dfimagetools package

Submodules

dfimagetools.artifact_filters module

Helper for filtering based on artifact definitions.

class dfimagetools.artifact_filters.ArtifactDefinitionFiltersGenerator(artifacts_registry, environment_variables, user_accounts)[source]

Bases: object

Generator of filters based on artifact definitions.

GetFindSpecs(names)[source]

Retrieves find specifications for one or more artifact definitions.

Parameters

names (list[str]) – names of the artifact definitions to filter on.

Yields

dfvfs.FindSpec – file system (dfVFS) find specification.

dfimagetools.bodyfile module

Helper for generating bodyfile entries.

class dfimagetools.bodyfile.BodyfileGenerator[source]

Bases: object

Bodyfile generator.

GetEntries(file_entry, path_segments)[source]

Retrieves bodyfile entry representations of a file entry.

Parameters
  • file_entry (dfvfs.FileEntry) – file entry.

  • path_segments (str) – path segments of the full path of the file entry.

Yields

str – bodyfile entry.

dfimagetools.data_stream_writer module

Helper to write data streams.

class dfimagetools.data_stream_writer.DataStreamWriter[source]

Bases: object

Data stream writer.

GetDisplayPath(source_path_segments, source_data_stream_name)[source]

Retrieves a path to display.

Parameters
  • source_path_segments (list[str]) – path segment of the source file.

  • source_data_stream_name (str) – name of the data stream of the source file.

Returns

display path.

Return type

str

GetSanitizedPath(source_path_segments, source_data_stream_name, target_path)[source]

Retrieves santized a path.

This function replaces non-printable and other invalid path characters with an underscore “_”.

Parameters
  • source_path_segments (list[str]) – path segment of the source file.

  • source_data_stream_name (str) – name of the data stream of the source file.

  • target_path (str) – path of the target directory.

Returns

sanitized path.

Return type

str

WriteDataStream(file_entry, data_stream_name, destination_path)[source]

Writes the contents of the source data stream to a destination file.

Note that this function will overwrite an existing file.

Parameters
  • file_entry (dfvfs.FileEntry) – file entry whose content is to be written.

  • data_stream_name (str) – name of the data stream whose content is to be written.

  • destination_path (str) – path of the destination file.

dfimagetools.decorators module

Function decorators.

dfimagetools.decorators.deprecated(function)[source]

Decorator to mark functions or methods as deprecated.

dfimagetools.environment_variables module

Windows environment variables collector.

class dfimagetools.environment_variables.WindowsEnvironmentVariablesCollector[source]

Bases: object

Windows environment variables collector.

Collect(registry)[source]

Collects environment variables.

Parameters

registry (dfwinreg.WinRegistry) – Windows Registry.

Yields

EnvironmentVariable – an environment variable.

dfimagetools.file_entry_lister module

Helper to list file entries.

class dfimagetools.file_entry_lister.FileEntryLister(*args: Any, **kwargs: Any)[source]

Bases: VolumeScanner

File entry lister.

GetWindowsDirectory(base_path_spec)[source]

Retrieves the Windows directory from the base path specification.

Parameters

base_path_spec (dfvfs.PathSpec) – source path specification.

Returns

path of the Windows directory or None if not available.

Return type

str

ListFileEntries(base_path_specs)[source]

Lists file entries in the base path specifications.

Parameters

base_path_specs (list[dfvfs.PathSpec]) – source path specifications.

Yields

tuple[dfvfs.FileEntry, list[str]] – file entry and path segments.

ListFileEntriesWithFindSpecs(base_path_specs, find_specs)[source]

Lists file entries in the base path specifications.

This method filters file entries based on the find specifications.

Parameters
  • base_path_specs (list[dfvfs.PathSpec]) – source path specification.

  • find_specs (list[dfvfs.FindSpec]) – find specifications.

Yields

tuple[dfvfs.FileEntry, list[str]] – file entry and path segments.

dfimagetools.helpers module

Helper functions for CLI tools.

dfimagetools.helpers.SetDFVFSBackEnd(back_end)[source]

Sets the dfVFS back-end.

Parameters

back_end (str) – dfVFS back-end.

dfimagetools.path_resolver module

Helper for resolving paths.

class dfimagetools.path_resolver.PathResolver[source]

Bases: object

Path resolver.

