dissect.fat

Submodules

• dissect.fat.c_exfat
• dissect.fat.c_fat
• dissect.fat.exceptions
• dissect.fat.exfat
• dissect.fat.fat

Package Contents

Classes

ExFAT
FATFS

exception dissect.fat.BadClusterError

Bases: Error

Common base class for all non-exit exceptions.

exception dissect.fat.EmptyDirectoryError

Bases: Error

Common base class for all non-exit exceptions.

exception dissect.fat.Error

Bases: Exception

Common base class for all non-exit exceptions.

exception dissect.fat.FileNotFoundError

Bases: Error, FileNotFoundError

Common base class for all non-exit exceptions.

exception dissect.fat.FreeClusterError

Bases: Error

Common base class for all non-exit exceptions.

exception dissect.fat.InvalidBPB

Bases: Error

Common base class for all non-exit exceptions.

exception dissect.fat.InvalidDirectoryError

Bases: Error

Common base class for all non-exit exceptions.

exception dissect.fat.InvalidHeaderMagic

Bases: Error

Common base class for all non-exit exceptions.

exception dissect.fat.LastEmptyDirectoryError

Bases: Error

Common base class for all non-exit exceptions.

exception dissect.fat.NotADirectoryError

Bases: Error, NotADirectoryError

Common base class for all non-exit exceptions.

class dissect.fat.ExFAT(fh: BinaryIO)

filesystem

vbr

fs_name

sector_size

cluster_size

fat_sector

fat_sector_count

fat_size

fat

cluster_heap_sector

cluster_count

root_dir_cluster

root_dir_sector

root_directory

files

alloc_bitmap = None

upcase_table = None

volume_label

cluster_to_sector(cluster: int) → int | None

Returns the clusters’ corresponding sector address

Parameters:

cluster (int) – cluster address

Returns:

corresponding sector address if available

Return type:

int

sector_to_cluster(sector: int) → int | None

Returns the sectors’ corresponding cluster address

Parameters:

sector (int) – sector address

Returns:

corresponding cluster address if available

Return type:

int

runlist(starting_cluster: int, not_fragmented: bool = True, size: int | None = None) → list[tuple[int, int]]

Creates a RunlistStream compatible runlist from exFAT FAT structures, in sectors.

Parameters:

starting_cluster (int) – First cluster of file, folder or location in question

Returns:

[(sector_offset, run_length_in_sectors)]

Return type:

runlist

get_cluster_chain(starting_cluster: int) → list[int]

Reads the on disk FAT to construct the cluster chain

Parameters:

starting_cluster (int) – cluster to look-up the chain from

Returns:

Chain of clusters. Including starting_cluster

Return type:

list

class dissect.fat.FATFS(fh: BinaryIO, encoding: str = 'ibm437')

fh

encoding = 'ibm437'

bpb

fat_size

total_sectors

first_data_sector

sector_size

cluster_size

fat

data_stream

volume_label = ''

volume_id

root

get(path: str, dirent: DirectoryEntry | RootDirectory | None = None) → DirectoryEntry | RootDirectory