dissect.target.filesystems.apfs

Module Contents

Classes

ApfsFilesystem	Base class for filesystems.
ApfsVolumeFilesystem	Base class for filesystems.
ApfsDirEntry	Directory entry base class. Closely models os.DirEntry.
ApfsFilesystemEntry	Base class for filesystem entries.

Attributes

log

dissect.target.filesystems.apfs.log

class dissect.target.filesystems.apfs.ApfsFilesystem(fh: BinaryIO | list[BinaryIO], *args, **kwargs)

Bases: dissect.target.filesystem.Filesystem

Base class for filesystems.

__type__ = 'apfs-container'

A short string identifying the type of filesystem.

container

vfs

__repr__() → str

iter_subfs() → collections.abc.Iterator[ApfsVolumeFilesystem]

Yield possible sub-filesystems.

get(path: str) → dissect.target.filesystem.FilesystemEntry

Retrieve a FilesystemEntry from the filesystem.

Parameters:

path – The path which we want to retrieve.

Returns:

A FilesystemEntry for the path.

class dissect.target.filesystems.apfs.ApfsVolumeFilesystem(container: ApfsFilesystem, name: str | None = None, uuid: uuid.UUID | None = None)

Bases: dissect.target.filesystem.Filesystem

Base class for filesystems.

__type__ = 'apfs'

A short string identifying the type of filesystem.

container

__repr__() → str

get(path: str) → dissect.target.filesystem.FilesystemEntry

Retrieve a FilesystemEntry from the filesystem.

Parameters:

path – The path which we want to retrieve.

Returns:

A FilesystemEntry for the path.

class dissect.target.filesystems.apfs.ApfsDirEntry(fs: Filesystem, path: str, name: str, entry: Any)

Bases: dissect.target.filesystem.DirEntry

Directory entry base class. Closely models os.DirEntry.

Filesystem implementations are encouraged to subclass this class to provide efficient implementations of the various methods.

Parameters:

• fs – The filesystem the entry belongs to.

• path – The path of the parent directory.

• name – The name of the entry.

• entry – The raw entry backing this directory entry.

fs: ApfsVolumeFilesystem

The filesystem the entry belongs to.

entry: dissect.apfs.objects.fs.DirectoryEntry

The raw entry backing this directory entry.

get() → ApfsFilesystemEntry

Retrieve the FilesystemEntry this directory entry points to.

Subclasses should override this method to provide an efficient implementation.

is_dir(*, follow_symlinks: bool = True) → bool

Return whether this entry is a directory or a symbolic link pointing to a directory.

Subclasses should override this method to provide an efficient implementation.

is_file(*, follow_symlinks: bool = True) → bool

Return whether this entry is a file or a symbolic link pointing to a file.

Subclasses should override this method to provide an efficient implementation.

is_symlink() → bool

Return whether this entry is a symbolic link.

Subclasses should override this method to provide an efficient implementation.

stat(*, follow_symlinks: bool = True) → dissect.target.helpers.fsutil.stat_result

class dissect.target.filesystems.apfs.ApfsFilesystemEntry(fs: Filesystem, path: str, entry: Any)

Bases: dissect.target.filesystem.FilesystemEntry

Base class for filesystem entries.

fs: ApfsVolumeFilesystem

entry: dissect.apfs.objects.fs.INode

get(path: str) → dissect.target.filesystem.FilesystemEntry

Retrieve a FilesystemEntry relative to this entry.

Parameters:

path – The path relative to this filesystem entry.

Returns:

A relative FilesystemEntry.

open() → BinaryIO

Open this filesystem entry.

Returns:

A file-like object. Resolves symlinks when possible

scandir() → collections.abc.Iterator[dissect.target.filesystem.FilesystemEntry]

Iterate over the contents of a directory, yields FilesystemEntry.

Returns:

An iterator of FilesystemEntry.

is_dir(follow_symlinks: bool = True) → bool

Determine if this entry is a directory.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a directory or a symbolic link to a directory, return False otherwise. If follow_symlinks is False, return True only if the entry is a directory (without following symlinks).

is_file(follow_symlinks: bool = True) → bool

Determine if this entry is a file.

Parameters:

follow_symlinks – Whether to resolve the entry if it is a symbolic link.

Returns:

True if the entry is a file or a symbolic link to a file, return False otherwise. If follow_symlinks is False, return True only if the entry is a file (without following symlinks).

is_symlink() → bool

Determine whether this entry is a symlink.

Returns:

True if the entry is a symbolic link, False otherwise.

readlink() → str

Read the link where this entry points to, return the resulting path as string.

If it is a symlink and returns the entry that corresponds to that path. This means it follows the path a link points to, it tries to do it recursively.

Returns:

The path the link points to.

stat(follow_symlinks: bool = True) → dissect.target.helpers.fsutil.stat_result

Determine the stat information of this entry.

If the entry is a symlink and follow_symlinks is True, it gets resolved, attempting to stat the path where it points to.

Parameters:

follow_symlinks – Whether to resolve the symbolic link if this entry is a symbolic link.

Returns:

The stat information of this entry.

lstat() → dissect.target.helpers.fsutil.stat_result

Determine the stat information of this entry, without resolving the symlinks.

When it detects a symlink, it will stat the information of the symlink, not the path it points to.

Returns:

The stat information of this entry.