dfvfs.path package

Submodules

dfvfs.path.apfs_container_path_spec module

The APFS container path specification implementation.

class dfvfs.path.apfs_container_path_spec.APFSContainerPathSpec(location=None, parent=None, volume_index=None, **kwargs)[source]

Bases: PathSpec

APFS container path specification implementation.

location

location.

Type:

str

volume_index

volume index.

Type:

int

TYPE_INDICATOR = 'APFS_CONTAINER'
__init__(location=None, parent=None, volume_index=None, **kwargs)[source]

Initializes a path specification.

Note that an APFS container path specification must have a parent.

Parameters:
  • location (Optional[str]) – location.

  • parent (Optional[PathSpec]) – parent path specification.

  • volume_index (Optional[int]) – index of the volume within the container.

Raises:

ValueError – when parent is not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.apfs_path_spec module

The APFS path specification implementation.

class dfvfs.path.apfs_path_spec.APFSPathSpec(identifier=None, location=None, parent=None, **kwargs)[source]

Bases: PathSpec

APFS path specification implementation.

identifier

identifier.

Type:

int

location

location.

Type:

str

TYPE_INDICATOR = 'APFS'
__init__(identifier=None, location=None, parent=None, **kwargs)[source]

Initializes a path specification.

Note that an APFS path specification must have a parent.

Parameters:
  • identifier (Optional[int]) – identifier.

  • location (Optional[str]) – location.

  • parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when parent or both identifier and location are not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.apm_path_spec module

The Apple Partition Map (APM) path specification implementation.

class dfvfs.path.apm_path_spec.APMPathSpec(location=None, entry_index=None, parent=None, **kwargs)[source]

Bases: PathSpec

APM path specification.

entry_index

partition entry index.

Type:

int

location

location.

Type:

str

TYPE_INDICATOR = 'APM'
__init__(location=None, entry_index=None, parent=None, **kwargs)[source]

Initializes a path specification.

Note that the APM path specification must have a parent.

Parameters:
  • entry_index (Optional[int]) – partition entry index.

  • location (Optional[str]) – location.

  • parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when parent is not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.bde_path_spec module

The BitLocker Drive Encryption (BDE) path specification implementation.

class dfvfs.path.bde_path_spec.BDEPathSpec(password=None, parent=None, recovery_password=None, startup_key=None, **kwargs)[source]

Bases: PathSpec

BDE path specification.

password

password.

Type:

str

recovery_password

recovery password.

Type:

str

startup_key

name of the startup key file.

Type:

str

TYPE_INDICATOR = 'BDE'
__init__(password=None, parent=None, recovery_password=None, startup_key=None, **kwargs)[source]

Initializes a path specification.

Note that the BDE path specification must have a parent.

Parameters:
  • password (Optional[str]) – password.

  • parent (Optional[PathSpec]) – parent path specification.

  • recovery_password (Optional[str]) – recovery password.

  • startup_key (Optional[str]) – name of the startup key file.

Raises:

ValueError – when parent is not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.compressed_stream_path_spec module

The compressed stream path specification implementation.

class dfvfs.path.compressed_stream_path_spec.CompressedStreamPathSpec(compression_method=None, parent=None, **kwargs)[source]

Bases: PathSpec

Compressed stream path specification.

compression_method

method used to the compress the data.

Type:

str

TYPE_INDICATOR = 'COMPRESSED_STREAM'
__init__(compression_method=None, parent=None, **kwargs)[source]

Initializes a path specification.

Note that the compressed stream path specification must have a parent.

Parameters:
  • compression_method (Optional[str]) – method used to the compress the data.

  • parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when compression method or parent are not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.cpio_path_spec module

The CPIO path specification implementation.

class dfvfs.path.cpio_path_spec.CPIOPathSpec(location=None, parent=None, **kwargs)[source]

Bases: LocationPathSpec

CPIO file path specification.

TYPE_INDICATOR = 'CPIO'
__init__(location=None, parent=None, **kwargs)[source]

Initializes a path specification.

Note that the CPIO file path specification must have a parent.

