dfvfs.vfs package
Submodules
dfvfs.vfs.apfs_attribute module
The APFS attribute implementation.
- class dfvfs.vfs.apfs_attribute.APFSExtendedAttribute(fsapfs_extended_attribute)[source]
Bases:
Attribute
APFS extended attribute that uses pyfsapfs.
- GetExtents()[source]
Retrieves the extents.
- Returns
the extents of the attribute data.
- Return type
list[Extent]
- get_offset()[source]
Retrieves the current offset into the file input/output (IO) object.
- Returns
current offset into the file input/output (IO) object.
- Return type
int
- get_size()[source]
Retrieves the size of the file input/output (IO) object.
- Returns
size of the file input/output (IO) object.
- Return type
int
- property name
name.
- Type
str
- read(size=None)[source]
Reads a byte string from the file input/output (IO) object.
The function will read a byte string of the specified size or all of the remaining data if no size was specified.
- Parameters
size (Optional[int]) – number of bytes to read, where None is all remaining data.
- Returns
data read.
- Return type
bytes
- Raises
IOError – if the read failed.
OSError – if the read failed.
- seek(offset, whence=0)[source]
Seeks to an offset within the file input/output (IO) object.
- Parameters
offset (int) – offset to seek.
whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.
- Raises
IOError – if the seek failed.
OSError – if the seek failed.
dfvfs.vfs.apfs_container_directory module
The APFS container directory implementation.
dfvfs.vfs.apfs_container_file_entry module
The APFS container file entry implementation.
- class dfvfs.vfs.apfs_container_file_entry.APFSContainerFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, volume_index=None)[source]
Bases:
FileEntry
File system file entry that uses pyfsapfs.
- GetAPFSVolume()[source]
Retrieves an APFS volume.
- Returns
an APFS volume or None if not available.
- Return type
pyfsapfs.volume
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None if not available.
- Return type
- IsLocked()[source]
Determines if the file entry is locked.
- Returns
True if the file entry is locked.
- Return type
bool
- TYPE_INDICATOR = 'APFS_CONTAINER'
- Unlock()[source]
Unlocks the file entry.
- Returns
True if the file entry was unlocked.
- Return type
bool
- property name
name of the file entry, which does not include the full path.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
- property sub_file_entries
sub file entries.
- Type
generator[APFSContainerFileEntry]
dfvfs.vfs.apfs_container_file_system module
The APFS container file system implementation.
- class dfvfs.vfs.apfs_container_file_system.APFSContainerFileSystem(resolver_context, path_spec)[source]
Bases:
FileSystem
APFS container file system using pyfsapfs.
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
True if the file entry exists.
- Return type
bool
- GetAPFSContainer()[source]
Retrieves the APFS container.
- Returns
the APFS container.
- Return type
pyfsapfs.container
- GetAPFSVolumeByPathSpec(path_spec)[source]
Retrieves an APFS volume for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
an APFS volume or None if not available.
- Return type
pyfsapfs.volume
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
a file entry or None if not exists.
- Return type
- GetVolumeIndexByPathSpec(path_spec)[source]
Retrieves the volume index for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
volume index or None if the index cannot be determined.
- Return type
int
- TYPE_INDICATOR = 'APFS_CONTAINER'
dfvfs.vfs.apfs_directory module
The APFS directory implementation.
dfvfs.vfs.apfs_file_entry module
The APFS file entry implementation.
- class dfvfs.vfs.apfs_file_entry.APFSFileEntry(resolver_context, file_system, path_spec, fsapfs_file_entry=None, is_root=False, is_virtual=False)[source]
Bases:
FileEntry
File system file entry that uses pyfsapfs.
- GetAPFSFileEntry()[source]
Retrieves the APFS file entry.
- Returns
APFS file entry.
- Return type
pyfsapfs.file_entry
- GetLinkedFileEntry()[source]
Retrieves the linked file entry, e.g. for a symbolic link.
- Returns
linked file entry or None if not available.
- Return type
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'APFS'
- property access_time
access time or None if not available.
- Type
dfdatetime.DateTimeValues
- property added_time
added time or None if not available.
- Type
dfdatetime.DateTimeValues
- property change_time
change time or None if not available.
- Type
dfdatetime.DateTimeValues
- property creation_time
creation time or None if not available.
- Type
dfdatetime.DateTimeValues
- property modification_time
modification time or None if not available.
- Type
dfdatetime.DateTimeValues
- property name
name of the file entry, which does not include the full path.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.apfs_file_system module
The APFS file system implementation.
- class dfvfs.vfs.apfs_file_system.APFSFileSystem(resolver_context, path_spec)[source]
Bases:
FileSystem
File system that uses pyfsapfs.
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
True if the file entry exists.
- Return type
bool
- Raises
BackEndError – if the file entry cannot be opened.
- GetAPFSFileEntryByPathSpec(path_spec)[source]
Retrieves the APFS file entry for a path specification.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
file entry.
- Return type
pyfsapfs.file_entry
- Raises
PathSpecError – if the path specification is missing location and identifier.
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
file entry or None if not available.
- Return type
- Raises
BackEndError – if the file entry cannot be opened.
- GetRootFileEntry()[source]
Retrieves the root file entry.
- Returns
file entry or None if not available.
- Return type
- ROOT_DIRECTORY_IDENTIFIER = 2
- TYPE_INDICATOR = 'APFS'
dfvfs.vfs.apm_directory module
The Apple Partition Map (APM) directory implementation.
dfvfs.vfs.apm_file_entry module
The Apple Partition Map (APM) file entry implementation.
- class dfvfs.vfs.apm_file_entry.APMFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, vsapm_partition=None)[source]
Bases:
FileEntry
File system file entry that uses pyvsapm.
- GetAPMPartition()[source]
Retrieves the APM partition.
- Returns
a APM partition.
- Return type
pyvsapm.partition
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'APM'
- property name
name of the file entry, without the full path.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.apm_file_system module
The Apple Partition Map (APM) file system implementation.
- class dfvfs.vfs.apm_file_system.APMFileSystem(resolver_context, path_spec)[source]
Bases:
FileSystem
File system that uses pyvsapm.
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
True if the file entry exists.
- Return type
bool
- GetAPMPartitionByPathSpec(path_spec)[source]
Retrieves a APM partition for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
a APM partition or None if not available.
- Return type
pyvsapm.partition
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
a file entry or None if not available.
- Return type
- GetRootFileEntry()[source]
Retrieves the root file entry.
- Returns
root file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'APM'
dfvfs.vfs.attribute module
The Virtual File System (VFS) attribute interface.
- class dfvfs.vfs.attribute.Attribute[source]
Bases:
object
Attribute interface.
- GetExtents()[source]
Retrieves the extents.
- Returns
the extents of the attribute data.
- Return type
list[Extent]
- property type_indicator
type indicator or None if not known.
- Type
str
- class dfvfs.vfs.attribute.StatAttribute[source]
Bases:
object
Attribute that represents a POSIX stat.
- device_number
major and minor device number (if block or character device file), derived from st_rdev.
- Type
Tuple[int, int]
- group_identifier
group identifier (GID), equivalent to st_gid.
- Type
int
- inode_number
number of the corresponding inode, equivalent to st_ino.
- Type
int
- mode
access mode, equivalent to st_mode.
- Type
int
- number_of_links
number of hard links, equivalent to st_nlink.
- Type
int
- owner_identifier
user identifier (UID) of the owner, equivalent to st_uid.
- Type
int
- size
size, in number of bytes, equivalent to st_size.
- Type
int
- type
file type, value derived from st_mode >> 12.
- Type
str
- TYPE_BLOCK_DEVICE = 'block_device'
- TYPE_CHARACTER_DEVICE = 'character_device'
- TYPE_DEVICE = 'device'
- TYPE_DIRECTORY = 'directory'
- TYPE_FILE = 'file'
- TYPE_LINK = 'link'
- TYPE_PIPE = 'pipe'
- TYPE_SOCKET = 'socket'
- TYPE_WHITEOUT = 'whiteout'
dfvfs.vfs.bde_file_entry module
The BDE file entry implementation.
- class dfvfs.vfs.bde_file_entry.BDEFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]
Bases:
RootOnlyFileEntry
File system file entry that uses pybde.
