dissect.btrfs

Submodules

• dissect.btrfs.btrfs
• dissect.btrfs.c_btrfs
• dissect.btrfs.exceptions
• dissect.btrfs.stream
• dissect.btrfs.tree

Package Contents

Classes

Btrfs	Btrfs filesystem implementation.
INode	Represent a Btrfs inode.
Subvolume	Represent a Btrfs subvolume.

class dissect.btrfs.Btrfs(fh: BinaryIO | list[BinaryIO])

Btrfs filesystem implementation.

This implementation supports most basic Btrfs features such as subvolumes, compression and (meta)data RAID. To open a RAID volume, simply pass all file-like objects that belong to the RAID set as a list.

Parameters:

fh – A file-like object for the volume to use for parsing Btrfs.

get(path: str | int, node: INode | None = None) → INode

Retrieve a Btrfs inode by path or inode number.

Parameters:

• path – Filesystem path or inode number.

• node – Optional inode used for relative lookups.

subvolumes() → Iterator[Subvolume]

Yield all subvolumes.

find_subvolume(path: str | None = None) → Subvolume | None

Find a subvolume by path.

Parameters:

path – The path of the subvolume to find.

open_subvolume(objectid: int, parent: INode | None = None) → Subvolume

Open a subvolume.

Parameters:

• objectid – The objectid of the subvolume to open.

• parent – Optional parent node to attach to the root of the subvolume.

class dissect.btrfs.INode(subvolume: Subvolume, inum: int, type: int | None = None, parent: INode | None = None)

Represent a Btrfs inode.

Parameters:

• subvolume – The subvolume this inode belongs to.

• inum – The inode number of this inode.

• type – Optional file type of this inode, as observed in a directory entry.

• parent – Optional parent of this inode, if this inode is parsed from a directory listing.

property parents: list[INode]

property path: str

Return the path to this inode within the subvolume. In case of multiple hardlinks, return the first path.

property full_path: str

Return the full path to this inode. In case of multiple hardlinks, return the first path.

__repr__() → str

Return repr(self).

inode() → dissect.btrfs.c_btrfs.c_btrfs.btrfs_inode_item

Return the parsed inode structure.

size() → int

Return the file size.

uid() → int

Return the owner user ID.

gid() → int

Return the owner group ID.

mode() → int

Return the file mode.

type() → int

Return the file type.

atime() → datetime.datetime

Return datetime timestamp of last access.

atime_ns() → int

Return nanosecond timestamp of last access.

ctime() → datetime.datetime

Return datetime timestamp of last metadata change.

ctime_ns() → int

Return nanosecond timestamp of last metadata change.

mtime() → datetime.datetime

Return datetime timestamp of last content modification.

mtime_ns() → int

Return nanosecond timestamp of last content modification.

otime() → datetime.datetime

Return datetime timestamp of inode creation.

otime_ns() → int

Return nanosecond timestamp of inode creation.

is_dir() → bool

Return whether this inode is a directory.

is_file() → bool

Return whether this inode is a regular file.

is_symlink() → bool

Return whether this inode is a symlink.

is_block_device() → bool

Return whether this inode is a block device.

is_character_device() → bool

Return whether this inode is a character device.

is_device() → bool

Return whether this inode is a device.

is_fifo() → bool

Return whether this inode is a FIFO file.

is_socket() → bool

Return whether this inode is a socket file.

is_ipc() → bool

Return whether this inode is an IPC file.

link() → str

Return the symlink target.

link_inode() → INode

Resolve the symlink target to an inode.

get(path: str) → INode

Retrieve a Btrfs inode relative from this inode.

Parameters:

path – Filesystem path.

paths(full: bool = False) → Iterator[str]

Yield all paths (hardlinks) to this inode.

By default only resolves up to the root of the subvolume this inode belongs to. For a full path to the root of the filesystem tree, set full to True.

Parameters:

full – Whether to fully resolve the path up to the root of the filesystem tree.

listdir() → dict[str, INode]

Return a directory listing.

iterdir() → Iterator[tuple[str, INode]]

Iterate directory contents.

extents() → list[dissect.btrfs.stream.Extent] | None

open() → BinaryIO

Return the data stream for the inode.

File data in Btrfs can be inlined in the B-tree or stored in file extents. In both cases it can be compressed.

class dissect.btrfs.Subvolume(btrfs: Btrfs, objectid: int, parent: INode | None = None)

Represent a Btrfs subvolume.

Btrfs has support for multiple subvolumes. The default subvolume is the FS_TREE subvolume. Each subvolume has its own B-tree.

Parameters:

• btrfs – The filesystem this subvolume belongs to.

• objectid – The object ID of the subvolume to open.

• parent – Optional parent node to attach to the root of the subvolume.

__repr__() → str

Return repr(self).

tree() → dissect.btrfs.tree.BTree

uuid() → uuid.UUID

root() → INode

path() → str

get(path: str | int, node: INode | None = None) → INode

Retrieve a Btrfs inode by path or inode number.

Parameters:

• path – Filesystem path or inode number.

• node – Optional inode used for relative lookups.

inode(inum: int, type: int | None = None, parent: INode | None = None) → INode

Return an INode by number, optionally attaching a type and parent.

resolve_path(objectid: int) → str

exception dissect.btrfs.Error

Bases: Exception

Common base class for all non-exit exceptions.

exception dissect.btrfs.FileNotFoundError

Bases: Error

Common base class for all non-exit exceptions.

exception dissect.btrfs.NotADirectoryError

Bases: Error

Common base class for all non-exit exceptions.

exception dissect.btrfs.NotASymlinkError

Bases: Error

Common base class for all non-exit exceptions.