dissect.target.helpers.magic.magic

Module Contents

Classes

Magic

Magic is a helper class for identifying files to a file type by magic bytes.

Functions

from_file	Detect file type from a Path instance.
from_entry	Detect file type from a FilesystemEntry instance.
from_descriptor	Detect file type from a file descriptor or handle.
from_buffer	Detect file type from provided bytes or buffer of bytes.

Attributes

MagicSignature
MagicResult
from_fh

type dissect.target.helpers.magic.magic.MagicSignature = tuple[str, str, bytes]

type dissect.target.helpers.magic.magic.MagicResult = str | None

class dissect.target.helpers.magic.magic.Magic

Magic is a helper class for identifying files to a file type by magic bytes.

This class mimics python-magic behaviour, however this implementation does not depend on the libmagic C-library system package. Instead a precompiled XML document of FreeDesktop’s shared-mime-info project is used to identify files.

Falls back to file extensions (where applicable) if no magic header is detected in the provided buffer.

The underlying implementation currently does not support nested magic definitions and logical AND/OR matches, which somewhat limits the supported FreeDesktop XML magic signature set.

from dissect.target.helpers import magic

>>> magic.from_buffer(b"SQLite format 3FILE DATAM<²¡")
"SQLite3 database"

>>> magic.from_file(target.fs.path("file.jpg"), mime=True)
"image/jpg"

Currently does not implement python-magic Magic invocation behaviour.

Resources:

• https://github.com/ahupp/python-magic/blob/master/magic/__init__.py

• https://github.com/file/file/tree/master/magic

• https://freedesktop.org/wiki/Specifications/shared-mime-info-spec/

• https://gitlab.freedesktop.org/xdg/shared-mime-info/-/blob/master/data/freedesktop.org.xml.in

static detect(buf: BinaryIO, suffix: str | None = None, *, mime: bool = False) → MagicResult

Searches mimetypes.MAP for the given bytes.

dissect.target.helpers.magic.magic.from_file(path: pathlib.Path, *, mime: bool = False) → MagicResult

Detect file type from a Path instance.

dissect.target.helpers.magic.magic.from_entry(entry: dissect.target.filesystem.FilesystemEntry, *, mime: bool = False) → MagicResult

Detect file type from a FilesystemEntry instance.

dissect.target.helpers.magic.magic.from_descriptor(fh: BinaryIO, suffix: str | None = None, *, mime: bool = False) → MagicResult

Detect file type from a file descriptor or handle.

dissect.target.helpers.magic.magic.from_fh

dissect.target.helpers.magic.magic.from_buffer(buf: bytes, suffix: str | None = None, *, mime: bool = False) → MagicResult

Detect file type from provided bytes or buffer of bytes.