dissect.evidence

Subpackages

• dissect.evidence.asdf
  • dissect.evidence.asdf.asdf
  • dissect.evidence.asdf.streams
• dissect.evidence.tools
  • dissect.evidence.tools.asdf
    • dissect.evidence.tools.asdf.dd
    • dissect.evidence.tools.asdf.meta
    • dissect.evidence.tools.asdf.repair
    • dissect.evidence.tools.asdf.verify

Submodules

• dissect.evidence.ad1
• dissect.evidence.ewf
• dissect.evidence.exceptions

Package Contents

Classes

AsdfSnapshot	ASDF file reader.
AsdfStream	ASDF stream from a snapshot.
EWF	Expert Witness disk image Format

class dissect.evidence.AsdfSnapshot(fh: BinaryIO, recover: bool = False)

ASDF file reader.

Parameters:

fh – File-like object to read the ASDF file from.

contains(idx: int) → bool

Check whether this file contains the given stream index.

Parameters:

idx – The stream to check.

open(idx: int) → AsdfStream

Open a specific stream in the file.

Parameters:

idx – The stream to open.

streams() → AsdfStream

Iterate over all streams in the file.

disks() → AsdfStream

Iterate over all non-reserved streams in the file.

class dissect.evidence.AsdfStream(asdf: AsdfSnapshot, idx: int)

Bases: dissect.util.stream.AlignedStream

ASDF stream from a snapshot.

Parameters:

• asdf – AsdfSnapshot parent object.

• idx – Stream index in the AsdfSnapshot.

class dissect.evidence.EWF(fh)

Bases: dissect.util.stream.AlignedStream

Expert Witness disk image Format

read_sectors(sector, count)