dissect.hypervisor.disk.hdd#

Module Contents#

Classes#

HDD

Parallels HDD virtual disk implementation.

Descriptor

Helper class for working with DiskDescriptor.xml.

XMLEntry

StorageData

Storage

Image

Snapshots

Shot

StorageStream

Stream implementation for HDD streams.

HDS

Parallels HDS implementation.

Attributes#

DEFAULT_TOP_GUID

NULL_GUID

dissect.hypervisor.disk.hdd.DEFAULT_TOP_GUID#
dissect.hypervisor.disk.hdd.NULL_GUID#
class dissect.hypervisor.disk.hdd.HDD(path: pathlib.Path)#

Parallels HDD virtual disk implementation.

Parameters:

path – The path to the .hdd directory or .hdd file in a .hdd directory.

open(guid: str | uuid.UUID | None = None) → BinaryIO#

Open a stream for this HDD, optionally for a specific snapshot.

If no snapshot GUID is provided, the “top” snapshot will be used.

Parameters:

guid – The snapshot GUID to open.

class dissect.hypervisor.disk.hdd.Descriptor(path: pathlib.Path)#

Helper class for working with DiskDescriptor.xml.

References

Parameters:

path – The path to DiskDescriptor.xml.

get_snapshot_chain(guid: uuid.UUID) → list[uuid.UUID]#

Return the snapshot chain for a given snapshot GUID.

Parameters:

guid – The snapshot GUID to return a chain for.

class dissect.hypervisor.disk.hdd.XMLEntry#
classmethod from_xml(element: xml.etree.ElementTree.Element) → XMLEntry#
class dissect.hypervisor.disk.hdd.StorageData#

Bases: XMLEntry

storages: list[Storage]#
class dissect.hypervisor.disk.hdd.Storage#

Bases: XMLEntry

start: int#
end: int#
images: list[Image]#
find_image(guid: uuid.UUID) → Image#

Find a specific image GUID.

Parameters:

guid – The image GUID to find.

Raises:

KeyError – If the GUID could not be found.

class dissect.hypervisor.disk.hdd.Image#

Bases: XMLEntry

guid: uuid.UUID#
type: str#
file: str#
class dissect.hypervisor.disk.hdd.Snapshots#

Bases: XMLEntry

top_guid: uuid.UUID | None#
shots: list[Shot]#
find_shot(guid: uuid.UUID) → Shot#

Find a specific snapshot GUID.

Parameters:

guid – The snapshot GUID to find.

Raises:

KeyError – If the GUID could not be found.

class dissect.hypervisor.disk.hdd.Shot#

Bases: XMLEntry

guid: uuid.UUID#
parent: uuid.UUID#
class dissect.hypervisor.disk.hdd.StorageStream(streams: list[tuple[Storage, BinaryIO]])#

Bases: dissect.util.stream.AlignedStream

Stream implementation for HDD streams.

HDD files can exist of one or multiple streams, starting at consecutive offsets. This class stitches all streams together into a single stream.

Parameters:

streams – A list of Storage and file-like object tuples.

class dissect.hypervisor.disk.hdd.HDS(fh: BinaryIO, parent: BinaryIO | None = None)#

Bases: dissect.util.stream.AlignedStream

Parallels HDS implementation.

HDS is the format for Parallels sparse disk files.

Parameters:

  • fh – The file-like object to the HDS file.

  • parent – Optional file-like object for the parent HDS file.

bat() → list[int]#

Return the block allocation table (BAT).