Package rekall :: Package plugins :: Module core :: Class DirectoryDumperMixin
[frames] | no frames]

Class DirectoryDumperMixin

source code


A mixin for plugins that want to dump files to a directory.

Instance Methods
 
__init__(self, *args_, **kwargs)
Dump to a directory.
source code
 
check_dump_dir(self, dump_dir=None) source code
 
CopyToFile(self, address_space, start, end, outfd)
Copy a part of the address space to the output file.
source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Variables
  dump_dir_optional = True
  default_dump_dir = '.'
Properties

Inherited from object: __class__

Method Details

__init__(self, *args_, **kwargs)
(Constructor)

source code 
Dump to a directory.

Args:
  dump_dir: The directory where files should be dumped.

Overrides: object.__init__

CopyToFile(self, address_space, start, end, outfd)

source code 

Copy a part of the address space to the output file.

This utility function allows the writing of sparse files correctly. We pass over the address space, automatically skipping regions which are not valid. For file systems which support sparse files (e.g. in Linux), no additional disk space will be used for unmapped regions.

If a region has no mapped pages, the resulting file will be of 0 bytes long.