dfvfs.vfs package

Submodules

dfvfs.vfs.apfs_attribute module

The APFS attribute implementation.

class dfvfs.vfs.apfs_attribute.APFSExtendedAttribute(fsapfs_extended_attribute)[source]

Bases: Attribute

APFS extended attribute that uses pyfsapfs.

GetExtents()[source]

Retrieves the extents.

Returns

the extents of the attribute data.

Return type

list[Extent]

get_offset()[source]

Retrieves the current offset into the file input/output (IO) object.

Returns

current offset into the file input/output (IO) object.

Return type

int

get_size()[source]

Retrieves the size of the file input/output (IO) object.

Returns

size of the file input/output (IO) object.

Return type

int

property name

name.

Type

str

read(size=None)[source]

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file input/output (IO) object.

Parameters
  • offset (int) – offset to seek.

  • whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises
  • IOError – if the seek failed.

  • OSError – if the seek failed.

seekable()[source]

Determines if a file input/output (IO) object is seekable.

Returns

True since a file IO object provides a seek method.

Return type

bool

tell()[source]

Retrieves the current offset into the file input/output (IO) object.

dfvfs.vfs.apfs_container_directory module

The APFS container directory implementation.

class dfvfs.vfs.apfs_container_directory.APFSContainerDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pyfsapfs.

dfvfs.vfs.apfs_container_file_entry module

The APFS container file entry implementation.

class dfvfs.vfs.apfs_container_file_entry.APFSContainerFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, volume_index=None)[source]

Bases: FileEntry

File system file entry that uses pyfsapfs.

GetAPFSVolume()[source]

Retrieves an APFS volume.

Returns

an APFS volume or None if not available.

Return type

pyfsapfs.volume

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None if not available.

Return type

APFSContainerFileEntry

IsLocked()[source]

Determines if the file entry is locked.

Returns

True if the file entry is locked.

Return type

bool

TYPE_INDICATOR = 'APFS_CONTAINER'
Unlock()[source]

Unlocks the file entry.

Returns

True if the file entry was unlocked.

Return type

bool

property name

name of the file entry, which does not include the full path.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

property sub_file_entries

sub file entries.

Type

generator[APFSContainerFileEntry]

dfvfs.vfs.apfs_container_file_system module

The APFS container file system implementation.

class dfvfs.vfs.apfs_container_file_system.APFSContainerFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

APFS container file system using pyfsapfs.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – a path specification.

Returns

True if the file entry exists.

Return type

bool

GetAPFSContainer()[source]

Retrieves the APFS container.

Returns

the APFS container.

Return type

pyfsapfs.container

GetAPFSVolumeByPathSpec(path_spec)[source]

Retrieves an APFS volume for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

an APFS volume or None if not available.

Return type

pyfsapfs.volume

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

a file entry or None if not exists.

Return type

APFSContainerFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

a file entry.

Return type

APFSContainerFileEntry

GetVolumeIndexByPathSpec(path_spec)[source]

Retrieves the volume index for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

volume index or None if the index cannot be determined.

Return type

int

TYPE_INDICATOR = 'APFS_CONTAINER'

dfvfs.vfs.apfs_directory module

The APFS directory implementation.

class dfvfs.vfs.apfs_directory.APFSDirectory(file_system, path_spec, fsapfs_file_entry)[source]

Bases: Directory

File system directory that uses pyfsapfs.

dfvfs.vfs.apfs_file_entry module

The APFS file entry implementation.

class dfvfs.vfs.apfs_file_entry.APFSFileEntry(resolver_context, file_system, path_spec, fsapfs_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyfsapfs.

GetAPFSFileEntry()[source]

Retrieves the APFS file entry.

Returns

APFS file entry.

Return type

pyfsapfs.file_entry

GetExtents()[source]

Retrieves the extents.

Returns

the extents.

Return type

list[Extent]

GetLinkedFileEntry()[source]

Retrieves the linked file entry, e.g. for a symbolic link.

Returns

linked file entry or None if not available.

Return type

APFSFileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None if not available.

Return type

APFSFileEntry

TYPE_INDICATOR = 'APFS'
property access_time

access time or None if not available.

Type

dfdatetime.DateTimeValues

property added_time

added time or None if not available.

Type

dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type

dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type

dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type

dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.apfs_file_system module

The APFS file system implementation.

class dfvfs.vfs.apfs_file_system.APFSFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfsapfs.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – path specification.

Returns

True if the file entry exists.

Return type

bool

Raises

BackEndError – if the file entry cannot be opened.

GetAPFSFileEntryByPathSpec(path_spec)[source]

Retrieves the APFS file entry for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

file entry.

Return type

pyfsapfs.file_entry

Raises

PathSpecError – if the path specification is missing location and identifier.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

file entry or None if not available.

Return type

APFSFileEntry

Raises

BackEndError – if the file entry cannot be opened.

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

file entry or None if not available.

Return type

APFSFileEntry

ROOT_DIRECTORY_IDENTIFIER = 2
TYPE_INDICATOR = 'APFS'

dfvfs.vfs.apm_directory module

The Apple Partition Map (APM) directory implementation.

class dfvfs.vfs.apm_directory.APMDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pyvsapm.

dfvfs.vfs.apm_file_entry module

The Apple Partition Map (APM) file entry implementation.

class dfvfs.vfs.apm_file_entry.APMFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, vsapm_partition=None)[source]

Bases: FileEntry

File system file entry that uses pyvsapm.

GetAPMPartition()[source]

Retrieves the APM partition.

Returns

a APM partition.

Return type

pyvsapm.partition

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None if not available.

Return type

APMFileEntry

TYPE_INDICATOR = 'APM'
property name

name of the file entry, without the full path.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.apm_file_system module

The Apple Partition Map (APM) file system implementation.

class dfvfs.vfs.apm_file_system.APMFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyvsapm.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – path specification.

Returns

True if the file entry exists.

Return type

bool

GetAPMPartitionByPathSpec(path_spec)[source]

Retrieves a APM partition for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

a APM partition or None if not available.

Return type

pyvsapm.partition

GetAPMVolume()[source]

Retrieves the APM volume.

Returns

a APM volume.

Return type

pyvsapm.volume

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

a file entry or None if not available.

Return type

APMFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

root file entry or None if not available.

Return type

APMFileEntry

TYPE_INDICATOR = 'APM'

dfvfs.vfs.attribute module

The Virtual File System (VFS) attribute interface.

class dfvfs.vfs.attribute.Attribute[source]

Bases: object

Attribute interface.

GetExtents()[source]

Retrieves the extents.

Returns

the extents of the attribute data.

Return type

list[Extent]

property type_indicator

type indicator or None if not known.

Type

str

class dfvfs.vfs.attribute.StatAttribute[source]

Bases: object

Attribute that represents a POSIX stat.

device_number

major and minor device number (if block or character device file), derived from st_rdev.

Type

Tuple[int, int]

group_identifier

group identifier (GID), equivalent to st_gid.

Type

int

inode_number

number of the corresponding inode, equivalent to st_ino.

Type

int

mode

access mode, equivalent to st_mode.

Type

int

number of hard links, equivalent to st_nlink.

Type

int

owner_identifier

user identifier (UID) of the owner, equivalent to st_uid.

Type

int

size

size, in number of bytes, equivalent to st_size.

Type

int

type

file type, value derived from st_mode >> 12.

Type

str

TYPE_BLOCK_DEVICE = 'block_device'
TYPE_CHARACTER_DEVICE = 'character_device'
TYPE_DEVICE = 'device'
TYPE_DIRECTORY = 'directory'
TYPE_FILE = 'file'
TYPE_PIPE = 'pipe'
TYPE_SOCKET = 'socket'
TYPE_WHITEOUT = 'whiteout'

dfvfs.vfs.bde_file_entry module

The BDE file entry implementation.

class dfvfs.vfs.bde_file_entry.BDEFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

File system file entry that uses pybde.

IsLocked()[source]

Determines if the file entry is locked.

