How to use the pytsk3.TSK_FS_META_FLAG_ALLOC function in pytsk3

To help you get started, we’ve selected a few pytsk3 examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github log2timeline / plaso / plaso / lib / sleuthkit.py View on Github external
def IsAllocated(self):
    """Return a boolean indicating if the file is allocated or not."""
    ret = False
    flags = self.fileobj.info.meta.flags

    if flags:
      if int(flags) & int(pytsk3.TSK_FS_META_FLAG_ALLOC):
        ret = True

    return ret
github mit-ll / LO-PHI / python-lophi-semanticgap / lophi_semanticgap / disk / filesystems / __init__.py View on Github external
def _is_file_allocated(self, tsk_fs_file):
        """
        Returns true if file is currently allocated, otherwise false
        """
        
        ## need to check the flags field -- tsk_fs_file.meta.flags
        
#        return (not tsk_fs_file.meta) or (tsk_fs_file.meta.flags & pytsk3.TSK_FS_META_FLAG_ALLOC != 0)
        return (long(str(tsk_fs_file.meta.flags)) & pytsk3.TSK_FS_META_FLAG_ALLOC) != 0
github mit-ll / LO-PHI / python-lophi-semanticgap / lophi_semanticgap / disk / filesystem_reconstructor.py View on Github external
@TODO Finish this!!!!
            @bug: bit shifting for extracting flag values is currently wrong!
            They all evalutate 1 for some reason when the flags bitmask clearly 
            idicates they aren't
        """

        # Get our flags
        new_flags = long(str(new_file.info.meta.flags))
        mft_filename = self._get_path(self.mft_raw, inode)
            
        semantic_data_new = {
                                'filename':mft_filename,
                                'flags':new_flags,
                                # Extract Flags
                                'flag_alloc':new_flags & pytsk3.TSK_FS_META_FLAG_ALLOC,
                                'flag_comp':(new_flags & pytsk3.TSK_FS_META_FLAG_COMP) >> 4,
                                'flag_orphan':(new_flags & pytsk3.TSK_FS_META_FLAG_ORPHAN) >> 5,
                                'flag_unalloc':(new_flags & pytsk3.TSK_FS_META_FLAG_UNALLOC) >> 1,
                                'flag_unused':(new_flags & pytsk3.TSK_FS_META_FLAG_UNUSED) >> 3,
                                'flag_used':(new_flags & pytsk3.TSK_FS_META_FLAG_USED) >> 2,
                                'size':new_file.info.meta.size,
                                'uid':new_file.info.meta.uid,
                                'gid':new_file.info.meta.gid,
#                                 'hidden':new_file.info.meta.hidden,
                                'mtime':new_file.info.meta.mtime,
                                'mtime_nano':new_file.info.meta.mtime_nano,
                                'atime':new_file.info.meta.atime,
                                'atime_nano':new_file.info.meta.atime_nano,
                                'ctime':new_file.info.meta.ctime,
                                'ctime_nano':new_file.info.meta.ctime_nano,
                                'crtime':new_file.info.meta.crtime,
github SekoiaLab / fastir_artifacts / fastir / common / filesystem.py View on Github external
def is_allocated(self, tsk_entry):
        return (int(tsk_entry.info.name.flags) & pytsk3.TSK_FS_NAME_FLAG_ALLOC != 0 and
                int(tsk_entry.info.meta.flags) & pytsk3.TSK_FS_META_FLAG_ALLOC != 0)
github log2timeline / dfvfs / pyvfs / vfs / sleuthkit.py View on Github external
def IsAllocated(self):
    """Return a boolean indicating if the file is allocated or not."""
    ret = False
    flags = self.fileobj.info.meta.flags

    if flags:
      if int(flags) & int(pytsk3.TSK_FS_META_FLAG_ALLOC):
        ret = True

    return ret
github log2timeline / plaso / plaso / pvfs / pfile_entry.py View on Github external
def IsAllocated(self):
    """Determines if the file entry is allocated."""
    flags = getattr(self.file_object.fileobj.info.meta, 'flags', 0)
    return int(flags) & pytsk3.TSK_FS_META_FLAG_ALLOC
github log2timeline / dfvfs / dfvfs / vfs / tsk_file_entry.py View on Github external
stat_object.uid = getattr(self._tsk_file.info.meta, 'uid', None)
    stat_object.gid = getattr(self._tsk_file.info.meta, 'gid', None)

    # File entry type stat information.

    # Other stat information.
    stat_object.ino = getattr(self._tsk_file.info.meta, 'addr', None)
    # stat_object.dev = stat_info.st_dev
    # stat_object.nlink = getattr(self._tsk_file.info.meta, 'nlink', None)
    # stat_object.fs_type = 'Unknown'

    flags = getattr(self._tsk_file.info.meta, 'flags', 0)

    # The flags are an instance of pytsk3.TSK_FS_META_FLAG_ENUM.
    stat_object.is_allocated = bool(int(flags) & pytsk3.TSK_FS_META_FLAG_ALLOC)

    return stat_object