dissect.evidence.ewf
#
Module Contents#
Classes#
Expert Witness Disk Image Format. |
|
Basic buffered stream that provides easy aligned reads. |
|
Functions#
Find all related EWF files from the given path. |
Attributes#
- dissect.evidence.ewf.log#
- dissect.evidence.ewf.ewf_def = Multiline-String#
Show Value
""" enum MediaType : uint8 { Removable = 0x00, Fixed = 0x01, Optical = 0x03, Logical = 0x0e, RAM = 0x10 }; enum MediaFlags : uint8 { Image = 0x01, Physical = 0x02, Fastbloc = 0x04, Tablaeu = 0x08 }; enum CompressionLevel : uint8 { None = 0x00, Good = 0x01, Best = 0x02 }; typedef struct { char signature[8]; uint8 fields_start; uint16 segment_number; uint16 fields_end; } EWFHeader; typedef struct { char type[16]; uint64 next; uint64 size; uint8 pad[40]; uint32 checksum; } EWFSectionDescriptor; typedef struct { uint32 reserved_1; uint32 chunk_count; uint32 sector_count; uint32 sector_size; uint32 total_sector_count; uint8 reserved[20]; uint8 pad[45]; char signature[5]; uint32 checksum; } EWFVolumeSectionSpec; typedef struct { MediaType media_type; uint8 reserved_1[3]; uint32 chunk_count; uint32 sector_count; uint32 sector_size; uint64 total_sector_count; uint32 num_cylinders; uint32 num_heads; uint32 num_sectors; uint8 media_flags; uint8 unknown_1[3]; uint32 palm_start_sector; uint32 unknown_2; uint32 smart_start_sector; CompressionLevel compression_level; uint8 unknown_3[3]; uint32 error_granularity; uint32 unknown_4; uint8 uuid[16]; uint8 pad[963]; char signature[5]; uint32 checksum; } EWFVolumeSection; typedef struct { uint32 num_entries; uint32 _; uint64 base_offset; uint32 _; uint32 checksum; uint32 entries[num_entries]; } EWFTableSection; """
- dissect.evidence.ewf.c_ewf#
- dissect.evidence.ewf.MAX_OPEN_SEGMENTS = 128#
- dissect.evidence.ewf.find_files(path: str | pathlib.Path) list[pathlib.Path] #
Find all related EWF files from the given path.
- class dissect.evidence.ewf.EWF(fh: BinaryIO | list[BinaryIO])#
Expert Witness Disk Image Format.
- open() BinaryIO #
- class dissect.evidence.ewf.EWFStream(ewf: EWF)#
Bases:
dissect.util.stream.AlignedStream
Basic buffered stream that provides easy aligned reads.
- Must be subclassed for various stream implementations. Subclasses can implement:
_read(offset, length)
_seek(pos, whence=io.SEEK_SET)
The offset and length for _read are guaranteed to be aligned. The only time that overriding _seek would make sense is if there’s no known size of your stream, but still want to provide SEEK_END functionality.
Most subclasses of AlignedStream take one or more file-like objects as source. Operations on these subclasses, like reading, will modify the source file-like object as a side effect.
- Parameters:
size – The size of the stream. This is used in read and seek operations. None if unknown.
align – The alignment size. Read operations are aligned on this boundary. Also determines buffer size.
- class dissect.evidence.ewf.HeaderSection(segment: Segment, section: SectionDescriptor)#
- __repr__() str #
Return repr(self).
- class dissect.evidence.ewf.VolumeSection(segment: Segment, section: SectionDescriptor)#
- class dissect.evidence.ewf.TableSection(segment: Segment, section: SectionDescriptor)#