:py:mod:`dissect.evidence.ewf.ewf`
==================================

.. py:module:: dissect.evidence.ewf.ewf




Module Contents
---------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.evidence.ewf.ewf.EWF
   dissect.evidence.ewf.ewf.EWFStream
   dissect.evidence.ewf.ewf.Segment
   dissect.evidence.ewf.ewf.HeaderSection
   dissect.evidence.ewf.ewf.VolumeSection
   dissect.evidence.ewf.ewf.TableSection
   dissect.evidence.ewf.ewf.SectionDescriptor



Functions
~~~~~~~~~

.. autoapisummary::
   :nosignatures:

   dissect.evidence.ewf.ewf.find_files



Attributes
~~~~~~~~~~

.. autoapisummary::

   dissect.evidence.ewf.ewf.log
   dissect.evidence.ewf.ewf.MAX_OPEN_SEGMENTS


.. py:data:: log

.. py:data:: MAX_OPEN_SEGMENTS
   :value: 128


.. py:function:: find_files(path: str | pathlib.Path) -> list[pathlib.Path]

   Find all related EWF files from the given path.


.. py:class:: EWF(fh: BinaryIO | list[BinaryIO] | pathlib.Path | list[pathlib.Path])

   Expert Witness Disk Image Format.


   .. py:attribute:: fh


   .. py:attribute:: header
      :type:  HeaderSection
      :value: None



   .. py:attribute:: volume
      :type:  VolumeSection
      :value: None



   .. py:attribute:: chunk_size


   .. py:attribute:: size


   .. py:method:: segment(idx: int) -> Segment


   .. py:method:: open() -> BinaryIO


.. py:class:: EWFStream(ewf: EWF)

   Bases: :py:obj:`dissect.util.stream.AlignedStream`


   Basic buffered stream that provides aligned reads.

   Must be subclassed for various stream implementations. Subclasses can implement:
       - :meth:`~AlignedStream._read`
       - :meth:`~AlignedStream._seek`

   The offset and length for ``_read`` are guaranteed to be aligned for streams of a known size.
   If your stream has an unknown size (i.e. ``size == None``), reads of length ``-1`` (i.e. read until EOF) will be
   passed through to your implementation of ``_read``.
   The only time that overriding ``_seek`` would make sense is if there's no known size of your stream,
   but still want to provide ``SEEK_END`` functionality.

   Most subclasses of ``AlignedStream`` take one or more file-like objects as source.
   Operations on these subclasses, like reading, will modify the source file-like object as a side effect.

   :param size: The size of the stream. This is used in read and seek operations. ``None`` if unknown.
   :param align: The alignment size. Read operations are aligned on this boundary. Also determines buffer size.

   .. automethod:: _read
   .. automethod:: _seek


   .. py:attribute:: ewf


   .. py:attribute:: sector_size


.. py:class:: Segment(ewf: EWF, fh: BinaryIO)

   .. py:attribute:: ewf


   .. py:attribute:: fh


   .. py:attribute:: ewfheader


   .. py:attribute:: header


   .. py:attribute:: volume


   .. py:attribute:: sections
      :type:  list[SectionDescriptor]
      :value: []



   .. py:attribute:: tables
      :type:  list[TableSection]
      :value: []



   .. py:attribute:: table_offsets
      :value: []



   .. py:attribute:: chunk_count


   .. py:attribute:: sector_count


   .. py:attribute:: size


   .. py:attribute:: sector_offset
      :value: None



   .. py:attribute:: offset
      :value: None



   .. py:method:: read_sectors(sector: int, count: int) -> bytes


.. py:class:: HeaderSection(segment: Segment, section: SectionDescriptor)

   .. py:attribute:: segment


   .. py:attribute:: section


   .. py:attribute:: data


   .. py:method:: __repr__() -> str


.. py:class:: VolumeSection(segment: Segment, section: SectionDescriptor)

   .. py:attribute:: segment


   .. py:attribute:: section


   .. py:attribute:: volume


   .. py:attribute:: chunk_count


   .. py:attribute:: sector_count


   .. py:attribute:: sector_size


.. py:class:: TableSection(segment: Segment, section: SectionDescriptor)

   .. py:attribute:: segment


   .. py:attribute:: section


   .. py:attribute:: header


   .. py:attribute:: num_entries


   .. py:attribute:: base_offset


   .. py:attribute:: entries


   .. py:attribute:: sector_count


   .. py:attribute:: size


   .. py:attribute:: sector_offset
      :value: None



   .. py:attribute:: offset
      :value: None



   .. py:attribute:: read_chunk


   .. py:method:: read_sectors(sector: int, count: int) -> bytes


.. py:class:: SectionDescriptor(fh: BinaryIO)

   .. py:attribute:: fh


   .. py:attribute:: offset


   .. py:attribute:: type


   .. py:attribute:: next


   .. py:attribute:: size


   .. py:attribute:: checksum


   .. py:attribute:: data_offset


   .. py:method:: __repr__() -> str