dfvfs.vfs package

Submodules

dfvfs.vfs.apfs_attribute module

The APFS attribute implementation.

class dfvfs.vfs.apfs_attribute.APFSExtendedAttribute(fsapfs_extended_attribute)[source]

Bases: Attribute

APFS extended attribute that uses pyfsapfs.

GetExtents()[source]

Retrieves the extents.

Returns: the extents of the attribute data.
Return type: list[Extent]

get_offset()[source]

Retrieves the current offset into the file input/output (IO) object.

Returns: current offset into the file input/output (IO) object.
Return type: int

get_size()[source]

Retrieves the size of the file input/output (IO) object.

Returns: size of the file input/output (IO) object.
Return type: int

property name

name.

Type: str

read(size=None)[source]

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

IOError – if the read failed.
OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file input/output (IO) object.

Parameters

offset (int) – offset to seek.
whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises

IOError – if the seek failed.
OSError – if the seek failed.

seekable()[source]

Determines if a file input/output (IO) object is seekable.

Returns: True since a file IO object provides a seek method.
Return type: bool

tell()[source]: Retrieves the current offset into the file input/output (IO) object.

dfvfs.vfs.apfs_container_directory module

The APFS container directory implementation.

class dfvfs.vfs.apfs_container_directory.APFSContainerDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pyfsapfs.

dfvfs.vfs.apfs_container_file_entry module

The APFS container file entry implementation.

class dfvfs.vfs.apfs_container_file_entry.APFSContainerFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyfsapfs.

GetAPFSVolume()[source]

Retrieves an APFS volume.

Returns: an APFS volume or None if not available.
Return type: pyfsapfs.volume

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns: parent file entry or None if not available.
Return type: APFSContainerFileEntry

IsLocked()[source]

Determines if the file entry is locked.

Returns: True if the file entry is locked.
Return type: bool

TYPE_INDICATOR = 'APFS_CONTAINER'

Unlock()[source]

Unlocks the file entry.

Returns: True if the file entry was unlocked.
Return type: bool

property name

name of the file entry, which does not include the full path.

Type: str

property size

size of the file entry in bytes or None if not available.

Type: int

property sub_file_entries

sub file entries.

Type: generator[APFSContainerFileEntry]

dfvfs.vfs.apfs_container_file_system module

The APFS container file system implementation.

class dfvfs.vfs.apfs_container_file_system.APFSContainerFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

APFS container file system using pyfsapfs.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – a path specification.
Returns: True if the file entry exists.
Return type: bool

GetAPFSContainer()[source]

Retrieves the APFS container.

Returns: the APFS container.
Return type: pyfsapfs.container

GetAPFSVolumeByPathSpec(path_spec)[source]

Retrieves an APFS volume for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: an APFS volume or None if not available.
Return type: pyfsapfs.volume

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: a file entry or None if not exists.
Return type: APFSContainerFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: a file entry.
Return type: APFSContainerFileEntry

TYPE_INDICATOR = 'APFS_CONTAINER'

dfvfs.vfs.apfs_directory module

The APFS directory implementation.

class dfvfs.vfs.apfs_directory.APFSDirectory(file_system, path_spec, fsapfs_file_entry)[source]

Bases: Directory

File system directory that uses pyfsapfs.

dfvfs.vfs.apfs_file_entry module

The APFS file entry implementation.

class dfvfs.vfs.apfs_file_entry.APFSFileEntry(resolver_context, file_system, path_spec, fsapfs_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyfsapfs.

GetAPFSFileEntry()[source]

Retrieves the APFS file entry.

Returns: APFS file entry.
Return type: pyfsapfs.file_entry

GetExtents()[source]

Retrieves the extents.

Returns: the extents.
Return type: list[Extent]

GetLinkedFileEntry()[source]

Retrieves the linked file entry, e.g. for a symbolic link.

Returns: linked file entry or None if not available.
Return type: APFSFileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns: parent file entry or None if not available.
Return type: APFSFileEntry

TYPE_INDICATOR = 'APFS'

property access_time

access time or None if not available.

Type: dfdatetime.DateTimeValues

property added_time

added time or None if not available.

Type: dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type: dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type: dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type: str

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.apfs_file_system module

The APFS file system implementation.

class dfvfs.vfs.apfs_file_system.APFSFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfsapfs.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – path specification.
Returns: True if the file entry exists.
Return type: bool
Raises: BackEndError – if the file entry cannot be opened.

GetAPFSFileEntryByPathSpec(path_spec)[source]

Retrieves the APFS file entry for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: file entry.
Return type: pyfsapfs.file_entry
Raises: PathSpecError – if the path specification is missing location and identifier.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: file entry or None if not available.
Return type: APFSFileEntry
Raises: BackEndError – if the file entry cannot be opened.

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: file entry or None if not available.
Return type: APFSFileEntry

ROOT_DIRECTORY_IDENTIFIER = 2

TYPE_INDICATOR = 'APFS'

dfvfs.vfs.attribute module

The Virtual File System (VFS) attribute interface.

class dfvfs.vfs.attribute.Attribute[source]

Bases: object

Attribute interface.

GetExtents()[source]

Retrieves the extents.

Returns: the extents of the attribute data.
Return type: list[Extent]

property type_indicator

type indicator or None if not known.

Type: str

class dfvfs.vfs.attribute.StatAttribute[source]

Bases: object

Attribute that represents a POSIX stat.

device_number

major and minor device number (if block or character device file), derived from st_rdev.

Type: Tuple[int, int]

group_identifier

group identifier (GID), equivalent to st_gid.

Type: int

inode_number

number of the corresponding inode, equivalent to st_ino.

Type: int

mode

access mode, equivalent to st_mode.

Type: int

number_of_links

number of hard links, equivalent to st_nlink.

Type: int

owner_identifier

user identifier (UID) of the owner, equivalent to st_uid.

Type: int

size

size, in number of bytes, equivalent to st_size.

Type: int

type

file type, value derived from st_mode >> 12.

Type: str

TYPE_BLOCK_DEVICE = 'block_device'

TYPE_CHARACTER_DEVICE = 'character_device'

TYPE_DEVICE = 'device'

TYPE_DIRECTORY = 'directory'

TYPE_FILE = 'file'

TYPE_LINK = 'link'

TYPE_PIPE = 'pipe'

TYPE_SOCKET = 'socket'

TYPE_WHITEOUT = 'whiteout'

dfvfs.vfs.bde_file_entry module

The BDE file entry implementation.

class dfvfs.vfs.bde_file_entry.BDEFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

File system file entry that uses pybde.

IsLocked()[source]

Determines if the file entry is locked.

Returns: True if the file entry is locked.
Return type: bool

TYPE_INDICATOR = 'BDE'

Unlock()[source]

Unlocks the file entry.

Returns: True if the file entry was unlocked.
Return type: bool

property creation_time

creation time or None if not available.

Type: dfdatetime.DateTimeValues

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.bde_file_system module

The BDE file system implementation.

class dfvfs.vfs.bde_file_system.BDEFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

File system that uses pybde.

GetBDEVolume()[source]

Retrieves the BDE volume.

Returns: BDE volume.
Return type: pybde.volume

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: file entry or None.
Return type: BDEFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: file entry or None.
Return type: BDEFileEntry

TYPE_INDICATOR = 'BDE'

dfvfs.vfs.compressed_stream_file_entry module

The compressed stream file entry implementation.

class dfvfs.vfs.compressed_stream_file_entry.CompressedStreamFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

Compressed stream file entry.

TYPE_INDICATOR = 'COMPRESSED_STREAM'

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.compressed_stream_file_system module

The compressed stream file system implementation.

class dfvfs.vfs.compressed_stream_file_system.CompressedStreamFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

Compressed stream file system.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: a file entry or None if not available.
Return type: CompressedStreamFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: a file entry or None if not available.
Return type: CompressedStreamFileEntry

TYPE_INDICATOR = 'COMPRESSED_STREAM'

dfvfs.vfs.cpio_directory module

The CPIO directory implementation.

class dfvfs.vfs.cpio_directory.CPIODirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses CPIOArchiveFile.

dfvfs.vfs.cpio_file_entry module

The CPIO file entry implementation.

class dfvfs.vfs.cpio_file_entry.CPIOFileEntry(resolver_context, file_system, path_spec, cpio_archive_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses CPIOArchiveFile.

