def _GetStat(self):
"""Retrieves the stat object.
Returns:
The stat object (instance of vfs.VFSStat).
Raises:
BackEndError: when the compressed stream is missing.
"""
encoded_stream = self.GetFileObject()
if not encoded_stream:
raise errors.BackEndError(
u'Unable to open encoded stream: {0:s}.'.format(
self.path_spec.comparable))
try:
stat_object = vfs_stat.VFSStat()
# File data stat information.
stat_object.size = encoded_stream.get_size()
# Date and time stat information.
# Ownership and permissions stat information.
# File entry type stat information.
stat_object.type = stat_object.TYPE_FILE
# Other stat information.
finally:
encoded_stream.close()
return stat_object
def _GetStat(self):
"""Retrieves the stat object.
Returns:
The stat object (instance of vfs.VFSStat).
Raises:
BackEndError: when the SQLite blob is missing.
"""
blob_file = self.GetFileObject()
if not blob_file:
raise errors.BackEndError(
u'Unable to open blob file: {0:s}.'.format(
self.path_spec.comparable))
try:
stat_object = vfs_stat.VFSStat()
# The root file entry is virtual and should have type directory.
if self._is_virtual:
stat_object.type = stat_object.TYPE_DIRECTORY
else:
stat_object.type = stat_object.TYPE_FILE
stat_object.size = blob_file.get_size()
finally:
blob_file.close()
return stat_object
def _GetStat(self):
"""Retrieves the stat object.
Returns:
The stat object (instance of vfs.VFSStat).
Raises:
BackEndError: when the BDE file is missing.
"""
bde_volume = self._file_system.GetBdeVolume()
if bde_volume is None:
raise errors.BackEndError(u'Missing BDE volume.')
stat_object = vfs_stat.VFSStat()
# File data stat information.
stat_object.size = bde_volume.get_size()
# Date and time stat information.
timestamp = date_time.PosixTimestamp.FromFiletime(
bde_volume.get_creation_time_as_integer())
if timestamp is not None:
stat_object.crtime = timestamp
# Ownership and permissions stat information.
# File entry type stat information.
stat_object.type = stat_object.TYPE_FILE
# Other stat information.
return stat_object
def _GetStat(self):
"""Retrieves the stat object.
Returns:
VFSStat: stat object.
Raises:
BackEndError: when the BDE file is missing.
"""
bde_volume = self._file_system.GetBDEVolume()
if bde_volume is None:
raise errors.BackEndError(u'Missing BDE volume.')
stat_object = vfs_stat.VFSStat()
# File data stat information.
stat_object.size = bde_volume.get_size()
# Date and time stat information.
timestamp = bde_volume.get_creation_time_as_integer()
date_time_values = dfdatetime_filetime.Filetime(timestamp=timestamp)
stat_time, stat_time_nano = date_time_values.CopyToStatTimeTuple()
if stat_time is not None:
stat_object.crtime = stat_time
stat_object.crtime_nano = stat_time_nano
# Ownership and permissions stat information.
# File entry type stat information.
stat_object.type = stat_object.TYPE_FILE
# Other stat information.
return stat_object
def _GetStat(self):
"""Retrieves the stat object.
Returns:
VFSStat: stat object.
Raises:
BackEndError: when the FVDE file is missing.
"""
fvde_volume = self._file_system.GetFVDEVolume()
if fvde_volume is None:
raise errors.BackEndError(u'Missing FVDE volume.')
stat_object = vfs_stat.VFSStat()
# File data stat information.
stat_object.size = fvde_volume.get_size()
# Date and time stat information.
# Ownership and permissions stat information.
# File entry type stat information.
stat_object.type = stat_object.TYPE_FILE
# Other stat information.
return stat_object
def AddFileEntry(self,
path,
file_entry_type=definitions.FILE_ENTRY_TYPE_FILE,
file_data=None,
link_data=None):
"""Adds a fake file entry.
Args:
path: the path of the file entry.
file_entry_type: optional type of the file entry object.
