`dissect.archive.vbk`¶

Module Contents¶

Classes¶

`VBK`	Veeam Backup (VBK) file implementation.
`SnapshotSlot`	A snapshot slot in the VBK file.
`Bank`	A bank in the snapshot slot. A bank is a collection of pages.
`MetaItem`	Base class for value types in a meta vector.
`DirItem`	Base class for directory items.
`RootDirectory`	Special directory item for the root directory. Does not actually exist in the VBK file.
`SubFolderItem`	Directory item for a subfolder (directory type).
`ExtFibItem`	Directory item for an external file.
`IntFibItem`	Directory item for an internal file.
`PatchItem`	Directory item for a patch.
`IncrementItem`	Directory item for an increment.
`MetaTableDescriptor`	A descriptor for a meta table in the VBK file.
`FibBlockDescriptor`	A descriptor for a FIB (File In Backup) block in the VBK file.
`FibBlockDescriptorV7`	A descriptor for a FIB (File In Backup) block in the VBK file. Version 7.
`StgBlockDescriptor`	A descriptor for a storage block in the VBK file.
`StgBlockDescriptorV7`	A descriptor for a storage block in the VBK file. Version 7.
`PropertiesDictionary`	A dictionary of properties in the VBK file.
`MetaBlob`	A meta blob in the VBK file.
`MetaVector`	A vector of meta items in the VBK file.
`MetaVector2`	A vector of meta items in the VBK file. Version 2.
`FibMetaSparseTable`	A sparse table of FIB (File In Backup) blocks in the VBK file.
`FibStream`	A stream for reading FIB (File In Backup) blocks in the VBK file.

Attributes¶

T

exception dissect.archive.vbk.VBKError¶

Bases: dissect.archive.exceptions.Error

Common base class for all non-exit exceptions.

exception dissect.archive.vbk.NotAFileError¶

Bases: VBKError

Common base class for all non-exit exceptions.

exception dissect.archive.vbk.NotADirectoryError¶

Bases: VBKError

Common base class for all non-exit exceptions.

class dissect.archive.vbk.VBK(fh: BinaryIO, verify: bool = True)¶

Veeam Backup (VBK) file implementation.

References

CMeta
CStgFormat

Notes

TODO: Encryption
TODO: Incrememental backups

Parameters:

fh – The file handle of the VBK file to read.
verify – Whether to verify checksums.

fh¶

header¶

format_version¶

block_size¶

slot1¶

slot2¶

active_slot: SnapshotSlot¶

root¶

block_store¶

is_v7() → bool¶

page(idx: int) → bytes¶

Read a page from the VBK file.

Parameters:: idx – The index of the page to read.

get_meta_blob(page: int) → MetaBlob¶

Read a meta blob from the VBK file.

Parameters:: page – The starting page number of the meta blob to read.

get(path: str, item: DirItem | None = None) → DirItem¶: Get a directory item from the VBK file.

class dissect.archive.vbk.SnapshotSlot(vbk: VBK, offset: int)¶

A snapshot slot in the VBK file.

References

CSlotHdr
SSnapshotDescriptor
CSnapshotSlot
CMetaStore
CMetaObjs
SMetaObjRefs
SDirRootRec
SBlocksStoreHdr

Notes

TODO: Free blocks index (CFreeBlocksIndex, SFreeBlockIndexItem)
TODO: Deduplication index (CDedupIndex, SDedupIndexItem)
TODO: Crypto store (CCryptoStore, SCryptoStoreRec)

Parameters:

vbk – The VBK object that the snapshot slot is part of.
offset – The offset of the snapshot slot in the file.

vbk¶

offset¶

header¶

descriptor = None¶

grain = None¶

valid_max_banks = 0¶

banks = []¶

__repr__() → str¶

property size: int¶: The size of the snapshot slot in the file.

verify() → bool¶

Verify the snapshot slot’s CRC.

Parameters:: crc – The CRC to verify against.

page(page: int) → bytes¶

Read a page from the snapshot slot.

Parameters:: idx – The page number to read.

class dissect.archive.vbk.Bank(vbk: VBK, offset: int, size: int)¶

A bank in the snapshot slot. A bank is a collection of pages.

References

SBankHdr
CBankHdrPage

Parameters:

vbk – The VBK object that the bank is part of.
offset – The offset of the bank in the file.
size – The size of the bank in the file.

vbk¶

offset¶

size¶

header¶

page¶

__repr__() → str¶

verify(crc: int) → bool¶

Verify the bank’s CRC.

Parameters:: crc – The CRC to verify against.

class dissect.archive.vbk.MetaItem(vbk: VBK, buf: bytes)¶

Base class for value types in a meta vector.

__struct__: dissect.cstruct.Structure = None¶

vbk¶

buf¶

entry = None¶

classmethod from_bytes(vbk: VBK, buf: bytes) → MetaItem¶

class dissect.archive.vbk.DirItem(vbk: VBK, buf: bytes)¶

Bases: MetaItem

Base class for directory items.

