dissect.btrfs.tree

Module Contents

Classes

BTree

Represent a Btrfs B-tree.

Cursor

A basic cursor implementation for interacting with a BTree.
class dissect.btrfs.tree.BTree(btrfs: dissect.btrfs.btrfs.Btrfs, root_item: dissect.btrfs.c_btrfs.c_btrfs.btrfs_root_item | None = None, root_offset: int | None = None)

Represent a Btrfs B-tree.

One of root_item or root_offset must be given.

Parameters:

  • btrfs – The filesystem this B-tree belongs to.

  • root_item – Optional btrfs_root_item to open the B-tree from.

  • root_offset – Optional offset to open the B-tree from.

cursor() → Cursor

Return a new cursor into the B-tree.

find(objectid: int | None = None, type: int | None = None, offset: int | None = None) → tuple[dissect.btrfs.c_btrfs.c_btrfs.btrfs_item, memoryview]

Search for a single item in the B-tree.

Parameters:

  • objectid – Optional object ID to search for.

  • type – Optional type to search for.

  • offset – Optional offset to search for.

class dissect.btrfs.tree.Cursor(btree: BTree)

A basic cursor implementation for interacting with a BTree.

Parameters:

btree – The BTree to open a cursor on.

reset() → None

Reset the cursor.

push(address: int, initial_index: int = 0) → None

Push the cursor down a node.

Parameters:

  • address – The address of the node to push down to.

  • initial_index – The initial index to seek to in the new node. -1 means the last item.

pop() → None

Pop up a node.

next() → None

Traverse to the next leaf item.

Will move up and down the tree to find the next leaf item.

next_node() → None

Traverse to the next node.

Will move up and down the tree to find the next node.

prev() → None

Traverse to the previous leaf item.

Will move up and down the tree to find the previous leaf item.

prev_node() → None

Traverse to the previous leaf item.

Will move up and down the tree to find the previous leaf item.

first() → None

Move the cursor to the first leaf item.

last() → None

Move the cursor to the last leaf item.

get() → tuple[dissect.btrfs.c_btrfs.c_btrfs.btrfs_item, memoryview]

Retrieve the leaf item and the associated data at the current cursor position.

Cursor must be positioned at a leaf item.

item() → dissect.btrfs.c_btrfs.c_btrfs.btrfs_key_ptr | dissect.btrfs.c_btrfs.c_btrfs.btrfs_item

Retrieve a leaf or branch item.

Cursor can be positioned at a branch or leaf item.

items() → Iterator[dissect.btrfs.c_btrfs.c_btrfs.btrfs_key_ptr | dissect.btrfs.c_btrfs.c_btrfs.btrfs_item]

Iterate over all items in the current node.

data() → memoryview

Return the associated data of the current leaf item.

iter(objectid: int | None = None, type: int | None = None, offset: int | None = None, ignore_offset: bool = False) → Iterator[tuple[dissect.btrfs.c_btrfs.c_btrfs.btrfs_item, memoryview]]

Search and iterate the B-tree for the specified key.

Stop iterating if the current item no longer matches the given parameters.

Parameters:

  • objectid – Optional object ID to search for.

  • type – Optional type to search for.

  • offset – Optional offset to search for.

  • ignore_offset – Only use the offset argument for the initial positioning of the cursor, but ignore it for future iterations. This is useful for e.g. iterating file extents.

walk(objectid: int | None = None, type: int | None = None, offset: int | None = None) → Iterator[tuple[dissect.btrfs.c_btrfs.c_btrfs.btrfs_item, memoryview]]

Walk all leaf items of the B-tree and yield all matching leafs.

Parameters:

  • objectid – Optional object ID to yield items of.

  • type – Optional type to yield items of.

  • offset – Optional offset to yield items of.

search(objectid: int | None = None, type: int | None = None, offset: int | None = None) → bool

Perform a binary search on the current node for the key with the given parameters.

Puts the cursor at the index of the matching item, or just before a “greater” item if no exact match is found. True is returned if this is the case, else False is returned and the cursor position is reset.

Parameters:

  • objectid – Optional object ID to search for.

  • type – Optional type to search for.

  • offset – Optional offset to search for.