Re: [sleuthkit-users] Python bindings timetable?

[Michael C. <scu...@gm...>]

Hi Rob,
    You can open any type of filesystem using the tsk_fs_img_open()
by specifying the offset and an TSK_IMG_INFO object. See examples here

http://code.google.com/p/pytsk/wiki/OverView

Note that you can provide an offset to the FS_Info() constructor
(Which you would normally get through mmls). The full prototype is:

static FS_Info FS_Info_Con(FS_Info self, Img_Info img, TSK_OFF_T offset,
                           TSK_FS_TYPE_ENUM type)

It might also be a good idea to bind the volume system. Its just that
that is a new part of TSK which I am not personally using. The way I
use this is to extend the IMG_INFO object like this:

class MyImgInfo(pytsk3.Img_Info):
   ...
   def read(self, offset, length):
      ... provide implementation here ...

   def get_size(self):
      .... Return a reasonable size

I can then provide any volume management from python.

There are also lots of examples in the source tree. There is for
example, a very functional fls.py.

Thanks
Michael

On 20 April 2011 12:17, Rob Meijer <pi...@gm...> wrote:
> Just attempted for the first time to play around with the libtsk
> python bindings (http://code.google.com/p/pytsk/).
> This looks like a very interesting project indeed, but my first
> attempt to use it ran into the problem that tsk_vs_open
> has no python equivalent (yet), so it basically only works on ISO
> images for now.  If this project becomes usably complete,
> it would seem like a perfect fast prototyping  environment for libtsk3
> based projects.  Is there any known timetable as to
> when this project aims to be API complete enough to be usable?
>
> ------------------------------------------------------------------------------
> Benefiting from Server Virtualization: Beyond Initial Workload
> Consolidation -- Increasing the use of server virtualization is a top
> priority.Virtualization can reduce costs, simplify management, and improve
> application availability and disaster protection. Learn more about boosting
> the value of server virtualization. http://p.sf.net/sfu/vmware-sfdev2dev
> _______________________________________________
> sleuthkit-users mailing list
> https://lists.sourceforge.net/lists/listinfo/sleuthkit-users
> http://www.sleuthkit.org
>