References

SDirItemRec
CDir

__struct__¶

name¶

__repr__() → str¶

classmethod from_bytes(vbk: VBK, buf: bytes) → SubFolderItem | ExtFibItem | IntFibItem | PatchItem | IncrementItem | DirItem¶

property type: dissect.archive.c_vbk.c_vbk.DirItemType¶: The type of the directory item.

property size: int¶

property properties: PropertiesDictionary | None¶: The properties of the directory item, if it has them.

is_dir() → bool¶: Return whether the directory item is a directory.

is_file() → bool¶: Return whether the directory item is a file.

is_internal_file() → bool¶: Return whether the directory item is an internal file.

is_external_file() → bool¶: Return whether the directory item is an external file.

listdir() → dict[str, DirItem]¶: Return a dictionary of the items in the directory.

iterdir() → Iterator[DirItem]¶: Iterate over the items in the directory.

open() → BinaryIO¶: Open the file for reading.

class dissect.archive.vbk.RootDirectory(vbk: VBK, page: int, count: int)¶

Bases: DirItem

Special directory item for the root directory. Does not actually exist in the VBK file.

name = '/'¶

root¶

count¶

__repr__() → str¶

is_dir() → bool¶: Return whether the directory item is a directory.

iterdir() → Iterator[DirItem]¶: Iterate over the items in the directory.

class dissect.archive.vbk.SubFolderItem(vbk: VBK, buf: bytes)¶

Bases: DirItem

Directory item for a subfolder (directory type).

References

CSubFolderHdr
CFolderMeta

root¶

count¶

__repr__() → str¶

is_dir() → bool¶: Return whether the directory item is a directory.

iterdir() → Iterator[DirItem]¶: Iterate over the items in the directory.

class dissect.archive.vbk.ExtFibItem(vbk: VBK, buf: bytes)¶

Bases: DirItem

Directory item for an external file.

References

SFibHdr
CExtFibMeta

__repr__() → str¶

property size: int¶

is_external_file() → bool¶: Return whether the directory item is an external file.

class dissect.archive.vbk.IntFibItem(vbk: VBK, buf: bytes)¶

Bases: DirItem

Directory item for an internal file.

References

SFibHdr
CIntFibMeta

__repr__() → str¶

property size: int¶

is_internal_file() → bool¶: Return whether the directory item is an internal file.

open() → FibStream¶: Open the file for reading.

class dissect.archive.vbk.PatchItem(vbk: VBK, buf: bytes)¶

Bases: DirItem

Directory item for a patch.

Notes

TODO: SPatchHdr
TODO: CPatchMeta

__repr__() → str¶

property size: int¶

class dissect.archive.vbk.IncrementItem(vbk: VBK, buf: bytes)¶

Bases: DirItem

Directory item for an increment.

Notes

TODO: SIncrementHdr
TODO: CIncrementMeta

__repr__() → str¶

property size: int¶

class dissect.archive.vbk.MetaTableDescriptor(vbk: VBK, buf: bytes)¶

Bases: MetaItem

A descriptor for a meta table in the VBK file.

References

SMetaTableDescriptor

__struct__¶

__repr__() → str¶

property page: int¶: The page number of the first page in the meta table.

property block_size: int¶: The block size of the meta table.

property count: int¶: The number of entries in the meta table.

class dissect.archive.vbk.FibBlockDescriptor(vbk: VBK, buf: bytes)¶

Bases: MetaItem

A descriptor for a FIB (File In Backup) block in the VBK file.

References

SFibBlockDescriptor

__struct__¶

__repr__() → str¶

is_normal() → bool¶: Return whether the block is a normal block.

is_sparse() → bool¶: Return whether the block is a sparse block.

is_reserved() → bool¶: Return whether the block is a reserved block.

is_archived() → bool¶

Return whether the block is an archived block.

If the block is archived, the compressed size and compression type are stored in the block ID:

BlockId = CompressedSize | (CompressionType << 32)

Notes

TODO: Verify the above

is_block_in_blob() → bool¶

Return whether the block is a block in a blob.

If the block is in a blob, the block ID, blob ID and offset are stored in the block ID:

BlockId = BlockId? & 0x3FFFFFF | (BlobId << 26) | ((Offset >> 9) << 42)

Notes

TODO: Verify the above

is_block_in_blob_reserved() → bool¶

Return whether the block is a reserved block in a blob.

If the block is a reserved block in a blob, the block ID is stored in the block ID:

BlockId = BlockId? | 0xFFFFFFFFFC000000

Notes

TODO: Verify the above

property block_size: int¶: The size of the block.

property type: dissect.archive.c_vbk.c_vbk.BlockLocationType¶: The type of the block.

property digest: bytes¶: The digest of the block.

property block_id: int¶: The ID of the block.

property flags: dissect.archive.c_vbk.c_vbk.BlockFlags¶: The flags of the block.

class dissect.archive.vbk.FibBlockDescriptorV7(vbk: VBK, buf: bytes)¶

Bases: FibBlockDescriptor

A descriptor for a FIB (File In Backup) block in the VBK file. Version 7.

