def _Parse(self): """Extracts attributes and extents from the volume.""" tsk_vs_part = self._file_entry.GetTSKVsPart() tsk_addr = getattr(tsk_vs_part, 'addr', None) if tsk_addr is not None: address = volume_system.VolumeAttribute('address', tsk_addr) self._AddAttribute(address) tsk_desc = getattr(tsk_vs_part, 'desc', None) if tsk_desc is not None: # pytsk3 returns an UTF-8 encoded byte string. try: tsk_desc = tsk_desc.decode('utf8') self._AddAttribute(volume_system.VolumeAttribute( 'description', tsk_desc)) except UnicodeError: pass start_sector = tsk_partition.TSKVsPartGetStartSector(tsk_vs_part) number_of_sectors = tsk_partition.TSKVsPartGetNumberOfSectors(tsk_vs_part) volume_extent = volume_system.VolumeExtent( start_sector * self._bytes_per_sector, number_of_sectors * self._bytes_per_sector) self._extents.append(volume_extent)
def _Parse(self): """Extracts attributes and extents from the volume.""" fsapfs_volume = self._file_entry.GetAPFSVolume() volume_attribute = volume_system.VolumeAttribute( 'identifier', fsapfs_volume.identifier) self._AddAttribute(volume_attribute) volume_attribute = volume_system.VolumeAttribute( 'name', fsapfs_volume.name) self._AddAttribute(volume_attribute)
def _Parse(self): """Extracts attributes and extents from the volume.""" vshadow_store = self._file_entry.GetVShadowStore() self._AddAttribute(volume_system.VolumeAttribute( 'identifier', vshadow_store.identifier)) self._AddAttribute(volume_system.VolumeAttribute( 'copy_identifier', vshadow_store.copy_identifier)) self._AddAttribute(volume_system.VolumeAttribute( 'copy_set_identifier', vshadow_store.copy_set_identifier)) self._AddAttribute(volume_system.VolumeAttribute( 'creation_time', vshadow_store.get_creation_time_as_integer())) volume_extent = volume_system.VolumeExtent(0, vshadow_store.volume_size) self._extents.append(volume_extent)
def _Parse(self): """Extracts attributes and extents from the volume.""" vsgpt_partition = self._file_entry.GetGPTPartition() volume_attribute = volume_system.VolumeAttribute( 'identifier', vsgpt_partition.identifier) self._AddAttribute(volume_attribute) # TODO: implement in pyvsgpt # TODO: add support for partition extents volume_extent = volume_system.VolumeExtent(0, vsgpt_partition.size) self._extents.append(volume_extent)
def _Parse(self): """Extracts attributes and extents from the volume.""" tsk_vs_part = self._file_entry.GetTSKVsPart() tsk_addr = getattr(tsk_vs_part, u'addr', None) if tsk_addr is not None: self._AddAttribute( volume_system.VolumeAttribute(u'address', tsk_addr)) tsk_desc = getattr(tsk_vs_part, u'desc', None) if tsk_desc is not None: self._AddAttribute( volume_system.VolumeAttribute(u'description', tsk_desc)) start_sector = tsk_partition.TSKVsPartGetStartSector(tsk_vs_part) number_of_sectors = tsk_partition.TSKVsPartGetNumberOfSectors( tsk_vs_part) self._extents.append( volume_system.VolumeExtent( start_sector * self._bytes_per_sector, number_of_sectors * self._bytes_per_sector))
def _Parse(self): """Extracts attributes and extents from the volume.""" vslvm_logical_volume = self._file_entry.GetLVMLogicalVolume() volume_attribute = volume_system.VolumeAttribute( 'identifier', vslvm_logical_volume.identifier) self._AddAttribute(volume_attribute) # TODO: implement in pyvslvm # TODO: add support for creation time # TODO: add support for logical volume extents volume_extent = volume_system.VolumeExtent(0, vslvm_logical_volume.size) self._extents.append(volume_extent)