How to use the pytsk3.Volume_Info function in pytsk3

return []

            try:
                volumes = pytsk3.Volume_Info(baseimage, getattr(pytsk3, 'TSK_VS_TYPE_' + vstype.upper()),
                                             volume_system.parent.offset // volume_system.disk.block_size)
                volume_system.volume_source = 'multi'
                return volumes
            except Exception as e:
                # some bug in sleuthkit makes detection sometimes difficult, so we hack around it:
                if "(GPT or DOS at 0)" in str(e) and vstype != 'gpt':
                    volume_system.vstype = 'gpt'
                    # noinspection PyBroadException
                    try:
                        logger.warning("Error in retrieving volume info: TSK couldn't decide between GPT and DOS, "
                                       "choosing GPT for you. Use --vstype=dos to force DOS.", exc_info=True)
                        volumes = pytsk3.Volume_Info(baseimage, getattr(pytsk3, 'TSK_VS_TYPE_GPT'))
                        volume_system.volume_source = 'multi'
                        return volumes
                    except Exception as e:
                        logger.exception("Failed retrieving image info (possible empty image).")
                        raise SubsystemError(e)
                else:
                    logger.exception("Failed retrieving image info (possible empty image).")
                    raise SubsystemError(e)
        finally:
            if baseimage:
                baseimage.close()
                del baseimage

#!/usr/bin/python
# Sample program or step 4 in becoming a DFIR Wizard!
# No license as this code is simple and free!
import sys
import pytsk3
import datetime
import admin
if not admin.isUserAdmin():
        admin.runAsAdmin()
        sys.exit()
imagefile = "\\\\.\\PhysicalDrive0"
imagehandle = pytsk3.Img_Info(imagefile)
partitionTable = pytsk3.Volume_Info(imagehandle)
for partition in partitionTable:
  print partition.addr, partition.desc, "%ss(%s)" % (partition.start, partition.start * 512), partition.len
  if 'NTFS' in partition.desc:
    filesystemObject = pytsk3.FS_Info(imagehandle, offset=(partition.start*512))
    fileobject = filesystemObject.open("/$MFT")
    print "File Inode:",fileobject.info.meta.addr
    print "File Name:",fileobject.info.name.name
    print "File Creation Time:",datetime.datetime.fromtimestamp(fileobject.info.meta.crtime).strftime('%Y-%m-%d %H:%M:%S')
    outFileName = str(partition.addr)+fileobject.info.name.name
    print outFileName
    outfile = open(outFileName, 'w')
    filedata = fileobject.read_random(0,fileobject.info.meta.size)
    outfile.write(filedata)
    outfile.close

def tsktest(retstr=None):
    # Step 1: get an IMG_INFO object
    img = pytsk3.Img_Info("/home/bcadmin/Desktop/jo-work-usb-2009-12-11.E01")

    ## Step 2: get a Volume_Info object
    volume = pytsk3.Volume_Info(img)

    ## Step 3: Iterate over all the partitions.
    retstr = 'PARTITIONS ON THIS DISK:' + '\'
    for part in volume:
        #print part.addr, part.desc, part.start, part.len
        retstr += str(part.addr) + ' ' + str(part.desc) + ' ' + str(part.start) + ' ' + str(part.len) + '<br>'

    retstr += '<br>' + 'Contents of the root directory:' + '<br>'

    ## Now, a hack to recognize the start location. Do NOT use this
    ## code in production. It's just a demo.
    fs = pytsk3.FS_Info(img, offset = 63 * 512)

    for directory_entry in fs.open_dir(path="/"):
        directory_entry = directory_entry.info.name.name
        try:

def __init__(self, url):
        # parse out the different volumes
        
        self.url = url
        self.img = pytsk3.Img_Info(url=self.url)
        self.VOL_INFO = pytsk3.Volume_Info(self.img)

        self.vol_to_se = {}
        self.VOLUMES = []
        self.VOLUME_BOUNDARIES = []

