dfvfs.volume package

Submodules

dfvfs.volume.apfs_volume_system module

The Apple File System (APFS) volume system.

class dfvfs.volume.apfs_volume_system.APFSVolume(file_entry)[source]

Bases: Volume

Volume that uses pyfsapfs.

__init__(file_entry)[source]

Initializes an APFS volume.

Parameters:: file_entry (APFSContainerFileEntry) – an APFS container file entry.

class dfvfs.volume.apfs_volume_system.APFSVolumeSystem[source]

Bases: VolumeSystem

Volume system that uses pyfsapfs.

TYPE_INDICATOR = 'APFS_CONTAINER'

VOLUME_IDENTIFIER_PREFIX = 'apfs'

dfvfs.volume.apm_volume_system module

The Apple Partition Map (APM) volume system.

class dfvfs.volume.apm_volume_system.APMVolume(file_entry)[source]

Bases: Volume

Volume that uses pyvsapm.

__init__(file_entry)[source]

Initializes a APM volume.

Parameters:: file_entry (APMFileEntry) – a APM file entry.

class dfvfs.volume.apm_volume_system.APMVolumeSystem[source]

Bases: VolumeSystem

Volume system that uses pyvsapm.

TYPE_INDICATOR = 'APM'

VOLUME_IDENTIFIER_PREFIX = 'p'

dfvfs.volume.cs_volume_system module

The Core Storage (CS) volume system.

class dfvfs.volume.cs_volume_system.CSVolume(file_entry)[source]

Bases: Volume

Volume that uses pyfvde.

__init__(file_entry)[source]

Initializes a CS volume.

Parameters:: file_entry (CSFileEntry) – a CS file entry.

class dfvfs.volume.cs_volume_system.CSVolumeSystem[source]

Bases: VolumeSystem

Volume system that uses pyfvde.

TYPE_INDICATOR = 'CS'

VOLUME_IDENTIFIER_PREFIX = 'cs'

dfvfs.volume.factory module

The volume system factory.

class dfvfs.volume.factory.Factory[source]

Bases: object

Volume system factory.

classmethod DeregisterVolumeSystem(volume_system_type)[source]

Deregisters a path specification type.

Parameters:: volume_system_type (type) – path specification type.
Raises:: KeyError – if path specification type is not registered.

classmethod NewVolumeSystem(type_indicator)[source]

Creates a new path specification for the specific type indicator.

Parameters:: type_indicator (str) – type indicator.
Returns:: path specification.
Return type:: VolumeSystem
Raises:: KeyError – if path specification is not registered.

classmethod RegisterVolumeSystem(volume_system_type)[source]

Registers a path specification type.

Parameters:: volume_system_type (type) – path specification type.
Raises:: KeyError – if path specification type is already registered.

dfvfs.volume.gpt_volume_system module

The GUID Partition Table (GPT) volume system.

class dfvfs.volume.gpt_volume_system.GPTVolume(file_entry)[source]

Bases: Volume

Volume that uses pyvsgpt.

__init__(file_entry)[source]

Initializes a GPT volume.

Parameters:: file_entry (GPTFileEntry) – a GPT file entry.

class dfvfs.volume.gpt_volume_system.GPTVolumeSystem[source]

Bases: VolumeSystem

Volume system that uses pyvsgpt.

TYPE_INDICATOR = 'GPT'

VOLUME_IDENTIFIER_PREFIX = 'p'

dfvfs.volume.lvm_volume_system module

The Logical Volume Manager (LVM) volume system.

class dfvfs.volume.lvm_volume_system.LVMVolume(file_entry)[source]

Bases: Volume

Volume that uses pyvslvm.

__init__(file_entry)[source]

Initializes a LVM volume.

Parameters:: file_entry (LVMFileEntry) – a LVM file entry.

class dfvfs.volume.lvm_volume_system.LVMVolumeSystem[source]

Bases: VolumeSystem

Volume system that uses pyvslvm.

TYPE_INDICATOR = 'LVM'

VOLUME_IDENTIFIER_PREFIX = 'lvm'

dfvfs.volume.tsk_volume_system module

The SleuthKit (TSK) volume system.

class dfvfs.volume.tsk_volume_system.TSKVolume(file_entry, bytes_per_sector)[source]

Bases: Volume

Volume that uses pytsk3.

__init__(file_entry, bytes_per_sector)[source]

Initializes a volume.

Parameters:

file_entry (TSKPartitionFileEntry) – a TSK partition file entry.
bytes_per_sector (int) – number of bytes per sector.

class dfvfs.volume.tsk_volume_system.TSKVolumeSystem[source]

Bases: VolumeSystem

Volume system that uses pytsk3.

