Add birthtime, blocksize and blks to stat_output for NTFSFilesystemEntry

[Miauwkeru]

st_block is 0 when the file is resident, as it inside the MFT metadata
st_birthtime and st_birthtime_ns now use the creation_time from a MFT Record

Other timestamps where incorrectly used, and have been changed:

st_mtime: changed from using last_change_time to last_modification_time
st_ctime: changed from using creation_time to last_change_time

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 75.59%. Comparing base (c5bf1ed) to head (8fd94c0).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #848   +/-   ##
=======================================
  Coverage   75.59%   75.59%           
=======================================
  Files         311      311           
  Lines       26561    26569    +8     
=======================================
+ Hits        20078    20086    +8     
  Misses       6483     6483           

Flag	Coverage Δ
unittests	75.59% <100.00%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[Schamper]

[Miauwkeru]

dissect.target/dissect/target/helpers/fsutil.py

Line 131 in c5bf1ed

"_st_ctime": "integer time of last change",

So what do we want to use, the windows style or unix style? Cause I'd prefer them to be consistent across dissect. Regardless what the python docs say. As we change it anyways

[Schamper]

The entire filesystem layer is designed to be consistent with Python since the beginning of Dissect.

[Miauwkeru]

The entire filesystem layer is designed to be consistent with Python since the beginning of Dissect.

In that case, have we changed that for any other filesystem then? Where the c_time gets used for the birth timestamp on the machine? Or should we adapt the btrfs stuff too when using windows?

Cause in this current case it seems to only hold for ntfs doesn't it?

[Schamper]

https://github.com/python/cpython/blob/3.12/Modules/posixmodule.c#L2142-L2145
https://docs.python.org/3/library/os.html#os.DirEntry.stat (deprecation note)

The only thing missing currently is setting st_birthtime and st_birthtime_ns to their proper values on Windows filesystems (read, NTFS).

Btrfs and other filesystems don't have this, as they actually properly expose all 4 timestamps.

[Miauwkeru]

https://github.com/python/cpython/blob/3.12/Modules/posixmodule.c#L2142-L2145 https://docs.python.org/3/library/os.html#os.DirEntry.stat (deprecation note)

The only thing missing currently is setting st_birthtime and st_birthtime_ns to their proper values on Windows filesystems (read, NTFS).

Btrfs and other filesystems don't have this, as they actually properly expose all 4 timestamps.

st_birthtime gets set here right?: https://github.com/python/cpython/blob/aee219f4558dda619bd86e4b0e028ce47a5e4b77/Python/fileutils.c#L1122

where ctime gets changed afterwards at the posixmodule sets it to the value in st_birthtime, which is only used for backwards compatibility.

So sure, I'll set the ctime to birthtime for now. And make a note about it for backwards compatibility

[Schamper]

st_birthtime gets set here right?: https://github.com/python/cpython/blob/aee219f4558dda619bd86e4b0e028ce47a5e4b77/Python/fileutils.c#L1122

In our code.

[Miauwkeru]

st_birthtime gets set here right?: https://github.com/python/cpython/blob/aee219f4558dda619bd86e4b0e028ce47a5e4b77/Python/fileutils.c#L1122

In our code.

which I've done?