Returns

True if the file entry is locked.

Return type

bool

TYPE_INDICATOR = 'BDE'
Unlock()[source]

Unlocks the file entry.

Returns

True if the file entry was unlocked.

Return type

bool

property creation_time

creation time or None if not available.

Type

dfdatetime.DateTimeValues

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.bde_file_system module

The BDE file system implementation.

class dfvfs.vfs.bde_file_system.BDEFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

File system that uses pybde.

GetBDEVolume()[source]

Retrieves the BDE volume.

Returns

BDE volume.

Return type

pybde.volume

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

file entry or None.

Return type

BDEFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

file entry or None.

Return type

BDEFileEntry

TYPE_INDICATOR = 'BDE'

dfvfs.vfs.compressed_stream_file_entry module

The compressed stream file entry implementation.

class dfvfs.vfs.compressed_stream_file_entry.CompressedStreamFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

Compressed stream file entry.

TYPE_INDICATOR = 'COMPRESSED_STREAM'
property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.compressed_stream_file_system module

The compressed stream file system implementation.

class dfvfs.vfs.compressed_stream_file_system.CompressedStreamFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

Compressed stream file system.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

a file entry or None if not available.

Return type

CompressedStreamFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

a file entry or None if not available.

Return type

CompressedStreamFileEntry

TYPE_INDICATOR = 'COMPRESSED_STREAM'

dfvfs.vfs.cpio_directory module

The CPIO directory implementation.

class dfvfs.vfs.cpio_directory.CPIODirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses CPIOArchiveFile.

dfvfs.vfs.cpio_file_entry module

The CPIO file entry implementation.

class dfvfs.vfs.cpio_file_entry.CPIOFileEntry(resolver_context, file_system, path_spec, cpio_archive_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses CPIOArchiveFile.

GetCPIOArchiveFileEntry()[source]

Retrieves the CPIO archive file entry object.

Returns

CPIO archive file entry.

Return type

CPIOArchiveFileEntry

Raises

PathSpecError – if the path specification is incorrect.

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None if not available.

Return type

CPIOFileEntry

TYPE_INDICATOR = 'CPIO'
property modification_time

modification time or None if not available.

Type

dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.cpio_file_system module

The CPIO archive file system implementation.

class dfvfs.vfs.cpio_file_system.CPIOFileSystem(resolver_context, path_spec, encoding='utf-8')[source]

Bases: FileSystem

CPIO archive file system.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – a path specification.

Returns

True if the file entry exists.

Return type

bool

GetCPIOArchiveFile()[source]

Retrieves the CPIO archive file.

Returns

a CPIO archive file.

Return type

CPIOArchiveFile

GetCPIOArchiveFileEntryByPathSpec(path_spec)[source]

Retrieves the CPIO archive file entry for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

CPIO archive file entry or None if not available.

Return type

CPIOArchiveFileEntry

Raises

PathSpecError – if the path specification is incorrect.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

a file entry or None if not available.

Return type

CPIOFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

a file entry or None if not available.

Return type

CPIOFileEntry

TYPE_INDICATOR = 'CPIO'

dfvfs.vfs.cs_directory module

The Core Storage (CS) directory implementation.

class dfvfs.vfs.cs_directory.CSDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pyfvde.

dfvfs.vfs.cs_file_entry module

The Core Storage (CS) file entry implementation.

class dfvfs.vfs.cs_file_entry.CSFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, fvde_logical_volume=None)[source]

Bases: FileEntry

File system file entry that uses pyfvde.

GetFVDELogicalVolume()[source]

Retrieves the Core Storage logical volume.

Returns

a Core Storage logical volume.

Return type

pyfvde.logical_volume

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None if not available.

Return type

CSFileEntry

IsLocked()[source]

Determines if the file entry is locked.

Returns

True if the file entry is locked.

Return type

bool

TYPE_INDICATOR = 'CS'
Unlock()[source]

Unlocks the file entry.

Returns

True if the file entry was unlocked.

Return type

bool

property name

name of the file entry, without the full path.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.cs_file_system module

The Core Storage (CS) file system implementation.

class dfvfs.vfs.cs_file_system.CSFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfvde.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – path specification.

Returns

True if the file entry exists.

Return type

bool

GetFVDELogicalVolumeByPathSpec(path_spec)[source]

Retrieves a Core Storage logical volume for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

a Core Storage logical volume or None if not

available.

Return type

pyfvde.logical_volume

GetFVDEVolumeGroup()[source]

Retrieves the Core Storage volume group.

Returns

a Core Storage volume group.

Return type

pyfvde.volume_group

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

a file entry or None if not available.

Return type

CSFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

root file entry or None if not available.

Return type

CSFileEntry

TYPE_INDICATOR = 'CS'

dfvfs.vfs.data_range_file_entry module

The data range file entry implementation.

class dfvfs.vfs.data_range_file_entry.DataRangeFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

File entry that represents a data range.

TYPE_INDICATOR = 'DATA_RANGE'
property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.data_range_file_system module

The data range file system implementation.

class dfvfs.vfs.data_range_file_system.DataRangeFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

Data range file system.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

a file entry or None if not available.

Return type

DataRangeFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

a file entry or None if not available.

Return type

DataRangeFileEntry

TYPE_INDICATOR = 'DATA_RANGE'

dfvfs.vfs.data_stream module

The Virtual File System (VFS) data stream interface.

class dfvfs.vfs.data_stream.DataStream(file_entry)[source]

Bases: object

Data stream interface.

GetExtents()[source]

Retrieves the extents.

Returns

the extents of the data stream.

Return type

list[Extent]

IsDefault()[source]

Determines if the data stream is the default data stream.

Returns

True if the data stream is the default data stream.

Return type

bool

property name

name.

Type

str

dfvfs.vfs.directory module

The Virtual File System (VFS) directory interface.

class dfvfs.vfs.directory.Directory(file_system, path_spec)[source]

Bases: object

Directory interface.

path_spec

path specification of the directory.

Type

PathSpec

property entries

path specifications of the directory entries.

Type

generator[PathSpec]

dfvfs.vfs.encoded_stream_file_entry module

The encoded stream file entry implementation.

class dfvfs.vfs.encoded_stream_file_entry.EncodedStreamFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

Class that implements an encoded stream file entry.

TYPE_INDICATOR = 'ENCODED_STREAM'
property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.encoded_stream_file_system module

The encoded stream file system implementation.

class dfvfs.vfs.encoded_stream_file_system.EncodedStreamFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

Encoded stream file system.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

a file entry or None if not available.

Return type

EncodedStreamFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

a file entry or None if not available.

Return type

EncodedStreamFileEntry

TYPE_INDICATOR = 'ENCODED_STREAM'

dfvfs.vfs.encrypted_stream_file_entry module

The encrypted stream file entry implementation.

class dfvfs.vfs.encrypted_stream_file_entry.EncryptedStreamFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

Encrypted stream file entry.

TYPE_INDICATOR = 'ENCRYPTED_STREAM'
property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.encrypted_stream_file_system module

The encrypted stream file system implementation.

class dfvfs.vfs.encrypted_stream_file_system.EncryptedStreamFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

Encrypted stream file system.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

a file entry or None if not available.

Return type

EncryptedStreamFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

a file entry or None if not available.

Return type

EncryptedStreamFileEntry

TYPE_INDICATOR = 'ENCRYPTED_STREAM'

dfvfs.vfs.ext_attribute module

The EXT attribute implementation.

class dfvfs.vfs.ext_attribute.EXTExtendedAttribute(fsext_extended_attribute)[source]

Bases: Attribute

EXT extended attribute that uses pyfsext.

GetExtents()[source]

Retrieves the extents.

Returns

the extents of the attribute data.

Return type

list[Extent]

get_offset()[source]

Retrieves the current offset into the file input/output (IO) object.

Returns

current offset into the file input/output (IO) object.

Return type

int

get_size()[source]

Retrieves the size of the file input/output (IO) object.

Returns

size of the file input/output (IO) object.

