#NEWLINE# def __init__( self , base_fd , pathspec = None , progress_callback = None , full_pathspec = None ) : #NEWLINE# #INDENT# 'Use TSK to read the pathspec.\n\n    Args:\n      base_fd: The file like object we read this component from.\n      pathspec: An optional pathspec to open directly.\n      progress_callback: A callback to indicate that the open call is still\n                         working but needs more time.\n      full_pathspec: The full pathspec we are trying to open.\n    Raises:\n      IOError: If the file can not be opened.\n    ' #NEWLINE# super ( TSKFile , self ) . __init__ ( base_fd , pathspec = pathspec , progress_callback = progress_callback , full_pathspec = full_pathspec ) #NEWLINE# if ( self . base_fd is None ) : #NEWLINE# #INDENT# raise IOError ( 'TSK driver must have a file base.' ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# if ( isinstance ( base_fd , TSKFile ) and self . base_fd . IsDirectory ( ) ) : #NEWLINE# #INDENT# self . tsk_raw_device = self . base_fd . tsk_raw_device #NEWLINE# last_path = utils . JoinPath ( self . pathspec . last . path , pathspec . path ) #NEWLINE# self . pathspec . Pop ( ( - 1 ) ) #NEWLINE# self . pathspec . Append ( pathspec ) #NEWLINE# self . pathspec . last . path = last_path #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# if ( not self . base_fd . IsDirectory ( ) ) : #NEWLINE# #INDENT# self . tsk_raw_device = self . base_fd #NEWLINE# self . pathspec . Append ( pathspec ) #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# raise IOError ( 'Unable to parse base using Sleuthkit.' ) #NEWLINE# #UNINDENT# #UNINDENT# #UNINDENT# self . pathspec . last . path_options = rdf_paths . PathSpec . Options . CASE_LITERAL #NEWLINE# fd_hash = self . tsk_raw_device . pathspec . SerializeToString ( ) #NEWLINE# try : #NEWLINE# #INDENT# self . filesystem = vfs . DEVICE_CACHE . Get ( fd_hash ) #NEWLINE# self . fs = self . filesystem . fs #NEWLINE# #UNINDENT# except KeyError : #NEWLINE# #INDENT# self . img = MyImgInfo ( fd = self . tsk_raw_device , progress_callback = progress_callback ) #NEWLINE# self . fs = pytsk3 . FS_Info ( self . img , 0 ) #NEWLINE# self . filesystem = CachedFilesystem ( self . fs , self . img ) #NEWLINE# vfs . DEVICE_CACHE . Put ( fd_hash , self . filesystem ) #NEWLINE# #UNINDENT# if pathspec . HasField ( 'inode' ) : #NEWLINE# #INDENT# self . fd = self . fs . open_meta ( pathspec . inode ) #NEWLINE# self . tsk_attribute = self . GetAttribute ( pathspec . ntfs_type , pathspec . ntfs_id ) #NEWLINE# if self . tsk_attribute : #NEWLINE# #INDENT# self . size = self . tsk_attribute . info . size #NEWLINE# #UNINDENT# else : #NEWLINE# #INDENT# self . size = self . fd . info . meta . size #NEWLINE# #UNINDENT# #UNINDENT# else : #NEWLINE# #INDENT# self . fd = self . fs . open ( utils . SmartStr ( self . pathspec . last . path ) ) #NEWLINE# self . size = self . fd . info . meta . size #NEWLINE# self . pathspec . last . inode = self . fd . info . meta . addr