ds_store

README

Go .DS_Store parser

This is a quick and dirty Go parser for .DS_Store files. I focused on the extraction of file names and ignored other parameters.

It does not support the full set of structure formats, so it might break in some scenarios.

#Useful information: The following descriptions and sourcecodes were quite helpful:

• http://search.cpan.org/~wiml/Mac-Finder-DSStore/DSStoreFormat.pod
• https://wiki.mozilla.org/DS_Store_File_Format

#Example code

package main

import (
	"fmt"
	"os"
	"flag"
	"github.com/gehaxelt/ds_store"
	"io/ioutil"
)

func main() {

	var fileName string

	flag.StringVar(&fileName, "i", "", "DS_Store input file")
	flag.Parse()

	if fileName == "" {
		panic("FileName (-i): Must be specified")
	} else if _, err := os.Stat(fileName); os.IsNotExist(err) {
		panic("FileName (-i): File does not exist:" + fileName)
	}

	dat, err := ioutil.ReadFile(fileName)

	if err != nil {
		panic(err)
	}

	a, err := ds_store.NewAllocator(dat)

	filenames, err := a.TraverseFromRootNode()
	if err != nil {
		panic(err)
	}

	for _,f := range filenames {
		fmt.Printf("File: %s \n", f)
	}
}

./ds_storeviewer -i samples/DS_Store-2
File: joomlatools-files 
File: joomlatools-files 
File: joomlatools-files 
File: joomlatools-files 

License

See License.md

Documentation

Index

• type Allocator
  • func NewAllocator(data []byte) (a *Allocator, err error)
  • func (a *Allocator) GetBlock(bid uint32) (block *Block, err error)
  • func (a *Allocator) Traverse(bid uint32) (filenames []string, err error)
  • func (a *Allocator) TraverseFromRootNode() (filenames []string, err error)
• type Block
  • func NewBlock(a *Allocator, pos uint32, size uint32) (block *Block, err error)

Types

type Allocator

type Allocator struct {
	Data     []byte
	Pos      uint32
	Root     *Block
	Offsets  []uint32
	Toc      map[string]uint32
	FreeList map[uint32][]uint32
}

func NewAllocator

func NewAllocator(data []byte) (a *Allocator, err error)

func (*Allocator) GetBlock

func (a *Allocator) GetBlock(bid uint32) (block *Block, err error)

func (*Allocator) Traverse

func (a *Allocator) Traverse(bid uint32) (filenames []string, err error)

func (*Allocator) TraverseFromRootNode

func (a *Allocator) TraverseFromRootNode() (filenames []string, err error)

type Block

type Block struct {
	Allocator *Allocator
	Offset    uint32
	Size      uint32
	Data      []byte
	Pos       uint32
}

func NewBlock

func NewBlock(a *Allocator, pos uint32, size uint32) (block *Block, err error)