        # print out some info about the disk image
        logger.debug("--- Volume info ---")
        logger.debug("Current: %d" % self.VOL_INFO.current)
        logger.debug("VS Type: %d" % self.VOL_INFO.info.vstype)
        logger.debug("Offset: %d" % self.VOL_INFO.info.offset)
        logger.debug("Block Size: %d" % self.VOL_INFO.info.block_size)
        logger.debug("Endian: %d" % self.VOL_INFO.info.endian)
        logger.debug("Partition List: %s" % self.VOL_INFO.info.part_list)
        logger.debug("Parition Count: %d" % self.VOL_INFO.info.part_count)
        logger.debug("--- Volume info ---")

type=str,
        default='inventory.csv',
        required=False,
        help='File to write the hashes to'
    )
args = argparser.parse_args()
filenames = pyewf.glob(args.imagefile)
dirPath = args.path
outfile = open(args.output,'w')
outfile.write('"Inode","Full Path","Creation Time","Size","MD5 Hash","SHA1 Hash"\n')
wr = csv.writer(outfile, quoting=csv.QUOTE_ALL)
ewf_handle = pyewf.handle()
ewf_handle.open(filenames)
imagehandle = ewf_Img_Info(ewf_handle)

partitionTable = pytsk3.Volume_Info(imagehandle)
for partition in partitionTable:
  print partition.addr, partition.desc, "%ss(%s)" % (partition.start, partition.start * 512), partition.len
  if 'NTFS' in partition.desc:
    filesystemObject = pytsk3.FS_Info(imagehandle, offset=(partition.start*512))
    directoryObject = filesystemObject.open_dir(path=dirPath)
    print "Directory:",dirPath
    directoryRecurse(directoryObject,[])

def process(image_path, output, format):
    """Processing entry point"""
    imagehandle = pytsk3.Img_Info(url=image_path)
    partitionTable = pytsk3.Volume_Info(imagehandle)
    for partition in partitionTable:
      print partition.addr, partition.desc, "%ss(%s)" % (partition.start, partition.start * 512), partition.len
      try:
            filesystemObject = pytsk3.FS_Info(imagehandle, offset=(partition.start*512))
      except:
              print "Partition has no supported file system"
              continue
      print "File System Type Detected .",filesystemObject.info.ftype,"."
      if (str(filesystemObject.info.ftype) == "TSK_FS_TYPE_NTFS_DETECT"):
        print "NTFS DETECTED"
        # Process the hives in a specific order so that the
        # data can be correctly matched between the hives
        try:
            filesystemObject.open("/Windows")
        except:
            print "No Windows directory, skipping"

def GetImageSize(file_path, offset):
  """Read the partition information to gather volume size."""
  if not offset:
    return 0, 0

  img = pytsk3.Img_Info(file_path)
  try:
    volume = pytsk3.Volume_Info(img)
  except IOError:
    return 0, 0

  size = 0
  for vol in volume:
    if vol.start == offset:
      size = vol.len
      break

  size *= volume.info.block_size
  return volume.info.block_size, size

device=fs_struct.f_mntfromname,
        mount_point=fs_struct.f_mntonname,
        type=fs_struct.f_fstypename)

  drive_re = re.compile("r?disk[0-9].*")
  for drive in os.listdir("/dev"):
    if not drive_re.match(drive):
      continue

    path = os.path.join("/dev", drive)
    try:
      img_inf = pytsk3.Img_Info(path)
      # This is a volume or a partition - we send back a TSK device.
      yield rdf_client_fs.Filesystem(device=path)

      vol_inf = pytsk3.Volume_Info(img_inf)

      for volume in vol_inf:
        if volume.flags == pytsk3.TSK_VS_PART_FLAG_ALLOC:
          offset = volume.start * vol_inf.info.block_size
          yield rdf_client_fs.Filesystem(
              device="{path}:{offset}".format(path=path, offset=offset),
              type="partition")

    except (IOError, RuntimeError):
      continue

def populate_parts(image, image_file):
        """Populate partition information for an image from the image file."""
        logging.debug("Getting image info for: " + image_file.path)
        image_info = pytsk3.Img_Info(image_file.path)
        try:
            volume_info = pytsk3.Volume_Info(image_info)
        except:
            logging.info("Failed to get Volume Info for: " + image_file.path)
            # pytsk3.Volume_Info works only with file systems which have partition
            # defined. For file systems like FAT12, with no partition info, we need
            # to handle in an exception.
            try:
                fs_info = pytsk3.FS_Info(image_info, offset=0)
            except:
                # Botch by populating with file system details
                image_file.__partitions__.append(
                    Partition(image, -1, -1, -1, -1, "Error Parsing"))
                return

            if fs_info.info.ftype == pytsk3.TSK_FS_TYPE_FAT12:
                fs_desc = "FAT12 file system"
            elif fs_info.info.ftype == pytsk3.TSK_FS_TYPE_ISO9660_DETECT: