dissect.evidence.ad1#

Module Contents#

Classes#

AD1

LogicalImage

FileEntry

FileMeta

FileObject

Basic buffered stream that provides easy aligned reads.

Attributes#

dissect.evidence.ad1.ad1_def = Multiline-String#
Show Value
"""
enum EntryType : uint32 {
    File        = 0x0,
    Directory   = 0x5
};

enum MetaType : uint32 {
    FileClass           = 0x2,
    FileSize            = 0x3,
    PhysicalSize        = 0x4,
    StartCluster        = 0x6,
    DateAccessed        = 0x7,
    DateCreated         = 0x8,
    DateModified        = 0x9,
    Unknown_1           = 0xd,
    Unknown_2           = 0xe,
    ActualFile          = 0x1e,
    Unknown_3           = 0x1002,
    Unknown_4           = 0x1003,
    Unknown_5           = 0x1004,
    Unknown_6           = 0x1005,
    MD5                 = 0x5001,
    SHA1                = 0x5002,
    ClusterSize         = 0x9001,
    ClusterCount        = 0x9002,
    FreeClusterCount    = 0x9003,
    VolumeSerialNumber  = 0x9006
};

typedef struct {
    char        magic[16];
    uint32      unk1;
    uint32      unk2;
    uint32      unk3;
    uint32      unk4;
    uint16      unk5;
    uint16      version;
    uint32      unk6;
    uint64      logical_image_offset;
} SegmentedFileHeader;

typedef struct {
    char        magic[16];
    uint32      unk1;
    uint32      unk2;
    uint32      chunk_size;     // This is supposed to be uint64? But that doesn't seem right
    uint32      unk3;
    uint32      unk4;
    uint64      entry_offset;
    uint32      name_len;
    uint32      unk5;
    uint64      name_offset;
    uint64      unk6;
    uint64      unk7;
    uint64      unk8;
    uint64      unk9;
    char        name[name_len];
} LogicalImageHeader;

typedef struct {
    uint64      next;
    uint64      child;
    uint64      meta;
    uint64      unk1;
    uint64      size;
    EntryType   type;
    uint32      name_len;
    char        name[name_len];
    uint64      unk2;
    uint64      num_chunks;
    uint64      chunks[num_chunks];
} FileEntry;

typedef struct {
    uint64      next;
    uint32      category;
    MetaType    type;
    uint32      len;
    char        data[len];
} FileMeta;
"""
dissect.evidence.ad1.c_ad1#
dissect.evidence.ad1.EntryType#
dissect.evidence.ad1.MetaType#
class dissect.evidence.ad1.AD1(fh)#
__getattr__(k)#
entry(path='')#
listdir(path)#
get(path)#
open(path)#
abstract walk()#
class dissect.evidence.ad1.LogicalImage(fh)#
__repr__()#

Return repr(self).

__getattr__(k)#
class dissect.evidence.ad1.FileEntry(image, offset, parent)#
__repr__()#

Return repr(self).

__getattr__(k)#
open()#
is_file()#
is_dir()#
class dissect.evidence.ad1.FileMeta(image, offset)#
__repr__()#

Return repr(self).

__getattr__(k)#
class dissect.evidence.ad1.FileObject(entry)#

Bases: dissect.util.stream.AlignedStream

Basic buffered stream that provides easy aligned reads.

Must be subclassed for various stream implementations. Subclasses can implement:
  • _read(offset, length)

  • _seek(pos, whence=io.SEEK_SET)

The offset and length for _read are guaranteed to be aligned. The only time that overriding _seek would make sense is if there’s no known size of your stream, but still want to provide SEEK_END functionality.

Most subclasses of AlignedStream take one or more file-like objects as source. Operations on these subclasses, like reading, will modify the source file-like object as a side effect.

Parameters:
  • size – The size of the stream. This is used in read and seek operations. None if unknown.

  • align – The alignment size. Read operations are aligned on this boundary. Also determines buffer size.