def _GetStat(self): """Retrieves the stat object. Returns: The stat object (instance of vfs.VFSStat). Raises: BackEndError: when the compressed stream is missing. """ encoded_stream = self.GetFileObject() if not encoded_stream: raise errors.BackEndError( u'Unable to open encoded stream: {0:s}.'.format( self.path_spec.comparable)) try: stat_object = vfs_stat.VFSStat() # File data stat information. stat_object.size = encoded_stream.get_size() # Date and time stat information. # Ownership and permissions stat information. # File entry type stat information. stat_object.type = stat_object.TYPE_FILE # Other stat information. finally: encoded_stream.close() return stat_object
def _GetStat(self): """Retrieves the stat object. Returns: The stat object (instance of vfs.VFSStat). Raises: BackEndError: when the SQLite blob is missing. """ blob_file = self.GetFileObject() if not blob_file: raise errors.BackEndError( u'Unable to open blob file: {0:s}.'.format( self.path_spec.comparable)) try: stat_object = vfs_stat.VFSStat() # The root file entry is virtual and should have type directory. if self._is_virtual: stat_object.type = stat_object.TYPE_DIRECTORY else: stat_object.type = stat_object.TYPE_FILE stat_object.size = blob_file.get_size() finally: blob_file.close() return stat_object
def _GetStat(self): """Retrieves the stat object. Returns: The stat object (instance of vfs.VFSStat). Raises: BackEndError: when the BDE file is missing. """ bde_volume = self._file_system.GetBdeVolume() if bde_volume is None: raise errors.BackEndError(u'Missing BDE volume.') stat_object = vfs_stat.VFSStat() # File data stat information. stat_object.size = bde_volume.get_size() # Date and time stat information. timestamp = date_time.PosixTimestamp.FromFiletime( bde_volume.get_creation_time_as_integer()) if timestamp is not None: stat_object.crtime = timestamp # Ownership and permissions stat information. # File entry type stat information. stat_object.type = stat_object.TYPE_FILE # Other stat information. return stat_object
def _GetStat(self): """Retrieves the stat object. Returns: VFSStat: stat object. Raises: BackEndError: when the BDE file is missing. """ bde_volume = self._file_system.GetBDEVolume() if bde_volume is None: raise errors.BackEndError(u'Missing BDE volume.') stat_object = vfs_stat.VFSStat() # File data stat information. stat_object.size = bde_volume.get_size() # Date and time stat information. timestamp = bde_volume.get_creation_time_as_integer() date_time_values = dfdatetime_filetime.Filetime(timestamp=timestamp) stat_time, stat_time_nano = date_time_values.CopyToStatTimeTuple() if stat_time is not None: stat_object.crtime = stat_time stat_object.crtime_nano = stat_time_nano # Ownership and permissions stat information. # File entry type stat information. stat_object.type = stat_object.TYPE_FILE # Other stat information. return stat_object
def _GetStat(self): """Retrieves the stat object. Returns: VFSStat: stat object. Raises: BackEndError: when the FVDE file is missing. """ fvde_volume = self._file_system.GetFVDEVolume() if fvde_volume is None: raise errors.BackEndError(u'Missing FVDE volume.') stat_object = vfs_stat.VFSStat() # File data stat information. stat_object.size = fvde_volume.get_size() # Date and time stat information. # Ownership and permissions stat information. # File entry type stat information. stat_object.type = stat_object.TYPE_FILE # Other stat information. return stat_object
def AddFileEntry(self, path, file_entry_type=definitions.FILE_ENTRY_TYPE_FILE, file_data=None, link_data=None): """Adds a fake file entry. Args: path: the path of the file entry. file_entry_type: optional type of the file entry object. The default is file (definitions.FILE_ENTRY_TYPE_FILE). file_data: optional data of the fake file-like object. The default is None. link_data: optional link data of the fake file entry object. The default is None. Raises: KeyError: if the path already exists. ValueError: if the file data is set but the file entry type is not a file or if the link data is set but the file entry type is not a link. """ if path in self._paths: raise KeyError( u'File entry already set for path: {0:s}.'