dfvfs.vfs package

Submodules

dfvfs.vfs.apfs_attribute module

The APFS attribute implementation.

class dfvfs.vfs.apfs_attribute.APFSExtendedAttribute(fsapfs_extended_attribute)[source]

Bases: Attribute

APFS extended attribute that uses pyfsapfs.

GetExtents()[source]

Retrieves the extents.

Returns:: the extents of the attribute data.
Return type:: list[Extent]

__init__(fsapfs_extended_attribute)[source]

Initializes an attribute.

Parameters:: fsapfs_extended_attribute (pyfsapfs.extended_attribute) – APFS extended attribute.
Raises:: BackEndError – if the pyfsapfs extended attribute is missing.

get_offset()[source]

Retrieves the current offset into the file input/output (IO) object.

Returns:: current offset into the file input/output (IO) object.
Return type:: int

get_size()[source]

Retrieves the size of the file input/output (IO) object.

Returns:: size of the file input/output (IO) object.
Return type:: int

property name

name.

Type:: str

read(size=None)[source]

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:: size (Optional[int]) – number of bytes to read, where None is all remaining data.
Returns:: data read.
Return type:: bytes
Raises:: OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file input/output (IO) object.

Parameters:

offset (int) – offset to seek.
whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises:

OSError – if the seek failed.

seekable()[source]

Determines if a file input/output (IO) object is seekable.

Returns:: True since a file IO object provides a seek method.
Return type:: bool

tell()[source]: Retrieves the current offset into the file input/output (IO) object.

dfvfs.vfs.apfs_container_directory module

The APFS container directory implementation.

class dfvfs.vfs.apfs_container_directory.APFSContainerDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pyfsapfs.

dfvfs.vfs.apfs_container_file_entry module

The APFS container file entry implementation.

class dfvfs.vfs.apfs_container_file_entry.APFSContainerFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, volume_index=None)[source]

Bases: FileEntry

File system file entry that uses pyfsapfs.

GetAPFSVolume()[source]

Retrieves an APFS volume.

Returns:: an APFS volume or None if not available.
Return type:: pyfsapfs.volume

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None if not available.
Return type:: APFSContainerFileEntry

IsLocked()[source]

Determines if the file entry is locked.

Returns:: True if the file entry is locked.
Return type:: bool

TYPE_INDICATOR = 'APFS_CONTAINER'

Unlock()[source]

Unlocks the file entry.

Returns:: True if the file entry was unlocked.
Return type:: bool

__init__(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, volume_index=None)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file entry emulated by the corresponding file system.
volume_index (Optional[int]) – volume index or None.

Raises:

BackEndError – when the fsapfs volume is missing in a non-virtual file entry.

property name

Retrieves the name.

Returns:: name of the file entry, which does not include the full path.
Return type:: str

property size

Retrieves the size.

Returns:: size of the file entry in bytes or None if not available.
Return type:: int

property sub_file_entries

Retrieves sub file entries.

Returns:: sub file entries.
Return type:: generator[APFSContainerFileEntry]

dfvfs.vfs.apfs_container_file_system module

The APFS container file system implementation.

class dfvfs.vfs.apfs_container_file_system.APFSContainerFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

APFS container file system using pyfsapfs.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: True if the file entry exists.
Return type:: bool

GetAPFSContainer()[source]

Retrieves the APFS container.

Returns:: the APFS container.
Return type:: pyfsapfs.container

GetAPFSVolumeByPathSpec(path_spec)[source]

Retrieves an APFS volume for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: an APFS volume or None if not available.
Return type:: pyfsapfs.volume

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: a file entry or None if not exists.
Return type:: APFSContainerFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: a file entry.
Return type:: APFSContainerFileEntry

GetVolumeIndexByPathSpec(path_spec)[source]

Retrieves the volume index for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: volume index or None if the index cannot be determined.
Return type:: int

TYPE_INDICATOR = 'APFS_CONTAINER'

__init__(resolver_context, path_spec)[source]

Initializes an APFS container file system.

Parameters:

resolver_context (resolver.Context) – resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.apfs_directory module

The APFS directory implementation.

class dfvfs.vfs.apfs_directory.APFSDirectory(file_system, path_spec, fsapfs_file_entry)[source]

Bases: Directory

File system directory that uses pyfsapfs.

__init__(file_system, path_spec, fsapfs_file_entry)[source]

Initializes a directory.

Parameters:

file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
fsapfs_file_entry (pyfsapfs.file_entry) – APFS file entry.

dfvfs.vfs.apfs_file_entry module

The APFS file entry implementation.

class dfvfs.vfs.apfs_file_entry.APFSFileEntry(resolver_context, file_system, path_spec, fsapfs_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyfsapfs.

GetAPFSFileEntry()[source]

Retrieves the APFS file entry.

Returns:: APFS file entry.
Return type:: pyfsapfs.file_entry

GetExtents()[source]

Retrieves the extents.

Returns:: the extents.
Return type:: list[Extent]

GetLinkedFileEntry()[source]

Retrieves the linked file entry, e.g. for a symbolic link.

Returns:: linked file entry or None if not available.
Return type:: APFSFileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None if not available.
Return type:: APFSFileEntry

TYPE_INDICATOR = 'APFS'

__init__(resolver_context, file_system, path_spec, fsapfs_file_entry=None, is_root=False, is_virtual=False)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
fsapfs_file_entry (Optional[pyfsapfs.file_entry]) – APFS file entry.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file entry emulated by the corresponding file system.

Raises:

BackEndError – if the pyfsapfs file entry is missing.

property access_time

access time or None if not available.

Type:: dfdatetime.DateTimeValues

property added_time

added time or None if not available.

Type:: dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type:: dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type:: dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type:: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type:: str

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.apfs_file_system module

The APFS file system implementation.

class dfvfs.vfs.apfs_file_system.APFSFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfsapfs.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: True if the file entry exists.
Return type:: bool
Raises:: BackEndError – if the file entry cannot be opened.

GetAPFSFileEntryByPathSpec(path_spec)[source]

Retrieves the APFS file entry for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: file entry.
Return type:: pyfsapfs.file_entry
Raises:: PathSpecError – if the path specification is missing location and identifier.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: file entry or None if not available.
Return type:: APFSFileEntry
Raises:: BackEndError – if the file entry cannot be opened.

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: file entry or None if not available.
Return type:: APFSFileEntry

ROOT_DIRECTORY_IDENTIFIER = 2

TYPE_INDICATOR = 'APFS'

__init__(resolver_context, path_spec)[source]

Initializes an APFS file system.

Parameters:

resolver_context (Context) – resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.apm_directory module

The Apple Partition Map (APM) directory implementation.

class dfvfs.vfs.apm_directory.APMDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pyvsapm.

dfvfs.vfs.apm_file_entry module

The Apple Partition Map (APM) file entry implementation.

class dfvfs.vfs.apm_file_entry.APMFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, vsapm_partition=None)[source]

Bases: FileEntry

File system file entry that uses pyvsapm.

GetAPMPartition()[source]

Retrieves the APM partition.

Returns:: a APM partition.
Return type:: pyvsapm.partition

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None if not available.
Return type:: APMFileEntry

TYPE_INDICATOR = 'APM'

__init__(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, vsapm_partition=None)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file
vsapm_partition (Optional[pyvsapm.partition]) – a APM partition.

Raises:

BackEndError – when APM partition is missing for a non-virtual file entry.

property name

name of the file entry, without the full path.

Type:: str

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.apm_file_system module

The Apple Partition Map (APM) file system implementation.

class dfvfs.vfs.apm_file_system.APMFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyvsapm.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: True if the file entry exists.
Return type:: bool

GetAPMPartitionByPathSpec(path_spec)[source]

Retrieves a APM partition for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: a APM partition or None if not available.
Return type:: pyvsapm.partition

GetAPMVolume()[source]

Retrieves the APM volume.

Returns:: a APM volume.
Return type:: pyvsapm.volume

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: a file entry or None if not available.
Return type:: APMFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: root file entry or None if not available.
Return type:: APMFileEntry

TYPE_INDICATOR = 'APM'

__init__(resolver_context, path_spec)[source]

Initializes a file system.

Parameters:

resolver_context (Context) – resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.attribute module

The Virtual File System (VFS) attribute interface.

class dfvfs.vfs.attribute.Attribute[source]

Bases: object

Attribute interface.

GetExtents()[source]

Retrieves the extents.

Returns:: the extents of the attribute data.
Return type:: list[Extent]

property type_indicator

type indicator or None if not known.

Type:: str

class dfvfs.vfs.attribute.StatAttribute[source]

Bases: object

Attribute that represents a POSIX stat.

device_number

major and minor device number (if block or character device file), derived from st_rdev.

Type:: Tuple[int, int]

group_identifier

group identifier (GID), equivalent to st_gid.

Type:: int

inode_number

number of the corresponding inode, equivalent to st_ino.

Type:: int

mode

access mode, equivalent to st_mode.

Type:: int

number_of_links

number of hard links, equivalent to st_nlink.

Type:: int

owner_identifier

user identifier (UID) of the owner, equivalent to st_uid.

Type:: int

size

size, in number of bytes, equivalent to st_size.

Type:: int

type

file type, value derived from st_mode >> 12.

Type:: str

TYPE_BLOCK_DEVICE = 'block_device'

TYPE_CHARACTER_DEVICE = 'character_device'

TYPE_DEVICE = 'device'

TYPE_DIRECTORY = 'directory'

TYPE_FILE = 'file'

TYPE_LINK = 'link'

TYPE_PIPE = 'pipe'

TYPE_SOCKET = 'socket'

TYPE_WHITEOUT = 'whiteout'

__init__()[source]: Initializes an attribute.

dfvfs.vfs.bde_file_entry module

The BDE file entry implementation.

class dfvfs.vfs.bde_file_entry.BDEFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

File system file entry that uses pybde.

IsLocked()[source]

Determines if the file entry is locked.

Returns:: True if the file entry is locked.
Return type:: bool

TYPE_INDICATOR = 'BDE'

Unlock()[source]

Unlocks the file entry.