- IsLocked()[source]
Determines if the file entry is locked.
- Returns
True if the file entry is locked.
- Return type
bool
- TYPE_INDICATOR = 'BDE'
- Unlock()[source]
Unlocks the file entry.
- Returns
True if the file entry was unlocked.
- Return type
bool
- property creation_time
creation time or None if not available.
- Type
dfdatetime.DateTimeValues
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.bde_file_system module
The BDE file system implementation.
- class dfvfs.vfs.bde_file_system.BDEFileSystem(resolver_context, path_spec)[source]
Bases:
RootOnlyFileSystem
File system that uses pybde.
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
file entry or None.
- Return type
- TYPE_INDICATOR = 'BDE'
dfvfs.vfs.compressed_stream_file_entry module
The compressed stream file entry implementation.
- class dfvfs.vfs.compressed_stream_file_entry.CompressedStreamFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]
Bases:
RootOnlyFileEntry
Compressed stream file entry.
- TYPE_INDICATOR = 'COMPRESSED_STREAM'
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.compressed_stream_file_system module
The compressed stream file system implementation.
- class dfvfs.vfs.compressed_stream_file_system.CompressedStreamFileSystem(resolver_context, path_spec)[source]
Bases:
RootOnlyFileSystem
Compressed stream file system.
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
a file entry or None if not available.
- Return type
- GetRootFileEntry()[source]
Retrieves the root file entry.
- Returns
a file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'COMPRESSED_STREAM'
dfvfs.vfs.cpio_directory module
The CPIO directory implementation.
dfvfs.vfs.cpio_file_entry module
The CPIO file entry implementation.
- class dfvfs.vfs.cpio_file_entry.CPIOFileEntry(resolver_context, file_system, path_spec, cpio_archive_file_entry=None, is_root=False, is_virtual=False)[source]
Bases:
FileEntry
File system file entry that uses CPIOArchiveFile.
- GetCPIOArchiveFileEntry()[source]
Retrieves the CPIO archive file entry object.
- Returns
CPIO archive file entry.
- Return type
- Raises
PathSpecError – if the path specification is incorrect.
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'CPIO'
- property modification_time
modification time or None if not available.
- Type
dfdatetime.DateTimeValues
- property name
name of the file entry, which does not include the full path.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.cpio_file_system module
The CPIO archive file system implementation.
- class dfvfs.vfs.cpio_file_system.CPIOFileSystem(resolver_context, path_spec, encoding='utf-8')[source]
Bases:
FileSystem
CPIO archive file system.
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
True if the file entry exists.
- Return type
bool
- GetCPIOArchiveFile()[source]
Retrieves the CPIO archive file.
- Returns
a CPIO archive file.
- Return type
- GetCPIOArchiveFileEntryByPathSpec(path_spec)[source]
Retrieves the CPIO archive file entry for a path specification.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
CPIO archive file entry or None if not available.
- Return type
- Raises
PathSpecError – if the path specification is incorrect.
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
a file entry or None if not available.
- Return type
- GetRootFileEntry()[source]
Retrieves the root file entry.
- Returns
a file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'CPIO'
dfvfs.vfs.cs_directory module
The Core Storage (CS) directory implementation.
dfvfs.vfs.cs_file_entry module
The Core Storage (CS) file entry implementation.
- class dfvfs.vfs.cs_file_entry.CSFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, fvde_logical_volume=None)[source]
Bases:
FileEntry
File system file entry that uses pyfvde.
- GetFVDELogicalVolume()[source]
Retrieves the Core Storage logical volume.
- Returns
a Core Storage logical volume.
- Return type
pyfvde.logical_volume
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None if not available.
- Return type
- IsLocked()[source]
Determines if the file entry is locked.
- Returns
True if the file entry is locked.
- Return type
bool
- TYPE_INDICATOR = 'CS'
- Unlock()[source]
Unlocks the file entry.
- Returns
True if the file entry was unlocked.
- Return type
bool
- property name
name of the file entry, without the full path.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.cs_file_system module
The Core Storage (CS) file system implementation.
- class dfvfs.vfs.cs_file_system.CSFileSystem(resolver_context, path_spec)[source]
Bases:
FileSystem
File system that uses pyfvde.
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
True if the file entry exists.
- Return type
bool
- GetFVDELogicalVolumeByPathSpec(path_spec)[source]
Retrieves a Core Storage logical volume for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
- a Core Storage logical volume or None if not
available.
- Return type
pyfvde.logical_volume
- GetFVDEVolumeGroup()[source]
Retrieves the Core Storage volume group.
- Returns
a Core Storage volume group.
- Return type
pyfvde.volume_group
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
a file entry or None if not available.
- Return type
- GetRootFileEntry()[source]
Retrieves the root file entry.
- Returns
root file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'CS'
dfvfs.vfs.data_range_file_entry module
The data range file entry implementation.
- class dfvfs.vfs.data_range_file_entry.DataRangeFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]
Bases:
RootOnlyFileEntry
File entry that represents a data range.
- TYPE_INDICATOR = 'DATA_RANGE'
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.data_range_file_system module
The data range file system implementation.
- class dfvfs.vfs.data_range_file_system.DataRangeFileSystem(resolver_context, path_spec)[source]
Bases:
RootOnlyFileSystem
Data range file system.
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
a file entry or None if not available.
- Return type
- GetRootFileEntry()[source]
Retrieves the root file entry.
- Returns
a file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'DATA_RANGE'
dfvfs.vfs.data_stream module
The Virtual File System (VFS) data stream interface.
- class dfvfs.vfs.data_stream.DataStream(file_entry)[source]
Bases:
object
Data stream interface.
- GetExtents()[source]
Retrieves the extents.
- Returns
the extents of the data stream.
- Return type
list[Extent]
- IsDefault()[source]
Determines if the data stream is the default data stream.
- Returns
True if the data stream is the default data stream.
- Return type
bool
- property name
name.
- Type
str
dfvfs.vfs.directory module
The Virtual File System (VFS) directory interface.
dfvfs.vfs.encoded_stream_file_entry module
The encoded stream file entry implementation.
- class dfvfs.vfs.encoded_stream_file_entry.EncodedStreamFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]
Bases:
RootOnlyFileEntry
Class that implements an encoded stream file entry.
- TYPE_INDICATOR = 'ENCODED_STREAM'
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.encoded_stream_file_system module
The encoded stream file system implementation.
- class dfvfs.vfs.encoded_stream_file_system.EncodedStreamFileSystem(resolver_context, path_spec)[source]
Bases:
RootOnlyFileSystem
Encoded stream file system.
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
a file entry or None if not available.
- Return type
- GetRootFileEntry()[source]
Retrieves the root file entry.
- Returns
a file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'ENCODED_STREAM'
dfvfs.vfs.encrypted_stream_file_entry module
The encrypted stream file entry implementation.
- class dfvfs.vfs.encrypted_stream_file_entry.EncryptedStreamFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]
Bases:
RootOnlyFileEntry
Encrypted stream file entry.
- TYPE_INDICATOR = 'ENCRYPTED_STREAM'
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.encrypted_stream_file_system module
The encrypted stream file system implementation.
- class dfvfs.vfs.encrypted_stream_file_system.EncryptedStreamFileSystem(resolver_context, path_spec)[source]
Bases:
RootOnlyFileSystem
Encrypted stream file system.
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
a file entry or None if not available.
- Return type
- GetRootFileEntry()[source]
Retrieves the root file entry.
- Returns
a file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'ENCRYPTED_STREAM'
dfvfs.vfs.ext_attribute module
The EXT attribute implementation.
- class dfvfs.vfs.ext_attribute.EXTExtendedAttribute(fsext_extended_attribute)[source]
Bases:
Attribute
EXT extended attribute that uses pyfsext.
- GetExtents()[source]
Retrieves the extents.
- Returns
the extents of the attribute data.
- Return type
list[Extent]
- get_offset()[source]
Retrieves the current offset into the file input/output (IO) object.
- Returns
current offset into the file input/output (IO) object.
- Return type
int
- get_size()[source]
Retrieves the size of the file input/output (IO) object.
- Returns
size of the file input/output (IO) object.
- Return type
int
- property name
name.
