acquire.acquire.tools.decrypter

Module Contents

Classes

EncryptedFile

Basic buffered stream that provides aligned reads.

Functions

decrypt_header

check_existing

worker

setup_logging

main

show_duplicates

find_enc_files

Attributes

progress

log

CHUNK_SIZE

WORKER_COUNT

STATUS_EXIT

STATUS_INFO

STATUS_START

STATUS_UPDATE

acquire.acquire.tools.decrypter.progress
acquire.acquire.tools.decrypter.log
acquire.acquire.tools.decrypter.CHUNK_SIZE = 4194304
acquire.acquire.tools.decrypter.WORKER_COUNT
acquire.acquire.tools.decrypter.STATUS_EXIT = 0
acquire.acquire.tools.decrypter.STATUS_INFO = 1
acquire.acquire.tools.decrypter.STATUS_START = 2
acquire.acquire.tools.decrypter.STATUS_UPDATE = 3
exception acquire.acquire.tools.decrypter.VerifyError

Bases: Exception

Common base class for all non-exit exceptions.

class acquire.acquire.tools.decrypter.EncryptedFile(fh: BinaryIO, key_file: pathlib.Path | None = None, key_server: str | None = None)

Bases: dissect.util.stream.AlignedStream

Basic buffered stream that provides aligned reads.

Must be subclassed for various stream implementations. Subclasses can implement:

  • _read()

  • _seek()

The offset and length for _read are guaranteed to be aligned for streams of a known size. If your stream has an unknown size (i.e. size == None), reads of length -1 (i.e. read until EOF) will be passed through to your implementation of _read. The only time that overriding _seek would make sense is if there’s no known size of your stream, but still want to provide SEEK_END functionality.

Most subclasses of AlignedStream take one or more file-like objects as source. Operations on these subclasses, like reading, will modify the source file-like object as a side effect.

Parameters:

  • size – The size of the stream. This is used in read and seek operations. None if unknown.

  • align – The alignment size. Read operations are aligned on this boundary. Also determines buffer size.

fh
key_file = None
key_server = None
digest = None
property file_header: acquire.crypt.c_acquire.file
property header: acquire.crypt.c_acquire.header
cipher
buffers
seekable() → bool

Indicate that the stream is seekable.

seek(pos: int, whence: int = io.SEEK_CUR) → int

Seek the stream to the specified position.

Returns:

The new stream position after seeking.

chunks(chunk_size: int = CHUNK_SIZE) → collections.abc.Iterator[bytes]
verify() → None
property footer: acquire.crypt.c_acquire.footer
property timestamp: datetime.datetime
acquire.acquire.tools.decrypter.decrypt_header(header: bytes, fingerprint: bytes, key_file: pathlib.Path | None = None, key_server: str | None = None) → bytes
acquire.acquire.tools.decrypter.check_existing(in_path: pathlib.Path, out_path: pathlib.Path, status_queue: multiprocessing.Queue) → bool
acquire.acquire.tools.decrypter.worker(task_id: int, stop_event: threading.Event, status_queue: queue.Queue, in_path: pathlib.Path, out_path: pathlib.Path, key_file: pathlib.Path | None = None, key_server: str | None = None, clobber: bool = False) → None
acquire.acquire.tools.decrypter.setup_logging(logger: logging.Logger, verbosity: int) → None
acquire.acquire.tools.decrypter.main() → int
acquire.acquire.tools.decrypter.show_duplicates(output_directory: pathlib.Path, files: list[pathlib.Path]) → None
acquire.acquire.tools.decrypter.find_enc_files(files: list[pathlib.Path]) → list[pathlib.Path]