Returns:: True if the file entry was unlocked.
Return type:: bool

__init__(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Initializes the file entry object.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file

Raises:

BackEndError – when the BDE volume is missing.

property creation_time

creation time or None if not available.

Type:: dfdatetime.DateTimeValues

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.bde_file_system module

The BDE file system implementation.

class dfvfs.vfs.bde_file_system.BDEFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

File system that uses pybde.

GetBDEVolume()[source]

Retrieves the BDE volume.

Returns:: BDE volume.
Return type:: pybde.volume

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: file entry or None.
Return type:: BDEFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: file entry or None.
Return type:: BDEFileEntry

TYPE_INDICATOR = 'BDE'

__init__(resolver_context, path_spec)[source]

Initializes a file system.

Parameters:

resolver_context (Context) – resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.compressed_stream_file_entry module

The compressed stream file entry implementation.

class dfvfs.vfs.compressed_stream_file_entry.CompressedStreamFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

Compressed stream file entry.

TYPE_INDICATOR = 'COMPRESSED_STREAM'

__init__(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file

Raises:

BackEndError – when the compressed stream is missing.

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.compressed_stream_file_system module

The compressed stream file system implementation.

class dfvfs.vfs.compressed_stream_file_system.CompressedStreamFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

Compressed stream file system.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: a file entry or None if not available.
Return type:: CompressedStreamFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: a file entry or None if not available.
Return type:: CompressedStreamFileEntry

TYPE_INDICATOR = 'COMPRESSED_STREAM'

__init__(resolver_context, path_spec)[source]

Initializes a compressed stream file system.

Parameters:

resolver_context (Context) – a resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.cpio_directory module

The CPIO directory implementation.

class dfvfs.vfs.cpio_directory.CPIODirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses CPIOArchiveFile.

dfvfs.vfs.cpio_file_entry module

The CPIO file entry implementation.

class dfvfs.vfs.cpio_file_entry.CPIOFileEntry(resolver_context, file_system, path_spec, cpio_archive_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses CPIOArchiveFile.

GetCPIOArchiveFileEntry()[source]

Retrieves the CPIO archive file entry object.

Returns:: CPIO archive file entry.
Return type:: CPIOArchiveFileEntry
Raises:: PathSpecError – if the path specification is incorrect.

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None if not available.
Return type:: CPIOFileEntry

TYPE_INDICATOR = 'CPIO'

__init__(resolver_context, file_system, path_spec, cpio_archive_file_entry=None, is_root=False, is_virtual=False)[source]

Initializes a file entry object.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
cpio_archive_file_entry (Optional[CPIOArchiveFileEntry]) – CPIO archive file entry.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file entry emulated by the corresponding file system.

Raises:

BackEndError – when the CPIO archive file entry is missing in a non-virtual file entry.

property modification_time

modification time or None if not available.

Type:: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type:: str

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.cpio_file_system module

The CPIO archive file system implementation.

class dfvfs.vfs.cpio_file_system.CPIOFileSystem(resolver_context, path_spec, encoding='utf-8')[source]

Bases: FileSystem

CPIO archive file system.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: True if the file entry exists.
Return type:: bool

GetCPIOArchiveFile()[source]

Retrieves the CPIO archive file.

Returns:: a CPIO archive file.
Return type:: CPIOArchiveFile

GetCPIOArchiveFileEntryByPathSpec(path_spec)[source]

Retrieves the CPIO archive file entry for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: CPIO archive file entry or None if not available.
Return type:: CPIOArchiveFileEntry
Raises:: PathSpecError – if the path specification is incorrect.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: a file entry or None if not available.
Return type:: CPIOFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: a file entry or None if not available.
Return type:: CPIOFileEntry

TYPE_INDICATOR = 'CPIO'

__init__(resolver_context, path_spec, encoding='utf-8')[source]

Initializes a CPIO archive file system.

Parameters:

resolver_context (Context) – resolver context.
path_spec (PathSpec) – a path specification.
encoding (Optional[str]) – file entry name encoding.

dfvfs.vfs.cs_directory module

The Core Storage (CS) directory implementation.

class dfvfs.vfs.cs_directory.CSDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pyfvde.

dfvfs.vfs.cs_file_entry module

The Core Storage (CS) file entry implementation.

class dfvfs.vfs.cs_file_entry.CSFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, fvde_logical_volume=None)[source]

Bases: FileEntry

File system file entry that uses pyfvde.

GetFVDELogicalVolume()[source]

Retrieves the Core Storage logical volume.

Returns:: a Core Storage logical volume.
Return type:: pyfvde.logical_volume

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None if not available.
Return type:: CSFileEntry

IsLocked()[source]

Determines if the file entry is locked.

Returns:: True if the file entry is locked.
Return type:: bool

TYPE_INDICATOR = 'CS'

Unlock()[source]

Unlocks the file entry.

Returns:: True if the file entry was unlocked.
Return type:: bool

__init__(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, fvde_logical_volume=None)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file
fvde_logical_volume (Optional[pyfvde.logical_volume]) – a Core Storage logical volume.

Raises:

BackEndError – when Core Storage logical volume is missing for a non-virtual file entry.

property name

name of the file entry, without the full path.

Type:: str

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.cs_file_system module

The Core Storage (CS) file system implementation.

class dfvfs.vfs.cs_file_system.CSFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfvde.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: True if the file entry exists.
Return type:: bool

GetFVDELogicalVolumeByPathSpec(path_spec)[source]

Retrieves a Core Storage logical volume for a path specification.

Parameters:

path_spec (PathSpec) – path specification.

Returns:

a Core Storage logical volume or None if not: available.

Return type:

pyfvde.logical_volume

GetFVDEVolumeGroup()[source]

Retrieves the Core Storage volume group.

Returns:: a Core Storage volume group.
Return type:: pyfvde.volume_group

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: a file entry or None if not available.
Return type:: CSFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: root file entry or None if not available.
Return type:: CSFileEntry

TYPE_INDICATOR = 'CS'

__init__(resolver_context, path_spec)[source]

Initializes a file system.

Parameters:

resolver_context (Context) – resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.data_range_file_entry module

The data range file entry implementation.

class dfvfs.vfs.data_range_file_entry.DataRangeFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

File entry that represents a data range.

TYPE_INDICATOR = 'DATA_RANGE'

__init__(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file entry emulated by the corresponding file system.

Raises:

ValueError – if a derived file entry class does not define a type indicator.

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.data_range_file_system module

The data range file system implementation.

class dfvfs.vfs.data_range_file_system.DataRangeFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

Data range file system.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: a file entry or None if not available.
Return type:: DataRangeFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: a file entry or None if not available.
Return type:: DataRangeFileEntry

TYPE_INDICATOR = 'DATA_RANGE'

__init__(resolver_context, path_spec)[source]

Initializes a data range file system.

Parameters:

resolver_context (Context) – a resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.data_stream module

The Virtual File System (VFS) data stream interface.

class dfvfs.vfs.data_stream.DataStream(file_entry)[source]

Bases: object

Data stream interface.

GetExtents()[source]

Retrieves the extents.

Returns:: the extents of the data stream.
Return type:: list[Extent]

IsDefault()[source]

Determines if the data stream is the default data stream.

Returns:: True if the data stream is the default data stream.
Return type:: bool

__init__(file_entry)[source]

Initializes the data stream.

Parameters:: file_entry (FileEntry) – file entry.

property name

name.

Type:: str

property size

size.

Type:: int

dfvfs.vfs.directory module

The Virtual File System (VFS) directory interface.

class dfvfs.vfs.directory.Directory(file_system, path_spec)[source]

Bases: object

Directory interface.

path_spec

path specification of the directory.

Type:: PathSpec

__init__(file_system, path_spec)[source]

Initializes a directory.

Parameters:

file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.

property entries

Retrieves directory entries.

Returns:: path specifications of the directory entries.
Return type:: generator[PathSpec]

dfvfs.vfs.encoded_stream_file_entry module

The encoded stream file entry implementation.

class dfvfs.vfs.encoded_stream_file_entry.EncodedStreamFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

Class that implements an encoded stream file entry.

TYPE_INDICATOR = 'ENCODED_STREAM'

__init__(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file

Raises:

BackEndError – when the encoded stream is missing.

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.encoded_stream_file_system module

The encoded stream file system implementation.

class dfvfs.vfs.encoded_stream_file_system.EncodedStreamFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

Encoded stream file system.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: a file entry or None if not available.
Return type:: EncodedStreamFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: a file entry or None if not available.
Return type:: EncodedStreamFileEntry

TYPE_INDICATOR = 'ENCODED_STREAM'

__init__(resolver_context, path_spec)[source]

Initializes an encoded file system.

Parameters:

resolver_context (Context) – a resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.encrypted_stream_file_entry module

The encrypted stream file entry implementation.

class dfvfs.vfs.encrypted_stream_file_entry.EncryptedStreamFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

Encrypted stream file entry.

TYPE_INDICATOR = 'ENCRYPTED_STREAM'

__init__(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file

Raises:

BackEndError – when the encrypted stream is missing.

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.encrypted_stream_file_system module

The encrypted stream file system implementation.

class dfvfs.vfs.encrypted_stream_file_system.EncryptedStreamFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

Encrypted stream file system.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: a file entry or None if not available.
Return type:: EncryptedStreamFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: a file entry or None if not available.
Return type:: EncryptedStreamFileEntry

TYPE_INDICATOR = 'ENCRYPTED_STREAM'

__init__(resolver_context, path_spec)[source]

Initializes an encrypted file system.

Parameters:

resolver_context (Context) – a resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.ext_attribute module

The EXT attribute implementation.

class dfvfs.vfs.ext_attribute.EXTExtendedAttribute(fsext_extended_attribute)[source]

Bases: Attribute

EXT extended attribute that uses pyfsext.

GetExtents()[source]

Retrieves the extents.

Returns:: the extents of the attribute data.
Return type:: list[Extent]

__init__(fsext_extended_attribute)[source]

Initializes an attribute.

Parameters:: fsext_extended_attribute (pyfsext.extended_attribute) – EXT extended attribute.
Raises:: BackEndError – if the pyfsext extended attribute is missing.

get_offset()[source]

Retrieves the current offset into the file input/output (IO) object.

