dfvfs.path package
Submodules
dfvfs.path.apfs_container_path_spec module
The APFS container path specification implementation.
- class dfvfs.path.apfs_container_path_spec.APFSContainerPathSpec(location=None, parent=None, volume_index=None, **kwargs)[source]
Bases:
PathSpec
APFS container path specification implementation.
- location
location.
- Type
str
- volume_index
volume index.
- Type
int
- TYPE_INDICATOR = 'APFS_CONTAINER'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.apfs_path_spec module
The APFS path specification implementation.
- class dfvfs.path.apfs_path_spec.APFSPathSpec(identifier=None, location=None, parent=None, **kwargs)[source]
Bases:
PathSpec
APFS path specification implementation.
- identifier
identifier.
- Type
int
- location
location.
- Type
str
- TYPE_INDICATOR = 'APFS'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.apm_path_spec module
The Apple Partition Map (APM) path specification implementation.
- class dfvfs.path.apm_path_spec.APMPathSpec(location=None, entry_index=None, parent=None, **kwargs)[source]
Bases:
PathSpec
APM path specification.
- entry_index
partition entry index.
- Type
int
- location
location.
- Type
str
- TYPE_INDICATOR = 'APM'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.bde_path_spec module
The BitLocker Drive Encryption (BDE) path specification implementation.
- class dfvfs.path.bde_path_spec.BDEPathSpec(password=None, parent=None, recovery_password=None, startup_key=None, **kwargs)[source]
Bases:
PathSpec
BDE path specification.
- password
password.
- Type
str
- recovery_password
recovery password.
- Type
str
- startup_key
name of the startup key file.
- Type
str
- TYPE_INDICATOR = 'BDE'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.compressed_stream_path_spec module
The compressed stream path specification implementation.
- class dfvfs.path.compressed_stream_path_spec.CompressedStreamPathSpec(compression_method=None, parent=None, **kwargs)[source]
Bases:
PathSpec
Compressed stream path specification.
- compression_method
method used to the compress the data.
- Type
str
- TYPE_INDICATOR = 'COMPRESSED_STREAM'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.cpio_path_spec module
The CPIO path specification implementation.
- class dfvfs.path.cpio_path_spec.CPIOPathSpec(location=None, parent=None, **kwargs)[source]
Bases:
LocationPathSpec
CPIO file path specification.
- TYPE_INDICATOR = 'CPIO'
dfvfs.path.cs_path_spec module
The Core Storage (CS) path specification implementation.
- class dfvfs.path.cs_path_spec.CSPathSpec(encrypted_root_plist=None, location=None, password=None, parent=None, recovery_password=None, volume_index=None, **kwargs)[source]
Bases:
PathSpec
CS path specification.
- encrypted_root_plist
path to the EncryptedRoot.plist.wipekey file.
- Type
str
- location
location.
- Type
str
- password
password.
- Type
str
- recovery_password
recovery password.
- Type
str
- volume_index
logical volume index.
- Type
int
- TYPE_INDICATOR = 'CS'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.data_range_path_spec module
The data range path specification implementation.
- class dfvfs.path.data_range_path_spec.DataRangePathSpec(parent=None, range_offset=None, range_size=None, **kwargs)[source]
Bases:
PathSpec
Data range path specification.
- range_offset
start offset of the data range.
- Type
int
- range_size
size of the data range.
- Type
int
- TYPE_INDICATOR = 'DATA_RANGE'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.encoded_stream_path_spec module
The encoded stream path specification implementation.
- class dfvfs.path.encoded_stream_path_spec.EncodedStreamPathSpec(encoding_method=None, parent=None, **kwargs)[source]
Bases:
PathSpec
Encoded stream path specification.
- encoding_method
method used to the encode the data.
- Type
str
- TYPE_INDICATOR = 'ENCODED_STREAM'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.encrypted_stream_path_spec module
The encrypted stream path specification implementation.
- class dfvfs.path.encrypted_stream_path_spec.EncryptedStreamPathSpec(cipher_mode=None, encryption_method=None, initialization_vector=None, key=None, parent=None, **kwargs)[source]
Bases:
PathSpec
Encrypted stream path specification.
- cipher_mode
cipher mode.
- Type
str
- encryption_method
method used to the encrypt the data.
- Type
str
- initialization_vector
initialization vector.
- Type
bytes
- key
key.
- Type
bytes
- TYPE_INDICATOR = 'ENCRYPTED_STREAM'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.ewf_path_spec module
The EWF image path specification implementation.
dfvfs.path.ext_path_spec module
The EXT path specification implementation.
- class dfvfs.path.ext_path_spec.EXTPathSpec(inode=None, location=None, parent=None, **kwargs)[source]
Bases:
PathSpec
EXT path specification implementation.
- inode
inode.
- Type
int
- location
location.
- Type
str
- TYPE_INDICATOR = 'EXT'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.factory module
The path specification factory.
