dissect.apfs.cursor

Module Contents

Classes

Cursor

Cursor for traversing B-Trees.
class dissect.apfs.cursor.Cursor(btree: dissect.apfs.objects.BTree, omap: dissect.apfs.objects.ObjectMap | None = None, oid: int = 0, xid: int | None = None)

Cursor for traversing B-Trees.

Parameters:

  • btree – B-Tree to traverse.

  • omap – Optional object map to resolve child pointers.

  • oid – Optional base object ID to resolve child pointers.

  • xid – Optional transaction ID to resolve child pointers.

btree
omap = None
oid = 0
xid = None
property state: tuple[dissect.apfs.objects.BTreeNode, int, list[tuple[dissect.apfs.objects.BTreeNode, int]]]

Get the current cursor state.

reset() → typing_extensions.Self

Reset the cursor to the root of the B-Tree.

key() → bytes

Get the current key.

value() → bytes

Get the current value.

item() → tuple[bytes, bytes]

Get the current key and value.

first() → bool

Move the cursor to the first item in the B-Tree.

last() → bool

Move the cursor to the last item in the B-Tree.

next() → bool

Move the cursor to the next item in the B-Tree.

prev() → bool

Move the cursor to the previous item in the B-Tree.

push() → typing_extensions.Self

Push down to the child node at the current index.

pop() → typing_extensions.Self

Pop back to the parent node.

walk() → collections.abc.Iterator[tuple[bytes, bytes]]

Walk the B-Tree in order, yielding (key, value) tuples.

search(key: Any, *, exact: bool = False, cmp: collections.abc.Callable[[Any, bytes], Literal[-1, 0, 1]] = cmp_default) → typing_extensions.Self

Search for a key in the B-Tree.

Parameters:

  • key – Key to search for.

  • exact – If True, only return if an exact match is found.

  • cmp – Comparison function to use. Should return -1, 0, or 1.