Returns:: current offset into the file input/output (IO) object.
Return type:: int

get_size()[source]

Retrieves the size of the file input/output (IO) object.

Returns:: size of the file input/output (IO) object.
Return type:: int

property name

name.

Type:: str

read(size=None)[source]

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:: size (Optional[int]) – number of bytes to read, where None is all remaining data.
Returns:: data read.
Return type:: bytes
Raises:: OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file input/output (IO) object.

Parameters:

offset (int) – offset to seek.
whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises:

OSError – if the seek failed.

seekable()[source]

Determines if a file input/output (IO) object is seekable.

Returns:: True since a file IO object provides a seek method.
Return type:: bool

tell()[source]: Retrieves the current offset into the file input/output (IO) object.

dfvfs.vfs.ext_directory module

The EXT directory implementation.

class dfvfs.vfs.ext_directory.EXTDirectory(file_system, path_spec, fsext_file_entry)[source]

Bases: Directory

File system directory that uses pyfsext.

__init__(file_system, path_spec, fsext_file_entry)[source]

Initializes a directory.

Parameters:

file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
fsext_file_entry (pyfsext.file_entry) – EXT file entry.

dfvfs.vfs.ext_file_entry module

The EXT file entry implementation.

class dfvfs.vfs.ext_file_entry.EXTFileEntry(resolver_context, file_system, path_spec, fsext_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyfsext.

GetEXTFileEntry()[source]

Retrieves the EXT file entry.

Returns:: EXT file entry.
Return type:: pyfsext.file_entry

GetExtents()[source]

Retrieves the extents.

Returns:: the extents.
Return type:: list[Extent]

GetLinkedFileEntry()[source]

Retrieves the linked file entry, e.g. for a symbolic link.

Returns:: linked file entry or None if not available.
Return type:: EXTFileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None if not available.
Return type:: EXTFileEntry

TYPE_INDICATOR = 'EXT'

__init__(resolver_context, file_system, path_spec, fsext_file_entry=None, is_root=False, is_virtual=False)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
fsext_file_entry (Optional[pyfsext.file_entry]) – EXT file entry.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file entry emulated by the corresponding file system.

Raises:

BackEndError – if the pyfsext file entry is missing.

property access_time

access time or None if not available.

Type:: dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type:: dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type:: dfdatetime.DateTimeValues

property deletion_time

deletion time or None if not available.

Type:: dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type:: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type:: str

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.ext_file_system module

The EXT file system implementation.

class dfvfs.vfs.ext_file_system.EXTFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfsext.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: True if the file entry exists.
Return type:: bool
Raises:: BackEndError – if the file entry cannot be opened.

GetEXTFileEntryByPathSpec(path_spec)[source]

Retrieves the EXT file entry for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: file entry.
Return type:: pyfsext.file_entry
Raises:: PathSpecError – if the path specification is missing location and inode.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: file entry or None if not available.
Return type:: EXTFileEntry
Raises:: BackEndError – if the file entry cannot be opened.

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: file entry.
Return type:: EXTFileEntry

ROOT_DIRECTORY_INODE_NUMBER = 2

TYPE_INDICATOR = 'EXT'

__init__(resolver_context, path_spec)[source]

Initializes an EXT file system.

Parameters:

resolver_context (Context) – resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.extent module

The Virtual File System (VFS) extent.

class dfvfs.vfs.extent.Extent(extent_type=None, offset=None, size=None)[source]

Bases: object

Extent.

extent_type

type of the extent, for example EXTENT_TYPE_SPARSE.

Type:: str

offset

offset of the extent relative from the start of the file system in bytes.

Type:: int

size

size of the extent in bytes.

Type:: int

__init__(extent_type=None, offset=None, size=None)[source]

Initializes an extent.

Parameters:

extent_type (Optional[str]) – type of the extent, for example EXTENT_TYPE_SPARSE.
offset (Optional[int]) – offset of the extent relative from the start of the file system in bytes.
size (Optional{int]) – size of the extent in bytes.

dfvfs.vfs.fake_directory module

The fake directory implementation.

class dfvfs.vfs.fake_directory.FakeDirectory(file_system, path_spec)[source]

Bases: Directory

Fake file system directory.

dfvfs.vfs.fake_file_entry module

The fake file entry implementation.

class dfvfs.vfs.fake_file_entry.FakeFileEntry(resolver_context, file_system, path_spec, file_entry_type=None, is_root=False)[source]

Bases: FileEntry

Fake file system file entry.

GetFileObject(data_stream_name='')[source]

Retrieves a file-like object of a specific data stream.

Parameters:: data_stream_name (Optional[str]) – name of the data stream, where an empty string represents the default data stream.
Returns:: a file-like object or None if not available.
Return type:: FakeFileIO
Raises:: OSError – if the file entry is not a file.

GetParentFileEntry()[source]

Retrieves the root file entry.

Returns:: parent file entry or None if not available.
Return type:: FakeFileEntry

TYPE_INDICATOR = 'FAKE'

__init__(resolver_context, file_system, path_spec, file_entry_type=None, is_root=False)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
file_entry_type (Optional[str]) – file entry type.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.

property access_time

access time or None if not available.

Type:: dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type:: dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type:: dfdatetime.DateTimeValues

property name

name of the file entry, without the full path.

Type:: str

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.fake_file_system module

The fake file system implementation.

class dfvfs.vfs.fake_file_system.FakeFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

Fake file system.

AddFileEntry(path, file_entry_type='file', file_data=None, link_data=None)[source]

Adds a fake file entry.

Parameters:

path (str) – path of the file entry.
file_entry_type (Optional[str]) – type of the file entry object.
file_data (Optional[bytes]) – data of the fake file-like object.
link_data (Optional[bytes]) – link data of the fake file entry object.

Raises:

KeyError – if the path already exists.
ValueError – if the file data is set but the file entry type is not a file or if the link data is set but the file entry type is not a link.

FileEntryExistsByPath(path)[source]

Determines if a file entry for a path exists.

Parameters:: path (str) – path of the file entry.
Returns:: True if the file entry exists.
Return type:: bool

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: True if the file entry exists.
Return type:: bool

GetDataByPath(path)[source]

Retrieves the data associated to a path.

Parameters:: path (str) – path of the file entry.
Returns:: data or None if not available.
Return type:: bytes

GetFileEntryByPath(path)[source]

Retrieves a file entry for a path.

Parameters:: path (str) – path of the file entry.
Returns:: a file entry or None if not available.
Return type:: FakeFileEntry

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: a file entry or None if not available.
Return type:: FakeFileEntry

GetPaths()[source]

Retrieves the paths dictionary.

Returns:: file-like object per path.
Return type:: dict[str, FileIO]

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: a file entry or None if not available.
Return type:: FakeFileEntry

TYPE_INDICATOR = 'FAKE'

__init__(resolver_context, path_spec)[source]

Initializes a file system.

Parameters:

resolver_context (Context) – a resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.fat_directory module

The FAT directory implementation.

class dfvfs.vfs.fat_directory.FATDirectory(file_system, path_spec, fsfat_file_entry)[source]

Bases: Directory

File system directory that uses pyfsfat.

__init__(file_system, path_spec, fsfat_file_entry)[source]

Initializes a directory.

Parameters:

file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
fsfat_file_entry (pyfsfat.file_entry) – FAT file entry.

dfvfs.vfs.fat_file_entry module

The FAT file entry implementation.

class dfvfs.vfs.fat_file_entry.FATFileEntry(resolver_context, file_system, path_spec, fsfat_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyfsfat.

GetExtents()[source]

Retrieves the extents.

Returns:: the extents.
Return type:: list[Extent]

GetFATFileEntry()[source]

Retrieves the FAT file entry.

Returns:: FAT file entry.
Return type:: pyfsfat.file_entry

GetFileObject(data_stream_name='')[source]

Retrieves a file-like object of a specific data stream.

Parameters:: data_stream_name (Optional[str]) – name of the data stream, where an empty string represents the default data stream.
Returns:: a file-like object or None if not available.
Return type:: FileIO

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None if not available.
Return type:: FATFileEntry

TYPE_INDICATOR = 'FAT'

__init__(resolver_context, file_system, path_spec, fsfat_file_entry=None, is_root=False, is_virtual=False)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
fsfat_file_entry (Optional[pyfsfat.file_entry]) – FAT file entry.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file entry emulated by the corresponding file system.

Raises:

BackEndError – if the pyfsfat file entry is missing.

property access_time

access time or None if not available.

Type:: dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type:: dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type:: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type:: str

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.fat_file_system module

The FAT file system implementation.

class dfvfs.vfs.fat_file_system.FATFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfsfat.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: True if the file entry exists.
Return type:: bool
Raises:: BackEndError – if the file entry cannot be opened.

GetFATFileEntryByPathSpec(path_spec)[source]

Retrieves the FAT file entry for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: file entry.
Return type:: pyfsfat.file_entry
Raises:: PathSpecError – if the path specification is missing location and identifier.

GetFATVolume()[source]

Retrieves the FAT volume.

Returns:: a FAT volume.
Return type:: pyfsfat.volume

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: file entry or None if not available.
Return type:: FATFileEntry
Raises:: BackEndError – if the file entry cannot be opened.

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: file entry.
Return type:: FATFileEntry

LOCATION_ROOT = '\\'

PATH_SEPARATOR = '\\'

TYPE_INDICATOR = 'FAT'

__init__(resolver_context, path_spec)[source]

Initializes an FAT file system.

Parameters:

resolver_context (Context) – resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.file_entry module

The Virtual File System (VFS) file entry interface.

The file entry can be various file system elements like a regular file, a directory or file system metadata.

class dfvfs.vfs.file_entry.FileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: object

File entry interface.

entry_type

file entry type, such as device, directory, file, link, socket and pipe or None if not available. The available file entry types are defined in dfvfs.lib.definitions for example FILE_ENTRY_TYPE_FILE.

Type:: str

path_spec

path specification.

Type:: PathSpec

GetDataStream(name, case_sensitive=True)[source]

Retrieves a data stream by name.

Parameters:

name (str) – name of the data stream.
case_sensitive (Optional[bool]) – True if the name is case sensitive.

Returns:

a data stream or None if not available.

Return type:

DataStream

Raises:

ValueError – if the name is not string.

GetExtents()[source]

Retrieves the extents.

Returns:: the extents.
Return type:: list[Extent]

GetFileObject(data_stream_name='')[source]

Retrieves a file-like object of a specific data stream.

Parameters:: data_stream_name (Optional[str]) – name of the data stream, where an empty string represents the default data stream.
Returns:: a file-like object or None if not available.
Return type:: FileIO

GetFileSystem()[source]

Retrieves the file system which contains the file entry.

Returns:: a file system.
Return type:: FileSystem

GetLinkedFileEntry()[source]

Retrieves the linked file entry, for example for a symbolic link.

Returns:: linked file entry or None if not available.
Return type:: FileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None if not available.
Return type:: FileEntry

GetStatAttribute()[source]

Retrieves a stat attribute.

Returns:: a stat attribute or None if not available.
Return type:: StatAttribute

GetSubFileEntryByName(name, case_sensitive=True)[source]

Retrieves a sub file entry by name.

Parameters:

name (str) – name of the file entry.
case_sensitive (Optional[bool]) – True if the name is case sensitive.

Returns:

a file entry or None if not available.

Return type:

FileEntry

HasDataStream(name, case_sensitive=True)[source]

Determines if the file entry has specific data stream.

Parameters:

name (str) – name of the data stream.
case_sensitive (Optional[bool]) – True if the name is case sensitive.

Returns:

True if the file entry has the data stream.

Return type:

bool

Raises:

ValueError – if the name is not string.

HasExternalData()[source]

Determines if the file entry has external stored data.

Returns:: True if the file entry has external stored data.
Return type:: bool

IsAllocated()[source]

Determines if the file entry is allocated.

Returns:: True if the file entry is allocated.
Return type:: bool

IsDevice()[source]

Determines if the file entry is a device.

Returns:: True if the file entry is a device.
Return type:: bool

IsDirectory()[source]

Determines if the file entry is a directory.

Returns:: True if the file entry is a directory.
Return type:: bool

IsFile()[source]

Determines if the file entry is a file.

Returns:: True if the file entry is a file.
Return type:: bool

IsLink()[source]

Determines if the file entry is a link.

Returns:: True if the file entry is a link.
Return type:: bool

IsLocked()[source]

Determines if the file entry is locked.

Returns:: True if the file entry is locked.
Return type:: bool

IsPipe()[source]

Determines if the file entry is a pipe.

Returns:: True if the file entry is a pipe.
Return type:: bool

IsRoot()[source]

Determines if the file entry is the root file entry.

Returns:: True if the file entry is the root file entry.
Return type:: bool

IsSocket()[source]

Determines if the file entry is a socket.

Returns:: True if the file entry is a socket.
Return type:: bool

IsVirtual()[source]

Determines if the file entry is virtual (emulated by dfVFS).

Returns:: True if the file entry is virtual.
Return type:: bool

Unlock()[source]

Unlocks the file entry.

Returns:: True if the file entry was unlocked.
Return type:: bool

__init__(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file entry emulated by the corresponding file system.

Raises:

ValueError – if a derived file entry class does not define a type indicator.

property access_time

Retrieves the access time.

Returns:: access time or None if not available.
Return type:: dfdatetime.DateTimeValues

property added_time

Retrieves the added time.

Returns:: added time or None if not available.
Return type:: dfdatetime.DateTimeValues

property attributes

Retrieves attributes.

Returns:: attributes.
Return type:: generator[Attribute]

property backup_time

Retrieves the backup time.

Returns:: backup time or None if not available.
Return type:: dfdatetime.DateTimeValues

property change_time

Retrieves the change time.

Returns:: change time or None if not available.
Return type:: dfdatetime.DateTimeValues

property creation_time

Retrieves the creation time.

Returns:: creation time or None if not available.
Return type:: dfdatetime.DateTimeValues

property data_streams

Retrieves data streams.

Returns:: data streams.
Return type:: generator[DataStream]

property deletion_time

Retrieves the deletion time.

Returns:: deletion time or None if not available.
Return type:: dfdatetime.DateTimeValues

property link

Retrieves the path of a linked file entry.

Returns:: full path of the linked file entry or None if not available.
Return type:: str

property modification_time

Retrieves the modification time.

Returns:: modification time or None if not available.
Return type:: dfdatetime.DateTimeValues

abstract property name

Retrieves the name.

Returns:: name of the file entry, without the full path.
Return type:: str

property number_of_attributes

Retrieves the number of attributes.

Returns:: number of attributes.
Return type:: int

property number_of_data_streams

Retrieves the number of data streams.

Returns:: number of data streams.
Return type:: int

property number_of_sub_file_entries

Retrieves the number of sub file entries.

Returns:: number of sub file entries.
Return type:: int

property size

Retrieves the size.

Returns:: size of the file entry in bytes or None if not available.
Return type:: int

property sub_file_entries

Retrieves sub file entries.

Returns:: sub file entries.
Return type:: generator[FileEntry]

property type_indicator

Retrieves the type indicator.

Returns:: type indicator.
Return type:: str

dfvfs.vfs.file_system module

The Virtual File System (VFS) file system interface.

class dfvfs.vfs.file_system.FileSystem(resolver_context, path_spec)[source]

Bases: object

File system interface.

BasenamePath(path)[source]

Determines the basename of the path.

Parameters:: path (str) – path.
Returns:: basename of the path.
Return type:: str

DirnamePath(path)[source]

Determines the directory name of the path.

The file system root is represented by an empty string.

Parameters:: path (str) – path.
Returns:: directory name of the path or None.
Return type:: str

abstractmethod FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: True if the file entry exists.
Return type:: bool

GetDataStreamByPathSpec(path_spec)[source]

Retrieves a data stream for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: a data stream or None if not available.
Return type:: DataStream

abstractmethod GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: a file entry or None if not available.
Return type:: FileEntry

GetFileObjectByPathSpec(path_spec)[source]

Retrieves a file-like object for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: a file-like object or None if not available.
Return type:: FileIO

GetPathSegmentAndSuffix(base_path, path)[source]

Determines the path segment and suffix of the path.

None is returned if the path does not start with the base path and an empty string if the path exactly matches the base path.

Parameters:

base_path (str) – base path.
path (str) – path.

Returns:

path segment and suffix string.

Return type:

tuple[str, str]

abstractmethod GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: a file entry or None if not available.
Return type:: FileEntry

JoinPath(path_segments)[source]

Joins the path segments into a path.

Parameters:: path_segments (list[str]) – path segments.
Returns:: joined path segments prefixed with the path separator.
Return type:: str

LOCATION_ROOT = '/'

Open(path_spec=None, mode='rb')[source]

Opens the file system object defined by path specification.

Parameters:

path_spec (Optional[PathSpec]) – a path specification.
mode (Optional[str]) – file access mode. The default is ‘rb’ which represents read-only binary.

Raises:

AccessError – if the access to open the file was denied.
OSError – if the file system object was already opened or the open failed.
PathSpecError – if the path specification is incorrect.
ValueError – if the path specification or mode is invalid.

PATH_SEPARATOR = '/'

SplitPath(path)[source]

Splits the path into path segments.

Parameters:

path (str) – path.

Returns:

path segments without the root path segment, which is: an empty string.

Return type:

list[str]

__del__()[source]: Cleans up the file system.

__init__(resolver_context, path_spec)[source]

Initializes a file system.

Parameters:

resolver_context (Context) – resolver context.
path_spec (PathSpec) – a path specification.

Raises:

ValueError – if a derived file system class does not define a type indicator.

property type_indicator

type indicator.

Type:: str

dfvfs.vfs.gpt_directory module

The GUID Partition Table (GPT) directory implementation.

class dfvfs.vfs.gpt_directory.GPTDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pyvsgpt.

dfvfs.vfs.gpt_file_entry module

The GUID Partition Table (GPT) file entry implementation.

class dfvfs.vfs.gpt_file_entry.GPTFileEntry(resolver_context, file_system, path_spec, entry_index=None, is_root=False, is_virtual=False, vsgpt_partition=None)[source]

Bases: FileEntry

File system file entry that uses pyvsgpt.

GetGPTPartition()[source]

Retrieves the GPT partition.

Returns:: a GPT partition.
Return type:: pyvsgpt.partition

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None if not available.
Return type:: GPTFileEntry

TYPE_INDICATOR = 'GPT'

__init__(resolver_context, file_system, path_spec, entry_index=None, is_root=False, is_virtual=False, vsgpt_partition=None)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
entry_index (Optional[int]) – GPT partition entry index or None.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file
vsgpt_partition (Optional[pyvsgpt.partition]) – a GPT partition.

Raises:

BackEndError – when GPT partition is missing for a non-virtual file entry.

property name

name of the file entry, without the full path.

Type:: str

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.gpt_file_system module

The GUID Partition Table (GPT) file system implementation.

class dfvfs.vfs.gpt_file_system.GPTFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyvsgpt.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: True if the file entry exists.
Return type:: bool

GetEntryIndexByPathSpec(path_spec)[source]

Retrieves the entry index for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: entry index or None if not available.
Return type:: int

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: a file entry or None if not available.
Return type:: GPTFileEntry

GetGPTPartitionByPathSpec(path_spec)[source]

Retrieves a GPT partition for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: a GPT partition or None if not available.
Return type:: pyvsgpt.partition

GetGPTVolume()[source]

Retrieves the GPT volume.

Returns:: a GPT volume.
Return type:: pyvsgpt.volume

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: root file entry or None if not available.
Return type:: GPTFileEntry

TYPE_INDICATOR = 'GPT'

__init__(resolver_context, path_spec)[source]

Initializes a file system.

Parameters:

resolver_context (Context) – resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.gzip_file_entry module

The gzip file entry implementation.

class dfvfs.vfs.gzip_file_entry.GzipFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

File system file entry that uses gzip.

