Skip to content

Ability to append data to extraction file #660

@nyuware

Description

@nyuware

Is your feature request related to a problem? Please describe.
I'm currently writing a handler for the EWF file format, this format is usually used for single disk images destined to be used in recoveries or criminal investigations. While using the FileSystem class, it's currently not possible to extract a single file using fs.carve or fs.write_bytes or fs.write_chunks.

Doing this entry_path = Path("ewf.decrypted") would result into Errno 17: file already exists

Describe the solution you'd like
The ability to create a single file, perhaps re-adjusting the flags of those functions to allow the creation of a single file
Perhaps giving the ability of using "ab" instead of "wb" while opening a file ?

Additional context
Here is my current code, I'm using the offset of the chunks I'm currently extracting, because there is no other way to name it

for _ in range(header.number_of_entries):
            entry = self._struct_parser.parse("table_entry_t", file, Endian.LITTLE)
            entry_path = Path(f"{str(entry.offset)}.bin")

            entries.append((Path(entry_path.name),entry.offset,))
            
        for i, (carve_path, start_offset) in enumerate(entries):
            if i < len(entries) - 1:
                next_offset = entries[i + 1][1]
                size = int.from_bytes(next_offset, byteorder="little") - int.from_bytes(start_offset, byteorder="little")
                if file.read(2) in (magic.value for magic in zlibmagic):
                    fs.write_bytes(carve_path,zlib.decompress(file.read(size)))
                else:
                    fs.carve(carve_path, file, position + int.from_bytes(start_offset, byteorder="little"), size)

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or request

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions