dissect.target.filesystem

Module Contents

Classes

Filesystem	Base class for filesystems.
FilesystemEntry	Base class for filesystem entries.
VirtualDirectory	Virtual directory implementation. Backed by a dict.
VirtualFileHandle	Base class for raw binary I/O.
VirtualFile	Virtual file backed by a file-like object.
MappedFile	Virtual file backed by a file on the host machine.
VirtualSymlink	Virtual symlink implementation.
VirtualFilesystem	Base class for filesystems.
RootFilesystem	Base class for filesystems.
EntryList	Wrapper list for filesystem entries.
RootFilesystemEntry	Base class for filesystem entries.

Functions

register	Register a filesystem implementation to use when opening a filesystem.
open

Attributes

FILESYSTEMS
MODULE_PATH
log

dissect.target.filesystem.FILESYSTEMS: list[Type[Filesystem]] = []

dissect.target.filesystem.MODULE_PATH = 'dissect.target.filesystems'

dissect.target.filesystem.log

class dissect.target.filesystem.Filesystem(volume: BinaryIO | None, alt_separator: str = '', case_sensitive: bool = True)

Base class for filesystems.

__fstype__: str

Defines the type of filesystem it is.

__repr__() → str

Return repr(self).

path(*args) → dissect.target.helpers.fsutil.TargetPath

Get a specific path from the filesystem.

classmethod detect(fh: BinaryIO) → bool

Detect whether the fh file-handle is supported by this Filesystem implementation.

The position of fh will be restored before returning.

Parameters:

fh – A file-like object, usually a disk or partition.

Returns:

True if fh is supported, False otherwise.

abstract get(path: str) → FilesystemEntry

Retrieve a FilesystemEntry from the filesystem.

Parameters:

path – The path which we want to retrieve.

Returns:

A FilesystemEntry for the path.

open(path: str) → BinaryIO

Open a filesystem entry.

Parameters:

path – The location on the filesystem to open.

Returns:

A file-like object. Resolves symlinks when possible.

iterdir(path: str) → Iterator[str]

Iterate over the contents of a directory, return them as strings.

Parameters:

path – The location on the filesystem to iterate over.

Returns:

An iterator of directory entries as path strings.

scandir(path: str) → Iterator[FilesystemEntry]

Iterate over the contents of a directory, return them as FilesystemEntry’s.

Parameters:

path – The directory to scan.

Returns:

An iterator of directory entries as FilesystemEntry’s.

listdir(path: str) → List[str]

List the contents of a directory as strings.

Parameters:

path – The directory to get the listing from.

Returns:

A list of path strings.

listdir_ext(path: str) → List[FilesystemEntry]

List the contents of a directory as FilesystemEntry’s.

Parameters:

path – The directory to get the listing from.

Returns:

A list of FilesystemEntry’s.

walk(path: str, topdown: bool = True, onerror: Callable | None = None, followlinks: bool = False) → Iterator[str]

Walk a directory pointed to by path, returning the string representation of both files and directories.

It walks across all the files inside path recursively.

Parameters:

• path – The path to walk on the filesystem.

• topdown – True puts the path at the top, False puts the path at the bottom.

• onerror – A method to execute when an error occurs.

• followlinks – True if we want to follow any symbolic link.

Returns:

An iterator of directory entries as path strings.

walk_ext(path: str, topdown: bool = True, onerror: Callable | None = None, followlinks: bool = False) → Iterator[FilesystemEntry]

Walk a directory pointed to by path, returning FilesystemEntry’s of both files and directories.

It walks across all the files inside path recursively.

Parameters:

• path – The path to walk on the filesystem.

• topdown – True puts the path at the top, False puts the path at the bottom.

• onerror – A method to execute when an error occurs.

• followlinks – True if we want to follow any symbolic link.

Returns:

An iterator of directory entries as FilesystemEntry’s.

glob(pattern: str) → Iterator[str]

Iterate over the directory part of pattern, returning entries matching pattern as strings.

Parameters:

pattern – The pattern to match.

Returns:

An iterator of path strings that match the pattern.

glob_ext(pattern: str) → Iterator[FilesystemEntry]

Iterate over the directory part of pattern, returning entries matching pattern as FilesysmteEntry’s.