TYPE_INDICATOR = 'GZIP'

__init__(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file

Raises:

BackEndError – when the gzip file is missing.

property modification_time

modification time or None if not available.

Type:: dfdatetime.DateTimeValues

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.gzip_file_system module

The gzip file system implementation.

class dfvfs.vfs.gzip_file_system.GzipFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

File system that uses gzip.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: a file entry or None if not available.
Return type:: GzipFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: a file entry or None if not available.
Return type:: GzipFileEntry

TYPE_INDICATOR = 'GZIP'

dfvfs.vfs.hfs_attribute module

The HFS attribute implementation.

class dfvfs.vfs.hfs_attribute.HFSExtendedAttribute(fshfs_extended_attribute)[source]

Bases: Attribute

HFS extended attribute that uses pyfshfs.

GetExtents()[source]

Retrieves the extents.

Returns:: the extents of the attribute data.
Return type:: list[Extent]

__init__(fshfs_extended_attribute)[source]

Initializes an attribute.

Parameters:: fshfs_extended_attribute (pyfshfs.extended_attribute) – HFS extended attribute.
Raises:: BackEndError – if the pyfshfs extended attribute is missing.

get_offset()[source]

Retrieves the current offset into the file input/output (IO) object.

Returns:: current offset into the file input/output (IO) object.
Return type:: int

get_size()[source]

Retrieves the size of the file input/output (IO) object.

Returns:: size of the file input/output (IO) object.
Return type:: int

property name

name.

Type:: str

read(size=None)[source]

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:: size (Optional[int]) – number of bytes to read, where None is all remaining data.
Returns:: data read.
Return type:: bytes
Raises:: OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file input/output (IO) object.

Parameters:

offset (int) – offset to seek.
whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises:

OSError – if the seek failed.

seekable()[source]

Determines if a file input/output (IO) object is seekable.

Returns:: True since a file IO object provides a seek method.
Return type:: bool

tell()[source]: Retrieves the current offset into the file input/output (IO) object.

dfvfs.vfs.hfs_data_stream module

The HFS data stream implementation.

class dfvfs.vfs.hfs_data_stream.HFSDataStream(file_entry, fshfs_data_stream)[source]

Bases: DataStream

File system data stream that uses pyfshfs.

GetExtents()[source]

Retrieves the extents.

Returns:: the extents of the data stream.
Return type:: list[Extent]

__init__(file_entry, fshfs_data_stream)[source]

Initializes a HFS data stream.

Parameters:

file_entry (FileEntry) – file entry.
fshfs_data_stream (pyfshfs.data_stream) – HFS data stream.

dfvfs.vfs.hfs_directory module

The HFS directory implementation.

class dfvfs.vfs.hfs_directory.HFSDirectory(file_system, path_spec, fshfs_file_entry)[source]

Bases: Directory

File system directory that uses pyfshfs.

__init__(file_system, path_spec, fshfs_file_entry)[source]

Initializes a directory.

Parameters:

file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
fshfs_file_entry (pyfshfs.file_entry) – HFS file entry.

dfvfs.vfs.hfs_file_entry module

The HFS file entry implementation.

class dfvfs.vfs.hfs_file_entry.HFSFileEntry(resolver_context, file_system, path_spec, fshfs_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyfshfs.

GetExtents()[source]

Retrieves the extents.

Returns:: the extents.
Return type:: list[Extent]

GetFileObject(data_stream_name='')[source]

Retrieves a file-like object of a specific data stream.

Parameters:: data_stream_name (Optional[str]) – name of the data stream, where an empty string represents the default data stream.
Returns:: a file-like object or None if not available.
Return type:: FileIO

GetHFSFileEntry()[source]

Retrieves the HFS file entry.

Returns:: HFS file entry.
Return type:: pyfshfs.file_entry

GetLinkedFileEntry()[source]

Retrieves the linked file entry, e.g. for a symbolic link.

Returns:: linked file entry or None if not available.
Return type:: HFSFileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None if not available.
Return type:: HFSFileEntry

TYPE_INDICATOR = 'HFS'

__init__(resolver_context, file_system, path_spec, fshfs_file_entry=None, is_root=False, is_virtual=False)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
fshfs_file_entry (Optional[pyfshfs.file_entry]) – HFS file entry.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file entry emulated by the corresponding file system.

Raises:

BackEndError – if the pyfshfs file entry is missing.

property access_time

access time or None if not available.

Type:: dfdatetime.DateTimeValues

property added_time

added time or None if not available.

Type:: dfdatetime.DateTimeValues

property backup_time

backup time or None if not available.

Type:: dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type:: dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type:: dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type:: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type:: str

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.hfs_file_system module

The HFS file system implementation.

class dfvfs.vfs.hfs_file_system.HFSFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfshfs.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: True if the file entry exists.
Return type:: bool
Raises:: BackEndError – if the file entry cannot be opened.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: file entry or None if not available.
Return type:: HFSFileEntry
Raises:: BackEndError – if the file entry cannot be opened.

GetHFSFileEntryByPathSpec(path_spec)[source]

Retrieves the HFS file entry for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: file entry.
Return type:: pyfshfs.file_entry
Raises:: PathSpecError – if the path specification is missing location and identifier.

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: file entry.
Return type:: HFSFileEntry

ROOT_DIRECTORY_IDENTIFIER_NUMBER = 2

TYPE_INDICATOR = 'HFS'

__init__(resolver_context, path_spec)[source]

Initializes an HFS file system.

Parameters:

resolver_context (Context) – resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.luksde_file_entry module

The LUKSDE file entry implementation.

class dfvfs.vfs.luksde_file_entry.LUKSDEFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

File system file entry that uses pyluksde.

IsLocked()[source]

Determines if the file entry is locked.

Returns:: True if the file entry is locked.
Return type:: bool

TYPE_INDICATOR = 'LUKSDE'

Unlock()[source]

Unlocks the file entry.

Returns:: True if the file entry was unlocked.
Return type:: bool

__init__(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Initializes the file entry object.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file

Raises:

BackEndError – when the LUKSDE volume is missing.

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.luksde_file_system module

The LUKSDE file system implementation.

class dfvfs.vfs.luksde_file_system.LUKSDEFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

File system that uses pyluksde.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: file entry or None.
Return type:: LUKSDEFileEntry

GetLUKSDEVolume()[source]

Retrieves the LUKSDE volume.

Returns:: LUKSDE volume.
Return type:: pyluksde.volume

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: file entry or None.
Return type:: LUKSDEFileEntry

TYPE_INDICATOR = 'LUKSDE'

__init__(resolver_context, path_spec)[source]

Initializes a file system.

Parameters:

resolver_context (Context) – resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.lvm_directory module

The Logical Volume Manager (LVM) directory implementation.

class dfvfs.vfs.lvm_directory.LVMDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pyvslvm.

dfvfs.vfs.lvm_file_entry module

The Logical Volume Manager (LVM) file entry implementation.

class dfvfs.vfs.lvm_file_entry.LVMFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, vslvm_logical_volume=None)[source]

Bases: FileEntry

File system file entry that uses pyvslvm.

GetLVMLogicalVolume()[source]

Retrieves the LVM logical volume.

Returns:: a LVM logical volume.
Return type:: pyvslvm.logical_volume

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None if not available.
Return type:: LVMFileEntry

TYPE_INDICATOR = 'LVM'

__init__(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, vslvm_logical_volume=None)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file
vslvm_logical_volume (Optional[pyvslvm.logical_volume]) – a LVM logical volume.

Raises:

BackEndError – when LVM logical volume is missing for a non-virtual file entry.

property name

name of the file entry, without the full path.

Type:: str

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.lvm_file_system module

The Logical Volume Manager (LVM) file system implementation.

class dfvfs.vfs.lvm_file_system.LVMFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyvslvm.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: True if the file entry exists.
Return type:: bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: a file entry or None if not available.
Return type:: LVMFileEntry

GetLVMLogicalVolumeByPathSpec(path_spec)[source]

Retrieves a LVM logical volume for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: a LVM logical volume or None if not available.
Return type:: pyvslvm.logical_volume

GetLVMVolumeGroup()[source]

Retrieves the LVM volume group.

Returns:: a LVM volume group.
Return type:: pyvslvm.volume_group

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: root file entry or None if not available.
Return type:: LVMFileEntry

TYPE_INDICATOR = 'LVM'

__init__(resolver_context, path_spec)[source]

Initializes a file system.

Parameters:

resolver_context (Context) – resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.ntfs_attribute module

The NTFS attribute implementations.

class dfvfs.vfs.ntfs_attribute.FileNameNTFSAttribute(fsntfs_attribute)[source]

Bases: NTFSAttribute

NTFS $FILE_NAME file system attribute.

TYPE_INDICATOR = 'NTFS:$FILE_NAME'

property access_time

access time or None if not set.

Type:: dfdatetime.Filetime

property creation_time

creation time or None if not set.

Type:: dfdatetime.Filetime

property entry_modification_time

entry modification time or None if not set.

Type:: dfdatetime.Filetime

property file_attribute_flags

file attribute flags or None if not available.

Type:: int

property modification_time

modification time.

Type:: dfdatetime.Filetime

property name

name.

Type:: str

property name_space

name_space.

Type:: int

property parent_file_reference

parent file reference.

Type:: int

class dfvfs.vfs.ntfs_attribute.NTFSAttribute(fsntfs_attribute)[source]

Bases: Attribute

File system attribute that uses pyfsntfs.

__init__(fsntfs_attribute)[source]

Initializes an attribute.

Parameters:: fsntfs_attribute (pyfsntfs.attribute) – NTFS attribute.
Raises:: BackEndError – if the pyfsntfs attribute is missing.

property attribute_type: The attribute type.

class dfvfs.vfs.ntfs_attribute.ObjectIdentifierNTFSAttribute(fsntfs_attribute)[source]

Bases: NTFSAttribute

NTFS $OBJECT_ID file system attribute.

TYPE_INDICATOR = 'NTFS:$OBJECT_ID'

property droid_file_identifier

droid file identifier, formatted as an UUID.

