dissect.thumbcache

Subpackages

Submodules

Package Contents

Classes

IndexEntry

ThumbnailIndex

Thumbcache

This class combines the thumbnailindex and thumbcachefile.

ThumbcacheEntry

ThumbcacheFile

exception dissect.thumbcache.Error

Bases: Exception

A generic exception for the thumbcache module.

class dissect.thumbcache.IndexEntry(fh: BinaryIO, type: dissect.thumbcache.util.ThumbnailType)
fh
type
property header: dissect.thumbcache.c_thumbcache.c_thumbcache.VISTA_ENTRY | dissect.thumbcache.c_thumbcache.c_thumbcache.WINDOWS7_ENTRY | dissect.thumbcache.c_thumbcache.c_thumbcache.WINDOWS8_ENTRY
in_use() → bool
property identifier: bytes
property flags: int
property cache_offsets: list[int]

Retrieves the index data entries.

These are offsets into the thumbcache files, where the order specifies in which of the files. More information about the order can be found in Thumbcache.

property last_modified: datetime.datetime
__repr__() → str
class dissect.thumbcache.ThumbnailIndex(fh: BinaryIO)
fh
property header: dissect.thumbcache.c_thumbcache.c_thumbcache.INDEX_HEADER_V1 | dissect.thumbcache.c_thumbcache.c_thumbcache.INDEX_HEADER_V2
property version: int
property type: dissect.thumbcache.util.ThumbnailType
property total_entries: int
property used_entries: int
entries() → collections.abc.Iterator[IndexEntry]

Returns all index entries that are actually used.

class dissect.thumbcache.Thumbcache(path: pathlib.Path, prefix: str = 'thumbcache')

This class combines the thumbnailindex and thumbcachefile.

The class looks up all files inside path that have the same prefix.

Parameters:

  • path – The directory that contains the thumbcache files.

  • prefix – The start of the name to search for.

property mapping: dict[int, pathlib.Path]

Looks at the version field in the cache file header.

entries() → collections.abc.Iterator[tuple[pathlib.Path, dissect.thumbcache.thumbcache_file.ThumbcacheEntry]]

Iterates through all the specific entries from the thumbcache files.

index_entries() → collections.abc.Iterator[dissect.thumbcache.index.IndexEntry]

Iterates through all the index entries that are in use.

class dissect.thumbcache.ThumbcacheEntry(fh: BinaryIO, type: dissect.thumbcache.util.ThumbnailType)
data_checksum: bytes
header_checksum: bytes
identifier: str
property hash: str
property extension: str

This property contains the extension type of the data (Only in VISTA).

property data: bytes
__repr__()
class dissect.thumbcache.ThumbcacheFile(fh: BinaryIO)
__slots__ = ['_cached_entries', '_entries', '_header', 'fh', 'offset', 'signature', 'size', 'type']

This class defines a thumbcache file, that is usually denoted by thumbcache_*.db. Which is is different from the thumbcache_idx.db.

Parameters:

fh – A file-like object.

fh
property header: dissect.thumbcache.c_thumbcache.c_thumbcache.CACHE_HEADER_VISTA | dissect.thumbcache.c_thumbcache.c_thumbcache.CACHE_HEADER
property version: dissect.thumbcache.util.ThumbnailType
__getitem__(key: int) → ThumbcacheEntry
__getattribute__(name: str) → Any
entries() → collections.abc.Iterator[ThumbcacheEntry]