GetCPIOArchiveFileEntry()[source]

Retrieves the CPIO archive file entry object.

Returns: CPIO archive file entry.
Return type: CPIOArchiveFileEntry
Raises: PathSpecError – if the path specification is incorrect.

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns: parent file entry or None if not available.
Return type: CPIOFileEntry

TYPE_INDICATOR = 'CPIO'

property modification_time

modification time or None if not available.

Type: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type: str

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.cpio_file_system module

The CPIO archive file system implementation.

class dfvfs.vfs.cpio_file_system.CPIOFileSystem(resolver_context, path_spec, encoding='utf-8')[source]

Bases: FileSystem

CPIO archive file system.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – a path specification.
Returns: True if the file entry exists.
Return type: bool

GetCPIOArchiveFile()[source]

Retrieves the CPIO archive file.

Returns: a CPIO archive file.
Return type: CPIOArchiveFile

GetCPIOArchiveFileEntryByPathSpec(path_spec)[source]

Retrieves the CPIO archive file entry for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: CPIO archive file entry or None if not available.
Return type: CPIOArchiveFileEntry
Raises: PathSpecError – if the path specification is incorrect.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: a file entry or None if not available.
Return type: CPIOFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: a file entry or None if not available.
Return type: CPIOFileEntry

TYPE_INDICATOR = 'CPIO'

dfvfs.vfs.cs_directory module

The Core Storage (CS) directory implementation.

class dfvfs.vfs.cs_directory.CSDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pyfvde.

dfvfs.vfs.cs_file_entry module

The Core Storage (CS) file entry implementation.

class dfvfs.vfs.cs_file_entry.CSFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, fvde_logical_volume=None)[source]

Bases: FileEntry

File system file entry that uses pyfvde.

GetFVDELogicalVolume()[source]

Retrieves the Core Storage logical volume.

Returns: a Core Storage logical volume.
Return type: pyfvde.logical_volume

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns: parent file entry or None if not available.
Return type: CSFileEntry

IsLocked()[source]

Determines if the file entry is locked.

Returns: True if the file entry is locked.
Return type: bool

TYPE_INDICATOR = 'CS'

Unlock()[source]

Unlocks the file entry.

Returns: True if the file entry was unlocked.
Return type: bool

property name

name of the file entry, without the full path.

Type: str

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.cs_file_system module

The Core Storage (CS) file system implementation.

class dfvfs.vfs.cs_file_system.CSFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfvde.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – path specification.
Returns: True if the file entry exists.
Return type: bool

GetFVDELogicalVolumeByPathSpec(path_spec)[source]

Retrieves a Core Storage logical volume for a path specification.

Parameters

path_spec (PathSpec) – path specification.

Returns

a Core Storage logical volume or None if not: available.

Return type

pyfvde.logical_volume

GetFVDEVolumeGroup()[source]

Retrieves the Core Storage volume group.

Returns: a Core Storage volume group.
Return type: pyfvde.volume_group

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: a file entry or None if not available.
Return type: CSFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: root file entry or None if not available.
Return type: CSFileEntry

TYPE_INDICATOR = 'CS'

dfvfs.vfs.data_range_file_entry module

The data range file entry implementation.

class dfvfs.vfs.data_range_file_entry.DataRangeFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

File entry that represents a data range.

TYPE_INDICATOR = 'DATA_RANGE'

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.data_range_file_system module

The data range file system implementation.

class dfvfs.vfs.data_range_file_system.DataRangeFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

Data range file system.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: a file entry or None if not available.
Return type: DataRangeFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: a file entry or None if not available.
Return type: DataRangeFileEntry

TYPE_INDICATOR = 'DATA_RANGE'

dfvfs.vfs.data_stream module

The Virtual File System (VFS) data stream interface.

class dfvfs.vfs.data_stream.DataStream(file_entry)[source]

Bases: object

Data stream interface.

GetExtents()[source]

Retrieves the extents.

Returns: the extents of the data stream.
Return type: list[Extent]

IsDefault()[source]

Determines if the data stream is the default data stream.

Returns: True if the data stream is the default data stream.
Return type: bool

property name

name.

Type: str

dfvfs.vfs.directory module

The Virtual File System (VFS) directory interface.

class dfvfs.vfs.directory.Directory(file_system, path_spec)[source]

Bases: object

Directory interface.

path_spec

path specification of the directory.

Type: PathSpec

property entries

path specifications of the directory entries.

Type: generator[PathSpec]

dfvfs.vfs.encoded_stream_file_entry module

The encoded stream file entry implementation.

class dfvfs.vfs.encoded_stream_file_entry.EncodedStreamFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

Class that implements an encoded stream file entry.

TYPE_INDICATOR = 'ENCODED_STREAM'

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.encoded_stream_file_system module

The encoded stream file system implementation.

class dfvfs.vfs.encoded_stream_file_system.EncodedStreamFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

Encoded stream file system.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: a file entry or None if not available.
Return type: EncodedStreamFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: a file entry or None if not available.
Return type: EncodedStreamFileEntry

TYPE_INDICATOR = 'ENCODED_STREAM'

dfvfs.vfs.encrypted_stream_file_entry module

The encrypted stream file entry implementation.

class dfvfs.vfs.encrypted_stream_file_entry.EncryptedStreamFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

Encrypted stream file entry.

TYPE_INDICATOR = 'ENCRYPTED_STREAM'

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.encrypted_stream_file_system module

The encrypted stream file system implementation.

class dfvfs.vfs.encrypted_stream_file_system.EncryptedStreamFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

Encrypted stream file system.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: a file entry or None if not available.
Return type: EncryptedStreamFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: a file entry or None if not available.
Return type: EncryptedStreamFileEntry

TYPE_INDICATOR = 'ENCRYPTED_STREAM'

dfvfs.vfs.ext_attribute module

The EXT attribute implementation.

class dfvfs.vfs.ext_attribute.EXTExtendedAttribute(fsext_extended_attribute)[source]

Bases: Attribute

EXT extended attribute that uses pyfsext.

GetExtents()[source]

Retrieves the extents.

Returns: the extents of the attribute data.
Return type: list[Extent]

get_offset()[source]

Retrieves the current offset into the file input/output (IO) object.

Returns: current offset into the file input/output (IO) object.
Return type: int

get_size()[source]

Retrieves the size of the file input/output (IO) object.

Returns: size of the file input/output (IO) object.
Return type: int

property name

name.

Type: str

read(size=None)[source]

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

IOError – if the read failed.
OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file input/output (IO) object.

Parameters

offset (int) – offset to seek.
whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises

IOError – if the seek failed.
OSError – if the seek failed.

seekable()[source]

Determines if a file input/output (IO) object is seekable.

Returns: True since a file IO object provides a seek method.
Return type: bool

tell()[source]: Retrieves the current offset into the file input/output (IO) object.

dfvfs.vfs.ext_directory module

The EXT directory implementation.

class dfvfs.vfs.ext_directory.EXTDirectory(file_system, path_spec, fsext_file_entry)[source]

Bases: Directory

File system directory that uses pyfsext.

dfvfs.vfs.ext_file_entry module

The EXT file entry implementation.

class dfvfs.vfs.ext_file_entry.EXTFileEntry(resolver_context, file_system, path_spec, fsext_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyfsext.

GetEXTFileEntry()[source]

Retrieves the EXT file entry.

Returns: EXT file entry.
Return type: pyfsext.file_entry

GetExtents()[source]

Retrieves the extents.

Returns: the extents.
Return type: list[Extent]

GetLinkedFileEntry()[source]

Retrieves the linked file entry, e.g. for a symbolic link.

Returns: linked file entry or None if not available.
Return type: EXTFileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns: parent file entry or None if not available.
Return type: EXTFileEntry

TYPE_INDICATOR = 'EXT'

property access_time

access time or None if not available.

