How to use the dfvfs.resolver.resolver.Resolver.OpenFileObject function in dfvfs

To help you get started, we’ve selected a few dfvfs examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github log2timeline / dfvfs / dfvfs / vfs / zip_file_system.py View on Github external
Args:
      path_spec (PathSpec): path specification of the file system.
      mode (Optional[str]): file access mode. The default is 'rb' which
          represents read-only binary.

    Raises:
      AccessError: if the access to open the file was denied.
      IOError: if the file system object could not be opened.
      PathSpecError: if the path specification is incorrect.
      ValueError: if the path specification is invalid.
    """
    if not path_spec.HasParent():
      raise errors.PathSpecError(
          'Unsupported path specification without parent.')

    file_object = resolver.Resolver.OpenFileObject(
        path_spec.parent, resolver_context=self._resolver_context)

    try:
      zip_file = zipfile.ZipFile(file_object, 'r')
    except:
      file_object.close()
      raise

    self._file_object = file_object
    self._zip_file = zip_file
github log2timeline / dfvfs / dfvfs / vfs / tsk_partition_file_system.py View on Github external
Args:
      path_spec (PathSpec): a path specification.
      mode (Optional[str]): file access mode. The default is 'rb' which
          represents read-only binary.

    Raises:
      AccessError: if the access to open the file was denied.
      IOError: if the file system object could not be opened.
      PathSpecError: if the path specification is incorrect.
      ValueError: if the path specification is invalid.
    """
    if not path_spec.HasParent():
      raise errors.PathSpecError(
          'Unsupported path specification without parent.')

    file_object = resolver.Resolver.OpenFileObject(
        path_spec.parent, resolver_context=self._resolver_context)

    try:
      tsk_image_object = tsk_image.TSKFileSystemImage(file_object)
      tsk_volume = pytsk3.Volume_Info(tsk_image_object)
    except:
      file_object.close()
      raise

    self._file_object = file_object
    self._tsk_volume = tsk_volume
github libyal / winreg-kb / shellfolder.py View on Github external
def OpenFile(self, windows_path):
    """Opens the file specificed by the Windows path.

    Args:
      windows_path: the Windows path to the file.

    Returns:
      The file-like object (instance of dfvfs.FileIO) or None if
      the file does not exist.
    """
    path_spec = self._path_resolver.ResolvePath(windows_path)
    if path_spec is None:
      return None

    return resolver.Resolver.OpenFileObject(path_spec)
github log2timeline / dfvfs / dfvfs / helpers / source_scanner.py View on Github external
# Also see: https://github.com/log2timeline/dfvfs/issues/332
      container_file_entry = resolver.Resolver.OpenFileEntry(
          scan_node.path_spec, resolver_context=self._resolver_context)
      fsapfs_volume = container_file_entry.GetAPFSVolume()

      # TODO: unlocking the volume multiple times is inefficient cache volume
      # object in scan node and use is_locked = fsapfs_volume.is_locked()
      try:
        is_locked = not apfs_helper.APFSUnlockVolume(
            fsapfs_volume, scan_node.path_spec, resolver.Resolver.key_chain)
      except IOError as exception:
        raise errors.BackEndError(
            'Unable to unlock APFS volume with error: {0!s}'.format(exception))

    else:
      file_object = resolver.Resolver.OpenFileObject(
          scan_node.path_spec, resolver_context=self._resolver_context)
      is_locked = not file_object or file_object.is_locked
      file_object.close()

    if is_locked:
      scan_context.LockScanNode(scan_node.path_spec)

      # For BitLocker To Go add a scan node for the unencrypted part of
      # the volume.
      if scan_node.type_indicator == definitions.TYPE_INDICATOR_BDE:
        path_spec = self.ScanForFileSystem(scan_node.path_spec.parent)
        if path_spec:
          scan_context.AddScanNode(path_spec, scan_node.parent_node)
github log2timeline / plaso / plaso / engine / extractors.py View on Github external
parser_mediator (ParserMediator): parser mediator.
      file_entry (dfvfs.FileEntry): file entry.
      data_stream_name (str): data stream name.
    """
    parent_path_spec = getattr(file_entry.path_spec, 'parent', None)
    filename_upper = file_entry.name.upper()
    if (self._mft_parser and parent_path_spec and
        filename_upper in ('$MFT', '$MFTMIRR') and not data_stream_name):
      self._ParseDataStreamWithParser(
          parser_mediator, self._mft_parser, file_entry, '')

