dissect.target 3.19.dev58__tar.gz → 3.20__tar.gz

{dissect_target-3.19.dev58/dissect.target.egg-info → dissect_target-3.20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.19.dev58
+Version: 3.20
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3
@@ -31,10 +31,11 @@ Requires-Dist: dissect.ntfs<4,>=3.4
 Requires-Dist: dissect.regf<4,>=3.3
 Requires-Dist: dissect.util<4,>=3
 Requires-Dist: dissect.volume<4,>=2
-Requires-Dist: flow.record~=3.16.0
+Requires-Dist: flow.record~=3.18.0
 Requires-Dist: structlog
 Provides-Extra: full
 Requires-Dist: asn1crypto; extra == "full"
+Requires-Dist: dissect.archive<2,>=1; extra == "full"
 Requires-Dist: dissect.btrfs<2,>=1; extra == "full"
 Requires-Dist: dissect.cim<4,>=3; extra == "full"
 Requires-Dist: dissect.clfs<2,>=1; extra == "full"
@@ -43,6 +44,7 @@ Requires-Dist: dissect.etl<4,>=3; extra == "full"
 Requires-Dist: dissect.extfs<4,>=3; extra == "full"
 Requires-Dist: dissect.fat<4,>=3; extra == "full"
 Requires-Dist: dissect.ffs<4,>=3; extra == "full"
+Requires-Dist: dissect.fve<5,>=4; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "full"
 Requires-Dist: dissect.jffs<2,>=1; extra == "full"
 Requires-Dist: dissect.ole<4,>=3; extra == "full"
 Requires-Dist: dissect.shellitem<4,>=3; extra == "full"
@@ -59,6 +61,7 @@ Requires-Dist: tomli; python_version < "3.11" and extra == "full"
 Requires-Dist: zstandard; extra == "full"
 Provides-Extra: dev
 Requires-Dist: dissect.target[full,mqtt,yara]; extra == "dev"
+Requires-Dist: dissect.archive[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.btrfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.cim[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.clfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
@@ -70,6 +73,7 @@ Requires-Dist: dissect.evidence[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.extfs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.fat[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.ffs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.fve[dev]<5.0.dev,>=4.0.dev; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "dev"
 Requires-Dist: dissect.hypervisor[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.jffs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
 Requires-Dist: dissect.ntfs[dev]<4.0.dev,>=3.4.dev; extra == "dev"

{dissect_target-3.19.dev58 → dissect_target-3.20}/dissect/target/container.py

@@ -239,7 +239,7 @@ def open(item: Union[list, str, BinaryIO, Path], *args, **kwargs):
                 log.info("Failed to import %s", container)
                 log.debug("", exc_info=e)
             except Exception as e:
-                raise ContainerError(f"Failed to open container {item}", cause=e)
+                raise ContainerError(f"Failed to open container {item}") from e
     finally:
         if first_fh_opened:
             first_fh.close()

{dissect_target-3.19.dev58 → dissect_target-3.20}/dissect/target/exceptions.py

@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 import os
 import sys
 import traceback
@@ -7,13 +9,12 @@ from typing import Callable
 class Error(Exception):
     """Generic dissect.target error"""
 
-    def __init__(self, message=None, cause=None, extra=None):
+    def __init__(self, message: str | None = None, extra: list[Exception] | None = None):
         if extra:
             exceptions = "\n\n".join(["".join(traceback.format_exception_only(type(e), e)) for e in extra])
             message = f"{message}\n\nAdditionally, the following exceptions occurred:\n\n{exceptions}"
 
         super().__init__(message)
-        self.__cause__ = cause
         self.__extra__ = extra
 
 
@@ -72,15 +73,15 @@ class PluginNotFoundError(PluginError):
     """Plugin cannot be found."""
 
 
-class FileNotFoundError(FilesystemError):
+class FileNotFoundError(FilesystemError, FileNotFoundError):
     """The requested path could not be found."""
 
 
-class IsADirectoryError(FilesystemError):
+class IsADirectoryError(FilesystemError, IsADirectoryError):
     """The entry is a directory."""
 
 
-class NotADirectoryError(FilesystemError):
+class NotADirectoryError(FilesystemError, NotADirectoryError):
     """The entry is not a directory."""
 
 

{dissect_target-3.19.dev58 → dissect_target-3.20}/dissect/target/filesystem.py

@@ -1142,7 +1142,7 @@ class VirtualFilesystem(Filesystem):
                     try:
                         return entry.top.get(fsutil.join(*parts[i:], alt_separator=self.alt_separator))
                     except FilesystemError as e:
-                        raise FileNotFoundError(full_path, cause=e)
+                        raise FileNotFoundError(full_path) from e
                 else:
                     raise FileNotFoundError(full_path)
 
@@ -1715,7 +1715,7 @@ def open(fh: BinaryIO, *args, **kwargs) -> Filesystem:
                 log.info("Failed to import %s", filesystem)
                 log.debug("", exc_info=e)
             except Exception as e:
-                raise FilesystemError(f"Failed to open filesystem for {fh}", cause=e)
+                raise FilesystemError(f"Failed to open filesystem for {fh}") from e
     finally:
         fh.seek(offset)
 

{dissect_target-3.19.dev58 → dissect_target-3.20}/dissect/target/filesystems/btrfs.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import math
 from typing import BinaryIO, Iterator, Optional, Union
 
 import dissect.btrfs as btrfs
@@ -78,13 +79,13 @@ class BtrfsSubvolumeFilesystem(Filesystem):
         try:
             return self.subvolume.get(path, node)
         except btrfs.FileNotFoundError as e:
-            raise FileNotFoundError(path, cause=e)
+            raise FileNotFoundError(path) from e
         except btrfs.NotADirectoryError as e:
-            raise NotADirectoryError(path, cause=e)
+            raise NotADirectoryError(path) from e
         except btrfs.NotASymlinkError as e:
-            raise NotASymlinkError(path, cause=e)
+            raise NotASymlinkError(path) from e
         except btrfs.Error as e:
-            raise FileNotFoundError(path, cause=e)
+            raise FileNotFoundError(path) from e
 
 
 class BtrfsFilesystemEntry(FilesystemEntry):
@@ -153,7 +154,7 @@ class BtrfsFilesystemEntry(FilesystemEntry):
         node = self.entry.inode
 
         # mode, ino, dev, nlink, uid, gid, size, atime, mtime, ctime
-        st_info = st_info = fsutil.stat_result(
+        st_info = fsutil.stat_result(
             [
                 entry.mode,
                 entry.inum,
@@ -176,5 +177,13 @@ class BtrfsFilesystemEntry(FilesystemEntry):
 
         # Btrfs has a birth time, called otime
         st_info.st_birthtime = entry.otime.timestamp()
+        st_info.st_birthtime_ns = entry.otime_ns
+
+        # Add block information of the filesystem
+        st_info.st_blksize = entry.btrfs.sector_size
+
+        st_info.st_blocks = 0
+        if not self.is_dir():
+            st_info.st_blocks = (st_info.st_blksize // 512) * math.ceil(st_info.st_size / st_info.st_blksize)
 
         return st_info

{dissect_target-3.19.dev58 → dissect_target-3.20}/dissect/target/filesystems/config.py

@@ -133,7 +133,7 @@ class ConfigurationEntry(FilesystemEntry):
     Behaves like a ``directory`` when :attr:`parser_items` is a :class:`.ConfigurationParser` or a ``dict``.
     Behaves like a ``file`` otherwise.
 
-    Attributes:
+    Args:
         parser_items: A dict-like object containing all configuration entries and values.
             In most cases this is either a :class:`.ConfigurationParser` or ``dict``.
             Otherwise, its the entry's value
@@ -247,10 +247,14 @@ class ConfigurationEntry(FilesystemEntry):
         Returns:
             A file-like object holding a byte representation of :attr:`parser_items`.
         """
+
         if isinstance(self.parser_items, ConfigurationParser):
             # Currently trying to open the underlying entry
             return self.entry.open()
 
+        if isinstance(self.parser_items, bytes):
+            return io.BytesIO(self.parser_items)
+
         output_data = self._write_value_mapping(self.parser_items)
         return io.BytesIO(bytes(output_data, "utf-8"))
 

{dissect_target-3.19.dev58 → dissect_target-3.20}/dissect/target/filesystems/extfs.py