Type: dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type: dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type: dfdatetime.DateTimeValues

property deletion_time

deletion time or None if not available.

Type: dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type: str

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.ext_file_system module

The EXT file system implementation.

class dfvfs.vfs.ext_file_system.EXTFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfsext.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – path specification.
Returns: True if the file entry exists.
Return type: bool
Raises: BackEndError – if the file entry cannot be opened.

GetEXTFileEntryByPathSpec(path_spec)[source]

Retrieves the EXT file entry for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: file entry.
Return type: pyfsext.file_entry
Raises: PathSpecError – if the path specification is missing location and inode.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: file entry or None if not available.
Return type: EXTFileEntry
Raises: BackEndError – if the file entry cannot be opened.

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: file entry.
Return type: EXTFileEntry

ROOT_DIRECTORY_INODE_NUMBER = 2

TYPE_INDICATOR = 'EXT'

dfvfs.vfs.extent module

The Virtual File System (VFS) extent.

class dfvfs.vfs.extent.Extent(extent_type=None, offset=None, size=None)[source]

Bases: object

Extent.

extent_type

type of the extent, for example EXTENT_TYPE_SPARSE.

Type: str

offset

offset of the extent relative from the start of the file system in bytes.

Type: int

size

size of the extent in bytes.

Type: int

dfvfs.vfs.fake_directory module

The fake directory implementation.

class dfvfs.vfs.fake_directory.FakeDirectory(file_system, path_spec)[source]

Bases: Directory

Fake file system directory.

dfvfs.vfs.fake_file_entry module

The fake file entry implementation.

class dfvfs.vfs.fake_file_entry.FakeFileEntry(resolver_context, file_system, path_spec, file_entry_type=None, is_root=False)[source]

Bases: FileEntry

Fake file system file entry.

GetFileObject(data_stream_name='')[source]

Retrieves a file-like object of a specific data stream.

Parameters

data_stream_name (Optional[str]) – name of the data stream, where an empty string represents the default data stream.

Returns

a file-like object or None if not available.

Return type

FakeFileIO

Raises

IOError – if the file entry is not a file.
OSError – if the file entry is not a file.

GetParentFileEntry()[source]

Retrieves the root file entry.

Returns: parent file entry or None if not available.
Return type: FakeFileEntry

TYPE_INDICATOR = 'FAKE'

property access_time

access time or None if not available.

Type: dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type: dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type: dfdatetime.DateTimeValues

property name

name of the file entry, without the full path.

Type: str

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.fake_file_system module

The fake file system implementation.

class dfvfs.vfs.fake_file_system.FakeFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

Fake file system.

AddFileEntry(path, file_entry_type='file', file_data=None, link_data=None)[source]

Adds a fake file entry.

Parameters

path (str) – path of the file entry.
file_entry_type (Optional[str]) – type of the file entry object.
file_data (Optional[bytes]) – data of the fake file-like object.
link_data (Optional[bytes]) – link data of the fake file entry object.

Raises

KeyError – if the path already exists.
ValueError – if the file data is set but the file entry type is not a file or if the link data is set but the file entry type is not a link.

FileEntryExistsByPath(path)[source]

Determines if a file entry for a path exists.

Parameters: path (str) – path of the file entry.
Returns: True if the file entry exists.
Return type: bool

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – path specification.
Returns: True if the file entry exists.
Return type: bool

GetDataByPath(path)[source]

Retrieves the data associated to a path.

Parameters: path (str) – path of the file entry.
Returns: data or None if not available.
Return type: bytes

GetFileEntryByPath(path)[source]

Retrieves a file entry for a path.

Parameters: path (str) – path of the file entry.
Returns: a file entry or None if not available.
Return type: FakeFileEntry

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: a file entry or None if not available.
Return type: FakeFileEntry

GetPaths()[source]

Retrieves the paths dictionary.

Returns: file-like object per path.
Return type: dict[str, FileIO]

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: a file entry or None if not available.
Return type: FakeFileEntry

TYPE_INDICATOR = 'FAKE'

dfvfs.vfs.fat_directory module

The FAT directory implementation.

class dfvfs.vfs.fat_directory.FATDirectory(file_system, path_spec, fsfat_file_entry)[source]

Bases: Directory

File system directory that uses pyfsfat.

dfvfs.vfs.fat_file_entry module

The FAT file entry implementation.

class dfvfs.vfs.fat_file_entry.FATFileEntry(resolver_context, file_system, path_spec, fsfat_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyfsfat.

GetExtents()[source]

Retrieves the extents.

Returns: the extents.
Return type: list[Extent]

GetFATFileEntry()[source]

Retrieves the FAT file entry.

Returns: FAT file entry.
Return type: pyfsfat.file_entry

GetFileObject(data_stream_name='')[source]

Retrieves a file-like object of a specific data stream.

Parameters: data_stream_name (Optional[str]) – name of the data stream, where an empty string represents the default data stream.
Returns: a file-like object or None if not available.
Return type: FileIO

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns: parent file entry or None if not available.
Return type: FATFileEntry

TYPE_INDICATOR = 'FAT'

property access_time

access time or None if not available.

Type: dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type: dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type: str

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.fat_file_system module

The FAT file system implementation.

class dfvfs.vfs.fat_file_system.FATFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfsfat.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – path specification.
Returns: True if the file entry exists.
Return type: bool
Raises: BackEndError – if the file entry cannot be opened.

GetFATFileEntryByPathSpec(path_spec)[source]

Retrieves the FAT file entry for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: file entry.
Return type: pyfsfat.file_entry
Raises: PathSpecError – if the path specification is missing location and identifier.

GetFATVolume()[source]

Retrieves the FAT volume.

Returns: a FAT volume.
Return type: pyfsfat.volume

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: file entry or None if not available.
Return type: FATFileEntry
Raises: BackEndError – if the file entry cannot be opened.

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: file entry.
Return type: FATFileEntry

LOCATION_ROOT = '\\'

PATH_SEPARATOR = '\\'

TYPE_INDICATOR = 'FAT'

dfvfs.vfs.file_entry module

The Virtual File System (VFS) file entry interface.

The file entry can be various file system elements like a regular file, a directory or file system metadata.

class dfvfs.vfs.file_entry.FileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: object

File entry interface.

entry_type

file entry type, such as device, directory, file, link, socket and pipe or None if not available. The available file entry types are defined in dfvfs.lib.definitions for example FILE_ENTRY_TYPE_FILE.

Type: str

path_spec

path specification.

Type: PathSpec

GetDataStream(name, case_sensitive=True)[source]

Retrieves a data stream by name.

Parameters

name (str) – name of the data stream.
case_sensitive (Optional[bool]) – True if the name is case sensitive.

Returns

a data stream or None if not available.

Return type

DataStream

Raises

ValueError – if the name is not string.

GetExtents()[source]

Retrieves the extents.

Returns: the extents.
Return type: list[Extent]

GetFileObject(data_stream_name='')[source]

Retrieves a file-like object of a specific data stream.

Parameters: data_stream_name (Optional[str]) – name of the data stream, where an empty string represents the default data stream.
Returns: a file-like object or None if not available.
Return type: FileIO

GetFileSystem()[source]

Retrieves the file system which contains the file entry.

Returns: a file system.
Return type: FileSystem

GetLinkedFileEntry()[source]

Retrieves the linked file entry, for example for a symbolic link.

Returns: linked file entry or None if not available.
Return type: FileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns: parent file entry or None if not available.
Return type: FileEntry

GetStatAttribute()[source]

Retrieves a stat attribute.

Returns: a stat attribute or None if not available.
Return type: StatAttribute

GetSubFileEntryByName(name, case_sensitive=True)[source]

Retrieves a sub file entry by name.

Parameters

name (str) – name of the file entry.
case_sensitive (Optional[bool]) – True if the name is case sensitive.

Returns

a file entry or None if not available.

Return type

FileEntry

HasDataStream(name, case_sensitive=True)[source]

Determines if the file entry has specific data stream.

Parameters

name (str) – name of the data stream.
case_sensitive (Optional[bool]) – True if the name is case sensitive.

