class Dfxml::Parser::FileObject

Public Instance Methods

allocated?() click to toggle source

Begin boolean methods

Convenience methods for flags expressed in the metadata layer of file systems. However, they’re not terribly robust and are considered workarounds for the way fiwalk expresses metadata-layer flags in its output. In fiwalk-generated dfxml, when an element should be considered true, the element contains the value “1”. However, the expression in output doesn’t necessarily fit with what humans expect. For example, the allocated/unallocated flags are expressed in fiwalk’s output as follows:

  • when allocated: <alloc>1</alloc>

  • when unallocated: <unalloc>1</unalloc>

For more clarification, see fiwalk_tsk.cpp’s handling for fs_file->meta in process_tsk_file.

# File lib/dfxml/parser.rb, line 121
def allocated?
  isone?(@alloc) && !isone?(@unalloc)
end
atime=(val) click to toggle source

Begin timestamp methods

It would be preferable to have a way to call these matching on element name.

# File lib/dfxml/parser.rb, line 82
def atime=(val)
  @atime = Time.parse(val)
end
bkup_time=(val) click to toggle source
# File lib/dfxml/parser.rb, line 86
def bkup_time=(val)
  @bkup_time = Time.parse(val)
end
compressed?() click to toggle source
# File lib/dfxml/parser.rb, line 125
def compressed?
  isone?(@compressed)
end
crtime=(val) click to toggle source
# File lib/dfxml/parser.rb, line 90
def crtime=(val)
  @crtime = Time.parse(val)
end
dtime=(val) click to toggle source
# File lib/dfxml/parser.rb, line 94
def dtime=(val)
  @dtime = Time.parse(val)
end
encrypted?() click to toggle source
# File lib/dfxml/parser.rb, line 129
def encrypted?
  # encrypted is not a flag, but we'll treat it like one.
  isone?(@encrypted)
end
mtime=(val) click to toggle source
# File lib/dfxml/parser.rb, line 98
def mtime=(val)
  @mtime = Time.parse(val)
end
orphan?() click to toggle source
# File lib/dfxml/parser.rb, line 134
def orphan?
  isone?(@orphan)
end
type() click to toggle source

End boolean methods

# File lib/dfxml/parser.rb, line 144
def type
  Dfxml::CharacterFileTypes[@name_type] ||= Dfxml::NumericFileTypes[@meta_type.to_i]
end
used?() click to toggle source
# File lib/dfxml/parser.rb, line 138
def used?
  isone?(@used) && !isone?(@unused)
end