:py:mod:`dissect.apfs.objects.fs` ================================= .. py:module:: dissect.apfs.objects.fs Module Contents --------------- Classes ~~~~~~~ .. autoapisummary:: dissect.apfs.objects.fs.FS dissect.apfs.objects.fs.Snapshot dissect.apfs.objects.fs.INode dissect.apfs.objects.fs.DirectoryEntry dissect.apfs.objects.fs.XAttr .. py:class:: FS(*args, **kwargs) Bases: :py:obj:`dissect.apfs.objects.base.Object` APFS Filesystem object, also referred to as the "volume". .. py:attribute:: __type__ .. py:attribute:: __struct__ .. py:attribute:: object :type: dissect.apfs.c_apfs.c_apfs.apfs_superblock .. py:attribute:: inode .. py:attribute:: root .. py:method:: __repr__() -> str .. py:property:: index :type: int The volume index within the container. .. py:property:: features :type: dissect.apfs.c_apfs.c_apfs.APFS_FEATURE The features supported by this filesystem. .. py:property:: incompatible_features :type: dissect.apfs.c_apfs.c_apfs.APFS_INCOMPAT The incompatible features supported by this filesystem. .. py:property:: is_case_insensitive :type: bool Whether the filesystem is case insensitive. .. py:property:: is_normalization_insensitive :type: bool Whether the filesystem is normalization insensitive. .. py:property:: is_sealed :type: bool Whether the filesystem is sealed (read-only). .. py:property:: unmount_time :type: datetime.datetime The last unmount time of the filesystem. .. py:property:: omap :type: dissect.apfs.objects.omap.ObjectMap The object map for the filesystem. .. py:property:: root_tree :type: dissect.apfs.objects.btree.BTree The root B-tree for the filesystem. .. py:property:: snap_meta_tree :type: dissect.apfs.objects.btree.BTree The snapshot metadata B-tree for the filesystem. .. py:property:: uuid :type: uuid.UUID The filesystem UUID. .. py:property:: mtime :type: datetime.datetime The last modification time of the filesystem. .. py:property:: flags :type: dissect.apfs.c_apfs.c_apfs.APFS_FS .. py:property:: is_unencrypted :type: bool Whether the filesystem is unencrypted. .. py:property:: is_encrypted :type: bool Whether the filesystem is encrypted. .. py:property:: is_onekey :type: bool Whether the filesystem uses the volume encryption key for all. .. py:property:: formatted_by :type: tuple[str, datetime.datetime, int] Information about the tool that formatted the filesystem. .. py:property:: modified_by :type: list[tuple[str, datetime.datetime, int]] Information about the tools that modified the filesystem. .. py:property:: name :type: str The volume name. .. py:property:: role :type: dissect.apfs.c_apfs.c_apfs.APFS_VOL_ROLE The volume role. .. py:property:: snapshots :type: list[Snapshot] All snapshots in the filesystem. .. py:property:: fext_tree :type: dissect.apfs.objects.btree.BTree The file extent B-tree for the filesystem. .. py:property:: keybag :type: dissect.apfs.objects.keybag.VolumeKeybag | None The volume keybag, if present. .. py:property:: password_hint :type: str | None The password hint for the volume, if present. .. py:method:: unlock(password: str, uuid: uuid.UUID | str | None = None) -> None .. py:method:: cursor() -> dissect.apfs.cursor.Cursor Create a new cursor for the volume's root B-tree. .. py:method:: records(oid: int) -> dict[dissect.apfs.c_apfs.c_apfs.APFS_TYPE, list[Any]] Get all records for a given object ID. :param oid: The object ID to search for. .. py:method:: inodes() -> collections.abc.Iterator[INode] Iterate over all inodes in the filesystem. .. py:method:: get(path: str | int | DirectoryEntry, node: INode | None = None) -> INode Get an inode by its path, object ID, or directory entry. :param path: The path, object ID, or directory entry of the inode to retrieve. :param node: The starting inode for relative paths. Defaults to the root inode. .. py:class:: Snapshot(fs: FS, xid: int, value: bytes) .. py:attribute:: fs .. py:attribute:: xid .. py:attribute:: value .. py:method:: __repr__() -> str .. py:property:: create_time :type: datetime.datetime The creation time of the snapshot. .. py:property:: change_time :type: datetime.datetime The change time of the snapshot. .. py:property:: name :type: str The name of the snapshot. .. py:method:: open() -> FS Open the snapshot as a filesystem. .. py:class:: INode(volume: FS, oid: int, sibling_id: int | None = None) APFS inode. Represents a file or directory in an APFS volume. :param volume: Parent APFS volume. :param oid: The object ID of the inode. :param sibling_id: The sibling ID of the inode, if applicable. .. py:attribute:: volume .. py:attribute:: oid .. py:attribute:: sibling_id :value: None .. py:method:: __repr__() -> str .. py:property:: records :type: dict[dissect.apfs.c_apfs.c_apfs.APFS_TYPE, list[Any]] All records for this inode. .. py:property:: inode :type: dissect.apfs.c_apfs.c_apfs.j_inode_val The parsed inode structure. .. py:property:: xfields :type: dict The extended fields for this inode. .. py:property:: xattr :type: dict[str, XAttr] The extended attributes for this inode. .. py:property:: parent :type: INode The parent inode. .. py:property:: parents :type: collections.abc.Iterator[INode] Iterate over the parent inodes of this inode, up to the