dissect.fat.exfat¶
Module Contents¶
Classes¶
- class dissect.fat.exfat.ExFAT(fh: BinaryIO)¶
- filesystem¶
- vbr¶
- fs_name¶
- sector_size¶
- cluster_size¶
- fat_sector¶
- fat_sector_count¶
- fat_size¶
- fat¶
- cluster_heap_sector¶
- cluster_count¶
- root_dir_cluster¶
- root_dir_sector¶
- root_directory¶
- files¶
- alloc_bitmap = None¶
- upcase_table = None¶
- volume_label¶
- cluster_to_sector(cluster: int) int | None¶
Returns the clusters’ corresponding sector address
- Parameters:
cluster (int) – cluster address
- Returns:
corresponding sector address if available
- Return type:
int
- sector_to_cluster(sector: int) int | None¶
Returns the sectors’ corresponding cluster address
- Parameters:
sector (int) – sector address
- Returns:
corresponding cluster address if available
- Return type:
int
- runlist(starting_cluster: int, not_fragmented: bool = True, size: int | None = None) list[tuple[int, int]]¶
Creates a RunlistStream compatible runlist from exFAT FAT structures, in sectors.
- Parameters:
starting_cluster (int) – First cluster of file, folder or location in question
- Returns:
[(sector_offset, run_length_in_sectors)]
- Return type:
runlist
- get_cluster_chain(starting_cluster: int) list[int]¶
Reads the on disk FAT to construct the cluster chain
- Parameters:
starting_cluster (int) – cluster to look-up the chain from
- Returns:
Chain of clusters. Including starting_cluster
- Return type:
list