dfvfs.path package

Submodules

dfvfs.path.apfs_container_path_spec module

The APFS container path specification implementation.

class dfvfs.path.apfs_container_path_spec.APFSContainerPathSpec(location=None, parent=None, volume_index=None, **kwargs)[source]

Bases: PathSpec

APFS container path specification implementation.

location

location.

Type: str

volume_index

volume index.

Type: int

TYPE_INDICATOR = 'APFS_CONTAINER'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.apfs_path_spec module

The APFS path specification implementation.

class dfvfs.path.apfs_path_spec.APFSPathSpec(identifier=None, location=None, parent=None, **kwargs)[source]

Bases: PathSpec

APFS path specification implementation.

identifier

identifier.

Type: int

location

location.

Type: str

TYPE_INDICATOR = 'APFS'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.bde_path_spec module

The BitLocker Drive Encryption (BDE) path specification implementation.

class dfvfs.path.bde_path_spec.BDEPathSpec(password=None, parent=None, recovery_password=None, startup_key=None, **kwargs)[source]

Bases: PathSpec

BDE path specification.

password

password.

Type: str

recovery_password

recovery password.

Type: str

startup_key

name of the startup key file.

Type: str

TYPE_INDICATOR = 'BDE'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.compressed_stream_path_spec module

The compressed stream path specification implementation.

class dfvfs.path.compressed_stream_path_spec.CompressedStreamPathSpec(compression_method=None, parent=None, **kwargs)[source]

Bases: PathSpec

Compressed stream path specification.

compression_method

method used to the compress the data.

Type: str

TYPE_INDICATOR = 'COMPRESSED_STREAM'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.cpio_path_spec module

The CPIO path specification implementation.

class dfvfs.path.cpio_path_spec.CPIOPathSpec(location=None, parent=None, **kwargs)[source]

Bases: LocationPathSpec

CPIO file path specification.

TYPE_INDICATOR = 'CPIO'

dfvfs.path.cs_path_spec module

The Core Storage (CS) path specification implementation.

class dfvfs.path.cs_path_spec.CSPathSpec(encrypted_root_plist=None, location=None, password=None, parent=None, recovery_password=None, volume_index=None, **kwargs)[source]

Bases: PathSpec

CS path specification.

encrypted_root_plist

path to the EncryptedRoot.plist.wipekey file.

Type: str

location

location.

Type: str

password

password.

Type: str

recovery_password

recovery password.

Type: str

volume_index

logical volume index.

Type: int

TYPE_INDICATOR = 'CS'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.data_range_path_spec module

The data range path specification implementation.

class dfvfs.path.data_range_path_spec.DataRangePathSpec(parent=None, range_offset=None, range_size=None, **kwargs)[source]

Bases: PathSpec

Data range path specification.

range_offset

start offset of the data range.

Type: int

range_size

size of the data range.

Type: int

TYPE_INDICATOR = 'DATA_RANGE'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.encoded_stream_path_spec module

The encoded stream path specification implementation.

class dfvfs.path.encoded_stream_path_spec.EncodedStreamPathSpec(encoding_method=None, parent=None, **kwargs)[source]

Bases: PathSpec

Encoded stream path specification.

encoding_method

method used to the encode the data.

Type: str

TYPE_INDICATOR = 'ENCODED_STREAM'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.encrypted_stream_path_spec module

The encrypted stream path specification implementation.

class dfvfs.path.encrypted_stream_path_spec.EncryptedStreamPathSpec(cipher_mode=None, encryption_method=None, initialization_vector=None, key=None, parent=None, **kwargs)[source]

Bases: PathSpec

Encrypted stream path specification.

cipher_mode

cipher mode.

Type: str

encryption_method

method used to the encrypt the data.

Type: str

initialization_vector

initialization vector.

Type: bytes

key

key.

Type: bytes

TYPE_INDICATOR = 'ENCRYPTED_STREAM'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.ewf_path_spec module

The EWF image path specification implementation.

class dfvfs.path.ewf_path_spec.EWFPathSpec(parent=None, **kwargs)[source]

Bases: PathSpec

EWF image path specification.