- Type
str
- read(size=None)[source]
Reads a byte string from the file input/output (IO) object.
The function will read a byte string of the specified size or all of the remaining data if no size was specified.
- Parameters
size (Optional[int]) – number of bytes to read, where None is all remaining data.
- Returns
data read.
- Return type
bytes
- Raises
IOError – if the read failed.
OSError – if the read failed.
- seek(offset, whence=0)[source]
Seeks to an offset within the file input/output (IO) object.
- Parameters
offset (int) – offset to seek.
whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.
- Raises
IOError – if the seek failed.
OSError – if the seek failed.
dfvfs.vfs.ext_directory module
The EXT directory implementation.
dfvfs.vfs.ext_file_entry module
The EXT file entry implementation.
- class dfvfs.vfs.ext_file_entry.EXTFileEntry(resolver_context, file_system, path_spec, fsext_file_entry=None, is_root=False, is_virtual=False)[source]
Bases:
FileEntry
File system file entry that uses pyfsext.
- GetEXTFileEntry()[source]
Retrieves the EXT file entry.
- Returns
EXT file entry.
- Return type
pyfsext.file_entry
- GetLinkedFileEntry()[source]
Retrieves the linked file entry, e.g. for a symbolic link.
- Returns
linked file entry or None if not available.
- Return type
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'EXT'
- property access_time
access time or None if not available.
- Type
dfdatetime.DateTimeValues
- property change_time
change time or None if not available.
- Type
dfdatetime.DateTimeValues
- property creation_time
creation time or None if not available.
- Type
dfdatetime.DateTimeValues
- property deletion_time
deletion time or None if not available.
- Type
dfdatetime.DateTimeValues
- property modification_time
modification time or None if not available.
- Type
dfdatetime.DateTimeValues
- property name
name of the file entry, which does not include the full path.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.ext_file_system module
The EXT file system implementation.
- class dfvfs.vfs.ext_file_system.EXTFileSystem(resolver_context, path_spec)[source]
Bases:
FileSystem
File system that uses pyfsext.
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
True if the file entry exists.
- Return type
bool
- Raises
BackEndError – if the file entry cannot be opened.
- GetEXTFileEntryByPathSpec(path_spec)[source]
Retrieves the EXT file entry for a path specification.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
file entry.
- Return type
pyfsext.file_entry
- Raises
PathSpecError – if the path specification is missing location and inode.
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
file entry or None if not available.
- Return type
- Raises
BackEndError – if the file entry cannot be opened.
- ROOT_DIRECTORY_INODE_NUMBER = 2
- TYPE_INDICATOR = 'EXT'
dfvfs.vfs.extent module
The Virtual File System (VFS) extent.
- class dfvfs.vfs.extent.Extent(extent_type=None, offset=None, size=None)[source]
Bases:
object
Extent.
- extent_type
type of the extent, for example EXTENT_TYPE_SPARSE.
- Type
str
- offset
offset of the extent relative from the start of the file system in bytes.
- Type
int
- size
size of the extent in bytes.
- Type
int
dfvfs.vfs.fake_directory module
The fake directory implementation.
dfvfs.vfs.fake_file_entry module
The fake file entry implementation.
- class dfvfs.vfs.fake_file_entry.FakeFileEntry(resolver_context, file_system, path_spec, file_entry_type=None, is_root=False)[source]
Bases:
FileEntry
Fake file system file entry.
- GetFileObject(data_stream_name='')[source]
Retrieves a file-like object of a specific data stream.
- Parameters
data_stream_name (Optional[str]) – name of the data stream, where an empty string represents the default data stream.
- Returns
a file-like object or None if not available.
- Return type
FakeFileIO
- Raises
IOError – if the file entry is not a file.
OSError – if the file entry is not a file.
- GetParentFileEntry()[source]
Retrieves the root file entry.
- Returns
parent file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'FAKE'
- property access_time
access time or None if not available.
- Type
dfdatetime.DateTimeValues
- property change_time
change time or None if not available.
- Type
dfdatetime.DateTimeValues
- property modification_time
modification time or None if not available.
- Type
dfdatetime.DateTimeValues
- property name
name of the file entry, without the full path.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.fake_file_system module
The fake file system implementation.
- class dfvfs.vfs.fake_file_system.FakeFileSystem(resolver_context, path_spec)[source]
Bases:
FileSystem
Fake file system.
- AddFileEntry(path, file_entry_type='file', file_data=None, link_data=None)[source]
Adds a fake file entry.
- Parameters
path (str) – path of the file entry.
file_entry_type (Optional[str]) – type of the file entry object.
file_data (Optional[bytes]) – data of the fake file-like object.
link_data (Optional[bytes]) – link data of the fake file entry object.
- Raises
KeyError – if the path already exists.
ValueError – if the file data is set but the file entry type is not a file or if the link data is set but the file entry type is not a link.
- FileEntryExistsByPath(path)[source]
Determines if a file entry for a path exists.
- Parameters
path (str) – path of the file entry.
- Returns
True if the file entry exists.
- Return type
bool
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
True if the file entry exists.
- Return type
bool
- GetDataByPath(path)[source]
Retrieves the data associated to a path.
- Parameters
path (str) – path of the file entry.
- Returns
data or None if not available.
- Return type
bytes
- GetFileEntryByPath(path)[source]
Retrieves a file entry for a path.
- Parameters
path (str) – path of the file entry.
- Returns
a file entry or None if not available.
- Return type
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
a file entry or None if not available.
- Return type
- GetPaths()[source]
Retrieves the paths dictionary.
- Returns
file-like object per path.
- Return type
dict[str, FileIO]
- GetRootFileEntry()[source]
Retrieves the root file entry.
- Returns
a file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'FAKE'
dfvfs.vfs.fat_directory module
The FAT directory implementation.
dfvfs.vfs.fat_file_entry module
The FAT file entry implementation.
- class dfvfs.vfs.fat_file_entry.FATFileEntry(resolver_context, file_system, path_spec, fsfat_file_entry=None, is_root=False, is_virtual=False)[source]
Bases:
FileEntry
File system file entry that uses pyfsfat.
- GetFATFileEntry()[source]
Retrieves the FAT file entry.
- Returns
FAT file entry.
- Return type
pyfsfat.file_entry
- GetFileObject(data_stream_name='')[source]
Retrieves a file-like object of a specific data stream.
- Parameters
data_stream_name (Optional[str]) – name of the data stream, where an empty string represents the default data stream.
- Returns
a file-like object or None if not available.
- Return type
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'FAT'
- property access_time
access time or None if not available.
- Type
dfdatetime.DateTimeValues
- property creation_time
creation time or None if not available.
- Type
dfdatetime.DateTimeValues
- property modification_time
modification time or None if not available.
- Type
dfdatetime.DateTimeValues
- property name
name of the file entry, which does not include the full path.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.fat_file_system module
The FAT file system implementation.
- class dfvfs.vfs.fat_file_system.FATFileSystem(resolver_context, path_spec)[source]
Bases:
FileSystem
File system that uses pyfsfat.
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
True if the file entry exists.
- Return type
bool
- Raises
BackEndError – if the file entry cannot be opened.
- GetFATFileEntryByPathSpec(path_spec)[source]
Retrieves the FAT file entry for a path specification.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
file entry.
- Return type
pyfsfat.file_entry
- Raises
PathSpecError – if the path specification is missing location and identifier.
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
file entry or None if not available.
- Return type
- Raises
BackEndError – if the file entry cannot be opened.
- LOCATION_ROOT = '\\'
- PATH_SEPARATOR = '\\'
- TYPE_INDICATOR = 'FAT'
dfvfs.vfs.file_entry module
The Virtual File System (VFS) file entry interface.
The file entry can be various file system elements like a regular file, a directory or file system metadata.
- class dfvfs.vfs.file_entry.FileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]
Bases:
object
File entry interface.
- entry_type
file entry type, such as device, directory, file, link, socket and pipe or None if not available. The available file entry types are defined in dfvfs.lib.definitions for example FILE_ENTRY_TYPE_FILE.
- Type
str
- GetDataStream(name, case_sensitive=True)[source]
Retrieves a data stream by name.
- Parameters
name (str) – name of the data stream.
case_sensitive (Optional[bool]) – True if the name is case sensitive.
