def _Parse(self):
"""Extracts attributes and extents from the volume."""
tsk_vs_part = self._file_entry.GetTSKVsPart()
tsk_addr = getattr(tsk_vs_part, 'addr', None)
if tsk_addr is not None:
address = volume_system.VolumeAttribute('address', tsk_addr)
self._AddAttribute(address)
tsk_desc = getattr(tsk_vs_part, 'desc', None)
if tsk_desc is not None:
# pytsk3 returns an UTF-8 encoded byte string.
try:
tsk_desc = tsk_desc.decode('utf8')
self._AddAttribute(volume_system.VolumeAttribute(
'description', tsk_desc))
except UnicodeError:
pass
start_sector = tsk_partition.TSKVsPartGetStartSector(tsk_vs_part)
number_of_sectors = tsk_partition.TSKVsPartGetNumberOfSectors(tsk_vs_part)
volume_extent = volume_system.VolumeExtent(
start_sector * self._bytes_per_sector,
number_of_sectors * self._bytes_per_sector)
self._extents.append(volume_extent)
def _Parse(self):
"""Extracts sections and volumes from the volume system."""
root_file_entry = self._file_system.GetRootFileEntry()
tsk_volume = self._file_system.GetTSKVolume()
self.bytes_per_sector = tsk_partition.TSKVolumeGetBytesPerSector(
tsk_volume)
for sub_file_entry in root_file_entry.sub_file_entries:
tsk_vs_part = sub_file_entry.GetTSKVsPart()
start_sector = tsk_partition.TSKVsPartGetStartSector(tsk_vs_part)
number_of_sectors = tsk_partition.TSKVsPartGetNumberOfSectors(
tsk_vs_part)
if start_sector is None or number_of_sectors is None:
continue
if tsk_partition.TSKVsPartIsAllocated(tsk_vs_part):
volume = TSKVolume(sub_file_entry, self.bytes_per_sector)
self._AddVolume(volume)
volume_extent = volume_system.VolumeExtent(
start_sector * self.bytes_per_sector,
number_of_sectors * self.bytes_per_sector)
self._sections.append(volume_extent)
def _Parse(self):
"""Extracts attributes and extents from the volume."""
vsgpt_partition = self._file_entry.GetGPTPartition()
volume_attribute = volume_system.VolumeAttribute(
'identifier', vsgpt_partition.identifier)
self._AddAttribute(volume_attribute)
# TODO: implement in pyvsgpt
# TODO: add support for partition extents
volume_extent = volume_system.VolumeExtent(0, vsgpt_partition.size)
self._extents.append(volume_extent)
def _Parse(self):
"""Extracts attributes and extents from the volume."""
vslvm_logical_volume = self._file_entry.GetLVMLogicalVolume()
volume_attribute = volume_system.VolumeAttribute(
'identifier', vslvm_logical_volume.identifier)
self._AddAttribute(volume_attribute)
# TODO: implement in pyvslvm
# TODO: add support for creation time
# TODO: add support for logical volume extents
volume_extent = volume_system.VolumeExtent(0,
vslvm_logical_volume.size)
self._extents.append(volume_extent)
def _Parse(self):
"""Extracts attributes and extents from the volume."""
vshadow_store = self._file_entry.GetVShadowStore()
self._AddAttribute(volume_system.VolumeAttribute(
'identifier', vshadow_store.identifier))
self._AddAttribute(volume_system.VolumeAttribute(
'copy_identifier', vshadow_store.copy_identifier))
self._AddAttribute(volume_system.VolumeAttribute(
'copy_set_identifier', vshadow_store.copy_set_identifier))
self._AddAttribute(volume_system.VolumeAttribute(
'creation_time', vshadow_store.get_creation_time_as_integer()))
volume_extent = volume_system.VolumeExtent(0, vshadow_store.volume_size)
self._extents.append(volume_extent)
def _Parse(self):
"""Extracts attributes and extents from the volume."""
tsk_vs_part = self._file_entry.GetTSKVsPart()
tsk_addr = getattr(tsk_vs_part, u'addr', None)
if tsk_addr is not None:
self._AddAttribute(
volume_system.VolumeAttribute(u'address', tsk_addr))
tsk_desc = getattr(tsk_vs_part, u'desc', None)
if tsk_desc is not None:
self._AddAttribute(
volume_system.VolumeAttribute(u'description', tsk_desc))
start_sector = tsk_partition.TSKVsPartGetStartSector(tsk_vs_part)
number_of_sectors = tsk_partition.TSKVsPartGetNumberOfSectors(
tsk_vs_part)
self._extents.append(
volume_system.VolumeExtent(
start_sector * self._bytes_per_sector,
number_of_sectors * self._bytes_per_sector))