Parameters:

pattern – The pattern to match.

Returns:

An iterator of FilesystemEntry’s that match the pattern.

exists(path: str) → bool

Determines whether path exists on a filesystem.

If the path is a symbolic link, it will attempt to resolve it to find the FilesystemEntry it points to.

Parameters:

path – a path on the filesystem.

Returns:

True if the given path exists, False otherwise.

lexists(path: str) → bool

Determines if a path exists on the filesystem without resolving links.

Parameters:

path – A path on the filesystem.

Returns:

True if the given path is a file, False otherwise.

is_file(path: str, follow_symlinks: bool = True) → bool

Determine if path is a file on the filesystem.

Parameters:

• path – The path on the filesystem.

• follow_symlinks – Whether to resolve the path if it is a symbolic link.

Returns:

True if the given path is a file or a symbolic link to a file, return False otherwise. If follow_symlinks is False, return True only if the given path is a file (without following symlinks).

is_dir(path: str, follow_symlinks: bool = True) → bool

Determine whether the given path is a directory on the filesystem.

Parameters:

• path – The path on the filesystem.

• follow_symlinks – Whether to resolve the path if it is a symbolic link.

Returns:

True if the given path is a directory or a symbolic link to a directory, return False otherwise. If follow_symlinks is False, return True only if the given path is a directory (without following symlinks).

is_symlink(path: str) → bool

Determine wether the given path is a symlink on the filesystem.

Parameters:

path – The path on the filesystem.

Returns:

True if the given path is a symbolic link, False otherwise.

readlink(path: str) → str

Read the link where the given path points to, return the resulting path as string.

If it is a symlink and returns the string that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Parameters:

path – The symbolic link to read.

Returns:

The path the link points to.

readlink_ext(path: str) → FilesystemEntry

Read the link where the given path points to, return the resulting path as FilesystemEntry.

If it is a symlink and returns the entry that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Parameters:

path – The symbolic link to read.

Returns:

The FilesystemEntry where the symbolic link points to.

stat(path: str, follow_symlinks: bool = True) → dissect.target.helpers.fsutil.stat_result

Determine the stat information of a path on the filesystem.

If path is a symlink and follow_symlinks is True, it gets resolved, attempting to stat the path where it points to.

Parameters:

• path – The filesystem path we want the stat information from.

• follow_symlinks – Whether to resolve the path if it is a symbolic link.

Returns:

The stat information of the given path.

lstat(path: str) → dissect.target.helpers.fsutil.stat_result

Determine the stat information of a path on the filesystem, without resolving symlinks.

When it detects a symlink, it will stat the information of the symlink, not the path it points to.

Parameters:

path – The filesystem path we want the stat information from.

Returns:

The stat information of the given path.

md5(path: str) → str

Calculate the MD5 digest of the contents of the file path points to.

Parameters:

path – The filesystem path to get the digest from.

Returns:

The MD5 digest of the contents of path.

sha1(path: str) → str

Calculate the SHA1 digest of the contents of the file path points to.

Parameters:

path – The filesystem path to get the digest from.

Returns:

The SHA1 digest of the contents of path.

sha256(path: str) → str

Calculate the SHA256 digest of the contents of the file path points to.

Parameters:

path – The filesystem path to get the digest from.

Returns:

The SHA256 digest of the contents of path.

hash(path: str, algos: List[str] | List[Callable] | None = None) → tuple[str]

Calculate the digest of the contents of path, using the algos algorithms.

Parameters:

• path – The filesystem path to get the digest from.

• algos – The types of hashes to calculate. If None it will use the common set of algorithms defined in dissect.target.helpers.hashutil.common() as [MD5, SHA1, SHA256].

Returns:

The digests of the contents of path.

class dissect.target.filesystem.FilesystemEntry(fs: Filesystem, path: str, entry: Any)

Base class for filesystem entries.

__repr__() → str

Return repr(self).

__str__() → str

Return str(self).

abstract get(path: str) → FilesystemEntry

Retrieve a FilesystemEntry relative to this entry.

Parameters:

path – The path relative to this filesystem entry.