The default is file (definitions.FILE_ENTRY_TYPE_FILE).
file_data: optional data of the fake file-like object.
The default is None.
link_data: optional link data of the fake file entry object.
The default is None.
Raises:
KeyError: if the path already exists.
ValueError: if the file data is set but the file entry type is not a file
or if the link data is set but the file entry type is not
a link.
"""
if path in self._paths:
raise KeyError(
u'File entry already set for path: {0:s}.'.format(path))
if file_data and file_entry_type != definitions.FILE_ENTRY_TYPE_FILE:
raise ValueError(u'File data set for non-file file entry type.')
if link_data and file_entry_type != definitions.FILE_ENTRY_TYPE_LINK:
raise ValueError(u'Link data set for non-link file entry type.')
stat_object = vfs_stat.VFSStat()
# File data stat information.
if file_data is not None:
stat_object.size = len(file_data)
# Date and time stat information.
timestamp = date_time.PosixTimestamp.GetNow()
stat_object.atime = timestamp
stat_object.ctime = timestamp
stat_object.mtime = timestamp
# Ownership and permissions stat information.
# File entry type stat information.
stat_object.type = file_entry_type
# Other stat information.
if file_data:
path_data = file_data
elif link_data:
path_data = link_data
else:
path_data = None
self._paths[path] = (stat_object, path_data)
def _GetStat(self):
"""Retrieves the stat object.
Returns:
The stat object (instance of vfs.VFSStat).
Raises:
BackEndError: when the SQLite blob file-like object is missing.
"""
stat_object = vfs_stat.VFSStat()
# The root file entry is virtual and should have type directory.
if self._is_virtual:
stat_object.type = stat_object.TYPE_DIRECTORY
else:
file_object = self.GetFileObject()
if not file_object:
raise errors.BackEndError(
u'Unable to retrieve SQLite blob file-like object.')
try:
stat_object.type = stat_object.TYPE_FILE
stat_object.size = file_object.get_size()
finally:
file_object.close()
return stat_object
def _GetStat(self):
"""Retrieves information about the file entry.
Returns:
VFSStat: a stat object.
"""
stat_object = vfs_stat.VFSStat()
# Date and time stat information.
access_time = self.access_time
if access_time:
stat_time, stat_time_nano = access_time.CopyToStatTimeTuple()
if stat_time is not None:
stat_object.atime = stat_time
if stat_time_nano is not None:
stat_object.atime_nano = stat_time_nano
change_time = self.change_time
if change_time:
stat_time, stat_time_nano = change_time.CopyToStatTimeTuple()
if stat_time is not None:
stat_object.ctime = stat_time
if stat_time_nano is not None:
stat_object.ctime_nano = stat_time_nano
creation_time = self.creation_time
if creation_time:
stat_time, stat_time_nano = creation_time.CopyToStatTimeTuple()
if stat_time is not None:
stat_object.crtime = stat_time
if stat_time_nano is not None:
stat_object.crtime_nano = stat_time_nano
modification_time = self.modification_time
if modification_time:
stat_time, stat_time_nano = modification_time.CopyToStatTimeTuple()
if stat_time is not None:
stat_object.mtime = stat_time
if stat_time_nano is not None:
stat_object.mtime_nano = stat_time_nano
# File data stat information.
stat_object.size = self.size
# Ownership and permissions stat information.
# TODO: consider adding stat_object.mode
# TODO: consider adding stat_object.uid
# TODO: consider adding stat_object.gid
# File entry type stat information.
stat_object.type = self.entry_type
# Other stat information.
# TODO: consider adding stat_object.ino
# TODO: consider adding stat_object.fs_type
stat_object.is_allocated = self.IsAllocated()
return stat_object
def _GetStat(self):
"""Retrieves the stat object.
Returns:
The stat object (instance of vfs.VFSStat).
Raises:
BackEndError: when the zip info is missing in a non-virtual file entry.
