The Dissect module tying all other Dissect modules together. It provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets).
GNU Affero General Public License v3.0
38
stars
42
forks
source link
Consider if we want to separate FilesystemEntry into FilesystemEntry and DirEntry #649
Currently, we only have a single FilesystemEntry class that, in most filesystem implementations, is backed by a single object (e.g. INode class) that represents both a real inode and a directory entry, usually by means of lazy loading. However, this creates some strange relations with regards to file names and parent inodes, which are generally strictly linked to directory entries and not inodes.
NTFS is currently the only implementation that kind of separates this. Here, the “lazy loading” is moved into the dissect.target implementation by means of a .dereference() method.
Now that pathlib.Path has started using os.scandir() which returns os.DirEntry classes, it might be worth looking into this. It should in principle give more flexibility, allow for more accurate caching, and being closer to how the real filesystem is implemented. However, at the cost of the filesystem layer in dissect.target becoming considerably more complex.
Additionally, this would very easily allow us to add “deleted files” support to dissect.target. A directory entry could simply have a flag .deleted set to True, for example. Support for this will of course need to be added to underlying filesystem implementations as well (i.e. ability to recover and list deleted directory entries).
Currently, we only have a single
FilesystemEntryclass that, in most filesystem implementations, is backed by a single object (e.g.INodeclass) that represents both a real inode and a directory entry, usually by means of lazy loading. However, this creates some strange relations with regards to file names and parent inodes, which are generally strictly linked to directory entries and not inodes.NTFS is currently the only implementation that kind of separates this. Here, the “lazy loading” is moved into the
dissect.targetimplementation by means of a.dereference()method.Now that
pathlib.Pathhas started usingos.scandir()which returnsos.DirEntryclasses, it might be worth looking into this. It should in principle give more flexibility, allow for more accurate caching, and being closer to how the real filesystem is implemented. However, at the cost of the filesystem layer indissect.targetbecoming considerably more complex.Additionally, this would very easily allow us to add “deleted files” support to
dissect.target. A directory entry could simply have a flag.deletedset toTrue, for example. Support for this will of course need to be added to underlying filesystem implementations as well (i.e. ability to recover and list deleted directory entries).