Returns:

A relative FilesystemEntry.

abstract open() → BinaryIO

Open this filesystem entry.

Returns:

A file-like object. Resolves symlinks when possible

abstract iterdir() → Iterator[str]

Iterate over the contents of a directory, return them as strings.

Returns:

An iterator of directory entries as path strings.

abstract scandir() → Iterator[FilesystemEntry]

Iterate over the contents of a directory, return them as FilesystemEntry’s.

Returns:

An iterator of directory entries as FilesystemEntry’s.

listdir() → List[str]

List the contents of a directory as strings.

Returns:

A list of path strings.

listdir_ext() → List[FilesystemEntry]

List the contents of a directory as FilesystemEntry’s.

Returns:

A list of FilesystemEntry’s.

walk(topdown: bool = True, onerror: Callable | None = None, followlinks: bool = False) → Iterator[str]

Walk a directory and list its contents as strings.

It walks across all the files inside the entry recursively.

These contents include::

• files

• directories

• symboliclinks

Parameters:

• topdown – True puts this entry at the top of the list, False puts this entry at the bottom.

• onerror – A method to execute when an error occurs.

• followlinks – True if we want to follow any symbolic link.

Returns:

An iterator of directory entries as path strings.

walk_ext(topdown: bool = True, onerror: Callable | None = None, followlinks: bool = False) → Iterator[FilesystemEntry]

Walk a directory and show its contents as FilesystemEntry’s.

It walks across all the files inside the entry recursively.

These contents include::

• files

• directories

• symboliclinks

Parameters:

• topdown – True puts this entry at the top of the list, False puts this entry at the bottom.

• onerror – A method to execute when an error occurs.

• followlinks – True if we want to follow any symbolic link

Returns:

An iterator of directory entries as FilesystemEntry’s.

glob(pattern) → Iterator[str]

Iterate over this directory part of patern, returning entries matching pattern as strings.

Parameters:

pattern – The pattern to match.

Returns:

An iterator of path strings that match the pattern.

glob_ext(pattern) → Iterator[FilesystemEntry]

Iterate over the directory part of pattern, returning entries matching pattern as FilesysmteEntry’s.

Parameters:

pattern – The pattern to glob for.

Returns:

An iterator of FilesystemEntry’s that match the pattern.

exists(path: str) → bool

Determines whether a path, relative to this entry, exists.

If the path is a symbolic link, it will attempt to resolve it to find the FilesystemEntry it points to.

Parameters:

path – The path relative to this entry.

Returns:

True if the path exists, False otherwise.

lexists(path: str) → bool

Determine wether a path relative to this enty, exists without resolving links.

Parameters:

path – The path relative to this entry.

Returns:

True if the path exists, False otherwise.

abstract is_file(follow_symlinks: bool = True) → bool

Determine if this entry is a file.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a file or a symbolic link to a file, return False otherwise. If follow_symlinks is False, return True only if the entry is a file (without following symlinks).

abstract is_dir(follow_symlinks: bool = True) → bool

Determine if this entry is a directory.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a directory or a symbolic link to a directory, return False otherwise. If follow_symlinks is False, return True only if the entry is a directory (without following symlinks).

abstract is_symlink() → bool

Determine whether this entry is a symlink.

Returns:

True if the entry is a symbolic link, False otherwise.

abstract readlink() → str

Read the link where this entry points to, return the resulting path as string.

If it is a symlink and returns the entry that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Returns:

The path the link points to.

readlink_ext() → FilesystemEntry

Read the link where this entry points to, return the resulting path as FilesystemEntry.

If it is a symlink and returns the string that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Returns:

The filesystem entry the link points to.

abstract stat(follow_symlinks: bool = True) → dissect.target.helpers.fsutil.stat_result

Determine the stat information of this entry.

If the entry is a symlink and follow_symlinks is True, it gets resolved, attempting to stat the path where it points to.

Parameters:

follow_symlinks – Whether to resolve the symbolic link if this entry is a symbolic link.

Returns:

The stat information of this entry.

abstract lstat() → dissect.target.helpers.fsutil.stat_result

Determine the stat information of this entry, without resolving the symlinks.