TYPE_INDICATOR = 'EWF'

dfvfs.path.ext_path_spec module

The EXT path specification implementation.

class dfvfs.path.ext_path_spec.EXTPathSpec(inode=None, location=None, parent=None, **kwargs)[source]

Bases: PathSpec

EXT path specification implementation.

inode

inode.

Type: int

location

location.

Type: str

TYPE_INDICATOR = 'EXT'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.factory module

The path specification factory.

class dfvfs.path.factory.Factory[source]

Bases: object

Path specification factory.

classmethod DeregisterPathSpec(path_spec_type)[source]

Deregisters a path specification type.

Parameters: path_spec_type (type) – path specification type.
Raises: KeyError – if path specification type is not registered.

classmethod GetProperties(path_spec)[source]

Retrieves a dictionary containing the path specification properties.

Parameters: path_spec (PathSpec) – path specification.
Returns: path specification properties.
Return type: dict[str, str]
Raises: dict – path specification properties.

classmethod IsSystemLevelTypeIndicator(type_indicator)[source]

Determines if the type indicator is at system-level.

Parameters: type_indicator (str) – type indicator.
Returns: True if the type indicator is at system-level.
Return type: bool

classmethod NewPathSpec(type_indicator, **kwargs)[source]

Creates a new path specification for the specific type indicator.

Parameters

type_indicator (str) – type indicator.
kwargs (dict) – keyword arguments depending on the path specification.

Returns

path specification.

Return type

PathSpec

Raises

KeyError – if path specification is not registered.

PROPERTY_NAMES = frozenset({'cipher_mode', 'column_name', 'compression_method', 'data_stream', 'encoding_method', 'encryption_method', 'identifier', 'initialization_vector', 'inode', 'key', 'location', 'mft_attribute', 'mft_entry', 'part_index', 'password', 'range_offset', 'range_size', 'recovery_password', 'row_condition', 'row_index', 'start_offset', 'startup_key', 'store_index', 'table_name', 'volume_index'})

classmethod RegisterPathSpec(path_spec_type)[source]

Registers a path specification type.

Parameters: path_spec_type (type) – path specification type.
Raises: KeyError – if path specification type is already registered.

dfvfs.path.fake_path_spec module

The fake path specification implementation.

class dfvfs.path.fake_path_spec.FakePathSpec(location=None, **kwargs)[source]

Bases: LocationPathSpec

Fake path specification.

TYPE_INDICATOR = 'FAKE'

dfvfs.path.fat_path_spec module

The FAT path specification implementation.

class dfvfs.path.fat_path_spec.FATPathSpec(identifier=None, location=None, parent=None, **kwargs)[source]

Bases: PathSpec

FAT path specification implementation.

identifier

(virtual) identifier.

Type: int

location

location.

Type: str

TYPE_INDICATOR = 'FAT'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.gpt_path_spec module

The GUID Partition Table (GPT) path specification implementation.

class dfvfs.path.gpt_path_spec.GPTPathSpec(location=None, entry_index=None, parent=None, **kwargs)[source]

Bases: PathSpec

GPT path specification.

entry_index

partition entry index.

Type: int

location

location.

Type: str

TYPE_INDICATOR = 'GPT'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.gzip_path_spec module

The gzip file path specification implementation.

class dfvfs.path.gzip_path_spec.GzipPathSpec(parent=None, **kwargs)[source]

Bases: PathSpec

Gzip file path specification.

TYPE_INDICATOR = 'GZIP'

dfvfs.path.hfs_path_spec module

The HFS path specification implementation.

class dfvfs.path.hfs_path_spec.HFSPathSpec(data_stream=None, identifier=None, location=None, parent=None, **kwargs)[source]

Bases: PathSpec

HFS path specification implementation.

data_stream

data stream name, where None indicates the default data stream.

Type: str

identifier

catalog node identifier (CNID).

Type: int

location

location.

Type: str

TYPE_INDICATOR = 'HFS'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.location_path_spec module

The location-based path specification implementation.

class dfvfs.path.location_path_spec.LocationPathSpec(location=None, parent=None, **kwargs)[source]

Bases: PathSpec

Base class for location-based path specifications.

location

location.

