Hide navigation sidebar

Hide table of contents sidebar

Skip to content

Toggle site navigation sidebar

Dissect 3.16-1-g6ddf946 documentation

Toggle table of contents sidebar

Home
Overview
Projects
Toggle navigation of Projects
Usage
Toggle navigation of Usage
- Introduction
- First steps
  Toggle navigation of First steps
  - Next steps as an Incident Handler
  - Next steps as a Security Analyst
- Use-cases
- Disk encryption (FVE)
Tools
Toggle navigation of Tools
- acquire
- target-query
- target-shell
- target-fs
- target-reg
- target-dump
- target-dd
- target-mount
- target-info
- rdump
Plugin Reference
Toggle navigation of Plugin Reference
Advanced
Toggle navigation of Advanced
- Python API
- Targets
- Loaders
- Containers
- Volumes
- Filesystems
- Plugins
- Record Descriptors
API Reference
Toggle navigation of API Reference
- dissect.archive
  Toggle navigation of dissect.archive
- dissect.btrfs
  Toggle navigation of dissect.btrfs
- dissect.cim
  Toggle navigation of dissect.cim
- dissect.clfs
  Toggle navigation of dissect.clfs
- dissect.cstruct
  Toggle navigation of dissect.cstruct
- dissect.esedb
  Toggle navigation of dissect.esedb
  - dissect.esedb.tools
    Toggle navigation of dissect.esedb.tools
  - dissect.esedb.c_esedb
  - dissect.esedb.compression
  - dissect.esedb.cursor
  - dissect.esedb.esedb
  - dissect.esedb.exceptions
  - dissect.esedb.index
  - dissect.esedb.lcmapstring
  - dissect.esedb.page
  - dissect.esedb.record
  - dissect.esedb.sorting_table
  - dissect.esedb.table
- dissect.etl
  Toggle navigation of dissect.etl
  - dissect.etl.headers
    Toggle navigation of dissect.etl.headers
  - dissect.etl.manifests
  - dissect.etl.etl
  - dissect.etl.exceptions
  - dissect.etl.manifest
  - dissect.etl.utils
- dissect.eventlog
  Toggle navigation of dissect.eventlog
- dissect.evidence
  Toggle navigation of dissect.evidence
  - dissect.evidence.asdf
    Toggle navigation of dissect.evidence.asdf
    - dissect.evidence.asdf.asdf
    - dissect.evidence.asdf.streams
  - dissect.evidence.tools
    Toggle navigation of dissect.evidence.tools
    - dissect.evidence.tools.asdf
      Toggle navigation of dissect.evidence.tools.asdf
  - dissect.evidence.ad1
  - dissect.evidence.ewf
  - dissect.evidence.exceptions
- dissect.executable
  Toggle navigation of dissect.executable
  - dissect.executable.elf
    Toggle navigation of dissect.executable.elf
    - dissect.executable.elf.c_elf
    - dissect.executable.elf.elf
  - dissect.executable.macho
  - dissect.executable.pe
  - dissect.executable.exception
- dissect.extfs
  Toggle navigation of dissect.extfs
- dissect.fat
  Toggle navigation of dissect.fat
- dissect.ffs
  Toggle navigation of dissect.ffs
- dissect.hypervisor
  Toggle navigation of dissect.hypervisor
  - dissect.hypervisor.backup
    Toggle navigation of dissect.hypervisor.backup
  - dissect.hypervisor.descriptor
    Toggle navigation of dissect.hypervisor.descriptor
  - dissect.hypervisor.disk
    Toggle navigation of dissect.hypervisor.disk
  - dissect.hypervisor.tools
    Toggle navigation of dissect.hypervisor.tools
    - dissect.hypervisor.tools.envelope
    - dissect.hypervisor.tools.vma
  - dissect.hypervisor.util
    Toggle navigation of dissect.hypervisor.util
    - dissect.hypervisor.util.envelope
    - dissect.hypervisor.util.vmtar
  - dissect.hypervisor.exceptions
- dissect.jffs
  Toggle navigation of dissect.jffs
- dissect.ntfs
  Toggle navigation of dissect.ntfs
- dissect.ole
  Toggle navigation of dissect.ole
- dissect.regf
  Toggle navigation of dissect.regf
- dissect.shellitem
  Toggle navigation of dissect.shellitem
  - dissect.shellitem.lnk
    Toggle navigation of dissect.shellitem.lnk
    - dissect.shellitem.lnk.c_lnk
    - dissect.shellitem.lnk.lnk
  - dissect.shellitem.tools
    Toggle navigation of dissect.shellitem.tools
    - dissect.shellitem.tools.lnk
- dissect.sql
  Toggle navigation of dissect.sql
- dissect.squashfs
  Toggle navigation of dissect.squashfs
- dissect.target
  Toggle navigation of dissect.target
  - dissect.target.containers
    Toggle navigation of dissect.target.containers
  - dissect.target.filesystems
    Toggle navigation of dissect.target.filesystems
  - dissect.target.helpers
    Toggle navigation of dissect.target.helpers
  - dissect.target.loaders
    Toggle navigation of dissect.target.loaders
  - dissect.target.plugins
    Toggle navigation of dissect.target.plugins
    - dissect.target.plugins.apps
      Toggle navigation of dissect.target.plugins.apps
      - dissect.target.plugins.apps.av
        Toggle navigation of dissect.target.plugins.apps.av
        
