:py:mod:`dissect.btrfs.btrfs` ============================= .. py:module:: dissect.btrfs.btrfs Module Contents --------------- Classes ~~~~~~~ .. autoapisummary:: dissect.btrfs.btrfs.Btrfs dissect.btrfs.btrfs.Subvolume dissect.btrfs.btrfs.INode .. py:class:: Btrfs(fh: BinaryIO | list[BinaryIO]) Btrfs filesystem implementation. This implementation supports most basic Btrfs features such as subvolumes, compression and (meta)data RAID. To open a RAID volume, simply pass all file-like objects that belong to the RAID set as a list. :param fh: A file-like object for the volume to use for parsing Btrfs. .. py:attribute:: fhs .. py:attribute:: sb .. py:attribute:: sector_size .. py:attribute:: node_size .. py:attribute:: stripe_size .. py:attribute:: label .. py:attribute:: uuid .. py:attribute:: metadata_uuid .. py:attribute:: devices .. py:attribute:: open_subvolume .. py:attribute:: fs_tree .. py:attribute:: default_subvolume .. py:attribute:: root .. py:method:: get(path: str | int, node: INode | None = None) -> INode Retrieve a Btrfs inode by path or inode number. :param path: Filesystem path or inode number. :param node: Optional inode used for relative lookups. .. py:method:: subvolumes() -> collections.abc.Iterator[Subvolume] Yield all subvolumes. .. py:method:: find_subvolume(path: str | None = None) -> Subvolume | None Find a subvolume by path. :param path: The path of the subvolume to find. .. py:class:: Subvolume(btrfs: Btrfs, objectid: int, parent: INode | None = None) Represent a Btrfs subvolume. Btrfs has support for multiple subvolumes. The default subvolume is the ``FS_TREE`` subvolume. Each subvolume has its own B-tree. :param btrfs: The filesystem this subvolume belongs to. :param objectid: The object ID of the subvolume to open. :param parent: Optional parent node to attach to the root of the subvolume. .. py:attribute:: btrfs .. py:attribute:: objectid .. py:attribute:: parent :value: None .. py:attribute:: inode .. py:attribute:: resolve_path .. py:method:: __repr__() -> str .. py:property:: tree :type: dissect.btrfs.tree.BTree .. py:property:: uuid :type: uuid.UUID .. py:property:: root :type: INode .. py:property:: path :type: str .. py:method:: get(path: str | int, node: INode | None = None) -> INode Retrieve a Btrfs inode by path or inode number. :param path: Filesystem path or inode number. :param node: Optional inode used for relative lookups. .. py:class:: INode(subvolume: Subvolume, inum: int, type: int | None = None, parent: INode | None = None) Represent a Btrfs inode. :param subvolume: The subvolume this inode belongs to. :param inum: The inode number of this inode. :param type: Optional file type of this inode, as observed in a directory entry. :param parent: Optional parent of this inode, if this inode is parsed from a directory listing. .. py:attribute:: subvolume .. py:attribute:: btrfs .. py:attribute:: inum .. py:attribute:: parent :value: None .. py:attribute:: listdir .. py:attribute:: extents .. py:method:: __repr__() -> str .. py:property:: inode :type: dissect.btrfs.c_btrfs.c_btrfs.btrfs_inode_item Return the parsed inode structure. .. py:property:: size :type: int Return the file size. .. py:property:: uid :type: int Return the owner user ID. .. py:property:: gid :type: int Return the owner group ID. .. py:property:: mode :type: int Return the file mode. .. py:property:: type :type: int Return the file type. .. py:property:: atime :type: datetime.datetime Return datetime timestamp of last access. .. py:property:: atime_ns :type: int Return nanosecond timestamp of last access. .. py:property:: ctime :type: datetime.datetime Return datetime timestamp of last metadata change. .. py:property:: ctime_ns :type: int Return nanosecond timestamp of last metadata change. .. py:property:: mtime :type: datetime.datetime Return datetime timestamp of last content modification. .. py:property:: mtime_ns :type: int Return nanosecond timestamp of last content modification. .. py:property:: otime :type: datetime.datetime Return datetime timestamp of inode creation. .. py:property:: otime_ns :type: int Return nanosecond timestamp of inode creation. .. py:method:: is_dir() -> bool Return whether this inode is a directory. .. py:method:: is_file() -> bool Return whether this inode is a regular file. .. py:method:: is_symlink() -> bool Return whether this inode is a symlink. .. py:method:: is_block_device() -> bool Return whether this inode is a block device. .. py:method:: is_character_device() -> bool Return whether this inode is a character device. .. py:method:: is_device() -> bool Return whether this inode is a device. .. py:method:: is_fifo() -> bool Return whether this inode is a FIFO file. .. py:method:: is_socket() -> bool Return whether this inode is a socket file. .. py:method:: is_ipc() -> bool Return whether this inode is an IPC file. .. py:property:: link :type: str Return the symlink target. .. py:property:: link_inode :type: INode Resolve the symlink target to an inode. .. py:property:: parents :type: collections.abc.Iterator[INode] .. py:property:: path :type: str Return the path to this inode within the subvolume. In case of multiple hardlinks, return the first path. .. py:property:: full_path :type: str Return the full path to this inode. In case of multiple hardlinks, return the first path. .. py:method:: get(path: str) -> INode Retrieve a Btrfs inode relative from this inode. :param path: Filesystem path. .. py:method:: paths(full: bool = False) -> collections.abc.Iterator[str] Yield all paths (hardlinks) to this inode. By default only resolves up to the root of the subvolume this inode belongs to. For a full path to the root of the filesystem tree, set ``full`` to ``True``. :param full: Whether to fully resolve the path up to the root of the filesystem tree. .. py:method:: iterdir() -> collections.abc.Iterator[tuple[str, INode]] Iterate directory contents. .. py:method:: open() -> BinaryIO Return the data stream for the inode. File data in Btrfs can be inlined in the B-tree or stored in file extents. In both cases it can be compressed.