added simple boot sector analyzer

fishy/ntfs/ntfs_boot.py

@@ -0,0 +1,81 @@
+"""
+interface for ntfs boot sector
+"""
+import os
+import hashlib
+
+class NTFSMeta:
+    """ class to analyze and scan boot sector of ntfs systems.
+    """
+    def __init__(self, stream):
+        """ init: open ntfs image
+            file: saves file name
+        """
+        self.stream = stream
+        if os.path.isfile(self.stream):
+            print("ok")
+            # test.is_ntfs() TODO is this needed?
+        else:
+            print("file does not exist.")
+
+    def is_altered(self):
+        """ is_altered:
+            compare boot sector with the backup boot sector (via hash values)
+            true: the sector was altered
+            false: the sector was not altered
+        """
+        offset = 512 # sector size TODO needs to be determined dynamically
+        try:
+            # open file
+            file = open(self.stream, "rb")
+            data = file.read(offset)
+            # create hash value for boot sector
+            hash_boot = hashlib.sha256()
+            hash_boot.update(data)
+            # determine file size
+            statinfo = os.stat(self.stream)
+            # skip to last partition (backup boot sector)
+            file.seek(statinfo.st_size - offset)
+            backup = file.read(offset)
+            # create hash value for backup boot sector
+            hash_back = hashlib.sha256()
+            hash_back.update(backup)
+            # compare hash values
+            if hash_boot.hexdigest() == hash_back.hexdigest():
+                # nothing to do here
+                print("boot sector was not compromised.")
+                return False
+            else:
+                # compromised, further action required
+                print("boot sector was compromised.")
+                return True
+        except IOError:
+            return 0
+        finally:
+            file.close()
+
+    def scan_boot_sector(self):
+        """ scan_boot_sector: scans the boot sector for hidden data
+        """
+        with open(self.stream, "rb") as file:
+            offset = 512
+            # 	file.seek(0) jump to start of file needed?
+            pos = file.tell()
+            current_pos = 0
+            last = os.stat(self.stream).st_size - offset
+            while current_pos < offset:
+                # switch cursor between current position at boot & backup sector
+                file.seek(pos + current_pos)
+                boot_c = file.read(1)
+                file.seek(last + current_pos)
+                back_c = file.read(1)
+                if not boot_c:
+                    print("End of file")
+                    break
+                if boot_c != back_c:
+                    # do something
+                    print(boot_c)
+                current_pos = current_pos + 1
+            file.seek(pos)
+            file.close()
+