- Returns
a data stream or None if not available.
- Return type
- Raises
ValueError – if the name is not string.
- GetFileObject(data_stream_name='')[source]
Retrieves a file-like object of a specific data stream.
- Parameters
data_stream_name (Optional[str]) – name of the data stream, where an empty string represents the default data stream.
- Returns
a file-like object or None if not available.
- Return type
- GetFileSystem()[source]
Retrieves the file system which contains the file entry.
- Returns
a file system.
- Return type
- GetLinkedFileEntry()[source]
Retrieves the linked file entry, for example for a symbolic link.
- Returns
linked file entry or None if not available.
- Return type
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None if not available.
- Return type
- GetStatAttribute()[source]
Retrieves a stat attribute.
- Returns
a stat attribute or None if not available.
- Return type
- GetSubFileEntryByName(name, case_sensitive=True)[source]
Retrieves a sub file entry by name.
- Parameters
name (str) – name of the file entry.
case_sensitive (Optional[bool]) – True if the name is case sensitive.
- Returns
a file entry or None if not available.
- Return type
- HasDataStream(name, case_sensitive=True)[source]
Determines if the file entry has specific data stream.
- Parameters
name (str) – name of the data stream.
case_sensitive (Optional[bool]) – True if the name is case sensitive.
- Returns
True if the file entry has the data stream.
- Return type
bool
- Raises
ValueError – if the name is not string.
- HasExternalData()[source]
Determines if the file entry has external stored data.
- Returns
True if the file entry has external stored data.
- Return type
bool
- IsAllocated()[source]
Determines if the file entry is allocated.
- Returns
True if the file entry is allocated.
- Return type
bool
- IsDevice()[source]
Determines if the file entry is a device.
- Returns
True if the file entry is a device.
- Return type
bool
- IsDirectory()[source]
Determines if the file entry is a directory.
- Returns
True if the file entry is a directory.
- Return type
bool
- IsFile()[source]
Determines if the file entry is a file.
- Returns
True if the file entry is a file.
- Return type
bool
- IsLink()[source]
Determines if the file entry is a link.
- Returns
True if the file entry is a link.
- Return type
bool
- IsLocked()[source]
Determines if the file entry is locked.
- Returns
True if the file entry is locked.
- Return type
bool
- IsPipe()[source]
Determines if the file entry is a pipe.
- Returns
True if the file entry is a pipe.
- Return type
bool
- IsRoot()[source]
Determines if the file entry is the root file entry.
- Returns
True if the file entry is the root file entry.
- Return type
bool
- IsSocket()[source]
Determines if the file entry is a socket.
- Returns
True if the file entry is a socket.
- Return type
bool
- IsVirtual()[source]
Determines if the file entry is virtual (emulated by dfVFS).
- Returns
True if the file entry is virtual.
- Return type
bool
- Unlock()[source]
Unlocks the file entry.
- Returns
True if the file entry was unlocked.
- Return type
bool
- property access_time
access time or None if not available.
- Type
dfdatetime.DateTimeValues
- property added_time
added time or None if not available.
- Type
dfdatetime.DateTimeValues
- property backup_time
backup time or None if not available.
- Type
dfdatetime.DateTimeValues
- property change_time
change time or None if not available.
- Type
dfdatetime.DateTimeValues
- property creation_time
creation time or None if not available.
- Type
dfdatetime.DateTimeValues
- property data_streams
data streams.
- Type
generator[DataStream]
- property deletion_time
deletion time or None if not available.
- Type
dfdatetime.DateTimeValues
- property link
full path of the linked file entry or None if not available.
- Type
str
- property modification_time
modification time or None if not available.
- Type
dfdatetime.DateTimeValues
- abstract property name
name of the file entry, without the full path.
- Type
str
- property number_of_attributes
number of attributes.
- Type
int
- property number_of_data_streams
number of data streams.
- Type
int
- property number_of_sub_file_entries
number of sub file entries.
- Type
int
- property size
size of the file entry in bytes or None if not available.
- Type
int
- property type_indicator
type indicator.
- Type
str
dfvfs.vfs.file_system module
The Virtual File System (VFS) file system interface.
- class dfvfs.vfs.file_system.FileSystem(resolver_context, path_spec)[source]
Bases:
object
File system interface.
- BasenamePath(path)[source]
Determines the basename of the path.
- Parameters
path (str) – path.
- Returns
basename of the path.
- Return type
str
- DirnamePath(path)[source]
Determines the directory name of the path.
The file system root is represented by an empty string.
- Parameters
path (str) – path.
- Returns
directory name of the path or None.
- Return type
str
- abstract FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
True if the file entry exists.
- Return type
bool
- GetDataStreamByPathSpec(path_spec)[source]
Retrieves a data stream for a path specification.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
a data stream or None if not available.
- Return type
- abstract GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- GetPathSegmentAndSuffix(base_path, path)[source]
Determines the path segment and suffix of the path.
None is returned if the path does not start with the base path and an empty string if the path exactly matches the base path.
- Parameters
base_path (str) – base path.
path (str) – path.
- Returns
path segment and suffix string.
- Return type
tuple[str, str]
- abstract GetRootFileEntry()[source]
Retrieves the root file entry.
- Returns
a file entry or None if not available.
- Return type
- JoinPath(path_segments)[source]
Joins the path segments into a path.
- Parameters
path_segments (list[str]) – path segments.
- Returns
joined path segments prefixed with the path separator.
- Return type
str
- LOCATION_ROOT = '/'
- Open(path_spec=None, mode='rb')[source]
Opens the file system object defined by path specification.
- Parameters
path_spec (Optional[PathSpec]) – a path specification.
mode (Optional[str]) – file access mode. The default is ‘rb’ which represents read-only binary.
- Raises
AccessError – if the access to open the file was denied.
IOError – if the file system object was already opened or the open failed.
OSError – if the file system object was already opened or the open failed.
PathSpecError – if the path specification is incorrect.
ValueError – if the path specification or mode is invalid.
- PATH_SEPARATOR = '/'
- SplitPath(path)[source]
Splits the path into path segments.
- Parameters
path (str) – path.
- Returns
- path segments without the root path segment, which is
an empty string.
- Return type
list[str]
- property type_indicator
type indicator.
- Type
str
dfvfs.vfs.gpt_directory module
The GUID Partition Table (GPT) directory implementation.
dfvfs.vfs.gpt_file_entry module
The GUID Partition Table (GPT) file entry implementation.
- class dfvfs.vfs.gpt_file_entry.GPTFileEntry(resolver_context, file_system, path_spec, entry_index=None, is_root=False, is_virtual=False, vsgpt_partition=None)[source]
Bases:
FileEntry
File system file entry that uses pyvsgpt.
- GetGPTPartition()[source]
Retrieves the GPT partition.
- Returns
a GPT partition.
- Return type
pyvsgpt.partition
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'GPT'
- property name
name of the file entry, without the full path.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.gpt_file_system module
The GUID Partition Table (GPT) file system implementation.
- class dfvfs.vfs.gpt_file_system.GPTFileSystem(resolver_context, path_spec)[source]
Bases:
FileSystem
File system that uses pyvsgpt.
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
True if the file entry exists.
- Return type
bool
- GetEntryIndexByPathSpec(path_spec)[source]
Retrieves the entry index for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
entry index or None if not available.
- Return type
int
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
a file entry or None if not available.
- Return type
- GetGPTPartitionByPathSpec(path_spec)[source]
Retrieves a GPT partition for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
a GPT partition or None if not available.
- Return type
pyvsgpt.partition
- GetRootFileEntry()[source]
Retrieves the root file entry.
- Returns
root file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'GPT'
dfvfs.vfs.gzip_file_entry module
The gzip file entry implementation.
- class dfvfs.vfs.gzip_file_entry.GzipFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]
Bases:
RootOnlyFileEntry
File system file entry that uses gzip.
- TYPE_INDICATOR = 'GZIP'
- property modification_time
modification time or None if not available.
- Type
dfdatetime.DateTimeValues
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.gzip_file_system module
The gzip file system implementation.
- class dfvfs.vfs.gzip_file_system.GzipFileSystem(resolver_context, path_spec)[source]
Bases:
RootOnlyFileSystem
File system that uses gzip.
