:py:mod:`dissect.hypervisor.disk.hdd` ===================================== .. py:module:: dissect.hypervisor.disk.hdd Module Contents --------------- Classes ~~~~~~~ .. autoapisummary:: dissect.hypervisor.disk.hdd.HDD dissect.hypervisor.disk.hdd.Descriptor dissect.hypervisor.disk.hdd.XMLEntry dissect.hypervisor.disk.hdd.StorageData dissect.hypervisor.disk.hdd.Storage dissect.hypervisor.disk.hdd.Image dissect.hypervisor.disk.hdd.Snapshots dissect.hypervisor.disk.hdd.Shot dissect.hypervisor.disk.hdd.StorageStream dissect.hypervisor.disk.hdd.HDS Attributes ~~~~~~~~~~ .. autoapisummary:: dissect.hypervisor.disk.hdd.DEFAULT_TOP_GUID dissect.hypervisor.disk.hdd.NULL_GUID .. py:data:: DEFAULT_TOP_GUID .. py:data:: NULL_GUID .. py:class:: HDD(path: pathlib.Path) Parallels HDD virtual disk implementation. :param path: The path to the .hdd directory or .hdd file in a .hdd directory. .. py:method:: open(guid: Optional[Union[str, uuid.UUID]] = None) -> BinaryIO Open a stream for this HDD, optionally for a specific snapshot. If no snapshot GUID is provided, the "top" snapshot will be used. :param guid: The snapshot GUID to open. .. py:class:: Descriptor(path: pathlib.Path) Helper class for working with ``DiskDescriptor.xml``. .. rubric:: References - https://github.com/qemu/qemu/blob/master/docs/interop/prl-xml.txt :param path: The path to ``DiskDescriptor.xml``. .. py:method:: get_snapshot_chain(guid: uuid.UUID) -> list[uuid.UUID] Return the snapshot chain for a given snapshot GUID. :param guid: The snapshot GUID to return a chain for. .. py:class:: XMLEntry .. py:method:: from_xml(element: xml.etree.ElementTree.Element) -> XMLEntry :classmethod: .. py:class:: StorageData Bases: :py:obj:`XMLEntry` .. py:attribute:: storages :type: list[Storage] .. py:class:: Storage Bases: :py:obj:`XMLEntry` .. py:attribute:: start :type: int .. py:attribute:: end :type: int .. py:attribute:: images :type: list[Image] .. py:method:: find_image(guid: uuid.UUID) -> Image Find a specific image GUID. :param guid: The image GUID to find. :raises KeyError: If the GUID could not be found. .. py:class:: Image Bases: :py:obj:`XMLEntry` .. py:attribute:: guid :type: uuid.UUID .. py:attribute:: type :type: str .. py:attribute:: file :type: str .. py:class:: Snapshots Bases: :py:obj:`XMLEntry` .. py:attribute:: top_guid :type: Optional[uuid.UUID] .. py:attribute:: shots :type: list[Shot] .. py:method:: find_shot(guid: uuid.UUID) -> Shot Find a specific snapshot GUID. :param guid: The snapshot GUID to find. :raises KeyError: If the GUID could not be found. .. py:class:: Shot Bases: :py:obj:`XMLEntry` .. py:attribute:: guid :type: uuid.UUID .. py:attribute:: parent :type: uuid.UUID .. py:class:: StorageStream(streams: list[tuple[Storage, BinaryIO]]) Bases: :py:obj:`dissect.util.stream.AlignedStream` Stream implementation for HDD streams. HDD files can exist of one or multiple streams, starting at consecutive offsets. This class stitches all streams together into a single stream. :param streams: A list of :class:`Storage` and file-like object tuples. .. py:class:: HDS(fh: BinaryIO, parent: Optional[BinaryIO] = None) Bases: :py:obj:`dissect.util.stream.AlignedStream` Parallels HDS implementation. HDS is the format for Parallels sparse disk files. :param fh: The file-like object to the HDS file. :param parent: Optional file-like object for the parent HDS file. .. py:method:: bat() -> list[int] Return the block allocation table (BAT).