Parameters:
  • location (Optional[str]) – CPIO file internal location string prefixed with a path separator character.

  • parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when parent is not set.

dfvfs.path.cs_path_spec module

The Core Storage (CS) path specification implementation.

class dfvfs.path.cs_path_spec.CSPathSpec(encrypted_root_plist=None, location=None, password=None, parent=None, recovery_password=None, volume_index=None, **kwargs)[source]

Bases: PathSpec

CS path specification.

encrypted_root_plist

path to the EncryptedRoot.plist.wipekey file.

Type:

str

location

location.

Type:

str

password

password.

Type:

str

recovery_password

recovery password.

Type:

str

volume_index

logical volume index.

Type:

int

TYPE_INDICATOR = 'CS'
__init__(encrypted_root_plist=None, location=None, password=None, parent=None, recovery_password=None, volume_index=None, **kwargs)[source]

Initializes a path specification.

Note that the CS path specification must have a parent.

Parameters:
  • encrypted_root_plist (Optional[str]) – path to the EncryptedRoot.plist.wipekey file.

  • location (Optional[str]) – location.

  • password (Optional[str]) – password.

  • parent (Optional[PathSpec]) – parent path specification.

  • recovery_password (Optional[str]) – recovery password.

  • volume_index (Optional[int]) – logical volume index.

Raises:

ValueError – when parent is not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.data_range_path_spec module

The data range path specification implementation.

class dfvfs.path.data_range_path_spec.DataRangePathSpec(parent=None, range_offset=None, range_size=None, **kwargs)[source]

Bases: PathSpec

Data range path specification.

range_offset

start offset of the data range.

Type:

int

range_size

size of the data range.

Type:

int

TYPE_INDICATOR = 'DATA_RANGE'
__init__(parent=None, range_offset=None, range_size=None, **kwargs)[source]

Initializes a path specification.

Note that the data range path specification must have a parent.

Parameters:
  • parent (Optional[PathSpec]) – parent path specification.

  • range_offset (Optional[int]) – start offset of the data range.

  • range_size (Optional[int]) – size of the data range.

Raises:

ValueError – when range offset, range offset or parent are not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.encoded_stream_path_spec module

The encoded stream path specification implementation.

class dfvfs.path.encoded_stream_path_spec.EncodedStreamPathSpec(encoding_method=None, parent=None, **kwargs)[source]

Bases: PathSpec

Encoded stream path specification.

encoding_method

method used to the encode the data.

Type:

str

TYPE_INDICATOR = 'ENCODED_STREAM'
__init__(encoding_method=None, parent=None, **kwargs)[source]

Initializes a path specification.

Note that the encoded stream path specification must have a parent.

Parameters:
  • encoding_method (Optional[str]) – method used to the encode the data.

  • parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when encoding method or parent are not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.encrypted_stream_path_spec module

The encrypted stream path specification implementation.

class dfvfs.path.encrypted_stream_path_spec.EncryptedStreamPathSpec(cipher_mode=None, encryption_method=None, initialization_vector=None, key=None, parent=None, **kwargs)[source]

Bases: PathSpec

Encrypted stream path specification.

cipher_mode

cipher mode.

Type:

str

encryption_method

method used to the encrypt the data.

Type:

str

initialization_vector

initialization vector.

Type:

bytes

key

key.

Type:

bytes

TYPE_INDICATOR = 'ENCRYPTED_STREAM'
__init__(cipher_mode=None, encryption_method=None, initialization_vector=None, key=None, parent=None, **kwargs)[source]

Initializes a path specification.

Note that the encrypted stream path specification must have a parent.

Parameters:
  • cipher_mode (Optional[str]) – cipher mode.

  • encryption_method (Optional[str]) – method used to the encrypt the data.

  • initialization_vector (Optional[bytes]) – initialization vector.

  • key (Optional[bytes]) – key.

  • parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when encryption method or parent are not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.ewf_path_spec module

The EWF image path specification implementation.

class dfvfs.path.ewf_path_spec.EWFPathSpec(parent=None, **kwargs)[source]

Bases: PathSpec

EWF image path specification.

TYPE_INDICATOR = 'EWF'
__init__(parent=None, **kwargs)[source]

Initializes a path specification.

Note that the EWF file path specification must have a parent.

Parameters:

parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when parent is not set.

dfvfs.path.ext_path_spec module

The EXT path specification implementation.

class dfvfs.path.ext_path_spec.EXTPathSpec(inode=None, location=None, parent=None, **kwargs)[source]

Bases: PathSpec

EXT path specification implementation.

inode

inode.

Type:

int

location

location.

Type:

str

TYPE_INDICATOR = 'EXT'
__init__(inode=None, location=None, parent=None, **kwargs)[source]

Initializes a path specification.

Note that an EXT path specification must have a parent.

Parameters:
  • inode (Optional[int]) – inode.

  • location (Optional[str]) – location.

  • parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when parent or both inode and location are not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.factory module

The path specification factory.

class dfvfs.path.factory.Factory[source]

Bases: object

Path specification factory.

classmethod DeregisterPathSpec(path_spec_type)[source]

Deregisters a path specification type.

Parameters:

path_spec_type (type) – path specification type.

Raises:

KeyError – if path specification type is not registered.

classmethod GetProperties(path_spec)[source]

Retrieves a dictionary containing the path specification properties.

Parameters:

path_spec (PathSpec) – path specification.

Returns:

path specification properties.

Return type:

dict[str, str]

Raises:

dict – path specification properties.

classmethod IsSystemLevelTypeIndicator(type_indicator)[source]

Determines if the type indicator is at system-level.

Parameters:

type_indicator (str) – type indicator.

Returns:

True if the type indicator is at system-level.

Return type:

bool

classmethod NewPathSpec(type_indicator, **kwargs)[source]

Creates a new path specification for the specific type indicator.

Parameters:
  • type_indicator (str) – type indicator.

  • kwargs (dict) – keyword arguments depending on the path specification.

Returns:

path specification.

Return type:

PathSpec

Raises:

KeyError – if path specification is not registered.

PROPERTY_NAMES = frozenset({'cipher_mode', 'column_name', 'compression_method', 'data_stream', 'encoding_method', 'encryption_method', 'identifier', 'initialization_vector', 'inode', 'key', 'location', 'mft_attribute', 'mft_entry', 'part_index', 'password', 'range_offset', 'range_size', 'recovery_password', 'row_condition', 'row_index', 'start_offset', 'startup_key', 'store_index', 'table_name', 'volume_index'})
classmethod RegisterPathSpec(path_spec_type)[source]

Registers a path specification type.

Parameters:

path_spec_type (type) – path specification type.

Raises:

KeyError – if path specification type is already registered.

dfvfs.path.fake_path_spec module

The fake path specification implementation.

class dfvfs.path.fake_path_spec.FakePathSpec(location=None, **kwargs)[source]

Bases: LocationPathSpec

Fake path specification.

TYPE_INDICATOR = 'FAKE'
__init__(location=None, **kwargs)[source]

Initializes a path specification.

Note that the fake path specification cannot have a parent.

Parameters:

location (Optional[str]) – location e.g. /opt/dfvfs.

Raises:

ValueError – when parent is set.

dfvfs.path.fat_path_spec module

The FAT path specification implementation.

class dfvfs.path.fat_path_spec.FATPathSpec(identifier=None, location=None, parent=None, **kwargs)[source]

Bases: PathSpec

FAT path specification implementation.

identifier

(virtual) identifier.

Type:

int

location

location.

Type:

str

TYPE_INDICATOR = 'FAT'
__init__(identifier=None, location=None, parent=None, **kwargs)[source]

Initializes a path specification.

Note that an FAT path specification must have a parent.

Parameters:
  • identifier (Optional[int]) – (virtual) identifier.

  • location (Optional[str]) – location.

  • parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when parent or both identifier and location are not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.gpt_path_spec module

The GUID Partition Table (GPT) path specification implementation.

class dfvfs.path.gpt_path_spec.GPTPathSpec(location=None, entry_index=None, parent=None, **kwargs)[source]

Bases: PathSpec

GPT path specification.

entry_index

partition entry index.

