rekall :: plugins :: response :: windows :: WindowsRootFileInformation :: Class WindowsRootFileInformation

Class WindowsRootFileInformation

A special FileInformation class to handle windows drives.

In windows the root directory (/) is not real, it contains a listing of drive letters. So listing the "/" directory should return a list of FileInformation("/c:"), FileInformation("/d:") etc.

Instance Methods

__init__(self, **kwargs)
x.__init__(...) initializes x; see help(type(x)) for signature

source code

open(self)

source code

list_names(self)

source code

list(self)
If this is a directory return a list of children.

source code

Inherited from rekall_lib.utils.SlottedObject: keys

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Class Methods

from_stat(cls, filespec, session=None) (Inherited from rekall.plugins.response.common.FileInformation)

source code

Properties
	atime (Inherited from rekall.plugins.response.common.FileInformation)
	ctime (Inherited from rekall.plugins.response.common.FileInformation)
	filename (Inherited from rekall.plugins.response.common.FileInformation)
	mtime (Inherited from rekall.plugins.response.common.FileInformation)
	session (Inherited from rekall.plugins.response.common.FileInformation)
	st_atime (Inherited from rekall.plugins.response.common.FileInformation)
	st_ctime (Inherited from rekall.plugins.response.common.FileInformation)
	st_dev (Inherited from rekall.plugins.response.common.FileInformation)
	st_gid (Inherited from rekall.plugins.response.common.FileInformation)
	st_ino (Inherited from rekall.plugins.response.common.FileInformation)
	st_mode (Inherited from rekall.plugins.response.common.FileInformation)
	st_mtime (Inherited from rekall.plugins.response.common.FileInformation)
	st_nlink (Inherited from rekall.plugins.response.common.FileInformation)
	st_size (Inherited from rekall.plugins.response.common.FileInformation)
	st_uid (Inherited from rekall.plugins.response.common.FileInformation)
Inherited from `object`: `__class__`

Method Details

init(self, **kwargs)
(Constructor)

source code

x.__init__(...) initializes x; see help(type(x)) for signature

Overrides: object.__init__: (inherited documentation)

If this is a directory return a list of children.

Overrides: common.FileInformation.list: (inherited documentation)

Class WindowsRootFileInformation

__init__(self, **kwargs) (Constructor)

open(self)

list_names(self)

list(self)

init(self, **kwargs)
(Constructor)