Source code for dfvfs.analyzer.ewf_analyzer_helper
# -*- coding: utf-8 -*-
"""The EWF format analyzer helper implementation."""
from dfvfs.analyzer import analyzer
from dfvfs.analyzer import analyzer_helper
from dfvfs.analyzer import specification
from dfvfs.lib import definitions
[docs]
class EWFAnalyzerHelper(analyzer_helper.AnalyzerHelper):
"""EWF analyzer helper."""
FORMAT_CATEGORIES = frozenset([
definitions.FORMAT_CATEGORY_ARCHIVE,
definitions.FORMAT_CATEGORY_STORAGE_MEDIA_IMAGE])
TYPE_INDICATOR = definitions.TYPE_INDICATOR_EWF
[docs]
def GetFormatSpecification(self):
"""Retrieves the format specification.
Returns:
FormatSpecification: format specification or None if the format cannot
be defined by a specification object.
"""
format_specification = specification.FormatSpecification(
self.type_indicator)
# EWF version 1 signature and start of fields.
format_specification.AddNewSignature(
b'EVF\x09\x0d\x0a\xff\x00\x01', offset=0)
# EWF version 2 signature and major version.
format_specification.AddNewSignature(b'EVF2\r\n\x81\x00\x02', offset=0)
return format_specification
analyzer.Analyzer.RegisterHelper(EWFAnalyzerHelper())