Class: Dfxml::Parser::FileObject

Inherits:
Object
  • Object
show all
Includes:
SAXMachine
Defined in:
lib/dfxml/parser.rb

Instance Method Summary collapse

Instance Method Details

#allocated? ⇒ Boolean

Begin boolean methods

Convenience methods for flags expressed in the metadata layer of file systems. However, they’re not terribly robust and are considered workarounds for the way fiwalk expresses metadata-layer flags in its output. In fiwalk-generated dfxml, when an element should be considered true, the element contains the value “1”. However, the expression in output doesn’t necessarily fit with what humans expect. For example, the allocated/unallocated flags are expressed in fiwalk’s output as follows:

  • when allocated: <alloc>1</alloc>

  • when unallocated: <unalloc>1</unalloc>

For more clarification, see fiwalk_tsk.cpp’s handling for fs_file->meta in process_tsk_file.

Returns:

  • (Boolean) 


121
122
123
 
# File 'lib/dfxml/parser.rb', line 121

def allocated?
  isone?(@alloc) && !isone?(@unalloc)
end

#atime=(val) ⇒ Object

Begin timestamp methods

It would be preferable to have a way to call these matching on element name.



82
83
84
 
# File 'lib/dfxml/parser.rb', line 82

def atime=(val)
  @atime = Time.parse(val)
end

#bkup_time=(val) ⇒ Object 



86
87
88
 
# File 'lib/dfxml/parser.rb', line 86

def bkup_time=(val)
  @bkup_time = Time.parse(val)
end

#compressed? ⇒ Boolean

Returns:

  • (Boolean) 


125
126
127
 
# File 'lib/dfxml/parser.rb', line 125

def compressed?
  isone?(@compressed)
end

#crtime=(val) ⇒ Object 



90
91
92
 
# File 'lib/dfxml/parser.rb', line 90

def crtime=(val)
  @crtime = Time.parse(val)
end

#dtime=(val) ⇒ Object 



94
95
96
 
# File 'lib/dfxml/parser.rb', line 94

def dtime=(val)
  @dtime = Time.parse(val)
end

#encrypted? ⇒ Boolean

Returns:

  • (Boolean) 


129
130
131
132
 
# File 'lib/dfxml/parser.rb', line 129

def encrypted?
  # encrypted is not a flag, but we'll treat it like one.
  isone?(@encrypted)
end

#mtime=(val) ⇒ Object 



98
99
100
 
# File 'lib/dfxml/parser.rb', line 98

def mtime=(val)
  @mtime = Time.parse(val)
end

#orphan? ⇒ Boolean

Returns:

  • (Boolean) 


134
135
136
 
# File 'lib/dfxml/parser.rb', line 134

def orphan?
  isone?(@orphan)
end

#type ⇒ Object

End boolean methods



144
145
146
 
# File 'lib/dfxml/parser.rb', line 144

def type
  Dfxml::CharacterFileTypes[@name_type] ||= Dfxml::NumericFileTypes[@meta_type.to_i]
end

#used? ⇒ Boolean

Returns:

  • (Boolean) 


138
139
140
 
# File 'lib/dfxml/parser.rb', line 138

def used?
  isone?(@used) && !isone?(@unused)
end