forked from log2timeline/dfvfs
-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Added fsext back-end log2timeline#464
- Loading branch information
1 parent
99aae01
commit d0d17b1
Showing
30 changed files
with
1,439 additions
and
21 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -2,14 +2,14 @@ Source: dfvfs | |
| Section: python | ||
| Priority: extra | ||
| Maintainer: Log2Timeline maintainers <[email protected]> | ||
| Build-Depends: debhelper (>= 9), dh-python, python3-all (>= 3.5~), python3-setuptools | ||
| Build-Depends: debhelper (>= 9), dh-python, python3-all (>= 3.6~), python3-setuptools | ||
| Standards-Version: 4.1.4 | ||
| X-Python3-Version: >= 3.5 | ||
| X-Python3-Version: >= 3.6 | ||
| Homepage: https://github.com/log2timeline/dfvfs | ||
|
|
||
| Package: python3-dfvfs | ||
| Architecture: all | ||
| Depends: libbde-python3 (>= 20140531), libewf-python3 (>= 20131210), libfsapfs-python3 (>= 20181205), libfsntfs-python3 (>= 20200424), libfvde-python3 (>= 20160719), libfwnt-python3 (>= 20160418), libluksde-python3 (>= 20200101), libqcow-python3 (>= 20131204), libsigscan-python3 (>= 20191221), libsmdev-python3 (>= 20140529), libsmraw-python3 (>= 20140612), libvhdi-python3 (>= 20131210), libvmdk-python3 (>= 20140421), libvshadow-python3 (>= 20160109), libvslvm-python3 (>= 20160109), python3-cffi-backend (>= 1.9.1), python3-cryptography (>= 2.0.2), python3-dfdatetime (>= 20200121), python3-dtfabric (>= 20170524), python3-idna (>= 2.5), python3-pytsk3 (>= 20160721), python3-yaml (>= 3.10), ${python3:Depends}, ${misc:Depends} | ||
| Depends: libbde-python3 (>= 20140531), libewf-python3 (>= 20131210), libfsapfs-python3 (>= 20181205), libfsext-python3 (>= 20200819), libfsntfs-python3 (>= 20200424), libfvde-python3 (>= 20160719), libfwnt-python3 (>= 20160418), libluksde-python3 (>= 20200101), libqcow-python3 (>= 20131204), libsigscan-python3 (>= 20191221), libsmdev-python3 (>= 20140529), libsmraw-python3 (>= 20140612), libvhdi-python3 (>= 20131210), libvmdk-python3 (>= 20140421), libvshadow-python3 (>= 20160109), libvslvm-python3 (>= 20160109), python3-cffi-backend (>= 1.9.1), python3-cryptography (>= 2.0.2), python3-dfdatetime (>= 20200121), python3-dtfabric (>= 20170524), python3-idna (>= 2.5), python3-pytsk3 (>= 20160721), python3-yaml (>= 3.10), ${python3:Depends}, ${misc:Depends} | ||
| Description: Python 3 module of dfVFS | ||
| dfVFS, or Digital Forensics Virtual File System, provides read-only access to | ||
| file-system objects from various storage media types and file formats. The goal | ||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,44 @@ | ||
| # -*- coding: utf-8 -*- | ||
| """The EXT format analyzer helper implementation.""" | ||
|
|
||
| from __future__ import unicode_literals | ||
|
|
||
| from dfvfs.analyzer import analyzer | ||
| from dfvfs.analyzer import analyzer_helper | ||
| from dfvfs.analyzer import specification | ||
| from dfvfs.lib import definitions | ||
|
|
||
|
|
||
| class EXTAnalyzerHelper(analyzer_helper.AnalyzerHelper): | ||
| """EXT analyzer helper.""" | ||
|
|
||
| FORMAT_CATEGORIES = frozenset([ | ||
| definitions.FORMAT_CATEGORY_FILE_SYSTEM]) | ||
|
|
||
| TYPE_INDICATOR = definitions.TYPE_INDICATOR_EXT | ||
|
|
||
| def GetFormatSpecification(self): | ||
| """Retrieves the format specification. | ||
| Returns: | ||
| FormatSpecification: format specification or None if the format cannot | ||
| be defined by a specification object. | ||
| """ | ||
| format_specification = specification.FormatSpecification( | ||
| self.type_indicator) | ||
|
|
||
| # EXT file system signature. | ||
| format_specification.AddNewSignature(b'\x53\xef', offset=1080) | ||
|
|
||
| return format_specification | ||
|
|
||
| def IsEnabled(self): | ||
| """Determines if the analyzer helper is enabled. | ||
| Returns: | ||
| bool: True if the analyzer helper is enabled. | ||
| """ | ||
| return definitions.PREFERRED_EXT_BACK_END == self.TYPE_INDICATOR | ||
|
|
||
|
|
||
| analyzer.Analyzer.RegisterHelper(EXTAnalyzerHelper()) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,141 @@ | ||
| # -*- coding: utf-8 -*- | ||
| """The Extended File System (EXT) file-like object implementation.""" | ||
|
|
||
| from __future__ import unicode_literals | ||
|
|
||
| import os | ||
|
|
||
| from dfvfs.file_io import file_io | ||
