dissect.target icon indicating copy to clipboard operation
dissect.target copied to clipboard

Separate FilesystemEntry into FilesystemEntry and DirEntry

Open DissectBot opened this issue 1 year ago • 0 comments

Currently, we only have a single FilesystemEntry class that, in most filesystem implementations, is backed by a single object (e.g. INode class) that represents both a real inode and a directory entry, usually by means of lazy loading. However, this creates some strange relations with regards to file names and parent inodes, which are generally strictly linked to directory entries and not inodes.

NTFS is currently the only implementation that kind of separates this. Here, the “lazy loading” is moved into the dissect.target implementation by means of a .dereference() method.

Now that pathlib.Path has started using os.scandir() which returns os.DirEntry classes, it might be worth looking into this. It should in principle give more flexibility, allow for more accurate caching, and being closer to how the real filesystem is implemented. However, at the cost of the filesystem layer in dissect.target becoming considerably more complex.

Additionally, this would very easily allow us to add “deleted files” support to dissect.target. A directory entry could simply have a flag .deleted set to True, for example. Support for this will of course need to be added to underlying filesystem implementations as well (i.e. ability to recover and list deleted directory entries).

DissectBot avatar Mar 20 '24 13:03 DissectBot