Returns

True if the file entry has the data stream.

Return type

bool

Raises

ValueError – if the name is not string.

HasExternalData()[source]

Determines if the file entry has external stored data.

Returns: True if the file entry has external stored data.
Return type: bool

IsAllocated()[source]

Determines if the file entry is allocated.

Returns: True if the file entry is allocated.
Return type: bool

IsDevice()[source]

Determines if the file entry is a device.

Returns: True if the file entry is a device.
Return type: bool

IsDirectory()[source]

Determines if the file entry is a directory.

Returns: True if the file entry is a directory.
Return type: bool

IsFile()[source]

Determines if the file entry is a file.

Returns: True if the file entry is a file.
Return type: bool

IsLink()[source]

Determines if the file entry is a link.

Returns: True if the file entry is a link.
Return type: bool

IsLocked()[source]

Determines if the file entry is locked.

Returns: True if the file entry is locked.
Return type: bool

IsPipe()[source]

Determines if the file entry is a pipe.

Returns: True if the file entry is a pipe.
Return type: bool

IsRoot()[source]

Determines if the file entry is the root file entry.

Returns: True if the file entry is the root file entry.
Return type: bool

IsSocket()[source]

Determines if the file entry is a socket.

Returns: True if the file entry is a socket.
Return type: bool

IsVirtual()[source]

Determines if the file entry is virtual (emulated by dfVFS).

Returns: True if the file entry is virtual.
Return type: bool

Unlock()[source]

Unlocks the file entry.

Returns: True if the file entry was unlocked.
Return type: bool

property access_time

access time or None if not available.

Type: dfdatetime.DateTimeValues

property added_time

added time or None if not available.

Type: dfdatetime.DateTimeValues

property attributes

attributes.

Type: generator[Attribute]

property backup_time

backup time or None if not available.

Type: dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type: dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type: dfdatetime.DateTimeValues

property data_streams

data streams.

Type: generator[DataStream]

property deletion_time

deletion time or None if not available.

Type: dfdatetime.DateTimeValues

property link

full path of the linked file entry or None if not available.

Type: str

property modification_time

modification time or None if not available.

Type: dfdatetime.DateTimeValues

abstract property name

name of the file entry, without the full path.

Type: str

property number_of_attributes

number of attributes.

Type: int

property number_of_data_streams

number of data streams.

Type: int

property number_of_sub_file_entries

number of sub file entries.

Type: int

property size

size of the file entry in bytes or None if not available.

Type: int

property sub_file_entries

sub file entries.

Type: generator[FileEntry]

property type_indicator

type indicator.

Type: str

dfvfs.vfs.file_system module

The Virtual File System (VFS) file system interface.

class dfvfs.vfs.file_system.FileSystem(resolver_context, path_spec)[source]

Bases: object

File system interface.

BasenamePath(path)[source]

Determines the basename of the path.

Parameters: path (str) – path.
Returns: basename of the path.
Return type: str

DirnamePath(path)[source]

Determines the directory name of the path.

The file system root is represented by an empty string.

Parameters: path (str) – path.
Returns: directory name of the path or None.
Return type: str

abstract FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – a path specification.
Returns: True if the file entry exists.
Return type: bool

GetDataStreamByPathSpec(path_spec)[source]

Retrieves a data stream for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: a data stream or None if not available.
Return type: DataStream

abstract GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: a file entry or None if not available.
Return type: FileEntry

GetFileObjectByPathSpec(path_spec)[source]

Retrieves a file-like object for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: a file-like object or None if not available.
Return type: FileIO

GetPathSegmentAndSuffix(base_path, path)[source]

Determines the path segment and suffix of the path.

None is returned if the path does not start with the base path and an empty string if the path exactly matches the base path.

Parameters

base_path (str) – base path.
path (str) – path.

Returns

path segment and suffix string.

Return type

tuple[str, str]

abstract GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: a file entry or None if not available.
Return type: FileEntry

JoinPath(path_segments)[source]

Joins the path segments into a path.

Parameters: path_segments (list[str]) – path segments.
Returns: joined path segments prefixed with the path separator.
Return type: str

LOCATION_ROOT = '/'

Open(path_spec=None, mode='rb')[source]

Opens the file system object defined by path specification.

Parameters

path_spec (Optional[PathSpec]) – a path specification.
mode (Optional[str]) – file access mode. The default is ‘rb’ which represents read-only binary.

Raises

AccessError – if the access to open the file was denied.
IOError – if the file system object was already opened or the open failed.
OSError – if the file system object was already opened or the open failed.
PathSpecError – if the path specification is incorrect.
ValueError – if the path specification or mode is invalid.

PATH_SEPARATOR = '/'

SplitPath(path)[source]

Splits the path into path segments.

Parameters

path (str) – path.

Returns

path segments without the root path segment, which is: an empty string.

Return type

list[str]

__del__()[source]: Cleans up the file system.

property type_indicator

type indicator.

Type: str

dfvfs.vfs.gpt_directory module

The GUID Partition Table (GPT) directory implementation.

class dfvfs.vfs.gpt_directory.GPTDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pyvsgpt.

dfvfs.vfs.gpt_file_entry module

The GUID Partition Table (GPT) file entry implementation.

class dfvfs.vfs.gpt_file_entry.GPTFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, vsgpt_partition=None)[source]

Bases: FileEntry

File system file entry that uses pyvsgpt.

GetGPTPartition()[source]

Retrieves the GPT partition.

Returns: a GPT partition.
Return type: pyvsgpt.partition

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns: parent file entry or None if not available.
Return type: GPTFileEntry

TYPE_INDICATOR = 'GPT'

property name

name of the file entry, without the full path.

Type: str

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.gpt_file_system module

The GUID Partition Table (GPT) file system implementation.

class dfvfs.vfs.gpt_file_system.GPTFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyvsgpt.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – path specification.
Returns: True if the file entry exists.
Return type: bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: a file entry or None if not available.
Return type: GPTFileEntry

GetGPTPartitionByPathSpec(path_spec)[source]

Retrieves a GPT partition for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: a GPT partition or None if not available.
Return type: pyvsgpt.partition

GetGPTVolume()[source]

Retrieves the GPT volume.

Returns: a GPT volume.
Return type: pyvsgpt.volume

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: root file entry or None if not available.
Return type: GPTFileEntry

TYPE_INDICATOR = 'GPT'

dfvfs.vfs.gzip_file_entry module

The gzip file entry implementation.

class dfvfs.vfs.gzip_file_entry.GzipFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

File system file entry that uses gzip.

TYPE_INDICATOR = 'GZIP'

property modification_time

modification time or None if not available.

Type: dfdatetime.DateTimeValues

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.gzip_file_system module

The gzip file system implementation.

class dfvfs.vfs.gzip_file_system.GzipFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

File system that uses gzip.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: a file entry or None if not available.
Return type: GzipFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: a file entry or None if not available.
Return type: GzipFileEntry

TYPE_INDICATOR = 'GZIP'

dfvfs.vfs.hfs_attribute module

The HFS attribute implementation.

class dfvfs.vfs.hfs_attribute.HFSExtendedAttribute(fshfs_extended_attribute)[source]

Bases: Attribute

HFS extended attribute that uses pyfshfs.

GetExtents()[source]

Retrieves the extents.

Returns: the extents of the attribute data.
Return type: list[Extent]

get_offset()[source]

Retrieves the current offset into the file input/output (IO) object.

Returns: current offset into the file input/output (IO) object.
Return type: int

get_size()[source]

Retrieves the size of the file input/output (IO) object.

Returns: size of the file input/output (IO) object.
Return type: int

property name

name.

Type: str

read(size=None)[source]

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

IOError – if the read failed.
OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file input/output (IO) object.

Parameters

offset (int) – offset to seek.
whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises

IOError – if the seek failed.
OSError – if the seek failed.

seekable()[source]

Determines if a file input/output (IO) object is seekable.