.format(path)) if file_data and file_entry_type != definitions.FILE_ENTRY_TYPE_FILE: raise ValueError(u'File data set for non-file file entry type.') if link_data and file_entry_type != definitions.FILE_ENTRY_TYPE_LINK: raise ValueError(u'Link data set for non-link file entry type.') stat_object = vfs_stat.VFSStat() # File data stat information. if file_data is not None: stat_object.size = len(file_data) # Date and time stat information. timestamp = date_time.PosixTimestamp.GetNow() stat_object.atime = timestamp stat_object.ctime = timestamp stat_object.mtime = timestamp # Ownership and permissions stat information. # File entry type stat information. stat_object.type = file_entry_type # Other stat information. if file_data: path_data = file_data elif link_data: path_data = link_data else: path_data = None self._paths[path] = (stat_object, path_data)
def _GetStat(self): """Retrieves the stat object. Returns: The stat object (instance of vfs.VFSStat). Raises: BackEndError: when the SQLite blob file-like object is missing. """ stat_object = vfs_stat.VFSStat() # The root file entry is virtual and should have type directory. if self._is_virtual: stat_object.type = stat_object.TYPE_DIRECTORY else: file_object = self.GetFileObject() if not file_object: raise errors.BackEndError( u'Unable to retrieve SQLite blob file-like object.') try: stat_object.type = stat_object.TYPE_FILE stat_object.size = file_object.get_size() finally: file_object.close() return stat_object
def _GetStat(self): """Retrieves information about the file entry. Returns: VFSStat: a stat object. """ stat_object = vfs_stat.VFSStat() # Date and time stat information. access_time = self.access_time if access_time: stat_time, stat_time_nano = access_time.CopyToStatTimeTuple() if stat_time is not None: stat_object.atime = stat_time if stat_time_nano is not None: stat_object.atime_nano = stat_time_nano change_time = self.change_time if change_time: stat_time, stat_time_nano = change_time.CopyToStatTimeTuple() if stat_time is not None: stat_object.ctime = stat_time if stat_time_nano is not None: stat_object.ctime_nano = stat_time_nano creation_time = self.creation_time if creation_time: stat_time, stat_time_nano = creation_time.CopyToStatTimeTuple() if stat_time is not None: stat_object.crtime = stat_time if stat_time_nano is not None: stat_object.crtime_nano = stat_time_nano modification_time = self.modification_time if modification_time: stat_time, stat_time_nano = modification_time.CopyToStatTimeTuple() if stat_time is not None: stat_object.mtime = stat_time if stat_time_nano is not None: stat_object.mtime_nano = stat_time_nano # File data stat information. stat_object.size = self.size # Ownership and permissions stat information. # TODO: consider adding stat_object.mode # TODO: consider adding stat_object.uid # TODO: consider adding stat_object.gid # File entry type stat information. stat_object.type = self.entry_type # Other stat information. # TODO: consider adding stat_object.ino # TODO: consider adding stat_object.fs_type stat_object.is_allocated = self.IsAllocated() return stat_object
def _GetStat(self): """Retrieves the stat object. Returns: The stat object (instance of vfs.VFSStat). Raises: BackEndError: when the zip info is missing in a non-virtual file entry. """ zip_info = self.GetZipInfo() if not self._is_virtual and zip_info is None: raise errors.BackEndError( u'Missing zip info in non-virtual file entry.') stat_object = vfs_stat.VFSStat() # File data stat information. if zip_info is not None: stat_object.size = getattr(zip_info, u'size', None) # Date and time stat information. # TODO: move this to a timelib equivalent. zip_info_date_time = getattr(zip_info, u'date_time', None) if zip_info_date_time: stat_object.mtime = date_time.PosixTimestamp.FromTimeElements( zip_info_date_time) # Ownership and permissions stat information. if zip_info is not None: creator_system = getattr(zip_info, u'create_system', 0) external_attributes = getattr(zip_info, u'external_attr', 0) if external_attributes != 0: if