Dissect Volume

3.18 verified Fri May 01 auth: no python

A Dissect module implementing a parser for different disk volume and partition systems, e.g. LVM2, GPT, and MBR. Part of the Dissect forensic framework. Current version: 3.18, requires Python >=3.10. Release cadence follows Dissect project updates.

pip install dissect-volume

Common errors

error ModuleNotFoundError: No module named 'dissect.volume' ↓

cause The package dissect-volume is not installed or is installed in a different environment.

fix

Run pip install dissect-volume and ensure you are in the correct Python environment.

error ImportError: cannot import name 'VolumeSystem' from 'dissect.volume' ↓

cause Import path changed in dissect-volume 3.x. Old import `from dissect.volume.volume import VolumeSystem` no longer works.

fix

Use from dissect.volume import VolumeSystem instead.

error AttributeError: 'NoneType' object has no attribute 'read' ↓

cause VolumeSystem received a file path (string) instead of a file-like object. The library expects a file-like object.

fix

Use with open('image.raw', 'rb') as fh: vs = VolumeSystem(fh).

error ValueError: Unable to determine volume system ↓

cause The provided file does not contain a recognizable volume system signature (e.g., GPT, MBR, LVM).

fix

Verify the disk image is valid and contains a supported partition scheme. You can try specifying the volume type manually: VolumeSystem(fh, type='gpt').

Warnings

breaking dissect.volume 3.x drops support for Python < 3.10. Also, the internal module paths changed: e.g., `dissect.volume.volume.VolumeSystem` is now `dissect.volume.VolumeSystem`. Old imports will break. ↓

fix Update imports to the new top-level paths: `from dissect.volume import VolumeSystem`.

deprecated The `LVM2` class constructor signature changed in 3.0; the `lvm2` parameter is replaced by `fh` (file-like object). ↓

fix Use `LVM2(fh=open('file', 'rb'))` instead of old `LVM2('file')`.

gotcha VolumeSystem expects a seekable file-like object. Passing a non-seekable stream (e.g., from a network socket) will fail. Always use a file, BytesIO, or other seekable object. ↓

fix If you have a bytes object, wrap it in `io.BytesIO(data)` before passing to VolumeSystem.

gotcha On Windows, file paths need to be opened in binary mode: `open('path', 'rb')` else parsing errors may occur. ↓

fix Always use `'rb'` mode when opening disk images.

Imports

VolumeSystem

wrong

from dissect.volume.volume import VolumeSystem

correct

from dissect.volume import VolumeSystem

Direct import from dissect.volume is the correct public API path.

LVM2

wrong

from dissect.volume.lvm2 import LVM2

correct

from dissect.volume.lvm import LVM2

Module name is 'lvm', not 'lvm2'.

GPT
```
from dissect.volume.gpt import GPT
```
MBR
```
from dissect.volume.mbr import MBR
```
disk
```
from dissect.volume.disk import Disk
```

Quickstart

Basic usage: open a disk image and enumerate volumes.

from dissect.volume import VolumeSystem

# Open a disk image file (e.g., raw, qcow2) and parse volume system
with open('disk.raw', 'rb') as fh:
    vs = VolumeSystem(fh)
    for volume in vs.volumes:
        print(f'Volume: {volume.name}, type: {volume.type}, size: {volume.size}')