dissect.btrfs.btrfs

Module Contents

Classes

Btrfs	Btrfs filesystem implementation.
Subvolume	Represent a Btrfs subvolume.
INode	Represent a Btrfs inode.

class dissect.btrfs.btrfs.Btrfs(fh: BinaryIO | list[BinaryIO])

Btrfs filesystem implementation.

This implementation supports most basic Btrfs features such as subvolumes, compression and (meta)data RAID. To open a RAID volume, simply pass all file-like objects that belong to the RAID set as a list.

Parameters:

fh – A file-like object for the volume to use for parsing Btrfs.

fhs

sb

sector_size

node_size

stripe_size

label

uuid

metadata_uuid

devices

open_subvolume

fs_tree

default_subvolume

root

get(path: str | int, node: INode | None = None) → INode

Retrieve a Btrfs inode by path or inode number.

Parameters:

• path – Filesystem path or inode number.

• node – Optional inode used for relative lookups.

subvolumes() → collections.abc.Iterator[Subvolume]

Yield all subvolumes.

find_subvolume(path: str | None = None) → Subvolume | None

Find a subvolume by path.

Parameters:

path – The path of the subvolume to find.

class dissect.btrfs.btrfs.Subvolume(btrfs: Btrfs, objectid: int, parent: INode | None = None)

Represent a Btrfs subvolume.

Btrfs has support for multiple subvolumes. The default subvolume is the FS_TREE subvolume. Each subvolume has its own B-tree.

Parameters:

• btrfs – The filesystem this subvolume belongs to.

• objectid – The object ID of the subvolume to open.

• parent – Optional parent node to attach to the root of the subvolume.

btrfs

objectid

parent = None

inode

resolve_path

__repr__() → str

property tree: dissect.btrfs.tree.BTree

property uuid: uuid.UUID

property root: INode

property path: str

get(path: str | int, node: INode | None = None) → INode

Retrieve a Btrfs inode by path or inode number.

Parameters:

• path – Filesystem path or inode number.

• node – Optional inode used for relative lookups.

class dissect.btrfs.btrfs.INode(subvolume: Subvolume, inum: int, type: int | None = None, parent: INode | None = None)

Represent a Btrfs inode.

Parameters:

• subvolume – The subvolume this inode belongs to.

• inum – The inode number of this inode.

• type – Optional file type of this inode, as observed in a directory entry.

• parent – Optional parent of this inode, if this inode is parsed from a directory listing.

subvolume

btrfs

inum

parent = None

listdir

extents

__repr__() → str

property inode: dissect.btrfs.c_btrfs.c_btrfs.btrfs_inode_item

Return the parsed inode structure.

property size: int

Return the file size.

property uid: int

Return the owner user ID.

property gid: int

Return the owner group ID.

property mode: int

Return the file mode.

property type: int

Return the file type.

property atime: datetime.datetime

Return datetime timestamp of last access.

property atime_ns: int

Return nanosecond timestamp of last access.

property ctime: datetime.datetime

Return datetime timestamp of last metadata change.

property ctime_ns: int

Return nanosecond timestamp of last metadata change.

property mtime: datetime.datetime

Return datetime timestamp of last content modification.

property mtime_ns: int

Return nanosecond timestamp of last content modification.

property otime: datetime.datetime

Return datetime timestamp of inode creation.

property otime_ns: int

Return nanosecond timestamp of inode creation.

is_dir() → bool

Return whether this inode is a directory.

is_file() → bool

Return whether this inode is a regular file.

is_symlink() → bool

Return whether this inode is a symlink.

is_block_device() → bool

Return whether this inode is a block device.

is_character_device() → bool

Return whether this inode is a character device.

is_device() → bool

Return whether this inode is a device.

is_fifo() → bool

Return whether this inode is a FIFO file.

is_socket() → bool

Return whether this inode is a socket file.

is_ipc() → bool

Return whether this inode is an IPC file.

property link: str

Return the symlink target.

property link_inode: INode

Resolve the symlink target to an inode.

property parents: collections.abc.Iterator[INode]

property path: str

Return the path to this inode within the subvolume. In case of multiple hardlinks, return the first path.

property full_path: str

Return the full path to this inode. In case of multiple hardlinks, return the first path.

get(path: str) → INode

Retrieve a Btrfs inode relative from this inode.

Parameters:

path – Filesystem path.

paths(full: bool = False) → collections.abc.Iterator[str]

Yield all paths (hardlinks) to this inode.

By default only resolves up to the root of the subvolume this inode belongs to. For a full path to the root of the filesystem tree, set full to True.

Parameters:

full – Whether to fully resolve the path up to the root of the filesystem tree.

iterdir() → collections.abc.Iterator[tuple[str, INode]]

Iterate directory contents.

open() → BinaryIO

Return the data stream for the inode.

File data in Btrfs can be inlined in the B-tree or stored in file extents. In both cases it can be compressed.