creator_system == self._CREATOR_SYSTEM_UNIX: st_mode = external_attributes >> 16 stat_object.mode = st_mode & 0x0fff # File entry type stat information. # The root file entry is virtual and should have type directory. if (self._is_virtual or external_attributes & self._MSDOS_FILE_ATTRIBUTES_IS_DIRECTORY): stat_object.type = stat_object.TYPE_DIRECTORY else: stat_object.type = stat_object.TYPE_FILE # Other stat information. # zip_info.compress_type # zip_info.comment # zip_info.extra # zip_info.create_version # zip_info.extract_version # zip_info.flag_bits # zip_info.volume # zip_info.internal_attr # zip_info.compress_size return stat_object
def _GetStat(self): """Retrieves the stat object. Returns: VFSStat: stat object. Raises: BackEndError: when the TAR info is missing in a non-virtual file entry. """ tar_info = self.GetTARInfo() if not self._is_virtual and tar_info is None: raise errors.BackEndError( u'Missing TAR info in non-virtual file entry.') stat_object = vfs_stat.VFSStat() # File data stat information. stat_object.size = getattr(tar_info, u'size', None) # Date and time stat information. stat_object.mtime = getattr(tar_info, u'mtime', None) # Ownership and permissions stat information. stat_object.mode = getattr(tar_info, u'mode', None) stat_object.uid = getattr(tar_info, u'uid', None) stat_object.gid = getattr(tar_info, u'gid', None) # TODO: implement support for: # stat_object.uname = getattr(tar_info, u'uname', None) # stat_object.gname = getattr(tar_info, u'gname', None) # File entry type stat information. # The root file entry is virtual and should have type directory. if self._is_virtual or tar_info.isdir(): stat_object.type = stat_object.TYPE_DIRECTORY elif tar_info.isfile(): stat_object.type = stat_object.TYPE_FILE elif tar_info.issym() or tar_info.islnk(): stat_object.type = stat_object.TYPE_LINK elif tar_info.ischr() or tar_info.isblk(): stat_object.type = stat_object.TYPE_DEVICE elif tar_info.isfifo(): stat_object.type = stat_object.TYPE_PIPE # TODO: determine if this covers all the types: # REGTYPE, AREGTYPE, LNKTYPE, SYMTYPE, DIRTYPE, FIFOTYPE, CONTTYPE, # CHRTYPE, BLKTYPE, GNUTYPE_SPARSE # Other stat information. # tar_info.pax_headers return stat_object
def _GetStat(self): """Retrieves the stat object. Returns: The stat object (instance of vfs.VFSStat). Raises: BackEndError: when the CPIO archive file entry is missing in a non-virtual file entry. """ cpio_archive_file_entry = self.GetCPIOArchiveFileEntry() if not self._is_virtual and cpio_archive_file_entry is None: raise errors.BackEndError( u'Missing CPIO archive file entry in non-virtual file entry.') stat_object = vfs_stat.VFSStat() # File data stat information. stat_object.size = getattr(cpio_archive_file_entry, u'data_size', None) # Date and time stat information. stat_object.mtime = getattr(cpio_archive_file_entry, u'modification_time', None) # Ownership and permissions stat information. mode = getattr(cpio_archive_file_entry, u'mode', 0) stat_object.mode = stat.S_IMODE(mode) stat_object.uid = getattr(cpio_archive_file_entry, u'user_identifier', None) stat_object.gid = getattr(cpio_archive_file_entry, u'group_identifier', None) # File entry type stat information. # The stat info member st_mode can have multiple types e.g. # LINK and DIRECTORY in case of a symbolic link to a directory # dfVFS currently only supports one type so we need to check # for LINK first. if stat.S_ISLNK(mode): stat_object.type = stat_object.TYPE_LINK # The root file entry is virtual and should have type directory. elif self._is_virtual or stat.S_ISDIR(mode): stat_object.type = stat_object.TYPE_DIRECTORY elif stat.S_ISREG(mode): stat_object.type = stat_object.TYPE_FILE elif stat.S_ISCHR(mode) or stat.S_ISBLK(mode): stat_object.type = stat_object.TYPE_DEVICE elif stat.S_ISFIFO(mode): stat_object.type = stat_object.TYPE_PIPE elif stat.S_ISSOCK(mode): stat_object.type = stat_object.TYPE_SOCKET return stat_object
def _GetStat(self): """Retrieves information about the file entry. Returns: VFSStat: a stat object. """ stat_object = vfs_stat.VFSStat() if self._compressed_stream: stat_object.size = self._compressed_stream.get_size() stat_object.type = self.entry_type return stat_object