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
a file entry or None if not available.
- Return type
- GetRootFileEntry()[source]
Retrieves the root file entry.
- Returns
a file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'GZIP'
dfvfs.vfs.hfs_attribute module
The HFS attribute implementation.
- class dfvfs.vfs.hfs_attribute.HFSExtendedAttribute(fshfs_extended_attribute)[source]
Bases:
Attribute
HFS extended attribute that uses pyfshfs.
- GetExtents()[source]
Retrieves the extents.
- Returns
the extents of the attribute data.
- Return type
list[Extent]
- get_offset()[source]
Retrieves the current offset into the file input/output (IO) object.
- Returns
current offset into the file input/output (IO) object.
- Return type
int
- get_size()[source]
Retrieves the size of the file input/output (IO) object.
- Returns
size of the file input/output (IO) object.
- Return type
int
- property name
name.
- Type
str
- read(size=None)[source]
Reads a byte string from the file input/output (IO) object.
The function will read a byte string of the specified size or all of the remaining data if no size was specified.
- Parameters
size (Optional[int]) – number of bytes to read, where None is all remaining data.
- Returns
data read.
- Return type
bytes
- Raises
IOError – if the read failed.
OSError – if the read failed.
- seek(offset, whence=0)[source]
Seeks to an offset within the file input/output (IO) object.
- Parameters
offset (int) – offset to seek.
whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.
- Raises
IOError – if the seek failed.
OSError – if the seek failed.
dfvfs.vfs.hfs_data_stream module
The HFS data stream implementation.
dfvfs.vfs.hfs_directory module
The HFS directory implementation.
dfvfs.vfs.hfs_file_entry module
The HFS file entry implementation.
- class dfvfs.vfs.hfs_file_entry.HFSFileEntry(resolver_context, file_system, path_spec, fshfs_file_entry=None, is_root=False, is_virtual=False)[source]
Bases:
FileEntry
File system file entry that uses pyfshfs.
- GetFileObject(data_stream_name='')[source]
Retrieves a file-like object of a specific data stream.
- Parameters
data_stream_name (Optional[str]) – name of the data stream, where an empty string represents the default data stream.
- Returns
a file-like object or None if not available.
- Return type
- GetHFSFileEntry()[source]
Retrieves the HFS file entry.
- Returns
HFS file entry.
- Return type
pyfshfs.file_entry
- GetLinkedFileEntry()[source]
Retrieves the linked file entry, e.g. for a symbolic link.
- Returns
linked file entry or None if not available.
- Return type
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'HFS'
- property access_time
access time or None if not available.
- Type
dfdatetime.DateTimeValues
- property added_time
added time or None if not available.
- Type
dfdatetime.DateTimeValues
- property backup_time
backup time or None if not available.
- Type
dfdatetime.DateTimeValues
- property change_time
change time or None if not available.
- Type
dfdatetime.DateTimeValues
- property creation_time
creation time or None if not available.
- Type
dfdatetime.DateTimeValues
- property modification_time
modification time or None if not available.
- Type
dfdatetime.DateTimeValues
- property name
name of the file entry, which does not include the full path.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.hfs_file_system module
The HFS file system implementation.
- class dfvfs.vfs.hfs_file_system.HFSFileSystem(resolver_context, path_spec)[source]
Bases:
FileSystem
File system that uses pyfshfs.
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
True if the file entry exists.
- Return type
bool
- Raises
BackEndError – if the file entry cannot be opened.
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
file entry or None if not available.
- Return type
- Raises
BackEndError – if the file entry cannot be opened.
- GetHFSFileEntryByPathSpec(path_spec)[source]
Retrieves the HFS file entry for a path specification.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
file entry.
- Return type
pyfshfs.file_entry
- Raises
PathSpecError – if the path specification is missing location and identifier.
- ROOT_DIRECTORY_IDENTIFIER_NUMBER = 2
- TYPE_INDICATOR = 'HFS'
dfvfs.vfs.luksde_file_entry module
The LUKSDE file entry implementation.
- class dfvfs.vfs.luksde_file_entry.LUKSDEFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]
Bases:
RootOnlyFileEntry
File system file entry that uses pyluksde.
- IsLocked()[source]
Determines if the file entry is locked.
- Returns
True if the file entry is locked.
- Return type
bool
- TYPE_INDICATOR = 'LUKSDE'
- Unlock()[source]
Unlocks the file entry.
- Returns
True if the file entry was unlocked.
- Return type
bool
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.luksde_file_system module
The LUKSDE file system implementation.
- class dfvfs.vfs.luksde_file_system.LUKSDEFileSystem(resolver_context, path_spec)[source]
Bases:
RootOnlyFileSystem
File system that uses pyluksde.
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
file entry or None.
- Return type
- GetLUKSDEVolume()[source]
Retrieves the LUKSDE volume.
- Returns
LUKSDE volume.
- Return type
pyluksde.volume
- TYPE_INDICATOR = 'LUKSDE'
dfvfs.vfs.lvm_directory module
The Logical Volume Manager (LVM) directory implementation.
dfvfs.vfs.lvm_file_entry module
The Logical Volume Manager (LVM) file entry implementation.
- class dfvfs.vfs.lvm_file_entry.LVMFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, vslvm_logical_volume=None)[source]
Bases:
FileEntry
File system file entry that uses pyvslvm.
- GetLVMLogicalVolume()[source]
Retrieves the LVM logical volume.
- Returns
a LVM logical volume.
- Return type
pyvslvm.logical_volume
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'LVM'
- property name
name of the file entry, without the full path.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.lvm_file_system module
The Logical Volume Manager (LVM) file system implementation.
- class dfvfs.vfs.lvm_file_system.LVMFileSystem(resolver_context, path_spec)[source]
Bases:
FileSystem
File system that uses pyvslvm.
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
True if the file entry exists.
- Return type
bool
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
a file entry or None if not available.
- Return type
- GetLVMLogicalVolumeByPathSpec(path_spec)[source]
Retrieves a LVM logical volume for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
a LVM logical volume or None if not available.
- Return type
pyvslvm.logical_volume
- GetLVMVolumeGroup()[source]
Retrieves the LVM volume group.
- Returns
a LVM volume group.
- Return type
pyvslvm.volume_group
- GetRootFileEntry()[source]
Retrieves the root file entry.
- Returns
root file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'LVM'
dfvfs.vfs.ntfs_attribute module
The NTFS attribute implementations.
- class dfvfs.vfs.ntfs_attribute.FileNameNTFSAttribute(fsntfs_attribute)[source]
Bases:
NTFSAttribute
NTFS $FILE_NAME file system attribute.
- TYPE_INDICATOR = 'NTFS:$FILE_NAME'
- property access_time
access time or None if not set.
- Type
dfdatetime.Filetime
- property creation_time
creation time or None if not set.
- Type
dfdatetime.Filetime
- property entry_modification_time
entry modification time or None if not set.
- Type
dfdatetime.Filetime
- property file_attribute_flags
file attribute flags or None if not available.
- Type
int
- property modification_time
modification time.
- Type
dfdatetime.Filetime
- property name
name.
- Type
str
- property name_space
name_space.
- Type
int
- property parent_file_reference
parent file reference.
- Type
int
- class dfvfs.vfs.ntfs_attribute.NTFSAttribute(fsntfs_attribute)[source]
Bases:
Attribute
File system attribute that uses pyfsntfs.
- property attribute_type
The attribute type.
- class dfvfs.vfs.ntfs_attribute.ObjectIdentifierNTFSAttribute(fsntfs_attribute)[source]
Bases:
NTFSAttribute
NTFS $OBJECT_ID file system attribute.
- TYPE_INDICATOR = 'NTFS:$OBJECT_ID'
- property droid_file_identifier
droid file identifier, formatted as an UUID.
- Type
str
- class dfvfs.vfs.ntfs_attribute.SecurityDescriptorNTFSAttribute(fsntfs_attribute)[source]
Bases:
NTFSAttribute
NTFS $SECURITY_DESCRIPTOR file system attribute.
- TYPE_INDICATOR = 'NTFS:$SECURITY_DESCRIPTOR'
- property security_descriptor
security descriptor.
