dfvfs.file_io package

Submodules

dfvfs.file_io.apfs_file_io module

The Apple File System (APFS) file-like object implementation.

class dfvfs.file_io.apfs_file_io.APFSFile(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object using pyfsapfs.file_entry

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset into the file-like object.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.bde_file_io module

The BitLocker Drive Encryption (BDE) file-like object.

class dfvfs.file_io.bde_file_io.BDEFile(resolver_context, path_spec)

Bases: FileObjectIO

File input/output (IO) object using pybde.

property is_locked

True if the volume is locked.

Type

bool

dfvfs.file_io.compressed_stream_io module

The compressed stream file-like object implementation.

class dfvfs.file_io.compressed_stream_io.CompressedStream(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object of a compressed stream.

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset in the uncompressed stream.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the uncompressed stream.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.cpio_file_io module

The CPIO extracted file-like object implementation.

class dfvfs.file_io.cpio_file_io.CPIOFile(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object using CPIOArchiveFile.

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset in the CPIO archived file.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the CPIO archived file.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.cs_file_io module

The Core Storage (CS) file-like object.

class dfvfs.file_io.cs_file_io.CSFile(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object using pyfvde.

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset into the file-like object.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

property is_locked

True if the volume is locked.

Type

bool

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.data_range_io module

The data range file-like object.

class dfvfs.file_io.data_range_io.DataRange(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object that maps an in-file data range.

The data range object allows to expose a single partition within a full disk image as a separate file-like object by mapping the data range (offset and size) of the volume on top of the full disk image.

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset in the data range.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the data range.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.encoded_stream_io module

The encoded stream file-like object implementation.

class dfvfs.file_io.encoded_stream_io.EncodedStream(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object of a encoded stream.

SetDecodedStreamSize(decoded_stream_size)

Sets the decoded stream size.

This function is used to set the decoded stream size if it can be determined separately.

Parameters

decoded_stream_size (int) – size of the decoded stream in bytes.

Raises

• IOError – if the file-like object is already open.

• OSError – if the file-like object is already open.

• ValueError – if the decoded stream size is invalid.

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset in the decoded stream.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the decoded stream.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.encrypted_stream_io module

The encrypted stream file-like object implementation.

class dfvfs.file_io.encrypted_stream_io.EncryptedStream(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object of a encrypted stream.

SetDecryptedStreamSize(decrypted_stream_size)

Sets the decrypted stream size.

This function is used to set the decrypted stream size if it can be determined separately.

Parameters

decrypted_stream_size (int) – size of the decrypted stream in bytes.

Raises

• IOError – if the file-like object is already open.

• OSError – if the file-like object is already open.

• ValueError – if the decrypted stream size is invalid.

get_offset()

Retrieves the current offset into the decrypted stream.

Returns

current offset into the decrypted stream.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the decrypted stream.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek.

• whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.ewf_file_io module

The EWF image file-like object.

class dfvfs.file_io.ewf_file_io.EWFFile(resolver_context, path_spec)

Bases: FileObjectIO

File input/output (IO) object using pyewf.

get_size()

Retrieves the size of the file-like object.

Returns

size of the RAW storage media image inside the EWF container.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

dfvfs.file_io.ext_file_io module

The Extended File System (EXT) file-like object implementation.

class dfvfs.file_io.ext_file_io.EXTFile(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object using pyfsext.file_entry

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset into the file-like object.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.fake_file_io module

The fake file-like object implementation.

class dfvfs.file_io.fake_file_io.FakeFile(resolver_context, path_spec, file_data)

Bases: FileIO

Fake file input/output (IO) object.

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset into the file-like object.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.fat_file_io module

The File Allocation Table (FAT) file-like object implementation.

class dfvfs.file_io.fat_file_io.FATFile(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object using pyfsfat.file_entry

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset into the file-like object.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.file_io module

The Virtual File System (VFS) file input/output (IO) object interface.

class dfvfs.file_io.file_io.FileIO(resolver_context, path_spec)

Bases: object

VFS file input/output (IO) object interface.

Open(path_spec=None, mode='rb')

Opens the file input/output (IO) object defined by path specification.

Parameters

• path_spec (Optional[PathSpec]) – path specification.

• mode (Optional[str]) – file access mode.

Raises

• AccessError – if the access to open the file was denied.

• IOError – if the file input/output (IO) object was already opened or the open failed.

• OSError – if the file input/output (IO) object was already opened or the open failed.

• PathSpecError – if the path specification is incorrect.

• ValueError – if the path specification or mode is invalid.

__del__()

Cleans up the file input/output (IO) object.

abstract get_offset()

Retrieves the current offset into the file input/output (IO) object.

Returns

current offset into the file input/output (IO) object.

Return type

int

Raises

• IOError – if the file input/output (IO)-like object has not been opened.

• OSError – if the file input/output (IO)-like object has not been opened.

abstract get_size()

Retrieves the size of the file input/output (IO) object.

Returns

size of the file input/output (IO) object.

Return type

int

Raises

• IOError – if the file input/output (IO) object has not been opened.

• OSError – if the file input/output (IO) object has not been opened.

abstract read(size=None)

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

abstract seek(offset, whence=0)

Seeks to an offset within the file input/output (IO) object.

Parameters

• offset (int) – offset to seek.

• whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

seekable()

Determines if a file input/output (IO) object is seekable.

Returns

True since a file IO object provides a seek method.

Return type

bool

tell()

Retrieves the current offset into the file input/output (IO) object.

dfvfs.file_io.file_object_io module

The file object file input/output (IO) object implementation.

class dfvfs.file_io.file_object_io.FileObjectIO(resolver_context, path_spec)

Bases: FileIO

Base class for file object-based file input/output (IO) object.

