How to use the pytsk3.TSK_FS_META_TYPE_LNK function in pytsk3

To help you get started, we’ve selected a few pytsk3 examples, based on popular ways it is used in public projects.

Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.

github SekoiaLab / fastir_artifacts / fastir / common / filesystem.py View on Github external
def is_symlink(self, path_object):
        return path_object.obj.info.meta.type == pytsk3.TSK_FS_META_TYPE_LNK
github log2timeline / plaso / plaso / pvfs / pfile_entry.py View on Github external
def IsLink(self):
    """Determines if the file entry is a link."""
    tsk_fs_meta_type = getattr(
        self.file_object.fileobj.info.meta, 'type',
        pytsk3.TSK_FS_META_TYPE_UNDEF)
    return tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_LNK
github google / grr / grr / client / grr_response_client / vfs_handlers / sleuthkit.py View on Github external
pytsk3.TSK_FS_NAME_TYPE_UNDEF: 0,
      pytsk3.TSK_FS_NAME_TYPE_FIFO: stat.S_IFIFO,
      pytsk3.TSK_FS_NAME_TYPE_CHR: stat.S_IFCHR,
      pytsk3.TSK_FS_NAME_TYPE_DIR: stat.S_IFDIR,
      pytsk3.TSK_FS_NAME_TYPE_BLK: stat.S_IFBLK,
      pytsk3.TSK_FS_NAME_TYPE_REG: stat.S_IFREG,
      pytsk3.TSK_FS_NAME_TYPE_LNK: stat.S_IFLNK,
      pytsk3.TSK_FS_NAME_TYPE_SOCK: stat.S_IFSOCK,
  }

  META_TYPE_LOOKUP = {
      pytsk3.TSK_FS_META_TYPE_BLK: 0,
      pytsk3.TSK_FS_META_TYPE_CHR: stat.S_IFCHR,
      pytsk3.TSK_FS_META_TYPE_DIR: stat.S_IFDIR,
      pytsk3.TSK_FS_META_TYPE_FIFO: stat.S_IFIFO,
      pytsk3.TSK_FS_META_TYPE_LNK: stat.S_IFLNK,
      pytsk3.TSK_FS_META_TYPE_REG: stat.S_IFREG,
      pytsk3.TSK_FS_META_TYPE_SOCK: stat.S_IFSOCK,
  }

  # Files we won't return in directories.
  BLACKLIST_FILES = [
      "$OrphanFiles"  # Special TSK dir that invokes processing.
  ]

  # The file like object we read our image from
  tsk_raw_device = None

  # NTFS files carry an attribute identified by ntfs_type and ntfs_id.
  tsk_attribute = None

  # This is all bits that define the type of the file in the stat mode. Equal to
github py4n6 / aff4 / python2.6 / tsk / tskfuse.py View on Github external
def make_stat(meta):
    """ Return a stat structure from TSK metadata struct """
    meta_type_dispatcher = {
        pytsk3.TSK_FS_META_TYPE_DIR: stat.S_IFDIR,
        pytsk3.TSK_FS_META_TYPE_REG: stat.S_IFREG,
        pytsk3.TSK_FS_META_TYPE_FIFO: stat.S_IFIFO,
        pytsk3.TSK_FS_META_TYPE_CHR: stat.S_IFCHR,
        pytsk3.TSK_FS_META_TYPE_LNK: stat.S_IFLNK,
        pytsk3.TSK_FS_META_TYPE_BLK: stat.S_IFBLK,
        }

    s = fuse.Stat()
    s.st_ino = meta.addr
    s.st_dev = 0
    s.st_nlink = meta.nlink
    s.st_uid = meta.uid
    s.st_gid = meta.gid
    s.st_size = meta.size
    s.st_atime = meta.atime
    s.st_mtime = meta.mtime
    s.st_ctime = meta.crtime
    s.st_blocks = 2
    s.st_rdev = 0
    s.st_mode = meta_type_dispatcher.get(int(meta.type), 0)
github google / rekall / rekall-agent / rekall_agent / client_actions / tsk.py View on Github external
pytsk3.TSK_FS_NAME_TYPE_BLK: "b",
    pytsk3.TSK_FS_NAME_TYPE_REG: "r",
    pytsk3.TSK_FS_NAME_TYPE_LNK: "l",
    pytsk3.TSK_FS_NAME_TYPE_SOCK: "h",
    pytsk3.TSK_FS_NAME_TYPE_SHAD: "s",
    pytsk3.TSK_FS_NAME_TYPE_WHT: "w",
    pytsk3.TSK_FS_NAME_TYPE_VIRT: "v"
}

META_TYPE_LOOKUP = {
    pytsk3.TSK_FS_META_TYPE_REG: "r",
    pytsk3.TSK_FS_META_TYPE_DIR: "d",
    pytsk3.TSK_FS_META_TYPE_FIFO: "p",
    pytsk3.TSK_FS_META_TYPE_CHR: "c",
    pytsk3.TSK_FS_META_TYPE_BLK: "b",
    pytsk3.TSK_FS_META_TYPE_LNK: "h",
    pytsk3.TSK_FS_META_TYPE_SHAD: "s",
    pytsk3.TSK_FS_META_TYPE_SOCK: "s",
    pytsk3.TSK_FS_META_TYPE_WHT: "w",
    pytsk3.TSK_FS_META_TYPE_VIRT: "v"
}

ATTRIBUTE_TYPES_TO_PRINT = [
    pytsk3.TSK_FS_ATTR_TYPE_NTFS_IDXROOT,
    pytsk3.TSK_FS_ATTR_TYPE_NTFS_DATA,
    pytsk3.TSK_FS_ATTR_TYPE_DEFAULT]


class TSKListDirectoryAction(files.ListDirectoryAction):
    """List Directory via TSK."""
    schema = [
        dict(name="path",
github log2timeline / dfvfs / dfvfs / vfs / tsk_file_entry.py View on Github external
resolver_context, file_system, path_spec, is_root=is_root,
        is_virtual=is_virtual)
    self._file_system_type = tsk_file.info.fs_info.ftype
    self._name = None
    self._parent_inode = parent_inode
    self._tsk_file = tsk_file

    # The type is an instance of pytsk3.TSK_FS_META_TYPE_ENUM.
    tsk_fs_meta_type = getattr(
        tsk_file.info.meta, 'type', pytsk3.TSK_FS_META_TYPE_UNDEF)

    if tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_REG:
      self.entry_type = definitions.FILE_ENTRY_TYPE_FILE
    elif tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_DIR:
      self.entry_type = definitions.FILE_ENTRY_TYPE_DIRECTORY
    elif tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_LNK:
      self.entry_type = definitions.FILE_ENTRY_TYPE_LINK
    elif tsk_fs_meta_type in (
        pytsk3.TSK_FS_META_TYPE_CHR, pytsk3.TSK_FS_META_TYPE_BLK):
      self.entry_type = definitions.FILE_ENTRY_TYPE_DEVICE
    elif tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_FIFO:
      self.entry_type = definitions.FILE_ENTRY_TYPE_PIPE
    elif tsk_fs_meta_type == pytsk3.TSK_FS_META_TYPE_SOCK:
      self.entry_type = definitions.FILE_ENTRY_TYPE_SOCKET