Return type

int

property name

name.

Type

str

read(size=None)[source]

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file input/output (IO) object.

Parameters
  • offset (int) – offset to seek.

  • whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises
  • IOError – if the seek failed.

  • OSError – if the seek failed.

seekable()[source]

Determines if a file input/output (IO) object is seekable.

Returns

True since a file IO object provides a seek method.

Return type

bool

tell()[source]

Retrieves the current offset into the file input/output (IO) object.

dfvfs.vfs.ext_directory module

The EXT directory implementation.

class dfvfs.vfs.ext_directory.EXTDirectory(file_system, path_spec, fsext_file_entry)[source]

Bases: Directory

File system directory that uses pyfsext.

dfvfs.vfs.ext_file_entry module

The EXT file entry implementation.

class dfvfs.vfs.ext_file_entry.EXTFileEntry(resolver_context, file_system, path_spec, fsext_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyfsext.

GetEXTFileEntry()[source]

Retrieves the EXT file entry.

Returns

EXT file entry.

Return type

pyfsext.file_entry

GetExtents()[source]

Retrieves the extents.

Returns

the extents.

Return type

list[Extent]

GetLinkedFileEntry()[source]

Retrieves the linked file entry, e.g. for a symbolic link.

Returns

linked file entry or None if not available.

Return type

EXTFileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None if not available.

Return type

EXTFileEntry

TYPE_INDICATOR = 'EXT'
property access_time

access time or None if not available.

Type

dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type

dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type

dfdatetime.DateTimeValues

property deletion_time

deletion time or None if not available.

Type

dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type

dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.ext_file_system module

The EXT file system implementation.

class dfvfs.vfs.ext_file_system.EXTFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfsext.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – path specification.

Returns

True if the file entry exists.

Return type

bool

Raises

BackEndError – if the file entry cannot be opened.

GetEXTFileEntryByPathSpec(path_spec)[source]

Retrieves the EXT file entry for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

file entry.

Return type

pyfsext.file_entry

Raises

PathSpecError – if the path specification is missing location and inode.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

file entry or None if not available.

Return type

EXTFileEntry

Raises

BackEndError – if the file entry cannot be opened.

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

file entry.

Return type

EXTFileEntry

ROOT_DIRECTORY_INODE_NUMBER = 2
TYPE_INDICATOR = 'EXT'

dfvfs.vfs.extent module

The Virtual File System (VFS) extent.

class dfvfs.vfs.extent.Extent(extent_type=None, offset=None, size=None)[source]

Bases: object

Extent.

extent_type

type of the extent, for example EXTENT_TYPE_SPARSE.

Type

str

offset

offset of the extent relative from the start of the file system in bytes.

Type

int

size

size of the extent in bytes.

Type

int

dfvfs.vfs.fake_directory module

The fake directory implementation.

class dfvfs.vfs.fake_directory.FakeDirectory(file_system, path_spec)[source]

Bases: Directory

Fake file system directory.

dfvfs.vfs.fake_file_entry module

The fake file entry implementation.

class dfvfs.vfs.fake_file_entry.FakeFileEntry(resolver_context, file_system, path_spec, file_entry_type=None, is_root=False)[source]

Bases: FileEntry

Fake file system file entry.

GetFileObject(data_stream_name='')[source]

Retrieves a file-like object of a specific data stream.

Parameters

data_stream_name (Optional[str]) – name of the data stream, where an empty string represents the default data stream.

Returns

a file-like object or None if not available.

Return type

FakeFileIO

Raises
  • IOError – if the file entry is not a file.

  • OSError – if the file entry is not a file.

GetParentFileEntry()[source]

Retrieves the root file entry.

Returns

parent file entry or None if not available.

Return type

FakeFileEntry

TYPE_INDICATOR = 'FAKE'
property access_time

access time or None if not available.

Type

dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type

dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type

dfdatetime.DateTimeValues

property name

name of the file entry, without the full path.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.fake_file_system module

The fake file system implementation.

class dfvfs.vfs.fake_file_system.FakeFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

Fake file system.

AddFileEntry(path, file_entry_type='file', file_data=None, link_data=None)[source]

Adds a fake file entry.

Parameters
  • path (str) – path of the file entry.

  • file_entry_type (Optional[str]) – type of the file entry object.

  • file_data (Optional[bytes]) – data of the fake file-like object.

  • link_data (Optional[bytes]) – link data of the fake file entry object.

Raises
  • KeyError – if the path already exists.

  • ValueError – if the file data is set but the file entry type is not a file or if the link data is set but the file entry type is not a link.

FileEntryExistsByPath(path)[source]

Determines if a file entry for a path exists.

Parameters

path (str) – path of the file entry.

Returns

True if the file entry exists.

Return type

bool

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – path specification.

Returns

True if the file entry exists.

Return type

bool

GetDataByPath(path)[source]

Retrieves the data associated to a path.

Parameters

path (str) – path of the file entry.

Returns

data or None if not available.

Return type

bytes

GetFileEntryByPath(path)[source]

Retrieves a file entry for a path.

Parameters

path (str) – path of the file entry.

Returns

a file entry or None if not available.

Return type

FakeFileEntry

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

a file entry or None if not available.

Return type

FakeFileEntry

GetPaths()[source]

Retrieves the paths dictionary.

Returns

file-like object per path.

Return type

dict[str, FileIO]

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

a file entry or None if not available.

Return type

FakeFileEntry

TYPE_INDICATOR = 'FAKE'

dfvfs.vfs.fat_directory module

The FAT directory implementation.

class dfvfs.vfs.fat_directory.FATDirectory(file_system, path_spec, fsfat_file_entry)[source]

Bases: Directory

File system directory that uses pyfsfat.

dfvfs.vfs.fat_file_entry module

The FAT file entry implementation.

class dfvfs.vfs.fat_file_entry.FATFileEntry(resolver_context, file_system, path_spec, fsfat_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyfsfat.

GetExtents()[source]

Retrieves the extents.

Returns

the extents.

Return type

list[Extent]

GetFATFileEntry()[source]

Retrieves the FAT file entry.

Returns

FAT file entry.

Return type

pyfsfat.file_entry

GetFileObject(data_stream_name='')[source]

Retrieves a file-like object of a specific data stream.

Parameters

data_stream_name (Optional[str]) – name of the data stream, where an empty string represents the default data stream.

Returns

a file-like object or None if not available.

Return type

FileIO

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None if not available.

Return type

FATFileEntry

TYPE_INDICATOR = 'FAT'
property access_time

access time or None if not available.

Type

dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type

dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type

dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.fat_file_system module

The FAT file system implementation.

class dfvfs.vfs.fat_file_system.FATFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfsfat.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – path specification.

Returns

True if the file entry exists.

Return type

bool

Raises

BackEndError – if the file entry cannot be opened.

GetFATFileEntryByPathSpec(path_spec)[source]

Retrieves the FAT file entry for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

file entry.

Return type

pyfsfat.file_entry

Raises

PathSpecError – if the path specification is missing location and identifier.

GetFATVolume()[source]

Retrieves the FAT volume.

Returns

a FAT volume.

Return type

pyfsfat.volume

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

file entry or None if not available.

Return type

FATFileEntry

Raises

BackEndError – if the file entry cannot be opened.

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

file entry.

Return type

FATFileEntry

LOCATION_ROOT = '\\'
PATH_SEPARATOR = '\\'
TYPE_INDICATOR = 'FAT'

dfvfs.vfs.file_entry module

The Virtual File System (VFS) file entry interface.

The file entry can be various file system elements like a regular file, a directory or file system metadata.

class dfvfs.vfs.file_entry.FileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: object

File entry interface.

entry_type

file entry type, such as device, directory, file, link, socket and pipe or None if not available. The available file entry types are defined in dfvfs.lib.definitions for example FILE_ENTRY_TYPE_FILE.

Type

str

path_spec

path specification.

Type

PathSpec

GetDataStream(name, case_sensitive=True)[source]

Retrieves a data stream by name.