When it detects a symlink, it will stat the information of the symlink, not the path it points to.

Returns:

The stat information of this entry.

abstract attr() → Any

The attributes related to this entry, resolving any symlinks.

If the entry is a symbolic link, it will attempt to resolve it first. Resulting in the attr information of the entry it points to.

Returns:

The attributes of this entry.

abstract lattr() → Any

The attributes related to this current entry, without resolving links.

Returns:

The attributes of this entry.

md5() → str

Calculates the MD5 digest of this entry.

Returns:

The MD5 digest of this entry.

sha1() → str

Calculates the SHA1 digest of this entry.

Returns:

The SHA1 digest of this entry.

sha256() → str

Calculates the SHA256 digest of this entry.

Returns:

The SHA256 digest of this entry.

hash(algos: List[str] | List[Callable] | None = None) → tuple[str]

Calculate the digest of this entry, using the algos algorithms.

Parameters:

algos – The types of hashes to calculate. If None it will use the common set of algorithms defined in dissect.target.helpers.hashutil.common() as [MD5, SHA1, SHA256].

Returns:

The various digests of this entry.

class dissect.target.filesystem.VirtualDirectory(fs, path)

Bases: FilesystemEntry

Virtual directory implementation. Backed by a dict.

__getitem__(item) → FilesystemEntry

__contains__(item) → bool

open() → BinaryIO

Open this filesystem entry.

Returns:

A file-like object. Resolves symlinks when possible

attr() → Any

The attributes related to this entry, resolving any symlinks.

If the entry is a symbolic link, it will attempt to resolve it first. Resulting in the attr information of the entry it points to.

Returns:

The attributes of this entry.

lattr() → Any

The attributes related to this current entry, without resolving links.

Returns:

The attributes of this entry.

add(name: str, entry: FilesystemEntry) → None

Add an entry to this VirtualDirectory.

get(path: str) → FilesystemEntry

Retrieve a FilesystemEntry relative to this entry.

Parameters:

path – The path relative to this filesystem entry.

Returns:

A relative FilesystemEntry.

iterdir() → Iterator[str]

Iterate over the contents of a directory, return them as strings.

Returns:

An iterator of directory entries as path strings.

scandir() → Iterator[FilesystemEntry]

Iterate over the contents of a directory, return them as FilesystemEntry’s.

Returns:

An iterator of directory entries as FilesystemEntry’s.

stat(follow_symlinks: bool = True) → dissect.target.helpers.fsutil.stat_result

Determine the stat information of this entry.

If the entry is a symlink and follow_symlinks is True, it gets resolved, attempting to stat the path where it points to.

Parameters:

follow_symlinks – Whether to resolve the symbolic link if this entry is a symbolic link.

Returns:

The stat information of this entry.

lstat() → dissect.target.helpers.fsutil.stat_result

Determine the stat information of this entry, without resolving the symlinks.

When it detects a symlink, it will stat the information of the symlink, not the path it points to.

Returns:

The stat information of this entry.

is_dir(follow_symlinks: bool = True) → bool

Determine if this entry is a directory.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a directory or a symbolic link to a directory, return False otherwise. If follow_symlinks is False, return True only if the entry is a directory (without following symlinks).

is_file(follow_symlinks: bool = True) → bool

Determine if this entry is a file.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a file or a symbolic link to a file, return False otherwise. If follow_symlinks is False, return True only if the entry is a file (without following symlinks).

is_symlink() → bool

Determine whether this entry is a symlink.

Returns:

True if the entry is a symbolic link, False otherwise.

readlink() → str

Read the link where this entry points to, return the resulting path as string.

If it is a symlink and returns the entry that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Returns:

The path the link points to.

readlink_ext() → FilesystemEntry

Read the link where this entry points to, return the resulting path as FilesystemEntry.

If it is a symlink and returns the string that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Returns:

The filesystem entry the link points to.

class dissect.target.filesystem.VirtualFileHandle(fh: BinaryIO)

Bases: io.RawIOBase

Base class for raw binary I/O.

readinto(b: bytearray) → int

seek(offset: int, whence: int = io.SEEK_SET) → int

Change stream position.

