rawdisk.plugins.filesystems.hfs_plus package

Submodules

rawdisk.plugins.filesystems.hfs_plus.hfs_plus module

class rawdisk.plugins.filesystems.hfs_plus.hfs_plus.HfsPlus

Bases: rawdisk.plugins.categories.IFilesystemPlugin

Filesystem plugin for HFS+ partition.

detect(filename, offset, standalone=False)

Always returns True, since there is only one partition with this type GUID, no need to do further verification.

get_volume_object()

Returns HfsPlusVolume object.

gpt_identifiers

Should return a list (usually one) of GPT identifiers that are used to detect this volume

rawdisk.plugins.filesystems.hfs_plus.hfs_plus_volume module

class rawdisk.plugins.filesystems.hfs_plus.hfs_plus_volume.HfsPlusVolume

Bases: rawdisk.filesystems.volume.Volume

Structure for HFS+ volume.

fd

fd – file descriptor used to read volume information

vol_header

VolumeHeader – Initialized VolumeHeader object

See also

https://developer.apple.com/legacy/library/technotes/tn/tn1150.html

load(filename, offset)

Loads HFS+ volume information

class rawdisk.plugins.filesystems.hfs_plus.hfs_plus_volume.VolumeHeader(data)

Bases: rawdisk.util.rawstruct.RawStruct

Represents HFS+ volume header

signature

2 byte string – The volume signature, which must be kHFSPlusSigWord (‘H+’) for an HFS Plus volume.

version

ushort – The version of the volume format, which is currently 4 (kHFSPlusVersion) for HFS Plus volumes.

attributes

uint – HFS+ volume attributes

Module contents