Improve NTFS support

[joachimmetz]

• [x] Add ADS stream support
  • Requires dfVFS update: https://codereview.appspot.com/235930043/
• [x] Handle metadata files in special ways
  • Initial changes
• [x] Create a $MFT metadata file parser
  • Initial version
• [x] Distributed link tracking support
  • LNK
  • NTFS $MFT
• [x] Create a $UsnJrnl:$J metadata file parser
  • add support to libfsntfs an pyfsntfs
  • add plaso parser
  • create test image with USN journal, see http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/fsutil_usn.mspx?mfr=true
• [x] $MFT parser add "full path hints"
• [x] make libfsntfs the default
  • have end-to-end comparison testing
• [ ] Parse attributes
  • Requires dfVFS update: https://codereview.appspot.com/264170043
  • Change file stat to handle attributes
• [ ] Parse security descriptors
• [ ] Parse $I30 streams
  • Related: Timestamps from deleted files
• [ ] Parse $Logfile
  • use libfsntfs
  • needs more research
• [ ] Distributed link tracking support
  • NTFS file stat
• [ ] Aftercare
  • split off file entry functionality of parser mediator
  • change 'fs:stat:ntfs' into 'fs:ntfs:stat'
• [ ] parsing of stand-alone USN change journal
  • will need some container format to handle sparse data runs

[joachimmetz]

1.4 release items finished, moving to 1.5

[joachimmetz]

bumped milestone this will require more work

[Onager]

Not going to make release, removing milestone.

Please do not re-assign to a milestone until this issue has been cleaned up.

[MariasStory]

What about the "full path hints"?

[Onager]

Please do not re-assign to a milestone until this issue has been cleaned up.