Dfxml report of disk image with fiwalk results in AttributeError

[bitsgalore]

I'm trying to use the module to generate dfxml reports of disk images. I can't find any examples of this in either the documentation or in the examples, but after digging a bit into the code I came up with this:

#! /usr/bin/env python3

import os
from dfxml import fiwalk

imageFile = os.path.abspath("1a330188-23d0-11ed-a1cf-3dad24cfc09f.img")
test = fiwalk.fiwalk_xml_stream(imagefile=imageFile)
print(test)

But this results in:

Traceback (most recent call last):
  File "./test-fiwalk.py", line 7, in <module>
    test = fiwalk.fiwalk_xml_stream(imagefile=imageFile)
  File "/home/johan/.local/lib/python3.8/site-packages/dfxml/fiwalk.py", line 138, in fiwalk_xml_stream
    p = Popen(cmd + E01_glob(imagefile.name),stdout=PIPE)
AttributeError: 'str' object has no attribute 'name'

Not sure if this is some bug, or perhaps I'm just doing something completely wrong here myself? In any case, as this seems one of the most obvious use cases for this software, it would be helpful to provide some documentation or example.

[jgru]

Hi @bitsgalore,

Not sure if this is some bug, or perhaps I'm just doing something completely wrong here myself? In any case, as this seems one of the most obvious use cases for this software, it would be helpful to provide some documentation or example.

did you try to open the imagefile first?
Apparently, this is how it is done in the scripts in the bin-directory, e.g., imap.py.

import os
from dfxml import fiwalk

imgfile_path  = os.path.abspath("1a330188-23d0-11ed-a1cf-3dad24cfc09f.img")

with open(imgfile_path, "rb") as ifs:
    test = fiwalk.fiwalk_xml_stream(imagefile=ifs)

[simsong]

Did you look at the examples in the demos directory?

[bitsgalore]

@jgru That seems to do the trick, wouldn't have thought of that myself. Thanks (also for the super fast response)!

@simsong Yes, that's the first place I looked of course. From the file names alone none of the demo files seem to cover this use case, which was confirmed by opening a few of them.

[simsong]

Okay. Can you give us a pull request with a use case that covers your situation?

[bitsgalore]

Sure, here it is: #40