Type: str

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.luksde_path_spec module

The LUKS Drive Encryption path specification implementation.

class dfvfs.path.luksde_path_spec.LUKSDEPathSpec(password=None, parent=None, **kwargs)[source]

Bases: PathSpec

LUKSDE path specification.

password

password.

Type: str

TYPE_INDICATOR = 'LUKSDE'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.lvm_path_spec module

The Logical Volume Manager (LVM) path specification implementation.

class dfvfs.path.lvm_path_spec.LVMPathSpec(location=None, parent=None, volume_index=None, **kwargs)[source]

Bases: PathSpec

LVM path specification.

location

location.

Type: str

volume_index

logical volume index.

Type: int

TYPE_INDICATOR = 'LVM'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.modi_path_spec module

The Mac OS disk image path specification implementation.

class dfvfs.path.modi_path_spec.MODIPathSpec(parent=None, **kwargs)[source]

Bases: PathSpec

Mac OS disk image path specification.

TYPE_INDICATOR = 'MODI'

dfvfs.path.mount_path_spec module

The mount path specification implementation.

class dfvfs.path.mount_path_spec.MountPathSpec(identifier=None, **kwargs)[source]

Bases: PathSpec

Mount path specification.

identifier

identifier of the mount point.

Type: str

TYPE_INDICATOR = 'MOUNT'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.ntfs_path_spec module

The path NTFS specification implementation.

class dfvfs.path.ntfs_path_spec.NTFSPathSpec(data_stream=None, location=None, mft_attribute=None, mft_entry=None, parent=None, **kwargs)[source]

Bases: PathSpec

NTFS path specification.

data_stream

data stream name, where None indicates the default data stream.

Type: str

location

location.

Type: str

mft_attribute

$FILE_NAME MFT attribute index, where the first attribute is indicated by 0.

Type: int

mft_entry

MFT entry, where the first entry is indicated by 0.

Type: int

TYPE_INDICATOR = 'NTFS'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.os_path_spec module

The operating system path specification implementation.

class dfvfs.path.os_path_spec.OSPathSpec(location=None, **kwargs)[source]

Bases: LocationPathSpec

Operating system path specification.

TYPE_INDICATOR = 'OS'

dfvfs.path.path_spec module

The Virtual File System (VFS) path specification interface.

class dfvfs.path.path_spec.PathSpec(parent=None, **kwargs)[source]

Bases: object

Path specification interface.

parent

parent path specification.

Type: PathSpec

CopyToDict()[source]

Copies the path specification to a dictionary.

Returns: path specification attributes.
Return type: dict[str, object]

HasParent()[source]

Determines if the path specification has a parent.

Returns: True if the path specification has a parent.
Return type: bool

IsFileSystem()[source]

Determines if the path specification is a file system.

Returns: True if the path specification is a file system.
Return type: bool

IsSystemLevel()[source]

Determines if the path specification is at system-level.

System-level is an indication used if the path specification is handled by the operating system and should not have a parent.

Returns: True if the path specification is at system-level.
Return type: bool

IsVolumeSystem()[source]

Determines if the path specification is a volume system.

Returns: True if the path specification is a volume system.
Return type: bool

IsVolumeSystemRoot()[source]

Determines if the path specification is the root of a volume system.

Returns: True if the path specification is the root of a volume system.
Return type: bool

__eq__(other)[source]: Determines if the path specification is equal to the other.

__hash__()[source]: Returns the hash of a path specification.

property comparable

comparable representation of the path specification.

Type: str

property type_indicator

type indicator.

Type: str

dfvfs.path.phdi_path_spec module

The PHDI image path specification implementation.

class dfvfs.path.phdi_path_spec.PHDIPathSpec(parent=None, **kwargs)[source]

Bases: PathSpec

PHDI image path specification.

TYPE_INDICATOR = 'PHDI'

dfvfs.path.qcow_path_spec module

The QCOW image path specification implementation.

class dfvfs.path.qcow_path_spec.QCOWPathSpec(parent=None, **kwargs)[source]

Bases: PathSpec

QCOW image path specification.