def _GetStat(self): """Retrieves the stat object. Returns: The stat object (instance of VFSStat). Raises: BackEndError: when the vslvm logical volume is missing in a non-virtual file entry. """ vslvm_logical_volume = self.GetLVMLogicalVolume() if not self._is_virtual and vslvm_logical_volume is None: raise errors.BackEndError( u'Missing vslvm logical volume in non-virtual file entry.') stat_object = vfs_stat.VFSStat() # File data stat information. if vslvm_logical_volume is not None: stat_object.size = vslvm_logical_volume.size # Date and time stat information. if vslvm_logical_volume is not None: # TODO: implement in pyvslvm # timestamp = vslvm_logical_volume.get_creation_time_as_integer() timestamp = None if timestamp is not None: date_time_values = dfdatetime_posix_time.PosixTimestamp( timestamp) stat_time, stat_time_nano = date_time_values.CopyToStatTimeTuple( ) if stat_time is not None: stat_object.crtime = stat_time stat_object.crtime_nano = stat_time_nano # Ownership and permissions stat information. # File entry type stat information. # The root file entry is virtual and should have type directory. if self._is_virtual: stat_object.type = stat_object.TYPE_DIRECTORY else: stat_object.type = stat_object.TYPE_FILE return stat_object
def _GetStat(self): """Retrieves information about the file entry. Returns: VFSStat: a stat object. """ stat_object = vfs_stat.VFSStat() # Date and time stat information. access_time = self.access_time if access_time: stat_time, stat_time_nano = access_time.CopyToStatTimeTuple() if stat_time is not None: stat_object.atime = stat_time if stat_time_nano is not None: stat_object.atime_nano = stat_time_nano change_time = self.change_time if change_time: stat_time, stat_time_nano = change_time.CopyToStatTimeTuple() if stat_time is not None: stat_object.ctime = stat_time if stat_time_nano is not None: stat_object.ctime_nano = stat_time_nano creation_time = self.creation_time if creation_time: stat_time, stat_time_nano = creation_time.CopyToStatTimeTuple() if stat_time is not None: stat_object.crtime = stat_time if stat_time_nano is not None: stat_object.crtime_nano = stat_time_nano modification_time = self.modification_time if modification_time: stat_time, stat_time_nano = modification_time.CopyToStatTimeTuple() if stat_time is not None: stat_object.mtime = stat_time if stat_time_nano is not None: stat_object.mtime_nano = stat_time_nano # File entry type stat information. if self.entry_type: stat_object.type = self.entry_type return stat_object
def _GetStat(self): """Retrieves the stat object. Returns: dfvvfs.VFSStat: a stat object. Raises: BackEndError: when the regf key is missing. """ if not self._regf_key: raise errors.BackEndError('Missing regf key.') stat_object = vfs_stat.VFSStat() # File data stat information. if self._regf_value: stat_object.size = self._regf_value.get_data_size() # Date and time stat information. if self._regf_value: timestamp = None else: filetime_object = filetime.Filetime( timestamp=self._regf_key.get_last_written_time_as_integer()) # TODO: CopyToStatTimeTuple is to be deprecated. timestamp, _ = filetime_object.CopyToStatTimeTuple() if timestamp is not None: stat_object.mtime = timestamp # Ownership and permissions stat information. # TODO: add support for security key. # File entry type stat information. if self._regf_value: stat_object.type = stat_object.TYPE_FILE else: stat_object.type = stat_object.TYPE_DIRECTORY # TODO: add support for a link: # stat_object.type = stat_object.TYPE_LINK # Other stat information. stat_object.is_allocated = True return stat_object