Parameters
  • name (str) – name of the data stream.

  • case_sensitive (Optional[bool]) – True if the name is case sensitive.

Returns

a data stream or None if not available.

Return type

DataStream

Raises

ValueError – if the name is not string.

GetExtents()[source]

Retrieves the extents.

Returns

the extents.

Return type

list[Extent]

GetFileObject(data_stream_name='')[source]

Retrieves a file-like object of a specific data stream.

Parameters

data_stream_name (Optional[str]) – name of the data stream, where an empty string represents the default data stream.

Returns

a file-like object or None if not available.

Return type

FileIO

GetFileSystem()[source]

Retrieves the file system which contains the file entry.

Returns

a file system.

Return type

FileSystem

GetLinkedFileEntry()[source]

Retrieves the linked file entry, for example for a symbolic link.

Returns

linked file entry or None if not available.

Return type

FileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None if not available.

Return type

FileEntry

GetStatAttribute()[source]

Retrieves a stat attribute.

Returns

a stat attribute or None if not available.

Return type

StatAttribute

GetSubFileEntryByName(name, case_sensitive=True)[source]

Retrieves a sub file entry by name.

Parameters
  • name (str) – name of the file entry.

  • case_sensitive (Optional[bool]) – True if the name is case sensitive.

Returns

a file entry or None if not available.

Return type

FileEntry

HasDataStream(name, case_sensitive=True)[source]

Determines if the file entry has specific data stream.

Parameters
  • name (str) – name of the data stream.

  • case_sensitive (Optional[bool]) – True if the name is case sensitive.

Returns

True if the file entry has the data stream.

Return type

bool

Raises

ValueError – if the name is not string.

HasExternalData()[source]

Determines if the file entry has external stored data.

Returns

True if the file entry has external stored data.

Return type

bool

IsAllocated()[source]

Determines if the file entry is allocated.

Returns

True if the file entry is allocated.

Return type

bool

IsDevice()[source]

Determines if the file entry is a device.

Returns

True if the file entry is a device.

Return type

bool

IsDirectory()[source]

Determines if the file entry is a directory.

Returns

True if the file entry is a directory.

Return type

bool

IsFile()[source]

Determines if the file entry is a file.

Returns

True if the file entry is a file.

Return type

bool

Determines if the file entry is a link.

Returns

True if the file entry is a link.

Return type

bool

IsLocked()[source]

Determines if the file entry is locked.

Returns

True if the file entry is locked.

Return type

bool

IsPipe()[source]

Determines if the file entry is a pipe.

Returns

True if the file entry is a pipe.

Return type

bool

IsRoot()[source]

Determines if the file entry is the root file entry.

Returns

True if the file entry is the root file entry.

Return type

bool

IsSocket()[source]

Determines if the file entry is a socket.

Returns

True if the file entry is a socket.

Return type

bool

IsVirtual()[source]

Determines if the file entry is virtual (emulated by dfVFS).

Returns

True if the file entry is virtual.

Return type

bool

Unlock()[source]

Unlocks the file entry.

Returns

True if the file entry was unlocked.

Return type

bool

property access_time

access time or None if not available.

Type

dfdatetime.DateTimeValues

property added_time

added time or None if not available.

Type

dfdatetime.DateTimeValues

property attributes

attributes.

Type

generator[Attribute]

property backup_time

backup time or None if not available.

Type

dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type

dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type

dfdatetime.DateTimeValues

property data_streams

data streams.

Type

generator[DataStream]

property deletion_time

deletion time or None if not available.

Type

dfdatetime.DateTimeValues

full path of the linked file entry or None if not available.

Type

str

property modification_time

modification time or None if not available.

Type

dfdatetime.DateTimeValues

abstract property name

name of the file entry, without the full path.

Type

str

property number_of_attributes

number of attributes.

Type

int

property number_of_data_streams

number of data streams.

Type

int

property number_of_sub_file_entries

number of sub file entries.

Type

int

property size

size of the file entry in bytes or None if not available.

Type

int

property sub_file_entries

sub file entries.

Type

generator[FileEntry]

property type_indicator

type indicator.

Type

str

dfvfs.vfs.file_system module

The Virtual File System (VFS) file system interface.

class dfvfs.vfs.file_system.FileSystem(resolver_context, path_spec)[source]

Bases: object

File system interface.

BasenamePath(path)[source]

Determines the basename of the path.

Parameters

path (str) – path.

Returns

basename of the path.

Return type

str

DirnamePath(path)[source]

Determines the directory name of the path.

The file system root is represented by an empty string.

Parameters

path (str) – path.

Returns

directory name of the path or None.

Return type

str

abstract FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – a path specification.

Returns

True if the file entry exists.

Return type

bool

GetDataStreamByPathSpec(path_spec)[source]

Retrieves a data stream for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

a data stream or None if not available.

Return type

DataStream

abstract GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

a file entry or None if not available.

Return type

FileEntry

GetFileObjectByPathSpec(path_spec)[source]

Retrieves a file-like object for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

a file-like object or None if not available.

Return type

FileIO

GetPathSegmentAndSuffix(base_path, path)[source]

Determines the path segment and suffix of the path.

None is returned if the path does not start with the base path and an empty string if the path exactly matches the base path.

Parameters
  • base_path (str) – base path.

  • path (str) – path.

Returns

path segment and suffix string.

Return type

tuple[str, str]

abstract GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

a file entry or None if not available.

Return type

FileEntry

JoinPath(path_segments)[source]

Joins the path segments into a path.

Parameters

path_segments (list[str]) – path segments.

Returns

joined path segments prefixed with the path separator.

Return type

str

LOCATION_ROOT = '/'
Open(path_spec=None, mode='rb')[source]

Opens the file system object defined by path specification.

Parameters
  • path_spec (Optional[PathSpec]) – a path specification.

  • mode (Optional[str]) – file access mode. The default is ‘rb’ which represents read-only binary.

Raises
  • AccessError – if the access to open the file was denied.

  • IOError – if the file system object was already opened or the open failed.

  • OSError – if the file system object was already opened or the open failed.

  • PathSpecError – if the path specification is incorrect.

  • ValueError – if the path specification or mode is invalid.

PATH_SEPARATOR = '/'
SplitPath(path)[source]

Splits the path into path segments.

Parameters

path (str) – path.

Returns

path segments without the root path segment, which is

an empty string.

Return type

list[str]

__del__()[source]

Cleans up the file system.

property type_indicator

type indicator.

Type

str

dfvfs.vfs.gpt_directory module

The GUID Partition Table (GPT) directory implementation.

class dfvfs.vfs.gpt_directory.GPTDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pyvsgpt.

dfvfs.vfs.gpt_file_entry module

The GUID Partition Table (GPT) file entry implementation.

class dfvfs.vfs.gpt_file_entry.GPTFileEntry(resolver_context, file_system, path_spec, entry_index=None, is_root=False, is_virtual=False, vsgpt_partition=None)[source]

Bases: FileEntry

File system file entry that uses pyvsgpt.

GetGPTPartition()[source]

Retrieves the GPT partition.

Returns

a GPT partition.

Return type

pyvsgpt.partition

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None if not available.

Return type

GPTFileEntry

TYPE_INDICATOR = 'GPT'
property name

name of the file entry, without the full path.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.gpt_file_system module

The GUID Partition Table (GPT) file system implementation.

class dfvfs.vfs.gpt_file_system.GPTFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyvsgpt.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – path specification.

Returns

True if the file entry exists.

Return type

bool

GetEntryIndexByPathSpec(path_spec)[source]

Retrieves the entry index for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

entry index or None if not available.

Return type

int

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

a file entry or None if not available.

Return type

GPTFileEntry

GetGPTPartitionByPathSpec(path_spec)[source]

Retrieves a GPT partition for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

a GPT partition or None if not available.

Return type

pyvsgpt.partition

GetGPTVolume()[source]

Retrieves the GPT volume.

Returns

a GPT volume.

Return type

pyvsgpt.volume

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

root file entry or None if not available.

