From f6aa6d87e84fc593ad22fe0653bf60750ae8a1f5 Mon Sep 17 00:00:00 2001 From: Andrew Case Date: Fri, 7 Mar 2025 04:19:28 +0000 Subject: [PATCH] Add --tmpfs-only flag to RecoverFs to replace tmpfs plugin of Volatility 2 --- .../framework/plugins/linux/pagecache.py | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/linux/pagecache.py b/volatility3/framework/plugins/linux/pagecache.py index 7a1cf2506..3d2db7fd7 100644 --- a/volatility3/framework/plugins/linux/pagecache.py +++ b/volatility3/framework/plugins/linux/pagecache.py @@ -639,7 +639,7 @@ class RecoverFs(plugins.PluginInterface): Troubleshooting: to fix extraction errors related to long paths, please consider using https://github.com/mxmlnkn/ratarmount. """ - _version = (1, 0, 0) + _version = (1, 0, 1) _required_framework_version = (2, 21, 0) @classmethod @@ -656,6 +656,12 @@ class RecoverFs(plugins.PluginInterface): requirements.PluginRequirement( name="inodepages", plugin=InodePages, version=(3, 0, 0) ), + requirements.BooleanRequirement( + name="tmpfs_only", + description="Extracts only files from tmpfs file systems", + default=False, + optional=True, + ), requirements.ChoiceRequirement( name="compression_format", description="Compression format (default: gz)", @@ -805,6 +811,17 @@ class RecoverFs(plugins.PluginInterface): ) continue + sb_type = inode_in.superblock.get_type() + if not sb_type: + vollog.debug( + f"Unable to read superblock type for inode at {inode_in.inode.vol.offset}" + ) + continue + + if self.config["tmpfs_only"] and sb_type != "tmpfs": + vollog.debug(f"Skipping non-tmpfs filesystem {sb_type}") + continue + # Construct the output path if uuid_as_prefix: prefix = f"/{inode_in.superblock.uuid}"