dissect.btrfs.tree
#
Module Contents#
Classes#
- class dissect.btrfs.tree.BTree(btrfs: dissect.btrfs.btrfs.Btrfs, root_item: dissect.btrfs.c_btrfs.c_btrfs.btrfs_root_item | None = None, root_offset: int | None = None)#
Represent a Btrfs B-tree.
One of
root_item
orroot_offset
must be given.- Parameters:
btrfs – The filesystem this B-tree belongs to.
root_item – Optional
btrfs_root_item
to open the B-tree from.root_offset – Optional offset to open the B-tree from.
- find(objectid: int | None = None, type: int | None = None, offset: int | None = None) tuple[dissect.btrfs.c_btrfs.c_btrfs.btrfs_item, memoryview] #
Search for a single item in the B-tree.
- Parameters:
objectid – Optional object ID to search for.
type – Optional type to search for.
offset – Optional offset to search for.
- class dissect.btrfs.tree.Cursor(btree: BTree)#
A basic cursor implementation for interacting with a
BTree
.- Parameters:
btree – The
BTree
to open a cursor on.
- reset() None #
Reset the cursor.
- push(address: int, initial_index: int = 0) None #
Push the cursor down a node.
- Parameters:
address – The address of the node to push down to.
initial_index – The initial index to seek to in the new node.
-1
means the last item.
- pop() None #
Pop up a node.
- next() None #
Traverse to the next leaf item.
Will move up and down the tree to find the next leaf item.
- next_node() None #
Traverse to the next node.
Will move up and down the tree to find the next node.
- prev() None #
Traverse to the previous leaf item.
Will move up and down the tree to find the previous leaf item.
- prev_node() None #
Traverse to the previous leaf item.
Will move up and down the tree to find the previous leaf item.
- first() None #
Move the cursor to the first leaf item.
- last() None #
Move the cursor to the last leaf item.
- get() tuple[dissect.btrfs.c_btrfs.c_btrfs.btrfs_item, memoryview] #
Retrieve the leaf item and the associated data at the current cursor position.
Cursor must be positioned at a leaf item.
- item() dissect.btrfs.c_btrfs.c_btrfs.btrfs_key_ptr | dissect.btrfs.c_btrfs.c_btrfs.btrfs_item #
Retrieve a leaf or branch item.
Cursor can be positioned at a branch or leaf item.
- items() Iterator[dissect.btrfs.c_btrfs.c_btrfs.btrfs_key_ptr | dissect.btrfs.c_btrfs.c_btrfs.btrfs_item] #
Iterate over all items in the current node.
- data() memoryview #
Return the associated data of the current leaf item.
- iter(objectid: int | None = None, type: int | None = None, offset: int | None = None, ignore_offset: bool = False) Iterator[tuple[dissect.btrfs.c_btrfs.c_btrfs.btrfs_item, memoryview]] #
Search and iterate the B-tree for the specified key.
Stop iterating if the current item no longer matches the given parameters.
- Parameters:
objectid – Optional object ID to search for.
type – Optional type to search for.
offset – Optional offset to search for.
ignore_offset – Only use the
offset
argument for the initial positioning of the cursor, but ignore it for future iterations. This is useful for e.g. iterating file extents.
- walk(objectid: int | None = None, type: int | None = None, offset: int | None = None) Iterator[tuple[dissect.btrfs.c_btrfs.c_btrfs.btrfs_item, memoryview]] #
Walk all leaf items of the B-tree and yield all matching leafs.
- Parameters:
objectid – Optional object ID to yield items of.
type – Optional type to yield items of.
offset – Optional offset to yield items of.
- search(objectid: int | None = None, type: int | None = None, offset: int | None = None) bool #
Perform a binary search on the current node for the key with the given parameters.
Puts the cursor at the index of the matching item, or just before a “greater” item if no exact match is found.
True
is returned if this is the case, elseFalse
is returned and the cursor position is reset.- Parameters:
objectid – Optional object ID to search for.
type – Optional type to search for.
offset – Optional offset to search for.