TYPE_INDICATOR = 'QCOW'

dfvfs.path.raw_path_spec module

The RAW storage media image path specification implementation.

class dfvfs.path.raw_path_spec.RawPathSpec(parent=None, **kwargs)[source]

Bases: PathSpec

RAW storage media image path specification.

TYPE_INDICATOR = 'RAW'

dfvfs.path.sqlite_blob_path_spec module

The SQLite blob path specification implementation.

class dfvfs.path.sqlite_blob_path_spec.SQLiteBlobPathSpec(column_name=None, parent=None, row_condition=None, row_index=None, table_name=None, **kwargs)[source]

Bases: PathSpec

SQLite blob file path specification.

column_name

name of the column in which the blob is stored.

Type: str

row_condition

condition of the row in which the blob is stored. The condition is a tuple in the form: (column_name, operator, value). The condition must yield a single result.

Type: tuple

row_index

index of the row in which the blob is stored.

Type: int

table_name

name of the table in which the blob is stored.

Type: str

TYPE_INDICATOR = 'SQLITE_BLOB'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.tar_path_spec module

The TAR path specification implementation.

class dfvfs.path.tar_path_spec.TARPathSpec(location=None, parent=None, **kwargs)[source]

Bases: LocationPathSpec

TAR file path specification.

TYPE_INDICATOR = 'TAR'

dfvfs.path.tsk_partition_path_spec module

The SleuthKit (TSK) partition path specification implementation.

class dfvfs.path.tsk_partition_path_spec.TSKPartitionPathSpec(location=None, parent=None, part_index=None, start_offset=None, **kwargs)[source]

Bases: PathSpec

SleuthKit (TSK) partition path specification.

location

location.

Type: str

part_index

part index.

Type: int

start_offset

start offset.

Type: int

TYPE_INDICATOR = 'TSK_PARTITION'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.tsk_path_spec module

The SleuthKit (TSK) path specification implementation.

class dfvfs.path.tsk_path_spec.TSKPathSpec(data_stream=None, inode=None, location=None, parent=None, **kwargs)[source]

Bases: PathSpec

SleuthKit (TSK) path specification.

data_stream

data stream name, where None indicates the default data stream.

Type: str

inode

inode.

Type: int

location

location.

Type: str

TYPE_INDICATOR = 'TSK'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.vhdi_path_spec module

The Virtual Hard Disk image path specification implementation.

class dfvfs.path.vhdi_path_spec.VHDIPathSpec(parent=None, **kwargs)[source]

Bases: PathSpec

Virtual Hard Disk image path specification.

TYPE_INDICATOR = 'VHDI'

dfvfs.path.vmdk_path_spec module

The VMDK image path specification implementation.

class dfvfs.path.vmdk_path_spec.VMDKPathSpec(parent=None, **kwargs)[source]

Bases: PathSpec

VMDK image path specification.

TYPE_INDICATOR = 'VMDK'

dfvfs.path.vshadow_path_spec module

The Volume Shadow Snapshots (VSS) path specification implementation.

class dfvfs.path.vshadow_path_spec.VShadowPathSpec(location=None, parent=None, store_index=None, **kwargs)[source]

Bases: PathSpec

Volume Shadow Snapshots (VSS) path specification.

location

location.

Type: str

store_index

store index.

Type: int

TYPE_INDICATOR = 'VSHADOW'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.xfs_path_spec module

The XFS path specification implementation.

class dfvfs.path.xfs_path_spec.XFSPathSpec(inode=None, location=None, parent=None, **kwargs)[source]

Bases: PathSpec

XFS path specification implementation.

inode

inode.

Type: int

location

location.

Type: str

TYPE_INDICATOR = 'XFS'

property comparable

comparable representation of the path specification.

Type: str

dfvfs.path.zip_path_spec module

The ZIP archive file path specification implementation.

class dfvfs.path.zip_path_spec.ZipPathSpec(location=None, parent=None, **kwargs)[source]

Bases: LocationPathSpec

ZIP archive file path specification.

TYPE_INDICATOR = 'ZIP'

Module contents

Imports for path specification factory.