TYPE_INDICATOR = 'TSK_PARTITION'

VOLUME_IDENTIFIER_PREFIX = 'p'

__init__()[source]

Initializes a volume system.

Raises:: VolumeSystemError – if the volume system could not be accessed.

dfvfs.volume.volume_system module

The Virtual File System (VFS) volume system interface.

class dfvfs.volume.volume_system.Volume(identifier)[source]

Bases: object

The VFS volume interface.

GetAttribute(identifier)[source]

Retrieves a specific attribute.

Parameters:: identifier (str) – identifier of the attribute within the volume.
Returns:: volume attribute or None if not available.
Return type:: VolumeAttribute

HasExternalData()[source]

Determines if the volume has external stored data.

Returns:: True if the volume has external stored data.
Return type:: bool

__init__(identifier)[source]

Initializes a volume.

Parameters:: identifier (str) – identifier of the attribute within the volume.

property attributes

Retrieves attributes.

Returns:: volume attributes generator.
Return type:: generator[VolumeAttribute]

property extents

Retrieves extents.

Returns:: volume extents.
Return type:: list[VolumeExtent]

property number_of_attributes

Retrieves the number of attributes.

Returns:: number of attributes.
Return type:: int

property number_of_extents

Retrieves the number of extents.

Returns:: number of extents.
Return type:: int

class dfvfs.volume.volume_system.VolumeAttribute(identifier, value)[source]

Bases: object

The VFS volume attribute.

__init__(identifier, value)[source]

Initializes the volume attribute object.

Parameters:

identifier (str) – identifier of the attribute within the volume.
value (object) – value of the attribute.

class dfvfs.volume.volume_system.VolumeExtent(offset, size, extent_type=0)[source]

Bases: object

The VFS volume extent.

EXTENT_TYPE_DATA = 0

EXTENT_TYPE_SPARSE = 1

__init__(offset, size, extent_type=0)[source]

Initializes a volume extent.

Parameters:

offset (int) – start offset of the extent, in bytes.
size (int) – size of the extent, in bytes.
extent_type (Optional[str]) – type of extent.

class dfvfs.volume.volume_system.VolumeSystem[source]

Bases: object

The VFS volume system interface.

GetSectionByIndex(section_index)[source]

Retrieves a specific section based on the index.

Parameters:: section_index (int) – index of the section.
Returns:: a volume extent or None if not available.
Return type:: VolumeExtent

GetVolumeByIdentifier(volume_identifier)[source]

Retrieves a specific volume based on the identifier.

Parameters:: volume_identifier (str) – identifier of the volume within the volume system.
Returns:: a volume.
Return type:: Volume

GetVolumeByIndex(volume_index)[source]

Retrieves a specific volume based on the index.

Parameters:: volume_index (int) – index of the volume.
Returns:: a volume or None if not available.
Return type:: Volume

Open(path_spec)[source]

Opens a volume defined by path specification.

Parameters:: path_spec (PathSpec) – a path specification.
Raises:: VolumeSystemError – if the virtual file system representing the volume system could not be resolved.

TYPE_INDICATOR = None

VOLUME_IDENTIFIER_PREFIX = 'v'

__init__()[source]: Initializes a volume system.

property number_of_sections

Retrieves the number of sections.

Returns:: number of sections.
Return type:: int

property number_of_volumes

Retrieves the number of volumes.

Returns:: number of volumes.
Return type:: int

property sections

Retrieves sections.

Returns:: sections.
Return type:: list[VolumeExtent]

property volume_identifiers

Retrieves volume identifiers.

Returns:: volume identifiers.
Return type:: list[str]

property volumes

Retrieves volumes.

Returns:: volumes generator.
Return type:: generator(Volume)

dfvfs.volume.vshadow_volume_system module

The Volume Shadow Snapshots (VSS) volume system.

class dfvfs.volume.vshadow_volume_system.VShadowVolume(file_entry)[source]

Bases: Volume

Volume that uses pyvshadow.

HasExternalData()[source]

Determines if the volume has external stored data.

Returns:: True if the volume has external stored data.
Return type:: bool

__init__(file_entry)[source]

Initializes a volume.

Parameters:: file_entry (VShadowFileEntry) – a VSS file entry.

class dfvfs.volume.vshadow_volume_system.VShadowVolumeSystem[source]

Bases: VolumeSystem

Volume system that uses pyvshadow.

TYPE_INDICATOR = 'VSHADOW'

VOLUME_IDENTIFIER_PREFIX = 'vss'

Module contents

Imports for the volume system factory.