Type:: str

class dfvfs.vfs.ntfs_attribute.SecurityDescriptorNTFSAttribute(fsntfs_attribute)[source]

Bases: NTFSAttribute

NTFS $SECURITY_DESCRIPTOR file system attribute.

TYPE_INDICATOR = 'NTFS:$SECURITY_DESCRIPTOR'

property security_descriptor

security descriptor.

Type:: pyfwnt.security_descriptor

class dfvfs.vfs.ntfs_attribute.StandardInformationNTFSAttribute(fsntfs_attribute)[source]

Bases: NTFSAttribute

NTFS $STANDARD_INFORMATION file system attribute.

TYPE_INDICATOR = 'NTFS:$STANDARD_INFORMATION'

property access_time

access time or None if not set.

Type:: dfdatetime.Filetime

property creation_time

creation time or None if not set.

Type:: dfdatetime.Filetime

property entry_modification_time

entry modification time or None if not set.

Type:: dfdatetime.Filetime

property file_attribute_flags

file attribute flags or None if not available.

Type:: int

property modification_time

modification time or None if not set.

Type:: dfdatetime.Filetime

property owner_identifier

owner identifier.

Type:: int

property security_descriptor_identifier

security descriptor identifier.

Type:: int

property update_sequence_number

update sequence number.

Type:: int

dfvfs.vfs.ntfs_data_stream module

The NTFS data stream implementation.

class dfvfs.vfs.ntfs_data_stream.NTFSDataStream(file_entry, fsntfs_data_stream)[source]

Bases: DataStream

File system data stream that uses pyfsntfs.

GetExtents()[source]

Retrieves the extents.

Returns:: the extents of the data stream.
Return type:: list[Extent]

__init__(file_entry, fsntfs_data_stream)[source]

Initializes a NTFS data stream.

Parameters:

file_entry (FileEntry) – file entry.
fsntfs_data_stream (pyfsntfs.data_stream) – NTFS data stream.

dfvfs.vfs.ntfs_directory module

The NTFS directory implementation.

class dfvfs.vfs.ntfs_directory.NTFSDirectory(file_system, path_spec, fsntfs_file_entry)[source]

Bases: Directory

File system directory that uses pyfsntfs.

__init__(file_system, path_spec, fsntfs_file_entry)[source]

Initializes a directory.

Parameters:

file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
fsntfs_file_entry (pyfsntfs.file_entry) – NTFS file entry.

dfvfs.vfs.ntfs_file_entry module

The NTFS file entry implementation.

class dfvfs.vfs.ntfs_file_entry.NTFSFileEntry(resolver_context, file_system, path_spec, fsntfs_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyfsntfs.

GetExtents()[source]

Retrieves the extents.

Returns:: the extents.
Return type:: list[Extent]

GetFileObject(data_stream_name='')[source]

Retrieves a file-like object of a specific data stream.

Parameters:: data_stream_name (Optional[str]) – data stream name, where an empty string represents the default data stream.
Returns:: file-like object or None.
Return type:: NTFSFileIO

GetLinkedFileEntry()[source]

Retrieves the linked file entry, e.g. for a symbolic link.

Returns:: linked file entry or None.
Return type:: NTFSFileEntry

GetNTFSFileEntry()[source]

Retrieves the NTFS file entry.

Returns:: NTFS file entry.
Return type:: pyfsntfs.file_entry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None if not available.
Return type:: NTFSFileEntry

GetSecurityDescriptor()[source]

Retrieves the security descriptor.

Returns:: security descriptor.
Return type:: pyfwnt.security_descriptor

IsAllocated()[source]

Determines if the file entry is allocated.

Returns:: True if the file entry is allocated.
Return type:: bool

TYPE_INDICATOR = 'NTFS'

__init__(resolver_context, file_system, path_spec, fsntfs_file_entry=None, is_root=False, is_virtual=False)[source]

Initializes the file entry object.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
fsntfs_file_entry (Optional[pyfsntfs.file_entry]) – NTFS file entry.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file entry emulated by the corresponding file system.

Raises:

BackEndError – if the pyfsntfs file entry is missing.

property access_time

access time or None if not available.

Type:: dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type:: dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type:: dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type:: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type:: str

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.ntfs_file_system module

The NTFS file system implementation.

class dfvfs.vfs.ntfs_file_system.NTFSFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfsntfs.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: True if the file entry exists.
Return type:: bool
Raises:: BackEndError – if the file entry cannot be opened.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: file entry or None if not available.
Return type:: NTFSFileEntry
Raises:: BackEndError – if the file entry cannot be opened.

GetNTFSFileEntryByPathSpec(path_spec)[source]

Retrieves the NTFS file entry for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: NTFS file entry.
Return type:: pyfsntfs.file_entry
Raises:: PathSpecError – if the path specification is missing location and MFT entry.

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: file entry.
Return type:: NTFSFileEntry

LOCATION_ROOT = '\\'

MFT_ENTRY_ROOT_DIRECTORY = 5

PATH_SEPARATOR = '\\'

TYPE_INDICATOR = 'NTFS'

__init__(resolver_context, path_spec)[source]

Initializes a file system object.

Parameters:

resolver_context (Context) – resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.os_attribute module

The operating system attribute implementation.

class dfvfs.vfs.os_attribute.OSExtendedAttribute(location, name)[source]

Bases: Attribute

Extended attribute that uses the operating system.

__init__(location, name)[source]

Initializes an attribute.

Parameters:

location (str) – path of the file.
name (str) – name of the extended attribute.

get_offset()[source]

Retrieves the current offset into the file input/output (IO) object.

Returns:: current offset into the file input/output (IO) object.
Return type:: int

get_size()[source]

Retrieves the size of the file input/output (IO) object.

Returns:: size of the file input/output (IO) object.
Return type:: int

property name

name.

Type:: str

read(size=None)[source]

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:: size (Optional[int]) – number of bytes to read, where None is all remaining data.
Returns:: data read.
Return type:: bytes
Raises:: OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file input/output (IO) object.

Parameters:

offset (int) – offset to seek.
whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises:

OSError – if the seek failed.

seekable()[source]

Determines if a file input/output (IO) object is seekable.

Returns:: True since a file IO object provides a seek method.
Return type:: bool

tell()[source]: Retrieves the current offset into the file input/output (IO) object.

dfvfs.vfs.os_directory module

The operating system directory implementation.

class dfvfs.vfs.os_directory.OSDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses the operating system.

dfvfs.vfs.os_file_entry module

The operating system file entry implementation.

class dfvfs.vfs.os_file_entry.OSFileEntry(resolver_context, file_system, path_spec, is_root=False)[source]

Bases: FileEntry

File system file entry that uses os.

GetLinkedFileEntry()[source]

Retrieves the linked file entry, for example for a symbolic link.

Returns:: linked file entry or None if not available.
Return type:: OSFileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None if not available.
Return type:: OSFileEntry

TYPE_INDICATOR = 'OS'

__init__(resolver_context, file_system, path_spec, is_root=False)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.

property access_time

access time or None if not available.

Type:: dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type:: dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type:: dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type:: dfdatetime.DateTimeValues

property name

name of the file entry, without the full path.

Type:: str

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.os_file_system module

The operating system file system implementation.

class dfvfs.vfs.os_file_system.OSFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses the operating system.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: True if the file entry exists, false otherwise.
Return type:: bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: a file entry or None if not available.
Return type:: OSFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: a file entry or None if not available.
Return type:: OSFileEntry

JoinPath(path_segments)[source]

Joins the path segments into a path.

Parameters:: path_segments (list[str]) – path segments.
Returns:: joined path segments prefixed with the path separator.
Return type:: str

PATH_SEPARATOR = '/'

TYPE_INDICATOR = 'OS'

dfvfs.vfs.root_only_file_entry module

The root only file system file entry implementation.

class dfvfs.vfs.root_only_file_entry.RootOnlyFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: FileEntry

Root only file system file entry.

property name

name of the file entry, without the full path.

Type:: str

dfvfs.vfs.root_only_file_system module

The root only file system implementation.

class dfvfs.vfs.root_only_file_system.RootOnlyFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

Root only file system.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: True if the file entry exists.
Return type:: bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: a file entry or None if not available.
Return type:: FileEntry

abstractmethod GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: a file entry or None if not available.
Return type:: FileEntry

dfvfs.vfs.sqlite_blob_directory module

The SQLite blob directory implementation.

class dfvfs.vfs.sqlite_blob_directory.SQLiteBlobDirectory(file_system, path_spec)[source]

Bases: Directory

SQLite blob directory.

__init__(file_system, path_spec)[source]

Initializes a directory.

Parameters:

file_system (SQLiteBlobFileSystem) – file system.
path_spec (SQLiteBlobPathSpec) – path specification.

dfvfs.vfs.sqlite_blob_file_entry module

The SQLite blob file entry implementation.

class dfvfs.vfs.sqlite_blob_file_entry.SQLiteBlobFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: FileEntry

SQLite blob file entry.

GetNumberOfRows()[source]

Retrieves the number of rows in the table.

Returns:: number of rows.
Return type:: int
Raises:: BackEndError – when the SQLite blob file-like object is missing.

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None if not available.
Return type:: SQLiteBlobFileEntry

TYPE_INDICATOR = 'SQLITE_BLOB'

__init__(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file entry emulated by the corresponding file system.

property name

name of the file entry, which does not include the full path.

Type:: str

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.sqlite_blob_file_system module

The SQLite blob file system implementation.

class dfvfs.vfs.sqlite_blob_file_system.SQLiteBlobFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

Class that implements a file system object using SQLite blob.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: True if the file entry exists.
Return type:: bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: a file entry or None.
Return type:: FileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: a file entry or None.
Return type:: FileEntry

TYPE_INDICATOR = 'SQLITE_BLOB'

__init__(resolver_context, path_spec)[source]

Initializes a file system.

Parameters:

resolver_context (Context) – resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.tar_directory module

The TAR directory implementation.

class dfvfs.vfs.tar_directory.TARDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses tarfile.

dfvfs.vfs.tar_file_entry module

The TAR file entry implementation.

class dfvfs.vfs.tar_file_entry.TARFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, tar_info=None)[source]

Bases: FileEntry

File system file entry that uses tarfile.

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None.
Return type:: TARFileEntry

GetTARInfo()[source]

Retrieves the TAR info.

Returns:: TAR info or None if it does not exist.
Return type:: tarfile.TARInfo
Raises:: PathSpecError – if the path specification is incorrect.

TYPE_INDICATOR = 'TAR'

__init__(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, tar_info=None)[source]

Initializes the file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file entry emulated by the corresponding file system.
tar_info (Optional[tarfile.TARInfo]) – TAR info.

Raises:

BackEndError – when the TAR info is missing in a non-virtual file entry.

property modification_time

modification time or None if not available.

Type:: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type:: str

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.tar_file_system module

The TAR file system implementation.

class dfvfs.vfs.tar_file_system.TARFileSystem(resolver_context, path_spec, encoding='utf-8')[source]

Bases: FileSystem

Class that implements a file system using tarfile.

encoding

file entry name encoding.

Type:: str

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: True if the file entry exists.
Return type:: bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: file entry or None.
Return type:: TARFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: file entry.
Return type:: TARFileEntry

GetTARFile()[source]

Retrieves the TAR file.

Returns:: TAR file.
Return type:: tarfile.TARFile

GetTARInfoByPathSpec(path_spec)[source]

Retrieves the TAR info for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: TAR info or None if it does not exist.
Return type:: tarfile.TARInfo
Raises:: PathSpecError – if the path specification is incorrect.

TYPE_INDICATOR = 'TAR'

__init__(resolver_context, path_spec, encoding='utf-8')[source]

Initializes a file system.

Parameters:

resolver_context (Context) – resolver context.
path_spec (PathSpec) – a path specification.
encoding (Optional[str]) – file entry name encoding.

dfvfs.vfs.tsk_attribute module

The SleuthKit (TSK) attribute implementation.

class dfvfs.vfs.tsk_attribute.TSKAttribute(tsk_file, tsk_attribute)[source]

Bases: Attribute

File system attribute that uses pytsk3.

__init__(tsk_file, tsk_attribute)[source]

Initializes an attribute.

Parameters:

tsk_file (pytsk3.File) – TSK file.
tsk_attribute (pytsk3.Attribute) – TSK attribute.

Raises:

BackEndError – if the TSK file or attribute is missing.

property attribute_type

attribute type.

Type:: object

class dfvfs.vfs.tsk_attribute.TSKExtendedAttribute(tsk_file, tsk_attribute)[source]

Bases: TSKAttribute

File system extended attribute that uses pytsk3.

__init__(tsk_file, tsk_attribute)[source]

Initializes an attribute.

Parameters:

tsk_file (pytsk3.File) – TSK file.
tsk_attribute (pytsk3.Attribute) – TSK attribute.

get_offset()[source]

Retrieves the current offset into the file input/output (IO) object.

Returns:: current offset into the file input/output (IO) object.
Return type:: int

get_size()[source]

Retrieves the size of the file input/output (IO) object.

Returns:: size of the file input/output (IO) object.
Return type:: int

property name

name.

Raises:: BackEndError – if pytsk3 returns a non UTF-8 formatted name.
Type:: str

read(size=None)[source]

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:: size (Optional[int]) – number of bytes to read, where None is all remaining data.
Returns:: data read.
Return type:: bytes
Raises:: OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file input/output (IO) object.

Parameters:

offset (int) – offset to seek.
whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises:

OSError – if the seek failed.

seekable()[source]

Determines if a file input/output (IO) object is seekable.

Returns:: True since a file IO object provides a seek method.
Return type:: bool

tell()[source]: Retrieves the current offset into the file input/output (IO) object.

dfvfs.vfs.tsk_data_stream module

The SleuthKit (TSK) data stream implementation.

class dfvfs.vfs.tsk_data_stream.TSKDataStream(file_entry, pytsk_attribute)[source]

Bases: DataStream

File system data stream that uses pytsk3.

GetExtents()[source]

Retrieves the extents.

Returns:: the extents of the data stream.
Return type:: list[Extent]
Raises:: BackEndError – if pytsk3 returns no file system block size or data stream size.

__init__(file_entry, pytsk_attribute)[source]

Initializes a data stream.

Parameters:

file_entry (FileEntry) – file entry.
pytsk_attribute (pytsk3.Attribute) – TSK attribute.

dfvfs.vfs.tsk_directory module

The SleuthKit (TSK) directory implementation.

class dfvfs.vfs.tsk_directory.TSKDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pytsk3.

dfvfs.vfs.tsk_file_entry module

The SleuthKit (TSK) file entry implementation.

class dfvfs.vfs.tsk_file_entry.TSKFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, parent_inode=None, tsk_file=None)[source]

Bases: FileEntry

File system file entry that uses pytsk3.

GetExtents()[source]

Retrieves the extents.

Returns:: the extents.
Return type:: list[Extent]
Raises:: BackEndError – if pytsk3 returns no file system block size or data stream size.

GetFileObject(data_stream_name='')[source]

Retrieves a file-like object of a specific data stream.

Parameters:: data_stream_name (Optional[str]) – data stream name, where an empty string represents the default data stream.
Returns:: file-like object or None.
Return type:: TSKFileIO

GetLinkedFileEntry()[source]

Retrieves the linked file entry, e.g. for a symbolic link.

Returns:: linked file entry or None.
Return type:: TSKFileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None.
Return type:: TSKFileEntry

GetTSKFile()[source]

Retrieves the SleuthKit file object.

Returns:: TSK file.
Return type:: pytsk3.File
Raises:: PathSpecError – if the path specification is missing inode and location.

IsAllocated()[source]

Determines if the file entry is allocated.

Returns:: True if the file entry is allocated.
Return type:: bool

TYPE_INDICATOR = 'TSK'

__init__(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, parent_inode=None, tsk_file=None)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (TSKFileSystem) – file system.
path_spec (PathSpec) – path specification.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file entry emulated by the corresponding file system.
parent_inode (Optional[int]) – parent inode number.
tsk_file (Optional[pytsk3.File]) – TSK file.

Raises:

BackEndError – if the TSK File .info or .info.meta attribute is missing.

property access_time

access time or None if not available.

Type:: dfdatetime.DateTimeValues

property backup_time

backup time or None if not available.

Type:: dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type:: dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type:: dfdatetime.DateTimeValues

property deletion_time

deletion time or None if not available.

Type:: dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type:: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Raises:: BackEndError – if pytsk3 returns a non UTF-8 formatted name.
Type:: str

property size

size of the file entry in bytes or None if not available.

Type:: int

class dfvfs.vfs.tsk_file_entry.TSKTime(*args: Any, **kwargs: Any)[source]

Bases: DateTimeValues

SleuthKit timestamp.

fraction_of_second

fraction of second, which is an integer that contains the number 100 nano seconds before Sleuthkit 4.2.0 or number of nano seconds in Sleuthkit 4.2.0 and later.

Type:: int

CopyFromDateTimeString(time_string)[source]

Copies a SleuthKit timestamp from a date and time string.

Parameters:

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3, 6 or 9 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

CopyToDateTimeString()[source]

Copies the date time value to a date and time string.

Returns:

date and time value formatted as:: YYYY-MM-DD hh:mm:ss or YYYY-MM-DD hh:mm:ss.####### or YYYY-MM-DD hh:mm:ss.#########

Return type:

str

GetDate()[source]

Retrieves the date represented by the date and time values.

Returns:

year, month, day of month or (None, None, None): if the date and time values do not represent a date.

Return type:

tuple[int, int, int]

__init__(fraction_of_second=None, precision=None, time_zone_offset=None, timestamp=None)[source]

Initializes a SleuthKit timestamp.

Parameters:

fraction_of_second (Optional[int]) – fraction of second, which is an integer that contains the number 100 nano seconds before Sleuthkit 4.2.0 or number of nano seconds in Sleuthkit 4.2.0 and later.
precision (Optional[int]) – precision of the date and time value, which should be one of the PRECISION_VALUES in dfDateTime definitions.
time_zone_offset (Optional[int]) – time zone offset in number of minutes from UTC or None if not set.
timestamp (Optional[int]) – POSIX timestamp.

property timestamp

POSIX timestamp in microseconds or None if timestamp is not set.

Type:: int

dfvfs.vfs.tsk_file_system module

The SleuthKit (TSK) file system implementation.

class dfvfs.vfs.tsk_file_system.TSKFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pytsk3.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: True if the file entry exists.
Return type:: bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: a file entry or None if not available.
Return type:: TSKFileEntry

GetFsInfo()[source]

Retrieves the file system info.

Returns:: file system info.
Return type:: pytsk3.FS_Info

GetFsType()[source]

Retrieves the file system type.

Returns:: file system type.
Return type:: pytsk3.TSK_FS_TYPE_ENUM

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: a file entry.
Return type:: TSKFileEntry

GetRootInode()[source]

Retrieves the root inode.

Returns:: inode number or None if not available.
Return type:: int

GetTSKFileByPathSpec(path_spec)[source]

Retrieves the SleuthKit file object for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: TSK file.
Return type:: pytsk3.File
Raises:: PathSpecError – if the path specification is missing inode and location.

IsExt()[source]

Determines if the file system is ext2, ext3 or ext4.

Returns:: True if the file system is ext.
Return type:: bool

IsFat()[source]

Determines if the file system is FAT-12, FAT-16 or FAT-32.

Returns:: True if the file system is FAT.
Return type:: bool

IsHFS()[source]

Determines if the file system is HFS, HFS+ or HFSX.

Returns:: True if the file system is HFS.
Return type:: bool

IsNTFS()[source]

Determines if the file system is NTFS.

Returns:: True if the file system is NTFS.
Return type:: bool

TYPE_INDICATOR = 'TSK'

__init__(resolver_context, path_spec)[source]

Initializes a file system.

Parameters:

resolver_context (Context) – resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.tsk_partition_directory module

The SleuthKit (TSK) partition directory implementation.

class dfvfs.vfs.tsk_partition_directory.TSKPartitionDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pytsk3.

dfvfs.vfs.tsk_partition_file_entry module

The SleuthKit (TSK) partition file entry implementation.

class dfvfs.vfs.tsk_partition_file_entry.TSKPartitionFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, tsk_vs_part=None)[source]

Bases: FileEntry

File system file entry that uses pytsk3.