References

SFibBlockDescriptorV7

__struct__¶

__repr__() → str¶

property keyset_id: bytes¶

class dissect.archive.vbk.StgBlockDescriptor(vbk: VBK, buf: bytes)¶

Bases: MetaItem

A descriptor for a storage block in the VBK file.

References

SStgBlockDescriptor

__struct__¶

__repr__() → str¶

is_legacy() → bool¶: Return whether the block is a legacy block.

is_data_block() → bool¶

Return whether the block is a data block.

A data block is a block that has a usage counter greater than 0.

is_dedup_block() → bool¶

Return whether the block is a dedup block.

Notes

TODO: What is this?

is_compressed() → bool¶: Return whether the block is compressed.

property format: int¶: The format of the block.

property usage_counter: int¶: The usage counter of the block.

property offset: int¶: The offset of the block.

property allocated_size: int¶: The allocated size of the block.

property deduplication: int¶: The deduplication of the block.

property digest: bytes¶: The digest of the block.

property compression_type: dissect.archive.c_vbk.c_vbk.CompressionType¶: The compression type of the block.

property compressed_size: int¶: The compressed size of the block.

property source_size: int¶: The source size of the block.

class dissect.archive.vbk.StgBlockDescriptorV7(vbk: VBK, buf: bytes)¶

Bases: StgBlockDescriptor

A descriptor for a storage block in the VBK file. Version 7.

References

SStgBlockDescriptorV7

__struct__¶

__repr__() → str¶

property keyset_id: bytes¶: The keyset ID of the block.

class dissect.archive.vbk.PropertiesDictionary(vbk: VBK, page: int)¶

Bases: dict

A dictionary of properties in the VBK file.

References

CPropsDictionary
CDirElemPropsRW

Parameters:

vbk – The VBK object that the properties dictionary is part of.
page – The page number of the meta blob of the properties dictionary.

vbk¶

page¶

class dissect.archive.vbk.MetaBlob(slot: SnapshotSlot, root: int)¶

A meta blob in the VBK file.

A meta blob is a list of pages that are linked together. Each page has a header (MetaBlobHeader) with a NextPage field that points to the next page in the blob. The last page has a NextPage field of -1.

References

CMetaBlobRW

Parameters:

slot – The snapshot slot that the meta blob is part of.
root – The page number of the first page in the meta blob.

slot¶

root¶

__repr__() → str¶

pages() → Iterator[int]¶

data() → bytes¶

dissect.archive.vbk.T¶

class dissect.archive.vbk.MetaVector(vbk: VBK, type_: type[T], page: int, count: int)¶

Bases: Generic[T]

A vector of meta items in the VBK file.

References

CMetaVec

Parameters:

vbk – The VBK object that the vector is part of.
type – The type of the items in the vector.
page – The page number of the first page in the vector.
count – The number of items in the vector.

vbk¶

type¶

page¶

count¶

get¶

__repr__() → str¶

__iter__() → Iterator[T]¶

data(idx: int) → bytes¶

Read the data for an entry in the vector.

Parameters:: idx – The index of the entry to read.

class dissect.archive.vbk.MetaVector2(vbk: VBK, type_: type[T], page: int, count: int)¶

Bases: MetaVector[T]

A vector of meta items in the VBK file. Version 2.

MetaVector2 is essentially a table of page numbers that contain the vector entries. The table pages of a MetaVector2 have a 8-32 byte header, so we can hold a maximum of 508-511 entries per page. Read the comments in _lookup_page for more information.

References

CMetaVec2

Parameters:

vbk – The VBK object that the vector is part of.
type – The type of the items in the vector.
page – The page number of the first page in the vector.
count – The number of items in the vector.

data(idx: int) → bytes¶

Read the data for an entry in the vector.

Parameters:: idx – The index of the entry to read.

class dissect.archive.vbk.FibMetaSparseTable(vbk: VBK, page: int, count: int)¶

A sparse table of FIB (File In Backup) blocks in the VBK file.

References

CFibMetaSparseTable

Parameters:

vbk – The VBK object that the sparse table is part of.
page – The page number of the first page in the table.
count – The number of entries in the table.

MAX_ENTRIES_PER_TABLE = 1088¶

vbk¶

page¶

count¶

type¶

get(idx: int) → FibBlockDescriptor | FibBlockDescriptorV7¶

Get a block descriptor from the sparse table.

Parameters:: idx – The index of the block descriptor to get.

class dissect.archive.vbk.FibStream(vbk: VBK, page: int, count: int, size: int)¶

Bases: dissect.util.stream.AlignedStream

A stream for reading FIB (File In Backup) blocks in the VBK file.

Parameters:

vbk – The VBK object that the stream is part of.
page – The page number of the FibMetaSparseTable.
count – The number of entries in the meta sparse table.
size – The size of the stream.

vbk¶

page¶

count¶

table¶

dissect.archive.vbk¶

Module Contents¶

Classes¶

Attributes¶

`dissect.archive.vbk`¶