Return type

GPTFileEntry

TYPE_INDICATOR = 'GPT'

dfvfs.vfs.gzip_file_entry module

The gzip file entry implementation.

class dfvfs.vfs.gzip_file_entry.GzipFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

File system file entry that uses gzip.

TYPE_INDICATOR = 'GZIP'
property modification_time

modification time or None if not available.

Type

dfdatetime.DateTimeValues

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.gzip_file_system module

The gzip file system implementation.

class dfvfs.vfs.gzip_file_system.GzipFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

File system that uses gzip.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

a file entry or None if not available.

Return type

GzipFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

a file entry or None if not available.

Return type

GzipFileEntry

TYPE_INDICATOR = 'GZIP'

dfvfs.vfs.hfs_attribute module

The HFS attribute implementation.

class dfvfs.vfs.hfs_attribute.HFSExtendedAttribute(fshfs_extended_attribute)[source]

Bases: Attribute

HFS extended attribute that uses pyfshfs.

GetExtents()[source]

Retrieves the extents.

Returns

the extents of the attribute data.

Return type

list[Extent]

get_offset()[source]

Retrieves the current offset into the file input/output (IO) object.

Returns

current offset into the file input/output (IO) object.

Return type

int

get_size()[source]

Retrieves the size of the file input/output (IO) object.

Returns

size of the file input/output (IO) object.

Return type

int

property name

name.

Type

str

read(size=None)[source]

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file input/output (IO) object.

Parameters
  • offset (int) – offset to seek.

  • whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises
  • IOError – if the seek failed.

  • OSError – if the seek failed.

seekable()[source]

Determines if a file input/output (IO) object is seekable.

Returns

True since a file IO object provides a seek method.

Return type

bool

tell()[source]

Retrieves the current offset into the file input/output (IO) object.

dfvfs.vfs.hfs_data_stream module

The HFS data stream implementation.

class dfvfs.vfs.hfs_data_stream.HFSDataStream(file_entry, fshfs_data_stream)[source]

Bases: DataStream

File system data stream that uses pyfshfs.

GetExtents()[source]

Retrieves the extents.

Returns

the extents of the data stream.

Return type

list[Extent]

dfvfs.vfs.hfs_directory module

The HFS directory implementation.

class dfvfs.vfs.hfs_directory.HFSDirectory(file_system, path_spec, fshfs_file_entry)[source]

Bases: Directory

File system directory that uses pyfshfs.

dfvfs.vfs.hfs_file_entry module

The HFS file entry implementation.

class dfvfs.vfs.hfs_file_entry.HFSFileEntry(resolver_context, file_system, path_spec, fshfs_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyfshfs.

GetExtents()[source]

Retrieves the extents.

Returns

the extents.

Return type

list[Extent]

GetFileObject(data_stream_name='')[source]

Retrieves a file-like object of a specific data stream.

Parameters

data_stream_name (Optional[str]) – name of the data stream, where an empty string represents the default data stream.

Returns

a file-like object or None if not available.

Return type

FileIO

GetHFSFileEntry()[source]

Retrieves the HFS file entry.

Returns

HFS file entry.

Return type

pyfshfs.file_entry

GetLinkedFileEntry()[source]

Retrieves the linked file entry, e.g. for a symbolic link.

Returns

linked file entry or None if not available.

Return type

HFSFileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None if not available.

Return type

HFSFileEntry

TYPE_INDICATOR = 'HFS'
property access_time

access time or None if not available.

Type

dfdatetime.DateTimeValues

property added_time

added time or None if not available.

Type

dfdatetime.DateTimeValues

property backup_time

backup time or None if not available.

Type

dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type

dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type

dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type

dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.hfs_file_system module

The HFS file system implementation.

class dfvfs.vfs.hfs_file_system.HFSFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfshfs.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – path specification.

Returns

True if the file entry exists.

Return type

bool

Raises

BackEndError – if the file entry cannot be opened.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

file entry or None if not available.

Return type

HFSFileEntry

Raises

BackEndError – if the file entry cannot be opened.

GetHFSFileEntryByPathSpec(path_spec)[source]

Retrieves the HFS file entry for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

file entry.

Return type

pyfshfs.file_entry

Raises

PathSpecError – if the path specification is missing location and identifier.

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

file entry.

Return type

HFSFileEntry

ROOT_DIRECTORY_IDENTIFIER_NUMBER = 2
TYPE_INDICATOR = 'HFS'

dfvfs.vfs.luksde_file_entry module

The LUKSDE file entry implementation.

class dfvfs.vfs.luksde_file_entry.LUKSDEFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

File system file entry that uses pyluksde.

IsLocked()[source]

Determines if the file entry is locked.

Returns

True if the file entry is locked.

Return type

bool

TYPE_INDICATOR = 'LUKSDE'
Unlock()[source]

Unlocks the file entry.

Returns

True if the file entry was unlocked.

Return type

bool

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.luksde_file_system module

The LUKSDE file system implementation.

class dfvfs.vfs.luksde_file_system.LUKSDEFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

File system that uses pyluksde.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

file entry or None.

Return type

LUKSDEFileEntry

GetLUKSDEVolume()[source]

Retrieves the LUKSDE volume.

Returns

LUKSDE volume.

Return type

pyluksde.volume

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

file entry or None.

Return type

LUKSDEFileEntry

TYPE_INDICATOR = 'LUKSDE'

dfvfs.vfs.lvm_directory module

The Logical Volume Manager (LVM) directory implementation.

class dfvfs.vfs.lvm_directory.LVMDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pyvslvm.

dfvfs.vfs.lvm_file_entry module

The Logical Volume Manager (LVM) file entry implementation.

class dfvfs.vfs.lvm_file_entry.LVMFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, vslvm_logical_volume=None)[source]

Bases: FileEntry

File system file entry that uses pyvslvm.

GetLVMLogicalVolume()[source]

Retrieves the LVM logical volume.

Returns

a LVM logical volume.

Return type

pyvslvm.logical_volume

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None if not available.

Return type

LVMFileEntry

TYPE_INDICATOR = 'LVM'
property name

name of the file entry, without the full path.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.lvm_file_system module

The Logical Volume Manager (LVM) file system implementation.

class dfvfs.vfs.lvm_file_system.LVMFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyvslvm.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – path specification.

Returns

True if the file entry exists.

Return type

bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

a file entry or None if not available.

Return type

LVMFileEntry

GetLVMLogicalVolumeByPathSpec(path_spec)[source]

Retrieves a LVM logical volume for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

a LVM logical volume or None if not available.

Return type

pyvslvm.logical_volume

GetLVMVolumeGroup()[source]

Retrieves the LVM volume group.

Returns

a LVM volume group.

Return type

pyvslvm.volume_group

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

root file entry or None if not available.

Return type

LVMFileEntry

TYPE_INDICATOR = 'LVM'

dfvfs.vfs.ntfs_attribute module

The NTFS attribute implementations.

class dfvfs.vfs.ntfs_attribute.FileNameNTFSAttribute(fsntfs_attribute)[source]

Bases: NTFSAttribute

NTFS $FILE_NAME file system attribute.

TYPE_INDICATOR = 'NTFS:$FILE_NAME'
property access_time

access time or None if not set.

Type

dfdatetime.Filetime

property creation_time

creation time or None if not set.

Type

dfdatetime.Filetime

property entry_modification_time

entry modification time or None if not set.

Type

dfdatetime.Filetime

property file_attribute_flags

file attribute flags or None if not available.

Type

int

property modification_time

modification time.

Type

dfdatetime.Filetime

property name

name.

Type

str

property name_space

name_space.

Type

int

property parent_file_reference

parent file reference.

Type

int

class dfvfs.vfs.ntfs_attribute.NTFSAttribute(fsntfs_attribute)[source]

Bases: Attribute

File system attribute that uses pyfsntfs.

property attribute_type

The attribute type.

class dfvfs.vfs.ntfs_attribute.ObjectIdentifierNTFSAttribute(fsntfs_attribute)[source]

Bases: NTFSAttribute

NTFS $OBJECT_ID file system attribute.

