def _Open(self, path_spec, mode='rb'):
"""Opens the file system object defined by path specification.
Args:
path_spec (PathSpec): path specification.
mode (Optional[str]): file access mode.
Raises:
AccessError: if the access to open the file was denied.
IOError: if the file system object could not be opened.
PathSpecError: if the path specification is incorrect.
ValueError: if the path specification is invalid.
"""
if not path_spec.HasParent():
raise errors.PathSpecError(
'Unsupported path specification without parent.')
file_object = resolver.Resolver.OpenFileObject(
path_spec.parent, resolver_context=self._resolver_context)
try:
tsk_image_object = tsk_image.TSKFileSystemImage(file_object)
tsk_file_system = pytsk3.FS_Info(tsk_image_object)
except:
file_object.close()
raise
self._file_object = file_object
self._tsk_file_system = tsk_file_system
def get_tsk_file_system(self, source_path_spec, configuration):
file_object = path_spec_resolver.Resolver.OpenFileObject(
source_path_spec.parent,
resolver_context=configuration.resolver_context)
tsk_image_object = tsk_image.TSKFileSystemImage(file_object)
tsk_file_system = pytsk3.FS_Info(tsk_image_object)
return tsk_file_system
def _Open(self, path_spec=None, mode='rb'):
"""Opens the file system object defined by path specification.
Args:
path_spec: optional path specification (instance of path.PathSpec).
The default is None.
mode: optional file access mode. The default is 'rb' read-only binary.
Raises:
AccessError: if the access to open the file was denied.
IOError: if the file system object could not be opened.
PathSpecError: if the path specification is incorrect.
ValueError: if the path specification is invalid.
"""
if not path_spec.HasParent():
raise errors.PathSpecError(
u'Unsupported path specification without parent.')
file_object = resolver.Resolver.OpenFileObject(
path_spec.parent, resolver_context=self._resolver_context)
tsk_image_object = tsk_image.TSKFileSystemImage(file_object)
tsk_file_system = pytsk3.FS_Info(tsk_image_object)
self._file_object = file_object
self._tsk_file_system = tsk_file_system
def _Open(self, mode='rb'):
"""Opens the file system object defined by path specification.
Args:
mode (Optional[str]): file access mode. The default is 'rb' which
represents read-only binary.
Raises:
AccessError: if the access to open the file was denied.
IOError: if the file system object could not be opened.
PathSpecError: if the path specification is incorrect.
ValueError: if the path specification is invalid.
"""
if not self._path_spec.HasParent():
raise errors.PathSpecError(
'Unsupported path specification without parent.')
file_object = resolver.Resolver.OpenFileObject(
self._path_spec.parent, resolver_context=self._resolver_context)
tsk_image_object = tsk_image.TSKFileSystemImage(file_object)
tsk_volume = pytsk3.Volume_Info(tsk_image_object)
self._file_object = file_object
self._tsk_volume = tsk_volume
def ScanDisk(self, base_path_specs):
disk_info = []
self.base_path_specs = base_path_specs
for i, base_path_spec in enumerate(self.base_path_specs):
file_system = resolver.Resolver.OpenFileSystem(base_path_spec)
par_name = self.prefix + str(i)
if file_system.type_indicator == 'TSK':
tsk_image_object = tsk_image.TSKFileSystemImage(
file_system._file_object)
length = tsk_image_object.get_size()
par_type = 'TSK' if base_path_spec.parent.type_indicator != 'VSHADOW' else 'VSS'
par_info = [par_name, length, par_type, base_path_spec]
disk_info.append(par_info)
else:
raise NotImplementedError
return disk_info
def AnalyzeFileObject(self, file_object):
"""Retrieves the format specification.
Args:
file_object (FileIO): file-like object.
Returns:
str: type indicator if the file-like object contains a supported format
or None otherwise.
"""
tsk_image_object = tsk_image.TSKFileSystemImage(file_object)
try:
pytsk3.Volume_Info(tsk_image_object)
except IOError:
return
return self.type_indicator
def SplitDisk(self, output_writer):
if self.disk_info is None:
return
procs = []
for par_name, length, par_type, base_path_spec in self.disk_info:
file_system = resolver.Resolver.OpenFileSystem(base_path_spec)
if par_type in ['VSS', 'TSK']:
tsk_image_object = tsk_image.TSKFileSystemImage(
file_system._file_object)
file_name = par_name
imageWrite_process = Process(target=self._tskWriteImage,
args=(tsk_image_object, length,
output_writer, file_name))
imageWrite_process.start()
procs.append(imageWrite_process)
else: # apfs
raise NotImplementedError
for proc in procs:
proc.join()
