Skip to content

extfs.py

ofrak.core.extfs

Ext2Filesystem (ExtFilesystem) dataclass

Linux EXT2 filesystem.

Ext3Filesystem (ExtFilesystem) dataclass

Linux EXT3 filesystem.

Ext4Filesystem (ExtFilesystem) dataclass

Linux EXT4 filesystem.

ExtFilesystem (GenericBinary, FilesystemRoot) dataclass

ExtFilesystem()

ExtUnpacker (Unpacker)

Extracts files and directories from Linux Extended (EXT2/EXT3/EXT4) filesystems, the standard Linux filesystem family. These filesystems support full Unix permissions, symbolic links, hard links, and extended attributes. Use when analyzing disk images, partition dumps, or embedded system storage that uses EXT filesystems. Common in Linux-based embedded devices, development boards, and virtualized environments. Note that there are currently no EXT packers, so after unpacking, the resource cannot be repacked.

unpack(self, resource, config=None) async

Unpack the given resource.

Users should not call this method directly; rather, they should run Resource.run or Resource.unpack.

Parameters:

Name Type Description Default
resource Resource

The resource that is being unpacked

 required
config ComponentConfig

Optional config for unpacking. If an implementation provides a default, this default will always be used when config would otherwise be None. Note that a copy of the default config will be passed, so the default config values cannot be modified persistently by a component run.

 None
Source code in ofrak/core/extfs.py 
async def unpack(self, resource: Resource, config: ComponentConfig = None) -> None:
    async with resource.temp_to_disk(suffix=".extfs") as temp_fs_path:
        with tempfile.TemporaryDirectory() as temp_dir:
            command = [
                "debugfs",
                "-R",
                f"rdump / {temp_dir}",
                temp_fs_path,
            ]
            proc = await asyncio.create_subprocess_exec(
                *command,
            )
            returncode = await proc.wait()
            if returncode:
                raise CalledProcessError(returncode=returncode, cmd=command)

            fs_view = await resource.view_as(ExtFilesystem)
            await fs_view.initialize_from_disk(temp_dir)