DiskAnalyzer (version 0.0.1)
index
diskanalyzer.py

This package implements multiples libraries and tools to parse, analyze
and extract informations from disk on the live system.

 
Classes
       
_ctypes.Structure(_ctypes._CData)
GPTHeader
GPTPartitionEntry
MBRHeader
MBRPartitionEntry
builtins.object
Partition
enum.Enum(builtins.object)
GptPartitionType
MbrPartitionType
PartitionStatus

 
class GPTHeader(_ctypes.Structure)
    This class defines the GPT structure.
 
 
Method resolution order:
GPTHeader
_ctypes.Structure
_ctypes._CData
builtins.object

Methods defined here:
to_partition(self)
This function makes partition from GPT.

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)
backup_lba
current_lba
disk_guid
first_usable_lba
header_crc32
header_size
last_usable_lba
num_part_entries
part_array_crc32
part_entry_size
partition_entry_lba
reserved
revision
signature

Methods inherited from _ctypes.Structure:
__init__(self, /, *args, **kwargs)
Initialize self.  See help(type(self)) for accurate signature.

Static methods inherited from _ctypes.Structure:
__new__(*args, **kwargs) from _ctypes.PyCStructType
Create and return a new object.  See help(type) for accurate signature.

Methods inherited from _ctypes._CData:
__ctypes_from_outparam__(...)
__hash__(self, /)
Return hash(self).
__reduce__(...)
Helper for pickle.
__setstate__(...)

 
class GPTPartitionEntry(_ctypes.Structure)
    This class defines the GPT partition structure.
 
 
Method resolution order:
GPTPartitionEntry
_ctypes.Structure
_ctypes._CData
builtins.object

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)
attributes
end_lba
part_name
part_type_guid
start_lba
unique_part_guid

Methods inherited from _ctypes.Structure:
__init__(self, /, *args, **kwargs)
Initialize self.  See help(type(self)) for accurate signature.

Static methods inherited from _ctypes.Structure:
__new__(*args, **kwargs) from _ctypes.PyCStructType
Create and return a new object.  See help(type) for accurate signature.

Methods inherited from _ctypes._CData:
__ctypes_from_outparam__(...)
__hash__(self, /)
Return hash(self).
__reduce__(...)
Helper for pickle.
__setstate__(...)

 
class GptPartitionType(enum.Enum)
    GptPartitionType(value, names=None, *, module=None, qualname=None, type=None, start=1)
 
Enum for disk partitions type.
 
 
Method resolution order:
GptPartitionType
enum.Enum
builtins.object

Data and other attributes defined here:
EMPTY = <GptPartitionType.EMPTY: '00000000-0000-0000-0000-000000000000'>
LEGACY_MBR_PARTITION_GUID = <GptPartitionType.LEGACY_MBR_PARTITION_GUID: '024DEE41-33E7-11D3-9D69-0008C781F39F'>
PARTITION_BASIC_DATA_GUID = <GptPartitionType.PARTITION_BASIC_DATA_GUID: 'EBD0A0A2-B9E5-4433-87C0-68B6B72699C7'>
PARTITION_LINUX_FILE_SYSTEM_DATA_GUID = <GptPartitionType.PARTITION_LINUX_FILE_SYSTEM_DATA_GUID: '0FC63DAF-8483-4772-8E79-3D69D8477DE4'>
PARTITION_LINUX_LVM_GUID = <GptPartitionType.PARTITION_LINUX_LVM_GUID: 'E6D6D379-F507-44C2-A23C-238F2A3DF928'>
PARTITION_LINUX_RAID_GUID = <GptPartitionType.PARTITION_LINUX_RAID_GUID: 'A19D880F-05FC-4D3B-A006-743F0F84911E'>
PARTITION_LINUX_SWAP_GUID = <GptPartitionType.PARTITION_LINUX_SWAP_GUID: '0657FD6D-A4AB-43C4-84E5-0933C84B4F4F'>
PARTITION_MSFT_RESERVED_GUID = <GptPartitionType.PARTITION_MSFT_RESERVED_GUID: 'E3C9E316-0B5C-4DB8-817D-F92DF00215AE'>
PARTITION_SYSTEM_GUID = <GptPartitionType.PARTITION_SYSTEM_GUID: 'C12A7328-F81F-11D2-BA4B-00A0C93EC93B'>
PARTITION_U_BOOT_ENVIRONMENT = <GptPartitionType.PARTITION_U_BOOT_ENVIRONMENT: '3DE21764-95BD-54BD-A5C3-4ABE786F38A8'>
WINDOWS_RECOVERY_TOOLS = <GptPartitionType.WINDOWS_RECOVERY_TOOLS: 'DE94BBA4-06D1-4D40-A16A-BFD50179D6AC'>

Data descriptors inherited from enum.Enum:
name
The name of the Enum member.
value
The value of the Enum member.

Readonly properties inherited from enum.EnumMeta:
__members__
Returns a mapping of member name->value.
 
