dfvfs.file_io package

Submodules

dfvfs.file_io.apfs_file_io module

The Apple File System (APFS) file-like object implementation.

class dfvfs.file_io.apfs_file_io.APFSFile(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object using pyfsapfs.file_entry.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset into the file-like object.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.apm_file_io module

The Apple Partition Map (APM) file-like object implementation.

class dfvfs.file_io.apm_file_io.APMFile(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object using pyvsapm.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset in the partition.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the partition.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.bde_file_io module

The BitLocker Drive Encryption (BDE) file-like object.

class dfvfs.file_io.bde_file_io.BDEFile(resolver_context, path_spec)[source]

Bases: FileObjectIO

File input/output (IO) object using pybde.

property is_locked

True if the volume is locked.

Type:

bool

dfvfs.file_io.compressed_stream_io module

The compressed stream file-like object implementation.

class dfvfs.file_io.compressed_stream_io.CompressedStream(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object of a compressed stream.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset in the uncompressed stream.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the uncompressed stream.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.cpio_file_io module

The CPIO extracted file-like object implementation.

class dfvfs.file_io.cpio_file_io.CPIOFile(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object using CPIOArchiveFile.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset in the CPIO archived file.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the CPIO archived file.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.cs_file_io module

The Core Storage (CS) file-like object.

class dfvfs.file_io.cs_file_io.CSFile(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object using pyfvde.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset into the file-like object.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

property is_locked

True if the volume is locked.

Type:

bool

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.data_range_io module

The data range file-like object.

class dfvfs.file_io.data_range_io.DataRange(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object that maps an in-file data range.

The data range object allows to expose a single partition within a full disk image as a separate file-like object by mapping the data range (offset and size) of the volume on top of the full disk image.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset in the data range.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the data range.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.encoded_stream_io module

The encoded stream file-like object implementation.

class dfvfs.file_io.encoded_stream_io.EncodedStream(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object of a encoded stream.

SetDecodedStreamSize(decoded_stream_size)[source]

Sets the decoded stream size.

This function is used to set the decoded stream size if it can be determined separately.

Parameters:

decoded_stream_size (int) – size of the decoded stream in bytes.

Raises:
  • IOError – if the file-like object is already open.

  • OSError – if the file-like object is already open.

  • ValueError – if the decoded stream size is invalid.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset in the decoded stream.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the decoded stream.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.encrypted_stream_io module

The encrypted stream file-like object implementation.

class dfvfs.file_io.encrypted_stream_io.EncryptedStream(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object of a encrypted stream.

SetDecryptedStreamSize(decrypted_stream_size)[source]

Sets the decrypted stream size.

This function is used to set the decrypted stream size if it can be determined separately.

Parameters:

decrypted_stream_size (int) – size of the decrypted stream in bytes.

Raises:
  • IOError – if the file-like object is already open.

  • OSError – if the file-like object is already open.

  • ValueError – if the decrypted stream size is invalid.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the decrypted stream.

Returns:

current offset into the decrypted stream.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the decrypted stream.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek.

  • whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.ewf_file_io module

The EWF image file-like object.

class dfvfs.file_io.ewf_file_io.EWFFile(resolver_context, path_spec)[source]

Bases: FileObjectIO

File input/output (IO) object using pyewf.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the RAW storage media image inside the EWF container.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

dfvfs.file_io.ext_file_io module

The Extended File System (EXT) file-like object implementation.

class dfvfs.file_io.ext_file_io.EXTFile(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object using pyfsext.file_entry.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset into the file-like object.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.fake_file_io module

The fake file-like object implementation.

class dfvfs.file_io.fake_file_io.FakeFile(resolver_context, path_spec, file_data)[source]

Bases: FileIO

Fake file input/output (IO) object.

__init__(resolver_context, path_spec, file_data)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

  • file_data (bytes) – fake file data.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset into the file-like object.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.fat_file_io module

The File Allocation Table (FAT) file-like object implementation.

class dfvfs.file_io.fat_file_io.FATFile(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object using pyfsfat.file_entry.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset into the file-like object.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.file_io module

The Virtual File System (VFS) file input/output (IO) object interface.

class dfvfs.file_io.file_io.FileIO(resolver_context, path_spec)[source]

Bases: object

VFS file input/output (IO) object interface.