"""
zip_info = self.GetZipInfo()
if not self._is_virtual and zip_info is None:
raise errors.BackEndError(
u'Missing zip info in non-virtual file entry.')
stat_object = vfs_stat.VFSStat()
# File data stat information.
if zip_info is not None:
stat_object.size = getattr(zip_info, u'size', None)
# Date and time stat information.
# TODO: move this to a timelib equivalent.
zip_info_date_time = getattr(zip_info, u'date_time', None)
if zip_info_date_time:
stat_object.mtime = date_time.PosixTimestamp.FromTimeElements(
zip_info_date_time)
# Ownership and permissions stat information.
if zip_info is not None:
creator_system = getattr(zip_info, u'create_system', 0)
external_attributes = getattr(zip_info, u'external_attr', 0)
if external_attributes != 0:
if creator_system == self._CREATOR_SYSTEM_UNIX:
st_mode = external_attributes >> 16
stat_object.mode = st_mode & 0x0fff
# File entry type stat information.
# The root file entry is virtual and should have type directory.
if (self._is_virtual or external_attributes
& self._MSDOS_FILE_ATTRIBUTES_IS_DIRECTORY):
stat_object.type = stat_object.TYPE_DIRECTORY
else:
stat_object.type = stat_object.TYPE_FILE
# Other stat information.
# zip_info.compress_type
# zip_info.comment
# zip_info.extra
# zip_info.create_version
# zip_info.extract_version
# zip_info.flag_bits
# zip_info.volume
# zip_info.internal_attr
# zip_info.compress_size
return stat_object
def _GetStat(self):
"""Retrieves the stat object.
Returns:
VFSStat: stat object.
Raises:
BackEndError: when the TAR info is missing in a non-virtual file entry.
"""
tar_info = self.GetTARInfo()
if not self._is_virtual and tar_info is None:
raise errors.BackEndError(
u'Missing TAR info in non-virtual file entry.')
stat_object = vfs_stat.VFSStat()
# File data stat information.
stat_object.size = getattr(tar_info, u'size', None)
# Date and time stat information.
stat_object.mtime = getattr(tar_info, u'mtime', None)
# Ownership and permissions stat information.
stat_object.mode = getattr(tar_info, u'mode', None)
stat_object.uid = getattr(tar_info, u'uid', None)
stat_object.gid = getattr(tar_info, u'gid', None)
# TODO: implement support for:
# stat_object.uname = getattr(tar_info, u'uname', None)
# stat_object.gname = getattr(tar_info, u'gname', None)
# File entry type stat information.
# The root file entry is virtual and should have type directory.
if self._is_virtual or tar_info.isdir():
stat_object.type = stat_object.TYPE_DIRECTORY
elif tar_info.isfile():
stat_object.type = stat_object.TYPE_FILE
elif tar_info.issym() or tar_info.islnk():
stat_object.type = stat_object.TYPE_LINK
elif tar_info.ischr() or tar_info.isblk():
stat_object.type = stat_object.TYPE_DEVICE
elif tar_info.isfifo():
stat_object.type = stat_object.TYPE_PIPE
# TODO: determine if this covers all the types:
# REGTYPE, AREGTYPE, LNKTYPE, SYMTYPE, DIRTYPE, FIFOTYPE, CONTTYPE,
# CHRTYPE, BLKTYPE, GNUTYPE_SPARSE
# Other stat information.
# tar_info.pax_headers
return stat_object
def _GetStat(self):
"""Retrieves the stat object.
Returns:
The stat object (instance of vfs.VFSStat).
Raises:
BackEndError: when the CPIO archive file entry is missing in
a non-virtual file entry.
