:py:mod:`dissect.hypervisor.disk.qcow2` ======================================= .. py:module:: dissect.hypervisor.disk.qcow2 Module Contents --------------- Classes ~~~~~~~ .. autoapisummary:: dissect.hypervisor.disk.qcow2.QCow2 dissect.hypervisor.disk.qcow2.QCow2Snapshot dissect.hypervisor.disk.qcow2.QCow2Stream dissect.hypervisor.disk.qcow2.L2Table Functions ~~~~~~~~~ .. autoapisummary:: :nosignatures: dissect.hypervisor.disk.qcow2.offset_into_cluster dissect.hypervisor.disk.qcow2.offset_into_subcluster dissect.hypervisor.disk.qcow2.size_to_clusters dissect.hypervisor.disk.qcow2.size_to_subclusters dissect.hypervisor.disk.qcow2.offset_to_l1_index dissect.hypervisor.disk.qcow2.offset_to_l2_index dissect.hypervisor.disk.qcow2.offset_to_sc_index dissect.hypervisor.disk.qcow2.get_cluster_type dissect.hypervisor.disk.qcow2.get_subcluster_type dissect.hypervisor.disk.qcow2.get_subcluster_range_type dissect.hypervisor.disk.qcow2.count_contiguous_subclusters Attributes ~~~~~~~~~~ .. autoapisummary:: dissect.hypervisor.disk.qcow2.HAS_ZSTD .. py:data:: HAS_ZSTD :value: True .. py:class:: QCow2(fh: BinaryIO | pathlib.Path, data_file: BinaryIO | None = None, backing_file: BinaryIO | None = None, *, allow_no_data_file: bool = False, allow_no_backing_file: bool = False) QCOW2 virtual disk implementation. If a data-file is required and ``fh`` is not a ``Path``, it's required to manually pass a file like object in the `data_file` argument. Otherwise, the data file will be automatically opened if it exists in the same directory. It's possible to defer opening the data file by passing ``allow_no_data_file=True``. The same applies to the backing-file. This too can be deferred by passing ``allow_no_backing_file=True``. :param fh: File handle or path to the QCOW2 file. :param data_file: Optional file handle for the data file. If not provided and ``fh`` is a ``Path``, it will try to open it automatically. :param backing_file: Optional file handle for the backing file. If not provided and ``fh`` is a ``Path``, it will try to open it automatically. :param allow_no_data_file: If True, allows the QCOW2 file to be opened without a data file. :param allow_no_backing_file: If True, allows the QCOW2 file to be opened without a backing file. .. py:attribute:: header .. py:attribute:: size .. py:attribute:: cluster_bits .. py:attribute:: cluster_size .. py:attribute:: subclusters_per_cluster .. py:attribute:: subcluster_size .. py:attribute:: subcluster_bits .. py:attribute:: l2_bits .. py:attribute:: l2_size .. py:attribute:: csize_shift .. py:attribute:: csize_mask .. py:attribute:: cluster_offset_mask .. py:attribute:: backing_format :value: None .. py:attribute:: feature_table :value: None .. py:attribute:: crypto_header :value: None .. py:attribute:: bitmap_header :value: None .. py:attribute:: image_data_file :value: None .. py:attribute:: unknown_extensions :value: [] .. py:attribute:: backing_file :value: None .. py:attribute:: auto_backing_file :value: None .. py:attribute:: image_backing_file :value: None .. py:attribute:: l2_table .. py:property:: snapshots :type: list[QCow2Snapshot] .. py:property:: l1_table :type: list[int] .. py:property:: has_backing_file :type: bool .. py:property:: needs_backing_file :type: bool .. py:property:: has_data_file :type: bool .. py:property:: needs_data_file :type: bool .. py:property:: has_subclusters :type: bool .. py:method:: open() -> QCow2Stream Open the QCow2 file for reading. .. py:class:: QCow2Snapshot(qcow2: QCow2, offset: int) Wrapper class for snapshot table entries. .. py:attribute:: qcow2 .. py:attribute:: offset .. py:attribute:: header .. py:attribute:: extra .. py:attribute:: unknown_extra .. py:attribute:: id .. py:attribute:: name .. py:attribute:: entry_size .. py:method:: open() -> QCow2Stream Open the snapshot for reading. .. py:property:: l1_table :type: list[int] .. py:class:: QCow2Stream(qcow2: QCow2, l1_table: list[int] | None = None) Bases: :py:obj:`dissect.util.stream.AlignedStream` Aligned stream for reading QCow2 files. .. py:attribute:: qcow2 .. py:attribute:: l1_table .. py:class:: L2Table(qcow2: QCow2, offset: int) Convenience class for accessing the L2 table. .. py:attribute:: qcow2 .. py:attribute:: offset .. py:method:: entry(idx: int) -> int .. py:method:: bitmap(idx: int) -> int .. py:function:: offset_into_cluster(qcow2: QCow2, offset: int) -> int .. py:function:: offset_into_subcluster(qcow2: QCow2, offset: int) -> int .. py:function:: size_to_clusters(qcow2: QCow2, size: int) -> int .. py:function:: size_to_subclusters(qcow2: QCow2, size: int) -> int .. py:function:: offset_to_l1_index(qcow2: QCow2, offset: int) -> int .. py:function:: offset_to_l2_index(qcow2: QCow2, offset: int) -> int .. py:function:: offset_to_sc_index(qcow2: QCow2, offset: int) -> int .. py:function:: get_cluster_type(qcow2: QCow2, l2_entry: int) -> dissect.hypervisor.disk.c_qcow2.QCow2ClusterType .. py:function:: get_subcluster_type(qcow2: QCow2, l2_entry: int, l2_bitmap: int, sc_index: int) -> dissect.hypervisor.disk.c_qcow2.QCow2SubclusterType .. py:function:: get_subcluster_range_type(qcow2: QCow2, l2_entry: int, l2_bitmap: int, sc_from: int) -> tuple[dissect.hypervisor.disk.c_qcow2.QCow2SubclusterType, int] .. py:function:: count_contiguous_subclusters(qcow2: QCow2, nb_clusters: int, sc_index: int, l2_table: L2Table, l2_index: int) -> int