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None if not available.
Return type:: TSKPartitionFileEntry

GetTSKVsPart()[source]

Retrieves the TSK volume system part.

Returns:

a TSK volume system part or None if not: available.

Return type:

pytsk3.TSK_VS_PART_INFO

IsAllocated()[source]

Determines if the file entry is allocated.

Returns:: True if the file entry is allocated.
Return type:: bool

TYPE_INDICATOR = 'TSK_PARTITION'

__init__(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, tsk_vs_part=None)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file entry emulated by the corresponding file system.
tsk_vs_part (Optional[pytsk3.TSK_VS_PART_INFO]) – TSK volume system part.

Raises:

BackEndError – when the TSK volume system part is missing in a non-virtual file entry.

property name

name of the file entry, which does not include the full path.

Type:: str

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.tsk_partition_file_system module

The SleuthKit (TSK) partition file system implementation.

class dfvfs.vfs.tsk_partition_file_system.TSKPartitionFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

Class that implements a file system object using pytsk3.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: True if the file entry exists or false otherwise.
Return type:: bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: a file entry or None of not available.
Return type:: TSKPartitionFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: a file entry or None of not available.
Return type:: TSKPartitionFileEntry

GetTSKVolume()[source]

Retrieves the TSK volume object.

Returns:: a TSK volume object.
Return type:: pytsk3.Volume_Info

TYPE_INDICATOR = 'TSK_PARTITION'

__init__(resolver_context, path_spec)[source]

Initializes a file system object.

Parameters:

resolver_context (Context) – a resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.vshadow_directory module

The Volume Shadow Snapshots (VSS) directory implementation.

class dfvfs.vfs.vshadow_directory.VShadowDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pyvshadow.

dfvfs.vfs.vshadow_file_entry module

The Volume Shadow Snapshots (VSS) file entry implementation.

class dfvfs.vfs.vshadow_file_entry.VShadowFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyvshadow.

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None if not available.
Return type:: FileEntry

GetVShadowStore()[source]

Retrieves a VSS store.

Returns:: a VSS store or None if not available.
Return type:: pyvshadow.store

HasExternalData()[source]

Determines if the file entry has external stored data.

Returns:: True if the file entry has external data.
Return type:: bool

TYPE_INDICATOR = 'VSHADOW'

__init__(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file entry emulated by the corresponding file system.

Raises:

BackEndError – when the vshadow store is missing in a non-virtual file entry.

property creation_time

creation time or None if not available.

Type:: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type:: str

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.vshadow_file_system module

The Volume Shadow Snapshots (VSS) file system implementation.

class dfvfs.vfs.vshadow_file_system.VShadowFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyvshadow.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: True if the file entry exists.
Return type:: bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: file entry or None if not available.
Return type:: VShadowFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: file entry or None if not available.
Return type:: VShadowFileEntry

GetVShadowStoreByPathSpec(path_spec)[source]

Retrieves a VSS store for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: a VSS store or None if not available.
Return type:: pyvshadow.store

GetVShadowVolume()[source]

Retrieves a VSS volume.

Returns:: a VSS volume.
Return type:: pyvshadow.volume

TYPE_INDICATOR = 'VSHADOW'

__init__(resolver_context, path_spec)[source]

Initializes a file system.

Parameters:

resolver_context (Context) – resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.xfs_attribute module

The XFS attribute implementation.

class dfvfs.vfs.xfs_attribute.XFSExtendedAttribute(fsxfs_extended_attribute)[source]

Bases: Attribute

XFS extended attribute that uses pyfsxfs.

GetExtents()[source]

Retrieves the extents.

Returns:: the extents of the attribute data.
Return type:: list[Extent]

__init__(fsxfs_extended_attribute)[source]

Initializes an attribute.

Parameters:: fsxfs_extended_attribute (pyfsxfs.extended_attribute) – XFS extended attribute.
Raises:: BackEndError – if the pyfsxfs extended attribute is missing.

get_offset()[source]

Retrieves the current offset into the file input/output (IO) object.

Returns:: current offset into the file input/output (IO) object.
Return type:: int

get_size()[source]

Retrieves the size of the file input/output (IO) object.

Returns:: size of the file input/output (IO) object.
Return type:: int

property name

name.

Type:: str

read(size=None)[source]

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters:: size (Optional[int]) – number of bytes to read, where None is all remaining data.
Returns:: data read.
Return type:: bytes
Raises:: OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file input/output (IO) object.

Parameters:

offset (int) – offset to seek.
whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises:

OSError – if the seek failed.

seekable()[source]

Determines if a file input/output (IO) object is seekable.

Returns:: True since a file IO object provides a seek method.
Return type:: bool

tell()[source]: Retrieves the current offset into the file input/output (IO) object.

dfvfs.vfs.xfs_directory module

The XFS directory implementation.

class dfvfs.vfs.xfs_directory.XFSDirectory(file_system, path_spec, fsxfs_file_entry)[source]

Bases: Directory

File system directory that uses pyfsxfs.

__init__(file_system, path_spec, fsxfs_file_entry)[source]

Initializes a directory.

Parameters:

file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
fsxfs_file_entry (pyfsxfs.file_entry) – XFS file entry.

dfvfs.vfs.xfs_file_entry module

The XFS file entry implementation.

class dfvfs.vfs.xfs_file_entry.XFSFileEntry(resolver_context, file_system, path_spec, fsxfs_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyfsxfs.

GetExtents()[source]

Retrieves the extents.

Returns:: the extents.
Return type:: list[Extent]

GetLinkedFileEntry()[source]

Retrieves the linked file entry, e.g. for a symbolic link.

Returns:: linked file entry or None if not available.
Return type:: XFSFileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None if not available.
Return type:: XFSFileEntry

GetXFSFileEntry()[source]

Retrieves the XFS file entry.

Returns:: XFS file entry.
Return type:: pyfsxfs.file_entry

TYPE_INDICATOR = 'XFS'

__init__(resolver_context, file_system, path_spec, fsxfs_file_entry=None, is_root=False, is_virtual=False)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
fsxfs_file_entry (Optional[pyfsxfs.file_entry]) – XFS file entry.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file entry emulated by the corresponding file system.

Raises:

BackEndError – if the pyfsxfs file entry is missing.

property access_time

access time or None if not available.

Type:: dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type:: dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type:: dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type:: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type:: str

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.xfs_file_system module

The XFS file system implementation.

class dfvfs.vfs.xfs_file_system.XFSFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfsxfs.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: True if the file entry exists.
Return type:: bool
Raises:: BackEndError – if the file entry cannot be opened.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification.
Returns:: file entry or None if not available.
Return type:: XFSFileEntry
Raises:: BackEndError – if the file entry cannot be opened.

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: file entry.
Return type:: XFSFileEntry

GetXFSFileEntryByPathSpec(path_spec)[source]

Retrieves the XFS file entry for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: file entry.
Return type:: pyfsxfs.file_entry
Raises:: PathSpecError – if the path specification is missing location and inode.

TYPE_INDICATOR = 'XFS'

__init__(resolver_context, path_spec)[source]

Initializes an XFS file system.

Parameters:

resolver_context (Context) – resolver context.
path_spec (PathSpec) – a path specification.

dfvfs.vfs.zip_directory module

The ZIP directory implementation.

class dfvfs.vfs.zip_directory.ZIPDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses zipfile.

dfvfs.vfs.zip_file_entry module

The ZIP file entry implementation.

class dfvfs.vfs.zip_file_entry.ZipFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, zip_info=None)[source]

Bases: FileEntry

File system file entry that uses zipfile.

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns:: parent file entry or None if not available.
Return type:: ZipFileEntry

GetZipInfo()[source]

Retrieves the ZIP info object.

Returns:: a ZIP info object or None if not available.
Return type:: zipfile.ZipInfo
Raises:: PathSpecError – if the path specification is incorrect.

TYPE_INDICATOR = 'ZIP'

__init__(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, zip_info=None)[source]

Initializes a file entry.

Parameters:

resolver_context (Context) – resolver context.
file_system (FileSystem) – file system.
path_spec (PathSpec) – path specification.
is_root (Optional[bool]) – True if the file entry is the root file entry of the corresponding file system.
is_virtual (Optional[bool]) – True if the file entry is a virtual file entry emulated by the corresponding file system.
zip_info (Optional[zipfile.ZipInfo]) – ZIP information.

Raises:

BackEndError – when the zip info is missing in a non-virtual file entry.

property modification_time

modification time or None if not available.

Type:: dfdatetime.DateTimeValues

property name

name of the file entry, without the full path.

Type:: str

property size

size of the file entry in bytes or None if not available.

Type:: int

dfvfs.vfs.zip_file_system module

The ZIP file system implementation.

class dfvfs.vfs.zip_file_system.ZipFileSystem(resolver_context, path_spec, encoding='utf-8')[source]

Bases: FileSystem

File system that uses zipfile.

encoding

encoding of the file entry name.

Type:: str

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters:: path_spec (PathSpec) – path specification of the file entry.
Returns:: True if the file entry exists.
Return type:: bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters:: path_spec (PathSpec) – path specification of the file entry.
Returns:: a file entry or None.
Return type:: ZipFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns:: a file entry or None.
Return type:: ZipFileEntry

GetZipFile()[source]

Retrieves the ZIP file object.

Returns:: a ZIP file object or None.
Return type:: zipfile.ZipFile

GetZipInfoByPathSpec(path_spec)[source]

Retrieves the ZIP info for a path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Returns:: a ZIP info object or None if not available.
Return type:: zipfile.ZipInfo
Raises:: PathSpecError – if the path specification is incorrect.

TYPE_INDICATOR = 'ZIP'

__init__(resolver_context, path_spec, encoding='utf-8')[source]

Initializes a file system.

Parameters:

resolver_context (Context) – a resolver context.
path_spec (PathSpec) – a path specification.
encoding (Optional[str]) – encoding of the file entry name.