Returns: True since a file IO object provides a seek method.
Return type: bool

tell()[source]: Retrieves the current offset into the file input/output (IO) object.

dfvfs.vfs.hfs_data_stream module

The HFS data stream implementation.

class dfvfs.vfs.hfs_data_stream.HFSDataStream(file_entry, fshfs_data_stream)[source]

Bases: DataStream

File system data stream that uses pyfshfs.

GetExtents()[source]

Retrieves the extents.

Returns: the extents of the data stream.
Return type: list[Extent]

dfvfs.vfs.hfs_directory module

The HFS directory implementation.

class dfvfs.vfs.hfs_directory.HFSDirectory(file_system, path_spec, fshfs_file_entry)[source]

Bases: Directory

File system directory that uses pyfshfs.

dfvfs.vfs.hfs_file_entry module

The HFS file entry implementation.

class dfvfs.vfs.hfs_file_entry.HFSFileEntry(resolver_context, file_system, path_spec, fshfs_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyfshfs.

GetExtents()[source]

Retrieves the extents.

Returns: the extents.
Return type: list[Extent]

GetFileObject(data_stream_name='')[source]

Retrieves a file-like object of a specific data stream.

Parameters: data_stream_name (Optional[str]) – name of the data stream, where an empty string represents the default data stream.
Returns: a file-like object or None if not available.
Return type: FileIO

GetHFSFileEntry()[source]

Retrieves the HFS file entry.

Returns: HFS file entry.
Return type: pyfshfs.file_entry

GetLinkedFileEntry()[source]

Retrieves the linked file entry, e.g. for a symbolic link.

Returns: linked file entry or None if not available.
Return type: HFSFileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns: parent file entry or None if not available.
Return type: HFSFileEntry

TYPE_INDICATOR = 'HFS'

property access_time

access time or None if not available.

Type: dfdatetime.DateTimeValues

property added_time

added time or None if not available.

Type: dfdatetime.DateTimeValues

property backup_time

backup time or None if not available.

Type: dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type: dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type: dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type: str

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.hfs_file_system module

The HFS file system implementation.

class dfvfs.vfs.hfs_file_system.HFSFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfshfs.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – path specification.
Returns: True if the file entry exists.
Return type: bool
Raises: BackEndError – if the file entry cannot be opened.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: file entry or None if not available.
Return type: HFSFileEntry
Raises: BackEndError – if the file entry cannot be opened.

GetHFSFileEntryByPathSpec(path_spec)[source]

Retrieves the HFS file entry for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: file entry.
Return type: pyfshfs.file_entry
Raises: PathSpecError – if the path specification is missing location and identifier.

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: file entry.
Return type: HFSFileEntry

ROOT_DIRECTORY_IDENTIFIER_NUMBER = 2

TYPE_INDICATOR = 'HFS'

dfvfs.vfs.luksde_file_entry module

The LUKSDE file entry implementation.

class dfvfs.vfs.luksde_file_entry.LUKSDEFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: RootOnlyFileEntry

File system file entry that uses pyluksde.

IsLocked()[source]

Determines if the file entry is locked.

Returns: True if the file entry is locked.
Return type: bool

TYPE_INDICATOR = 'LUKSDE'

Unlock()[source]

Unlocks the file entry.

Returns: True if the file entry was unlocked.
Return type: bool

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.luksde_file_system module

The LUKSDE file system implementation.

class dfvfs.vfs.luksde_file_system.LUKSDEFileSystem(resolver_context, path_spec)[source]

Bases: RootOnlyFileSystem

File system that uses pyluksde.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: file entry or None.
Return type: LUKSDEFileEntry

GetLUKSDEVolume()[source]

Retrieves the LUKSDE volume.

Returns: LUKSDE volume.
Return type: pyluksde.volume

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: file entry or None.
Return type: LUKSDEFileEntry

TYPE_INDICATOR = 'LUKSDE'

dfvfs.vfs.lvm_directory module

The Logical Volume Manager (LVM) directory implementation.

class dfvfs.vfs.lvm_directory.LVMDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pyvslvm.

dfvfs.vfs.lvm_file_entry module

The Logical Volume Manager (LVM) file entry implementation.

class dfvfs.vfs.lvm_file_entry.LVMFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, vslvm_logical_volume=None)[source]

Bases: FileEntry

File system file entry that uses pyvslvm.

GetLVMLogicalVolume()[source]

Retrieves the LVM logical volume.

Returns: a LVM logical volume.
Return type: pyvslvm.logical_volume

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns: parent file entry or None if not available.
Return type: LVMFileEntry

TYPE_INDICATOR = 'LVM'

property name

name of the file entry, without the full path.

Type: str

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.lvm_file_system module

The Logical Volume Manager (LVM) file system implementation.

class dfvfs.vfs.lvm_file_system.LVMFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyvslvm.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – path specification.
Returns: True if the file entry exists.
Return type: bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: a file entry or None if not available.
Return type: LVMFileEntry

GetLVMLogicalVolumeByPathSpec(path_spec)[source]

Retrieves a LVM logical volume for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: a LVM logical volume or None if not available.
Return type: pyvslvm.logical_volume

GetLVMVolumeGroup()[source]

Retrieves the LVM volume group.

Returns: a LVM volume group.
Return type: pyvslvm.volume_group

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: root file entry or None if not available.
Return type: LVMFileEntry

TYPE_INDICATOR = 'LVM'

dfvfs.vfs.ntfs_attribute module

The NTFS attribute implementations.

class dfvfs.vfs.ntfs_attribute.FileNameNTFSAttribute(fsntfs_attribute)[source]

Bases: NTFSAttribute

NTFS $FILE_NAME file system attribute.

TYPE_INDICATOR = 'NTFS:$FILE_NAME'

property access_time

access time or None if not set.

Type: dfdatetime.Filetime

property creation_time

creation time or None if not set.

Type: dfdatetime.Filetime

property entry_modification_time

entry modification time or None if not set.

Type: dfdatetime.Filetime

property file_attribute_flags

file attribute flags or None if not available.

Type: int

property modification_time

modification time.

Type: dfdatetime.Filetime

property name

name.

Type: str

property name_space

name_space.

Type: int

property parent_file_reference

parent file reference.

Type: int

class dfvfs.vfs.ntfs_attribute.NTFSAttribute(fsntfs_attribute)[source]

Bases: Attribute

File system attribute that uses pyfsntfs.

property attribute_type: The attribute type.

class dfvfs.vfs.ntfs_attribute.ObjectIdentifierNTFSAttribute(fsntfs_attribute)[source]

Bases: NTFSAttribute

NTFS $OBJECT_ID file system attribute.

TYPE_INDICATOR = 'NTFS:$OBJECT_ID'

property droid_file_identifier

droid file identifier, formatted as an UUID.

Type: str

class dfvfs.vfs.ntfs_attribute.SecurityDescriptorNTFSAttribute(fsntfs_attribute)[source]

Bases: NTFSAttribute

NTFS $SECURITY_DESCRIPTOR file system attribute.

TYPE_INDICATOR = 'NTFS:$SECURITY_DESCRIPTOR'

property security_descriptor

security descriptor.

Type: pyfwnt.security_descriptor

class dfvfs.vfs.ntfs_attribute.StandardInformationNTFSAttribute(fsntfs_attribute)[source]

Bases: NTFSAttribute

NTFS $STANDARD_INFORMATION file system attribute.

TYPE_INDICATOR = 'NTFS:$STANDARD_INFORMATION'

property access_time

access time or None if not set.

Type: dfdatetime.Filetime

property creation_time

creation time or None if not set.

Type: dfdatetime.Filetime

property entry_modification_time

entry modification time or None if not set.

Type: dfdatetime.Filetime

property file_attribute_flags

file attribute flags or None if not available.

Type: int

property modification_time

modification time or None if not set.

Type: dfdatetime.Filetime

property owner_identifier

owner identifier.

Type: int

property security_descriptor_identifier

security descriptor identifier.

Type: int

property update_sequence_number

update sequence number.

Type: int

dfvfs.vfs.ntfs_data_stream module

The NTFS data stream implementation.

class dfvfs.vfs.ntfs_data_stream.NTFSDataStream(file_entry, fsntfs_data_stream)[source]

Bases: DataStream

File system data stream that uses pyfsntfs.