Change the stream position to the given byte offset. The offset is interpreted relative to the position indicated by whence. Values for whence are:

• 0 – start of stream (the default); offset should be zero or positive

• 1 – current stream position; offset may be negative

• 2 – end of stream; offset is usually negative

Return the new absolute position.

readable() → bool

Return whether object was opened for reading.

If False, read() will raise OSError.

seekable() → bool

Return whether object supports random access.

If False, seek(), tell() and truncate() will raise OSError. This method may need to do a test seek().

class dissect.target.filesystem.VirtualFile(fs: Filesystem, path: str, entry: Any)

Bases: FilesystemEntry

Virtual file backed by a file-like object.

attr() → Any

The attributes related to this entry, resolving any symlinks.

If the entry is a symbolic link, it will attempt to resolve it first. Resulting in the attr information of the entry it points to.

Returns:

The attributes of this entry.

lattr() → Any

The attributes related to this current entry, without resolving links.

Returns:

The attributes of this entry.

get(path: str) → FilesystemEntry

Retrieve a FilesystemEntry relative to this entry.

Parameters:

path – The path relative to this filesystem entry.

Returns:

A relative FilesystemEntry.

iterdir() → Iterator[str]

Iterate over the contents of a directory, return them as strings.

Returns:

An iterator of directory entries as path strings.

scandir() → Iterator[FilesystemEntry]

Iterate over the contents of a directory, return them as FilesystemEntry’s.

Returns:

An iterator of directory entries as FilesystemEntry’s.

open() → BinaryIO

Open this filesystem entry.

Returns:

A file-like object. Resolves symlinks when possible

stat(follow_symlinks: bool = True) → dissect.target.helpers.fsutil.stat_result

Determine the stat information of this entry.

If the entry is a symlink and follow_symlinks is True, it gets resolved, attempting to stat the path where it points to.

Parameters:

follow_symlinks – Whether to resolve the symbolic link if this entry is a symbolic link.

Returns:

The stat information of this entry.

lstat() → dissect.target.helpers.fsutil.stat_result

Determine the stat information of this entry, without resolving the symlinks.

When it detects a symlink, it will stat the information of the symlink, not the path it points to.

Returns:

The stat information of this entry.

is_dir(follow_symlinks: bool = True) → bool

Determine if this entry is a directory.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a directory or a symbolic link to a directory, return False otherwise. If follow_symlinks is False, return True only if the entry is a directory (without following symlinks).

is_file(follow_symlinks: bool = True) → bool

Determine if this entry is a file.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a file or a symbolic link to a file, return False otherwise. If follow_symlinks is False, return True only if the entry is a file (without following symlinks).

is_symlink() → bool

Determine whether this entry is a symlink.

Returns:

True if the entry is a symbolic link, False otherwise.

readlink() → str

Read the link where this entry points to, return the resulting path as string.

If it is a symlink and returns the entry that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Returns:

The path the link points to.

readlink_ext() → FilesystemEntry

Read the link where this entry points to, return the resulting path as FilesystemEntry.

If it is a symlink and returns the string that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Returns:

The filesystem entry the link points to.

class dissect.target.filesystem.MappedFile(fs: Filesystem, path: str, entry: Any)

Bases: VirtualFile

Virtual file backed by a file on the host machine.

open() → BinaryIO

Open this filesystem entry.

Returns:

A file-like object. Resolves symlinks when possible

stat(follow_symlinks: bool = True) → dissect.target.helpers.fsutil.stat_result

Determine the stat information of this entry.

If the entry is a symlink and follow_symlinks is True, it gets resolved, attempting to stat the path where it points to.

Parameters:

follow_symlinks – Whether to resolve the symbolic link if this entry is a symbolic link.

Returns:

The stat information of this entry.

lstat() → dissect.target.helpers.fsutil.stat_result

Determine the stat information of this entry, without resolving the symlinks.

When it detects a symlink, it will stat the information of the symlink, not the path it points to.

Returns:

The stat information of this entry.

attr() → dict[str, bytes]

The attributes related to this entry, resolving any symlinks.

If the entry is a symbolic link, it will attempt to resolve it first. Resulting in the attr information of the entry it points to.

