Ejemplo n.º 1
0
 def _catalogFileCallback(self, data, usn, filter_):
     for k,v in carveBtreeNode(data,HFSPlusCatalogKey, HFSPlusCatalogData):
         if v.recordType != kHFSPlusFileRecord:
             continue
         if filter_ and not filter_(k,v):
             continue
         name = getString(k)
         #if not self.filterFileName(name):
         #    continue
         h = hashlib.sha1(HFSPlusCatalogKey.build(k)).digest()
         if self.files.has_key(h):
             continue
         if not self.fileIds.has_key(v.data.fileID):
             print "Found deleted file record", v.data.fileID, name.encode("utf-8"), "created", hfs_date(v.data.createDate)
             self.files[h] = (name,v, usn)               
Ejemplo n.º 2
0
 def _catalogFileCallback(self, data, usn, filter_):
     for k, v in carveBtreeNode(data, HFSPlusCatalogKey,
                                HFSPlusCatalogData):
         if v.recordType != kHFSPlusFileRecord:
             continue
         if filter_ and not filter_(k, v):
             continue
         name = getString(k)
         #if not self.filterFileName(name):
         #    continue
         h = hashlib.sha1(HFSPlusCatalogKey.build(k)).digest()
         if self.files.has_key(h):
             continue
         if not self.fileIds.has_key(v.data.fileID):
             print "Found deleted file record", v.data.fileID, name.encode(
                 "utf-8"), "created", hfs_date(v.data.createDate)
             self.files[h] = (name, v, usn)
Ejemplo n.º 3
0
 def _attributesFileCallback(self, data, usn, filter_):
     for k,v in carveBtreeNode(data,HFSPlusAttrKey, HFSPlusAttrData):
         if getString(k) != "com.apple.system.cprotect":
             continue
         if self.fileIds.has_key(k.fileID):
             continue
         filekeys = self.keys.setdefault(k.fileID, [])
         try:
             cprotect = cprotect_xattr.parse(v.data)
         except:
             continue
         if cprotect.key_size == 0:
             continue
         filekey = self.volume.keybag.unwrapKeyForClass(cprotect.persistent_class, cprotect.persistent_key, False)
         if filekey and not filekey in filekeys:
             #print "Found key for file ID ", k.fileID
             filekeys.append(filekey)
 def _attributesFileCallback(self, data, usn, filter_):
     for k,v in carveBtreeNode(data,HFSPlusAttrKey, HFSPlusAttrData):
         if getString(k) != "com.apple.system.cprotect":
             continue
         if self.fileIds.has_key(k.fileID):
             continue
         filekeys = self.keys.setdefault(k.fileID, [])
         try:
             cprotect = cprotect_xattr.parse(v.data)
         except:
             continue
         if cprotect.key_size == 0:
             continue
         filekey = self.volume.keybag.unwrapKeyForClass(cprotect.persistent_class, cprotect.persistent_key, False)
         if filekey and not filekey in filekeys:
             #print "Found key for file ID ", k.fileID
             filekeys.append(filekey)