Package rekall :: Module io_manager :: Class DirectoryIOManager

[frames] | no frames]

Class DirectoryIOManager

source code

An IOManager which stores everything in files.

We prefer to store the profile file as a gzip compressed file within a versioned directory. For example the profile:

nt/GUID/BF9E190359784C2D8796CF5537B238B42

will be stored in:

$urn/nt/GUID/BF9E190359784C2D8796CF5537B238B42.gz

Where $urn is the path where the DirectoryIOManager was initialized with.

Nested Classes
	__metaclass__ Automatic Plugin Registration through metaclasses. (Inherited from rekall.io_manager.IOManager)
	top_level_class The baseclass for abstracted IO implementations. (Inherited from rekall.io_manager.IOManager)

Instance Methods

__init__(self, urn=None, **kwargs)
Initialize the IOManager.

source code

RebuildInventory(self)
Rebuild the inventory file.

source code

CheckInventory(self, path)
Checks the validity of the inventory and if the path exists in it.

source code

Metadata(self, path)
Returns metadata about a path.

source code

check_dump_dir(self, dump_dir=None)

source code

GetAbsolutePathName(self, name)

source code

EnsureDirectoryExists(self, dirname)

source code

ListFiles(self)
Returns a generator over all the files in this container.

source code

Create(self, name)
Creates a new file in the container.

source code

Destroy(self, name)
Destroys the file/directory at name's path.

source code

Open(self, name)
Opens a container member for reading.

source code

__str__(self)
str(x)

source code

Decoder(self, raw) (Inherited from rekall.io_manager.IOManager)

source code

Encoder(self, data, **options) (Inherited from rekall.io_manager.IOManager)

source code

FlushInventory(self)
Write the inventory to the storage. (Inherited from rekall.io_manager.IOManager)

source code

GetData(self, name, raw=False, default=None)
Get the data object stored at container member. (Inherited from rekall.io_manager.IOManager)

source code

SetMetadata(self, name, options) (Inherited from rekall.io_manager.IOManager)

source code

StoreData(self, name, data, **options)
Stores the data in the named container member. (Inherited from rekall.io_manager.IOManager)

source code

ValidateInventory(self) (Inherited from rekall.io_manager.IOManager)

source code

__enter__(self) (Inherited from rekall.io_manager.IOManager)

source code

__exit__(self, exc_type, exc_value, traceback) (Inherited from rekall.io_manager.IOManager)

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __subclasshook__

Class Methods

ImplementationByClass(self, name)

source code

ImplementationByName(self, name)

source code

Class Variables
	EXCLUDED_PATH_PREFIX = `[]`
	classes = `{'CacheDirectoryManager': <class 'rekall.plugins.too...` (Inherited from rekall.io_manager.IOManager)
	classes_by_name = `{None: [<class 'rekall.io_manager.DirectoryI...` (Inherited from rekall.io_manager.IOManager)
	order = `100` (Inherited from rekall.io_manager.IOManager)
	plugin_feature = `'IOManager'` (Inherited from rekall.io_manager.IOManager)

Properties
	inventory
Inherited from `object`: `__class__`

Method Details

init(self, urn=None, **kwargs)
(Constructor)

source code

Initialize the IOManager.

Args:

  urn: The path to the IO manager. This might contain a scheme or
       protocol specific to a certain IO manager implementation.

  mode: Can be "r" or "w".

  session: The session object.

  pretty_print: If specified we dump sorted yaml data - this ends up
  being more compressible in reality.

  version: The required version of the repository. The IOManager is free
       to implement arbitrary storage for different versions if
       required. Versioning the repository allows us to update the
       repository file format transparently without affecting older
       Rekall versions.

Overrides: object.__init__: (inherited documentation)

CheckInventory(self, path)

source code

Checks the validity of the inventory and if the path exists in it.

The inventory is a json object at the root of the repository which lists all the profiles in this repository. It allows us to determine quickly if a profile exists in this repository.

Overrides: IOManager.CheckInventory

Metadata(self, path)

source code

Returns metadata about a path.

Overrides: IOManager.Metadata: (inherited documentation)

ListFiles(self)

source code

Returns a generator over all the files in this container.

Overrides: IOManager.ListFiles: (inherited documentation)

Create(self, name)

source code

Creates a new file in the container.

Returns a file like object which should support the context manager
protocol. If the file already exists in the container, overwrite it.

For example:

with self.session.io_manager.Create("foobar") as fd:
   fd.Write("hello world")

Args:
  name: The name of the new file.

Overrides: IOManager.Create: (inherited documentation)

Destroy(self, name)

source code

Destroys the file/directory at name's path.

Overrides: IOManager.Destroy: (inherited documentation)

Open(self, name)

source code

Opens a container member for reading.

This should return a file like object which provides read access to
container members.

Raises:
  IOManagerError: If the file is not found.