GetExtents()[source]

Retrieves the extents.

Returns: the extents of the data stream.
Return type: list[Extent]

dfvfs.vfs.ntfs_directory module

The NTFS directory implementation.

class dfvfs.vfs.ntfs_directory.NTFSDirectory(file_system, path_spec, fsntfs_file_entry)[source]

Bases: Directory

File system directory that uses pyfsntfs.

dfvfs.vfs.ntfs_file_entry module

The NTFS file entry implementation.

class dfvfs.vfs.ntfs_file_entry.NTFSFileEntry(resolver_context, file_system, path_spec, fsntfs_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyfsntfs.

GetExtents()[source]

Retrieves the extents.

Returns: the extents.
Return type: list[Extent]

GetFileObject(data_stream_name='')[source]

Retrieves a file-like object of a specific data stream.

Parameters: data_stream_name (Optional[str]) – data stream name, where an empty string represents the default data stream.
Returns: file-like object or None.
Return type: NTFSFileIO

GetLinkedFileEntry()[source]

Retrieves the linked file entry, e.g. for a symbolic link.

Returns: linked file entry or None.
Return type: NTFSFileEntry

GetNTFSFileEntry()[source]

Retrieves the NTFS file entry.

Returns: NTFS file entry.
Return type: pyfsntfs.file_entry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns: parent file entry or None if not available.
Return type: NTFSFileEntry

GetSecurityDescriptor()[source]

Retrieves the security descriptor.

Returns: security descriptor.
Return type: pyfwnt.security_descriptor

IsAllocated()[source]

Determines if the file entry is allocated.

Returns: True if the file entry is allocated.
Return type: bool

TYPE_INDICATOR = 'NTFS'

property access_time

access time or None if not available.

Type: dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type: dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type: dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type: str

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.ntfs_file_system module

The NTFS file system implementation.

class dfvfs.vfs.ntfs_file_system.NTFSFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfsntfs.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – path specification.
Returns: True if the file entry exists.
Return type: bool
Raises: BackEndError – if the file entry cannot be opened.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: file entry or None if not available.
Return type: NTFSFileEntry
Raises: BackEndError – if the file entry cannot be opened.

GetNTFSFileEntryByPathSpec(path_spec)[source]

Retrieves the NTFS file entry for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: NTFS file entry.
Return type: pyfsntfs.file_entry
Raises: PathSpecError – if the path specification is missing location and MFT entry.

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: file entry.
Return type: NTFSFileEntry

LOCATION_ROOT = '\\'

MFT_ENTRY_ROOT_DIRECTORY = 5

PATH_SEPARATOR = '\\'

TYPE_INDICATOR = 'NTFS'

dfvfs.vfs.os_attribute module

The operating system attribute implementation.

class dfvfs.vfs.os_attribute.OSExtendedAttribute(location, name)[source]

Bases: Attribute

Extended attribute that uses the operating system.

get_offset()[source]

Retrieves the current offset into the file input/output (IO) object.

Returns: current offset into the file input/output (IO) object.
Return type: int

get_size()[source]

Retrieves the size of the file input/output (IO) object.

Returns: size of the file input/output (IO) object.
Return type: int

property name

name.

Type: str

read(size=None)[source]

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

IOError – if the read failed.
OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file input/output (IO) object.

Parameters

offset (int) – offset to seek.
whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises

IOError – if the seek failed.
OSError – if the seek failed.

seekable()[source]

Determines if a file input/output (IO) object is seekable.

Returns: True since a file IO object provides a seek method.
Return type: bool

tell()[source]: Retrieves the current offset into the file input/output (IO) object.

dfvfs.vfs.os_directory module

The operating system directory implementation.

class dfvfs.vfs.os_directory.OSDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses the operating system.

dfvfs.vfs.os_file_entry module

The operating system file entry implementation.

class dfvfs.vfs.os_file_entry.OSFileEntry(resolver_context, file_system, path_spec, is_root=False)[source]

Bases: FileEntry

File system file entry that uses os.

GetLinkedFileEntry()[source]

Retrieves the linked file entry, for example for a symbolic link.

Returns: linked file entry or None if not available.
Return type: OSFileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns: parent file entry or None if not available.
Return type: OSFileEntry

TYPE_INDICATOR = 'OS'

property access_time

access time or None if not available.

Type: dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type: dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type: dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type: dfdatetime.DateTimeValues

property name

name of the file entry, without the full path.

Type: str

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.os_file_system module

The operating system file system implementation.

class dfvfs.vfs.os_file_system.OSFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses the operating system.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – a path specification.
Returns: True if the file entry exists, false otherwise.
Return type: bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: a file entry or None if not available.
Return type: OSFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: a file entry or None if not available.
Return type: OSFileEntry

JoinPath(path_segments)[source]

Joins the path segments into a path.

Parameters: path_segments (list[str]) – path segments.
Returns: joined path segments prefixed with the path separator.
Return type: str

PATH_SEPARATOR = '/'

TYPE_INDICATOR = 'OS'

dfvfs.vfs.root_only_file_entry module

The root only file system file entry implementation.

class dfvfs.vfs.root_only_file_entry.RootOnlyFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: FileEntry

Root only file system file entry.

property name

name of the file entry, without the full path.

Type: str

dfvfs.vfs.root_only_file_system module

The root only file system implementation.

class dfvfs.vfs.root_only_file_system.RootOnlyFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

Root only file system.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – path specification.
Returns: True if the file entry exists.
Return type: bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: a file entry or None if not available.
Return type: FileEntry

abstract GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: a file entry or None if not available.
Return type: FileEntry

dfvfs.vfs.sqlite_blob_directory module

The SQLite blob directory implementation.

class dfvfs.vfs.sqlite_blob_directory.SQLiteBlobDirectory(file_system, path_spec)[source]

Bases: Directory

SQLite blob directory.

dfvfs.vfs.sqlite_blob_file_entry module

The SQLite blob file entry implementation.

class dfvfs.vfs.sqlite_blob_file_entry.SQLiteBlobFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: FileEntry

SQLite blob file entry.

GetNumberOfRows()[source]

Retrieves the number of rows in the table.

Returns: number of rows.
Return type: int
Raises: BackEndError – when the SQLite blob file-like object is missing.

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns: parent file entry or None if not available.
Return type: SQLiteBlobFileEntry

TYPE_INDICATOR = 'SQLITE_BLOB'

property name

name of the file entry, which does not include the full path.

Type: str

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.sqlite_blob_file_system module

The SQLite blob file system implementation.

class dfvfs.vfs.sqlite_blob_file_system.SQLiteBlobFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

Class that implements a file system object using SQLite blob.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – path specification.
Returns: True if the file entry exists.
Return type: bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: a file entry or None.
Return type: FileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: a file entry or None.
Return type: FileEntry

TYPE_INDICATOR = 'SQLITE_BLOB'

dfvfs.vfs.tar_directory module

The TAR directory implementation.

class dfvfs.vfs.tar_directory.TARDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses tarfile.

dfvfs.vfs.tar_file_entry module

The TAR file entry implementation.

class dfvfs.vfs.tar_file_entry.TARFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, tar_info=None)[source]

Bases: FileEntry

File system file entry that uses tarfile.

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns: parent file entry or None.
Return type: TARFileEntry

GetTARInfo()[source]

Retrieves the TAR info.

Returns: TAR info or None if it does not exist.
Return type: tarfile.TARInfo
Raises: PathSpecError – if the path specification is incorrect.

TYPE_INDICATOR = 'TAR'

property modification_time

modification time or None if not available.

Type: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type: str

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.tar_file_system module

The TAR file system implementation.

class dfvfs.vfs.tar_file_system.TARFileSystem(resolver_context, path_spec, encoding='utf-8')[source]

Bases: FileSystem

Class that implements a file system using tarfile.

encoding

file entry name encoding.

Type: str

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – path specification.
Returns: True if the file entry exists.
Return type: bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: file entry or None.
Return type: TARFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: file entry.
Return type: TARFileEntry

GetTARFile()[source]

Retrieves the TAR file.

