Class EWFFile

source code

A helper for parsing an EWF file.

Instance Methods

__init__(self, session=None, address_space=None)
x.__init__(...) initializes x; see help(type(x)) for signature

source code

handle_header(self, section)
Handle the header section.

source code

handle_header2(self, section)
Handle the header2 section.

source code

handle_volume(self, section)
Handle the volume section.

source code

handle_table(self, section)
Parse the table and store it in our lookup table.

source code

read_chunk(self, chunk_id)
Read a single chunk from the file.

source code

read_partial(self, offset, length)
Read as much as possible from the current offset.

source code

read(self, offset, length)
Read data from the file.

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Properties
Inherited from `object`: `__class__`

Method Details

init(self, session=None, address_space=None)
(Constructor)

source code

x.__init__(...) initializes x; see help(type(x)) for signature

Overrides: object.__init__: (inherited documentation)

handle_header(self, section)

source code

Handle the header section.

We do not currently do anything with it.

handle_header2(self, section)

source code

Handle the header2 section.

We do not currently do anything with it.

handle_volume(self, section)

source code

Handle the volume section.

We mainly use it to know the chunk size.

Class EWFFile

__init__(self, session=None, address_space=None) (Constructor)

handle_header(self, section)

handle_header2(self, section)

handle_volume(self, section)

init(self, session=None, address_space=None)
(Constructor)