dissect.target.filesystem#

Module Contents#

Classes#

Filesystem

Base class for filesystems.

FilesystemEntry

Base class for filesystem entries.

VirtualDirectory

Virtual directory implementation. Backed by a dict.

VirtualFileHandle

Base class for raw binary I/O.

VirtualFile

Virtual file backed by a file-like object.

MappedFile

Virtual file backed by a file on the host machine.

MappedCompressedFile

Virtual file backed by a compressed file on the host machine.

VirtualSymlink

Virtual symlink implementation.

VirtualFilesystem

Base class for filesystems.

RootFilesystem

Base class for filesystems.

EntryList

Wrapper list for filesystem entries.

RootFilesystemEntry

Base class for filesystem entries.

Functions#

register

Register a filesystem implementation to use when opening a filesystem.

is_multi_volume_filesystem

open

open_multi_volume

Attributes#

dissect.target.filesystem.TarFilesystem#
dissect.target.filesystem.FILESYSTEMS: list[Type[Filesystem]] = []#
dissect.target.filesystem.MODULE_PATH = 'dissect.target.filesystems'#
dissect.target.filesystem.log#
class dissect.target.filesystem.Filesystem(volume: BinaryIO | list[BinaryIO] | None = None, alt_separator: str = '', case_sensitive: bool = True)#

Base class for filesystems.

class property __fstype__: str#
__type__: str#

A short string identifying the type of filesystem.

__multi_volume__: bool = False#

Whether this filesystem supports multiple volumes (disks).

__repr__() str#

Return repr(self).

path(*args) dissect.target.helpers.fsutil.TargetPath#

Instantiate a new path-like object on this filesystem.

classmethod detect(fh: BinaryIO) bool#

Detect whether the fh file-handle is supported by this Filesystem implementation.

The position of fh will be restored before returning.

Parameters:

fh – A file-like object, usually a disk or partition.

Returns:

True if fh is supported, False otherwise.

classmethod detect_id(fh: BinaryIO) bytes | None#

Return a filesystem set identifier.

Only used in filesystems that support multiple volumes (disks) to find all volumes belonging to a single filesystem.

Parameters:

fh – A file-like object, usually a disk or partition.

iter_subfs() Iterator[Filesystem]#

Yield possible sub-filesystems.

abstract get(path: str) FilesystemEntry#

Retrieve a FilesystemEntry from the filesystem.

Parameters:

path – The path which we want to retrieve.

Returns:

A FilesystemEntry for the path.

open(path: str) BinaryIO#

Open a filesystem entry.

Parameters:

path – The location on the filesystem to open.

Returns:

A file-like object. Resolves symlinks when possible.

iterdir(path: str) Iterator[str]#

Iterate over the contents of a directory, return them as strings.

Parameters:

path – The location on the filesystem to iterate over.

Returns:

An iterator of directory entries as path strings.

scandir(path: str) Iterator[FilesystemEntry]#

Iterate over the contents of a directory, return them as FilesystemEntry’s.

Parameters:

path – The directory to scan.

Returns:

An iterator of directory entries as FilesystemEntry’s.

listdir(path: str) list[str]#

List the contents of a directory as strings.

Parameters:

path – The directory to get the listing from.

Returns:

A list of path strings.

listdir_ext(path: str) list[FilesystemEntry]#

List the contents of a directory as FilesystemEntry’s.

Parameters:

path – The directory to get the listing from.

Returns:

A list of FilesystemEntry’s.

walk(path: str, topdown: bool = True, onerror: Callable | None = None, followlinks: bool = False) Iterator[str]#

Walk a directory pointed to by path, returning the string representation of both files and directories.

It walks across all the files inside path recursively.

Parameters:
  • path – The path to walk on the filesystem.

  • topdownTrue puts the path at the top, False puts the path at the bottom.

  • onerror – A method to execute when an error occurs.

  • followlinksTrue if we want to follow any symbolic link.

Returns:

An iterator of directory entries as path strings.

walk_ext(path: str, topdown: bool = True, onerror: Callable | None = None, followlinks: bool = False) Iterator[FilesystemEntry]#

Walk a directory pointed to by path, returning FilesystemEntry’s of both files and directories.

It walks across all the files inside path recursively.

Parameters:
  • path – The path to walk on the filesystem.

  • topdownTrue puts the path at the top, False puts the path at the bottom.

  • onerror – A method to execute when an error occurs.

  • followlinksTrue if we want to follow any symbolic link.

Returns:

An iterator of directory entries as FilesystemEntry’s.

glob(pattern: str) Iterator[str]#

Iterate over the directory part of pattern, returning entries matching pattern as strings.

Parameters:

pattern – The pattern to match.

Returns:

An iterator of path strings that match the pattern.

glob_ext(pattern: str) Iterator[FilesystemEntry]#

Iterate over the directory part of pattern, returning entries matching pattern as FilesysmteEntry’s.

Parameters:

pattern – The pattern to match.

Returns:

An iterator of FilesystemEntry’s that match the pattern.

exists(path: str) bool#

Determines whether path exists on a filesystem.

If the path is a symbolic link, it will attempt to resolve it to find the FilesystemEntry it points to.

Parameters:

path – a path on the filesystem.

Returns:

True if the given path exists, False otherwise.

lexists(path: str) bool#

Determines if a path exists on the filesystem without resolving links.

Parameters:

path – A path on the filesystem.

Returns:

True if the given path is a file, False otherwise.

is_file(path: str, follow_symlinks: bool = True) bool#

Determine if path is a file on the filesystem.

Parameters:
  • path – The path on the filesystem.

  • follow_symlinks – Whether to resolve the path if it is a symbolic link.

Returns:

True if the given path is a file or a symbolic link to a file, return False otherwise. If follow_symlinks is False, return True only if the given path is a file (without following symlinks).

is_dir(path: str, follow_symlinks: bool = True) bool#

Determine whether the given path is a directory on the filesystem.

Parameters:
  • path – The path on the filesystem.

  • follow_symlinks – Whether to resolve the path if it is a symbolic link.

Returns:

True if the given path is a directory or a symbolic link to a directory, return False otherwise. If follow_symlinks is False, return True only if the given path is a directory (without following symlinks).

Determine wether the given path is a symlink on the filesystem.

Parameters:

path – The path on the filesystem.

Returns:

True if the given path is a symbolic link, False otherwise.

Read the link where the given path points to, return the resulting path as string.

If it is a symlink and returns the string that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Parameters:

path – The symbolic link to read.

Returns:

The path the link points to.

Read the link where the given path points to, return the resulting path as FilesystemEntry.

If it is a symlink and returns the entry that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Parameters:

path – The symbolic link to read.

Returns:

The FilesystemEntry where the symbolic link points to.

stat(path: str, follow_symlinks: bool = True) dissect.target.helpers.fsutil.stat_result#

Determine the stat information of a path on the filesystem.

If path is a symlink and follow_symlinks is True, it gets resolved, attempting to stat the path where it points to.

Parameters:
  • path – The filesystem path we want the stat information from.

  • follow_symlinks – Whether to resolve the path if it is a symbolic link.

Returns:

The stat information of the given path.

lstat(path: str) dissect.target.helpers.fsutil.stat_result#

Determine the stat information of a path on the filesystem, without resolving symlinks.

When it detects a symlink, it will stat the information of the symlink, not the path it points to.

Parameters:

path – The filesystem path we want the stat information from.

Returns:

The stat information of the given path.

md5(path: str) str#

Calculate the MD5 digest of the contents of the file path points to.

Parameters:

path – The filesystem path to get the digest from.

Returns:

The MD5 digest of the contents of path.

sha1(path: str) str#

Calculate the SHA1 digest of the contents of the file path points to.

Parameters:

path – The filesystem path to get the digest from.

Returns:

The SHA1 digest of the contents of path.

sha256(path: str) str#

Calculate the SHA256 digest of the contents of the file path points to.

Parameters:

path – The filesystem path to get the digest from.

Returns:

The SHA256 digest of the contents of path.

hash(path: str, algos: list[str] | list[Callable] | None = None) tuple[str]#

Calculate the digest of the contents of path, using the algos algorithms.

Parameters:
  • path – The filesystem path to get the digest from.

  • algos – The types of hashes to calculate. If None it will use the common set of algorithms defined in dissect.target.helpers.hashutil.common() as [MD5, SHA1, SHA256].

Returns:

The digests of the contents of path.

class dissect.target.filesystem.FilesystemEntry(fs: Filesystem, path: str, entry: Any)#

Base class for filesystem entries.

__repr__() str#

Return repr(self).