@@ -33,13 +33,13 @@ class ExtFilesystem(Filesystem):
         try:
             return self.extfs.get(path, node)
         except extfs.FileNotFoundError as e:
-            raise FileNotFoundError(path, cause=e)
+            raise FileNotFoundError(path) from e
         except extfs.NotADirectoryError as e:
-            raise NotADirectoryError(path, cause=e)
+            raise NotADirectoryError(path) from e
         except extfs.NotASymlinkError as e:
-            raise NotASymlinkError(path, cause=e)
+            raise NotASymlinkError(path) from e
         except extfs.Error as e:
-            raise FileNotFoundError(path, cause=e)
+            raise FileNotFoundError(path) from e
 
 
 class ExtFilesystemEntry(FilesystemEntry):
@@ -128,6 +128,7 @@ class ExtFilesystemEntry(FilesystemEntry):
         # Set birthtime if available
         if self.entry.crtime:
             st_info.st_birthtime = self.entry.crtime.timestamp()
+            st_info.st_birthtime_ns = self.entry.crtime_ns
 
         # Set the nanosecond resolution separately
         st_info.st_atime_ns = self.entry.atime_ns

{dissect_target-3.19.dev58 → dissect_target-3.20}/dissect/target/filesystems/fat.py

@@ -1,4 +1,5 @@
 import datetime
+import math
 import stat
 from typing import BinaryIO, Iterator, Optional, Union
 
@@ -41,11 +42,11 @@ class FatFilesystem(Filesystem):
         try:
             return self.fatfs.get(path, dirent=entry)
         except fat_exc.FileNotFoundError as e:
-            raise FileNotFoundError(path, cause=e)
+            raise FileNotFoundError(path) from e
         except fat_exc.NotADirectoryError as e:
-            raise NotADirectoryError(path, cause=e)
+            raise NotADirectoryError(path) from e
         except fat_exc.Error as e:
-            raise FileNotFoundError(path, cause=e)
+            raise FileNotFoundError(path) from e
 
 
 class FatFilesystemEntry(FilesystemEntry):
@@ -100,16 +101,21 @@ class FatFilesystemEntry(FilesystemEntry):
     def lstat(self) -> fsutil.stat_result:
         """Return the stat information of the given path, without resolving links."""
         # mode, ino, dev, nlink, uid, gid, size, atime, mtime, ctime
-        st_info = [
-            (stat.S_IFDIR if self.is_dir() else stat.S_IFREG) | 0o777,
-            self.entry.cluster,
-            id(self.fs),
-            1,
-            0,
-            0,
-            self.entry.size,
-            self.entry.atime.replace(tzinfo=self.fs.tzinfo).timestamp(),
-            self.entry.mtime.replace(tzinfo=self.fs.tzinfo).timestamp(),
-            self.entry.ctime.replace(tzinfo=self.fs.tzinfo).timestamp(),
-        ]
-        return fsutil.stat_result(st_info)
+        st_info = fsutil.stat_result(
+            [
+                (stat.S_IFDIR if self.is_dir() else stat.S_IFREG) | 0o777,
+                self.entry.cluster,
+                id(self.fs),
+                1,
+                0,
+                0,
+                self.entry.size,
+                self.entry.atime.replace(tzinfo=self.fs.tzinfo).timestamp(),
+                self.entry.mtime.replace(tzinfo=self.fs.tzinfo).timestamp(),
+                self.entry.ctime.replace(tzinfo=self.fs.tzinfo).timestamp(),
+            ]
+        )
+
+        st_info.st_blocks = math.ceil(self.entry.size / self.entry.fs.cluster_size)
+        st_info.st_blksize = self.entry.fs.cluster_size
+        return st_info

{dissect_target-3.19.dev58 → dissect_target-3.20}/dissect/target/filesystems/ffs.py

@@ -39,13 +39,13 @@ class FfsFilesystem(Filesystem):
         try:
             return self.ffs.get(path, node)
         except ffs.FileNotFoundError as e:
-            raise FileNotFoundError(path, cause=e)
+            raise FileNotFoundError(path) from e
         except ffs.NotADirectoryError as e:
-            raise NotADirectoryError(path, cause=e)
+            raise NotADirectoryError(path) from e
         except ffs.NotASymlinkError as e:
-            raise NotASymlinkError(path, cause=e)
+            raise NotASymlinkError(path) from e
         except ffs.Error as e:
-            raise FileNotFoundError(path, cause=e)
+            raise FileNotFoundError(path) from e
 
 
 class FfsFilesystemEntry(FilesystemEntry):
@@ -126,6 +126,12 @@ class FfsFilesystemEntry(FilesystemEntry):
             ]
         )
 
