dissect.btrfs.btrfs
#
Module Contents#
Classes#
Btrfs filesystem implementation. |
|
Represent a Btrfs subvolume. |
|
Represent a Btrfs inode. |
- class dissect.btrfs.btrfs.Btrfs(fh: BinaryIO | list[BinaryIO])#
Btrfs filesystem implementation.
This implementation supports most basic Btrfs features such as subvolumes, compression and (meta)data RAID. To open a RAID volume, simply pass all file-like objects that belong to the RAID set as a list.
- Parameters:
fh – A file-like object for the volume to use for parsing Btrfs.
- get(path: str | int, node: INode | None = None) INode #
Retrieve a Btrfs inode by path or inode number.
- Parameters:
path – Filesystem path or inode number.
node – Optional inode used for relative lookups.
- class dissect.btrfs.btrfs.Subvolume(btrfs: Btrfs, objectid: int, parent: INode | None = None)#
Represent a Btrfs subvolume.
Btrfs has support for multiple subvolumes. The default subvolume is the
FS_TREE
subvolume. Each subvolume has its own B-tree.- Parameters:
btrfs – The filesystem this subvolume belongs to.
objectid – The object ID of the subvolume to open.
parent – Optional parent node to attach to the root of the subvolume.
- __repr__() str #
Return repr(self).
- tree() dissect.btrfs.tree.BTree #
- uuid() uuid.UUID #
- path() str #
- get(path: str | int, node: INode | None = None) INode #
Retrieve a Btrfs inode by path or inode number.
- Parameters:
path – Filesystem path or inode number.
node – Optional inode used for relative lookups.
- inode(inum: int, type: int | None = None, parent: INode | None = None) INode #
Return an
INode
by number, optionally attaching a type and parent.
- resolve_path(objectid: int) str #
- class dissect.btrfs.btrfs.INode(subvolume: Subvolume, inum: int, type: int | None = None, parent: INode | None = None)#
Represent a Btrfs inode.
- Parameters:
subvolume – The subvolume this inode belongs to.
inum – The inode number of this inode.
type – Optional file type of this inode, as observed in a directory entry.
parent – Optional parent of this inode, if this inode is parsed from a directory listing.
- property path: str#
Return the path to this inode within the subvolume. In case of multiple hardlinks, return the first path.
- property full_path: str#
Return the full path to this inode. In case of multiple hardlinks, return the first path.
- __repr__() str #
Return repr(self).
- inode() dissect.btrfs.c_btrfs.c_btrfs.btrfs_inode_item #
Return the parsed inode structure.
- size() int #
Return the file size.
- uid() int #
Return the owner user ID.
- gid() int #
Return the owner group ID.
- mode() int #
Return the file mode.
- type() int #
Return the file type.
- atime() datetime.datetime #
Return datetime timestamp of last access.
- atime_ns() int #
Return nanosecond timestamp of last access.
- ctime() datetime.datetime #
Return datetime timestamp of last metadata change.
- ctime_ns() int #
Return nanosecond timestamp of last metadata change.
- mtime() datetime.datetime #
Return datetime timestamp of last content modification.
- mtime_ns() int #
Return nanosecond timestamp of last content modification.
- otime() datetime.datetime #
Return datetime timestamp of inode creation.
- otime_ns() int #
Return nanosecond timestamp of inode creation.
- is_dir() bool #
Return whether this inode is a directory.
- is_file() bool #
Return whether this inode is a regular file.
- is_symlink() bool #
Return whether this inode is a symlink.
- is_block_device() bool #
Return whether this inode is a block device.
- is_character_device() bool #
Return whether this inode is a character device.
- is_device() bool #
Return whether this inode is a device.
- is_fifo() bool #
Return whether this inode is a FIFO file.
- is_socket() bool #
Return whether this inode is a socket file.
- is_ipc() bool #
Return whether this inode is an IPC file.
- link() str #
Return the symlink target.
- get(path: str) INode #
Retrieve a Btrfs inode relative from this inode.
- Parameters:
path – Filesystem path.
- paths(full: bool = False) Iterator[str] #
Yield all paths (hardlinks) to this inode.
By default only resolves up to the root of the subvolume this inode belongs to. For a full path to the root of the filesystem tree, set
full
toTrue
.- Parameters:
full – Whether to fully resolve the path up to the root of the filesystem tree.
- extents() list[dissect.btrfs.stream.Extent] | None #
- open() BinaryIO #
Return the data stream for the inode.
File data in Btrfs can be inlined in the B-tree or stored in file extents. In both cases it can be compressed.