__str__() str#

Return str(self).

abstract get(path: str) FilesystemEntry#

Retrieve a FilesystemEntry relative to this entry.

Parameters:

path – The path relative to this filesystem entry.

Returns:

A relative FilesystemEntry.

abstract open() BinaryIO#

Open this filesystem entry.

Returns:

A file-like object. Resolves symlinks when possible

abstract iterdir() Iterator[str]#

Iterate over the contents of a directory, return them as strings.

Returns:

An iterator of directory entries as path strings.

abstract scandir() Iterator[FilesystemEntry]#

Iterate over the contents of a directory, return them as FilesystemEntry’s.

Returns:

An iterator of directory entries as FilesystemEntry’s.

listdir() list[str]#

List the contents of a directory as strings.

Returns:

A list of path strings.

listdir_ext() list[FilesystemEntry]#

List the contents of a directory as FilesystemEntry’s.

Returns:

A list of FilesystemEntry’s.

walk(topdown: bool = True, onerror: Callable | None = None, followlinks: bool = False) Iterator[str]#

Walk a directory and list its contents as strings.

It walks across all the files inside the entry recursively.

These contents include::
  • files

  • directories

  • symboliclinks

Parameters:
  • topdownTrue puts this entry at the top of the list, False puts this entry at the bottom.

  • onerror – A method to execute when an error occurs.

  • followlinksTrue if we want to follow any symbolic link.

Returns:

An iterator of directory entries as path strings.

walk_ext(topdown: bool = True, onerror: Callable | None = None, followlinks: bool = False) Iterator[FilesystemEntry]#

Walk a directory and show its contents as FilesystemEntry’s.

It walks across all the files inside the entry recursively.

These contents include::
  • files

  • directories

  • symboliclinks

Parameters:
  • topdownTrue puts this entry at the top of the list, False puts this entry at the bottom.

  • onerror – A method to execute when an error occurs.

  • followlinksTrue if we want to follow any symbolic link

Returns:

An iterator of directory entries as FilesystemEntry’s.

glob(pattern) Iterator[str]#

Iterate over this directory part of patern, returning entries matching pattern as strings.

Parameters:

pattern – The pattern to match.

Returns:

An iterator of path strings that match the pattern.

glob_ext(pattern) Iterator[FilesystemEntry]#

Iterate over the directory part of pattern, returning entries matching pattern as FilesysmteEntry’s.

Parameters:

pattern – The pattern to glob for.

Returns:

An iterator of FilesystemEntry’s that match the pattern.

exists(path: str) bool#

Determines whether a path, relative to this entry, exists.

If the path is a symbolic link, it will attempt to resolve it to find the FilesystemEntry it points to.

Parameters:

path – The path relative to this entry.

Returns:

True if the path exists, False otherwise.

lexists(path: str) bool#

Determine wether a path relative to this enty, exists without resolving links.

Parameters:

path – The path relative to this entry.

Returns:

True if the path exists, False otherwise.

abstract is_file(follow_symlinks: bool = True) bool#

Determine if this entry is a file.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a file or a symbolic link to a file, return False otherwise. If follow_symlinks is False, return True only if the entry is a file (without following symlinks).

abstract is_dir(follow_symlinks: bool = True) bool#

Determine if this entry is a directory.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a directory or a symbolic link to a directory, return False otherwise. If follow_symlinks is False, return True only if the entry is a directory (without following symlinks).

Determine whether this entry is a symlink.

Returns:

True if the entry is a symbolic link, False otherwise.

Read the link where this entry points to, return the resulting path as string.

If it is a symlink and returns the entry that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Returns:

The path the link points to.

Read the link where this entry points to, return the resulting path as FilesystemEntry.

If it is a symlink and returns the string that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Returns:

The filesystem entry the link points to.

abstract stat(follow_symlinks: bool = True) dissect.target.helpers.fsutil.stat_result#

Determine the stat information of this entry.

If the entry is a symlink and follow_symlinks is True, it gets resolved, attempting to stat the path where it points to.

Parameters:

follow_symlinks – Whether to resolve the symbolic link if this entry is a symbolic link.

Returns:

The stat information of this entry.

abstract lstat() dissect.target.helpers.fsutil.stat_result#

Determine the stat information of this entry, without resolving the symlinks.

When it detects a symlink, it will stat the information of the symlink, not the path it points to.

