Merge pull request #1393 from gcmoreira/linux_pagecache_dumping_convention_1392

Linux: Update inode pagecache plugin to conform to framework dumping convention

volatility3/framework/plugins/linux/pagecache.py

@@ -389,7 +389,7 @@ class InodePages(plugins.PluginInterface):
 
     _required_framework_version = (2, 0, 0)
 
-    _version = (1, 0, 1)
+    _version = (2, 0, 0)
 
     @classmethod
     def get_requirements(cls) -> List[interfaces.configuration.RequirementInterface]:
@@ -412,9 +412,10 @@ class InodePages(plugins.PluginInterface):
                 description="Inode address",
                 optional=True,
             ),
-            requirements.StringRequirement(
+            requirements.BooleanRequirement(
                 name="dump",
-                description="Output file path",
+                description="Extract inode content",
+                default=False,
                 optional=True,
             ),
         ]
@@ -436,7 +437,7 @@ class InodePages(plugins.PluginInterface):
         """
         if not inode.is_reg:
             vollog.error("The inode is not a regular file")
-            return
+            return None
 
         # By using truncate/seek, provided the filesystem supports it, a sparse file will be
         # created, saving both disk space and I/O time.
@@ -471,7 +472,7 @@ class InodePages(plugins.PluginInterface):
 
         if self.config["inode"] and self.config["find"]:
             vollog.error("Cannot use --inode and --find simultaneously")
-            return
+            return None
 
         if self.config["find"]:
             inodes_iter = Files.get_inodes(
@@ -487,15 +488,15 @@ class InodePages(plugins.PluginInterface):
             inode = vmlinux.object("inode", self.config["inode"], absolute=True)
         else:
             vollog.error("You must use either --inode or --find")
-            return
+            return None
 
         if not inode.is_valid():
             vollog.error("Invalid inode at 0x%x", inode.vol.offset)
-            return
+            return None
 
         if not inode.is_reg:
             vollog.error("The inode is not a regular file")
-            return
+            return None
 
         inode_size = inode.i_size
         for page_obj in inode.get_pages():
@@ -519,9 +520,13 @@ class InodePages(plugins.PluginInterface):
             yield 0, fields
 
         if self.config["dump"]:
-            filename = self.config["dump"]
-            vollog.info("[*] Writing inode at 0x%x to '%s'", inode.vol.offset, filename)
-            self.write_inode_content_to_file(inode, filename, self.open, vmlinux_layer)
+            open_method = self.open
+            inode_address = inode.vol.offset
+            filename = open_method.sanitize_filename(f"inode_0x{inode_address:x}.dmp")
+            vollog.info("[*] Writing inode at 0x%x to '%s'", inode_address, filename)
+            self.write_inode_content_to_file(
+                inode, filename, open_method, vmlinux_layer
+            )
 
     def run(self):
         headers = [