dissect.thumbcache#

Subpackages#

Submodules#

Package Contents#

Classes#

IndexEntry

ThumbnailIndex

Thumbcache

This class combines the thumbnailindex and thumbcachefile.

ThumbcacheEntry

ThumbcacheFile

exception dissect.thumbcache.Error#

Bases: Exception

A generic exception for the thumbcache module.

class dissect.thumbcache.IndexEntry(fh: BinaryIO, type: dissect.thumbcache.util.ThumbnailType)#
property header: dissect.cstruct.Structure#
property identifier: bytes#
property flags: int#
property cache_offsets: list[int]#

Retrieves the index data entries.

These are offsets into the thumbcache files, where the order specifies in which of the files. More information about the order can be found in Thumbcache.

property last_modified: datetime.datetime#
in_use() bool#
__repr__() str#

Return repr(self).

class dissect.thumbcache.ThumbnailIndex(fh: BinaryIO)#
property header: dissect.cstruct.Structure#
property version: int#
property type: dissect.thumbcache.util.ThumbnailType#
property total_entries: int#
property used_entries: int#
entries() Iterator[IndexEntry]#

Returns all index entries that are actually used.

class dissect.thumbcache.Thumbcache(path: pathlib.Path, prefix: str = 'thumbcache')#

This class combines the thumbnailindex and thumbcachefile.

The class looks up all files inside path that have the same prefix.

Parameters:
  • path – The directory that contains the thumbcache files.

  • prefix – The start of the name to search for.

property mapping: dict[int, pathlib.Path]#

Looks at the version field in the cache file header.

entries() Iterator[tuple[pathlib.Path, dissect.thumbcache.thumbcache_file.ThumbcacheEntry]]#

Iterates through all the specific entries from the thumbcache files.

index_entries() Iterator[dissect.thumbcache.index.IndexEntry]#

Iterates through all the index entries that are in use.

class dissect.thumbcache.ThumbcacheEntry(fh: BinaryIO, type: dissect.thumbcache.util.ThumbnailType)#
property hash: str#
property extension: str#

This property contains the extension type of the data (Only in VISTA).

property data: bytes#
__repr__()#

Return repr(self).

class dissect.thumbcache.ThumbcacheFile(fh: BinaryIO)#
property header: dissect.cstruct.Structure#
property version: dissect.thumbcache.util.ThumbnailType#
__slots__ = ['fh', '_header', 'signature', 'type', 'size', 'offset', '_entries', '_cached_entries']#

This class defines a thumbcache file, that is usually denoted by thumbcache_*.db. Which is is different from the thumbcache_idx.db.

Parameters:

fh – A file-like object.

__getitem__(key: int) ThumbcacheEntry#
__getattribute__(__name: str) Any#

Return getattr(self, name).

entries() list[ThumbcacheEntry]#