Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
def IsAllocated(self):
"""Return a boolean indicating if the file is allocated or not."""
ret = False
flags = self.fileobj.info.meta.flags
if flags:
if int(flags) & int(pytsk3.TSK_FS_META_FLAG_ALLOC):
ret = True
return ret
def _is_file_allocated(self, tsk_fs_file):
"""
Returns true if file is currently allocated, otherwise false
"""
## need to check the flags field -- tsk_fs_file.meta.flags
# return (not tsk_fs_file.meta) or (tsk_fs_file.meta.flags & pytsk3.TSK_FS_META_FLAG_ALLOC != 0)
return (long(str(tsk_fs_file.meta.flags)) & pytsk3.TSK_FS_META_FLAG_ALLOC) != 0
@TODO Finish this!!!!
@bug: bit shifting for extracting flag values is currently wrong!
They all evalutate 1 for some reason when the flags bitmask clearly
idicates they aren't
"""
# Get our flags
new_flags = long(str(new_file.info.meta.flags))
mft_filename = self._get_path(self.mft_raw, inode)
semantic_data_new = {
'filename':mft_filename,
'flags':new_flags,
# Extract Flags
'flag_alloc':new_flags & pytsk3.TSK_FS_META_FLAG_ALLOC,
'flag_comp':(new_flags & pytsk3.TSK_FS_META_FLAG_COMP) >> 4,
'flag_orphan':(new_flags & pytsk3.TSK_FS_META_FLAG_ORPHAN) >> 5,
'flag_unalloc':(new_flags & pytsk3.TSK_FS_META_FLAG_UNALLOC) >> 1,
'flag_unused':(new_flags & pytsk3.TSK_FS_META_FLAG_UNUSED) >> 3,
'flag_used':(new_flags & pytsk3.TSK_FS_META_FLAG_USED) >> 2,
'size':new_file.info.meta.size,
'uid':new_file.info.meta.uid,
'gid':new_file.info.meta.gid,
# 'hidden':new_file.info.meta.hidden,
'mtime':new_file.info.meta.mtime,
'mtime_nano':new_file.info.meta.mtime_nano,
'atime':new_file.info.meta.atime,
'atime_nano':new_file.info.meta.atime_nano,
'ctime':new_file.info.meta.ctime,
'ctime_nano':new_file.info.meta.ctime_nano,
'crtime':new_file.info.meta.crtime,
def is_allocated(self, tsk_entry):
return (int(tsk_entry.info.name.flags) & pytsk3.TSK_FS_NAME_FLAG_ALLOC != 0 and
int(tsk_entry.info.meta.flags) & pytsk3.TSK_FS_META_FLAG_ALLOC != 0)
def IsAllocated(self):
"""Return a boolean indicating if the file is allocated or not."""
ret = False
flags = self.fileobj.info.meta.flags
if flags:
if int(flags) & int(pytsk3.TSK_FS_META_FLAG_ALLOC):
ret = True
return ret
def IsAllocated(self):
"""Determines if the file entry is allocated."""
flags = getattr(self.file_object.fileobj.info.meta, 'flags', 0)
return int(flags) & pytsk3.TSK_FS_META_FLAG_ALLOC
stat_object.uid = getattr(self._tsk_file.info.meta, 'uid', None)
stat_object.gid = getattr(self._tsk_file.info.meta, 'gid', None)
# File entry type stat information.
# Other stat information.
stat_object.ino = getattr(self._tsk_file.info.meta, 'addr', None)
# stat_object.dev = stat_info.st_dev
# stat_object.nlink = getattr(self._tsk_file.info.meta, 'nlink', None)
# stat_object.fs_type = 'Unknown'
flags = getattr(self._tsk_file.info.meta, 'flags', 0)
# The flags are an instance of pytsk3.TSK_FS_META_FLAG_ENUM.
stat_object.is_allocated = bool(int(flags) & pytsk3.TSK_FS_META_FLAG_ALLOC)
return stat_object