Returns:

The stat information of this entry.

abstract attr() Any#

The attributes related to this entry, resolving any symlinks.

If the entry is a symbolic link, it will attempt to resolve it first. Resulting in the attr information of the entry it points to.

Returns:

The attributes of this entry.

abstract lattr() Any#

The attributes related to this current entry, without resolving links.

Returns:

The attributes of this entry.

md5() str#

Calculates the MD5 digest of this entry.

Returns:

The MD5 digest of this entry.

sha1() str#

Calculates the SHA1 digest of this entry.

Returns:

The SHA1 digest of this entry.

sha256() str#

Calculates the SHA256 digest of this entry.

Returns:

The SHA256 digest of this entry.

hash(algos: list[str] | list[Callable] | None = None) tuple[str]#

Calculate the digest of this entry, using the algos algorithms.

Parameters:

algos – The types of hashes to calculate. If None it will use the common set of algorithms defined in dissect.target.helpers.hashutil.common() as [MD5, SHA1, SHA256].

Returns:

The various digests of this entry.

class dissect.target.filesystem.VirtualDirectory(fs, path)#

Bases: FilesystemEntry

Virtual directory implementation. Backed by a dict.

__getitem__(item) FilesystemEntry#
__contains__(item) bool#
open() BinaryIO#

Open this filesystem entry.

Returns:

A file-like object. Resolves symlinks when possible

attr() Any#

The attributes related to this entry, resolving any symlinks.

If the entry is a symbolic link, it will attempt to resolve it first. Resulting in the attr information of the entry it points to.

Returns:

The attributes of this entry.

lattr() Any#

The attributes related to this current entry, without resolving links.

Returns:

The attributes of this entry.

add(name: str, entry: FilesystemEntry) None#

Add an entry to this VirtualDirectory.

get(path: str) FilesystemEntry#

Retrieve a FilesystemEntry relative to this entry.

Parameters:

path – The path relative to this filesystem entry.

Returns:

A relative FilesystemEntry.

iterdir() Iterator[str]#

Iterate over the contents of a directory, return them as strings.

Returns:

An iterator of directory entries as path strings.

scandir() Iterator[FilesystemEntry]#

Iterate over the contents of a directory, return them as FilesystemEntry’s.

Returns:

An iterator of directory entries as FilesystemEntry’s.

stat(follow_symlinks: bool = True) dissect.target.helpers.fsutil.stat_result#

Determine the stat information of this entry.

If the entry is a symlink and follow_symlinks is True, it gets resolved, attempting to stat the path where it points to.

Parameters:

follow_symlinks – Whether to resolve the symbolic link if this entry is a symbolic link.

Returns:

The stat information of this entry.

lstat() dissect.target.helpers.fsutil.stat_result#

Determine the stat information of this entry, without resolving the symlinks.

When it detects a symlink, it will stat the information of the symlink, not the path it points to.

Returns:

The stat information of this entry.

is_dir(follow_symlinks: bool = True) bool#

Determine if this entry is a directory.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a directory or a symbolic link to a directory, return False otherwise. If follow_symlinks is False, return True only if the entry is a directory (without following symlinks).

is_file(follow_symlinks: bool = True) bool#

Determine if this entry is a file.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a file or a symbolic link to a file, return False otherwise. If follow_symlinks is False, return True only if the entry is a file (without following symlinks).

Determine whether this entry is a symlink.

Returns:

True if the entry is a symbolic link, False otherwise.

Read the link where this entry points to, return the resulting path as string.

If it is a symlink and returns the entry that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Returns:

The path the link points to.

Read the link where this entry points to, return the resulting path as FilesystemEntry.

If it is a symlink and returns the string that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Returns:

The filesystem entry the link points to.

class dissect.target.filesystem.VirtualFileHandle(fh: BinaryIO)#

Bases: io.RawIOBase

Base class for raw binary I/O.

readinto(b: bytearray) int#
seek(offset: int, whence: int = io.SEEK_SET) int#

Change stream position.

Change the stream position to the given byte offset. The offset is interpreted relative to the position indicated by whence. Values for whence are:

  • 0 – start of stream (the default); offset should be zero or positive

  • 1 – current stream position; offset may be negative

  • 2 – end of stream; offset is usually negative

Return the new absolute position.

readable() bool#

Return whether object was opened for reading.

If False, read() will raise OSError.

seekable() bool#

Return whether object supports random access.

If False, seek(), tell() and truncate() will raise OSError. This method may need to do a test seek().

class dissect.target.filesystem.VirtualFile(fs: Filesystem, path: str, entry: Any)#

Bases: FilesystemEntry

Virtual file backed by a file-like object.

attr() Any#

The attributes related to this entry, resolving any symlinks.

If the entry is a symbolic link, it will attempt to resolve it first. Resulting in the attr information of the entry it points to.

Returns:

The attributes of this entry.

lattr() Any#

The attributes related to this current entry, without resolving links.

Returns:

The attributes of this entry.

get(path: str) FilesystemEntry#

Retrieve a FilesystemEntry relative to this entry.

Parameters:

path – The path relative to this filesystem entry.

Returns:

A relative FilesystemEntry.

iterdir() Iterator[str]#

Iterate over the contents of a directory, return them as strings.

Returns:

An iterator of directory entries as path strings.

scandir() Iterator[FilesystemEntry]#

Iterate over the contents of a directory, return them as FilesystemEntry’s.

Returns:

An iterator of directory entries as FilesystemEntry’s.

open() BinaryIO#

Open this filesystem entry.

Returns:

A file-like object. Resolves symlinks when possible

stat(follow_symlinks: bool = True) dissect.target.helpers.fsutil.stat_result#

Determine the stat information of this entry.

If the entry is a symlink and follow_symlinks is True, it gets resolved, attempting to stat the path where it points to.

Parameters:

follow_symlinks – Whether to resolve the symbolic link if this entry is a symbolic link.

Returns:

The stat information of this entry.

lstat() dissect.target.helpers.fsutil.stat_result#

Determine the stat information of this entry, without resolving the symlinks.

When it detects a symlink, it will stat the information of the symlink, not the path it points to.

Returns:

The stat information of this entry.

is_dir(follow_symlinks: bool = True) bool#

Determine if this entry is a directory.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a directory or a symbolic link to a directory, return False otherwise. If follow_symlinks is False, return True only if the entry is a directory (without following symlinks).

is_file(follow_symlinks: bool = True) bool#

Determine if this entry is a file.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a file or a symbolic link to a file, return False otherwise. If follow_symlinks is False, return True only if the entry is a file (without following symlinks).

Determine whether this entry is a symlink.

Returns:

True if the entry is a symbolic link, False otherwise.

Read the link where this entry points to, return the resulting path as string.

If it is a symlink and returns the entry that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Returns:

The path the link points to.

Read the link where this entry points to, return the resulting path as FilesystemEntry.

If it is a symlink and returns the string that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Returns:

The filesystem entry the link points to.

class dissect.target.filesystem.MappedFile(fs: Filesystem, path: str, entry: Any)#

Bases: VirtualFile

Virtual file backed by a file on the host machine.

open() BinaryIO#

Open this filesystem entry.

Returns:

A file-like object. Resolves symlinks when possible

stat(follow_symlinks: bool = True) dissect.target.helpers.fsutil.stat_result#

Determine the stat information of this entry.

If the entry is a symlink and follow_symlinks is True, it gets resolved, attempting to stat the path where it points to.

Parameters:

follow_symlinks – Whether to resolve the symbolic link if this entry is a symbolic link.

Returns:

The stat information of this entry.

lstat() dissect.target.helpers.fsutil.stat_result#

Determine the stat information of this entry, without resolving the symlinks.

When it detects a symlink, it will stat the information of the symlink, not the path it points to.

Returns:

The stat information of this entry.

attr() dict[str, bytes]#

The attributes related to this entry, resolving any symlinks.

If the entry is a symbolic link, it will attempt to resolve it first. Resulting in the attr information of the entry it points to.

Returns:

The attributes of this entry.

lattr() dict[str, bytes]#

The attributes related to this current entry, without resolving links.

Returns:

The attributes of this entry.

class dissect.target.filesystem.MappedCompressedFile(fs: Filesystem, path: str, entry: Any, algo: str = 'gzip')#

Bases: MappedFile

Virtual file backed by a compressed file on the host machine.

open() BinaryIO#

Open this filesystem entry.

Returns:

A file-like object. Resolves symlinks when possible

Bases: FilesystemEntry

Virtual symlink implementation.

attr() Any#

The attributes related to this entry, resolving any symlinks.

