acquire.acquire.outputs.base

Module Contents

Classes

Output

Base class to implement acquire output formats with.
class acquire.acquire.outputs.base.Output

Base class to implement acquire output formats with.

New output formats must sub-class this class.

init(path: pathlib.Path, **kwargs) → None
abstract write(output_path: str, fh: BinaryIO, entry: dissect.target.filesystem.FilesystemEntry | pathlib.Path | None, size: int | None = None) → None

Write a file-like object to the output.

Parameters:

  • output_path – The path of the entry in the output.

  • fh – The file-like object of the entry to write.

  • entry – The optional filesystem entry to write.

  • size – The optional file size in bytes of the entry to write.

write_entry(output_path: str, entry: dissect.target.filesystem.FilesystemEntry | pathlib.Path, size: int | None = None) → None

Write a filesystem entry to the output.

Parameters:

  • output_path – The path of the entry in the output.

  • entry – The filesystem entry to write.

  • size – The optional file size in bytes of the entry to write.

write_bytes(output_path: str, data: bytes, entry: dissect.target.filesystem.FilesystemEntry | pathlib.Path | None = None, size: int | None = None) → None

Write raw bytes to the output format.

Parameters:

  • output_path – The path of the entry in the output.

  • data – The raw bytes to write.

  • entry – The optional filesystem entry to write.

  • size – The optional file size in bytes of the entry to write.

write_volatile(output_path: str, entry: dissect.target.filesystem.FilesystemEntry | pathlib.Path, size: int | None = None) → None

Write a filesystem entry to the output.

Handles files that live in volatile filesystems. Such as procfs and sysfs.

Parameters:

  • output_path – The path of the entry in the output.

  • entry – The filesystem entry to write.

  • size – The optional file size in bytes of the entry to write.

abstract close() → None

Closes the output.