+        # Note: stat on linux always returns the default block size of 4096
+        # We are returning the actual block size of the filesystem, as on BSD
+        st_info.st_blksize = self.fs.ffs.block_size
+        # Note: st_blocks * 512 can be lower than st_blksize because FFS employs fragments
+        st_info.st_blocks = self.entry.nblocks
+
         # Set the nanosecond resolution separately
         st_info.st_atime_ns = self.entry.atime_ns
         st_info.st_mtime_ns = self.entry.mtime_ns
@@ -134,5 +140,6 @@ class FfsFilesystemEntry(FilesystemEntry):
         # FFS2 has a birth time, FFS1 does not
         if btime := self.entry.btime:
             st_info.st_birthtime = btime.timestamp()
+            st_info.st_birthtime_ns = self.entry.btime_ns
 
         return st_info

{dissect_target-3.19.dev58 → dissect_target-3.20}/dissect/target/filesystems/jffs.py

@@ -35,13 +35,13 @@ class JFFSFilesystem(Filesystem):
         try:
             return self.jffs2.get(path, node)
         except jffs2.FileNotFoundError as e:
-            raise FileNotFoundError(path, cause=e)
+            raise FileNotFoundError(path) from e
         except jffs2.NotADirectoryError as e:
-            raise NotADirectoryError(path, cause=e)
+            raise NotADirectoryError(path) from e
         except jffs2.NotASymlinkError as e:
-            raise NotASymlinkError(path, cause=e)
+            raise NotASymlinkError(path) from e
         except jffs2.Error as e:
-            raise FileNotFoundError(path, cause=e)
+            raise FileNotFoundError(path) from e
 
 
 class JFFSFilesystemEntry(FilesystemEntry):
@@ -76,13 +76,13 @@ class JFFSFilesystemEntry(FilesystemEntry):
             entry_path = fsutil.join(self.path, name, alt_separator=self.fs.alt_separator)
             yield JFFSFilesystemEntry(self.fs, entry_path, entry)
 
-    def is_dir(self, follow_symlinks: bool = False) -> bool:
+    def is_dir(self, follow_symlinks: bool = True) -> bool:
         try:
             return self._resolve(follow_symlinks).entry.is_dir()
         except FilesystemError:
             return False
 
-    def is_file(self, follow_symlinks: bool = False) -> bool:
+    def is_file(self, follow_symlinks: bool = True) -> bool:
         try:
             return self._resolve(follow_symlinks).entry.is_file()
         except FilesystemError:
@@ -97,7 +97,7 @@ class JFFSFilesystemEntry(FilesystemEntry):
 
         return self.entry.link
 
-    def stat(self, follow_symlinks: bool = False) -> fsutil.stat_result:
+    def stat(self, follow_symlinks: bool = True) -> fsutil.stat_result:
         return self._resolve(follow_symlinks).lstat()
 
     def lstat(self) -> fsutil.stat_result:
@@ -119,4 +119,9 @@ class JFFSFilesystemEntry(FilesystemEntry):
             ]
         )
 
+        # JFFS2 block size is a function of the "erase size" of the underlying flash device.
+        # Linux stat reports the default block size, which is defined as 4k in libc.
+        st_info.st_blksize = 4096
+        st_info.st_blocks = (node.isize + 511) // 512 if self.is_file() else 0
+
         return st_info

{dissect_target-3.19.dev58 → dissect_target-3.20}/dissect/target/filesystems/ntfs.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import math
 import stat
 from typing import BinaryIO, Iterator, Optional
 
@@ -47,12 +48,12 @@ class NtfsFilesystem(Filesystem):
         try:
             path = path.rsplit(":", maxsplit=1)[0]
             return self.ntfs.mft.get(path, root=root)
-        except NtfsFileNotFoundError:
-            raise FileNotFoundError(path)
+        except NtfsFileNotFoundError as e:
+            raise FileNotFoundError(path) from e
         except NtfsNotADirectoryError as e:
-            raise NotADirectoryError(path, cause=e)
+            raise NotADirectoryError(path) from e
         except NtfsError as e:
-            raise FileNotFoundError(path, cause=e)
+            raise FileNotFoundError(path) from e
 
 
 class NtfsFilesystemEntry(FilesystemEntry):
@@ -151,12 +152,14 @@ class NtfsFilesystemEntry(FilesystemEntry):
         record = self.dereference()
 