TYPE_INDICATOR = 'NTFS:$OBJECT_ID'
property droid_file_identifier

droid file identifier, formatted as an UUID.

Type

str

class dfvfs.vfs.ntfs_attribute.SecurityDescriptorNTFSAttribute(fsntfs_attribute)[source]

Bases: NTFSAttribute

NTFS $SECURITY_DESCRIPTOR file system attribute.

TYPE_INDICATOR = 'NTFS:$SECURITY_DESCRIPTOR'
property security_descriptor

security descriptor.

Type

pyfwnt.security_descriptor

class dfvfs.vfs.ntfs_attribute.StandardInformationNTFSAttribute(fsntfs_attribute)[source]

Bases: NTFSAttribute

NTFS $STANDARD_INFORMATION file system attribute.

TYPE_INDICATOR = 'NTFS:$STANDARD_INFORMATION'
property access_time

access time or None if not set.

Type

dfdatetime.Filetime

property creation_time

creation time or None if not set.

Type

dfdatetime.Filetime

property entry_modification_time

entry modification time or None if not set.

Type

dfdatetime.Filetime

property file_attribute_flags

file attribute flags or None if not available.

Type

int

property modification_time

modification time or None if not set.

Type

dfdatetime.Filetime

property owner_identifier

owner identifier.

Type

int

property security_descriptor_identifier

security descriptor identifier.

Type

int

property update_sequence_number

update sequence number.

Type

int

dfvfs.vfs.ntfs_data_stream module

The NTFS data stream implementation.

class dfvfs.vfs.ntfs_data_stream.NTFSDataStream(file_entry, fsntfs_data_stream)[source]

Bases: DataStream

File system data stream that uses pyfsntfs.

GetExtents()[source]

Retrieves the extents.

Returns

the extents of the data stream.

Return type

list[Extent]

dfvfs.vfs.ntfs_directory module

The NTFS directory implementation.

class dfvfs.vfs.ntfs_directory.NTFSDirectory(file_system, path_spec, fsntfs_file_entry)[source]

Bases: Directory

File system directory that uses pyfsntfs.

dfvfs.vfs.ntfs_file_entry module

The NTFS file entry implementation.

class dfvfs.vfs.ntfs_file_entry.NTFSFileEntry(resolver_context, file_system, path_spec, fsntfs_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyfsntfs.

GetExtents()[source]

Retrieves the extents.

Returns

the extents.

Return type

list[Extent]

GetFileObject(data_stream_name='')[source]

Retrieves a file-like object of a specific data stream.

Parameters

data_stream_name (Optional[str]) – data stream name, where an empty string represents the default data stream.

Returns

file-like object or None.

Return type

NTFSFileIO

GetLinkedFileEntry()[source]

Retrieves the linked file entry, e.g. for a symbolic link.

Returns

linked file entry or None.

Return type

NTFSFileEntry

GetNTFSFileEntry()[source]

Retrieves the NTFS file entry.

Returns

NTFS file entry.

Return type

pyfsntfs.file_entry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None if not available.

Return type

NTFSFileEntry

GetSecurityDescriptor()[source]

Retrieves the security descriptor.

Returns

security descriptor.

Return type

pyfwnt.security_descriptor

IsAllocated()[source]

Determines if the file entry is allocated.

Returns

True if the file entry is allocated.

Return type

bool

TYPE_INDICATOR = 'NTFS'
property access_time

access time or None if not available.

Type

dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type

dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type

dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type

dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.ntfs_file_system module

The NTFS file system implementation.

class dfvfs.vfs.ntfs_file_system.NTFSFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfsntfs.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – path specification.

Returns

True if the file entry exists.

Return type

bool

Raises

BackEndError – if the file entry cannot be opened.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

file entry or None if not available.

Return type

NTFSFileEntry

Raises

BackEndError – if the file entry cannot be opened.

GetNTFSFileEntryByPathSpec(path_spec)[source]

Retrieves the NTFS file entry for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

NTFS file entry.

Return type

pyfsntfs.file_entry

Raises

PathSpecError – if the path specification is missing location and MFT entry.

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

file entry.

Return type

NTFSFileEntry

LOCATION_ROOT = '\\'
MFT_ENTRY_ROOT_DIRECTORY = 5
PATH_SEPARATOR = '\\'
TYPE_INDICATOR = 'NTFS'

dfvfs.vfs.os_attribute module

The operating system attribute implementation.

class dfvfs.vfs.os_attribute.OSExtendedAttribute(location, name)[source]

Bases: Attribute

Extended attribute that uses the operating system.

get_offset()[source]

Retrieves the current offset into the file input/output (IO) object.

Returns

current offset into the file input/output (IO) object.

Return type

int

get_size()[source]

Retrieves the size of the file input/output (IO) object.

Returns

size of the file input/output (IO) object.

Return type

int

property name

name.

Type

str

read(size=None)[source]

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file input/output (IO) object.

Parameters
  • offset (int) – offset to seek.

  • whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises
  • IOError – if the seek failed.

  • OSError – if the seek failed.

seekable()[source]

Determines if a file input/output (IO) object is seekable.

Returns

True since a file IO object provides a seek method.

Return type

bool

tell()[source]

Retrieves the current offset into the file input/output (IO) object.

dfvfs.vfs.os_directory module

The operating system directory implementation.

class dfvfs.vfs.os_directory.OSDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses the operating system.

dfvfs.vfs.os_file_entry module

The operating system file entry implementation.

class dfvfs.vfs.os_file_entry.OSFileEntry(resolver_context, file_system, path_spec, is_root=False)[source]

Bases: FileEntry

File system file entry that uses os.

GetLinkedFileEntry()[source]

Retrieves the linked file entry, for example for a symbolic link.

Returns

linked file entry or None if not available.

Return type

OSFileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None if not available.

Return type

OSFileEntry

TYPE_INDICATOR = 'OS'
property access_time

access time or None if not available.

Type

dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type

dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type

dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type

dfdatetime.DateTimeValues

property name

name of the file entry, without the full path.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.os_file_system module

The operating system file system implementation.

class dfvfs.vfs.os_file_system.OSFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses the operating system.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – a path specification.

Returns

True if the file entry exists, false otherwise.

Return type

bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

a file entry or None if not available.

Return type

OSFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

a file entry or None if not available.

Return type

OSFileEntry

JoinPath(path_segments)[source]

Joins the path segments into a path.

Parameters

path_segments (list[str]) – path segments.

Returns

joined path segments prefixed with the path separator.

Return type

str

PATH_SEPARATOR = '/'
TYPE_INDICATOR = 'OS'

dfvfs.vfs.root_only_file_entry module

The root only file system file entry implementation.

class dfvfs.vfs.root_only_file_entry.RootOnlyFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: FileEntry

Root only file system file entry.

property name

name of the file entry, without the full path.

Type

str

dfvfs.vfs.root_only_file_system module

The root only file system implementation.

class dfvfs.vfs.root_only_file_system.RootOnlyFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

Root only file system.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – path specification.

Returns

True if the file entry exists.

Return type

bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

a file entry or None if not available.

Return type

FileEntry

abstract GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

a file entry or None if not available.

Return type

FileEntry

dfvfs.vfs.sqlite_blob_directory module

The SQLite blob directory implementation.

class dfvfs.vfs.sqlite_blob_directory.SQLiteBlobDirectory(file_system, path_spec)[source]

Bases: Directory

SQLite blob directory.

dfvfs.vfs.sqlite_blob_file_entry module

The SQLite blob file entry implementation.

class dfvfs.vfs.sqlite_blob_file_entry.SQLiteBlobFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: FileEntry

SQLite blob file entry.

GetNumberOfRows()[source]

Retrieves the number of rows in the table.

Returns

number of rows.

Return type

int

Raises

BackEndError – when the SQLite blob file-like object is missing.

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None if not available.