This mapping lists all enum members, including aliases. Note that this
is a read-only view of the internal mapping.

 
class MBRHeader(_ctypes.Structure)
    This class defines the MBR structure.
 
 
Method resolution order:
MBRHeader
_ctypes.Structure
_ctypes._CData
builtins.object

Methods defined here:
to_partition(self)
This function makes partition from MBR.

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)
bootloader
partitions
signature

Methods inherited from _ctypes.Structure:
__init__(self, /, *args, **kwargs)
Initialize self.  See help(type(self)) for accurate signature.

Static methods inherited from _ctypes.Structure:
__new__(*args, **kwargs) from _ctypes.PyCStructType
Create and return a new object.  See help(type) for accurate signature.

Methods inherited from _ctypes._CData:
__ctypes_from_outparam__(...)
__hash__(self, /)
Return hash(self).
__reduce__(...)
Helper for pickle.
__setstate__(...)

 
class MBRPartitionEntry(_ctypes.Structure)
    This class defines the MBR partition structure.
 
 
Method resolution order:
MBRPartitionEntry
_ctypes.Structure
_ctypes._CData
builtins.object

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)
chs_first
chs_last
lba_start
status
total_sectors
type

Methods inherited from _ctypes.Structure:
__init__(self, /, *args, **kwargs)
Initialize self.  See help(type(self)) for accurate signature.

Static methods inherited from _ctypes.Structure:
__new__(*args, **kwargs) from _ctypes.PyCStructType
Create and return a new object.  See help(type) for accurate signature.

Methods inherited from _ctypes._CData:
__ctypes_from_outparam__(...)
__hash__(self, /)
Return hash(self).
__reduce__(...)
Helper for pickle.
__setstate__(...)

 
class MbrPartitionType(enum.Enum)
    MbrPartitionType(value, names=None, *, module=None, qualname=None, type=None, start=1)
 
Enum for disk partitions type.
 
 
Method resolution order:
MbrPartitionType
enum.Enum
builtins.object

Data and other attributes defined here:
EMPTY = <MbrPartitionType.EMPTY: 0>
EXT2 = <MbrPartitionType.EXT2: 131>
FAT12 = <MbrPartitionType.FAT12: 1>
FAT16 = <MbrPartitionType.FAT16: 4>
FAT32 = <MbrPartitionType.FAT32: 11>
FAT32_LBA = <MbrPartitionType.FAT32_LBA: 12>
GPT_PROTECTIVE = <MbrPartitionType.GPT_PROTECTIVE: 238>
LINUX_LVM = <MbrPartitionType.LINUX_LVM: 142>
LINUX_SWAP = <MbrPartitionType.LINUX_SWAP: 130>
NTFS = <MbrPartitionType.NTFS: 7>
WINDOWS_RE = <MbrPartitionType.WINDOWS_RE: 39>

Data descriptors inherited from enum.Enum:
name
The name of the Enum member.
value
The value of the Enum member.

Readonly properties inherited from enum.EnumMeta:
__members__
Returns a mapping of member name->value.
 
This mapping lists all enum members, including aliases. Note that this
is a read-only view of the internal mapping.

 
class Partition(builtins.object)
    Partition(start_sector: int, end_sector: int, size: int) -&gt; None
 
Partition(start_sector: int, end_sector: int, size: int)
 
  Methods defined here:
__eq__(self, other)
Return self==value.
__init__(self, start_sector: int, end_sector: int, size: int) -> None
Initialize self.  See help(type(self)) for accurate signature.
__repr__(self)
Return repr(self).

Data descriptors defined here:
__dict__
dictionary for instance variables (if defined)
__weakref__
list of weak references to the object (if defined)

Data and other attributes defined here:
__annotations__ = {'end_sector': <class 'int'>, 'size': <class 'int'>, 'start_sector': <class 'int'>}
__dataclass_fields__ = {'end_sector': Field(name='end_sector',type=<class 'int'>,defau...appingproxy({}),kw_only=False,_field_type=_FIELD), 'size': Field(name='size',type=<class 'int'>,default=<da...appingproxy({}),kw_only=False,_field_type=_FIELD), 'start_sector': Field(name='start_sector',type=<class 'int'>,def...appingproxy({}),kw_only=False,_field_type=_FIELD)}
__dataclass_params__ = _DataclassParams(init=True,repr=True,eq=True,order=False,unsafe_hash=False,frozen=False)
__hash__ = None
__match_args__ = ('start_sector', 'end_sector', 'size')

 
class PartitionStatus(enum.Enum)
    PartitionStatus(value, names=None, *, module=None, qualname=None, type=None, start=1)
 
Enum for disk partitions status (bootable or not bootable).
 
 
Method resolution order:
PartitionStatus
enum.Enum
builtins.object

Data and other attributes defined here:
ACTIVE = <PartitionStatus.ACTIVE: 128>
INACTIVE = <PartitionStatus.INACTIVE: 0>

Data descriptors inherited from enum.Enum:
name
The name of the Enum member.
value
The value of the Enum member.

Readonly properties inherited from enum.EnumMeta:
__members__
Returns a mapping of member name->value.
 
