Source code for dfvfs.analyzer.ewf_analyzer_helper

# -*- coding: utf-8 -*-
"""The EWF format analyzer helper implementation."""

from dfvfs.analyzer import analyzer
from dfvfs.analyzer import analyzer_helper
from dfvfs.analyzer import specification
from dfvfs.lib import definitions


[docs] class EWFAnalyzerHelper(analyzer_helper.AnalyzerHelper): """EWF analyzer helper.""" FORMAT_CATEGORIES = frozenset([ definitions.FORMAT_CATEGORY_ARCHIVE, definitions.FORMAT_CATEGORY_STORAGE_MEDIA_IMAGE]) TYPE_INDICATOR = definitions.TYPE_INDICATOR_EWF
[docs] def GetFormatSpecification(self): """Retrieves the format specification. Returns: FormatSpecification: format specification or None if the format cannot be defined by a specification object. """ format_specification = specification.FormatSpecification( self.type_indicator) # EWF version 1 signature and start of fields. format_specification.AddNewSignature( b'EVF\x09\x0d\x0a\xff\x00\x01', offset=0) # EWF version 2 signature and major version. format_specification.AddNewSignature(b'EVF2\r\n\x81\x00\x02', offset=0) return format_specification
analyzer.Analyzer.RegisterHelper(EWFAnalyzerHelper())