read ntfs volumes, windows filesystem analysis, ntfs forensics, ntfs structure parsing, dissect ntfs module, ntfs data extraction, forensics, ntfs-parser, incident-response

[View on SkillFed](https://skillfed.io/packages/dissect-ntfs) · [View on PyPI](https://pypi.org/project/dissect-ntfs/)