Type:

int

location

location.

Type:

str

TYPE_INDICATOR = 'GPT'
__init__(location=None, entry_index=None, parent=None, **kwargs)[source]

Initializes a path specification.

Note that the GPT path specification must have a parent.

Parameters:
  • entry_index (Optional[int]) – partition entry index.

  • location (Optional[str]) – location.

  • parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when parent is not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.gzip_path_spec module

The gzip file path specification implementation.

class dfvfs.path.gzip_path_spec.GzipPathSpec(parent=None, **kwargs)[source]

Bases: PathSpec

Gzip file path specification.

TYPE_INDICATOR = 'GZIP'
__init__(parent=None, **kwargs)[source]

Initializes a path specification.

Note that the gzip file path specification must have a parent.

Parameters:

parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when parent is not set.

dfvfs.path.hfs_path_spec module

The HFS path specification implementation.

class dfvfs.path.hfs_path_spec.HFSPathSpec(data_stream=None, identifier=None, location=None, parent=None, **kwargs)[source]

Bases: PathSpec

HFS path specification implementation.

data_stream

data stream name, where None indicates the default data stream.

Type:

str

identifier

catalog node identifier (CNID).

Type:

int

location

location.

Type:

str

TYPE_INDICATOR = 'HFS'
__init__(data_stream=None, identifier=None, location=None, parent=None, **kwargs)[source]

Initializes a path specification.

Note that an HFS path specification must have a parent.

Parameters:
  • data_stream (Optional[str]) – data stream name, where None indicates the default data stream.

  • identifier (Optional[int]) – catalog node identifier (CNID).

  • location (Optional[str]) – location.

  • parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when parent or both identifier and location are not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.location_path_spec module

The location-based path specification implementation.

class dfvfs.path.location_path_spec.LocationPathSpec(location=None, parent=None, **kwargs)[source]

Bases: PathSpec

Base class for location-based path specifications.

location

location.

Type:

str

__init__(location=None, parent=None, **kwargs)[source]

Initializes a path specification.

Parameters:
  • location (Optional[str]) – location.

  • parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when location is not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.luksde_path_spec module

The LUKS Drive Encryption path specification implementation.

class dfvfs.path.luksde_path_spec.LUKSDEPathSpec(password=None, parent=None, **kwargs)[source]

Bases: PathSpec

LUKSDE path specification.

password

password.

Type:

str

TYPE_INDICATOR = 'LUKSDE'
__init__(password=None, parent=None, **kwargs)[source]

Initializes a path specification.

Note that the LUKSDE path specification must have a parent.

Parameters:
  • password (Optional[str]) – password.

  • parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when parent is not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.lvm_path_spec module

The Logical Volume Manager (LVM) path specification implementation.

class dfvfs.path.lvm_path_spec.LVMPathSpec(location=None, parent=None, volume_index=None, **kwargs)[source]

Bases: PathSpec

LVM path specification.

location

location.

Type:

str

volume_index

logical volume index.

Type:

int

TYPE_INDICATOR = 'LVM'
__init__(location=None, parent=None, volume_index=None, **kwargs)[source]

Initializes a path specification.

Note that the LVM path specification must have a parent.

Parameters:
  • location (Optional[str]) – location.

  • parent (Optional[PathSpec]) – parent path specification.

  • volume_index (Optional[int]) – logical volume index.

Raises:

ValueError – when parent is not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.modi_path_spec module

The Mac OS disk image path specification implementation.

class dfvfs.path.modi_path_spec.MODIPathSpec(parent=None, **kwargs)[source]

Bases: PathSpec

Mac OS disk image path specification.

TYPE_INDICATOR = 'MODI'
__init__(parent=None, **kwargs)[source]

Initializes a path specification.

Note that the MODI file path specification must have a parent.