"""
cpio_archive_file_entry = self.GetCPIOArchiveFileEntry()
if not self._is_virtual and cpio_archive_file_entry is None:
raise errors.BackEndError(
u'Missing CPIO archive file entry in non-virtual file entry.')
stat_object = vfs_stat.VFSStat()
# File data stat information.
stat_object.size = getattr(cpio_archive_file_entry, u'data_size', None)
# Date and time stat information.
stat_object.mtime = getattr(cpio_archive_file_entry,
u'modification_time', None)
# Ownership and permissions stat information.
mode = getattr(cpio_archive_file_entry, u'mode', 0)
stat_object.mode = stat.S_IMODE(mode)
stat_object.uid = getattr(cpio_archive_file_entry, u'user_identifier',
None)
stat_object.gid = getattr(cpio_archive_file_entry, u'group_identifier',
None)
# File entry type stat information.
# The stat info member st_mode can have multiple types e.g.
# LINK and DIRECTORY in case of a symbolic link to a directory
# dfVFS currently only supports one type so we need to check
# for LINK first.
if stat.S_ISLNK(mode):
stat_object.type = stat_object.TYPE_LINK
# The root file entry is virtual and should have type directory.
elif self._is_virtual or stat.S_ISDIR(mode):
stat_object.type = stat_object.TYPE_DIRECTORY
elif stat.S_ISREG(mode):
stat_object.type = stat_object.TYPE_FILE
elif stat.S_ISCHR(mode) or stat.S_ISBLK(mode):
stat_object.type = stat_object.TYPE_DEVICE
elif stat.S_ISFIFO(mode):
stat_object.type = stat_object.TYPE_PIPE
elif stat.S_ISSOCK(mode):
stat_object.type = stat_object.TYPE_SOCKET
return stat_object
def _GetStat(self):
"""Retrieves information about the file entry.
Returns:
VFSStat: a stat object.
"""
stat_object = vfs_stat.VFSStat()
if self._compressed_stream:
stat_object.size = self._compressed_stream.get_size()
stat_object.type = self.entry_type
return stat_object
def _GetStat(self):
"""Retrieves the stat object.
Returns:
The stat object (instance of VFSStat).
Raises:
BackEndError: when the vslvm logical volume is missing in a non-virtual
file entry.
"""
vslvm_logical_volume = self.GetLVMLogicalVolume()
if not self._is_virtual and vslvm_logical_volume is None:
raise errors.BackEndError(
u'Missing vslvm logical volume in non-virtual file entry.')
stat_object = vfs_stat.VFSStat()
# File data stat information.
if vslvm_logical_volume is not None:
stat_object.size = vslvm_logical_volume.size
# Date and time stat information.
if vslvm_logical_volume is not None:
# TODO: implement in pyvslvm
# timestamp = vslvm_logical_volume.get_creation_time_as_integer()
timestamp = None
if timestamp is not None:
date_time_values = dfdatetime_posix_time.PosixTimestamp(
timestamp)
stat_time, stat_time_nano = date_time_values.CopyToStatTimeTuple(
)
if stat_time is not None:
stat_object.crtime = stat_time
stat_object.crtime_nano = stat_time_nano
# Ownership and permissions stat information.
# File entry type stat information.
# The root file entry is virtual and should have type directory.
if self._is_virtual:
stat_object.type = stat_object.TYPE_DIRECTORY
else:
stat_object.type = stat_object.TYPE_FILE
return stat_object
def _GetStat(self):
"""Retrieves information about the file entry.
Returns:
VFSStat: a stat object.
"""
stat_object = vfs_stat.VFSStat()
# Date and time stat information.
access_time = self.access_time
if access_time:
stat_time, stat_time_nano = access_time.CopyToStatTimeTuple()
if stat_time is not None:
stat_object.atime = stat_time
if stat_time_nano is not None:
stat_object.atime_nano = stat_time_nano
change_time = self.change_time
if change_time:
stat_time, stat_time_nano = change_time.CopyToStatTimeTuple()
if stat_time is not None:
stat_object.ctime = stat_time
if stat_time_nano is not None:
stat_object.ctime_nano = stat_time_nano
creation_time = self.creation_time
if creation_time:
stat_time, stat_time_nano = creation_time.CopyToStatTimeTuple()
if stat_time is not None:
stat_object.crtime = stat_time
if stat_time_nano is not None:
stat_object.crtime_nano = stat_time_nano
modification_time = self.modification_time
if modification_time:
stat_time, stat_time_nano = modification_time.CopyToStatTimeTuple()
if stat_time is not None:
stat_object.mtime = stat_time
if stat_time_nano is not None:
stat_object.mtime_nano = stat_time_nano
# File entry type stat information.
if self.entry_type:
stat_object.type = self.entry_type
return stat_object
def _GetStat(self):
"""Retrieves the stat object.
