Skip to content

Changes to support non 512 block sizes with TSK partition #822

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
joachimmetz merged 1 commit into from
Jul 17, 2026
Merged

Changes to support non 512 block sizes with TSK partition #822

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion config/dpkg/control
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ Homepage: https://github.com/log2timeline/dfvfs

Package: python3-dfvfs
Architecture: all
Depends: libbde-python3 (>= 20220121), libcaes-python3 (>= 20240114), libewf-python3 (>= 20131210), libfcrypto-python3 (>= 20240114), libfsapfs-python3 (>= 20220709), libfsext-python3 (>= 20220829), libfsfat-python3 (>= 20220925), libfshfs-python3 (>= 20220831), libfsntfs-python3 (>= 20211229), libfsxfs-python3 (>= 20260702), libfvde-python3 (>= 20220121), libfwnt-python3 (>= 20210717), libluksde-python3 (>= 20220121), libmodi-python3 (>= 20210405), libphdi-python3 (>= 20220228), libqcow-python3 (>= 20201213), libsigscan-python3 (>= 20230109), libsmdev-python3 (>= 20140529), libsmraw-python3 (>= 20140612), libvhdi-python3 (>= 20201014), libvmdk-python3 (>= 20140421), libvsapm-python3 (>= 20260713), libvsgpt-python3 (>= 20211115), libvshadow-python3 (>= 20160109), libvslvm-python3 (>= 20160109), python3-dfdatetime (>= 20221112), python3-dtfabric (>= 20230518), python3-pytsk3 (>= 20210419), python3-xattr (>= 0.7.2), python3-yaml (>= 3.10), ${misc:Depends}
Depends: libbde-python3 (>= 20220121), libcaes-python3 (>= 20240114), libewf-python3 (>= 20131210), libfcrypto-python3 (>= 20240114), libfsapfs-python3 (>= 20220709), libfsext-python3 (>= 20220829), libfsfat-python3 (>= 20220925), libfshfs-python3 (>= 20220831), libfsntfs-python3 (>= 20211229), libfsxfs-python3 (>= 20260702), libfvde-python3 (>= 20220121), libfwnt-python3 (>= 20210717), libluksde-python3 (>= 20220121), libmodi-python3 (>= 20210405), libphdi-python3 (>= 20220228), libqcow-python3 (>= 20201213), libsigscan-python3 (>= 20230109), libsmdev-python3 (>= 20140529), libsmraw-python3 (>= 20140612), libvhdi-python3 (>= 20201014), libvmdk-python3 (>= 20140421), libvsapm-python3 (>= 20260713), libvsgpt-python3 (>= 20211115), libvshadow-python3 (>= 20160109), libvslvm-python3 (>= 20160109), python3-dfdatetime (>= 20221112), python3-dtfabric (>= 20230518), python3-pytsk3 (>= 20260715), python3-xattr (>= 0.7.2), python3-yaml (>= 3.10), ${misc:Depends}
Description: Python 3 module of dfVFS
dfVFS, or Digital Forensics Virtual File System, provides read-only access to
file-system objects from various storage media types and file formats. The goal
Expand Down
2 changes: 1 addition & 1 deletion dependencies.ini
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,7 +164,7 @@ version_property: get_version()

[pytsk3]
dpkg_name: python3-pytsk3
minimum_version: 20210419
minimum_version: 20260715
rpm_name: python3-pytsk3
version_property: get_version()

Expand Down
5 changes: 0 additions & 5 deletions dfvfs/analyzer/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,11 +26,6 @@
except ImportError:
pass

try:
from dfvfs.analyzer import tsk_partition_analyzer_helper
except ImportError:
pass

from dfvfs.analyzer import vhdi_analyzer_helper
from dfvfs.analyzer import vmdk_analyzer_helper
from dfvfs.analyzer import vshadow_analyzer_helper
Expand Down
32 changes: 13 additions & 19 deletions dfvfs/analyzer/analyzer.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,9 +138,9 @@ def _GetSpecificationStore(cls, format_category):
format_category (str): format category.

Returns:
tuple[FormatSpecificationStore, list[AnalyzerHelper]]: a format
specification store and remaining analyzer helpers that do not have
a format specification.
tuple[FormatSpecificationStore, list[AnalyzerHelper]]: a format specification
store and remaining analyzer helpers that do not have a format
specification.
"""
specification_store = specification.FormatSpecificationStore()
remainder_list = []
Expand Down Expand Up @@ -173,11 +173,11 @@ def _GetTypeIndicators(
Args:
signature_scanner (pysigscan.scanner): signature scanner.
specification_store (FormatSpecificationStore): specification store.
remainder_list (list[AnalyzerHelper]): remaining analyzer helpers that
do not have a format specification.
remainder_list (list[AnalyzerHelper]): remaining analyzer helpers that do not
have a format specification.
path_spec (PathSpec): path specification.
resolver_context (Optional[Context]): resolver context, where None
represents the built-in context which is not multi process safe.
resolver_context (Optional[Context]): resolver context, where None represents
the built-in context which is not multi process safe.

Returns:
list[str]: supported format type indicators.
Expand All @@ -195,7 +195,6 @@ def _GetTypeIndicators(
format_specification = specification_store.GetSpecificationBySignature(
scan_result.identifier
)

if format_specification.identifier not in type_indicator_list:
type_indicator_list.append(format_specification.identifier)

Expand All @@ -220,10 +219,8 @@ def DeregisterHelper(cls, analyzer_helper):
"""
if analyzer_helper.type_indicator not in cls._analyzer_helpers:
raise KeyError(
(
f"Analyzer helper object not set for type indicator: "
f"{analyzer_helper.type_indicator:s}."
)
f"Analyzer helper object not set for type indicator: "
f"{analyzer_helper.type_indicator:s}."
)

analyzer_helper = cls._analyzer_helpers[analyzer_helper.type_indicator]
Expand All @@ -238,8 +235,8 @@ def GetArchiveTypeIndicators(cls, path_spec, resolver_context=None):

Args:
path_spec (PathSpec): path specification.
resolver_context (Optional[Context]): resolver context, where None
represents the built-in context which is not multi process safe.
resolver_context (Optional[Context]): resolver context, where None represents
the built-in context which is not multi process safe.

Returns:
list[str]: supported format type indicators.
Expand Down Expand Up @@ -396,7 +393,6 @@ def GetVolumeSystemTypeIndicators(cls, path_spec, resolver_context=None):
path_spec,
resolver_context=resolver_context,
)

if (
len(type_indicators) > 1
and definitions.TYPE_INDICATOR_TSK_PARTITION in type_indicators
Expand All @@ -420,10 +416,8 @@ def RegisterHelper(cls, analyzer_helper):
"""
if analyzer_helper.type_indicator in cls._analyzer_helpers:
raise KeyError(
(
f"Analyzer helper object already set for type indicator: "
f"{analyzer_helper.type_indicator:s}."
)
f"Analyzer helper object already set for type indicator: "
f"{analyzer_helper.type_indicator:s}."
)

cls._FlushCache(analyzer_helper.format_categories)
Expand Down
38 changes: 0 additions & 38 deletions dfvfs/analyzer/tsk_partition_analyzer_helper.py
View file
Open in desktop

This file was deleted.

Loading
Loading