Package rekall :: Package plugins :: Package tools :: Module ewf :: Class EWFFileWriter

Class EWFFileWriter

A writer for EWF files.

NOTE: The EWF files we produce here are not generally compatible with Encase/FTK. We produce EWFv1 files which are unable to store sparse images. We place an ELF file inside the EWF container to ensure we can efficiently store sparse memory ranges.

Instance Methods

__init__(self, out_as, session)
x.__init__(...) initializes x; see help(type(x)) for signature

source code

__enter__(self)

source code

__exit__(self, exc_type, exc_value, trace)

source code

AddNewSection(self, section)

source code

StartNewTable(self)
Writes a sections table and begins collecting chunks into table.

source code

write(self, data)
Writes the data into the file.

source code

FlushTable(self)
Flush the current table.

source code

Close(self)

source code

Inherited from object: __delattr__, __format__, __getattribute__, __hash__, __new__, __reduce__, __reduce_ex__, __repr__, __setattr__, __sizeof__, __str__, __subclasshook__

Properties
Inherited from `object`: `__class__`

Method Details

init(self, out_as, session)
(Constructor)

source code

x.__init__(...) initializes x; see help(type(x)) for signature

Overrides: object.__init__: (inherited documentation)

write(self, data)

source code

Writes the data into the file.

This method allows the writer to be used as a file-like object.

Class EWFFileWriter

__init__(self, out_as, session) (Constructor)

write(self, data)

init(self, out_as, session)
(Constructor)