        dissect.target.plugins.apps.av.mcafee
        
        dissect.target.plugins.apps.av.sophos
        
        dissect.target.plugins.apps.av.symantec
        
        dissect.target.plugins.apps.av.trendmicro
      - dissect.target.plugins.apps.browser
        Toggle navigation of dissect.target.plugins.apps.browser
        
        dissect.target.plugins.apps.browser.brave
        
        dissect.target.plugins.apps.browser.browser
        
        dissect.target.plugins.apps.browser.chrome
        
        dissect.target.plugins.apps.browser.chromium
        
        dissect.target.plugins.apps.browser.edge
        
        dissect.target.plugins.apps.browser.firefox
        
        dissect.target.plugins.apps.browser.iexplore
      - dissect.target.plugins.apps.container
        Toggle navigation of dissect.target.plugins.apps.container
        
        dissect.target.plugins.apps.container.docker
      - dissect.target.plugins.apps.remoteaccess
        Toggle navigation of dissect.target.plugins.apps.remoteaccess
        
        dissect.target.plugins.apps.remoteaccess.anydesk
        
        dissect.target.plugins.apps.remoteaccess.remoteaccess
        
        dissect.target.plugins.apps.remoteaccess.teamviewer
      - dissect.target.plugins.apps.shell
        Toggle navigation of dissect.target.plugins.apps.shell
        
        dissect.target.plugins.apps.shell.powershell
      - dissect.target.plugins.apps.ssh
        Toggle navigation of dissect.target.plugins.apps.ssh
        
        dissect.target.plugins.apps.ssh.openssh
        
        dissect.target.plugins.apps.ssh.opensshd
        
        dissect.target.plugins.apps.ssh.putty
        
        dissect.target.plugins.apps.ssh.ssh
      - dissect.target.plugins.apps.texteditor
        Toggle navigation of dissect.target.plugins.apps.texteditor
        
        dissect.target.plugins.apps.texteditor.texteditor
        
        dissect.target.plugins.apps.texteditor.windowsnotepad
      - dissect.target.plugins.apps.vpn
        Toggle navigation of dissect.target.plugins.apps.vpn
        
        dissect.target.plugins.apps.vpn.openvpn
        
        dissect.target.plugins.apps.vpn.wireguard
      - dissect.target.plugins.apps.webhosting
        Toggle navigation of dissect.target.plugins.apps.webhosting
        
        dissect.target.plugins.apps.webhosting.cpanel
      - dissect.target.plugins.apps.webserver
        Toggle navigation of dissect.target.plugins.apps.webserver
        
        dissect.target.plugins.apps.webserver.apache
        
        dissect.target.plugins.apps.webserver.caddy
        
        dissect.target.plugins.apps.webserver.citrix
        
        dissect.target.plugins.apps.webserver.iis
        
        dissect.target.plugins.apps.webserver.nginx
        
        dissect.target.plugins.apps.webserver.webserver
    - dissect.target.plugins.child
      Toggle navigation of dissect.target.plugins.child
    - dissect.target.plugins.filesystem
      Toggle navigation of dissect.target.plugins.filesystem
      - dissect.target.plugins.filesystem.ntfs
        Toggle navigation of dissect.target.plugins.filesystem.ntfs
        
        dissect.target.plugins.filesystem.ntfs.mft
        
        dissect.target.plugins.filesystem.ntfs.mft_timeline
        
        dissect.target.plugins.filesystem.ntfs.usnjrnl
        
        dissect.target.plugins.filesystem.ntfs.utils
      - dissect.target.plugins.filesystem.unix
        Toggle navigation of dissect.target.plugins.filesystem.unix
        
        dissect.target.plugins.filesystem.unix.capability
        
        dissect.target.plugins.filesystem.unix.suid
      - dissect.target.plugins.filesystem.acquire_handles
      - dissect.target.plugins.filesystem.acquire_hash
      - dissect.target.plugins.filesystem.icat
      - dissect.target.plugins.filesystem.resolver
      - dissect.target.plugins.filesystem.walkfs
      - dissect.target.plugins.filesystem.yara
    - dissect.target.plugins.general
      Toggle navigation of dissect.target.plugins.general
    - dissect.target.plugins.os
      Toggle navigation of dissect.target.plugins.os
      - dissect.target.plugins.os.unix
        Toggle navigation of dissect.target.plugins.os.unix
        
        dissect.target.plugins.os.unix.bsd
        Toggle navigation of dissect.target.plugins.os.unix.bsd
        
        dissect.target.plugins.os.unix.bsd.citrix
        Toggle navigation of dissect.target.plugins.os.unix.bsd.citrix
        
