Skip to content

Instantly share code, notes, and snippets.

@truekonrads
Last active July 3, 2022 15:24
Show Gist options
  • Save truekonrads/facc9a2cee636b37b26a55130f76ebae to your computer and use it in GitHub Desktop.
Save truekonrads/facc9a2cee636b37b26a55130f76ebae to your computer and use it in GitHub Desktop.
from pyaff4 import data_store
from pyaff4 import aff4_image
from pyaff4 import lexicon
from pyaff4 import rdfvalue
from pyaff4 import zip
import urllib.parse
def getAff4Images(filepath):
volume_path_urn = rdfvalue.URN.NewURNFromFilename(filepath)
resolver = data_store.MemoryDataStore()
with zip.ZipFile.NewZipFile(resolver,None, volume_path_urn) as volume:
for subject in resolver.QueryPredicateObject(None,
lexicon.AFF4_TYPE, lexicon.AFF4_IMAGE_TYPE):
name=urllib.parse.unquote(subject.value).split("//")[2]
in_fd=resolver.AFF4FactoryOpen(subject)
yield (name,in_fd)
for n,fd in getAff4Images(fn):
print(n,fd)
if n.endswith(".json"):
print(fd.read())
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment