Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
Args:
path_spec (PathSpec): path specification of the file system.
mode (Optional[str]): file access mode. The default is 'rb' which
represents read-only binary.
Raises:
AccessError: if the access to open the file was denied.
IOError: if the file system object could not be opened.
PathSpecError: if the path specification is incorrect.
ValueError: if the path specification is invalid.
"""
if not path_spec.HasParent():
raise errors.PathSpecError(
'Unsupported path specification without parent.')
file_object = resolver.Resolver.OpenFileObject(
path_spec.parent, resolver_context=self._resolver_context)
try:
zip_file = zipfile.ZipFile(file_object, 'r')
except:
file_object.close()
raise
self._file_object = file_object
self._zip_file = zip_file
Args:
path_spec (PathSpec): a path specification.
mode (Optional[str]): file access mode. The default is 'rb' which
represents read-only binary.
Raises:
AccessError: if the access to open the file was denied.
IOError: if the file system object could not be opened.
PathSpecError: if the path specification is incorrect.
ValueError: if the path specification is invalid.
"""
if not path_spec.HasParent():
raise errors.PathSpecError(
'Unsupported path specification without parent.')
file_object = resolver.Resolver.OpenFileObject(
path_spec.parent, resolver_context=self._resolver_context)
try:
tsk_image_object = tsk_image.TSKFileSystemImage(file_object)
tsk_volume = pytsk3.Volume_Info(tsk_image_object)
except:
file_object.close()
raise
self._file_object = file_object
self._tsk_volume = tsk_volume
def OpenFile(self, windows_path):
"""Opens the file specificed by the Windows path.
Args:
windows_path: the Windows path to the file.
Returns:
The file-like object (instance of dfvfs.FileIO) or None if
the file does not exist.
"""
path_spec = self._path_resolver.ResolvePath(windows_path)
if path_spec is None:
return None
return resolver.Resolver.OpenFileObject(path_spec)
# Also see: https://github.com/log2timeline/dfvfs/issues/332
container_file_entry = resolver.Resolver.OpenFileEntry(
scan_node.path_spec, resolver_context=self._resolver_context)
fsapfs_volume = container_file_entry.GetAPFSVolume()
# TODO: unlocking the volume multiple times is inefficient cache volume
# object in scan node and use is_locked = fsapfs_volume.is_locked()
try:
is_locked = not apfs_helper.APFSUnlockVolume(
fsapfs_volume, scan_node.path_spec, resolver.Resolver.key_chain)
except IOError as exception:
raise errors.BackEndError(
'Unable to unlock APFS volume with error: {0!s}'.format(exception))
else:
file_object = resolver.Resolver.OpenFileObject(
scan_node.path_spec, resolver_context=self._resolver_context)
is_locked = not file_object or file_object.is_locked
file_object.close()
if is_locked:
scan_context.LockScanNode(scan_node.path_spec)
# For BitLocker To Go add a scan node for the unencrypted part of
# the volume.
if scan_node.type_indicator == definitions.TYPE_INDICATOR_BDE:
path_spec = self.ScanForFileSystem(scan_node.path_spec.parent)
if path_spec:
scan_context.AddScanNode(path_spec, scan_node.parent_node)
parser_mediator (ParserMediator): parser mediator.
file_entry (dfvfs.FileEntry): file entry.
data_stream_name (str): data stream name.
"""
parent_path_spec = getattr(file_entry.path_spec, 'parent', None)
filename_upper = file_entry.name.upper()
if (self._mft_parser and parent_path_spec and
filename_upper in ('$MFT', '$MFTMIRR') and not data_stream_name):
self._ParseDataStreamWithParser(
parser_mediator, self._mft_parser, file_entry, '')
elif (self._usnjrnl_parser and parent_path_spec and
filename_upper == '$USNJRNL' and data_stream_name == '$J'):
# To be able to ignore the sparse data ranges the UsnJrnl parser
# needs to read directly from the volume.
volume_file_object = path_spec_resolver.Resolver.OpenFileObject(
parent_path_spec, resolver_context=parser_mediator.resolver_context)
try:
self._ParseFileEntryWithParser(
parser_mediator, self._usnjrnl_parser, file_entry,
file_object=volume_file_object)
finally:
volume_file_object.close()
'specification.')
range_offset = tsk_partition.TSKVsPartGetStartSector(tsk_vs)
range_size = tsk_partition.TSKVsPartGetNumberOfSectors(tsk_vs)
if range_offset is None or range_size is None:
raise errors.PathSpecError(
'Unable to retrieve TSK volume system part data range from path '
'specification.')
bytes_per_sector = tsk_partition.TSKVolumeGetBytesPerSector(tsk_volume)
range_offset *= bytes_per_sector
range_size *= bytes_per_sector
self.SetRange(range_offset, range_size)
self._file_object = resolver.Resolver.OpenFileObject(
path_spec.parent, resolver_context=self._resolver_context)
self._file_object_set_in_init = True
# pylint: disable=protected-access
super(TSKPartitionFile, self)._Open(path_spec=path_spec, mode=mode)
Args:
path_spec (PathSpec): path specification.
mode (Optional[str]): file access mode. The default is 'rb' which
represents read-only binary.
Raises:
AccessError: if the access to open the file was denied.
IOError: if the file system object could not be opened.
PathSpecError: if the path specification is incorrect.
ValueError: if the path specification is invalid.
"""
if not path_spec.HasParent():
raise errors.PathSpecError(
'Unsupported path specification without parent.')
file_object = resolver.Resolver.OpenFileObject(
path_spec.parent, resolver_context=self._resolver_context)
try:
vslvm_handle = pyvslvm.handle()
vslvm_handle.open_file_object(file_object)
# TODO: implement multi physical volume support.
vslvm_handle.open_physical_volume_files_as_file_objects([
file_object])
vslvm_volume_group = vslvm_handle.get_volume_group()
except:
file_object.close()
raise
self._file_object = file_object
self._vslvm_handle = vslvm_handle
self._vslvm_volume_group = vslvm_volume_group
"""Opens the file-like object defined by path specification.
Args:
path_spec (path.PathSpec): the path specification.
Returns:
pyregf.file: a Windows Registry file.
Raises:
PathSpecError: if the path specification is incorrect.
"""
if not path_spec.HasParent():
raise errors.PathSpecError(
'Unsupported path specification without parent.')
file_object = resolver.Resolver.OpenFileObject(
path_spec.parent, resolver_context=self._resolver_context)
regf_file = pyregf.file()
regf_file.open_file_object(file_object)
return regf_file
file_system = resolver.Resolver.OpenFileSystem(
parent_path_spec, resolver_context=self._resolver_context)
# Note that we cannot use pyewf's glob function since it does not
# handle the file system abstraction dfvfs provides.
segment_file_path_specs = ewf.EWFGlobPathSpec(file_system, path_spec)
if not segment_file_path_specs:
return None
if parent_path_spec.IsSystemLevel():
# Typically the file-like object cache should have room for 127 items.
self._resolver_context.SetMaximumNumberOfFileObjects(
len(segment_file_path_specs) + 127)
for segment_file_path_spec in segment_file_path_specs:
file_object = resolver.Resolver.OpenFileObject(
segment_file_path_spec, resolver_context=self._resolver_context)
self._file_objects.append(file_object)
ewf_handle = pyewf.handle()
ewf_handle.open_file_objects(self._file_objects)
return ewf_handle