         size = 0
+        real_size = 0
         if self.is_symlink():
             mode = stat.S_IFLNK
         elif self.is_file():
             mode = stat.S_IFREG
             try:
                 size = record.size(self.ads)
+                real_size = record.size(self.ads, allocated=True)
             except NtfsFileNotFoundError as e:
                 # Occurs when it cannot find the the specific ads inside its attributes
                 raise FileNotFoundError from e
@@ -176,16 +179,29 @@ class NtfsFilesystemEntry(FilesystemEntry):
                 0,
                 size,
                 stdinfo.last_access_time.timestamp(),
-                stdinfo.last_change_time.timestamp(),
+                stdinfo.last_modification_time.timestamp(),
+                # ctime gets set to creation time for python <3.12 purposes
                 stdinfo.creation_time.timestamp(),
             ]
         )
 
         # Set the nanosecond resolution separately
         st_info.st_atime_ns = stdinfo.last_access_time_ns
-        st_info.st_mtime_ns = stdinfo.last_change_time_ns
+        st_info.st_mtime_ns = stdinfo.last_modification_time_ns
+
         st_info.st_ctime_ns = stdinfo.creation_time_ns
 
+        st_info.st_birthtime = stdinfo.creation_time.timestamp()
+        st_info.st_birthtime_ns = stdinfo.creation_time_ns
+
+        # real_size is none if the size is resident
+        st_info.st_blksize = record.ntfs.cluster_size
+        blocks = 0
+        if not record.resident:
+            blocks = math.ceil(real_size / 512)
+
+        st_info.st_blocks = blocks
+
         return st_info
 
     def attr(self) -> AttributeMap:

{dissect_target-3.19.dev58 → dissect_target-3.20}/dissect/target/filesystems/overlay.py

@@ -89,15 +89,25 @@ class Overlay2Filesystem(LayerFilesystem):
 
         # append and mount every layer
         for dest, layer in layers:
-            if layer.is_file() and dest in ["/etc/hosts", "/etc/hostname", "/etc/resolv.conf"]:
+            # we could have collected a layer reference that actually does not exist on the host
+            if not layer.exists():
+                log.warning(
+                    "Can not mount layer %s for container %s as it does not exist on the host", layer, path.name
+                )
+                continue
+
+            # mount points can be files
+            if layer.is_file():
                 layer_fs = VirtualFilesystem()
-                layer_fs.map_file_fh("/etc/" + layer.name, layer.open("rb"))
-                dest = dest.split("/")[0]
+                layer_fs.map_file_fh(dest, layer.open("rb"))
 
+            # regular overlay2 layers are directories
+            # mount points can be directories too
             else:
                 layer_fs = DirectoryFilesystem(layer)
 
-            self.append_layer().mount(dest, layer_fs)
+            log.info("Adding layer %s to destination %s", layer, dest)
+            self.append_layer().mount("/" if layer.is_file() else dest, layer_fs)
 
     def __repr__(self) -> str:
         return f"<{self.__class__.__name__} {self.base_path}>"

{dissect_target-3.19.dev58 → dissect_target-3.20}/dissect/target/filesystems/smb.py

@@ -58,10 +58,10 @@ class SmbFilesystem(Filesystem):
         except SessionError as e:
             if e.error == STATUS_NOT_A_DIRECTORY:
                 # STATUS_NOT_A_DIRECTORY
-                raise NotADirectoryError(path, cause=e)
+                raise NotADirectoryError(path) from e
             else:
                 # 0xC000000F is STATUS_NO_SUCH_FILE, but everything else should raise a FileNotFoundError anyway
-                raise FileNotFoundError(path, cause=e)
+                raise FileNotFoundError(path) from e
 
         if len(result) != 1:
             raise FileNotFoundError(path)
@@ -106,7 +106,7 @@ class SmbFilesystemEntry(FilesystemEntry):
         try:
             return SmbStream(self.fs.conn, self.fs.share_name, self.path, self.entry.get_filesize())
         except SessionError as e:
-            raise FilesystemError(f"Failed to open file: {self.path}", cause=e)
+            raise FilesystemError(f"Failed to open file: {self.path}") from e
 
     def is_dir(self, follow_symlinks: bool = True) -> bool:
         try:

{dissect_target-3.19.dev58 → dissect_target-3.20}/dissect/target/filesystems/squashfs.py

