dissect.apfs.objects.base

Module Contents

Classes

Object

Base class for APFS objects.
class dissect.apfs.objects.base.Object(container: dissect.apfs.apfs.APFS, address: int, *, block: bytes | None = None, cipher: dissect.fve.crypto.Cipher | None = None)

Base class for APFS objects.

The way we use this is a little unorthodox OOP-wise, but it works well for our use case. For the core of our APFS implementation we want to be able to read any object directly from a known type, but for interactive use it would also be nice to be able to read an object from its address and have it automatically be the correct subclass.

Subclasses should define the __type__ and __struct__ class variables.

Parameters:

  • container – The APFS container the object belongs to.

  • address – The block address of the object within the container.

  • block – Optionally, the raw block data of the object. If not provided, it will be read from the container.

  • cipher – Optionally, a cipher to decrypt the object (or child objects).

__type__
__struct__
__known_types__: ClassVar[dict[int, type[Object]]]
classmethod __init_subclass__()
container
address
block
cipher = None
object
__repr__() → str
classmethod from_address(container: dissect.apfs.apfs.APFS, address: int, count: int = 1, *, cipher: dissect.fve.crypto.Cipher | None = None) → typing_extensions.Self

Load an object from its address, automatically determining the correct subclass.

classmethod from_block(container: dissect.apfs.apfs.APFS, address: int, block: bytes, *, cipher: dissect.fve.crypto.Cipher | None = None) → typing_extensions.Self

Load an object from its raw block data, automatically determining the correct subclass.

property checksum: int

The object’s checksum.

is_valid() → bool

Check if the object’s checksum is valid.

property oid: int

The object’s ID.

property xid: int

The object’s transaction ID.

property type: dissect.apfs.c_apfs.c_apfs.OBJECT_TYPE

The object’s type.

property type_flags: dissect.apfs.c_apfs.c_apfs.OBJ

The object’s type flags.

property storage_type: dissect.apfs.c_apfs.c_apfs.OBJ

The object’s storage type.

property is_virtual: bool

Check if the object is stored as a virtual object.

property is_ephemeral: bool

Check if the object is stored as an ephemeral object.

property is_physical: bool

Check if the object is stored as a physical object.

property is_encrypted: bool

Check if the object is encrypted.

property subtype: dissect.apfs.c_apfs.c_apfs.OBJECT_TYPE

The object’s subtype.