rawdisk.filesystems package

Submodules

rawdisk.filesystems.detector module

This module is mostly used by plugins to register filesystem detection routines that are internaly used by rawdisk.reader.Reader to match filesystems

class rawdisk.filesystems.detector.FilesystemDetector(fs_plugins=None)[source]

Bases: object

A class that allows to match filesystem id or guid against available plugins.

all_plugins
clear_plugins()[source]
detect_gpt(filename, offset, fs_guid)[source]

Used by rawdisk.session.Session to match gpt partitions agains filesystem plugins.

Parameters:
  • filename – device or file that it will read in order to detect the
  • filesystem –
  • fs_id – filesystem guid to match
  • {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}) ((ex.) –
  • offset – offset for the filesystem that is being matched
Returns:

Volume object supplied by matched plugin. If there is no match, None is returned
detect_mbr(filename, offset, fs_id)[source]

Used by rawdisk.session.Session to match mbr partitions against filesystem plugins.

Parameters:
  • filename – device or file that it will read in order to detect
  • filesystem fs_id (the) – filesystem id to match (ex. 0x07)
  • offset – offset for the filesystem that is being matched
Returns:

Volume object supplied by matched plugin. If there is no match, None is returned
detect_standalone(filename, offset)[source]
get_gpt_plugins(fs_guid=None)[source]
get_mbr_plugins(fs_id=None)[source]
register_gpt_plugin(fs_guid, plugin)[source]

Used in plugin’s registration routine, to associate it’s detection method with given filesystem guid

Parameters:
  • fs_guid – filesystem guid that is read from GPT partition entry
  • plugin – plugin that supports this filesystem
register_mbr_plugin(fs_id, plugin)[source]

Used in plugin’s registration routine, to associate it’s detection method with given filesystem id

Parameters:
  • fs_id – filesystem id that is read from MBR partition entry
  • plugin – plugin that supports this filesystem

rawdisk.filesystems.volume module

class rawdisk.filesystems.volume.Volume[source]

Bases: object

This is base class for all Volume objects supplied by filesystem plugins.

dump_volume()[source]

Print volume information to std output, similar to ntfsprogs_1.22 package

load(filename, offset)[source]

Load volume information.

Parameters:
  • filename – Filename or device that it will read volume.
  • from. (information) –
  • offset – Volume offset.

Module contents