This mapping lists all enum members, including aliases. Note that this
is a read-only view of the internal mapping.

 
Functions
       
disk_parsing(keep_open: bool = False) -> Union[Tuple[Union[PermissionError, Exception, DiskAnalyzer.MBRHeader, DiskAnalyzer.GPTHeader], _io.BufferedReader], PermissionError, Exception, DiskAnalyzer.MBRHeader, DiskAnalyzer.GPTHeader]
This function returns the parsed structure or error and opened file if keep_open is True.
exit(status=None, /)
Exit the interpreter by raising SystemExit(status).
 
If the status is omitted or None, it defaults to zero (i.e., success).
If the status is an integer, it will be used as the system exit status.
If it is another kind of object, it will be printed and the system
exit status will be one (i.e., failure).
format_guid(guid_bytes: _ctypes.PyCArrayType) -> str
This function returns a GUID string from data.
get_main_partition(*args, **kwargs) -> Tuple[DiskAnalyzer.Partition, Optional[_io.BufferedReader]]
This function returns the main partition.
gpt_partitions_size(partition: DiskAnalyzer.GPTPartitionEntry) -> float
This function returns the size in MB for a GPT partition
is_gpt_signature(mbr: DiskAnalyzer.MBRHeader, sector_data: bytes) -> bool
This function checks the GPT magic bytes
to detect the start sector structure.
main() -> int
The main function to starts the script from the command line.
parse_gpt(file: _io.BufferedReader, gpt_data: bytes) -> DiskAnalyzer.GPTHeader
This function parses the GPT data.
parse_mbr(mbr_data: bytes) -> DiskAnalyzer.MBRHeader
This function parses the MBR data.
print_gpt_analysis(gpt_header: DiskAnalyzer.GPTHeader) -> None
This function prints informations about GPT headers and partitions.
print_mbr_analysis(mbr: DiskAnalyzer.MBRHeader) -> None
This function prints informations about MBR.

 
Data
        DRIVE_PATH = r'\\.\PhysicalDrive0'
List = typing.List
SECTOR_SIZE = 512
Tuple = typing.Tuple
Union = typing.Union
__author_email__ = 'mauricelambert434@gmail.com'
__copyright__ = '\nDiskAnalyzer Copyright (C) 2025 Maurice Lambe...ome to redistribute it\nunder certain conditions.\n'
__description__ = '\nThis package implements multiples libraries and t...tract informations from disk on the live system.\n'
__license__ = 'GPL-3.0 License'
__maintainer__ = 'Maurice Lambert'
__maintainer_email__ = 'mauricelambert434@gmail.com'
__url__ = 'https://github.com/mauricelambert/DiskAnalyzer'
copyright = '\nDiskAnalyzer Copyright (C) 2025 Maurice Lambe...ome to redistribute it\nunder certain conditions.\n'
gpt_attributes = {1: 'Platform required', 2: 'EFI firmware ignore partition', 4: 'Legacy BIOS bootable', 8: 'Reserved for future use', 281474976710656: 'Priority low', 562949953421312: 'Priority medium', 1125899906842624: 'Priority high', 2251799813685248: 'Priority highest', 4503599627370496: 'Tries remaining', 9007199254740992: 'Tries remaining', ...}
gpt_type_dict = {'00000000-0000-0000-0000-000000000000': 'EMPTY', '024DEE41-33E7-11D3-9D69-0008C781F39F': 'LEGACY_MBR_PARTITION_GUID', '0657FD6D-A4AB-43C4-84E5-0933C84B4F4F': 'PARTITION_LINUX_SWAP_GUID', '0FC63DAF-8483-4772-8E79-3D69D8477DE4': 'PARTITION_LINUX_FILE_SYSTEM_DATA_GUID', '3DE21764-95BD-54BD-A5C3-4ABE786F38A8': 'PARTITION_U_BOOT_ENVIRONMENT', 'A19D880F-05FC-4D3B-A006-743F0F84911E': 'PARTITION_LINUX_RAID_GUID', 'C12A7328-F81F-11D2-BA4B-00A0C93EC93B': 'PARTITION_SYSTEM_GUID', 'DE94BBA4-06D1-4D40-A16A-BFD50179D6AC': 'WINDOWS_RECOVERY_TOOLS', 'E3C9E316-0B5C-4DB8-817D-F92DF00215AE': 'PARTITION_MSFT_RESERVED_GUID', 'E6D6D379-F507-44C2-A23C-238F2A3DF928': 'PARTITION_LINUX_LVM_GUID', ...}
license = 'GPL-3.0 License'
mbr_type_dict = {0: 'EMPTY', 1: 'FAT12', 4: 'FAT16', 7: 'NTFS', 11: 'FAT32', 12: 'FAT32_LBA', 39: 'WINDOWS_RE', 130: 'LINUX_SWAP', 131: 'EXT2', 142: 'LINUX_LVM', ...}
status_dict = {0: 'INACTIVE', 128: 'ACTIVE'}

 
Author
        Maurice Lambert