Return type

SQLiteBlobFileEntry

TYPE_INDICATOR = 'SQLITE_BLOB'
property name

name of the file entry, which does not include the full path.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.sqlite_blob_file_system module

The SQLite blob file system implementation.

class dfvfs.vfs.sqlite_blob_file_system.SQLiteBlobFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

Class that implements a file system object using SQLite blob.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – path specification.

Returns

True if the file entry exists.

Return type

bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

a file entry or None.

Return type

FileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

a file entry or None.

Return type

FileEntry

TYPE_INDICATOR = 'SQLITE_BLOB'

dfvfs.vfs.tar_directory module

The TAR directory implementation.

class dfvfs.vfs.tar_directory.TARDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses tarfile.

dfvfs.vfs.tar_file_entry module

The TAR file entry implementation.

class dfvfs.vfs.tar_file_entry.TARFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, tar_info=None)[source]

Bases: FileEntry

File system file entry that uses tarfile.

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None.

Return type

TARFileEntry

GetTARInfo()[source]

Retrieves the TAR info.

Returns

TAR info or None if it does not exist.

Return type

tarfile.TARInfo

Raises

PathSpecError – if the path specification is incorrect.

TYPE_INDICATOR = 'TAR'
property modification_time

modification time or None if not available.

Type

dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.tar_file_system module

The TAR file system implementation.

class dfvfs.vfs.tar_file_system.TARFileSystem(resolver_context, path_spec, encoding='utf-8')[source]

Bases: FileSystem

Class that implements a file system using tarfile.

encoding

file entry name encoding.

Type

str

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – path specification.

Returns

True if the file entry exists.

Return type

bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

file entry or None.

Return type

TARFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

file entry.

Return type

TARFileEntry

GetTARFile()[source]

Retrieves the TAR file.

Returns

TAR file.

Return type

tarfile.TARFile

GetTARInfoByPathSpec(path_spec)[source]

Retrieves the TAR info for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

TAR info or None if it does not exist.

Return type

tarfile.TARInfo

Raises

PathSpecError – if the path specification is incorrect.

TYPE_INDICATOR = 'TAR'

dfvfs.vfs.tsk_attribute module

The SleuthKit (TSK) attribute implementation.

class dfvfs.vfs.tsk_attribute.TSKAttribute(tsk_file, tsk_attribute)[source]

Bases: Attribute

File system attribute that uses pytsk3.

property attribute_type

attribute type.

Type

object

class dfvfs.vfs.tsk_attribute.TSKExtendedAttribute(tsk_file, tsk_attribute)[source]

Bases: TSKAttribute

File system extended attribute that uses pytsk3.

get_offset()[source]

Retrieves the current offset into the file input/output (IO) object.

Returns

current offset into the file input/output (IO) object.

Return type

int

get_size()[source]

Retrieves the size of the file input/output (IO) object.

Returns

size of the file input/output (IO) object.

Return type

int

property name

name.

Raises

BackEndError – if pytsk3 returns a non UTF-8 formatted name.

Type

str

read(size=None)[source]

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file input/output (IO) object.

Parameters
  • offset (int) – offset to seek.

  • whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises
  • IOError – if the seek failed.

  • OSError – if the seek failed.

seekable()[source]

Determines if a file input/output (IO) object is seekable.

Returns

True since a file IO object provides a seek method.

Return type

bool

tell()[source]

Retrieves the current offset into the file input/output (IO) object.

dfvfs.vfs.tsk_data_stream module

The SleuthKit (TSK) data stream implementation.

class dfvfs.vfs.tsk_data_stream.TSKDataStream(file_entry, pytsk_attribute)[source]

Bases: DataStream

File system data stream that uses pytsk3.

GetExtents()[source]

Retrieves the extents.

Returns

the extents of the data stream.

Return type

list[Extent]

Raises

BackEndError – if pytsk3 returns no file system block size or data stream size.

dfvfs.vfs.tsk_directory module

The SleuthKit (TSK) directory implementation.

class dfvfs.vfs.tsk_directory.TSKDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pytsk3.

dfvfs.vfs.tsk_file_entry module

The SleuthKit (TSK) file entry implementation.

class dfvfs.vfs.tsk_file_entry.TSKFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, parent_inode=None, tsk_file=None)[source]

Bases: FileEntry

File system file entry that uses pytsk3.

GetExtents()[source]

Retrieves the extents.

Returns

the extents.

Return type

list[Extent]

Raises

BackEndError – if pytsk3 returns no file system block size or data stream size.

GetFileObject(data_stream_name='')[source]

Retrieves a file-like object of a specific data stream.

Parameters

data_stream_name (Optional[str]) – data stream name, where an empty string represents the default data stream.

Returns

file-like object or None.

Return type

TSKFileIO

GetLinkedFileEntry()[source]

Retrieves the linked file entry, e.g. for a symbolic link.

Returns

linked file entry or None.

Return type

TSKFileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None.

Return type

TSKFileEntry

GetTSKFile()[source]

Retrieves the SleuthKit file object.

Returns

TSK file.

Return type

pytsk3.File

Raises

PathSpecError – if the path specification is missing inode and location.

IsAllocated()[source]

Determines if the file entry is allocated.

Returns

True if the file entry is allocated.

Return type

bool

TYPE_INDICATOR = 'TSK'
property access_time

access time or None if not available.

Type

dfdatetime.DateTimeValues

property backup_time

backup time or None if not available.

Type

dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type

dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type

dfdatetime.DateTimeValues

property deletion_time

deletion time or None if not available.

Type

dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type

dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Raises

BackEndError – if pytsk3 returns a non UTF-8 formatted name.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

class dfvfs.vfs.tsk_file_entry.TSKTime(*args: Any, **kwargs: Any)[source]

Bases: DateTimeValues

SleuthKit timestamp.

fraction_of_second

fraction of second, which is an integer that contains the number 100 nano seconds before Sleuthkit 4.2.0 or number of nano seconds in Sleuthkit 4.2.0 and later.

Type

int

CopyFromDateTimeString(time_string)[source]

Copies a SleuthKit timestamp from a date and time string.

Parameters

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3 or 6 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

CopyToDateTimeString()[source]

Copies the date time value to a date and time string.

Returns

date and time value formatted as:

YYYY-MM-DD hh:mm:ss or YYYY-MM-DD hh:mm:ss.####### or YYYY-MM-DD hh:mm:ss.#########

Return type

str

GetDate()[source]

Retrieves the date represented by the date and time values.

Returns

year, month, day of month or (None, None, None)

if the date and time values do not represent a date.

Return type

tuple[int, int, int]

property timestamp

POSIX timestamp in microseconds or None if timestamp is not set.

Type

int

dfvfs.vfs.tsk_file_system module

The SleuthKit (TSK) file system implementation.

class dfvfs.vfs.tsk_file_system.TSKFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pytsk3.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – path specification.

Returns

True if the file entry exists.

Return type

bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

a file entry or None if not available.

Return type

TSKFileEntry

GetFsInfo()[source]

Retrieves the file system info.

Returns

file system info.

Return type

pytsk3.FS_Info

GetFsType()[source]

Retrieves the file system type.

Returns

file system type.

Return type

pytsk3.TSK_FS_TYPE_ENUM

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

a file entry.

Return type

TSKFileEntry

GetRootInode()[source]

Retrieves the root inode.

Returns

inode number or None if not available.

Return type

int

GetTSKFileByPathSpec(path_spec)[source]

Retrieves the SleuthKit file object for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

TSK file.

Return type

pytsk3.File

Raises

PathSpecError – if the path specification is missing inode and location.

IsExt()[source]

Determines if the file system is ext2, ext3 or ext4.

Returns

True if the file system is ext.

Return type

bool

IsHFS()[source]

Determines if the file system is HFS, HFS+ or HFSX.

Returns

True if the file system is HFS.

Return type

bool

IsNTFS()[source]

Determines if the file system is NTFS.

Returns

True if the file system is NTFS.

