dissect.thumbcache

Subpackages

Submodules

Package Contents

Classes

IndexEntry

ThumbnailIndex

Thumbcache

This class combines the thumbnailindex and thumbcachefile.

ThumbcacheEntry

ThumbcacheFile

exception dissect.thumbcache.Error

Bases: Exception

A generic exception for the thumbcache module.

class dissect.thumbcache.IndexEntry(fh: BinaryIO, type: dissect.thumbcache.util.ThumbnailType)
property header: dissect.cstruct.Structure
property identifier: bytes
property flags: int
property cache_offsets: list[int]

Retrieves the index data entries.

These are offsets into the thumbcache files, where the order specifies in which of the files. More information about the order can be found in Thumbcache.

property last_modified: datetime.datetime
in_use() → bool
__repr__() → str

Return repr(self).

class dissect.thumbcache.ThumbnailIndex(fh: BinaryIO)
property header: dissect.cstruct.Structure
property version: int
property type: dissect.thumbcache.util.ThumbnailType
property total_entries: int
property used_entries: int
entries() → Iterator[IndexEntry]

Returns all index entries that are actually used.

class dissect.thumbcache.Thumbcache(path: pathlib.Path, prefix: str = 'thumbcache')

This class combines the thumbnailindex and thumbcachefile.

The class looks up all files inside path that have the same prefix.

Parameters:

  • path – The directory that contains the thumbcache files.

  • prefix – The start of the name to search for.

property mapping: dict[int, pathlib.Path]

Looks at the version field in the cache file header.

entries() → Iterator[tuple[pathlib.Path, dissect.thumbcache.thumbcache_file.ThumbcacheEntry]]

Iterates through all the specific entries from the thumbcache files.

index_entries() → Iterator[dissect.thumbcache.index.IndexEntry]

Iterates through all the index entries that are in use.

class dissect.thumbcache.ThumbcacheEntry(fh: BinaryIO, type: dissect.thumbcache.util.ThumbnailType)
property hash: str
property extension: str

This property contains the extension type of the data (Only in VISTA).

property data: bytes
__repr__()

Return repr(self).

class dissect.thumbcache.ThumbcacheFile(fh: BinaryIO)
property header: dissect.cstruct.Structure
property version: dissect.thumbcache.util.ThumbnailType
__slots__ = ['fh', '_header', 'signature', 'type', 'size', 'offset', '_entries', '_cached_entries']

This class defines a thumbcache file, that is usually denoted by thumbcache_*.db. Which is is different from the thumbcache_idx.db.

Parameters:

fh – A file-like object.

__getitem__(key: int) → ThumbcacheEntry
__getattribute__(__name: str) → Any

Return getattr(self, name).

entries() → list[ThumbcacheEntry]