rawdisk.plugins.filesystems.hfs_plus package

Submodules

rawdisk.plugins.filesystems.hfs_plus.hfs_plus module

class rawdisk.plugins.filesystems.hfs_plus.hfs_plus.HfsPlusPlugin[source]

Bases: rawdisk.plugins.categories.IFilesystemPlugin

Filesystem plugin for HFS+ partition.

detect(filename, offset)[source]

Always returns True, since there is only one partition with this type GUID, no need to do further verification.

get_volume_object()[source]

Returns HfsPlusVolume object.

register()[source]

Registers this plugin with FilesystemDetector as gpt plugin, with type guid {48465300-0000-11AA-AA11-00306543ECAC}

rawdisk.plugins.filesystems.hfs_plus.hfs_plus_volume module

class rawdisk.plugins.filesystems.hfs_plus.hfs_plus_volume.HfsPlusVolume[source]

Bases: rawdisk.filesystems.volume.Volume

Structure for HFS+ volume.

Attributes:
fd (fd): file descriptor used to read volume information vol_header (VolumeHeader): Initialized VolumeHeader object
See Also:
https://developer.apple.com/legacy/library/technotes/tn/tn1150.html
load(filename, offset)[source]

Loads HFS+ volume information

class rawdisk.plugins.filesystems.hfs_plus.hfs_plus_volume.VolumeHeader(data)[source]

Bases: rawdisk.util.rawstruct.RawStruct

Represents HFS+ volume header

Attributes:
signature (2 byte string): The volume signature, which must be kHFSPlusSigWord (‘H+’) for an HFS Plus volume. version (ushort): The version of the volume format, which is currently 4 (kHFSPlusVersion) for HFS Plus volumes. attributes (uint): HFS+ volume attributes

Module contents