def _GetStat(self): """Retrieves the stat object. Returns: The stat object (instance of vfs.VFSStat). Raises: BackEndError: when the tsk volume system part is missing in a non-virtual file entry. """ tsk_vs_part = self.GetTSKVsPart() stat_object = vfs_stat.VFSStat() if not self._is_virtual and tsk_vs_part is None: raise errors.BackEndError( u'Missing tsk volume system part in non-virtual file entry.') tsk_volume = self._file_system.GetTSKVolume() bytes_per_sector = tsk_partition.TSKVolumeGetBytesPerSector(tsk_volume) # File data stat information. if tsk_vs_part is not None: number_of_sectors = tsk_partition.TSKVsPartGetNumberOfSectors( tsk_vs_part) if number_of_sectors: stat_object.size = number_of_sectors * bytes_per_sector # Date and time stat information. # Ownership and permissions stat information. # File entry type stat information. # The root file entry is virtual and should have type directory. if self._is_virtual: stat_object.type = stat_object.TYPE_DIRECTORY else: stat_object.type = stat_object.TYPE_FILE if not self._is_virtual: stat_object.is_allocated = tsk_partition.TSKVsPartIsAllocated( tsk_vs_part) return stat_object
def _GetStat(self): """Retrieves the stat object. Returns: The stat object (instance of vfs.VFSStat). Raises: BackEndError: when the encoded stream is missing. """ stat_object = vfs_stat.VFSStat() # File data stat information. stat_object.size = self.path_spec.range_size # File entry type stat information. stat_object.type = stat_object.TYPE_FILE return stat_object
def _GetStat(self): """Retrieves the stat object. Returns: The stat object (instance of vfs.VFSStat). Raises: BackEndError: when the regf key is missing. """ if not self._regf_key: raise errors.BackEndError(u'Missing regf key.') stat_object = vfs_stat.VFSStat() # File data stat information. if self._regf_value: stat_object.size = self._regf_value.get_data_size() # Date and time stat information. if self._regf_value: timestamp = None else: timestamp = date_time.PosixTimestamp.FromFiletime( self._regf_key.get_last_written_time_as_integer()) if timestamp is not None: stat_object.mtime = timestamp # Ownership and permissions stat information. # TODO: add support for security key. # File entry type stat information. if self._regf_value: stat_object.type = stat_object.TYPE_FILE else: stat_object.type = stat_object.TYPE_DIRECTORY # TODO: add support for a link: # stat_object.type = stat_object.TYPE_LINK # Other stat information. stat_object.is_allocated = True return stat_object
def _GetStat(self): """Retrieves the stat object. Returns: The stat object (instance of vfs.VFSStat). Raises: BackEndError: when the vshadow store is missing in a non-virtual file entry. """ vshadow_store = self.GetVShadowStore() if not self._is_virtual and vshadow_store is None: raise errors.BackEndError( u'Missing vshadow store in non-virtual file entry.') stat_object = vfs_stat.VFSStat() # File data stat information. if vshadow_store is not None: stat_object.size = vshadow_store.volume_size # Date and time stat information. if vshadow_store is not None: timestamp = vshadow_store.get_creation_time_as_integer() date_time_values = dfdatetime_filetime.Filetime( timestamp=timestamp) stat_time, stat_time_nano = date_time_values.CopyToStatTimeTuple() if stat_time is not None: stat_object.crtime = stat_time stat_object.crtime_nano = stat_time_nano # Ownership and permissions stat information. # File entry type stat information. # The root file entry is virtual and should have type directory. if self._is_virtual: stat_object.type = stat_object.TYPE_DIRECTORY else: stat_object.type = stat_object.TYPE_FILE return stat_object
def _GetStat(self): """Retrieves the stat object. Returns: The stat object (instance of vfs.VFSStat). Raises: BackEndError: when the gzip file is missing. """ gzip_file = self.GetFileObject() if not gzip_file: raise errors.BackEndError( u'Unable to open gzip file: {0:s}.'.format( self.path_spec.comparable)) try: stat_object = vfs_stat.VFSStat() # File data stat information. stat_object.size = gzip_file.uncompressed_data_size # Date and time stat information. stat_object.mtime = gzip_file.modification_time # Ownership and permissions stat information. # File entry type stat information. stat_object.type = stat_object.TYPE_FILE # Other stat information. # gzip_file.comment # gzip_file.operating_system # gzip_file.original_filename finally: gzip_file.close() return stat_object
def _GetStat(self): """Retrieves the stat object. Returns: VFSStat: stat object. Raises: BackEndError: if the TSK File .info or .info.meta attribute is missing. """ tsk_file = self.GetTSKFile() if not tsk_file or not tsk_file.info or not tsk_file.info.meta: raise errors.BackEndError(u'Missing TSK File .info or .info.meta.') stat_object = vfs_stat.VFSStat() # File data stat information. stat_object.size = getattr(tsk_file.info.meta, u'size', None) # Date and time stat information. stat_time, stat_time_nano = self._TSKFileTimeCopyToStatTimeTuple( tsk_file, u'atime') if stat_time is not None: stat_object.atime = stat_time stat_object.atime_nano = stat_time_nano stat_time, stat_time_nano = self._TSKFileTimeCopyToStatTimeTuple( tsk_file, u'bkup') if stat_time is not None: stat_object.bkup = stat_time stat_object.bkup_nano = stat_time_nano stat_time, stat_time_nano = self._TSKFileTimeCopyToStatTimeTuple( tsk_file, u'ctime') if stat_time is not None: stat_object.ctime = stat_time stat_object.ctime_nano = stat_time_nano stat_time, stat_time_nano = self._TSKFileTimeCopyToStatTimeTuple( tsk_file, u'crtime') if stat_time is not None: stat_object.crtime = stat_time stat_object.crtime_nano = stat_time_nano stat_time, stat_time_nano = self._TSKFileTimeCopyToStatTimeTuple( tsk_file, u'dtime') if stat_time is not None: stat_object.dtime = stat_time stat_object.dtime_nano = stat_time_nano stat_time, stat_time_nano = self._TSKFileTimeCopyToStatTimeTuple( tsk_file, u'mtime') if stat_time is not None: stat_object.mtime = stat_time stat_object.mtime_nano = stat_time_nano # Ownership and permissions stat information. mode = getattr(tsk_file.info.meta, u'mode', None) if mode is not None: # We need to cast mode to an int since it is of type # pytsk3.TSK_FS_META_MODE_ENUM. stat_object.mode = int(mode) stat_object.uid = getattr(tsk_file.info.meta, u'uid', None) stat_object.gid = getattr(tsk_file.info.meta, u'gid', None) # File entry type stat information. # The type is an instance of pytsk3.TSK_FS_META_TYPE_ENUM. tsk_fs_meta_type = getattr(tsk_file.info.meta, u'type', pytsk3.TSK_FS_META_TYPE_UNDEF) if tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_REG: stat_object.type = stat_object.TYPE_FILE elif tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_DIR: stat_object.type = stat_object.TYPE_DIRECTORY elif tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_LNK: stat_object.type = stat_object.TYPE_LINK elif (tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_CHR or tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_BLK): stat_object.type = stat_object.TYPE_DEVICE elif tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_FIFO: stat_object.type = stat_object.TYPE_PIPE elif tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_SOCK: stat_object.type = stat_object.TYPE_SOCKET # TODO: implement support for: # pytsk3.TSK_FS_META_TYPE_UNDEF # pytsk3.TSK_FS_META_TYPE_SHAD # pytsk3.TSK_FS_META_TYPE_WHT # pytsk3.TSK_FS_META_TYPE_VIRT # Other stat information. stat_object.ino = getattr(tsk_file.info.meta, u'addr', None) # stat_object.dev = stat_info.st_dev # stat_object.nlink = getattr(tsk_file.info.meta, u'nlink', None) # stat_object.fs_type = u'Unknown' flags = getattr(tsk_file.info.meta, u'flags', 0) # The flags are an instance of pytsk3.TSK_FS_META_FLAG_ENUM. if int(flags) & pytsk3.TSK_FS_META_FLAG_ALLOC: stat_object.is_allocated = True else: stat_object.is_allocated = False return stat_object
def _GetStat(self): """Retrieves the stat object. Returns: VFSStat: stat object. Raises: BackEndError: if the pyfsntfs file entry is missing. """ fsntfs_file_entry = self.GetNTFSFileEntry() if not fsntfs_file_entry: raise errors.BackEndError(u'Missing pyfsntfs file entry.') stat_object = vfs_stat.VFSStat() # File data stat information. if fsntfs_file_entry.has_default_data_stream(): stat_object.size = fsntfs_file_entry.get_size() # Date and time stat information. timestamp = fsntfs_file_entry.get_access_time_as_integer() date_time_values = dfdatetime_filetime.Filetime(timestamp=timestamp) stat_time, stat_time_nano = date_time_values.CopyToStatTimeTuple() if stat_time is not None: stat_object.atime = stat_time stat_object.atime_nano = stat_time_nano timestamp = fsntfs_file_entry.get_creation_time_as_integer() date_time_values = dfdatetime_filetime.Filetime(timestamp=timestamp) stat_time, stat_time_nano = date_time_values.CopyToStatTimeTuple() if stat_time is not None: stat_object.crtime = stat_time stat_object.crtime_nano = stat_time_nano timestamp = fsntfs_file_entry.get_modification_time_as_integer() date_time_values = dfdatetime_filetime.Filetime(timestamp=timestamp) stat_time, stat_time_nano = date_time_values.CopyToStatTimeTuple() if stat_time is not None: stat_object.mtime = stat_time stat_object.mtime_nano = stat_time_nano timestamp = fsntfs_file_entry.get_entry_modification_time_as_integer() date_time_values = dfdatetime_filetime.Filetime(timestamp=timestamp) stat_time, stat_time_nano = date_time_values.CopyToStatTimeTuple() if stat_time is not None: stat_object.ctime = stat_time stat_object.ctime_nano = stat_time_nano # Ownership and permissions stat information. # TODO: stat_object.mode # TODO: stat_object.uid # TODO: stat_object.gid # File entry type stat information. if self._IsLink(fsntfs_file_entry.file_attribute_flags): stat_object.type = stat_object.TYPE_LINK elif fsntfs_file_entry.has_directory_entries_index(): stat_object.type = stat_object.TYPE_DIRECTORY else: stat_object.type = stat_object.TYPE_FILE # Other stat information. stat_object.ino = (fsntfs_file_entry.file_reference & _FILE_REFERENCE_MFT_ENTRY_BITMASK) stat_object.fs_type = u'NTFS' stat_object.is_allocated = fsntfs_file_entry.is_allocated() return stat_object
def _GetStat(self): """Retrieves the stat object (instance of vfs.VFSStat). Raises: BackEndError: If an OSError comes up it is caught and an BackEndError error is raised instead. Returns: Stat object (instance of VFSStat) or None if no location is set. """ location = getattr(self.path_spec, u'location', None) if location is None: return stat_object = vfs_stat.VFSStat() is_windows_device = False stat_info = None # Windows does not support running os.stat on device files so we use # libsmdev to do an initial check. if platform.system() == u'Windows': try: is_windows_device = pysmdev.check_device(location) except IOError: pass if is_windows_device: stat_object.type = stat_object.TYPE_DEVICE else: # We are only catching OSError. However on the Windows platform # a WindowsError can be raised as well. We are not catching that since # that error does not exist on non-Windows platforms. try: stat_info = os.stat(location) except OSError as exception: raise errors.BackEndError( u'Unable to retrieve stat object with error: {0:s}'.format( exception)) # File data stat information. stat_object.size = stat_info.st_size # Date and time stat information. stat_object.atime = stat_info.st_atime stat_object.ctime = stat_info.st_ctime stat_object.mtime = stat_info.st_mtime # Ownership and permissions stat information. stat_object.mode = stat.S_IMODE(stat_info.st_mode) stat_object.uid = stat_info.st_uid stat_object.gid = stat_info.st_gid # If location contains a trailing segment separator and points to # a symbolic link to a directory stat info will not indicate # the file entry as a symbolic link. The following check ensures # that the LINK type is correctly detected. is_link = os.path.islink(location) # File entry type stat information. # The stat info member st_mode can have multiple types e.g. # LINK and DIRECTORY in case of a symbolic link to a directory # dfVFS currently only supports one type so we need to check # for LINK first. if stat.S_ISLNK(stat_info.st_mode) or is_link: stat_object.type = stat_object.TYPE_LINK elif stat.S_ISREG(stat_info.st_mode): stat_object.type = stat_object.TYPE_FILE elif stat.S_ISDIR(stat_info.st_mode): stat_object.type = stat_object.TYPE_DIRECTORY elif (stat.S_ISCHR(stat_info.st_mode) or stat.S_ISBLK(stat_info.st_mode)): stat_object.type = stat_object.TYPE_DEVICE elif stat.S_ISFIFO(stat_info.st_mode): stat_object.type = stat_object.TYPE_PIPE elif stat.S_ISSOCK(stat_info.st_mode): stat_object.type = stat_object.TYPE_SOCKET # Other stat information. stat_object.ino = stat_info.st_ino # stat_info.st_dev # stat_info.st_nlink return stat_object