- class dfvfs.path.factory.Factory[source]
Bases:
object
Path specification factory.
- classmethod DeregisterPathSpec(path_spec_type)[source]
Deregisters a path specification type.
- Parameters
path_spec_type (type) – path specification type.
- Raises
KeyError – if path specification type is not registered.
- classmethod GetProperties(path_spec)[source]
Retrieves a dictionary containing the path specification properties.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
path specification properties.
- Return type
dict[str, str]
- Raises
dict – path specification properties.
- classmethod IsSystemLevelTypeIndicator(type_indicator)[source]
Determines if the type indicator is at system-level.
- Parameters
type_indicator (str) – type indicator.
- Returns
True if the type indicator is at system-level.
- Return type
bool
- classmethod NewPathSpec(type_indicator, **kwargs)[source]
Creates a new path specification for the specific type indicator.
- Parameters
type_indicator (str) – type indicator.
kwargs (dict) – keyword arguments depending on the path specification.
- Returns
path specification.
- Return type
- Raises
KeyError – if path specification is not registered.
- PROPERTY_NAMES = frozenset({'cipher_mode', 'column_name', 'compression_method', 'data_stream', 'encoding_method', 'encryption_method', 'identifier', 'initialization_vector', 'inode', 'key', 'location', 'mft_attribute', 'mft_entry', 'part_index', 'password', 'range_offset', 'range_size', 'recovery_password', 'row_condition', 'row_index', 'start_offset', 'startup_key', 'store_index', 'table_name', 'volume_index'})
dfvfs.path.fake_path_spec module
The fake path specification implementation.
- class dfvfs.path.fake_path_spec.FakePathSpec(location=None, **kwargs)[source]
Bases:
LocationPathSpec
Fake path specification.
- TYPE_INDICATOR = 'FAKE'
dfvfs.path.fat_path_spec module
The FAT path specification implementation.
- class dfvfs.path.fat_path_spec.FATPathSpec(identifier=None, location=None, parent=None, **kwargs)[source]
Bases:
PathSpec
FAT path specification implementation.
- identifier
(virtual) identifier.
- Type
int
- location
location.
- Type
str
- TYPE_INDICATOR = 'FAT'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.gpt_path_spec module
The GUID Partition Table (GPT) path specification implementation.
- class dfvfs.path.gpt_path_spec.GPTPathSpec(location=None, entry_index=None, parent=None, **kwargs)[source]
Bases:
PathSpec
GPT path specification.
- entry_index
partition entry index.
- Type
int
- location
location.
- Type
str
- TYPE_INDICATOR = 'GPT'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.gzip_path_spec module
The gzip file path specification implementation.
dfvfs.path.hfs_path_spec module
The HFS path specification implementation.
- class dfvfs.path.hfs_path_spec.HFSPathSpec(data_stream=None, identifier=None, location=None, parent=None, **kwargs)[source]
Bases:
PathSpec
HFS path specification implementation.
- data_stream
data stream name, where None indicates the default data stream.
- Type
str
- identifier
catalog node identifier (CNID).
- Type
int
- location
location.
- Type
str
- TYPE_INDICATOR = 'HFS'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.location_path_spec module
The location-based path specification implementation.
dfvfs.path.luksde_path_spec module
The LUKS Drive Encryption path specification implementation.
dfvfs.path.lvm_path_spec module
The Logical Volume Manager (LVM) path specification implementation.
- class dfvfs.path.lvm_path_spec.LVMPathSpec(location=None, parent=None, volume_index=None, **kwargs)[source]
Bases:
PathSpec
LVM path specification.
- location
location.
- Type
str
- volume_index
logical volume index.
- Type
int
- TYPE_INDICATOR = 'LVM'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.modi_path_spec module
The Mac OS disk image path specification implementation.
dfvfs.path.mount_path_spec module
The mount path specification implementation.
dfvfs.path.ntfs_path_spec module
The path NTFS specification implementation.
- class dfvfs.path.ntfs_path_spec.NTFSPathSpec(data_stream=None, location=None, mft_attribute=None, mft_entry=None, parent=None, **kwargs)[source]
Bases:
PathSpec
NTFS path specification.
- data_stream
data stream name, where None indicates the default data stream.
- Type
str
- location
location.
- Type
str
- mft_attribute
$FILE_NAME MFT attribute index, where the first attribute is indicated by 0.
- Type
int
- mft_entry
MFT entry, where the first entry is indicated by 0.
- Type
int
- TYPE_INDICATOR = 'NTFS'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.os_path_spec module
The operating system path specification implementation.
- class dfvfs.path.os_path_spec.OSPathSpec(location=None, **kwargs)[source]
Bases:
LocationPathSpec
Operating system path specification.
- TYPE_INDICATOR = 'OS'
dfvfs.path.path_spec module
The Virtual File System (VFS) path specification interface.
