dissect.hypervisor.disk.hdd

Module Contents

Classes

HDD

Parallels HDD virtual disk implementation.

Descriptor

Helper class for working with DiskDescriptor.xml.

XMLEntry

StorageData

Storage

Image

Snapshots

Shot

StorageStream

Stream implementation for HDD streams.

HDS

Parallels HDS implementation.

Attributes

DEFAULT_TOP_GUID

NULL_GUID

dissect.hypervisor.disk.hdd.DEFAULT_TOP_GUID
dissect.hypervisor.disk.hdd.NULL_GUID
class dissect.hypervisor.disk.hdd.HDD(path: pathlib.Path)

Parallels HDD virtual disk implementation.

Parameters:

path – The path to the .hdd directory or .hdd file in a .hdd directory.

open(guid: str | uuid.UUID | None = None) → BinaryIO

Open a stream for this HDD, optionally for a specific snapshot.

If no snapshot GUID is provided, the “top” snapshot will be used.

Parameters:

guid – The snapshot GUID to open.

class dissect.hypervisor.disk.hdd.Descriptor(path: pathlib.Path)

Helper class for working with DiskDescriptor.xml.

References

Parameters:

path – The path to DiskDescriptor.xml.

get_snapshot_chain(guid: uuid.UUID) → list[uuid.UUID]

Return the snapshot chain for a given snapshot GUID.

Parameters:

guid – The snapshot GUID to return a chain for.

class dissect.hypervisor.disk.hdd.XMLEntry
classmethod from_xml(element: xml.etree.ElementTree.Element) → XMLEntry
class dissect.hypervisor.disk.hdd.StorageData

Bases: XMLEntry

storages: list[Storage]
class dissect.hypervisor.disk.hdd.Storage

Bases: XMLEntry

start: int
end: int
images: list[Image]
find_image(guid: uuid.UUID) → Image

Find a specific image GUID.

Parameters:

guid – The image GUID to find.

Raises:

KeyError – If the GUID could not be found.

class dissect.hypervisor.disk.hdd.Image

Bases: XMLEntry

guid: uuid.UUID
type: str
file: str
class dissect.hypervisor.disk.hdd.Snapshots

Bases: XMLEntry

top_guid: uuid.UUID | None
shots: list[Shot]
find_shot(guid: uuid.UUID) → Shot

Find a specific snapshot GUID.

Parameters:

guid – The snapshot GUID to find.

Raises:

KeyError – If the GUID could not be found.

class dissect.hypervisor.disk.hdd.Shot

Bases: XMLEntry

guid: uuid.UUID
parent: uuid.UUID
class dissect.hypervisor.disk.hdd.StorageStream(streams: list[tuple[Storage, BinaryIO]])

Bases: dissect.util.stream.AlignedStream

Stream implementation for HDD streams.

HDD files can exist of one or multiple streams, starting at consecutive offsets. This class stitches all streams together into a single stream.

Parameters:

streams – A list of Storage and file-like object tuples.

class dissect.hypervisor.disk.hdd.HDS(fh: BinaryIO, parent: BinaryIO | None = None)

Bases: dissect.util.stream.AlignedStream

Parallels HDS implementation.

HDS is the format for Parallels sparse disk files.

Parameters:

  • fh – The file-like object to the HDS file.

  • parent – Optional file-like object for the parent HDS file.

bat() → list[int]

Return the block allocation table (BAT).