dissect.target.containers.raw#

Module Contents#

Classes#

RawContainer

Base class that acts as a file-like object wrapper around anything that can behave like a "raw disk".
class dissect.target.containers.raw.RawContainer(fh: Union[BinaryIO, pathlib.Path], *args, **kwargs)#

Bases: dissect.target.container.Container

Base class that acts as a file-like object wrapper around anything that can behave like a “raw disk”.

Containers are anything from raw disk images and virtual disks, to evidence containers and made-up binary formats. Consumers of the Container class only need to implement seek, tell and read. Override __init__ for any opening that you may need to do, but don’t forget to initialize the super class.

Parameters:

  • fh – The source file-like object of the container or a Path object to the file.

  • size – The size of the container.

  • vs – An optional shorthand to set the underlying volume system, usually set later.

static detect_fh(fh: BinaryIO, original: Union[list, BinaryIO]) → bool#

Detect if this Container can be used to open the file-like object fh.

The function checks wether the raw data contains any magic information that corresponds to this specific container.

Parameters:

  • fh – A file-like object that we want to open a Container on.

  • original – The original argument passed to detect().

Returns:

True if this Container can be used for this file-like object, False otherwise.

static detect_path(path: pathlib.Path, original: Union[list, BinaryIO]) → bool#

Detect if this Container can be used to open path.

The function checks wether file inside path is formatted in such a way that this Container can be used to read it. For example, it validates against the file extension.

Parameters:

  • path – A location to a file.

  • original – The original argument passed to detect().

Returns:

True if this Container can be used for this path, False otherwise.