- class dfvfs.path.path_spec.PathSpec(parent=None, **kwargs)[source]
Bases:
object
Path specification interface.
- CopyToDict()[source]
Copies the path specification to a dictionary.
- Returns
path specification attributes.
- Return type
dict[str, object]
- HasParent()[source]
Determines if the path specification has a parent.
- Returns
True if the path specification has a parent.
- Return type
bool
- IsFileSystem()[source]
Determines if the path specification is a file system.
- Returns
True if the path specification is a file system.
- Return type
bool
- IsSystemLevel()[source]
Determines if the path specification is at system-level.
System-level is an indication used if the path specification is handled by the operating system and should not have a parent.
- Returns
True if the path specification is at system-level.
- Return type
bool
- IsVolumeSystem()[source]
Determines if the path specification is a volume system.
- Returns
True if the path specification is a volume system.
- Return type
bool
- IsVolumeSystemRoot()[source]
Determines if the path specification is the root of a volume system.
- Returns
True if the path specification is the root of a volume system.
- Return type
bool
- property comparable
comparable representation of the path specification.
- Type
str
- property type_indicator
type indicator.
- Type
str
dfvfs.path.phdi_path_spec module
The PHDI image path specification implementation.
dfvfs.path.qcow_path_spec module
The QCOW image path specification implementation.
dfvfs.path.raw_path_spec module
The RAW storage media image path specification implementation.
dfvfs.path.sqlite_blob_path_spec module
The SQLite blob path specification implementation.
- class dfvfs.path.sqlite_blob_path_spec.SQLiteBlobPathSpec(column_name=None, parent=None, row_condition=None, row_index=None, table_name=None, **kwargs)[source]
Bases:
PathSpec
SQLite blob file path specification.
- column_name
name of the column in which the blob is stored.
- Type
str
- row_condition
condition of the row in which the blob is stored. The condition is a tuple in the form: (column_name, operator, value). The condition must yield a single result.
- Type
tuple
- row_index
index of the row in which the blob is stored.
- Type
int
- table_name
name of the table in which the blob is stored.
- Type
str
- TYPE_INDICATOR = 'SQLITE_BLOB'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.tar_path_spec module
The TAR path specification implementation.
- class dfvfs.path.tar_path_spec.TARPathSpec(location=None, parent=None, **kwargs)[source]
Bases:
LocationPathSpec
TAR file path specification.
- TYPE_INDICATOR = 'TAR'
dfvfs.path.tsk_partition_path_spec module
The SleuthKit (TSK) partition path specification implementation.
- class dfvfs.path.tsk_partition_path_spec.TSKPartitionPathSpec(location=None, parent=None, part_index=None, start_offset=None, **kwargs)[source]
Bases:
PathSpec
SleuthKit (TSK) partition path specification.
- location
location.
- Type
str
- part_index
part index.
- Type
int
- start_offset
start offset.
- Type
int
- TYPE_INDICATOR = 'TSK_PARTITION'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.tsk_path_spec module
The SleuthKit (TSK) path specification implementation.
- class dfvfs.path.tsk_path_spec.TSKPathSpec(data_stream=None, inode=None, location=None, parent=None, **kwargs)[source]
Bases:
PathSpec
SleuthKit (TSK) path specification.
- data_stream
data stream name, where None indicates the default data stream.
- Type
str
- inode
inode.
- Type
int
- location
location.
- Type
str
- TYPE_INDICATOR = 'TSK'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.vhdi_path_spec module
The Virtual Hard Disk image path specification implementation.
dfvfs.path.vmdk_path_spec module
The VMDK image path specification implementation.
dfvfs.path.vshadow_path_spec module
The Volume Shadow Snapshots (VSS) path specification implementation.
- class dfvfs.path.vshadow_path_spec.VShadowPathSpec(location=None, parent=None, store_index=None, **kwargs)[source]
Bases:
PathSpec
Volume Shadow Snapshots (VSS) path specification.
- location
location.
- Type
str
- store_index
store index.
- Type
int
- TYPE_INDICATOR = 'VSHADOW'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.xfs_path_spec module
The XFS path specification implementation.
- class dfvfs.path.xfs_path_spec.XFSPathSpec(inode=None, location=None, parent=None, **kwargs)[source]
Bases:
PathSpec
XFS path specification implementation.
- inode
inode.
- Type
int
- location
location.
- Type
str
- TYPE_INDICATOR = 'XFS'
- property comparable
comparable representation of the path specification.
- Type
str
dfvfs.path.zip_path_spec module
The ZIP archive file path specification implementation.
- class dfvfs.path.zip_path_spec.ZipPathSpec(location=None, parent=None, **kwargs)[source]
Bases:
LocationPathSpec
ZIP archive file path specification.
- TYPE_INDICATOR = 'ZIP'
Module contents
Imports for path specification factory.