    elif (self._usnjrnl_parser and parent_path_spec and
          filename_upper == '$USNJRNL' and data_stream_name == '$J'):
      # To be able to ignore the sparse data ranges the UsnJrnl parser
      # needs to read directly from the volume.
      volume_file_object = path_spec_resolver.Resolver.OpenFileObject(
          parent_path_spec, resolver_context=parser_mediator.resolver_context)

      try:
        self._ParseFileEntryWithParser(
            parser_mediator, self._usnjrnl_parser, file_entry,
            file_object=volume_file_object)
      finally:
        volume_file_object.close()
github log2timeline / dfvfs / dfvfs / file_io / tsk_partition_file_io.py View on Github external
'specification.')

    range_offset = tsk_partition.TSKVsPartGetStartSector(tsk_vs)
    range_size = tsk_partition.TSKVsPartGetNumberOfSectors(tsk_vs)

    if range_offset is None or range_size is None:
      raise errors.PathSpecError(
          'Unable to retrieve TSK volume system part data range from path '
          'specification.')

    bytes_per_sector = tsk_partition.TSKVolumeGetBytesPerSector(tsk_volume)
    range_offset *= bytes_per_sector
    range_size *= bytes_per_sector

    self.SetRange(range_offset, range_size)
    self._file_object = resolver.Resolver.OpenFileObject(
        path_spec.parent, resolver_context=self._resolver_context)
    self._file_object_set_in_init = True

    # pylint: disable=protected-access
    super(TSKPartitionFile, self)._Open(path_spec=path_spec, mode=mode)
github log2timeline / dfvfs / dfvfs / vfs / lvm_file_system.py View on Github external
Args:
      path_spec (PathSpec): path specification.
      mode (Optional[str]): file access mode. The default is 'rb' which
          represents read-only binary.

    Raises:
      AccessError: if the access to open the file was denied.
      IOError: if the file system object could not be opened.
      PathSpecError: if the path specification is incorrect.
      ValueError: if the path specification is invalid.
    """
    if not path_spec.HasParent():
      raise errors.PathSpecError(
          'Unsupported path specification without parent.')

    file_object = resolver.Resolver.OpenFileObject(
        path_spec.parent, resolver_context=self._resolver_context)

    try:
      vslvm_handle = pyvslvm.handle()
      vslvm_handle.open_file_object(file_object)
      # TODO: implement multi physical volume support.
      vslvm_handle.open_physical_volume_files_as_file_objects([
          file_object])
      vslvm_volume_group = vslvm_handle.get_volume_group()
    except:
      file_object.close()
      raise

    self._file_object = file_object
    self._vslvm_handle = vslvm_handle
    self._vslvm_volume_group = vslvm_volume_group
github libyal / winreg-kb / winregrc / dfvfs_pyregf.py View on Github external
"""Opens the file-like object defined by path specification.

    Args:
      path_spec (path.PathSpec): the path specification.

    Returns:
      pyregf.file: a Windows Registry file.

    Raises:
      PathSpecError: if the path specification is incorrect.
    """
    if not path_spec.HasParent():
      raise errors.PathSpecError(
          'Unsupported path specification without parent.')

    file_object = resolver.Resolver.OpenFileObject(
        path_spec.parent, resolver_context=self._resolver_context)
    regf_file = pyregf.file()
    regf_file.open_file_object(file_object)
    return regf_file
github log2timeline / dfvfs / dfvfs / file_io / ewf_file_io.py View on Github external
file_system = resolver.Resolver.OpenFileSystem(
        parent_path_spec, resolver_context=self._resolver_context)

    # Note that we cannot use pyewf's glob function since it does not
    # handle the file system abstraction dfvfs provides.
    segment_file_path_specs = ewf.EWFGlobPathSpec(file_system, path_spec)
    if not segment_file_path_specs:
      return None

    if parent_path_spec.IsSystemLevel():
      # Typically the file-like object cache should have room for 127 items.
      self._resolver_context.SetMaximumNumberOfFileObjects(
          len(segment_file_path_specs) + 127)

    for segment_file_path_spec in segment_file_path_specs:
      file_object = resolver.Resolver.OpenFileObject(
          segment_file_path_spec, resolver_context=self._resolver_context)
      self._file_objects.append(file_object)

    ewf_handle = pyewf.handle()
    ewf_handle.open_file_objects(self._file_objects)
    return ewf_handle