Returns:

The attributes of this entry.

lattr() → dict[str, bytes]

The attributes related to this current entry, without resolving links.

Returns:

The attributes of this entry.

class dissect.target.filesystem.VirtualSymlink(fs: Filesystem, path: str, target: str)

Bases: FilesystemEntry

Virtual symlink implementation.

attr() → Any

The attributes related to this entry, resolving any symlinks.

If the entry is a symbolic link, it will attempt to resolve it first. Resulting in the attr information of the entry it points to.

Returns:

The attributes of this entry.

lattr() → Any

The attributes related to this current entry, without resolving links.

Returns:

The attributes of this entry.

get(path) → FilesystemEntry

Retrieve a FilesystemEntry relative to this entry.

Parameters:

path – The path relative to this filesystem entry.

Returns:

A relative FilesystemEntry.

iterdir() → Iterator[str]

Iterate over the contents of a directory, return them as strings.

Returns:

An iterator of directory entries as path strings.

scandir() → Iterator[FilesystemEntry]

Iterate over the contents of a directory, return them as FilesystemEntry’s.

Returns:

An iterator of directory entries as FilesystemEntry’s.

open() → BinaryIO

Open this filesystem entry.

Returns:

A file-like object. Resolves symlinks when possible

stat(follow_symlinks: bool = True) → dissect.target.helpers.fsutil.stat_result

Determine the stat information of this entry.

If the entry is a symlink and follow_symlinks is True, it gets resolved, attempting to stat the path where it points to.

Parameters:

follow_symlinks – Whether to resolve the symbolic link if this entry is a symbolic link.

Returns:

The stat information of this entry.

lstat() → dissect.target.helpers.fsutil.stat_result

Determine the stat information of this entry, without resolving the symlinks.

When it detects a symlink, it will stat the information of the symlink, not the path it points to.

Returns:

The stat information of this entry.

is_dir(follow_symlinks: bool = True) → bool

Determine if this entry is a directory.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a directory or a symbolic link to a directory, return False otherwise. If follow_symlinks is False, return True only if the entry is a directory (without following symlinks).

is_file(follow_symlinks: bool = True) → bool

Determine if this entry is a file.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a file or a symbolic link to a file, return False otherwise. If follow_symlinks is False, return True only if the entry is a file (without following symlinks).

is_symlink() → bool

Determine whether this entry is a symlink.

Returns:

True if the entry is a symbolic link, False otherwise.

readlink() → str

Read the link where this entry points to, return the resulting path as string.

If it is a symlink and returns the entry that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Returns:

The path the link points to.

class dissect.target.filesystem.VirtualFilesystem(**kwargs)

Bases: Filesystem

Base class for filesystems.

__fstype__ = 'virtual'

mount

static detect(fh: BinaryIO) → bool

Detect whether the fh file-handle is supported by this Filesystem implementation.

The position of fh will be restored before returning.

Parameters:

fh – A file-like object, usually a disk or partition.

Returns:

True if fh is supported, False otherwise.

get(path: str, relentry: FilesystemEntry = None) → FilesystemEntry

Retrieve a FilesystemEntry from the filesystem.

Parameters:

path – The path which we want to retrieve.

Returns:

A FilesystemEntry for the path.

makedirs(path: str) → VirtualDirectory

Create virtual directories into the VFS from the given path.

map_fs(vfspath: str, fs: Filesystem) → None

Mount a dissect filesystem to a directory in the VFS

map_dir(vfspath: str, realpath: str) → None

Recursively map a directory from the host machine into the VFS.

map_file(vfspath: str, realpath: str) → None

Map a file from the host machine into the VFS.

map_file_fh(vfspath: str, fh: BinaryIO) → None

Map a file handle into the VFS.

map_file_entry(vfspath: str, entry: FilesystemEntry) → None

Map a FilesystemEntry into the VFS.

Any missing subdirectories up to, but not including, the last part of vfspath will be created.

link(src: str, dst: str) → None

Hard link a FilesystemEntry to another location.

symlink(src: str, dst: str) → None

Create a symlink to another location.

class dissect.target.filesystem.RootFilesystem(target: dissect.target.target.Target)

Bases: Filesystem

Base class for filesystems.

property case_sensitive: bool

property alt_separator: str

__fstype__ = 'root'

static detect(fh: BinaryIO) → bool

Detect whether the fh file-handle is supported by this Filesystem implementation.