Returns:
dfvvfs.VFSStat: a stat object.
Raises:
BackEndError: when the regf key is missing.
"""
if not self._regf_key:
raise errors.BackEndError('Missing regf key.')
stat_object = vfs_stat.VFSStat()
# File data stat information.
if self._regf_value:
stat_object.size = self._regf_value.get_data_size()
# Date and time stat information.
if self._regf_value:
timestamp = None
else:
filetime_object = filetime.Filetime(
timestamp=self._regf_key.get_last_written_time_as_integer())
# TODO: CopyToStatTimeTuple is to be deprecated.
timestamp, _ = filetime_object.CopyToStatTimeTuple()
if timestamp is not None:
stat_object.mtime = timestamp
# Ownership and permissions stat information.
# TODO: add support for security key.
# File entry type stat information.
if self._regf_value:
stat_object.type = stat_object.TYPE_FILE
else:
stat_object.type = stat_object.TYPE_DIRECTORY
# TODO: add support for a link:
# stat_object.type = stat_object.TYPE_LINK
# Other stat information.
stat_object.is_allocated = True
return stat_object
def _GetStat(self):
"""Retrieves the stat object.
Returns:
The stat object (instance of vfs.VFSStat).
Raises:
BackEndError: when the tsk volume system part is missing in a non-virtual
file entry.
"""
tsk_vs_part = self.GetTSKVsPart()
stat_object = vfs_stat.VFSStat()
if not self._is_virtual and tsk_vs_part is None:
raise errors.BackEndError(
u'Missing tsk volume system part in non-virtual file entry.')
tsk_volume = self._file_system.GetTSKVolume()
bytes_per_sector = tsk_partition.TSKVolumeGetBytesPerSector(tsk_volume)
# File data stat information.
if tsk_vs_part is not None:
number_of_sectors = tsk_partition.TSKVsPartGetNumberOfSectors(
tsk_vs_part)
if number_of_sectors:
stat_object.size = number_of_sectors * bytes_per_sector
# Date and time stat information.
# Ownership and permissions stat information.
# File entry type stat information.
# The root file entry is virtual and should have type directory.
if self._is_virtual:
stat_object.type = stat_object.TYPE_DIRECTORY
else:
stat_object.type = stat_object.TYPE_FILE
if not self._is_virtual:
stat_object.is_allocated = tsk_partition.TSKVsPartIsAllocated(
tsk_vs_part)
return stat_object
def _GetStat(self):
"""Retrieves the stat object.
Returns:
The stat object (instance of vfs.VFSStat).
Raises:
BackEndError: when the encoded stream is missing.
"""
stat_object = vfs_stat.VFSStat()
# File data stat information.
stat_object.size = self.path_spec.range_size
# File entry type stat information.
stat_object.type = stat_object.TYPE_FILE
return stat_object
def _GetStat(self):
"""Retrieves the stat object.
Returns:
The stat object (instance of vfs.VFSStat).
Raises:
BackEndError: when the regf key is missing.
"""
if not self._regf_key:
raise errors.BackEndError(u'Missing regf key.')
stat_object = vfs_stat.VFSStat()
# File data stat information.
if self._regf_value:
stat_object.size = self._regf_value.get_data_size()
# Date and time stat information.
if self._regf_value:
timestamp = None
else:
timestamp = date_time.PosixTimestamp.FromFiletime(
self._regf_key.get_last_written_time_as_integer())
if timestamp is not None:
stat_object.mtime = timestamp
# Ownership and permissions stat information.
# TODO: add support for security key.
# File entry type stat information.
if self._regf_value:
stat_object.type = stat_object.TYPE_FILE
else:
stat_object.type = stat_object.TYPE_DIRECTORY
# TODO: add support for a link:
# stat_object.type = stat_object.TYPE_LINK
# Other stat information.
stat_object.is_allocated = True
return stat_object
def _GetStat(self):
"""Retrieves the stat object.
