Added support for volume identifier in path log2timeline#19

joachimmetz · Dec 27, 2021 · cde85df · cde85df
1 parent df18e6d
commit cde85df
Show file tree

Hide file tree

Showing 5 changed files with 42 additions and 34 deletions.
diff --git a/config/dpkg/control b/config/dpkg/control
@@ -9,7 +9,7 @@ Homepage: https://github.com/log2timeline/dfimagetools
 
 Package: python3-dfimagetools
 Architecture: all
-Depends: libbde-python3 (>= 20140531), libewf-python3 (>= 20131210), libfsapfs-python3 (>= 20201107), libfsext-python3 (>= 20210721), libfshfs-python3 (>= 20210722), libfsntfs-python3 (>= 20200921), libfsxfs-python3 (>= 20210726), libfvde-python3 (>= 20160719), libfwnt-python3 (>= 20210717), libluksde-python3 (>= 20200101), libmodi-python3 (>= 20210405), libqcow-python3 (>= 20201213), libsigscan-python3 (>= 20191221), libsmdev-python3 (>= 20140529), libsmraw-python3 (>= 20140612), libvhdi-python3 (>= 20201014), libvmdk-python3 (>= 20140421), libvsgpt-python3 (>= 20210207), libvshadow-python3 (>= 20160109), libvslvm-python3 (>= 20160109), python3-cffi-backend (>= 1.9.1), python3-cryptography (>= 2.0.2), python3-dfdatetime (>= 20211225), python3-dfvfs (>= 20211224), python3-dtfabric (>= 20170524), python3-idna (>= 2.5), python3-pytsk3 (>= 20210419), python3-pyxattr (>= 0.7.2), python3-yaml (>= 3.10), ${python3:Depends}, ${misc:Depends}
+Depends: libbde-python3 (>= 20140531), libewf-python3 (>= 20131210), libfsapfs-python3 (>= 20201107), libfsext-python3 (>= 20210721), libfshfs-python3 (>= 20210722), libfsntfs-python3 (>= 20200921), libfsxfs-python3 (>= 20210726), libfvde-python3 (>= 20160719), libfwnt-python3 (>= 20210717), libluksde-python3 (>= 20200101), libmodi-python3 (>= 20210405), libqcow-python3 (>= 20201213), libsigscan-python3 (>= 20191221), libsmdev-python3 (>= 20140529), libsmraw-python3 (>= 20140612), libvhdi-python3 (>= 20201014), libvmdk-python3 (>= 20140421), libvsgpt-python3 (>= 20210207), libvshadow-python3 (>= 20160109), libvslvm-python3 (>= 20160109), python3-cffi-backend (>= 1.9.1), python3-cryptography (>= 2.0.2), python3-dfdatetime (>= 20211225), python3-dfvfs (>= 20211227), python3-dtfabric (>= 20170524), python3-idna (>= 2.5), python3-pytsk3 (>= 20210419), python3-pyxattr (>= 0.7.2), python3-yaml (>= 3.10), ${python3:Depends}, ${misc:Depends}
 Description: Python 3 module of dfImageTools
  Collection of tools to process storage media images.
 

diff --git a/dependencies.ini b/dependencies.ini
@@ -19,7 +19,7 @@ version_property: __version__
 
 [dfvfs]
 dpkg_name: python3-dfvfs
-minimum_version: 20211224
+minimum_version: 20211227
 rpm_name: python3-dfvfs
 version_property: __version__
 

diff --git a/dfimagetools/file_entry_lister.py b/dfimagetools/file_entry_lister.py
@@ -12,6 +12,7 @@
 from dfvfs.helpers import volume_scanner
 from dfvfs.lib import definitions as dfvfs_definitions
 from dfvfs.resolver import resolver
+from dfvfs.volume import factory as dfvfs_volume_system_factory
 
 
 try:
@@ -98,32 +99,6 @@ def _GetBodyfileModeString(self, mode):
 
     return ''.join(file_mode)
 
