dissect.target.container

Module Contents

Classes

Container

Base class that acts as a file-like object wrapper around anything that can behave like a "raw disk".

Functions

register

Register a container implementation to use when opening a container.

open

Open a Container from the given object.

Attributes

CONTAINERS

MODULE_PATH

RawContainer

A lazy import of dissect.target.containers.raw.

log

dissect.target.container.CONTAINERS: list[type[Container]] = []
dissect.target.container.MODULE_PATH = 'dissect.target.containers'
dissect.target.container.RawContainer

A lazy import of dissect.target.containers.raw.

dissect.target.container.log
class dissect.target.container.Container(fh: BinaryIO | pathlib.Path, size: int, vs: dissect.target.volume.VolumeSystem | None = None)

Bases: io.IOBase

Base class that acts as a file-like object wrapper around anything that can behave like a “raw disk”.

Containers are anything from raw disk images and virtual disks, to evidence containers and made-up binary formats. Consumers of the Container class only need to implement seek, tell and read. Override __init__ for any opening that you may need to do, but don’t forget to initialize the super class.

Parameters:

  • fh – The source file-like object of the container or a Path object to the file.

  • size – The size of the container.

  • vs – An optional shorthand to set the underlying volume system, usually set later.

__type__: str = None

A short string identifying the type of container.

fh
size
vs = None
__repr__() → str

Return repr(self).

classmethod detect(item: list | BinaryIO | pathlib.Path) → bool

Detect if this Container can handle this file format.

Parameters:

item – The object we want to see if it can be handled by this Container.

Returns:

True if this Container can be used, False otherwise.

classmethod detect_fh(fh: BinaryIO, original: list | BinaryIO) → bool

Detect if this Container can be used to open the file-like object fh.

The function checks whether the raw data contains any magic information that corresponds to this specific container.

Parameters:

  • fh – A file-like object that we want to open a Container on.

  • original – The original argument passed to detect().

Returns:

True if this Container can be used for this file-like object, False otherwise.

static detect_path(path: pathlib.Path, original: list | pathlib.Path) → bool
Abstractmethod:

Detect if this Container can be used to open path.

The function checks wether file inside path is formatted in such a way that this Container can be used to read it. For example, it validates against the file extension.

Parameters:

  • path – A location to a file.

  • original – The original argument passed to detect().

Returns:

True if this Container can be used for this path, False otherwise.

abstract read(length: int = -1) → bytes

Read a length of bytes from this Container.

readinto(b: bytearray) → int

Uses dissect.target.helpers.utils.readinto().

abstract seek(offset: int, whence: int = io.SEEK_SET) → int

Change the stream position to offset.

whence determines where to seek from:

  • io.SEEK_SET (0):: absolute offset in the stream.

  • io.SEEK_CUR (1):: current position in the stream.

  • io.SEEK_END (2):: end of stream.

Parameters:

  • offset – The offset relative to the position indicated by whence.

  • whence – Where to start the seek from.

seekable() → bool

Returns whether seek can be used by this Container. Always True.

abstract tell() → int

Returns the current seek position of the Container.

close() → None

Close the container.

Override this if you need to clean-up anything.

dissect.target.container.register(module: str, class_name: str, internal: bool = True) → None

Register a container implementation to use when opening a container.

This function registers a container using module relative to the MODULE_PATH. It lazily imports the module, and retrieves the specific class from it.

Parameters:

  • module – The module where to find the container.

  • class_name – The class to load.

  • internal – Whether it is an internal module or not.

dissect.target.container.open(item: list | str | BinaryIO | pathlib.Path, *args, **kwargs) → Container

Open a Container from the given object.

All currently supported containers are checked to find a compatible one. RawContainer must always be checked last since it always succeeds!

Parameters:

item – The object we want to open a :class`Container` from.

Raises:

  • ContainerError – When a compatible :class`Container` was found but it failed to open.

  • ContainerError – When no compatible :class`Container` implementations were found.