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset into the file-like object.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.gpt_file_io module

The GUID Partition Table (GPT) file-like object implementation.

class dfvfs.file_io.gpt_file_io.GPTFile(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object using pyvsgpt.

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset in the partition.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the partition.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.gzip_file_io module

The gzip file-like object.

class dfvfs.file_io.gzip_file_io.GzipFile(resolver_context, path_spec)

Bases: FileObjectIO

File input/output (IO) object of a gzip file.

property comments

comments in the gzip file.

Type

list(str)

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

property modification_times

modification times stored in the gzip file.

Type

list(int)

property operating_systems

operating system values stored in the gzip file.

Type

list(int)

property original_filenames

original filenames stored in the gzip file.

Type

list(str)

property uncompressed_data_size

uncompressed data size.

Type

int

dfvfs.file_io.hfs_file_io module

The Hierarchical File System (HFS) file-like object implementation.

class dfvfs.file_io.hfs_file_io.HFSFile(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object using pyfshfs.file_entry

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset into the file-like object.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.luksde_file_io module

The LUKS Drive Encryption file-like object.

class dfvfs.file_io.luksde_file_io.LUKSDEFile(resolver_context, path_spec)

Bases: FileObjectIO

File input/output (IO) object using pyluksde.

property is_locked

True if the volume is locked.

Type

bool

dfvfs.file_io.lvm_file_io module

The Logical Volume Manager (LVM) file-like object implementation.

class dfvfs.file_io.lvm_file_io.LVMFile(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object using pyvslvm.

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset into the file-like object.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.modi_file_io module

The Mac OS disk image file-like object.

class dfvfs.file_io.modi_file_io.MODIFile(resolver_context, path_spec)

Bases: FileObjectIO

File input/output (IO) object using pymodi.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

dfvfs.file_io.ntfs_file_io module

The NTFS file-like object implementation.

class dfvfs.file_io.ntfs_file_io.NTFSFile(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object using pyfsntfs.

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset into the file-like object.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.os_file_io module

The operating system file-like object implementation.

class dfvfs.file_io.os_file_io.OSFile(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object that uses the operating system.

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset into the file-like object.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.phdi_file_io module

The PHDI image file-like object.

class dfvfs.file_io.phdi_file_io.PHDIFile(resolver_context, path_spec)

Bases: FileObjectIO

File input/output (IO) object using pyphdi.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

dfvfs.file_io.qcow_file_io module

The QCOW image file-like object.

class dfvfs.file_io.qcow_file_io.QCOWFile(resolver_context, path_spec)

Bases: FileObjectIO

File input/output (IO) object using pyqcow.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

dfvfs.file_io.raw_file_io module

The RAW storage media image file-like object implementation.

class dfvfs.file_io.raw_file_io.RawFile(resolver_context, path_spec)

Bases: FileObjectIO

File input/output (IO) object using pysmraw.

get_size()

Retrieves the size of the file-like object.

Returns

size of the RAW storage media image.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

dfvfs.file_io.sqlite_blob_file_io module

The SQlite blob file-like object.

class dfvfs.file_io.sqlite_blob_file_io.SQLiteBlobFile(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object using sqlite.

GetNumberOfRows()

Retrieves the number of rows of the table.

Returns

number of rows.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset into the file-like object.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.tar_file_io module

The TAR extracted file-like object implementation.

class dfvfs.file_io.tar_file_io.TARFile(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object using tarfile.

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset into the file-like object.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.tsk_file_io module

The SleuthKit (TSK) file-like object implementation.

class dfvfs.file_io.tsk_file_io.TSKFile(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object using pytsk3.

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset into the file-like object.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.tsk_partition_file_io module

The SleuthKit (TSK) partition file-like object implementation.

class dfvfs.file_io.tsk_partition_file_io.TSKPartitionFile(resolver_context, path_spec)

Bases: DataRange

File input/output (IO) object using pytsk3.

dfvfs.file_io.vhdi_file_io module

The Virtual Hard Disk image file-like object.

class dfvfs.file_io.vhdi_file_io.VHDIFile(resolver_context, path_spec)

Bases: FileObjectIO

File input/output (IO) object using pyvhdi.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

dfvfs.file_io.vmdk_file_io module

The VMDK image file-like object.

class dfvfs.file_io.vmdk_file_io.VMDKFile(resolver_context, path_spec)

Bases: FileObjectIO

File input/output (IO) object using pyvmdk.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

dfvfs.file_io.vshadow_file_io module

The Volume Shadow Snapshots (VSS) file-like object implementation.

class dfvfs.file_io.vshadow_file_io.VShadowFile(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object using pyvshadow.

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset into the file-like object.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.xfs_file_io module

The X File System (XFS) file-like object implementation.

class dfvfs.file_io.xfs_file_io.XFSFile(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object using pyfsxfs.file_entry

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset into the file-like object.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

dfvfs.file_io.zip_file_io module

The ZIP extracted file-like object implementation.

class dfvfs.file_io.zip_file_io.ZipFile(resolver_context, path_spec)

Bases: FileIO

File input/output (IO) object using zipfile.

get_offset()

Retrieves the current offset into the file-like object.

Returns

current offset into the file-like object.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

get_size()

Retrieves the size of the file-like object.

Returns

size of the file-like object data.

Return type

int

Raises

• IOError – if the file-like object has not been opened.

• OSError – if the file-like object has not been opened.

read(size=None)

Reads a byte string from the file-like object at the current offset.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

• IOError – if the read failed.

• OSError – if the read failed.

seek(offset, whence=0)

Seeks to an offset within the file-like object.

Parameters

• offset (int) – offset to seek to.

• whence (Optional(int)) – value that indicates whether offset is an absolute or relative position within the file.

Raises

• IOError – if the seek failed.

• OSError – if the seek failed.

Module contents