@@ -32,13 +32,13 @@ class SquashFSFilesystem(Filesystem):
         try:
             return self.squashfs.get(path, node)
         except exceptions.FileNotFoundError as e:
-            raise FileNotFoundError(path, cause=e)
+            raise FileNotFoundError(path) from e
         except exceptions.NotADirectoryError as e:
-            raise NotADirectoryError(path, cause=e)
+            raise NotADirectoryError(path) from e
         except exceptions.NotASymlinkError as e:
-            raise NotASymlinkError(path, cause=e)
+            raise NotASymlinkError(path) from e
         except exceptions.Error as e:
-            raise FileNotFoundError(path, cause=e)
+            raise FileNotFoundError(path) from e
 
 
 class SquashFSFilesystemEntry(FilesystemEntry):

{dissect_target-3.19.dev58 → dissect_target-3.20}/dissect/target/filesystems/vmfs.py

@@ -41,13 +41,13 @@ class VmfsFilesystem(Filesystem):
         try:
             return self.vmfs.get(path, node)
         except vmfs.FileNotFoundError as e:
-            raise FileNotFoundError(path, cause=e)
+            raise FileNotFoundError(path) from e
         except vmfs.NotADirectoryError as e:
-            raise NotADirectoryError(path, cause=e)
+            raise NotADirectoryError(path) from e
         except vmfs.NotASymlinkError as e:
-            raise NotASymlinkError(path, cause=e)
+            raise NotASymlinkError(path) from e
         except vmfs.Error as e:
-            raise FileNotFoundError(path, cause=e)
+            raise FileNotFoundError(path) from e
 
 
 class VmfsFilesystemEntry(FilesystemEntry):

{dissect_target-3.19.dev58 → dissect_target-3.20}/dissect/target/filesystems/xfs.py

@@ -35,14 +35,14 @@ class XfsFilesystem(Filesystem):
     def _get_node(self, path: str, node: Optional[xfs.INode] = None) -> xfs.INode:
         try:
             return self.xfs.get(path, node)
-        except xfs.FileNotFoundError:
-            raise FileNotFoundError(path)
-        except xfs.NotADirectoryError:
-            raise NotADirectoryError(path)
-        except xfs.NotASymlinkError:
-            raise NotASymlinkError(path)
+        except xfs.FileNotFoundError as e:
+            raise FileNotFoundError(path) from e
+        except xfs.NotADirectoryError as e:
+            raise NotADirectoryError(path) from e
+        except xfs.NotASymlinkError as e:
+            raise NotASymlinkError(path) from e
         except xfs.Error as e:
-            raise FileNotFoundError(path, cause=e)
+            raise FileNotFoundError(path) from e
 
 
 class XfsFilesystemEntry(FilesystemEntry):
@@ -130,8 +130,15 @@ class XfsFilesystemEntry(FilesystemEntry):
         st_info.st_mtime_ns = self.entry.mtime_ns
         st_info.st_ctime_ns = self.entry.ctime_ns
 
-        # XFS has a birth time, called crtime
+        st_info.st_blksize = self.fs.xfs.block_size
+        # Convert number of filesystem blocks to basic blocks
+        # Reference: https://github.com/torvalds/linux/blob/e32cde8d2bd7d251a8f9b434143977ddf13dcec6/fs/xfs/xfs_iops.c#L602 # noqa: E501
+        # Note that block size in XFS is always a multiple of 512, so the division below is safe
+        st_info.st_blocks = self.entry.nblocks * (self.fs.xfs.block_size // 512)
+
+        # XFS has a birth time, since inode version 3 (version 5 of filesystem)
         st_info.st_birthtime = self.entry.crtime.timestamp()
+        st_info.st_birthtime_ns = self.entry.crtime_ns
 
         return st_info
 

{dissect_target-3.19.dev58 → dissect_target-3.20}/dissect/target/helpers/compat/path_common.py

@@ -56,11 +56,11 @@ class _DissectScandirIterator:
 
     The _DissectScandirIterator provides a context manager, so scandir can be called as:
 
-    ```
-    with scandir(path) as it:
-        for entry in it
-            print(entry.name)
-    ```
+    .. code-block:: python
+
+        with scandir(path) as it:
+            for entry in it
+                print(entry.name)
 
     similar to os.scandir() behaviour since Python 3.6.
     """