dfvfs.volume package

Submodules

dfvfs.volume.apfs_volume_system module

The Apple File System (APFS) volume system.

class dfvfs.volume.apfs_volume_system.APFSVolume(file_entry)[source]

Bases: Volume

Volume that uses pyfsapfs.

class dfvfs.volume.apfs_volume_system.APFSVolumeSystem[source]

Bases: VolumeSystem

Volume system that uses pyfsapfs.

TYPE_INDICATOR = 'APFS_CONTAINER'

VOLUME_IDENTIFIER_PREFIX = 'apfs'

dfvfs.volume.cs_volume_system module

The Core Storage (CS) volume system.

class dfvfs.volume.cs_volume_system.CSVolume(file_entry)[source]

Bases: Volume

Volume that uses pyfvde.

class dfvfs.volume.cs_volume_system.CSVolumeSystem[source]

Bases: VolumeSystem

Volume system that uses pyfvde.

TYPE_INDICATOR = 'CS'

VOLUME_IDENTIFIER_PREFIX = 'cs'

dfvfs.volume.factory module

The volume system factory.

class dfvfs.volume.factory.Factory[source]

Bases: object

Volume system factory.

classmethod DeregisterVolumeSystem(volume_system_type)[source]

Deregisters a path specification type.

Parameters: volume_system_type (type) – path specification type.
Raises: KeyError – if path specification type is not registered.

classmethod NewVolumeSystem(type_indicator)[source]

Creates a new path specification for the specific type indicator.

Parameters: type_indicator (str) – type indicator.
Returns: path specification.
Return type: VolumeSystem
Raises: KeyError – if path specification is not registered.

classmethod RegisterVolumeSystem(volume_system_type)[source]

Registers a path specification type.

Parameters: volume_system_type (type) – path specification type.
Raises: KeyError – if path specification type is already registered.

dfvfs.volume.gpt_volume_system module

The GUID Partition Table (GPT) volume system.

class dfvfs.volume.gpt_volume_system.GPTVolume(file_entry)[source]

Bases: Volume

Volume that uses pyvsgpt.

class dfvfs.volume.gpt_volume_system.GPTVolumeSystem[source]

Bases: VolumeSystem

Volume system that uses pyvsgpt.

TYPE_INDICATOR = 'GPT'

VOLUME_IDENTIFIER_PREFIX = 'p'

dfvfs.volume.lvm_volume_system module

The Logical Volume Manager (LVM) volume system.

class dfvfs.volume.lvm_volume_system.LVMVolume(file_entry)[source]

Bases: Volume

Volume that uses pyvslvm.

class dfvfs.volume.lvm_volume_system.LVMVolumeSystem[source]

Bases: VolumeSystem

Volume system that uses pyvslvm.

TYPE_INDICATOR = 'LVM'

VOLUME_IDENTIFIER_PREFIX = 'lvm'

dfvfs.volume.tsk_volume_system module

The SleuthKit (TSK) volume system.

class dfvfs.volume.tsk_volume_system.TSKVolume(file_entry, bytes_per_sector)[source]

Bases: Volume

Volume that uses pytsk3.

class dfvfs.volume.tsk_volume_system.TSKVolumeSystem[source]

Bases: VolumeSystem

Volume system that uses pytsk3.

TYPE_INDICATOR = 'TSK_PARTITION'

VOLUME_IDENTIFIER_PREFIX = 'p'

dfvfs.volume.volume_system module

The Virtual File System (VFS) volume system interface.

class dfvfs.volume.volume_system.Volume(identifier)[source]

Bases: object

The VFS volume interface.

GetAttribute(identifier)[source]

Retrieves a specific attribute.

Parameters: identifier (str) – identifier of the attribute within the volume.
Returns: volume attribute or None if not available.
Return type: VolumeAttribute

HasExternalData()[source]

Determines if the volume has external stored data.

Returns: True if the volume has external stored data.
Return type: bool

property attributes

volume attributes generator.

Type: generator[VolumeAttribute]

property extents

volume extents.

Type: list[VolumeExtent]

property number_of_attributes

number of attributes.

Type: int

property number_of_extents

number of extents.

Type: int

class dfvfs.volume.volume_system.VolumeAttribute(identifier, value)[source]

Bases: object

The VFS volume attribute.

class dfvfs.volume.volume_system.VolumeExtent(offset, size, extent_type=0)[source]

Bases: object

The VFS volume extent.

EXTENT_TYPE_DATA = 0

EXTENT_TYPE_SPARSE = 1

class dfvfs.volume.volume_system.VolumeSystem[source]

Bases: object

The VFS volume system interface.

GetSectionByIndex(section_index)[source]

Retrieves a specific section based on the index.

Parameters: section_index (int) – index of the section.
Returns: a volume extent or None if not available.
Return type: VolumeExtent

GetVolumeByIdentifier(volume_identifier)[source]

Retrieves a specific volume based on the identifier.

Parameters: volume_identifier (str) – identifier of the volume within the volume system.
Returns: a volume.
Return type: Volume

GetVolumeByIndex(volume_index)[source]

Retrieves a specific volume based on the index.

Parameters: volume_index (int) – index of the volume.
Returns: a volume or None if not available.
Return type: Volume

Open(path_spec)[source]

Opens a volume defined by path specification.

Parameters: path_spec (PathSpec) – a path specification.
Raises: VolumeSystemError – if the virtual file system representing the volume system could not be resolved.

TYPE_INDICATOR = None

VOLUME_IDENTIFIER_PREFIX = 'v'

property number_of_sections

number of sections.

Type: int

property number_of_volumes

number of volumes.

Type: int

property sections

sections.

Type: list[VolumeExtent]

property volume_identifiers

volume identifiers.

Type: list[str]

property volumes

volumes generator.

Type: generator(Volume)

dfvfs.volume.vshadow_volume_system module

The Volume Shadow Snapshots (VSS) volume system.

class dfvfs.volume.vshadow_volume_system.VShadowVolume(file_entry)[source]

Bases: Volume

Volume that uses pyvshadow.

HasExternalData()[source]

Determines if the volume has external stored data.

Returns: True if the volume has external stored data.
Return type: bool

class dfvfs.volume.vshadow_volume_system.VShadowVolumeSystem[source]

Bases: VolumeSystem

Volume system that uses pyvshadow.

TYPE_INDICATOR = 'VSHADOW'

VOLUME_IDENTIFIER_PREFIX = 'vss'

Module contents

Imports for the volume system factory.