dissect.vmfs.resource#

Module Contents#

Classes#

ResourceManager

ResourceFile

VMFS resource file implementation.

SmallFileBlockResource

VMFS resource file implementation.

SubBlockResource

VMFS resource file implementation.

PointerBlockResource

VMFS resource file implementation.

FileDescriptorResource

VMFS resource file implementation.

JournalBlockResource

VMFS resource file implementation.

LargeFileBlockResource

VMFS resource file implementation.

Functions#

address_type

Return the address type.

address_fmt

Create a human readable representation of an address.

address_tbz

Return whether the TBZ flag is set.

parse_fb_address

Parse a FB address and return the block.

parse_sfb_address

Parse a SFB address and return the cluster and resource.

parse_sb_address

Parse a SB address and return the cluster and resource.

parse_pb_address

Parse a PB address and return the cluster and resource.

parse_fd_address

Parse a FD address and return the cluster and resource.

parse_jb_address

Parse a JB address and return the cluster and resource.

parse_lfb_address

Parse a LFB address and return the block.

Attributes#

dissect.vmfs.resource.address_type(addr)#

Return the address type.

Address type is encoded in the lower 3 bits.

dissect.vmfs.resource.address_fmt(vmfs, address)#

Create a human readable representation of an address.

References: - Addr3_AddrToStr and similar

dissect.vmfs.resource.address_tbz(vmfs, address)#

Return whether the TBZ flag is set.

The TBZ flag is only valid for FB and LFB addresses.

dissect.vmfs.resource.parse_fb_address(vmfs, address)#

Parse a FB address and return the block.

VMFS5 encoding:

0b11111111 11111111 11111111 11000000

dissect.vmfs.resource.parse_sfb_address(vmfs, address)#

Parse a SFB address and return the cluster and resource.

SFB (small file block) in VMFS6 is what FB was in VMFS5.

VMFS6 encoding:

0b00000000 00000000 00111111 11111111 11111111 11111111 10000000 00000000 (cluster) 0b11111111 11111000 00000000 00000000 00000000 00000000 00000000 00000000 (resource)

dissect.vmfs.resource.parse_sb_address(vmfs, address)#

Parse a SB address and return the cluster and resource.

VMFS5 encoding:

0b00001111 11111111 11111111 11000000 (cluster) 0b11110000 00000000 00000000 00000000 (resource) 0b00000000 00000000 00000000 00011000 (resource if config flag set, << 4)

VMFS6 encoding:

0b00000000 00000000 00000000 11111111 11111111 11111111 11111111 11000000 (cluster) 0b11111111 00000000 00000000 00000000 00000000 00000000 00000000 00000000 (resource)

dissect.vmfs.resource.parse_pb_address(vmfs, address)#

Parse a PB address and return the cluster and resource.

Encoding:

0b00001111 11111111 11111111 11000000 (cluster) 0b11110000 00000000 00000000 00000000 (resource)

VMFS6 encoding:

0b00000000 00000000 00000000 11111111 11111111 11111111 11111111 11000000 (cluster) 0b11111111 00000000 00000000 00000000 00000000 00000000 00000000 00000000 (resource)

dissect.vmfs.resource.parse_fd_address(vmfs, address)#

Parse a FD address and return the cluster and resource.

Encoding:

0b00000000 00111111 11111111 11000000 (cluster) 0b11111111 11000000 00000000 00000000 (resource)

dissect.vmfs.resource.parse_jb_address(vmfs, address)#

Parse a JB address and return the cluster and resource.

Encoding:

0b11111100 00000000 00000000 00000000 (cluster) 0b00000000 00000000 11111111 11111000 (resource)

dissect.vmfs.resource.parse_lfb_address(vmfs, address)#

Parse a LFB address and return the block.

Encoding:

0b00000000 00000000 00111111 11111111 11111111 11111111 10000000 00000000 (block)

class dissect.vmfs.resource.ResourceManager(vmfs)#
property fdc#
property pb2#
property pbc#
property sbc#
property fbb#
property lfb#
property jbc#
open(resource_type, address=None, fileobj=None)#
get(address)#
get_resource(resource_type, cluster, resource)#
parse_address(address)#
resolve_address(address)#
class dissect.vmfs.resource.ResourceFile(vmfs, resource_type, address, fh)#

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

property resource_size#
iter_resource_locations()#
abstract parse_address(address)#

Parse an address into a cluster/resource pair to use for looking up a resource.

get(address)#

Get the resource belonging to the given address.

get_resource(cluster, resource)#

Get the resource belonging to the given cluster/resource pair.

class dissect.vmfs.resource.SmallFileBlockResource(vmfs, resource_type, address, fh)#

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address)#

Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.SubBlockResource(vmfs, resource_type, address, fh)#

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address)#

Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.PointerBlockResource(vmfs, resource_type, address, fh)#

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address)#

Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.FileDescriptorResource(vmfs, resource_type, address, fh)#

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address)#

Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.JournalBlockResource(vmfs, resource_type, address, fh)#

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address)#

Parse an address into a cluster/resource pair to use for looking up a resource.

class dissect.vmfs.resource.LargeFileBlockResource(vmfs, resource_type, address, fh)#

Bases: ResourceFile

VMFS resource file implementation.

Resource files of different types need different interpretation of the resource data.

Resource files are made up of a header and multiple cluster groups. A group is made up of the clusters (“bitmaps”), followed by the actual resource items.

parse_address(address)#

Parse an address into a cluster/resource pair to use for looking up a resource.

dissect.vmfs.resource.RESOURCE_TYPE_MAP#