#!/usr/bin/python # # Copyright 2011, Michael Cohen . # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # # http://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. # See the License for the specific language governing permissions and # limitations under the License. import argparse import gc import pdb import sys import time import images import pytsk3 class Fls(object): FILE_TYPE_LOOKUP = { pytsk3.TSK_FS_NAME_TYPE_UNDEF: "-", pytsk3.TSK_FS_NAME_TYPE_FIFO: "p", pytsk3.TSK_FS_NAME_TYPE_CHR: "c", pytsk3.TSK_FS_NAME_TYPE_DIR: "d", pytsk3.TSK_FS_NAME_TYPE_BLK: "b", pytsk3.TSK_FS_NAME_TYPE_REG: "r", pytsk3.TSK_FS_NAME_TYPE_LNK: "l", pytsk3.TSK_FS_NAME_TYPE_SOCK: "h", pytsk3.TSK_FS_NAME_TYPE_SHAD: "s", pytsk3.TSK_FS_NAME_TYPE_WHT: "w", pytsk3.TSK_FS_NAME_TYPE_VIRT: "v"} META_TYPE_LOOKUP = { pytsk3.TSK_FS_META_TYPE_REG: "r", pytsk3.TSK_FS_META_TYPE_DIR: "d", pytsk3.TSK_FS_META_TYPE_FIFO: "p", pytsk3.TSK_FS_META_TYPE_CHR: "c", pytsk3.TSK_FS_META_TYPE_BLK: "b", pytsk3.TSK_FS_META_TYPE_LNK: "h", pytsk3.TSK_FS_META_TYPE_SHAD: "s", pytsk3.TSK_FS_META_TYPE_SOCK: "s", pytsk3.TSK_FS_META_TYPE_WHT: "w", pytsk3.TSK_FS_META_TYPE_VIRT: "v"} ATTRIBUTE_TYPES_TO_PRINT = [ pytsk3.TSK_FS_ATTR_TYPE_NTFS_IDXROOT, pytsk3.TSK_FS_ATTR_TYPE_NTFS_DATA, pytsk3.TSK_FS_ATTR_TYPE_DEFAULT] def __init__(self): super(Fls, self).__init__() self._fs_info = None self._img_info = None self._long_listing = False self._recursive = False def list_directory(self, directory, stack=None): stack.append(directory.info.fs_file.meta.addr) for directory_entry in directory: prefix = "+" * (len(stack) - 1) if prefix: prefix += " " # Skip ".", ".." or directory entries without a name. if (not hasattr(directory_entry, "info") or not hasattr(directory_entry.info, "name") or not hasattr(directory_entry.info.name, "name") or directory_entry.info.name.name in [".", ".."]): continue self.print_directory_entry(directory_entry, prefix=prefix) if self._recursive: try: sub_directory = directory_entry.as_directory() inode = directory_entry.info.meta.addr # This ensures that we don't recurse into a directory # above the current level and thus avoid circular loops. if inode not in stack: self.list_directory(sub_directory, stack) except IOError: pass stack.pop(-1) def open_directory(self, inode_or_path): inode = None path = None if inode_or_path is None: path = "/" elif inode_or_path.startswith("/"): path = inode_or_path else: inode = inode_or_path # Note that we cannot pass inode=None to fs_info.opendir(). if inode: directory = self._fs_info.open_dir(inode=inode) else: directory = self._fs_info.open_dir(path=path) return directory def open_file_system(self, offset): self._fs_info = pytsk3.FS_Info(self._img_info, offset=offset) def open_image(self, image_type, filenames): # List the actual files (any of these can raise for any reason). self._img_info = images.SelectImage(image_type, filenames) def parse_options(self, options): self._long_listing = getattr(options, "long_listing", False) self._recursive = getattr(options, "recursive", False) def print_directory_entry(self, directory_entry, prefix=""): meta = directory_entry.info.meta name = directory_entry.info.name name_type = "-" if name: name_type = self.FILE_TYPE_LOOKUP.get(int(name.type), "-") meta_type = "-" if meta: meta_type = self.META_TYPE_LOOKUP.get(int(meta.type), "-") directory_entry_type = "{0:s}/{1:s}".format(name_type, meta_type) for attribute in directory_entry: inode_type = int(attribute.info.type) if inode_type in self.ATTRIBUTE_TYPES_TO_PRINT: if self._fs_info.info.ftype in [ pytsk3.TSK_FS_TYPE_NTFS, pytsk3.TSK_FS_TYPE_NTFS_DETECT]: inode = "{0:d}-{1:d}-{2:d}".format( meta.addr, int(attribute.info.type), attribute.info.id) else: inode = "{0:d}".format(meta.addr) attribute_name = attribute.info.name if attribute_name and attribute_name not in ["$Data", "$I30"]: filename = "{0:s}:{1:s}".format(name.name, attribute.info.name) else: filename = name.name if meta and name: print("{0:s}{1:s} {2:s}:\t{3:s}".format( prefix, directory_entry_type, inode, filename)) def Main(): """The main program function. Returns: A boolean containing True if successful or False if not. """ args_parser = argparse.ArgumentParser(description=( "Lists a file system in a storage media image or device.")) args_parser.add_argument( "images", nargs="+", metavar="IMAGE", action="store", type=str, default=None, help=("Storage media images or devices.")) args_parser.add_argument( "inode", nargs="?", metavar="INODE", action="store", type=str, default=None, help=( "The inode or path to list. If [inode] is not given, the root " "directory is used")) # TODO: not implemented. # args_parser.add_argument( # "-f", "--fstype", metavar="TYPE", dest="file_system_type", # action="store", type=str, default=None, help=( # "The file system type (use \"-f list\" for supported types)")) args_parser.add_argument( "-i", "--imgtype", metavar="TYPE", dest="image_type", type=str, choices=["ewf", "qcow", "raw"], default="raw", help=( "Set the storage media image type.")) # TODO: not implemented. # args_parser.add_argument( # "-l", dest="long_listing", action="store_true", default=False, # help="Display long version (like ls -l)") args_parser.add_argument( "-o", "--offset", metavar="OFFSET", dest="offset", action="store", type=int, default=0, help="The offset into image file (in bytes)") args_parser.add_argument( "-r", "--recursive", dest="recursive", action="store_true", default=False, help="List subdirectories recursively.") options = args_parser.parse_args() if not options.images: print('No storage media image or device was provided.') print('') args_parser.print_help() print('') return False fls = Fls() fls.parse_options(options) fls.open_image(options.image_type, options.images) fls.open_file_system(options.offset) directory = fls.open_directory(options.inode) # Iterate over all files in the directory and print their name. # What you get in each iteration is a proxy object for the TSK_FS_FILE # struct - you can further dereference this struct into a TSK_FS_NAME # and TSK_FS_META structs. fls.list_directory(directory, []) return True if __name__ == '__main__': if not Main(): sys.exit(1) else: sys.exit(0)