- Type
pyfwnt.security_descriptor
- class dfvfs.vfs.ntfs_attribute.StandardInformationNTFSAttribute(fsntfs_attribute)[source]
Bases:
NTFSAttribute
NTFS $STANDARD_INFORMATION file system attribute.
- TYPE_INDICATOR = 'NTFS:$STANDARD_INFORMATION'
- property access_time
access time or None if not set.
- Type
dfdatetime.Filetime
- property creation_time
creation time or None if not set.
- Type
dfdatetime.Filetime
- property entry_modification_time
entry modification time or None if not set.
- Type
dfdatetime.Filetime
- property file_attribute_flags
file attribute flags or None if not available.
- Type
int
- property modification_time
modification time or None if not set.
- Type
dfdatetime.Filetime
- property owner_identifier
owner identifier.
- Type
int
- property security_descriptor_identifier
security descriptor identifier.
- Type
int
- property update_sequence_number
update sequence number.
- Type
int
dfvfs.vfs.ntfs_data_stream module
The NTFS data stream implementation.
dfvfs.vfs.ntfs_directory module
The NTFS directory implementation.
dfvfs.vfs.ntfs_file_entry module
The NTFS file entry implementation.
- class dfvfs.vfs.ntfs_file_entry.NTFSFileEntry(resolver_context, file_system, path_spec, fsntfs_file_entry=None, is_root=False, is_virtual=False)[source]
Bases:
FileEntry
File system file entry that uses pyfsntfs.
- GetFileObject(data_stream_name='')[source]
Retrieves a file-like object of a specific data stream.
- Parameters
data_stream_name (Optional[str]) – data stream name, where an empty string represents the default data stream.
- Returns
file-like object or None.
- Return type
NTFSFileIO
- GetLinkedFileEntry()[source]
Retrieves the linked file entry, e.g. for a symbolic link.
- Returns
linked file entry or None.
- Return type
- GetNTFSFileEntry()[source]
Retrieves the NTFS file entry.
- Returns
NTFS file entry.
- Return type
pyfsntfs.file_entry
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None if not available.
- Return type
- GetSecurityDescriptor()[source]
Retrieves the security descriptor.
- Returns
security descriptor.
- Return type
pyfwnt.security_descriptor
- IsAllocated()[source]
Determines if the file entry is allocated.
- Returns
True if the file entry is allocated.
- Return type
bool
- TYPE_INDICATOR = 'NTFS'
- property access_time
access time or None if not available.
- Type
dfdatetime.DateTimeValues
- property change_time
change time or None if not available.
- Type
dfdatetime.DateTimeValues
- property creation_time
creation time or None if not available.
- Type
dfdatetime.DateTimeValues
- property modification_time
modification time or None if not available.
- Type
dfdatetime.DateTimeValues
- property name
name of the file entry, which does not include the full path.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.ntfs_file_system module
The NTFS file system implementation.
- class dfvfs.vfs.ntfs_file_system.NTFSFileSystem(resolver_context, path_spec)[source]
Bases:
FileSystem
File system that uses pyfsntfs.
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
True if the file entry exists.
- Return type
bool
- Raises
BackEndError – if the file entry cannot be opened.
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
file entry or None if not available.
- Return type
- Raises
BackEndError – if the file entry cannot be opened.
- GetNTFSFileEntryByPathSpec(path_spec)[source]
Retrieves the NTFS file entry for a path specification.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
NTFS file entry.
- Return type
pyfsntfs.file_entry
- Raises
PathSpecError – if the path specification is missing location and MFT entry.
- LOCATION_ROOT = '\\'
- MFT_ENTRY_ROOT_DIRECTORY = 5
- PATH_SEPARATOR = '\\'
- TYPE_INDICATOR = 'NTFS'
dfvfs.vfs.os_attribute module
The operating system attribute implementation.
- class dfvfs.vfs.os_attribute.OSExtendedAttribute(location, name)[source]
Bases:
Attribute
Extended attribute that uses the operating system.
- get_offset()[source]
Retrieves the current offset into the file input/output (IO) object.
- Returns
current offset into the file input/output (IO) object.
- Return type
int
- get_size()[source]
Retrieves the size of the file input/output (IO) object.
- Returns
size of the file input/output (IO) object.
- Return type
int
- property name
name.
- Type
str
- read(size=None)[source]
Reads a byte string from the file input/output (IO) object.
The function will read a byte string of the specified size or all of the remaining data if no size was specified.
- Parameters
size (Optional[int]) – number of bytes to read, where None is all remaining data.
- Returns
data read.
- Return type
bytes
- Raises
IOError – if the read failed.
OSError – if the read failed.
- seek(offset, whence=0)[source]
Seeks to an offset within the file input/output (IO) object.
- Parameters
offset (int) – offset to seek.
whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.
- Raises
IOError – if the seek failed.
OSError – if the seek failed.
dfvfs.vfs.os_directory module
The operating system directory implementation.
dfvfs.vfs.os_file_entry module
The operating system file entry implementation.
- class dfvfs.vfs.os_file_entry.OSFileEntry(resolver_context, file_system, path_spec, is_root=False)[source]
Bases:
FileEntry
File system file entry that uses os.
- GetLinkedFileEntry()[source]
Retrieves the linked file entry, for example for a symbolic link.
- Returns
linked file entry or None if not available.
- Return type
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'OS'
- property access_time
access time or None if not available.
- Type
dfdatetime.DateTimeValues
- property change_time
change time or None if not available.
- Type
dfdatetime.DateTimeValues
- property creation_time
creation time or None if not available.
- Type
dfdatetime.DateTimeValues
- property modification_time
modification time or None if not available.
- Type
dfdatetime.DateTimeValues
- property name
name of the file entry, without the full path.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.os_file_system module
The operating system file system implementation.
- class dfvfs.vfs.os_file_system.OSFileSystem(resolver_context, path_spec)[source]
Bases:
FileSystem
File system that uses the operating system.
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
True if the file entry exists, false otherwise.
- Return type
bool
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
a file entry or None if not available.
- Return type
- GetRootFileEntry()[source]
Retrieves the root file entry.
- Returns
a file entry or None if not available.
- Return type
- JoinPath(path_segments)[source]
Joins the path segments into a path.
- Parameters
path_segments (list[str]) – path segments.
- Returns
joined path segments prefixed with the path separator.
- Return type
str
- PATH_SEPARATOR = '/'
- TYPE_INDICATOR = 'OS'
dfvfs.vfs.root_only_file_entry module
The root only file system file entry implementation.
dfvfs.vfs.root_only_file_system module
The root only file system implementation.
- class dfvfs.vfs.root_only_file_system.RootOnlyFileSystem(resolver_context, path_spec)[source]
Bases:
FileSystem
Root only file system.
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
True if the file entry exists.
- Return type
bool
dfvfs.vfs.sqlite_blob_directory module
The SQLite blob directory implementation.
dfvfs.vfs.sqlite_blob_file_entry module
The SQLite blob file entry implementation.
- class dfvfs.vfs.sqlite_blob_file_entry.SQLiteBlobFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]
Bases:
FileEntry
SQLite blob file entry.
- GetNumberOfRows()[source]
Retrieves the number of rows in the table.
- Returns
number of rows.
- Return type
int
- Raises
BackEndError – when the SQLite blob file-like object is missing.
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None if not available.
- Return type
- TYPE_INDICATOR = 'SQLITE_BLOB'
- property name
name of the file entry, which does not include the full path.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.sqlite_blob_file_system module
The SQLite blob file system implementation.
- class dfvfs.vfs.sqlite_blob_file_system.SQLiteBlobFileSystem(resolver_context, path_spec)[source]
Bases:
FileSystem
Class that implements a file system object using SQLite blob.
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
True if the file entry exists.
- Return type
bool
- GetRootFileEntry()[source]
Retrieves the root file entry.
- Returns
a file entry or None.
- Return type
- TYPE_INDICATOR = 'SQLITE_BLOB'
dfvfs.vfs.tar_directory module
The TAR directory implementation.
dfvfs.vfs.tar_file_entry module
The TAR file entry implementation.
- class dfvfs.vfs.tar_file_entry.TARFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, tar_info=None)[source]
Bases:
FileEntry
File system file entry that uses tarfile.
