:py:mod:`dissect.evidence`
==========================

.. py:module:: dissect.evidence


Subpackages
-----------
.. toctree::
   :titlesonly:
   :maxdepth: 3

   asdf/index.rst
   tools/index.rst


Submodules
----------
.. toctree::
   :titlesonly:
   :maxdepth: 1

   ad1/index.rst
   ewf/index.rst
   exceptions/index.rst


Package Contents
----------------

Classes
~~~~~~~

.. autoapisummary::

   dissect.evidence.AsdfSnapshot
   dissect.evidence.AsdfStream
   dissect.evidence.EWF




.. py:class:: AsdfSnapshot(fh: BinaryIO, recover: bool = False)


   ASDF file reader.

   :param fh: File-like object to read the ASDF file from.

   .. py:method:: contains(idx: int) -> bool

      Check whether this file contains the given stream index.

      :param idx: The stream to check.


   .. py:method:: open(idx: int) -> AsdfStream

      Open a specific stream in the file.

      :param idx: The stream to open.


   .. py:method:: streams() -> AsdfStream

      Iterate over all streams in the file.


   .. py:method:: disks() -> AsdfStream

      Iterate over all non-reserved streams in the file.



.. py:class:: AsdfStream(asdf: AsdfSnapshot, idx: int)


   Bases: :py:obj:`dissect.util.stream.AlignedStream`

   ASDF stream from a snapshot.

   :param asdf: :class:`AsdfSnapshot` parent object.
   :param idx: Stream index in the :class:`AsdfSnapshot`.


.. py:class:: EWF(fh: Union[BinaryIO, list[BinaryIO]])


   Expert Witness Disk Image Format.

   .. py:method:: open_segment(idx: int) -> Segment


   .. py:method:: open() -> BinaryIO