Open(path_spec=None, mode='rb')[source]

Opens the file input/output (IO) object defined by path specification.

Parameters:
  • path_spec (Optional[PathSpec]) – path specification.

  • mode (Optional[str]) – file access mode.

Raises:
  • AccessError – if the access to open the file was denied.

  • IOError – if the file input/output (IO) object was already opened or the open failed.

  • OSError – if the file input/output (IO) object was already opened or the open failed.

  • PathSpecError – if the path specification is incorrect.

  • ValueError – if the path specification or mode is invalid.

__del__()[source]

Cleans up the file input/output (IO) object.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

close()[source]

Closes the file input/output (IO) object.

Note that this function is a place holder for the file-like object interface.

abstract get_offset()[source]

Retrieves the current offset into the file input/output (IO) object.

Returns:

current offset into the file input/output (IO) object.

Return type:

int

Raises:
  • IOError – if the file input/output (IO)-like object has not been opened.

  • OSError – if the file input/output (IO)-like object has not been opened.

abstract get_size()[source]

Retrieves the size of the file input/output (IO) object.

Returns:

size of the file input/output (IO) object.

Return type:

int

Raises:
  • IOError – if the file input/output (IO) object has not been opened.

  • OSError – if the file input/output (IO) object has not been opened.

abstract read(size=None)[source]

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

abstract seek(offset, whence=0)[source]

Seeks to an offset within the file input/output (IO) object.

Parameters:
  • offset (int) – offset to seek.

  • whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

seekable()[source]

Determines if a file input/output (IO) object is seekable.

Returns:

True since a file IO object provides a seek method.

Return type:

bool

tell()[source]

Retrieves the current offset into the file input/output (IO) object.

dfvfs.file_io.file_object_io module

The file object file input/output (IO) object implementation.

class dfvfs.file_io.file_object_io.FileObjectIO(resolver_context, path_spec)[source]

Bases: FileIO

Base class for file object-based file input/output (IO) object.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset into the file-like object.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.gpt_file_io module

The GUID Partition Table (GPT) file-like object implementation.

class dfvfs.file_io.gpt_file_io.GPTFile(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object using pyvsgpt.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset in the partition.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the partition.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.gzip_file_io module

The gzip file-like object.

class dfvfs.file_io.gzip_file_io.GzipFile(resolver_context, path_spec)[source]

Bases: FileObjectIO

File input/output (IO) object of a gzip file.

property comments

Retrieves the comments.

Returns:

comments of the members.

Return type:

list[str]

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

property modification_times

Retrieves the modification times.

Returns:

modification times of the members.

Return type:

list[str]

property operating_systems

Retrieves the operating system values.

Returns:

operating system values of the members.

Return type:

list[str]

property original_filenames

Retrieves the original filenames.

Returns:

original filenames of the members.

Return type:

list[str]

property uncompressed_data_size

Retrieves the uncompressed data size.

Returns:

uncompressed data size.

Return type:

int

dfvfs.file_io.hfs_file_io module

The Hierarchical File System (HFS) file-like object implementation.

class dfvfs.file_io.hfs_file_io.HFSFile(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object using pyfshfs.file_entry.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset into the file-like object.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.luksde_file_io module

The LUKS Drive Encryption file-like object.

class dfvfs.file_io.luksde_file_io.LUKSDEFile(resolver_context, path_spec)[source]

Bases: FileObjectIO

File input/output (IO) object using pyluksde.

property is_locked

True if the volume is locked.