If the entry is a symbolic link, it will attempt to resolve it first. Resulting in the attr information of the entry it points to.

Returns:

The attributes of this entry.

lattr() Any#

The attributes related to this current entry, without resolving links.

Returns:

The attributes of this entry.

get(path) FilesystemEntry#

Retrieve a FilesystemEntry relative to this entry.

Parameters:

path – The path relative to this filesystem entry.

Returns:

A relative FilesystemEntry.

iterdir() Iterator[str]#

Iterate over the contents of a directory, return them as strings.

Returns:

An iterator of directory entries as path strings.

scandir() Iterator[FilesystemEntry]#

Iterate over the contents of a directory, return them as FilesystemEntry’s.

Returns:

An iterator of directory entries as FilesystemEntry’s.

open() BinaryIO#

Open this filesystem entry.

Returns:

A file-like object. Resolves symlinks when possible

stat(follow_symlinks: bool = True) dissect.target.helpers.fsutil.stat_result#

Determine the stat information of this entry.

If the entry is a symlink and follow_symlinks is True, it gets resolved, attempting to stat the path where it points to.

Parameters:

follow_symlinks – Whether to resolve the symbolic link if this entry is a symbolic link.

Returns:

The stat information of this entry.

lstat() dissect.target.helpers.fsutil.stat_result#

Determine the stat information of this entry, without resolving the symlinks.

When it detects a symlink, it will stat the information of the symlink, not the path it points to.

Returns:

The stat information of this entry.

is_dir(follow_symlinks: bool = True) bool#

Determine if this entry is a directory.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a directory or a symbolic link to a directory, return False otherwise. If follow_symlinks is False, return True only if the entry is a directory (without following symlinks).

is_file(follow_symlinks: bool = True) bool#

Determine if this entry is a file.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a file or a symbolic link to a file, return False otherwise. If follow_symlinks is False, return True only if the entry is a file (without following symlinks).

Determine whether this entry is a symlink.

Returns:

True if the entry is a symbolic link, False otherwise.

Read the link where this entry points to, return the resulting path as string.

If it is a symlink and returns the entry that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Returns:

The path the link points to.

class dissect.target.filesystem.VirtualFilesystem(**kwargs)#

Bases: Filesystem

Base class for filesystems.

__type__ = 'virtual'#
mount#
static detect(fh: BinaryIO) bool#

Detect whether the fh file-handle is supported by this Filesystem implementation.

The position of fh will be restored before returning.

Parameters:

fh – A file-like object, usually a disk or partition.

Returns:

True if fh is supported, False otherwise.

get(path: str, relentry: FilesystemEntry | None = None) FilesystemEntry#

Retrieve a FilesystemEntry from the filesystem.

Parameters:

path – The path which we want to retrieve.

Returns:

A FilesystemEntry for the path.

makedirs(path: str) VirtualDirectory#

Create virtual directories into the VFS from the given path.

map_fs(vfspath: str, fs: Filesystem) None#

Mount a dissect filesystem to a directory in the VFS

map_dir(vfspath: str, realpath: str) None#

Recursively map a directory from the host machine into the VFS.

map_file(vfspath: str, realpath: str, compression: str | None = None) None#

Map a file from the host machine into the VFS.

map_file_fh(vfspath: str, fh: BinaryIO) None#

Map a file handle into the VFS.

map_file_entry(vfspath: str, entry: FilesystemEntry) None#

Map a FilesystemEntry into the VFS.

Any missing subdirectories up to, but not including, the last part of vfspath will be created.

map_dir_from_tar(vfspath: str, tar_file: str | pathlib.Path, map_single_file: bool = False) None#

Map files in a tar onto the VFS.

Parameters:
  • vfspath – Destination path in the virtual filesystem.

  • tar_file – Source path of the tar file to map.

  • map_single_file – Only mount a single file found inside the tar at the specified path.

map_file_from_tar(vfspath: str, tar_file: str | pathlib.Path) None#

Map a single file in a tar archive to the given path in the VFS.

The provided tar archive should contain one file.

Parameters:
  • vfspath – Destination path in the virtual filesystem.

  • tar_file – Source path of the tar file to map.

Hard link a FilesystemEntry to another location.

Parameters:
  • src – The path to the target of the link.

  • dst – The path to the link.

Create a symlink to another location.

Parameters:
  • src – The path to the target of the symlink.

