Source code for dfvfs.analyzer.tsk_partition_analyzer_helper

# -*- coding: utf-8 -*-
"""The SleuthKit (TSK) partition format analyzer helper implementation."""

import pytsk3

from dfvfs.analyzer import analyzer
from dfvfs.analyzer import analyzer_helper
from dfvfs.lib import definitions
from dfvfs.lib import tsk_image


[docs] class TSKPartitionAnalyzerHelper(analyzer_helper.AnalyzerHelper): """TSK partition analyzer helper.""" FORMAT_CATEGORIES = frozenset([ definitions.FORMAT_CATEGORY_VOLUME_SYSTEM]) TYPE_INDICATOR = definitions.TYPE_INDICATOR_TSK_PARTITION
[docs] def AnalyzeFileObject(self, file_object): """Retrieves the format specification. Args: file_object (FileIO): file-like object. Returns: str: type indicator if the file-like object contains a supported format or None otherwise. """ tsk_image_object = tsk_image.TSKFileSystemImage(file_object) try: pytsk3.Volume_Info(tsk_image_object) except IOError: return None return self.type_indicator
analyzer.Analyzer.RegisterHelper(TSKPartitionAnalyzerHelper())