class Dfxml::Parser::FileObject
Public Instance Methods
Begin boolean methods
Convenience methods for flags expressed in the metadata layer of file systems. However, they’re not terribly robust and are considered workarounds for the way fiwalk expresses metadata-layer flags in its output. In fiwalk-generated dfxml, when an element should be considered true, the element contains the value “1”. However, the expression in output doesn’t necessarily fit with what humans expect. For example, the allocated/unallocated flags are expressed in fiwalk’s output as follows:
-
when allocated: <alloc>1</alloc>
-
when unallocated: <unalloc>1</unalloc>
For more clarification, see fiwalk_tsk.cpp’s handling for fs_file->meta in process_tsk_file.
# File lib/dfxml/parser.rb, line 121 def allocated? isone?(@alloc) && !isone?(@unalloc) end
Begin timestamp methods
It would be preferable to have a way to call these matching on element name.
# File lib/dfxml/parser.rb, line 82 def atime=(val) @atime = Time.parse(val) end
# File lib/dfxml/parser.rb, line 86 def bkup_time=(val) @bkup_time = Time.parse(val) end
# File lib/dfxml/parser.rb, line 125 def compressed? isone?(@compressed) end
# File lib/dfxml/parser.rb, line 90 def crtime=(val) @crtime = Time.parse(val) end
# File lib/dfxml/parser.rb, line 94 def dtime=(val) @dtime = Time.parse(val) end
# File lib/dfxml/parser.rb, line 129 def encrypted? # encrypted is not a flag, but we'll treat it like one. isone?(@encrypted) end
# File lib/dfxml/parser.rb, line 98 def mtime=(val) @mtime = Time.parse(val) end
# File lib/dfxml/parser.rb, line 134 def orphan? isone?(@orphan) end
End boolean methods
# File lib/dfxml/parser.rb, line 144 def type Dfxml::CharacterFileTypes[@name_type] ||= Dfxml::NumericFileTypes[@meta_type.to_i] end
# File lib/dfxml/parser.rb, line 138 def used? isone?(@used) && !isone?(@unused) end