Parameters:

parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when parent is not set.

dfvfs.path.mount_path_spec module

The mount path specification implementation.

class dfvfs.path.mount_path_spec.MountPathSpec(identifier=None, **kwargs)[source]

Bases: PathSpec

Mount path specification.

identifier

identifier of the mount point.

Type:

str

TYPE_INDICATOR = 'MOUNT'
__init__(identifier=None, **kwargs)[source]

Initializes a path specification.

Note that the mount path specification cannot have a parent.

Parameters:

identifier (Optional[str]) – identifier of the mount point.

Raises:

ValueError – when identifier is not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.ntfs_path_spec module

The path NTFS specification implementation.

class dfvfs.path.ntfs_path_spec.NTFSPathSpec(data_stream=None, location=None, mft_attribute=None, mft_entry=None, parent=None, **kwargs)[source]

Bases: PathSpec

NTFS path specification.

data_stream

data stream name, where None indicates the default data stream.

Type:

str

location

location.

Type:

str

mft_attribute

$FILE_NAME MFT attribute index, where the first attribute is indicated by 0.

Type:

int

mft_entry

MFT entry, where the first entry is indicated by 0.

Type:

int

TYPE_INDICATOR = 'NTFS'
__init__(data_stream=None, location=None, mft_attribute=None, mft_entry=None, parent=None, **kwargs)[source]

Initializes a path specification.

Note that the NTFS path specification must have a parent.

Parameters:
  • data_stream (Optional[str]) – data stream name, where None indicates the default data stream.

  • location (Optional[str]) – location.

  • mft_attribute (Optional[int]) – $FILE_NAME MFT attribute index, where the first attribute is indicated by 0.

  • mft_entry (Optional[int]) – MFT entry, where the first entry is indicated by 0.

  • parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when location and mft_entry, or parent are not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.os_path_spec module

The operating system path specification implementation.

class dfvfs.path.os_path_spec.OSPathSpec(location=None, **kwargs)[source]

Bases: LocationPathSpec

Operating system path specification.

TYPE_INDICATOR = 'OS'
__init__(location=None, **kwargs)[source]

Initializes a path specification.

Note that the operating system path specification cannot have a parent.

Parameters:

location (Optional[str]) – operating specific location string e.g. /opt/dfvfs or C:Optdfvfs.

Raises:

ValueError – when location is not set or parent is set with an unsupported path specification type.

dfvfs.path.path_spec module

The Virtual File System (VFS) path specification interface.

class dfvfs.path.path_spec.PathSpec(parent=None, **kwargs)[source]

Bases: object

Path specification interface.

parent

parent path specification.

Type:

PathSpec

CopyToDict()[source]

Copies the path specification to a dictionary.

Returns:

path specification attributes.

Return type:

dict[str, object]

HasParent()[source]

Determines if the path specification has a parent.

Returns:

True if the path specification has a parent.

Return type:

bool

IsFileSystem()[source]

Determines if the path specification is a file system.

Returns:

True if the path specification is a file system.

Return type:

bool

IsSystemLevel()[source]

Determines if the path specification is at system-level.

System-level is an indication used if the path specification is handled by the operating system and should not have a parent.

Returns:

True if the path specification is at system-level.

Return type:

bool

IsVolumeSystem()[source]

Determines if the path specification is a volume system.

Returns:

True if the path specification is a volume system.

Return type:

bool

IsVolumeSystemRoot()[source]

Determines if the path specification is the root of a volume system.

Returns:

True if the path specification is the root of a volume system.

Return type:

bool

__eq__(other)[source]

Determines if the path specification is equal to the other.

__hash__()[source]

Returns the hash of a path specification.

__init__(parent=None, **kwargs)[source]

Initializes a path specification.

Parameters:
  • parent (Optional[PathSpec]) – parent path specification.

  • kwargs (dict[str, object]) – keyword arguments depending on the path specification.

Raises:

ValueError – if a derived path specification class does not define a type indicator or when there are unused keyword arguments.

property comparable

comparable representation of the path specification.

Type:

str

property type_indicator

type indicator.

Type:

str

dfvfs.path.phdi_path_spec module

The PHDI image path specification implementation.

class dfvfs.path.phdi_path_spec.PHDIPathSpec(parent=None, **kwargs)[source]

Bases: PathSpec

PHDI image path specification.

TYPE_INDICATOR = 'PHDI'
__init__(parent=None, **kwargs)[source]

Initializes a path specification.

Note that the PHDI file path specification must have a parent.

Parameters:

parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when parent is not set.

dfvfs.path.qcow_path_spec module

The QCOW image path specification implementation.

class dfvfs.path.qcow_path_spec.QCOWPathSpec(parent=None, **kwargs)[source]

Bases: PathSpec

QCOW image path specification.

TYPE_INDICATOR = 'QCOW'
__init__(parent=None, **kwargs)[source]

Initializes a path specification.

Note that the QCOW path specification must have a parent.

Parameters:

parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when parent is not set.

dfvfs.path.raw_path_spec module

The RAW storage media image path specification implementation.

class dfvfs.path.raw_path_spec.RawPathSpec(parent=None, **kwargs)[source]

Bases: PathSpec

RAW storage media image path specification.

TYPE_INDICATOR = 'RAW'
__init__(parent=None, **kwargs)[source]

Initializes a path specification.

Note that the RAW path specification must have a parent.

Parameters:

parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when parent is not set.

dfvfs.path.sqlite_blob_path_spec module

The SQLite blob path specification implementation.

class dfvfs.path.sqlite_blob_path_spec.SQLiteBlobPathSpec(column_name=None, parent=None, row_condition=None, row_index=None, table_name=None, **kwargs)[source]

Bases: PathSpec

SQLite blob file path specification.

column_name

name of the column in which the blob is stored.

Type:

str

row_condition

condition of the row in which the blob is stored. The condition is a tuple in the form: (column_name, operator, value). The condition must yield a single result.

Type:

tuple

row_index

index of the row in which the blob is stored.

Type:

int

table_name

name of the table in which the blob is stored.

Type:

str

TYPE_INDICATOR = 'SQLITE_BLOB'
__init__(column_name=None, parent=None, row_condition=None, row_index=None, table_name=None, **kwargs)[source]

Initializes a path specification.

Note that the SQLite blob file path specification must have a parent.

Parameters:
  • column_name (Optional[str]) – name of the column in which the blob is stored.

  • parent (Optional[PathSpec]) – parent path specification.

  • row_condition (Optional[tuple]) – condition of the row in which the blob is stored. The condition is a tuple in the form: (column_name, operator, value). The condition must yield a single result.

  • row_index (Optional[int]) – index of the row in which the blob is stored.

  • table_name (Optional[str]) – name of the table in which the blob is stored.

Raises:

ValueError – when table_name, column_name, row_condition and row_index, or parent is not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.tar_path_spec module

The TAR path specification implementation.

class dfvfs.path.tar_path_spec.TARPathSpec(location=None, parent=None, **kwargs)[source]

Bases: LocationPathSpec

TAR file path specification.

TYPE_INDICATOR = 'TAR'
__init__(location=None, parent=None, **kwargs)[source]

Initializes a path specification.

Note that the TAR file path specification must have a parent.

Parameters:
  • location (str) – TAR file internal location string prefixed with a path separator character.

  • parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when parent is not set.

dfvfs.path.tsk_partition_path_spec module

The SleuthKit (TSK) partition path specification implementation.

class dfvfs.path.tsk_partition_path_spec.TSKPartitionPathSpec(location=None, parent=None, part_index=None, start_offset=None, **kwargs)[source]

Bases: PathSpec

SleuthKit (TSK) partition path specification.

location

location.

Type:

str

part_index

part index.

Type:

int

start_offset

start offset.

Type:

int

TYPE_INDICATOR = 'TSK_PARTITION'
__init__(location=None, parent=None, part_index=None, start_offset=None, **kwargs)[source]

Initializes a path specification.

Note that the TSK partition path specification must have a parent.

Parameters:
  • location (Optional[str]) – location.

  • parent (Optional[PathSpec]) – parent path specification.

