:py:mod:`dissect.vmfs` ====================== .. py:module:: dissect.vmfs Submodules ---------- .. toctree:: :titlesonly: :maxdepth: 1 c_vmfs/index.rst exceptions/index.rst lvm/index.rst resource/index.rst vmfs/index.rst Package Contents ---------------- Classes ~~~~~~~ .. autoapisummary:: dissect.vmfs.LVM dissect.vmfs.Extent dissect.vmfs.VMFS .. py:exception:: Error Bases: :py:obj:`Exception` Common base class for all non-exit exceptions. .. py:exception:: FileNotFoundError Bases: :py:obj:`Error` Common base class for all non-exit exceptions. .. py:exception:: InvalidHeader Bases: :py:obj:`Error` Common base class for all non-exit exceptions. .. py:exception:: NotADirectoryError Bases: :py:obj:`Error` Common base class for all non-exit exceptions. .. py:exception:: NotASymlinkError Bases: :py:obj:`Error` Common base class for all non-exit exceptions. .. py:class:: LVM(fh) Bases: :py:obj:`dissect.util.stream.AlignedStream` VMFS LVM implementation. Takes a list of file-like objects (or Extents) to construct a volume. VMFS should start at LVM dataOffset + 0x200000 .. py:class:: Extent(fh) Bases: :py:obj:`dissect.util.stream.AlignedStream` VMFS LVM physical extent implementation. PE bitmap is at VMFS_LVM_PE_BITMAP_BASE + version dependent offset. It appears that the LVM can start at the following offsets, however that still needs to be verified: - 0x100000 - 0x110000 - 0x200000 - 0x180000 - 0x900000 .. py:class:: VMFS(volume=None, vh=None, fdc=None, fbb=None, sbc=None, pbc=None, pb2=None, jbc=None) VMFS filesystem implementation. Assumes that an LVM has already been loaded. We implement it quite a bit different from how ESXi seems to use it. ESXi doesn't really distinguish between disk partitions and LVM volumes. Everything is a VMFS volume, and it either contains a filesystem header at 0x01300000 or it doesn't. Either it contains an LVM that requires multiple extents or it doesn't. It's all VMFS, LVM doesn't really exist and it's really just an extra header that specifies if the _filesystem_ requires multiple extents or not. This doesn't really fit with how the rest of dissect is architected, so we act like the LVM is a "proper LVM" that exposes a logical volume. We then load a "VMFS filesystem" on top of this logical volume. This volume is made up of one or more extents that are loaded beforehand. A lot of the math consists of bitwise shifts and masks, which translate to modulo or multiplication operations. For the sake of "maintainability" in relation to the original "code", we keep this as bitwise masks, at the sacrifice of some human readability. Comments explaining as such are placed where appropriate. .. py:property:: is_vmfs5 .. py:property:: is_vmfs6 .. py:method:: get(path, node=None) .. py:method:: file_descriptor(address, name=None, filetype=None) .. py:method:: iter_fd()