The position of fh will be restored before returning.

Parameters:

fh – A file-like object, usually a disk or partition.

Returns:

True if fh is supported, False otherwise.

mount(path: str, fs: Filesystem) → None

Mount a filesystem at a given path.

If there’s an overlap with an existing mount, creates a new layer.

link(dst: str, src: str) → None

Hard link a RootFilesystemEntry to another location.

symlink(dst: str, src: str) → None

Create a symlink to another location.

add_layer(**kwargs) → VirtualFilesystem

get(path: str, relentry: FilesystemEntry = None) → FilesystemEntry

Retrieve a FilesystemEntry from the filesystem.

Parameters:

path – The path which we want to retrieve.

Returns:

A FilesystemEntry for the path.

class dissect.target.filesystem.EntryList(value: Any)

Bases: list

Wrapper list for filesystem entries.

Expose a getattr on a list of items. Useful in cases where there’s a virtual filesystem entry as well as a real one.

__getattr__(attr: str) → Any

class dissect.target.filesystem.RootFilesystemEntry(fs: Filesystem, path: str, entry: FilesystemEntry)

Bases: FilesystemEntry

Base class for filesystem entries.

__getattr__(attr)

get(path: str) → FilesystemEntry

Retrieve a FilesystemEntry relative to this entry.

Parameters:

path – The path relative to this filesystem entry.

Returns:

A relative FilesystemEntry.

open() → BinaryIO

Open this filesystem entry.

Returns:

A file-like object. Resolves symlinks when possible

iterdir() → Iterator[str]

Iterate over the contents of a directory, return them as strings.

Returns:

An iterator of directory entries as path strings.

scandir() → Iterator[FilesystemEntry]

Iterate over the contents of a directory, return them as FilesystemEntry’s.

Returns:

An iterator of directory entries as FilesystemEntry’s.

is_file(follow_symlinks: bool = True) → bool

Determine if this entry is a file.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a file or a symbolic link to a file, return False otherwise. If follow_symlinks is False, return True only if the entry is a file (without following symlinks).

is_dir(follow_symlinks: bool = True) → bool

Determine if this entry is a directory.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a directory or a symbolic link to a directory, return False otherwise. If follow_symlinks is False, return True only if the entry is a directory (without following symlinks).

is_symlink() → bool

Determine whether this entry is a symlink.

Returns:

True if the entry is a symbolic link, False otherwise.

readlink() → str

Read the link where this entry points to, return the resulting path as string.

If it is a symlink and returns the entry that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Returns:

The path the link points to.

stat(follow_symlinks: bool = True) → dissect.target.helpers.fsutil.stat_result

Determine the stat information of this entry.

If the entry is a symlink and follow_symlinks is True, it gets resolved, attempting to stat the path where it points to.

Parameters:

follow_symlinks – Whether to resolve the symbolic link if this entry is a symbolic link.

Returns:

The stat information of this entry.

lstat() → dissect.target.helpers.fsutil.stat_result

Determine the stat information of this entry, without resolving the symlinks.

When it detects a symlink, it will stat the information of the symlink, not the path it points to.

Returns:

The stat information of this entry.

attr() → Any

The attributes related to this entry, resolving any symlinks.

If the entry is a symbolic link, it will attempt to resolve it first. Resulting in the attr information of the entry it points to.

Returns:

The attributes of this entry.

lattr() → Any

The attributes related to this current entry, without resolving links.

Returns:

The attributes of this entry.

dissect.target.filesystem.register(module: str, class_name: str, internal: bool = True) → None

Register a filesystem implementation to use when opening a filesystem.

This function registers a filesystem using module relative to the MODULE_PATH. It lazily imports the module, and retrieves the specific class from it.

Parameters:

• module – The module where to find the filesystem.

• class_name – The class to load.

• internal – Whether it is an internal module or not.

dissect.target.filesystem.open(fh: BinaryIO, *args, **kwargs) → Filesystem