dissect.target.plugins.os.unix.trash

Module Contents

Classes

GnomeTrashPlugin

Linux GNOME Trash plugin.

Attributes

TrashRecord

dissect.target.plugins.os.unix.trash.TrashRecord

class dissect.target.plugins.os.unix.trash.GnomeTrashPlugin(target: dissect.target.target.Target)

Bases: dissect.target.plugin.Plugin

Linux GNOME Trash plugin.

PATHS = ['.local/share/Trash']

trashes

check_compatible() → None

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

trash() → Iterator[TrashRecord]

Yield deleted files from GNOME Trash folders.

Recovers deleted files and artifacts from $HOME/.local/share/Trash. Probably also works with other desktop interfaces as long as they follow the Trash specification from FreeDesktop.

Currently does not parse media trash locations such as /media/$Label/.Trash-1000/*.

Resources:

• https://specifications.freedesktop.org/trash-spec/latest/

• https://github.com/GNOME/glib/blob/main/gio/glocalfile.c

• https://specifications.freedesktop.org/basedir-spec/latest/

Yields TrashRecord records with the following fields:

ts           (datetime): timestamp when the file was deleted or for expunged files when it could not be permanently deleted
path         (path):     path where the file was located before it was deleted
filesize     (filesize): size in bytes of the deleted file
deleted_path (path):     path to the current location of the deleted file
source       (path):     path to the .trashinfo file