dissect.target.containers.split#

Module Contents#

Classes#

SplitContainer

Base class that acts as a file-like object wrapper around anything that can behave like a "raw disk".

Functions#

dissect.target.containers.split.find_files(path: pathlib.Path) List[pathlib.Path]#
class dissect.target.containers.split.SplitContainer(fh: list | BinaryIO | pathlib.Path, *args, **kwargs)#

Bases: dissect.target.container.Container

Base class that acts as a file-like object wrapper around anything that can behave like a “raw disk”.

Containers are anything from raw disk images and virtual disks, to evidence containers and made-up binary formats. Consumers of the Container class only need to implement seek, tell and read. Override __init__ for any opening that you may need to do, but don’t forget to initialize the super class.

Parameters:
  • fh – The source file-like object of the container or a Path object to the file.

  • size – The size of the container.

  • vs – An optional shorthand to set the underlying volume system, usually set later.

__type__ = 'split'#
static detect_path(path: pathlib.Path, original: list | BinaryIO) bool#

Detect if this Container can be used to open path.

The function checks wether file inside path is formatted in such a way that this Container can be used to read it. For example, it validates against the file extension.

Parameters:
  • path – A location to a file.

  • original – The original argument passed to detect().

Returns:

True if this Container can be used for this path, False otherwise.

read(length: int) bytes#

Read a length of bytes from this Container.

seek(offset: int, whence: int = io.SEEK_SET) int#

Change the stream position to offset.

whence determines where to seek from:

  • io.SEEK_SET (0):: absolute offset in the stream.

  • io.SEEK_CUR (1):: current position in the stream.

  • io.SEEK_END (2):: end of stream.

Parameters:
  • offset – The offset relative to the position indicated by whence.

  • whence – Where to start the seek from.

tell() int#

Returns the current seek position of the Container.

close() None#

Close the container.

Override this if you need to clean-up anything.