Package rekall :: Module io_manager :: Class IOManager

Class IOManager

The baseclass for abstracted IO implementations.

The IO manager classes are responsible for managing access to profiles. A profile is a JSON dict which is named using a standard notation. For example, the profile for a certain NT kernel is:

nt/GUID/BF9E190359784C2D8796CF5537B238B42

The IO manager may actually store the profile file using some other scheme, but that internal scheme is private to itself.

Nested Classes
	__metaclass__ Automatic Plugin Registration through metaclasses.
	top_level_class The baseclass for abstracted IO implementations.

Instance Methods

__init__(self, urn=None, mode='r', session=None, pretty_print=True, version='v1.0')
Initialize the IOManager. source code

ValidateInventory(self)

source code

CheckInventory(self, path)
Checks the validity of the inventory and if the path exists in it.

source code

Metadata(self, path)
Returns metadata about a path.

source code

SetMetadata(self, name, options)

source code

FlushInventory(self)
Write the inventory to the storage.

source code

ListFiles(self)
Returns a generator over all the files in this container.

source code

Create(self, name, **options)
Creates a new file in the container.

source code

Destroy(self, name)
Destroys the file/directory at name's path.

source code

Open(self, name)
Opens a container member for reading.

source code

Encoder(self, data, **options)

source code

Decoder(self, raw)

source code

GetData(self, name, raw=False, default=None)
Get the data object stored at container member.

source code

StoreData(self, name, data, **options)
Stores the data in the named container member.

source code

__enter__(self)

source code

__exit__(self, exc_type, exc_value, traceback)

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Methods

ImplementationByClass(self, name)

source code

ImplementationByName(self, name)

source code

Class Variables
	order = `100`
	classes = `{'CacheDirectoryManager': <class 'rekall.plugins.too...`
	classes_by_name = `{None: [<class 'rekall.io_manager.DirectoryI...`
	plugin_feature = `'IOManager'`

Properties
	inventory
Inherited from `object`: `__class__`

Method Details

init(self, urn=None, mode=`'r'`, session=None, pretty_print=True, version=`'v1.0'`)
(Constructor)

source code

Initialize the IOManager.

Args:

  urn: The path to the IO manager. This might contain a scheme or
       protocol specific to a certain IO manager implementation.

  mode: Can be "r" or "w".

  session: The session object.

  pretty_print: If specified we dump sorted yaml data - this ends up
  being more compressible in reality.

  version: The required version of the repository. The IOManager is free
       to implement arbitrary storage for different versions if
       required. Versioning the repository allows us to update the
       repository file format transparently without affecting older
       Rekall versions.

Overrides: object.__init__

CheckInventory(self, path)

source code

Checks the validity of the inventory and if the path exists in it.

The inventory is a json object at the root of the repository which lists all the profiles in this repository. It allows us to determine quickly if a profile exists in this repository.

Create(self, name, **options)

source code

Creates a new file in the container.

Returns a file like object which should support the context manager
protocol. If the file already exists in the container, overwrite it.

For example:

with self.session.io_manager.Create("foobar") as fd:
   fd.Write("hello world")

Args:
  name: The name of the new file.

Open(self, name)

source code

Opens a container member for reading.

This should return a file like object which provides read access to
container members.

Raises:
  IOManagerError: If the file is not found.

GetData(self, name, raw=False, default=None)

source code

Get the data object stored at container member.

This returns an arbitrary python object which is stored in the named
container member. For example, normally a dict or list. This function
wraps the Open() method above and add deserialization to retrieve the
actual object.

Returns None if the file is not found.

Args:
  name: The name to retrieve the data under.
  raw: If specified we do not parse the data, simply return it as is.

StoreData(self, name, data, **options)

source code

Stores the data in the named container member.

This serializes the data and stores it in the named member. Not all
types of data are serializable, so this may raise. For example, when
using JSON to store the data, arbitrary python objects may not be used.

Args:
  name: The name under which the data will be stored.
  data: The data to store.

Common options:
  raw: If true we write the data directly without encoding to json. In
    this case data should be a string.
  uncompressed: File will not be compressed (default gzip compression).

Class Variable Details

classes

Value:

{'CacheDirectoryManager': <class 'rekall.plugins.tools.caching_url_man
ager.CacheDirectoryManager'>,
 'CachingManager': <class 'rekall.plugins.tools.caching_url_manager.Ca
chingManager'>,
 'DirectoryIOManager': <class 'rekall.io_manager.DirectoryIOManager'>,
 'PicklingDirectoryIOManager': <class 'rekall.cache.PicklingDirectoryI
OManager'>,
 'RepositoryManager': <class 'rekall.plugins.tools.repository_manager.
...

classes_by_name

Value:

{None: [<class 'rekall.io_manager.DirectoryIOManager'>,
        <class 'rekall.io_manager.ZipFileManager'>,
        <class 'rekall.io_manager.URLManager'>,
        <class 'rekall.cache.PicklingDirectoryIOManager'>,
        <class 'rekall.plugins.tools.caching_url_manager.CachingManage
r'>,
        <class 'rekall.plugins.tools.caching_url_manager.CacheDirector
yManager'>,
...

Property Details

inventory

Get Method:: unreachable.inventory(self)

Class IOManager

__init__(self, urn=None, mode='r', session=None, pretty_print=True, version='v1.0') (Constructor)

CheckInventory(self, path)

Create(self, name, **options)

Open(self, name)

GetData(self, name, raw=False, default=None)

StoreData(self, name, data, **options)

classes

classes_by_name

inventory

init(self, urn=None, mode=`'r'`, session=None, pretty_print=True, version=`'v1.0'`)
(Constructor)