Type:

bool

dfvfs.file_io.lvm_file_io module

The Logical Volume Manager (LVM) file-like object implementation.

class dfvfs.file_io.lvm_file_io.LVMFile(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object using pyvslvm.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset into the file-like object.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.modi_file_io module

The Mac OS disk image file-like object.

class dfvfs.file_io.modi_file_io.MODIFile(resolver_context, path_spec)[source]

Bases: FileObjectIO

File input/output (IO) object using pymodi.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

dfvfs.file_io.ntfs_file_io module

The NTFS file-like object implementation.

class dfvfs.file_io.ntfs_file_io.NTFSFile(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object using pyfsntfs.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset into the file-like object.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.os_file_io module

The operating system file-like object implementation.

class dfvfs.file_io.os_file_io.OSFile(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object that uses the operating system.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset into the file-like object.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.phdi_file_io module

The PHDI image file-like object.

class dfvfs.file_io.phdi_file_io.PHDIFile(resolver_context, path_spec)[source]

Bases: FileObjectIO

File input/output (IO) object using pyphdi.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

dfvfs.file_io.qcow_file_io module

The QCOW image file-like object.

class dfvfs.file_io.qcow_file_io.QCOWFile(resolver_context, path_spec)[source]

Bases: FileObjectIO

File input/output (IO) object using pyqcow.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

dfvfs.file_io.raw_file_io module

The RAW storage media image file-like object implementation.

class dfvfs.file_io.raw_file_io.RawFile(resolver_context, path_spec)[source]

Bases: FileObjectIO

File input/output (IO) object using pysmraw.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the RAW storage media image.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

dfvfs.file_io.sqlite_blob_file_io module

The SQlite blob file-like object.

class dfvfs.file_io.sqlite_blob_file_io.SQLiteBlobFile(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object using sqlite.

GetNumberOfRows()[source]

Retrieves the number of rows of the table.

Returns:

number of rows.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

__init__(resolver_context, path_spec)[source]

Initializes the file-like object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset into the file-like object.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.tar_file_io module

The TAR extracted file-like object implementation.

class dfvfs.file_io.tar_file_io.TARFile(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object using tarfile.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset into the file-like object.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.tsk_file_io module

The SleuthKit (TSK) file-like object implementation.

class dfvfs.file_io.tsk_file_io.TSKFile(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object using pytsk3.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset into the file-like object.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.tsk_partition_file_io module

The SleuthKit (TSK) partition file-like object implementation.

class dfvfs.file_io.tsk_partition_file_io.TSKPartitionFile(resolver_context, path_spec)[source]

Bases: DataRange

File input/output (IO) object using pytsk3.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

dfvfs.file_io.vhdi_file_io module

The Virtual Hard Disk image file-like object.

class dfvfs.file_io.vhdi_file_io.VHDIFile(resolver_context, path_spec)[source]

Bases: FileObjectIO

File input/output (IO) object using pyvhdi.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

dfvfs.file_io.vmdk_file_io module

The VMDK image file-like object.

class dfvfs.file_io.vmdk_file_io.VMDKFile(resolver_context, path_spec)[source]

Bases: FileObjectIO

File input/output (IO) object using pyvmdk.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

dfvfs.file_io.vshadow_file_io module

The Volume Shadow Snapshots (VSS) file-like object implementation.

class dfvfs.file_io.vshadow_file_io.VShadowFile(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object using pyvshadow.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset into the file-like object.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.xfs_file_io module

The X File System (XFS) file-like object implementation.

class dfvfs.file_io.xfs_file_io.XFSFile(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object using pyfsxfs.file_entry.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset into the file-like object.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

dfvfs.file_io.zip_file_io module

The ZIP extracted file-like object implementation.

class dfvfs.file_io.zip_file_io.ZipFile(resolver_context, path_spec)[source]

Bases: FileIO

File input/output (IO) object using zipfile.

__init__(resolver_context, path_spec)[source]

Initializes a file input/output (IO) object.

Parameters:
  • resolver_context (Context) – resolver context.

  • path_spec (PathSpec) – a path specification.

get_offset()[source]

Retrieves the current offset into the file-like object.

Returns:

current offset into the file-like object.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

get_size()[source]

Retrieves the size of the file-like object.

Returns:

size of the file-like object data.

Return type:

int

Raises:
  • IOError – if the file-like object has not been opened.

  • OSError – if the file-like object has not been opened.

read(size=None)[source]

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns:

data read.

Return type:

bytes

Raises:
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file-like object.

Parameters:
  • offset (int) – offset to seek to.

  • whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises:
  • IOError – if the seek failed.

  • OSError – if the seek failed.

Module contents