:py:mod:`dissect.target.volume` =============================== .. py:module:: dissect.target.volume Module Contents --------------- Classes ~~~~~~~ .. autoapisummary:: dissect.target.volume.VolumeSystem dissect.target.volume.EncryptedVolumeSystem dissect.target.volume.LogicalVolumeSystem dissect.target.volume.Volume Functions ~~~~~~~~~ .. autoapisummary:: :nosignatures: dissect.target.volume.open dissect.target.volume.is_lvm_volume dissect.target.volume.is_encrypted dissect.target.volume.open_encrypted dissect.target.volume.open_lvm Attributes ~~~~~~~~~~ .. autoapisummary:: dissect.target.volume.disk dissect.target.volume.lvm dissect.target.volume.vmfs dissect.target.volume.md dissect.target.volume.ddf dissect.target.volume.bde dissect.target.volume.luks dissect.target.volume.log dissect.target.volume.LOGICAL_VOLUME_MANAGERS dissect.target.volume.ENCRYPTED_VOLUME_MANAGERS .. py:data:: disk A lazy import of :mod:`dissect.target.volumes.disk`. .. py:data:: lvm A lazy import of :mod:`dissect.target.volumes.lvm`. .. py:data:: vmfs A lazy import of :mod:`dissect.target.volumes.vmfs`. .. py:data:: md A lazy import of :mod:`dissect.target.volumes.md`. .. py:data:: ddf A lazy import of :mod:`dissect.target.volumes.ddf`. .. py:data:: bde A lazy import of :mod:`dissect.target.volumes.bde`. .. py:data:: luks A lazy import of :mod:`dissect.target.volumes.luks`. .. py:data:: log A logger instance for this module. .. py:data:: LOGICAL_VOLUME_MANAGERS :type: list[type[LogicalVolumeSystem]] All available :class:`LogicalVolumeSystem` classes. .. py:data:: ENCRYPTED_VOLUME_MANAGERS :type: list[type[EncryptedVolumeSystem]] All available :class:`EncryptedVolumeSystem` classes. .. py:class:: VolumeSystem(fh: Union[BinaryIO, list[BinaryIO]], dsk: Optional[dissect.target.container.Container] = None, serial: Optional[str] = None) The base class for a volume system implementation. Volume systems are responsible for parsing a volume system over one or more disks and returning all available volumes. Subclasses of ``VolumeSystem`` must implement the ``_detect`` and ``_volumes`` methods. :param fh: The source file-like object(s) on which to open the volume system. :param dsk: A reference to the source disk or container. :param serial: Serial number of the volume system, if any. .. py:property:: volumes :type: list[Volume] A list of all the discovered volumes. .. py:attribute:: __type__ :type: str A short string identifying the type of volume system. .. py:method:: __repr__() -> str Return repr(self). .. py:method:: detect(fh: BinaryIO) -> bool :classmethod: Detects whether this ``VolumeSystem`` class can be opened on the given file-like object. The position of ``fh`` will be restored before returning. :returns: ``True`` or ``False`` if the ``VolumeSystem`` can be opened from this file-like object. .. py:class:: EncryptedVolumeSystem(fh: BinaryIO, *args, **kwargs) Bases: :py:obj:`VolumeSystem` An extension of the :class:`VolumeSystem` class that provides additional functionality for dealing with encryption. It adds helper functions for interacting with the :attr:`~dissect.target.helpers.keychain.KEYCHAIN`, so that subclasses don't have to manually interact with it. :param fh: The file-like object on which to open the encrypted volume system. .. py:method:: get_keys_for_identifier(identifier: str) -> list[dissect.target.helpers.keychain.Key] Retrieves a list of keys that match a single ``identifier``. :param identifier: A single key identifier. :returns: All the keys for a single identifier. .. py:method:: get_keys_for_identifiers(identifiers: list[str]) -> list[dissect.target.helpers.keychain.Key] Retrieves a list of keys that match a list of ``identifiers``. :param identifiers: A list of different key identifiers. .. py:method:: get_keys_without_identifier() -> list[dissect.target.helpers.keychain.Key] Retrieve a list of keys that have no identifier (``None``). These are the keys where no specific identifier was specified. .. py:class:: LogicalVolumeSystem(fh: Union[BinaryIO, list[BinaryIO]], dsk: Optional[dissect.target.container.Container] = None, serial: Optional[str] = None) Bases: :py:obj:`VolumeSystem` An extension of the :class:`VolumeSystem` class that provides additional functionality for dealing with logical volume systems. .. py:method:: detect_volume(fh: BinaryIO) -> bool :classmethod: Determine whether the given file-like object belongs to this logical volume system. The position of ``fh`` will be restored before returning. :param fh: A file-like object that may be part of the logical volume system. :returns: ``True`` if the given file-like object is part of the logical volume system, ``False`` otherwise. .. py:method:: open_all(volumes: list[BinaryIO]) -> Iterator[LogicalVolumeSystem] :classmethod: :abstractmethod: Open all the discovered logical volume systems from the given file-like objects. There can be more than one logical volume system on a given set of file-like objects. For example, you can have five disks or volumes with two separate LVM2 volume groups. This function is responsible for grouping the correct disks and volumes with each other, and correctly opening each distinct logical volume system. :param volumes: A list of file-like objects to discover and open the logical volume systems on. :returns: An iterator of :class:`LogicalVolumeSystem`. .. py:class:: Volume(fh: BinaryIO, number: int, offset: Optional[int], size: int, vtype: Optional[int], name: Optional[str], guid: Optional[str] = None, raw: Optional[BinaryIO] = None, disk: Optional[BinaryIO] = None, vs: Optional[VolumeSystem] = None, fs: Optional[dissect.target.filesystem.Filesystem] = None, drive_letter: Optional[str] = None) Bases: :py:obj:`io.IOBase` A representation of a volume on disk. It behaves like a regular file-like object with some additional information bound to it. :param fh: The raw file-like object of the volume. :param number: The logical volume number of this volume within the volume system. :param offset: Where the volume starts relative to the start of the volume system. :param size: The size of the volume. :param vtype: What kind of volume it is. :param name: The name of the volume. :param guid: The unique identifier of the volume. :param raw: A reference to the implementation specific object that the volume system uses for representing the volume. :param disk: A reference to the associated :class:`~dissect.volume.disk.Disk`. :param vs: A reference to the associated :class:`VolumeSystem`. :param fs: A reference to the :class:`~dissect.target.filesystem.Filesystem` that is on this ``Volume``. :param drive_letter: The letter associated to the ``Volume``, such as `c` or `d` in Windows. .. py:method:: __repr__() -> str Return repr(self). .. py:method:: read(length: int = -1) -> bytes Read a ``length`` of bytes from this ``Volume``. .. py:method:: readinto(b: bytearray) -> int Uses :func:`dissect.target.helpers.utils.readinto`. .. py:method:: seek(offset: int, whence: int = io.SEEK_SET) -> int Change the stream position to ``offset``. ``whence`` determines where to seek from: * ``io.SEEK_SET`` (``0``):: absolute offset in the stream. * ``io.SEEK_CUR`` (``1``):: current position in the stream. * ``io.SEEK_END`` (``2``):: end of stream. :param offset: The offset relative to the position indicated by ``whence``. :param whence: Where to start the seek from. .. py:method:: tell() -> int Returns the current seek position of the ``Volume``. .. py:method:: seekable() -> bool Returns whether ``seek`` can be used by this volume. Always ``True``. .. py:function:: open(fh: BinaryIO, *args, **kwargs) -> dissect.target.volumes.disk.DissectVolumeSystem Open a :class:`~dissect.target.volumes.disk.DissectVolumeSystem` on the given file-like object. :param fh: The file-like object to open a :class:`~dissect.target.volumes.disk.DissectVolumeSystem` on. :raises VolumeSystemError: If opening the :class:`~dissect.target.volumes.disk.DissectVolumeSystem` failed. :returns: An opened :class:`~dissect.target.volumes.disk.DissectVolumeSystem`. .. py:function:: is_lvm_volume(volume: BinaryIO) -> bool Determine whether the given file-like object belongs to any supported logical volume system. :param volume: A file-like object to test if it is part of any logical volume system. .. py:function:: is_encrypted(volume: BinaryIO) -> bool Determine whether the given file-like object belongs to any supported encrypted volume system. :param volume: A file-like object to test if it is part of any encrypted volume system. .. py:function:: open_encrypted(volume: BinaryIO) -> Iterator[Volume] Open an encrypted ``volume``. An encrypted volume can only be opened if the encrypted volume system can successfully decrypt the volume, meaning that the correct decryption key must be present in the :attr:`~dissect.target.helpers.keychain.KEYCHAIN`. The resulting :class:`Volume` object provides transparent decryption of the encrypted volume. :param volume: A file-like object representing a :class:`Volume`. :returns: An iterator of decrypted :class:`Volume` objects as opened by the encrypted volume manager. .. py:function:: open_lvm(volumes: list[BinaryIO], *args, **kwargs) -> Iterator[VolumeSystem] Open a single logical volume system on a list of file-like objects. :param volumes: A list of file-like objects to open a logical volume system on. :returns: An iterator of all the :class:`Volume` objects opened by the logical volume system.