rawdisk.filesystems package

Submodules

rawdisk.filesystems.detector module

This module is mostly used by plugins to register filesystem detection routines that are internaly used by rawdisk.reader.Reader to match filesystems

class rawdisk.filesystems.detector.FilesystemDetector

Bases: object

add_gpt_plugin(fs_guid, plugin)

Used in plugin’s registration routine, to associate it’s detection method with given filesystem guid

Args:

fs_guid: filesystem guid that is read from GPT partition entry plugin: plugin that supports this filesystem

add_mbr_plugin(fs_id, plugin)

Used in plugin’s registration routine, to associate it’s detection method with given filesystem id

Args:

fs_id: filesystem id that is read from MBR partition entry plugin: plugin that supports this filesystem

detect_gpt(filename, offset, fs_guid)

Used by rawdisk.reader.Reader to match gpt partitions agains filesystem plugins.

Args:

filename: device or file that it will read in order to detect the filesystem fs_id: filesystem guid to match (ex. {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}) offset: offset for the filesystem that is being matched

Returns:

Volume object supplied by matched plugin. If there is no match, None is returned

detect_mbr(filename, offset, fs_id)

Used by rawdisk.reader.Reader to match mbr partitions agains filesystem plugins.

Args:

filename: device or file that it will read in order to detect the filesystem fs_id: filesystem id to match (ex. 0x07) offset: offset for the filesystem that is being matched

Returns:

Volume object supplied by matched plugin. If there is no match, None is returned

rawdisk.filesystems.volume module

class rawdisk.filesystems.volume.Volume

Bases: object

This is base class for all Volume objects supplied by filesystem plugins.

dump_volume()

Print volume information to std output, similar to ntfsprogs_1.22 package

load(filename, offset)

Load volume information.

Args:

filename: Filename or device that it will read volume. information from. offset: Volume offset.

Module contents