-  def _GetBodyfileName(self, path_spec, path_segments):
-    """Retrieves a bodyfile name value.
-
-    Args:
-      path_spec (dfvfs.PathSpec): path specification of the file entry.
-      path_segments (list[str]): path segments of the full path of the file
-          entry.
-
-    Returns:
-      str: bodyfile name value.
-    """
-    name_value = ''
-
-    if path_spec.HasParent():
-      parent_path_spec = path_spec.parent
-      if parent_path_spec and parent_path_spec.type_indicator in (
-          dfvfs_definitions.PARTITION_TABLE_TYPE_INDICATORS):
-        name_value = ''.join([name_value, parent_path_spec.location])
-
-    path_segments = [
-        segment.translate(self._bodyfile_escape_characters)
-        for segment in path_segments]
-    name_value = ''.join([name_value, '/'.join(path_segments)])
-
-    return name_value or '/'
-
   def _GetBodyfileTimestamp(self, date_time):
     """Retrieves a bodyfile timestamp representation of a date time value.
 
@@ -173,7 +148,9 @@ def _ListFileEntry(self, file_system, file_entry, parent_path_segments):
     Yields:
       tuple[dfvfs.FileEntry, list[str]]: file entry and path segments.
     """
-    path_segments = parent_path_segments + [file_entry.name]
+    path_segments = list(parent_path_segments)
+    if not file_entry.IsRoot():
+      path_segments.append(file_entry.name)
 
     if not self._list_only_files or file_entry.IsFile():
       yield file_entry, path_segments
@@ -225,8 +202,10 @@ def GetBodyfileEntries(self, file_entry, path_segments):
     # TODO: add support to calculate MD5
     md5_string = '0'
 
-    file_entry_name_value = self._GetBodyfileName(
-        file_entry.path_spec, path_segments)
+    path_segments = [
+        segment.translate(self._bodyfile_escape_characters)
+        for segment in path_segments]
+    file_entry_name_value = '/'.join(path_segments) or '/'
 
     if file_entry.link:
       name_value = '{0:s} -> {1:s}'.format(
@@ -288,5 +267,34 @@ def ListFileEntries(self, base_path_specs):
             path_specification_string))
         return
 
-      for result in self._ListFileEntry(file_system, file_entry, []):
+      base_path_segments = ['']
+      if base_path_spec.HasParent() and base_path_spec.parent:
+        if base_path_spec.parent.type_indicator in (
+            dfvfs_definitions.TYPE_INDICATOR_APFS_CONTAINER,
+            dfvfs_definitions.TYPE_INDICATOR_GPT,
+            dfvfs_definitions.TYPE_INDICATOR_LVM):
+          volume_system = dfvfs_volume_system_factory.Factory.NewVolumeSystem(
+              base_path_spec.parent.type_indicator)
+          volume_system.Open(base_path_spec.parent)
+
+          volume = volume_system.GetVolumeByIdentifier(
+              base_path_spec.parent.location[1:])
+
+          if base_path_spec.parent.type_indicator == (
+              dfvfs_definitions.TYPE_INDICATOR_GPT):
+            volume_identifier_prefix = 'gpt'
+          else:
+            volume_identifier_prefix = volume_system.VOLUME_IDENTIFIER_PREFIX
+
+          volume_identifier = volume.GetAttribute('identifier')
+
+          base_path_segments = ['', '{0:s}{{{1:s}}}'.format(
+              volume_identifier_prefix, volume_identifier.value)]
+
+        elif base_path_spec.parent.type_indicator == (
+            dfvfs_definitions.TYPE_INDICATOR_TSK_PARTITION):
+          base_path_segments = base_path_spec.parent.location.split('/')
+
+      for result in self._ListFileEntry(
+          file_system, file_entry, base_path_segments):
         yield result
diff --git a/requirements.txt b/requirements.txt
@@ -3,7 +3,7 @@ PyYAML >= 3.10
 cffi >= 1.9.1
 cryptography >= 2.0.2
 dfdatetime >= 20211225
-dfvfs >= 20211224
+dfvfs >= 20211227
 dtfabric >= 20170524
 libbde-python >= 20140531
 libewf-python >= 20131210

diff --git a/setup.cfg b/setup.cfg
@@ -30,7 +30,7 @@ requires = libbde-python3 >= 20140531
            python3-cffi >= 1.9.1
            python3-cryptography >= 2.0.2
            python3-dfdatetime >= 20211225
-           python3-dfvfs >= 20211224
+           python3-dfvfs >= 20211227
            python3-dtfabric >= 20170524
            python3-idna >= 2.5
            python3-pytsk3 >= 20210419