| from dfvfs.lib import errors | ||
| from dfvfs.resolver import resolver | ||
|
|
||
|
|
||
| class EXTFile(file_io.FileIO): | ||
| """File-like object using pyfsext.file_entry""" | ||
|
|
||
| def __init__(self, resolver_context): | ||
| """Initializes a file-like object. | ||
| Args: | ||
| resolver_context (Context): resolver context. | ||
| """ | ||
| super(EXTFile, self).__init__(resolver_context) | ||
| self._file_system = None | ||
| self._fsext_file_entry = None | ||
|
|
||
| def _Close(self): | ||
| """Closes the file-like object.""" | ||
| self._fsext_file_entry = None | ||
|
|
||
| self._file_system.Close() | ||
| self._file_system = None | ||
|
|
||
| def _Open(self, path_spec=None, mode='rb'): | ||
| """Opens the file-like object defined by path specification. | ||
| Args: | ||
| path_spec (PathSpec): path specification. | ||
| mode (Optional[str]): file access mode. | ||
| Raises: | ||
| AccessError: if the access to open the file was denied. | ||
| IOError: if the file-like object could not be opened. | ||
| NotSupported: if a data stream, like the resource or named fork, is | ||
| requested to be opened. | ||
| OSError: if the file-like object could not be opened. | ||
| PathSpecError: if the path specification is incorrect. | ||
| ValueError: if the path specification is invalid. | ||
| """ | ||
| if not path_spec: | ||
| raise ValueError('Missing path specification.') | ||
|
|
||
| data_stream = getattr(path_spec, 'data_stream', None) | ||
| if data_stream: | ||
| raise errors.NotSupported( | ||
| 'Open data stream: {0:s} not supported.'.format(data_stream)) | ||
|
|
||
| self._file_system = resolver.Resolver.OpenFileSystem( | ||
| path_spec, resolver_context=self._resolver_context) | ||
|
|
||
| file_entry = self._file_system.GetFileEntryByPathSpec(path_spec) | ||
| if not file_entry: | ||
| raise IOError('Unable to open file entry.') | ||
|
|
||
| fsext_file_entry = file_entry.GetEXTFileEntry() | ||
| if not fsext_file_entry: | ||
| raise IOError('Unable to open EXT file entry.') | ||
|
|
||
| self._fsext_file_entry = fsext_file_entry | ||
|
|
||
| # Note: that the following functions do not follow the style guide | ||
| # because they are part of the file-like object interface. | ||
| # pylint: disable=invalid-name | ||
|
|
||
| def read(self, size=None): | ||
| """Reads a byte string from the file-like object at the current offset. | ||
| The function will read a byte string of the specified size or | ||
| all of the remaining data if no size was specified. | ||
| Args: | ||
| size (Optional[int]): number of bytes to read, where None is all | ||
| remaining data. | ||
| Returns: | ||
| bytes: data read. | ||
| Raises: | ||
| IOError: if the read failed. | ||
| OSError: if the read failed. | ||
| """ | ||
| if not self._is_open: | ||
| raise IOError('Not opened.') | ||
|
|
||
| return self._fsext_file_entry.read(size=size) | ||
|
|
||
| def seek(self, offset, whence=os.SEEK_SET): | ||
| """Seeks to an offset within the file-like object. | ||
| Args: | ||
| offset (int): offset to seek to. | ||
| whence (Optional(int)): value that indicates whether offset is an absolute | ||
| or relative position within the file. | ||
| Raises: | ||
| IOError: if the seek failed. | ||
| OSError: if the seek failed. | ||
| """ | ||
| if not self._is_open: | ||
| raise IOError('Not opened.') | ||
|
|
||
| self._fsext_file_entry.seek(offset, whence) | ||
|
|
||
| def get_offset(self): | ||
| """Retrieves the current offset into the file-like object. | ||
| Return: | ||
| int: current offset into the file-like object. | ||
| Raises: | ||
| IOError: if the file-like object has not been opened. | ||
| OSError: if the file-like object has not been opened. | ||
| """ | ||
| if not self._is_open: | ||
| raise IOError('Not opened.') | ||
|
|
||
| return self._fsext_file_entry.get_offset() | ||
|
|
||
| def get_size(self): | ||
| """Retrieves the size of the file-like object. | ||
| Returns: | ||
| int: size of the file-like object data. | ||
| Raises: | ||
| IOError: if the file-like object has not been opened. | ||
| OSError: if the file-like object has not been opened. | ||
| """ | ||
| if not self._is_open: | ||
| raise IOError('Not opened.') | ||
|
|
||
| return self._fsext_file_entry.get_size() |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.