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None.
- Return type
- GetTARInfo()[source]
Retrieves the TAR info.
- Returns
TAR info or None if it does not exist.
- Return type
tarfile.TARInfo
- Raises
PathSpecError – if the path specification is incorrect.
- TYPE_INDICATOR = 'TAR'
- property modification_time
modification time or None if not available.
- Type
dfdatetime.DateTimeValues
- property name
name of the file entry, which does not include the full path.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.tar_file_system module
The TAR file system implementation.
- class dfvfs.vfs.tar_file_system.TARFileSystem(resolver_context, path_spec, encoding='utf-8')[source]
Bases:
FileSystem
Class that implements a file system using tarfile.
- encoding
file entry name encoding.
- Type
str
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
True if the file entry exists.
- Return type
bool
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
file entry or None.
- Return type
- GetTARInfoByPathSpec(path_spec)[source]
Retrieves the TAR info for a path specification.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
TAR info or None if it does not exist.
- Return type
tarfile.TARInfo
- Raises
PathSpecError – if the path specification is incorrect.
- TYPE_INDICATOR = 'TAR'
dfvfs.vfs.tsk_attribute module
The SleuthKit (TSK) attribute implementation.
- class dfvfs.vfs.tsk_attribute.TSKAttribute(tsk_file, tsk_attribute)[source]
Bases:
Attribute
File system attribute that uses pytsk3.
- property attribute_type
attribute type.
- Type
object
- class dfvfs.vfs.tsk_attribute.TSKExtendedAttribute(tsk_file, tsk_attribute)[source]
Bases:
TSKAttribute
File system extended attribute that uses pytsk3.
- get_offset()[source]
Retrieves the current offset into the file input/output (IO) object.
- Returns
current offset into the file input/output (IO) object.
- Return type
int
- get_size()[source]
Retrieves the size of the file input/output (IO) object.
- Returns
size of the file input/output (IO) object.
- Return type
int
- property name
name.
- Raises
BackEndError – if pytsk3 returns a non UTF-8 formatted name.
- Type
str
- read(size=None)[source]
Reads a byte string from the file input/output (IO) object.
The function will read a byte string of the specified size or all of the remaining data if no size was specified.
- Parameters
size (Optional[int]) – number of bytes to read, where None is all remaining data.
- Returns
data read.
- Return type
bytes
- Raises
IOError – if the read failed.
OSError – if the read failed.
- seek(offset, whence=0)[source]
Seeks to an offset within the file input/output (IO) object.
- Parameters
offset (int) – offset to seek.
whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.
- Raises
IOError – if the seek failed.
OSError – if the seek failed.
dfvfs.vfs.tsk_data_stream module
The SleuthKit (TSK) data stream implementation.
- class dfvfs.vfs.tsk_data_stream.TSKDataStream(file_entry, pytsk_attribute)[source]
Bases:
DataStream
File system data stream that uses pytsk3.
- GetExtents()[source]
Retrieves the extents.
- Returns
the extents of the data stream.
- Return type
list[Extent]
- Raises
BackEndError – if pytsk3 returns no file system block size or data stream size.
dfvfs.vfs.tsk_directory module
The SleuthKit (TSK) directory implementation.
dfvfs.vfs.tsk_file_entry module
The SleuthKit (TSK) file entry implementation.
- class dfvfs.vfs.tsk_file_entry.TSKFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, parent_inode=None, tsk_file=None)[source]
Bases:
FileEntry
File system file entry that uses pytsk3.
- GetExtents()[source]
Retrieves the extents.
- Returns
the extents.
- Return type
list[Extent]
- Raises
BackEndError – if pytsk3 returns no file system block size or data stream size.
- GetFileObject(data_stream_name='')[source]
Retrieves a file-like object of a specific data stream.
- Parameters
data_stream_name (Optional[str]) – data stream name, where an empty string represents the default data stream.
- Returns
file-like object or None.
- Return type
TSKFileIO
- GetLinkedFileEntry()[source]
Retrieves the linked file entry, e.g. for a symbolic link.
- Returns
linked file entry or None.
- Return type
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None.
- Return type
- GetTSKFile()[source]
Retrieves the SleuthKit file object.
- Returns
TSK file.
- Return type
pytsk3.File
- Raises
PathSpecError – if the path specification is missing inode and location.
- IsAllocated()[source]
Determines if the file entry is allocated.
- Returns
True if the file entry is allocated.
- Return type
bool
- TYPE_INDICATOR = 'TSK'
- property access_time
access time or None if not available.
- Type
dfdatetime.DateTimeValues
- property backup_time
backup time or None if not available.
- Type
dfdatetime.DateTimeValues
- property change_time
change time or None if not available.
- Type
dfdatetime.DateTimeValues
- property creation_time
creation time or None if not available.
- Type
dfdatetime.DateTimeValues
- property deletion_time
deletion time or None if not available.
- Type
dfdatetime.DateTimeValues
- property modification_time
modification time or None if not available.
- Type
dfdatetime.DateTimeValues
- property name
name of the file entry, which does not include the full path.
- Raises
BackEndError – if pytsk3 returns a non UTF-8 formatted name.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
- class dfvfs.vfs.tsk_file_entry.TSKTime(*args: Any, **kwargs: Any)[source]
Bases:
DateTimeValues
SleuthKit timestamp.
- fraction_of_second
fraction of second, which is an integer that contains the number 100 nano seconds before Sleuthkit 4.2.0 or number of nano seconds in Sleuthkit 4.2.0 and later.
- Type
int
- CopyFromDateTimeString(time_string)[source]
Copies a SleuthKit timestamp from a date and time string.
- Parameters
time_string (str) –
date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##
Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3 or 6 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.
- CopyToDateTimeString()[source]
Copies the date time value to a date and time string.
- Returns
- date and time value formatted as:
YYYY-MM-DD hh:mm:ss or YYYY-MM-DD hh:mm:ss.####### or YYYY-MM-DD hh:mm:ss.#########
- Return type
str
- GetDate()[source]
Retrieves the date represented by the date and time values.
- Returns
- year, month, day of month or (None, None, None)
if the date and time values do not represent a date.
- Return type
tuple[int, int, int]
- property timestamp
POSIX timestamp in microseconds or None if timestamp is not set.
- Type
int
dfvfs.vfs.tsk_file_system module
The SleuthKit (TSK) file system implementation.
- class dfvfs.vfs.tsk_file_system.TSKFileSystem(resolver_context, path_spec)[source]
Bases:
FileSystem
File system that uses pytsk3.
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
True if the file entry exists.
- Return type
bool
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
a file entry or None if not available.
- Return type
- GetFsInfo()[source]
Retrieves the file system info.
- Returns
file system info.
- Return type
pytsk3.FS_Info
- GetFsType()[source]
Retrieves the file system type.
- Returns
file system type.
- Return type
pytsk3.TSK_FS_TYPE_ENUM
- GetRootInode()[source]
Retrieves the root inode.
- Returns
inode number or None if not available.
- Return type
int
- GetTSKFileByPathSpec(path_spec)[source]
Retrieves the SleuthKit file object for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
TSK file.
- Return type
pytsk3.File
- Raises
PathSpecError – if the path specification is missing inode and location.
- IsExt()[source]
Determines if the file system is ext2, ext3 or ext4.
- Returns
True if the file system is ext.
- Return type
bool
- IsHFS()[source]
Determines if the file system is HFS, HFS+ or HFSX.
- Returns
True if the file system is HFS.
- Return type
bool
- IsNTFS()[source]
Determines if the file system is NTFS.
- Returns
True if the file system is NTFS.
- Return type
bool
- TYPE_INDICATOR = 'TSK'
dfvfs.vfs.tsk_partition_directory module
The SleuthKit (TSK) partition directory implementation.
dfvfs.vfs.tsk_partition_file_entry module
The SleuthKit (TSK) partition file entry implementation.
- class dfvfs.vfs.tsk_partition_file_entry.TSKPartitionFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, tsk_vs_part=None)[source]
Bases:
FileEntry
File system file entry that uses pytsk3.
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None if not available.
- Return type
- GetTSKVsPart()[source]
Retrieves the TSK volume system part.
- Returns
- a TSK volume system part or None if not
available.
