"""The Volume Shadow Snapshots (VSS) volume system."""
from dfvfs.lib import definitions
from dfvfs.volume import factory
from dfvfs.volume import volume_system
[docs]
class VShadowVolume(volume_system.Volume):
"""Volume that uses pyvshadow."""
[docs]
def __init__(self, file_entry):
"""Initializes a volume.
Args:
file_entry (VShadowFileEntry): a VSS file entry.
"""
super().__init__(file_entry.name)
self._file_entry = file_entry
def _Parse(self):
"""Extracts attributes and extents from the volume."""
vshadow_store = self._file_entry.GetVShadowStore()
self._AddAttribute(
volume_system.VolumeAttribute("identifier", vshadow_store.identifier)
)
self._AddAttribute(
volume_system.VolumeAttribute(
"copy_identifier", vshadow_store.copy_identifier
)
)
self._AddAttribute(
volume_system.VolumeAttribute(
"copy_set_identifier", vshadow_store.copy_set_identifier
)
)
self._AddAttribute(
volume_system.VolumeAttribute(
"creation_time", vshadow_store.get_creation_time_as_integer()
)
)
volume_extent = volume_system.VolumeExtent(0, vshadow_store.volume_size)
self._extents.append(volume_extent)
[docs]
def HasExternalData(self):
"""Determines if the volume has external stored data.
Returns:
bool: True if the volume has external stored data.
"""
vshadow_store = self._file_entry.GetVShadowStore()
return not vshadow_store.has_in_volume_data()
[docs]
class VShadowVolumeSystem(volume_system.VolumeSystem):
"""Volume system that uses pyvshadow."""
TYPE_INDICATOR = definitions.TYPE_INDICATOR_VSHADOW
VOLUME_IDENTIFIER_PREFIX = "vss"
def _Parse(self):
"""Extracts sections and volumes from the volume system."""
root_file_entry = self._file_system.GetRootFileEntry()
for sub_file_entry in root_file_entry.sub_file_entries:
volume = VShadowVolume(sub_file_entry)
self._AddVolume(volume)
factory.Factory.RegisterVolumeSystem(VShadowVolumeSystem)