Returns: TAR file.
Return type: tarfile.TARFile

GetTARInfoByPathSpec(path_spec)[source]

Retrieves the TAR info for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: TAR info or None if it does not exist.
Return type: tarfile.TARInfo
Raises: PathSpecError – if the path specification is incorrect.

TYPE_INDICATOR = 'TAR'

dfvfs.vfs.tsk_attribute module

The SleuthKit (TSK) attribute implementation.

class dfvfs.vfs.tsk_attribute.TSKAttribute(tsk_file, tsk_attribute)[source]

Bases: Attribute

File system attribute that uses pytsk3.

property attribute_type

attribute type.

Type: object

class dfvfs.vfs.tsk_attribute.TSKExtendedAttribute(tsk_file, tsk_attribute)[source]

Bases: TSKAttribute

File system extended attribute that uses pytsk3.

get_offset()[source]

Retrieves the current offset into the file input/output (IO) object.

Returns: current offset into the file input/output (IO) object.
Return type: int

get_size()[source]

Retrieves the size of the file input/output (IO) object.

Returns: size of the file input/output (IO) object.
Return type: int

property name

name.

Raises: BackEndError – if pytsk3 returns a non UTF-8 formatted name.
Type: str

read(size=None)[source]

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

IOError – if the read failed.
OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file input/output (IO) object.

Parameters

offset (int) – offset to seek.
whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises

IOError – if the seek failed.
OSError – if the seek failed.

seekable()[source]

Determines if a file input/output (IO) object is seekable.

Returns: True since a file IO object provides a seek method.
Return type: bool

tell()[source]: Retrieves the current offset into the file input/output (IO) object.

dfvfs.vfs.tsk_data_stream module

The SleuthKit (TSK) data stream implementation.

class dfvfs.vfs.tsk_data_stream.TSKDataStream(file_entry, pytsk_attribute)[source]

Bases: DataStream

File system data stream that uses pytsk3.

GetExtents()[source]

Retrieves the extents.

Returns: the extents of the data stream.
Return type: list[Extent]
Raises: BackEndError – if pytsk3 returns no file system block size or data stream size.

dfvfs.vfs.tsk_directory module

The SleuthKit (TSK) directory implementation.

class dfvfs.vfs.tsk_directory.TSKDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pytsk3.

dfvfs.vfs.tsk_file_entry module

The SleuthKit (TSK) file entry implementation.

class dfvfs.vfs.tsk_file_entry.TSKFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, parent_inode=None, tsk_file=None)[source]

Bases: FileEntry

File system file entry that uses pytsk3.

GetExtents()[source]

Retrieves the extents.

Returns: the extents.
Return type: list[Extent]
Raises: BackEndError – if pytsk3 returns no file system block size or data stream size.

GetFileObject(data_stream_name='')[source]

Retrieves a file-like object of a specific data stream.

Parameters: data_stream_name (Optional[str]) – data stream name, where an empty string represents the default data stream.
Returns: file-like object or None.
Return type: TSKFileIO

GetLinkedFileEntry()[source]

Retrieves the linked file entry, e.g. for a symbolic link.

Returns: linked file entry or None.
Return type: TSKFileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns: parent file entry or None.
Return type: TSKFileEntry

GetTSKFile()[source]

Retrieves the SleuthKit file object.

Returns: TSK file.
Return type: pytsk3.File
Raises: PathSpecError – if the path specification is missing inode and location.

IsAllocated()[source]

Determines if the file entry is allocated.

Returns: True if the file entry is allocated.
Return type: bool

TYPE_INDICATOR = 'TSK'

property access_time

access time or None if not available.

Type: dfdatetime.DateTimeValues

property backup_time

backup time or None if not available.

Type: dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type: dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type: dfdatetime.DateTimeValues

property deletion_time

deletion time or None if not available.

Type: dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Raises: BackEndError – if pytsk3 returns a non UTF-8 formatted name.
Type: str

property size

size of the file entry in bytes or None if not available.

Type: int

class dfvfs.vfs.tsk_file_entry.TSKTime(*args: Any, **kwargs: Any)[source]

Bases: DateTimeValues

SleuthKit timestamp.

fraction_of_second

fraction of second, which is an integer that contains the number 100 nano seconds before Sleuthkit 4.2.0 or number of nano seconds in Sleuthkit 4.2.0 and later.

Type: int

CopyFromDateTimeString(time_string)[source]

Copies a SleuthKit timestamp from a date and time string.

Parameters

time_string (str) –

date and time value formatted as: YYYY-MM-DD hh:mm:ss.######[+-]##:##

Where # are numeric digits ranging from 0 to 9 and the seconds fraction can be either 3 or 6 digits. The time of day, seconds fraction and time zone offset are optional. The default time zone is UTC.

CopyToDateTimeString()[source]

Copies the date time value to a date and time string.

Returns

date and time value formatted as:: YYYY-MM-DD hh:mm:ss or YYYY-MM-DD hh:mm:ss.####### or YYYY-MM-DD hh:mm:ss.#########

Return type

str

GetDate()[source]

Retrieves the date represented by the date and time values.

Returns

year, month, day of month or (None, None, None): if the date and time values do not represent a date.

Return type

tuple[int, int, int]

property timestamp

POSIX timestamp in microseconds or None if timestamp is not set.

Type: int

dfvfs.vfs.tsk_file_system module

The SleuthKit (TSK) file system implementation.

class dfvfs.vfs.tsk_file_system.TSKFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pytsk3.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – path specification.
Returns: True if the file entry exists.
Return type: bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: a file entry or None if not available.
Return type: TSKFileEntry

GetFsInfo()[source]

Retrieves the file system info.

Returns: file system info.
Return type: pytsk3.FS_Info

GetFsType()[source]

Retrieves the file system type.

Returns: file system type.
Return type: pytsk3.TSK_FS_TYPE_ENUM

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: a file entry.
Return type: TSKFileEntry

GetRootInode()[source]

Retrieves the root inode.

Returns: inode number or None if not available.
Return type: int

GetTSKFileByPathSpec(path_spec)[source]

Retrieves the SleuthKit file object for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: TSK file.
Return type: pytsk3.File
Raises: PathSpecError – if the path specification is missing inode and location.

IsExt()[source]

Determines if the file system is ext2, ext3 or ext4.

Returns: True if the file system is ext.
Return type: bool

IsHFS()[source]

Determines if the file system is HFS, HFS+ or HFSX.

Returns: True if the file system is HFS.
Return type: bool

IsNTFS()[source]

Determines if the file system is NTFS.

Returns: True if the file system is NTFS.
Return type: bool

TYPE_INDICATOR = 'TSK'

dfvfs.vfs.tsk_partition_directory module

The SleuthKit (TSK) partition directory implementation.

class dfvfs.vfs.tsk_partition_directory.TSKPartitionDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pytsk3.

dfvfs.vfs.tsk_partition_file_entry module

The SleuthKit (TSK) partition file entry implementation.

class dfvfs.vfs.tsk_partition_file_entry.TSKPartitionFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, tsk_vs_part=None)[source]

Bases: FileEntry

File system file entry that uses pytsk3.

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns: parent file entry or None if not available.
Return type: TSKPartitionFileEntry

GetTSKVsPart()[source]

Retrieves the TSK volume system part.

Returns

a TSK volume system part or None if not: available.

Return type

pytsk3.TSK_VS_PART_INFO

IsAllocated()[source]

Determines if the file entry is allocated.

Returns: True if the file entry is allocated.
Return type: bool

TYPE_INDICATOR = 'TSK_PARTITION'

property name

name of the file entry, which does not include the full path.

Type: str

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.tsk_partition_file_system module

The SleuthKit (TSK) partition file system implementation.

class dfvfs.vfs.tsk_partition_file_system.TSKPartitionFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

Class that implements a file system object using pytsk3.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – a path specification.
Returns: True if the file entry exists or false otherwise.
Return type: bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: a file entry or None of not available.
Return type: TSKPartitionFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: a file entry or None of not available.
Return type: TSKPartitionFileEntry

GetTSKVolume()[source]

Retrieves the TSK volume object.

