:py:mod:`dissect.hypervisor.disk.vhdx` ====================================== .. py:module:: dissect.hypervisor.disk.vhdx Module Contents --------------- Classes ~~~~~~~ .. autoapisummary:: dissect.hypervisor.disk.vhdx.VHDX dissect.hypervisor.disk.vhdx.RegionTable dissect.hypervisor.disk.vhdx.BlockAllocationTable dissect.hypervisor.disk.vhdx.ParentLocator dissect.hypervisor.disk.vhdx.MetadataTable Functions ~~~~~~~~~ .. autoapisummary:: :nosignatures: dissect.hypervisor.disk.vhdx.open_parent Attributes ~~~~~~~~~~ .. autoapisummary:: dissect.hypervisor.disk.vhdx.log .. py:data:: log .. py:class:: VHDX(fh: BinaryIO | pathlib.Path | str) Bases: :py:obj:`dissect.util.stream.AlignedStream` Hyper-V VHDX implementation. Supports fixed, dynamic and differencing VHDX files. Currently, differencing VHDX files must be passed as a pathlib.Path object, with the parent VHDX in the same directory, or the registered absolute directory. .. py:attribute:: fh .. py:attribute:: path .. py:attribute:: file_identifier .. py:attribute:: header .. py:attribute:: headers .. py:attribute:: region_table .. py:attribute:: region_tables .. py:attribute:: metadata .. py:attribute:: size .. py:attribute:: block_size .. py:attribute:: has_parent .. py:attribute:: sector_size .. py:attribute:: id .. py:attribute:: parent :value: None .. py:attribute:: parent_locator :type: ParentLocator :value: None .. py:attribute:: bat .. py:method:: read_sectors(sector: int, count: int) -> bytes .. py:class:: RegionTable(fh: BinaryIO, offset: int) .. py:attribute:: fh .. py:attribute:: offset .. py:attribute:: header .. py:attribute:: entries .. py:attribute:: lookup .. py:method:: get(guid: uuid.UUID, required: bool = True) -> dissect.hypervisor.disk.c_vhdx.c_vhdx.region_table_entry | None .. py:class:: BlockAllocationTable(vhdx: VHDX, offset: int) .. py:attribute:: vhdx .. py:attribute:: offset .. py:attribute:: chunk_ratio .. py:attribute:: get .. py:method:: pb(block: int) -> dissect.hypervisor.disk.c_vhdx.c_vhdx.bat_entry Get a payload block entry for a given block. .. py:method:: sb(block: int) -> dissect.hypervisor.disk.c_vhdx.c_vhdx.bat_entry Get a sector bitmap entry for a given block. .. py:class:: ParentLocator(fh: BinaryIO) .. py:attribute:: fh .. py:attribute:: offset .. py:attribute:: header .. py:attribute:: type .. py:attribute:: entries :type: dict[str, str] .. py:class:: MetadataTable(fh: BinaryIO, offset: int, length: int) .. py:attribute:: METADATA_MAP :type: Final[dict[uuid.UUID, collections.abc.Callable[[BinaryIO], Any]]] .. py:attribute:: fh .. py:attribute:: offset .. py:attribute:: length .. py:attribute:: header .. py:attribute:: entries .. py:attribute:: lookup .. py:method:: get(guid: uuid.UUID, required: bool = True) -> Any | None .. py:function:: open_parent(path: pathlib.Path, locator: dict[str, str]) -> VHDX