volatility.plugins.linux.tmpfs.linux_tmpfs Class Reference

Recovers tmpfs filesystems from memory. More...

Inheritance diagram for volatility.plugins.linux.tmpfs.linux_tmpfs:

Public Member Functions
def	__init__ (self, config, args, kwargs)
def	fix_md
	Fix metadata for new files.
def	process_directory
def	walk_sb (self, root_dentry)
def	get_tmpfs_sbs (self)
	we need this b/c we have a bunch of 'super_block' structs but no method that I could find maps a super_block to its vfs_mnt which is needed to figure out where the super_block is mounted More...
def	calculate (self)
def	render_text (self, outfd, data)

Public Attributes
	dir_times

Detailed Description

Recovers tmpfs filesystems from memory.

Member Function Documentation

def volatility.plugins.linux.tmpfs.linux_tmpfs.get_tmpfs_sbs

(

self

)

we need this b/c we have a bunch of 'super_block' structs but no method that I could find maps a super_block to its vfs_mnt which is needed to figure out where the super_block is mounted

This function returns a hash table of hash[sb] = path

---

The documentation for this class was generated from the following file:

• volatility/plugins/linux/tmpfs.py