root. .. py:property:: private_id :type: int The private ID of this inode. .. py:property:: btime :type: datetime.datetime The birth time of this inode. .. py:property:: mtime :type: datetime.datetime The modification time of this inode. .. py:property:: ctime :type: datetime.datetime The change time of this inode. .. py:property:: atime :type: datetime.datetime The access time of this inode. .. py:property:: internal_flags :type: dissect.apfs.c_apfs.c_apfs.INODE The inode internal flags. .. py:property:: bsd_flags :type: int The inode BSD flags. .. py:method:: is_compressed() -> bool Return whether this inode is compressed. .. py:property:: uid :type: int The owner user ID of this inode. .. py:property:: gid :type: int The owner group ID of this inode. .. py:property:: mode :type: int The file mode of this inode. .. py:property:: type :type: int The file type of this inode. .. py:method:: is_dir() -> bool Return whether this inode is a directory. .. py:method:: is_file() -> bool Return whether this inode is a regular file. .. py:method:: is_symlink() -> bool Return whether this inode is a symbolic link. .. py:method:: is_block_device() -> bool Return whether this inode is a block device. .. py:method:: is_character_device() -> bool Return whether this inode is a character device. .. py:method:: is_device() -> bool Return whether this inode is a device (block or character). .. py:method:: is_fifo() -> bool Return whether this inode is a FIFO. .. py:method:: is_socket() -> bool Return whether this inode is a socket. .. py:method:: is_whiteout() -> bool Return whether this inode is a whiteout. .. py:property:: size :type: int The size of this inode in bytes. .. py:property:: siblings :type: list[INode] All sibling inodes of this inode. .. py:property:: sibling_link :type: tuple[int, str] | None The sibling link (``parent_id``, ``name``) tuple of this inode, if available. .. py:property:: name :type: str | None The name of this inode, if available. .. py:property:: names :type: list[str] All names of this inode, if available. .. py:property:: path :type: str The full path of this inode, if available. .. py:property:: paths :type: list[str] All full paths of this inode, if available. .. py:method:: get(name: str) -> DirectoryEntry Get a directory entry by name. .. py:method:: listdir() -> dict[str, DirectoryEntry] List the directory entries in this inode. .. py:method:: iterdir() -> collections.abc.Iterator[DirectoryEntry] Iterate over the directory entries in this inode. .. py:method:: readlink() -> str The target of this inode if it is a symbolic link. .. py:method:: open() -> dissect.util.stream.BufferedStream | dissect.apfs.stream.DecmpfsStream | dissect.apfs.stream.FileStream Open a stream for reading the inode data. .. py:class:: DirectoryEntry(volume: FS, key: bytes, value: bytes) APFS directory entry. :param volume: Parent APFS volume. :param key: The raw directory entry key. :param value: The raw directory entry value. .. py:attribute:: volume .. py:attribute:: value .. py:attribute:: xfields .. py:method:: __repr__() -> str .. py:property:: name :type: str The name of this directory entry. .. py:property:: hash :type: int | None The hash of this directory entry, if available. .. py:property:: file_id :type: int The object ID of the inode this directory entry refers to. .. py:property:: sibling_id :type: int | None The sibling ID of the inode this directory entry refers to, if available. .. py:property:: inode :type: INode The inode this directory entry refers to. .. py:property:: date_added :type: datetime.datetime The date and time this directory entry was added. .. py:property:: dt :type: dissect.apfs.c_apfs.c_apfs.DT The directory entry type. .. py:property:: type :type: int The file type of this directory entry. .. py:method:: is_dir() -> bool Return whether this directory entry is a directory. .. py:method:: is_file() -> bool Return whether this directory entry is a regular file. .. py:method:: is_symlink() -> bool Return whether this directory entry is a symbolic link. .. py:method:: is_block_device() -> bool Return whether this directory entry is a block device. .. py:method:: is_character_device() -> bool Return whether this directory entry is a character device. .. py:method:: is_device() -> bool Return whether this directory entry is a device (block or character). .. py:method:: is_fifo() -> bool Return whether this directory entry is a FIFO. .. py:method:: is_socket() -> bool Return whether this directory entry is a socket. .. py:method:: is_whiteout() -> bool Return whether this directory entry is a whiteout. .. py:class:: XAttr(inode: INode, key: bytes, value: bytes) APFS extended attribute. :param inode: The inode this xattr belongs to. :param key: The raw xattr key. :param value: The raw xattr value. .. py:attribute:: inode .. py:attribute:: key .. py:attribute:: value .. py:method:: __repr__() -> str .. py:property:: name :type: str The name of this xattr. .. py:property:: flags :type: dissect.apfs.c_apfs.c_apfs.XATTR The flags of this xattr. .. py:method:: open() -> dissect.util.stream.BufferedStream | dissect.apfs.stream.FileStream Open a stream for reading the xattr data.