rawdisk.plugins.filesystems.hfs_plus package

Submodules

rawdisk.plugins.filesystems.hfs_plus.hfs_plus module

class rawdisk.plugins.filesystems.hfs_plus.hfs_plus.HfsPlusPlugin

Bases: rawdisk.plugins.categories.IFilesystemPlugin

Filesystem plugin for HFS+ partition.

detect(filename, offset)

Always returns True, since there is only one partition with this type GUID, no need to do further verification.

get_volume_object()

Returns HfsPlusVolume object.

register()

Registers this plugin with FilesystemDetector as gpt plugin, with type guid {48465300-0000-11AA-AA11-00306543ECAC}

rawdisk.plugins.filesystems.hfs_plus.hfs_plus_volume module

class rawdisk.plugins.filesystems.hfs_plus.hfs_plus_volume.HfsPlusVolume

Bases: rawdisk.filesystems.volume.Volume

Structure for HFS+ volume.

Attributes:

fd (fd): file descriptor used to read volume information vol_header (VolumeHeader): Initialized VolumeHeader object

See Also:

https://developer.apple.com/legacy/library/technotes/tn/tn1150.html

load(filename, offset)

Loads HFS+ volume information

class rawdisk.plugins.filesystems.hfs_plus.hfs_plus_volume.VolumeHeader(data)

Bases: rawdisk.util.rawstruct.RawStruct

Represents HFS+ volume header

Attributes:

signature (2 byte string): The volume signature, which must be kHFSPlusSigWord (‘H+’) for an HFS Plus volume. version (ushort): The version of the volume format, which is currently 4 (kHFSPlusVersion) for HFS Plus volumes. attributes (uint): HFS+ volume attributes

Module contents