@@ -57,48 +57,34 @@ a VMDK for reading:
5757 Many of the parsers in this package behave in a very similar way, so check the API reference to see how to utilize the
5858parser you need.
5959
60- Open QCOW2 snapshots
61- ~~~~~~~~~~~~~~~~~~~~
60+ Opening QCOW2 disks & backing-files
61+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
6262
63- For `qcow2 ` images there is support for backing-files and it can either be automatically loaded when opening a target.
64- The backing-file will automatically be read from the `qcow2 ` headers and dissect will attempt to load it.
63+ The QCOW2 parser provided by this library can be used to open QCOW2 disk images, including snapshots and backing-files.
64+ When opening a QCOW2 image as a target, any backing-files are automatically loaded and resolved.
65+
66+ For example, to open a QCOW2 image along with its backing-file:
6567
6668.. code-block :: python
67- target = Target.open(target_path)
68- print (target.users())
6969
70- Or, for more control, the path to the backing file can be passed when initializing a `qcow2 ` disk:
70+ from dissect.hypervisor.disk.qcow2 import QCow2
71+
72+ with open (" /path/to/base-image.qcow2" , " rb" ) as base_image, \
73+ open (" /path/to/backing-file.qcow2" , " rb" ) as backing_file:
74+ qcow2 = QCow2(base_image, backing_file = backing_file)
75+
76+ print (qcow2.open().read(512 ))
77+ print (qcow2.backing_file.read(512 ))
78+
79+ When opening a QCOW2 image using the dissect.target :class: `~dissect.target.target.Target ` class, any backing-files
80+ are automatically loaded and resolved. For example:
7181
7282.. code-block :: python
73- def open_qcow2_with_backing_file (snapshot_path : Path, backing_path : Path):
74- # Open base QCOW2 image
75- backing_fh = backing_path.open(" rb" )
76- base_qcow2 = qcow2.QCow2(backing_fh)
77- base_stream = base_qcow2.open()
78-
79- # Open snapshot QCOW2 image with base as backing file
80- snapshot_fh = snapshot_path.open(" rb" )
81- snapshot_qcow2 = qcow2.QCow2(
82- snapshot_fh,
83- backing_file = base_stream
84- )
85- snapshot_stream = snapshot_qcow2.open()
86-
87- return snapshot_stream, snapshot_fh, backing_fh, base_stream
88-
89- def analyze_image (snapshot_path : Path, backing_path : Path):
90- # Open the QCOW2 snapshot along with its backing file and get file/stream handles
91- snapshot_stream, snapshot_fh, backing_fh, base_stream = open_qcow2_with_backing_file(snapshot_path, backing_path)
92-
93- # Create a new Dissect target to analyze the disk image
94- target = Target()
95- # Add the snapshot stream to the target’s disks
96- target.disks.add(snapshot_stream)
97- # Resolve all disks, volumes and filesystems and load an operating system on the current
98- target.apply()
99-
100- # Collect data from the snapshot
101- print (target.users())
83+
84+ from dissect.target import Target
85+
86+ target = Target(" /path/to/base-image.qcow2" ) # Automatically resolves backing-files
87+ print (target.hostname)
10288
10389 Tools
10490-----
0 commit comments