  • part_index (Optional[int]) – part index.

  • start_offset (Optional[int]) – start offset.

Raises:

ValueError – when parent is not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.tsk_path_spec module

The SleuthKit (TSK) path specification implementation.

class dfvfs.path.tsk_path_spec.TSKPathSpec(data_stream=None, inode=None, location=None, parent=None, **kwargs)[source]

Bases: PathSpec

SleuthKit (TSK) path specification.

data_stream

data stream name, where None indicates the default data stream.

Type:

str

inode

inode.

Type:

int

location

location.

Type:

str

TYPE_INDICATOR = 'TSK'
__init__(data_stream=None, inode=None, location=None, parent=None, **kwargs)[source]

Initializes a path specification.

Note that the TSK path specification must have a parent.

Parameters:
  • data_stream (Optional[str]) – data stream name, where None indicates the default data stream.

  • inode (Optional[int]) – inode.

  • location (Optional[str]) – location.

  • parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when inode and location, or parent are not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.vhdi_path_spec module

The Virtual Hard Disk image path specification implementation.

class dfvfs.path.vhdi_path_spec.VHDIPathSpec(parent=None, **kwargs)[source]

Bases: PathSpec

Virtual Hard Disk image path specification.

TYPE_INDICATOR = 'VHDI'
__init__(parent=None, **kwargs)[source]

Initializes a path specification.

Note that the VHDI file path specification must have a parent.

Parameters:

parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when parent is not set.

dfvfs.path.vmdk_path_spec module

The VMDK image path specification implementation.

class dfvfs.path.vmdk_path_spec.VMDKPathSpec(parent=None, **kwargs)[source]

Bases: PathSpec

VMDK image path specification.

TYPE_INDICATOR = 'VMDK'
__init__(parent=None, **kwargs)[source]

Initializes a path specification.

Note that the VMDK file path specification must have a parent.

Parameters:

parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when parent is not set.

dfvfs.path.vshadow_path_spec module

The Volume Shadow Snapshots (VSS) path specification implementation.

class dfvfs.path.vshadow_path_spec.VShadowPathSpec(location=None, parent=None, store_index=None, **kwargs)[source]

Bases: PathSpec

Volume Shadow Snapshots (VSS) path specification.

location

location.

Type:

str

store_index

store index.

Type:

int

TYPE_INDICATOR = 'VSHADOW'
__init__(location=None, parent=None, store_index=None, **kwargs)[source]

Initializes a path specification.

Note that the VSS path specification must have a parent.

Parameters:
  • location (Optional[str]) – location.

  • parent (Optional[PathSpec]) – parent path specification.

  • store_index (Optional[int]) – store index.

Raises:

ValueError – when parent is not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.xfs_path_spec module

The XFS path specification implementation.

class dfvfs.path.xfs_path_spec.XFSPathSpec(inode=None, location=None, parent=None, **kwargs)[source]

Bases: PathSpec

XFS path specification implementation.

inode

inode.

Type:

int

location

location.

Type:

str

TYPE_INDICATOR = 'XFS'
__init__(inode=None, location=None, parent=None, **kwargs)[source]

Initializes a path specification.

Note that an XFS path specification must have a parent.

Parameters:
  • inode (Optional[int]) – inode.

  • location (Optional[str]) – location.

  • parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when parent or both inode and location are not set.

property comparable

comparable representation of the path specification.

Type:

str

dfvfs.path.zip_path_spec module

The ZIP archive file path specification implementation.

class dfvfs.path.zip_path_spec.ZipPathSpec(location=None, parent=None, **kwargs)[source]

Bases: LocationPathSpec

ZIP archive file path specification.

TYPE_INDICATOR = 'ZIP'
__init__(location=None, parent=None, **kwargs)[source]

Initializes a path specification.

Note that the zip file path specification must have a parent.

Parameters:
  • location (Optional[str]) – ZIP file internal location string prefixed with a path separator character.

  • parent (Optional[PathSpec]) – parent path specification.

Raises:

ValueError – when parent is not set.

Module contents

Imports for path specification factory.