Return type

bool

TYPE_INDICATOR = 'TSK'

dfvfs.vfs.tsk_partition_directory module

The SleuthKit (TSK) partition directory implementation.

class dfvfs.vfs.tsk_partition_directory.TSKPartitionDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pytsk3.

dfvfs.vfs.tsk_partition_file_entry module

The SleuthKit (TSK) partition file entry implementation.

class dfvfs.vfs.tsk_partition_file_entry.TSKPartitionFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, tsk_vs_part=None)[source]

Bases: FileEntry

File system file entry that uses pytsk3.

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None if not available.

Return type

TSKPartitionFileEntry

GetTSKVsPart()[source]

Retrieves the TSK volume system part.

Returns

a TSK volume system part or None if not

available.

Return type

pytsk3.TSK_VS_PART_INFO

IsAllocated()[source]

Determines if the file entry is allocated.

Returns

True if the file entry is allocated.

Return type

bool

TYPE_INDICATOR = 'TSK_PARTITION'
property name

name of the file entry, which does not include the full path.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.tsk_partition_file_system module

The SleuthKit (TSK) partition file system implementation.

class dfvfs.vfs.tsk_partition_file_system.TSKPartitionFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

Class that implements a file system object using pytsk3.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – a path specification.

Returns

True if the file entry exists or false otherwise.

Return type

bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

a file entry or None of not available.

Return type

TSKPartitionFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

a file entry or None of not available.

Return type

TSKPartitionFileEntry

GetTSKVolume()[source]

Retrieves the TSK volume object.

Returns

a TSK volume object.

Return type

pytsk3.Volume_Info

TYPE_INDICATOR = 'TSK_PARTITION'

dfvfs.vfs.vshadow_directory module

The Volume Shadow Snapshots (VSS) directory implementation.

class dfvfs.vfs.vshadow_directory.VShadowDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pyvshadow.

dfvfs.vfs.vshadow_file_entry module

The Volume Shadow Snapshots (VSS) file entry implementation.

class dfvfs.vfs.vshadow_file_entry.VShadowFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyvshadow.

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None if not available.

Return type

FileEntry

GetVShadowStore()[source]

Retrieves a VSS store.

Returns

a VSS store or None if not available.

Return type

pyvshadow.store

HasExternalData()[source]

Determines if the file entry has external stored data.

Returns

True if the file entry has external data.

Return type

bool

TYPE_INDICATOR = 'VSHADOW'
property creation_time

creation time or None if not available.

Type

dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.vshadow_file_system module

The Volume Shadow Snapshots (VSS) file system implementation.

class dfvfs.vfs.vshadow_file_system.VShadowFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyvshadow.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – path specification.

Returns

True if the file entry exists.

Return type

bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

file entry or None if not available.

Return type

VShadowFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

file entry or None if not available.

Return type

VShadowFileEntry

GetVShadowStoreByPathSpec(path_spec)[source]

Retrieves a VSS store for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

a VSS store or None if not available.

Return type

pyvshadow.store

GetVShadowVolume()[source]

Retrieves a VSS volume.

Returns

a VSS volume.

Return type

pyvshadow.volume

TYPE_INDICATOR = 'VSHADOW'

dfvfs.vfs.xfs_attribute module

The XFS attribute implementation.

class dfvfs.vfs.xfs_attribute.XFSExtendedAttribute(fsxfs_extended_attribute)[source]

Bases: Attribute

XFS extended attribute that uses pyfsxfs.

GetExtents()[source]

Retrieves the extents.

Returns

the extents of the attribute data.

Return type

list[Extent]

get_offset()[source]

Retrieves the current offset into the file input/output (IO) object.

Returns

current offset into the file input/output (IO) object.

Return type

int

get_size()[source]

Retrieves the size of the file input/output (IO) object.

Returns

size of the file input/output (IO) object.

Return type

int

property name

name.

Type

str

read(size=None)[source]

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises
  • IOError – if the read failed.

  • OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file input/output (IO) object.

Parameters
  • offset (int) – offset to seek.

  • whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises
  • IOError – if the seek failed.

  • OSError – if the seek failed.

seekable()[source]

Determines if a file input/output (IO) object is seekable.

Returns

True since a file IO object provides a seek method.

Return type

bool

tell()[source]

Retrieves the current offset into the file input/output (IO) object.

dfvfs.vfs.xfs_directory module

The XFS directory implementation.

class dfvfs.vfs.xfs_directory.XFSDirectory(file_system, path_spec, fsxfs_file_entry)[source]

Bases: Directory

File system directory that uses pyfsxfs.

dfvfs.vfs.xfs_file_entry module

The XFS file entry implementation.

class dfvfs.vfs.xfs_file_entry.XFSFileEntry(resolver_context, file_system, path_spec, fsxfs_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyfsxfs.

GetExtents()[source]

Retrieves the extents.

Returns

the extents.

Return type

list[Extent]

GetLinkedFileEntry()[source]

Retrieves the linked file entry, e.g. for a symbolic link.

Returns

linked file entry or None if not available.

Return type

XFSFileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None if not available.

Return type

XFSFileEntry

GetXFSFileEntry()[source]

Retrieves the XFS file entry.

Returns

XFS file entry.

Return type

pyfsxfs.file_entry

TYPE_INDICATOR = 'XFS'
property access_time

access time or None if not available.

Type

dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type

dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type

dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type

dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.xfs_file_system module

The XFS file system implementation.

class dfvfs.vfs.xfs_file_system.XFSFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfsxfs.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – path specification.

Returns

True if the file entry exists.

Return type

bool

Raises

BackEndError – if the file entry cannot be opened.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

file entry or None if not available.

Return type

XFSFileEntry

Raises

BackEndError – if the file entry cannot be opened.

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

file entry.

Return type

XFSFileEntry

GetXFSFileEntryByPathSpec(path_spec)[source]

Retrieves the XFS file entry for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

file entry.

Return type

pyfsxfs.file_entry

Raises

PathSpecError – if the path specification is missing location and inode.

TYPE_INDICATOR = 'XFS'

dfvfs.vfs.zip_directory module

The ZIP directory implementation.

class dfvfs.vfs.zip_directory.ZIPDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses zipfile.

dfvfs.vfs.zip_file_entry module

The ZIP file entry implementation.

class dfvfs.vfs.zip_file_entry.ZipFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, zip_info=None)[source]

Bases: FileEntry

File system file entry that uses zipfile.

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns

parent file entry or None if not available.

Return type

ZipFileEntry

GetZipInfo()[source]

Retrieves the ZIP info object.

Returns

a ZIP info object or None if not available.

Return type

zipfile.ZipInfo

Raises

PathSpecError – if the path specification is incorrect.

TYPE_INDICATOR = 'ZIP'
property modification_time

modification time or None if not available.

Type

dfdatetime.DateTimeValues

property name

name of the file entry, without the full path.

Type

str

property size

size of the file entry in bytes or None if not available.

Type

int

dfvfs.vfs.zip_file_system module

The ZIP file system implementation.

class dfvfs.vfs.zip_file_system.ZipFileSystem(resolver_context, path_spec, encoding='utf-8')[source]

Bases: FileSystem

File system that uses zipfile.

encoding

encoding of the file entry name.

Type

str

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters

path_spec (PathSpec) – path specification of the file entry.

Returns

True if the file entry exists.

Return type

bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters

path_spec (PathSpec) – path specification of the file entry.

Returns

a file entry or None.

Return type

ZipFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns

a file entry or None.

Return type

ZipFileEntry

GetZipFile()[source]

Retrieves the ZIP file object.

Returns

a ZIP file object or None.

Return type

zipfile.ZipFile

GetZipInfoByPathSpec(path_spec)[source]

Retrieves the ZIP info for a path specification.

Parameters

path_spec (PathSpec) – a path specification.

Returns

a ZIP info object or None if not available.

Return type

zipfile.ZipInfo

Raises

PathSpecError – if the path specification is incorrect.

TYPE_INDICATOR = 'ZIP'

Module contents