Add --tmpfs-only flag to RecoverFs to replace tmpfs plugin of Volatility 2

volatility3/framework/plugins/linux/pagecache.py

@@ -639,7 +639,7 @@ class RecoverFs(plugins.PluginInterface):
     Troubleshooting: to fix extraction errors related to long paths, please consider using https://github.com/mxmlnkn/ratarmount.
     """
 
-    _version = (1, 0, 0)
+    _version = (1, 0, 1)
     _required_framework_version = (2, 21, 0)
 
     @classmethod
@@ -656,6 +656,12 @@ class RecoverFs(plugins.PluginInterface):
             requirements.PluginRequirement(
                 name="inodepages", plugin=InodePages, version=(3, 0, 0)
             ),
+            requirements.BooleanRequirement(
+                name="tmpfs_only",
+                description="Extracts only files from tmpfs file systems",
+                default=False,
+                optional=True,
+            ),
             requirements.ChoiceRequirement(
                 name="compression_format",
                 description="Compression format (default: gz)",
@@ -805,6 +811,17 @@ class RecoverFs(plugins.PluginInterface):
                 )
                 continue
 
+            sb_type = inode_in.superblock.get_type()
+            if not sb_type:
+                vollog.debug(
+                    f"Unable to read superblock type for inode at {inode_in.inode.vol.offset}"
+                )
+                continue
+
+            if self.config["tmpfs_only"] and sb_type != "tmpfs":
+                vollog.debug(f"Skipping non-tmpfs filesystem {sb_type}")
+                continue
+
             # Construct the output path
             if uuid_as_prefix:
                 prefix = f"/{inode_in.superblock.uuid}"