  • dst – The path to the symlink.

class dissect.target.filesystem.RootFilesystem(target: dissect.target.target.Target)#

Bases: Filesystem

Base class for filesystems.

property case_sensitive: bool#
property alt_separator: str#
__type__ = 'root'#
static detect(fh: BinaryIO) bool#

Detect whether the fh file-handle is supported by this Filesystem implementation.

The position of fh will be restored before returning.

Parameters:

fh – A file-like object, usually a disk or partition.

Returns:

True if fh is supported, False otherwise.

mount(path: str, fs: Filesystem) None#

Mount a filesystem at a given path.

If there’s an overlap with an existing mount, creates a new layer.

Hard link a RootFilesystemEntry to another location.

Create a symlink to another location.

add_layer(**kwargs) VirtualFilesystem#
get(path: str, relentry: FilesystemEntry = None) FilesystemEntry#

Retrieve a FilesystemEntry from the filesystem.

Parameters:

path – The path which we want to retrieve.

Returns:

A FilesystemEntry for the path.

class dissect.target.filesystem.EntryList(value: Any)#

Bases: list

Wrapper list for filesystem entries.

Expose a getattr on a list of items. Useful in cases where there’s a virtual filesystem entry as well as a real one.

__getattr__(attr: str) Any#
class dissect.target.filesystem.RootFilesystemEntry(fs: Filesystem, path: str, entry: FilesystemEntry)#

Bases: FilesystemEntry

Base class for filesystem entries.

__getattr__(attr)#
get(path: str) FilesystemEntry#

Retrieve a FilesystemEntry relative to this entry.

Parameters:

path – The path relative to this filesystem entry.

Returns:

A relative FilesystemEntry.

open() BinaryIO#

Open this filesystem entry.

Returns:

A file-like object. Resolves symlinks when possible

iterdir() Iterator[str]#

Iterate over the contents of a directory, return them as strings.

Returns:

An iterator of directory entries as path strings.

scandir() Iterator[FilesystemEntry]#

Iterate over the contents of a directory, return them as FilesystemEntry’s.

Returns:

An iterator of directory entries as FilesystemEntry’s.

is_file(follow_symlinks: bool = True) bool#

Determine if this entry is a file.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a file or a symbolic link to a file, return False otherwise. If follow_symlinks is False, return True only if the entry is a file (without following symlinks).

is_dir(follow_symlinks: bool = True) bool#

Determine if this entry is a directory.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a directory or a symbolic link to a directory, return False otherwise. If follow_symlinks is False, return True only if the entry is a directory (without following symlinks).

Determine whether this entry is a symlink.

Returns:

True if the entry is a symbolic link, False otherwise.

Read the link where this entry points to, return the resulting path as string.

If it is a symlink and returns the entry that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Returns:

The path the link points to.

stat(follow_symlinks: bool = True) dissect.target.helpers.fsutil.stat_result#

Determine the stat information of this entry.

If the entry is a symlink and follow_symlinks is True, it gets resolved, attempting to stat the path where it points to.

Parameters:

follow_symlinks – Whether to resolve the symbolic link if this entry is a symbolic link.

Returns:

The stat information of this entry.

lstat() dissect.target.helpers.fsutil.stat_result#

Determine the stat information of this entry, without resolving the symlinks.

When it detects a symlink, it will stat the information of the symlink, not the path it points to.

Returns:

The stat information of this entry.

attr() Any#

The attributes related to this entry, resolving any symlinks.

If the entry is a symbolic link, it will attempt to resolve it first. Resulting in the attr information of the entry it points to.

Returns:

The attributes of this entry.

lattr() Any#

The attributes related to this current entry, without resolving links.

Returns:

The attributes of this entry.

dissect.target.filesystem.register(module: str, class_name: str, internal: bool = True) None#

Register a filesystem implementation to use when opening a filesystem.

This function registers a filesystem using module relative to the MODULE_PATH. It lazily imports the module, and retrieves the specific class from it.

Parameters:
  • module – The module where to find the filesystem.

  • class_name – The class to load.

  • internal – Whether it is an internal module or not.

dissect.target.filesystem.is_multi_volume_filesystem(fh: BinaryIO) bool#
dissect.target.filesystem.open(fh: BinaryIO, *args, **kwargs) Filesystem#
dissect.target.filesystem.open_multi_volume(fhs: list[BinaryIO], *args, **kwargs) Filesystem#