dissect.database

Subpackages

Submodules

Package Contents

Classes

DB

Berkeley DB.

ESE

ESE database class.

SQLite3

class dissect.database.DB(fh: BinaryIO)

Berkeley DB.

Parameters:

fh – File-like object containing the Berkeley DB data.

fh
page_size
page
property is_btree: bool

Return whether the database of a DB_BTREE type.

property is_recno: bool

Return whether the database is a DB_RECNO type.

property is_hash: bool

Return whether the database is a DB_HASH type.

records() → collections.abc.Iterator[tuple[bytes | int, bytes]]

Iterate over all records in the database.

class dissect.database.ESE(fh: BinaryIO, impacket_compat: bool = False)

ESE database class.

Loads an ESE database from the given file handle. Optionally enable impacket compatible data output.

Impacket compatibility limits what values are parsed and returns most values as a hex string. Most notably, long and multi values are not parsed.

Parameters:

  • fh – The file-like object to open an ESE database on.

  • impacket_compat – Whether to make the output impacket compatible.

Raises:

InvalidDatabase – If the file-like object does not look like an ESE database.

fh
impacket_compat = False
header
page_size
version
format_major
format_minor
catalog
page
property has_small_pages: bool

Return whether this database has small pages (<= 8K).

table(name: str) → dissect.database.ese.table.Table

Get a table by name.

Parameters:

name – The table to retrieve.

tables() → list[dissect.database.ese.table.Table]

Get a list of all tables.

read_page(num: int) → bytes

Get the physical page data.

Parameters:

num – The physical page number to retrieve.

Raises:

IndexError – If the page number is out of bounds.

pages() → collections.abc.Iterator[dissect.database.ese.page.Page]

Iterate over all pages.

exception dissect.database.Error

Bases: Exception

Common base class for all non-exit exceptions.

class dissect.database.SQLite3(fh: BinaryIO, wal_fh: BinaryIO | None = None)
fh
wal = None
header
encoding
page_size
usable_page_size
page
open_wal(fh: BinaryIO) → None
table(name: str) → Table | None
tables() → collections.abc.Iterator[Table]
index(name: str) → Index | None
indices() → collections.abc.Iterator[Index]
raw_page(num: int) → bytes
pages() → collections.abc.Iterator[Page]
cells() → collections.abc.Iterator[Cell]