:py:mod:`dissect.btrfs.btrfs` ============================= .. py:module:: dissect.btrfs.btrfs Module Contents --------------- Classes ~~~~~~~ .. autoapisummary:: dissect.btrfs.btrfs.Btrfs dissect.btrfs.btrfs.Subvolume dissect.btrfs.btrfs.INode .. py:class:: Btrfs(fh: Union[BinaryIO, list[BinaryIO]]) Btrfs filesystem implementation. This implementation supports most basic Btrfs features such as subvolumes, compression and (meta)data RAID. To open a RAID volume, simply pass all file-like objects that belong to the RAID set as a list. :param fh: A file-like object for the volume to use for parsing Btrfs. .. py:method:: get(path: Union[str, int], node: Optional[INode] = None) -> INode Retrieve a Btrfs inode by path or inode number. :param path: Filesystem path or inode number. :param node: Optional inode used for relative lookups. .. py:method:: subvolumes() -> Iterator[Subvolume] Yield all subvolumes. .. py:method:: find_subvolume(path: Optional[str] = None) -> Optional[Subvolume] Find a subvolume by path. :param path: The path of the subvolume to find. .. py:method:: open_subvolume(objectid: int, parent: Optional[INode] = None) -> Subvolume Open a subvolume. :param objectid: The objectid of the subvolume to open. :param parent: Optional parent node to attach to the root of the subvolume. .. py:class:: Subvolume(btrfs: Btrfs, objectid: int, parent: Optional[INode] = None) Represent a Btrfs subvolume. Btrfs has support for multiple subvolumes. The default subvolume is the ``FS_TREE`` subvolume. Each subvolume has its own B-tree. :param btrfs: The filesystem this subvolume belongs to. :param objectid: The object ID of the subvolume to open. :param parent: Optional parent node to attach to the root of the subvolume. .. py:method:: __repr__() -> str Return repr(self). .. py:method:: tree() -> dissect.btrfs.tree.BTree .. py:method:: uuid() -> uuid.UUID .. py:method:: root() -> INode .. py:method:: path() -> str .. py:method:: get(path: Union[str, int], node: Optional[INode] = None) -> INode Retrieve a Btrfs inode by path or inode number. :param path: Filesystem path or inode number. :param node: Optional inode used for relative lookups. .. py:method:: inode(inum: int, type: Optional[int] = None, parent: Optional[INode] = None) -> INode Return an :class:`INode` by number, optionally attaching a type and parent. .. py:method:: resolve_path(objectid: int) -> str .. py:class:: INode(subvolume: Subvolume, inum: int, type: Optional[int] = None, parent: Optional[INode] = None) Represent a Btrfs inode. :param subvolume: The subvolume this inode belongs to. :param inum: The inode number of this inode. :param type: Optional file type of this inode, as observed in a directory entry. :param parent: Optional parent of this inode, if this inode is parsed from a directory listing. .. py:property:: parents :type: list[INode] .. py:property:: path :type: str Return the path to this inode within the subvolume. In case of multiple hardlinks, return the first path. .. py:property:: full_path :type: str Return the full path to this inode. In case of multiple hardlinks, return the first path. .. py:method:: __repr__() -> str Return repr(self). .. py:method:: inode() -> dissect.btrfs.c_btrfs.c_btrfs.btrfs_inode_item Return the parsed inode structure. .. py:method:: size() -> int Return the file size. .. py:method:: uid() -> int Return the owner user ID. .. py:method:: gid() -> int Return the owner group ID. .. py:method:: mode() -> int Return the file mode. .. py:method:: type() -> int Return the file type. .. py:method:: atime() -> datetime.datetime Return datetime timestamp of last access. .. py:method:: atime_ns() -> int Return nanosecond timestamp of last access. .. py:method:: ctime() -> datetime.datetime Return datetime timestamp of last metadata change. .. py:method:: ctime_ns() -> int Return nanosecond timestamp of last metadata change. .. py:method:: mtime() -> datetime.datetime Return datetime timestamp of last content modification. .. py:method:: mtime_ns() -> int Return nanosecond timestamp of last content modification. .. py:method:: otime() -> datetime.datetime Return datetime timestamp of inode creation. .. py:method:: otime_ns() -> int Return nanosecond timestamp of inode creation. .. py:method:: is_dir() -> bool Return whether this inode is a directory. .. py:method:: is_file() -> bool Return whether this inode is a regular file. .. py:method:: is_symlink() -> bool Return whether this inode is a symlink. .. py:method:: is_block_device() -> bool Return whether this inode is a block device. .. py:method:: is_character_device() -> bool Return whether this inode is a character device. .. py:method:: is_device() -> bool Return whether this inode is a device. .. py:method:: is_fifo() -> bool Return whether this inode is a FIFO file. .. py:method:: is_socket() -> bool Return whether this inode is a socket file. .. py:method:: is_ipc() -> bool Return whether this inode is an IPC file. .. py:method:: link() -> str Return the symlink target. .. py:method:: link_inode() -> INode Resolve the symlink target to an inode. .. py:method:: get(path: str) -> INode Retrieve a Btrfs inode relative from this inode. :param path: Filesystem path. .. py:method:: paths(full: bool = False) -> Iterator[str] Yield all paths (hardlinks) to this inode. By default only resolves up to the root of the subvolume this inode belongs to. For a full path to the root of the filesystem tree, set ``full`` to ``True``. :param full: Whether to fully resolve the path up to the root of the filesystem tree. .. py:method:: listdir() -> dict[str, INode] Return a directory listing. .. py:method:: iterdir() -> Iterator[tuple[str, INode]] Iterate directory contents. .. py:method:: extents() -> Optional[list[dissect.btrfs.stream.Extent]] .. py:method:: open() -> BinaryIO Return the data stream for the inode. File data in Btrfs can be inlined in the B-tree or stored in file extents. In both cases it can be compressed.