- Return type
pytsk3.TSK_VS_PART_INFO
- IsAllocated()[source]
Determines if the file entry is allocated.
- Returns
True if the file entry is allocated.
- Return type
bool
- TYPE_INDICATOR = 'TSK_PARTITION'
- property name
name of the file entry, which does not include the full path.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.tsk_partition_file_system module
The SleuthKit (TSK) partition file system implementation.
- class dfvfs.vfs.tsk_partition_file_system.TSKPartitionFileSystem(resolver_context, path_spec)[source]
Bases:
FileSystem
Class that implements a file system object using pytsk3.
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
True if the file entry exists or false otherwise.
- Return type
bool
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
a file entry or None of not available.
- Return type
- GetRootFileEntry()[source]
Retrieves the root file entry.
- Returns
a file entry or None of not available.
- Return type
- GetTSKVolume()[source]
Retrieves the TSK volume object.
- Returns
a TSK volume object.
- Return type
pytsk3.Volume_Info
- TYPE_INDICATOR = 'TSK_PARTITION'
dfvfs.vfs.vshadow_directory module
The Volume Shadow Snapshots (VSS) directory implementation.
dfvfs.vfs.vshadow_file_entry module
The Volume Shadow Snapshots (VSS) file entry implementation.
- class dfvfs.vfs.vshadow_file_entry.VShadowFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]
Bases:
FileEntry
File system file entry that uses pyvshadow.
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None if not available.
- Return type
- GetVShadowStore()[source]
Retrieves a VSS store.
- Returns
a VSS store or None if not available.
- Return type
pyvshadow.store
- HasExternalData()[source]
Determines if the file entry has external stored data.
- Returns
True if the file entry has external data.
- Return type
bool
- TYPE_INDICATOR = 'VSHADOW'
- property creation_time
creation time or None if not available.
- Type
dfdatetime.DateTimeValues
- property name
name of the file entry, which does not include the full path.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.vshadow_file_system module
The Volume Shadow Snapshots (VSS) file system implementation.
- class dfvfs.vfs.vshadow_file_system.VShadowFileSystem(resolver_context, path_spec)[source]
Bases:
FileSystem
File system that uses pyvshadow.
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
True if the file entry exists.
- Return type
bool
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
file entry or None if not available.
- Return type
- GetRootFileEntry()[source]
Retrieves the root file entry.
- Returns
file entry or None if not available.
- Return type
- GetVShadowStoreByPathSpec(path_spec)[source]
Retrieves a VSS store for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
a VSS store or None if not available.
- Return type
pyvshadow.store
- GetVShadowVolume()[source]
Retrieves a VSS volume.
- Returns
a VSS volume.
- Return type
pyvshadow.volume
- TYPE_INDICATOR = 'VSHADOW'
dfvfs.vfs.xfs_attribute module
The XFS attribute implementation.
- class dfvfs.vfs.xfs_attribute.XFSExtendedAttribute(fsxfs_extended_attribute)[source]
Bases:
Attribute
XFS extended attribute that uses pyfsxfs.
- GetExtents()[source]
Retrieves the extents.
- Returns
the extents of the attribute data.
- Return type
list[Extent]
- get_offset()[source]
Retrieves the current offset into the file input/output (IO) object.
- Returns
current offset into the file input/output (IO) object.
- Return type
int
- get_size()[source]
Retrieves the size of the file input/output (IO) object.
- Returns
size of the file input/output (IO) object.
- Return type
int
- property name
name.
- Type
str
- read(size=None)[source]
Reads a byte string from the file input/output (IO) object.
The function will read a byte string of the specified size or all of the remaining data if no size was specified.
- Parameters
size (Optional[int]) – number of bytes to read, where None is all remaining data.
- Returns
data read.
- Return type
bytes
- Raises
IOError – if the read failed.
OSError – if the read failed.
- seek(offset, whence=0)[source]
Seeks to an offset within the file input/output (IO) object.
- Parameters
offset (int) – offset to seek.
whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.
- Raises
IOError – if the seek failed.
OSError – if the seek failed.
dfvfs.vfs.xfs_directory module
The XFS directory implementation.
dfvfs.vfs.xfs_file_entry module
The XFS file entry implementation.
- class dfvfs.vfs.xfs_file_entry.XFSFileEntry(resolver_context, file_system, path_spec, fsxfs_file_entry=None, is_root=False, is_virtual=False)[source]
Bases:
FileEntry
File system file entry that uses pyfsxfs.
- GetLinkedFileEntry()[source]
Retrieves the linked file entry, e.g. for a symbolic link.
- Returns
linked file entry or None if not available.
- Return type
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None if not available.
- Return type
- GetXFSFileEntry()[source]
Retrieves the XFS file entry.
- Returns
XFS file entry.
- Return type
pyfsxfs.file_entry
- TYPE_INDICATOR = 'XFS'
- property access_time
access time or None if not available.
- Type
dfdatetime.DateTimeValues
- property change_time
change time or None if not available.
- Type
dfdatetime.DateTimeValues
- property creation_time
creation time or None if not available.
- Type
dfdatetime.DateTimeValues
- property modification_time
modification time or None if not available.
- Type
dfdatetime.DateTimeValues
- property name
name of the file entry, which does not include the full path.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.xfs_file_system module
The XFS file system implementation.
- class dfvfs.vfs.xfs_file_system.XFSFileSystem(resolver_context, path_spec)[source]
Bases:
FileSystem
File system that uses pyfsxfs.
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
True if the file entry exists.
- Return type
bool
- Raises
BackEndError – if the file entry cannot be opened.
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – path specification.
- Returns
file entry or None if not available.
- Return type
- Raises
BackEndError – if the file entry cannot be opened.
- GetXFSFileEntryByPathSpec(path_spec)[source]
Retrieves the XFS file entry for a path specification.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
file entry.
- Return type
pyfsxfs.file_entry
- Raises
PathSpecError – if the path specification is missing location and inode.
- TYPE_INDICATOR = 'XFS'
dfvfs.vfs.zip_directory module
The ZIP directory implementation.
dfvfs.vfs.zip_file_entry module
The ZIP file entry implementation.
- class dfvfs.vfs.zip_file_entry.ZipFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, zip_info=None)[source]
Bases:
FileEntry
File system file entry that uses zipfile.
- GetParentFileEntry()[source]
Retrieves the parent file entry.
- Returns
parent file entry or None if not available.
- Return type
- GetZipInfo()[source]
Retrieves the ZIP info object.
- Returns
a ZIP info object or None if not available.
- Return type
zipfile.ZipInfo
- Raises
PathSpecError – if the path specification is incorrect.
- TYPE_INDICATOR = 'ZIP'
- property modification_time
modification time or None if not available.
- Type
dfdatetime.DateTimeValues
- property name
name of the file entry, without the full path.
- Type
str
- property size
size of the file entry in bytes or None if not available.
- Type
int
dfvfs.vfs.zip_file_system module
The ZIP file system implementation.
- class dfvfs.vfs.zip_file_system.ZipFileSystem(resolver_context, path_spec, encoding='utf-8')[source]
Bases:
FileSystem
File system that uses zipfile.
- encoding
encoding of the file entry name.
- Type
str
- FileEntryExistsByPathSpec(path_spec)[source]
Determines if a file entry for a path specification exists.
- Parameters
path_spec (PathSpec) – path specification of the file entry.
- Returns
True if the file entry exists.
- Return type
bool
- GetFileEntryByPathSpec(path_spec)[source]
Retrieves a file entry for a path specification.
- Parameters
path_spec (PathSpec) – path specification of the file entry.
- Returns
a file entry or None.
- Return type
- GetRootFileEntry()[source]
Retrieves the root file entry.
- Returns
a file entry or None.
- Return type
- GetZipFile()[source]
Retrieves the ZIP file object.
- Returns
a ZIP file object or None.
- Return type
zipfile.ZipFile
- GetZipInfoByPathSpec(path_spec)[source]
Retrieves the ZIP info for a path specification.
- Parameters
path_spec (PathSpec) – a path specification.
- Returns
a ZIP info object or None if not available.
- Return type
zipfile.ZipInfo
- Raises
PathSpecError – if the path specification is incorrect.
- TYPE_INDICATOR = 'ZIP'