Module Expr Str Import alias FunctionDef arguments args NameParam NameParam defaults body Expr Str Assign NameStore Call NameLoad NameLoad Str NameLoad Assign NameStore Call NameLoad NameLoad Str NameLoad Assign NameStore Call NameLoad NameLoad Str NameLoad Assign NameStore NameLoad If CompareIs NameLoad NameLoad body If CompareIsNot NameLoad NameLoad body If Call AttributeLoad NameLoad attr Str body TryExcept body Assign NameStore BinOpSub Call NameLoad SubscriptLoad NameLoad Slice Num Num Num handlers ExceptHandler type NameLoad body Pass If BoolOpOr CompareIs NameLoad NameLoad CompareLt NameLoad Num body Assign NameStore NameLoad If BoolOpAnd CompareIs NameLoad NameLoad CompareIs NameLoad NameLoad body Return TupleLoad NameLoad NameLoad Assign NameStore Call NameLoad NameLoad Assign NameStore Num Assign NameStore Num Assign NameStore NameLoad Assign NameStore Call NameLoad NameLoad Assign NameStore Call NameLoad NameLoad If CompareGt NameLoad Num body If BoolOpAnd CompareIsNot NameLoad NameLoad BoolOpOr CompareLt NameLoad Num CompareGtE NameLoad NameLoad body Return TupleLoad NameLoad NameLoad For NameStore NameLoad body If Call NameLoad NameLoad body If CompareIsNot NameLoad NameLoad body If CompareEq NameLoad NameLoad body Break AugAssignAdd NameStore Num If BoolOpAnd CompareIsNot NameLoad NameLoad CompareEq NameLoad NameLoad body Break If CompareIsNot NameLoad NameLoad body Assign NameStore Call NameLoad NameLoad If CompareIsNot NameLoad NameLoad body AugAssignMult NameStore NameLoad If CompareEq NameLoad NameLoad body Break AugAssignAdd NameStore Num If BoolOpOr CompareIs NameLoad NameLoad CompareGtE NameLoad NameLoad body Return TupleLoad NameLoad NameLoad If UnaryOpNot Call NameLoad NameLoad body Assign NameStore NameLoad Return TupleLoad NameLoad NameLoad decorator_list FunctionDef arguments args NameParam defaults body Expr Str If BoolOpAnd Call NameLoad NameLoad Str CompareIsNot AttributeLoad NameLoad attr NameLoad body Assign NameStore Call NameLoad AttributeLoad NameLoad attr Str Num orelse Assign NameStore Num Return NameLoad decorator_list FunctionDef arguments args NameParam defaults body Expr Str Return Call NameLoad NameLoad Str NameLoad decorator_list FunctionDef arguments args NameParam defaults body Expr Str Return Call NameLoad NameLoad Str NameLoad decorator_list FunctionDef arguments args NameParam defaults body Expr Str Assign NameStore Call NameLoad NameLoad Str NameLoad Return BoolOpAnd CompareIsNot NameLoad NameLoad CompareEq NameLoad AttributeLoad NameLoad attr decorator_list
N/A N/A Helper functions for SleuthKit (TSK) partition support. N/A pytsk3 GetTSKVsPartByPathSpec N/A N/A tsk_volume path_spec N/A N/A N/A Retrieves the TSK volume system part object from the TSK volume object.

  Args:
    tsk_volume: a TSK volume object (instance of pytsk3.Volume_Info).
    path_spec: the path specification (instance of PathSpec).

  Returns:
    A tuple of the TSK volume system part object (instance of
    pytsk3.TSK_VS_PART_INFO) and the partition index. The partition index
    is None when not available. The function return or (None, None) on error.
   N/A location N/A getattr path_spec location None N/A part_index N/A getattr path_spec part_index None N/A start_offset N/A getattr path_spec start_offset None N/A partition_index None N/A N/A part_index None N/A N/A N/A location None N/A N/A N/A N/A location startswith /p N/A N/A N/A N/A partition_index N/A N/A int N/A location N/A 2 10 1 N/A N/A N/A ValueError N/A N/A N/A N/A N/A partition_index None N/A partition_index 0 N/A N/A location None N/A N/A N/A location None N/A start_offset None N/A N/A N/A None None N/A bytes_per_sector N/A TSKVolumeGetBytesPerSector tsk_volume N/A current_part_index 0 N/A current_partition_index 0 N/A tsk_vs_part None N/A tsk_vs_part_list N/A list tsk_volume N/A number_of_tsk_vs_parts N/A len tsk_vs_part_list N/A N/A number_of_tsk_vs_parts 0 N/A N/A N/A N/A part_index None N/A N/A part_index 0 N/A part_index number_of_tsk_vs_parts N/A N/A N/A None None N/A tsk_vs_part tsk_vs_part_list N/A N/A N/A TSKVsPartIsAllocated tsk_vs_part N/A N/A N/A partition_index None N/A N/A N/A partition_index current_partition_index N/A N/A N/A current_partition_index 1 N/A N/A N/A part_index None N/A part_index current_part_index N/A N/A N/A N/A start_offset None N/A N/A start_sector N/A TSKVsPartGetStartSector tsk_vs_part N/A N/A start_sector None N/A N/A start_sector bytes_per_sector N/A N/A start_sector start_offset N/A N/A N/A current_part_index 1 N/A N/A N/A tsk_vs_part None N/A current_part_index number_of_tsk_vs_parts N/A N/A N/A None None N/A N/A N/A TSKVsPartIsAllocated tsk_vs_part N/A N/A current_partition_index None N/A N/A tsk_vs_part current_partition_index N/A TSKVolumeGetBytesPerSector N/A N/A tsk_volume N/A N/A N/A Retrieves the number of bytes per sector from a TSK volume object.

  Args:
    tsk_volume: a TSK volume object (instance of pytsk3.Volume_Info).

  Returns:
    The number of bytes per sector or 512 by default.
   N/A N/A N/A hasattr tsk_volume info N/A N/A tsk_volume info None N/A N/A block_size N/A getattr N/A tsk_volume info block_size 512 N/A N/A block_size 512 N/A block_size N/A TSKVsPartGetNumberOfSectors N/A N/A tsk_vs_part N/A N/A N/A Retrieves the number of sectors of a TSK volume system part object.

  Args:
    tsk_vs_part: a TSK volume system part object (instance of
                 pytsk3.TSK_VS_PART_INFO).

  Returns:
    The number of sectors or None.
   N/A N/A getattr tsk_vs_part len None N/A TSKVsPartGetStartSector N/A N/A tsk_vs_part N/A N/A N/A Retrieves the start sector of a TSK volume system part object.

  Args:
    tsk_vs_part: a TSK volume system part object (instance of
                 pytsk3.TSK_VS_PART_INFO).

  Returns:
    The start sector or None.
   N/A N/A getattr tsk_vs_part start None N/A TSKVsPartIsAllocated N/A N/A tsk_vs_part N/A N/A N/A Determines if the TSK volume system part object is allocated.

  Args:
    tsk_vs_part: a TSK volume system part object (instance of
                 pytsk3.TSK_VS_PART_INFO).

  Returns:
    True if the volume system part is allocated, False otherwise.
   N/A tsk_vs_part_flags N/A getattr tsk_vs_part flags None N/A N/A N/A tsk_vs_part_flags None N/A tsk_vs_part_flags N/A pytsk3 TSK_VS_PART_FLAG_ALLOC N/A