Returns:
The stat object (instance of vfs.VFSStat).
Raises:
BackEndError: when the vshadow store is missing in a non-virtual
file entry.
"""
vshadow_store = self.GetVShadowStore()
if not self._is_virtual and vshadow_store is None:
raise errors.BackEndError(
u'Missing vshadow store in non-virtual file entry.')
stat_object = vfs_stat.VFSStat()
# File data stat information.
if vshadow_store is not None:
stat_object.size = vshadow_store.volume_size
# Date and time stat information.
if vshadow_store is not None:
timestamp = vshadow_store.get_creation_time_as_integer()
date_time_values = dfdatetime_filetime.Filetime(
timestamp=timestamp)
stat_time, stat_time_nano = date_time_values.CopyToStatTimeTuple()
if stat_time is not None:
stat_object.crtime = stat_time
stat_object.crtime_nano = stat_time_nano
# Ownership and permissions stat information.
# File entry type stat information.
# The root file entry is virtual and should have type directory.
if self._is_virtual:
stat_object.type = stat_object.TYPE_DIRECTORY
else:
stat_object.type = stat_object.TYPE_FILE
return stat_object
def _GetStat(self):
"""Retrieves the stat object.
Returns:
The stat object (instance of vfs.VFSStat).
Raises:
BackEndError: when the gzip file is missing.
"""
gzip_file = self.GetFileObject()
if not gzip_file:
raise errors.BackEndError(
u'Unable to open gzip file: {0:s}.'.format(
self.path_spec.comparable))
try:
stat_object = vfs_stat.VFSStat()
# File data stat information.
stat_object.size = gzip_file.uncompressed_data_size
# Date and time stat information.
stat_object.mtime = gzip_file.modification_time
# Ownership and permissions stat information.
# File entry type stat information.
stat_object.type = stat_object.TYPE_FILE
# Other stat information.
# gzip_file.comment
# gzip_file.operating_system
# gzip_file.original_filename
finally:
gzip_file.close()
return stat_object
def _GetStat(self):
"""Retrieves the stat object.
Returns:
VFSStat: stat object.
Raises:
BackEndError: if the TSK File .info or .info.meta attribute is missing.
"""
tsk_file = self.GetTSKFile()
if not tsk_file or not tsk_file.info or not tsk_file.info.meta:
raise errors.BackEndError(u'Missing TSK File .info or .info.meta.')
stat_object = vfs_stat.VFSStat()
# File data stat information.
stat_object.size = getattr(tsk_file.info.meta, u'size', None)
# Date and time stat information.
stat_time, stat_time_nano = self._TSKFileTimeCopyToStatTimeTuple(
tsk_file, u'atime')
if stat_time is not None:
stat_object.atime = stat_time
stat_object.atime_nano = stat_time_nano
stat_time, stat_time_nano = self._TSKFileTimeCopyToStatTimeTuple(
tsk_file, u'bkup')
if stat_time is not None:
stat_object.bkup = stat_time
stat_object.bkup_nano = stat_time_nano
stat_time, stat_time_nano = self._TSKFileTimeCopyToStatTimeTuple(
tsk_file, u'ctime')
if stat_time is not None:
stat_object.ctime = stat_time
stat_object.ctime_nano = stat_time_nano
stat_time, stat_time_nano = self._TSKFileTimeCopyToStatTimeTuple(
tsk_file, u'crtime')
if stat_time is not None:
stat_object.crtime = stat_time
stat_object.crtime_nano = stat_time_nano
stat_time, stat_time_nano = self._TSKFileTimeCopyToStatTimeTuple(
tsk_file, u'dtime')
if stat_time is not None:
stat_object.dtime = stat_time
stat_object.dtime_nano = stat_time_nano
stat_time, stat_time_nano = self._TSKFileTimeCopyToStatTimeTuple(
tsk_file, u'mtime')
if stat_time is not None:
stat_object.mtime = stat_time
stat_object.mtime_nano = stat_time_nano
# Ownership and permissions stat information.
mode = getattr(tsk_file.info.meta, u'mode', None)
if mode is not None:
# We need to cast mode to an int since it is of type
# pytsk3.TSK_FS_META_MODE_ENUM.
stat_object.mode = int(mode)
stat_object.uid = getattr(tsk_file.info.meta, u'uid', None)
stat_object.gid = getattr(tsk_file.info.meta, u'gid', None)
# File entry type stat information.
# The type is an instance of pytsk3.TSK_FS_META_TYPE_ENUM.
tsk_fs_meta_type = getattr(tsk_file.info.meta, u'type',
pytsk3.TSK_FS_META_TYPE_UNDEF)
if tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_REG:
stat_object.type = stat_object.TYPE_FILE
elif tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_DIR:
stat_object.type = stat_object.TYPE_DIRECTORY
elif tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_LNK:
stat_object.type = stat_object.TYPE_LINK
elif (tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_CHR
or tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_BLK):
stat_object.type = stat_object.TYPE_DEVICE
elif tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_FIFO:
stat_object.type = stat_object.TYPE_PIPE
elif tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_SOCK:
stat_object.type = stat_object.TYPE_SOCKET
# TODO: implement support for:
# pytsk3.TSK_FS_META_TYPE_UNDEF
# pytsk3.TSK_FS_META_TYPE_SHAD
# pytsk3.TSK_FS_META_TYPE_WHT
# pytsk3.TSK_FS_META_TYPE_VIRT
# Other stat information.
stat_object.ino = getattr(tsk_file.info.meta, u'addr', None)
# stat_object.dev = stat_info.st_dev
# stat_object.nlink = getattr(tsk_file.info.meta, u'nlink', None)
# stat_object.fs_type = u'Unknown'
flags = getattr(tsk_file.info.meta, u'flags', 0)
# The flags are an instance of pytsk3.TSK_FS_META_FLAG_ENUM.
if int(flags) & pytsk3.TSK_FS_META_FLAG_ALLOC:
stat_object.is_allocated = True
else:
stat_object.is_allocated = False
return stat_object
def _GetStat(self):
"""Retrieves the stat object.
Returns:
VFSStat: stat object.
Raises:
BackEndError: if the pyfsntfs file entry is missing.
"""
fsntfs_file_entry = self.GetNTFSFileEntry()
if not fsntfs_file_entry:
raise errors.BackEndError(u'Missing pyfsntfs file entry.')
stat_object = vfs_stat.VFSStat()
# File data stat information.
if fsntfs_file_entry.has_default_data_stream():
stat_object.size = fsntfs_file_entry.get_size()
# Date and time stat information.
timestamp = fsntfs_file_entry.get_access_time_as_integer()
date_time_values = dfdatetime_filetime.Filetime(timestamp=timestamp)
stat_time, stat_time_nano = date_time_values.CopyToStatTimeTuple()
if stat_time is not None:
stat_object.atime = stat_time
stat_object.atime_nano = stat_time_nano
timestamp = fsntfs_file_entry.get_creation_time_as_integer()
date_time_values = dfdatetime_filetime.Filetime(timestamp=timestamp)
stat_time, stat_time_nano = date_time_values.CopyToStatTimeTuple()
if stat_time is not None:
stat_object.crtime = stat_time
stat_object.crtime_nano = stat_time_nano
timestamp = fsntfs_file_entry.get_modification_time_as_integer()
date_time_values = dfdatetime_filetime.Filetime(timestamp=timestamp)
stat_time, stat_time_nano = date_time_values.CopyToStatTimeTuple()
if stat_time is not None:
stat_object.mtime = stat_time
stat_object.mtime_nano = stat_time_nano
timestamp = fsntfs_file_entry.get_entry_modification_time_as_integer()
date_time_values = dfdatetime_filetime.Filetime(timestamp=timestamp)
stat_time, stat_time_nano = date_time_values.CopyToStatTimeTuple()
if stat_time is not None:
stat_object.ctime = stat_time
stat_object.ctime_nano = stat_time_nano
# Ownership and permissions stat information.
# TODO: stat_object.mode
# TODO: stat_object.uid
# TODO: stat_object.gid
# File entry type stat information.
if self._IsLink(fsntfs_file_entry.file_attribute_flags):
stat_object.type = stat_object.TYPE_LINK
elif fsntfs_file_entry.has_directory_entries_index():
stat_object.type = stat_object.TYPE_DIRECTORY
else:
stat_object.type = stat_object.TYPE_FILE
# Other stat information.
stat_object.ino = (fsntfs_file_entry.file_reference
& _FILE_REFERENCE_MFT_ENTRY_BITMASK)
stat_object.fs_type = u'NTFS'
stat_object.is_allocated = fsntfs_file_entry.is_allocated()
return stat_object
def _GetStat(self):
"""Retrieves the stat object (instance of vfs.VFSStat).
Raises:
BackEndError: If an OSError comes up it is caught and an
BackEndError error is raised instead.
Returns:
Stat object (instance of VFSStat) or None if no location is set.
"""
location = getattr(self.path_spec, u'location', None)
if location is None:
return
stat_object = vfs_stat.VFSStat()
is_windows_device = False
stat_info = None
# Windows does not support running os.stat on device files so we use
# libsmdev to do an initial check.
if platform.system() == u'Windows':
try:
is_windows_device = pysmdev.check_device(location)
except IOError:
pass
if is_windows_device:
stat_object.type = stat_object.TYPE_DEVICE
else:
# We are only catching OSError. However on the Windows platform
# a WindowsError can be raised as well. We are not catching that since
# that error does not exist on non-Windows platforms.
try:
stat_info = os.stat(location)
except OSError as exception:
raise errors.BackEndError(
u'Unable to retrieve stat object with error: {0:s}'.format(
exception))
# File data stat information.
stat_object.size = stat_info.st_size
# Date and time stat information.
stat_object.atime = stat_info.st_atime
stat_object.ctime = stat_info.st_ctime
stat_object.mtime = stat_info.st_mtime
# Ownership and permissions stat information.
stat_object.mode = stat.S_IMODE(stat_info.st_mode)
stat_object.uid = stat_info.st_uid
stat_object.gid = stat_info.st_gid
# If location contains a trailing segment separator and points to
# a symbolic link to a directory stat info will not indicate
# the file entry as a symbolic link. The following check ensures
# that the LINK type is correctly detected.
is_link = os.path.islink(location)
# File entry type stat information.
# The stat info member st_mode can have multiple types e.g.
# LINK and DIRECTORY in case of a symbolic link to a directory
# dfVFS currently only supports one type so we need to check
# for LINK first.
if stat.S_ISLNK(stat_info.st_mode) or is_link:
stat_object.type = stat_object.TYPE_LINK
elif stat.S_ISREG(stat_info.st_mode):
stat_object.type = stat_object.TYPE_FILE
elif stat.S_ISDIR(stat_info.st_mode):
stat_object.type = stat_object.TYPE_DIRECTORY
elif (stat.S_ISCHR(stat_info.st_mode) or
stat.S_ISBLK(stat_info.st_mode)):
stat_object.type = stat_object.TYPE_DEVICE
elif stat.S_ISFIFO(stat_info.st_mode):
stat_object.type = stat_object.TYPE_PIPE
elif stat.S_ISSOCK(stat_info.st_mode):
stat_object.type = stat_object.TYPE_SOCKET
# Other stat information.
stat_object.ino = stat_info.st_ino
# stat_info.st_dev
# stat_info.st_nlink
return stat_object