Returns: a TSK volume object.
Return type: pytsk3.Volume_Info

TYPE_INDICATOR = 'TSK_PARTITION'

dfvfs.vfs.vshadow_directory module

The Volume Shadow Snapshots (VSS) directory implementation.

class dfvfs.vfs.vshadow_directory.VShadowDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses pyvshadow.

dfvfs.vfs.vshadow_file_entry module

The Volume Shadow Snapshots (VSS) file entry implementation.

class dfvfs.vfs.vshadow_file_entry.VShadowFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyvshadow.

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns: parent file entry or None if not available.
Return type: FileEntry

GetVShadowStore()[source]

Retrieves a VSS store.

Returns: a VSS store or None if not available.
Return type: pyvshadow.store

HasExternalData()[source]

Determines if the file entry has external stored data.

Returns: True if the file entry has external data.
Return type: bool

TYPE_INDICATOR = 'VSHADOW'

property creation_time

creation time or None if not available.

Type: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type: str

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.vshadow_file_system module

The Volume Shadow Snapshots (VSS) file system implementation.

class dfvfs.vfs.vshadow_file_system.VShadowFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyvshadow.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – path specification.
Returns: True if the file entry exists.
Return type: bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: file entry or None if not available.
Return type: VShadowFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: file entry or None if not available.
Return type: VShadowFileEntry

GetVShadowStoreByPathSpec(path_spec)[source]

Retrieves a VSS store for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: a VSS store or None if not available.
Return type: pyvshadow.store

GetVShadowVolume()[source]

Retrieves a VSS volume.

Returns: a VSS volume.
Return type: pyvshadow.volume

TYPE_INDICATOR = 'VSHADOW'

dfvfs.vfs.xfs_attribute module

The XFS attribute implementation.

class dfvfs.vfs.xfs_attribute.XFSExtendedAttribute(fsxfs_extended_attribute)[source]

Bases: Attribute

XFS extended attribute that uses pyfsxfs.

GetExtents()[source]

Retrieves the extents.

Returns: the extents of the attribute data.
Return type: list[Extent]

get_offset()[source]

Retrieves the current offset into the file input/output (IO) object.

Returns: current offset into the file input/output (IO) object.
Return type: int

get_size()[source]

Retrieves the size of the file input/output (IO) object.

Returns: size of the file input/output (IO) object.
Return type: int

property name

name.

Type: str

read(size=None)[source]

Reads a byte string from the file input/output (IO) object.

The function will read a byte string of the specified size or all of the remaining data if no size was specified.

Parameters

size (Optional[int]) – number of bytes to read, where None is all remaining data.

Returns

data read.

Return type

bytes

Raises

IOError – if the read failed.
OSError – if the read failed.

seek(offset, whence=0)[source]

Seeks to an offset within the file input/output (IO) object.

Parameters

offset (int) – offset to seek.
whence (Optional[int]) – value that indicates whether offset is an absolute or relative position within the file.

Raises

IOError – if the seek failed.
OSError – if the seek failed.

seekable()[source]

Determines if a file input/output (IO) object is seekable.

Returns: True since a file IO object provides a seek method.
Return type: bool

tell()[source]: Retrieves the current offset into the file input/output (IO) object.

dfvfs.vfs.xfs_directory module

The XFS directory implementation.

class dfvfs.vfs.xfs_directory.XFSDirectory(file_system, path_spec, fsxfs_file_entry)[source]

Bases: Directory

File system directory that uses pyfsxfs.

dfvfs.vfs.xfs_file_entry module

The XFS file entry implementation.

class dfvfs.vfs.xfs_file_entry.XFSFileEntry(resolver_context, file_system, path_spec, fsxfs_file_entry=None, is_root=False, is_virtual=False)[source]

Bases: FileEntry

File system file entry that uses pyfsxfs.

GetExtents()[source]

Retrieves the extents.

Returns: the extents.
Return type: list[Extent]

GetLinkedFileEntry()[source]

Retrieves the linked file entry, e.g. for a symbolic link.

Returns: linked file entry or None if not available.
Return type: XFSFileEntry

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns: parent file entry or None if not available.
Return type: XFSFileEntry

GetXFSFileEntry()[source]

Retrieves the XFS file entry.

Returns: XFS file entry.
Return type: pyfsxfs.file_entry

TYPE_INDICATOR = 'XFS'

property access_time

access time or None if not available.

Type: dfdatetime.DateTimeValues

property change_time

change time or None if not available.

Type: dfdatetime.DateTimeValues

property creation_time

creation time or None if not available.

Type: dfdatetime.DateTimeValues

property modification_time

modification time or None if not available.

Type: dfdatetime.DateTimeValues

property name

name of the file entry, which does not include the full path.

Type: str

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.xfs_file_system module

The XFS file system implementation.

class dfvfs.vfs.xfs_file_system.XFSFileSystem(resolver_context, path_spec)[source]

Bases: FileSystem

File system that uses pyfsxfs.

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – path specification.
Returns: True if the file entry exists.
Return type: bool
Raises: BackEndError – if the file entry cannot be opened.

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – path specification.
Returns: file entry or None if not available.
Return type: XFSFileEntry
Raises: BackEndError – if the file entry cannot be opened.

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: file entry.
Return type: XFSFileEntry

GetXFSFileEntryByPathSpec(path_spec)[source]

Retrieves the XFS file entry for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: file entry.
Return type: pyfsxfs.file_entry
Raises: PathSpecError – if the path specification is missing location and inode.

TYPE_INDICATOR = 'XFS'

dfvfs.vfs.zip_directory module

The ZIP directory implementation.

class dfvfs.vfs.zip_directory.ZIPDirectory(file_system, path_spec)[source]

Bases: Directory

File system directory that uses zipfile.

dfvfs.vfs.zip_file_entry module

The ZIP file entry implementation.

class dfvfs.vfs.zip_file_entry.ZipFileEntry(resolver_context, file_system, path_spec, is_root=False, is_virtual=False, zip_info=None)[source]

Bases: FileEntry

File system file entry that uses zipfile.

GetParentFileEntry()[source]

Retrieves the parent file entry.

Returns: parent file entry or None if not available.
Return type: ZipFileEntry

GetZipInfo()[source]

Retrieves the ZIP info object.

Returns: a ZIP info object or None if not available.
Return type: zipfile.ZipInfo
Raises: PathSpecError – if the path specification is incorrect.

TYPE_INDICATOR = 'ZIP'

property modification_time

modification time or None if not available.

Type: dfdatetime.DateTimeValues

property name

name of the file entry, without the full path.

Type: str

property size

size of the file entry in bytes or None if not available.

Type: int

dfvfs.vfs.zip_file_system module

The ZIP file system implementation.

class dfvfs.vfs.zip_file_system.ZipFileSystem(resolver_context, path_spec, encoding='utf-8')[source]

Bases: FileSystem

File system that uses zipfile.

encoding

encoding of the file entry name.

Type: str

FileEntryExistsByPathSpec(path_spec)[source]

Determines if a file entry for a path specification exists.

Parameters: path_spec (PathSpec) – path specification of the file entry.
Returns: True if the file entry exists.
Return type: bool

GetFileEntryByPathSpec(path_spec)[source]

Retrieves a file entry for a path specification.

Parameters: path_spec (PathSpec) – path specification of the file entry.
Returns: a file entry or None.
Return type: ZipFileEntry

GetRootFileEntry()[source]

Retrieves the root file entry.

Returns: a file entry or None.
Return type: ZipFileEntry

GetZipFile()[source]

Retrieves the ZIP file object.

Returns: a ZIP file object or None.
Return type: zipfile.ZipFile

GetZipInfoByPathSpec(path_spec)[source]

Retrieves the ZIP info for a path specification.

Parameters: path_spec (PathSpec) – a path specification.
Returns: a ZIP info object or None if not available.
Return type: zipfile.ZipInfo
Raises: PathSpecError – if the path specification is incorrect.

TYPE_INDICATOR = 'ZIP'