ExpandEnvironmentVariables(path, path_separator, environment_variables)[source]

Expands environment variables.

Parameters
  • path (str) – path with environment variables.

  • path_separator (str) – path segment separator.

  • environment_variables (list[EnvironmentVariable]) – environment variables.

Returns

path with environment variables expanded.

Return type

str

ExpandGlobStars(path, path_separator)[source]

Expands globstars “**”.

A globstar “**” will recursively match all files and zero or more directories and subdirectories.

By default the maximum recursion depth is 10 subdirectories, a numeric values after the globstar, such as “**5”, can be used to define the maximum recursion depth.

Parameters
  • path (str) – path with globstars.

  • path_separator (str) – path segment separator.

Returns

path with seperate globs for every globstar.

Return type

str

ExpandUsersVariable(path, path_separator, user_accounts)[source]

Expands a users variable, such as %%users.appdata%%.

Parameters
  • path (str) – path with users variable.

  • path_separator (str) – path segment separator.

  • user_accounts (list[UserAccount]) – user accounts.

Returns

paths for which the users variables have been expanded.

Return type

list[str]

dfimagetools.resources module

Various resource classes.

class dfimagetools.resources.EnvironmentVariable(case_sensitive=True, name=None, value=None)[source]

Bases: object

Environment variable.

case_sensitive

True if environment variable name is case sensitive.

Type

bool

name

environment variable name such as “SystemRoot” as in “%SystemRoot%” or “HOME” as in “$HOME”.

Type

str

value

environment variable value such as “C:Windows” or “/home/user”.

Type

str

class dfimagetools.resources.UserAccount(full_name=None, group_identifier=None, identifier=None, user_directory=None, user_directory_path_separator='/', username=None)[source]

Bases: object

User account.

full_name

name describing the user.

Type

str

group_identifier

identifier of the primary group the user is part of.

Type

str

identifier

user identifier.

Type

str

user_directory

path of the user (or home or profile) directory.

Type

str

user_directory_path_separator

path segment separator of the user directory.

Type

str

username

name uniquely identifying the user.

Type

str

dfimagetools.windows_registry module

Helpers to collect information from the Windows Registry.

class dfimagetools.windows_registry.StorageMediaImageWindowsRegistryFileReader(*args: Any, **kwargs: Any)[source]

Bases: WinRegistryFileReader

Storage media image Windows Registry file reader.

Open(path, ascii_codepage='cp1252')[source]

Opens the Windows Registry file specified by the path.

Parameters
  • path (str) – path of the Windows Registry file. The path is a Windows path relative to the root of the file system that contains the specific Windows Registry file. E.g. C:WindowsSystem32configSYSTEM

  • ascii_codepage (Optional[str]) – ASCII string codepage.

Returns

Windows Registry file or None if the file cannot

be opened.

Return type

WinRegistryFile

class dfimagetools.windows_registry.WindowsRegistryCollector(path_spec, windows_directory)[source]

Bases: object

Windows Registry collector.

CollectSystemEnvironmentVariables()[source]

Collects the system environment variables.

Returns

environment variables.

Return type

list[EnvironmentVariable]

class dfimagetools.windows_registry.WindowsRegistryFile(*args: Any, **kwargs: Any)[source]

Bases: WinRegistryFile

Windows Registry file.

This class manages a Windows Registry file-like object.

Close()[source]

Closes the Windows Registry file.

GetKeyByPath(key_path)[source]

Retrieves the key for a specific path.

Parameters

key_path (str) – Windows Registry key path.

Returns

Windows Registry key or None if not available.

Return type

WinRegistryKey

GetRootKey()[source]

Retrieves the root key.

Returns

Windows Registry root key or None if not available.

Return type

WinRegistryKey

Open(file_object)[source]

Opens the Windows Registry file using a file-like object.

Parameters

file_object (file) – file-like object.

Raises
  • IOError – if the Windows Registry file cannot be opened.

  • OSError – if the Windows Registry file cannot be opened.

SetKeyPathPrefix(key_path_prefix)[source]

Sets the Window Registry key path prefix.

Parameters

key_path_prefix (str) – Windows Registry key path prefix.

Module contents

Collection of tools to process storage media images.