def _catalogFileCallback(self, data, usn, filter_): for k,v in carveBtreeNode(data,HFSPlusCatalogKey, HFSPlusCatalogData): if v.recordType != kHFSPlusFileRecord: continue if filter_ and not filter_(k,v): continue name = getString(k) #if not self.filterFileName(name): # continue h = hashlib.sha1(HFSPlusCatalogKey.build(k)).digest() if self.files.has_key(h): continue if not self.fileIds.has_key(v.data.fileID): print "Found deleted file record", v.data.fileID, name.encode("utf-8"), "created", hfs_date(v.data.createDate) self.files[h] = (name,v, usn)
def _catalogFileCallback(self, data, usn, filter_): for k, v in carveBtreeNode(data, HFSPlusCatalogKey, HFSPlusCatalogData): if v.recordType != kHFSPlusFileRecord: continue if filter_ and not filter_(k, v): continue name = getString(k) #if not self.filterFileName(name): # continue h = hashlib.sha1(HFSPlusCatalogKey.build(k)).digest() if self.files.has_key(h): continue if not self.fileIds.has_key(v.data.fileID): print "Found deleted file record", v.data.fileID, name.encode( "utf-8"), "created", hfs_date(v.data.createDate) self.files[h] = (name, v, usn)
def _attributesFileCallback(self, data, usn, filter_): for k,v in carveBtreeNode(data,HFSPlusAttrKey, HFSPlusAttrData): if getString(k) != "com.apple.system.cprotect": continue if self.fileIds.has_key(k.fileID): continue filekeys = self.keys.setdefault(k.fileID, []) try: cprotect = cprotect_xattr.parse(v.data) except: continue if cprotect.key_size == 0: continue filekey = self.volume.keybag.unwrapKeyForClass(cprotect.persistent_class, cprotect.persistent_key, False) if filekey and not filekey in filekeys: #print "Found key for file ID ", k.fileID filekeys.append(filekey)