def _Open(self, path_spec, mode='rb'): """Opens the file system object defined by path specification. Args: path_spec (PathSpec): path specification. mode (Optional[str]): file access mode. Raises: AccessError: if the access to open the file was denied. IOError: if the file system object could not be opened. PathSpecError: if the path specification is incorrect. ValueError: if the path specification is invalid. """ if not path_spec.HasParent(): raise errors.PathSpecError( 'Unsupported path specification without parent.') file_object = resolver.Resolver.OpenFileObject( path_spec.parent, resolver_context=self._resolver_context) try: tsk_image_object = tsk_image.TSKFileSystemImage(file_object) tsk_file_system = pytsk3.FS_Info(tsk_image_object) except: file_object.close() raise self._file_object = file_object self._tsk_file_system = tsk_file_system
def get_tsk_file_system(self, source_path_spec, configuration): file_object = path_spec_resolver.Resolver.OpenFileObject( source_path_spec.parent, resolver_context=configuration.resolver_context) tsk_image_object = tsk_image.TSKFileSystemImage(file_object) tsk_file_system = pytsk3.FS_Info(tsk_image_object) return tsk_file_system
def _Open(self, path_spec=None, mode='rb'): """Opens the file system object defined by path specification. Args: path_spec: optional path specification (instance of path.PathSpec). The default is None. mode: optional file access mode. The default is 'rb' read-only binary. Raises: AccessError: if the access to open the file was denied. IOError: if the file system object could not be opened. PathSpecError: if the path specification is incorrect. ValueError: if the path specification is invalid. """ if not path_spec.HasParent(): raise errors.PathSpecError( u'Unsupported path specification without parent.') file_object = resolver.Resolver.OpenFileObject( path_spec.parent, resolver_context=self._resolver_context) tsk_image_object = tsk_image.TSKFileSystemImage(file_object) tsk_file_system = pytsk3.FS_Info(tsk_image_object) self._file_object = file_object self._tsk_file_system = tsk_file_system
def _Open(self, mode='rb'): """Opens the file system object defined by path specification. Args: mode (Optional[str]): file access mode. The default is 'rb' which represents read-only binary. Raises: AccessError: if the access to open the file was denied. IOError: if the file system object could not be opened. PathSpecError: if the path specification is incorrect. ValueError: if the path specification is invalid. """ if not self._path_spec.HasParent(): raise errors.PathSpecError( 'Unsupported path specification without parent.') file_object = resolver.Resolver.OpenFileObject( self._path_spec.parent, resolver_context=self._resolver_context) tsk_image_object = tsk_image.TSKFileSystemImage(file_object) tsk_volume = pytsk3.Volume_Info(tsk_image_object) self._file_object = file_object self._tsk_volume = tsk_volume
def ScanDisk(self, base_path_specs): disk_info = [] self.base_path_specs = base_path_specs for i, base_path_spec in enumerate(self.base_path_specs): file_system = resolver.Resolver.OpenFileSystem(base_path_spec) par_name = self.prefix + str(i) if file_system.type_indicator == 'TSK': tsk_image_object = tsk_image.TSKFileSystemImage( file_system._file_object) length = tsk_image_object.get_size() par_type = 'TSK' if base_path_spec.parent.type_indicator != 'VSHADOW' else 'VSS' par_info = [par_name, length, par_type, base_path_spec] disk_info.append(par_info) else: raise NotImplementedError return disk_info
def AnalyzeFileObject(self, file_object): """Retrieves the format specification. Args: file_object (FileIO): file-like object. Returns: str: type indicator if the file-like object contains a supported format or None otherwise. """ tsk_image_object = tsk_image.TSKFileSystemImage(file_object) try: pytsk3.Volume_Info(tsk_image_object) except IOError: return return self.type_indicator
def SplitDisk(self, output_writer): if self.disk_info is None: return procs = [] for par_name, length, par_type, base_path_spec in self.disk_info: file_system = resolver.Resolver.OpenFileSystem(base_path_spec) if par_type in ['VSS', 'TSK']: tsk_image_object = tsk_image.TSKFileSystemImage( file_system._file_object) file_name = par_name imageWrite_process = Process(target=self._tskWriteImage, args=(tsk_image_object, length, output_writer, file_name)) imageWrite_process.start() procs.append(imageWrite_process) else: # apfs raise NotImplementedError for proc in procs: proc.join()