Exemplo n.º 1
0
  def _Parse(self):
    """Extracts attributes and extents from the volume."""
    tsk_vs_part = self._file_entry.GetTSKVsPart()

    tsk_addr = getattr(tsk_vs_part, 'addr', None)
    if tsk_addr is not None:
      address = volume_system.VolumeAttribute('address', tsk_addr)
      self._AddAttribute(address)

    tsk_desc = getattr(tsk_vs_part, 'desc', None)
    if tsk_desc is not None:
      # pytsk3 returns an UTF-8 encoded byte string.
      try:
        tsk_desc = tsk_desc.decode('utf8')
        self._AddAttribute(volume_system.VolumeAttribute(
            'description', tsk_desc))
      except UnicodeError:
        pass

    start_sector = tsk_partition.TSKVsPartGetStartSector(tsk_vs_part)
    number_of_sectors = tsk_partition.TSKVsPartGetNumberOfSectors(tsk_vs_part)
    volume_extent = volume_system.VolumeExtent(
        start_sector * self._bytes_per_sector,
        number_of_sectors * self._bytes_per_sector)
    self._extents.append(volume_extent)
Exemplo n.º 2
0
    def _Parse(self):
        """Extracts attributes and extents from the volume."""
        fsapfs_volume = self._file_entry.GetAPFSVolume()

        volume_attribute = volume_system.VolumeAttribute(
            'identifier', fsapfs_volume.identifier)
        self._AddAttribute(volume_attribute)

        volume_attribute = volume_system.VolumeAttribute(
            'name', fsapfs_volume.name)
        self._AddAttribute(volume_attribute)
Exemplo n.º 3
0
  def _Parse(self):
    """Extracts attributes and extents from the volume."""
    vshadow_store = self._file_entry.GetVShadowStore()

    self._AddAttribute(volume_system.VolumeAttribute(
        'identifier', vshadow_store.identifier))
    self._AddAttribute(volume_system.VolumeAttribute(
        'copy_identifier', vshadow_store.copy_identifier))
    self._AddAttribute(volume_system.VolumeAttribute(
        'copy_set_identifier', vshadow_store.copy_set_identifier))
    self._AddAttribute(volume_system.VolumeAttribute(
        'creation_time', vshadow_store.get_creation_time_as_integer()))

    volume_extent = volume_system.VolumeExtent(0, vshadow_store.volume_size)
    self._extents.append(volume_extent)
Exemplo n.º 4
0
    def _Parse(self):
        """Extracts attributes and extents from the volume."""
        vsgpt_partition = self._file_entry.GetGPTPartition()

        volume_attribute = volume_system.VolumeAttribute(
            'identifier', vsgpt_partition.identifier)
        self._AddAttribute(volume_attribute)

        # TODO: implement in pyvsgpt
        # TODO: add support for partition extents
        volume_extent = volume_system.VolumeExtent(0, vsgpt_partition.size)
        self._extents.append(volume_extent)
Exemplo n.º 5
0
    def _Parse(self):
        """Extracts attributes and extents from the volume."""
        tsk_vs_part = self._file_entry.GetTSKVsPart()

        tsk_addr = getattr(tsk_vs_part, u'addr', None)
        if tsk_addr is not None:
            self._AddAttribute(
                volume_system.VolumeAttribute(u'address', tsk_addr))

        tsk_desc = getattr(tsk_vs_part, u'desc', None)
        if tsk_desc is not None:
            self._AddAttribute(
                volume_system.VolumeAttribute(u'description', tsk_desc))

        start_sector = tsk_partition.TSKVsPartGetStartSector(tsk_vs_part)
        number_of_sectors = tsk_partition.TSKVsPartGetNumberOfSectors(
            tsk_vs_part)
        self._extents.append(
            volume_system.VolumeExtent(
                start_sector * self._bytes_per_sector,
                number_of_sectors * self._bytes_per_sector))
Exemplo n.º 6
0
    def _Parse(self):
        """Extracts attributes and extents from the volume."""
        vslvm_logical_volume = self._file_entry.GetLVMLogicalVolume()

        volume_attribute = volume_system.VolumeAttribute(
            'identifier', vslvm_logical_volume.identifier)
        self._AddAttribute(volume_attribute)

        # TODO: implement in pyvslvm
        # TODO: add support for creation time
        # TODO: add support for logical volume extents
        volume_extent = volume_system.VolumeExtent(0,
                                                   vslvm_logical_volume.size)
        self._extents.append(volume_extent)