        dissect.target.plugins.os.unix.bsd.citrix.history
        
        dissect.target.plugins.os.unix.bsd.freebsd
        
        dissect.target.plugins.os.unix.bsd.ios
        
        dissect.target.plugins.os.unix.bsd.openbsd
        
        dissect.target.plugins.os.unix.bsd.osx
        Toggle navigation of dissect.target.plugins.os.unix.bsd.osx
        
        dissect.target.plugins.os.unix.bsd.osx.user
        
        dissect.target.plugins.os.unix.esxi
        
        dissect.target.plugins.os.unix.etc
        Toggle navigation of dissect.target.plugins.os.unix.etc
        
        dissect.target.plugins.os.unix.etc.etc
        
        dissect.target.plugins.os.unix.linux
        Toggle navigation of dissect.target.plugins.os.unix.linux
        
        dissect.target.plugins.os.unix.linux.android
        
        dissect.target.plugins.os.unix.linux.debian
        Toggle navigation of dissect.target.plugins.os.unix.linux.debian
        
        dissect.target.plugins.os.unix.linux.debian.vyos
        
        dissect.target.plugins.os.unix.linux.debian.apt
        
        dissect.target.plugins.os.unix.linux.debian.dpkg
        
        dissect.target.plugins.os.unix.linux.fortios
        Toggle navigation of dissect.target.plugins.os.unix.linux.fortios
        
        dissect.target.plugins.os.unix.linux.fortios.generic
        
        dissect.target.plugins.os.unix.linux.fortios.locale
        
        dissect.target.plugins.os.unix.linux.redhat
        Toggle navigation of dissect.target.plugins.os.unix.linux.redhat
        
        dissect.target.plugins.os.unix.linux.redhat.yum
        
        dissect.target.plugins.os.unix.linux.suse
        Toggle navigation of dissect.target.plugins.os.unix.linux.suse
        
        dissect.target.plugins.os.unix.linux.suse.zypper
        
        dissect.target.plugins.os.unix.linux.cmdline
        
        dissect.target.plugins.os.unix.linux.environ
        
        dissect.target.plugins.os.unix.linux.iptables
        
        dissect.target.plugins.os.unix.linux.modules
        
        dissect.target.plugins.os.unix.linux.netstat
        
        dissect.target.plugins.os.unix.linux.proc
        
        dissect.target.plugins.os.unix.linux.processes
        
        dissect.target.plugins.os.unix.linux.services
        
        dissect.target.plugins.os.unix.linux.sockets
        
        dissect.target.plugins.os.unix.locate
        Toggle navigation of dissect.target.plugins.os.unix.locate
        
        dissect.target.plugins.os.unix.locate.gnulocate
        
        dissect.target.plugins.os.unix.locate.locate
        
        dissect.target.plugins.os.unix.locate.mlocate
        
        dissect.target.plugins.os.unix.locate.plocate
        
        dissect.target.plugins.os.unix.log
        Toggle navigation of dissect.target.plugins.os.unix.log
        
        dissect.target.plugins.os.unix.log.atop
        
        dissect.target.plugins.os.unix.log.audit
        
        dissect.target.plugins.os.unix.log.auth
        
        dissect.target.plugins.os.unix.log.journal
        
        dissect.target.plugins.os.unix.log.lastlog
        
        dissect.target.plugins.os.unix.log.messages
        
        dissect.target.plugins.os.unix.log.utmp
        
        dissect.target.plugins.os.unix.cronjobs
        
        dissect.target.plugins.os.unix.datetime
        
        dissect.target.plugins.os.unix.generic
        
        dissect.target.plugins.os.unix.history
        
        dissect.target.plugins.os.unix.locale
        
        dissect.target.plugins.os.unix.packagemanager
        
        dissect.target.plugins.os.unix.shadow
      - dissect.target.plugins.os.windows
        Toggle navigation of dissect.target.plugins.os.windows
        
        dissect.target.plugins.os.windows.credential
        Toggle navigation of dissect.target.plugins.os.windows.credential
        
        dissect.target.plugins.os.windows.credential.credhist
        
        dissect.target.plugins.os.windows.credential.lsa
        
        dissect.target.plugins.os.windows.credential.sam
        
        dissect.target.plugins.os.windows.defender_helpers
        Toggle navigation of dissect.target.plugins.os.windows.defender_helpers
        
        dissect.target.plugins.os.windows.defender_helpers.defender_patterns
        
        dissect.target.plugins.os.windows.defender_helpers.defender_records
        
        dissect.target.plugins.os.windows.dpapi
        Toggle navigation of dissect.target.plugins.os.windows.dpapi
        
        dissect.target.plugins.os.windows.dpapi.keyprovider
        Toggle navigation of dissect.target.plugins.os.windows.dpapi.keyprovider
        
        dissect.target.plugins.os.windows.dpapi.keyprovider.credhist
        
        dissect.target.plugins.os.windows.dpapi.keyprovider.empty
        
        dissect.target.plugins.os.windows.dpapi.keyprovider.keychain
        
        dissect.target.plugins.os.windows.dpapi.keyprovider.keyprovider
        
        dissect.target.plugins.os.windows.dpapi.keyprovider.lsa
        
        dissect.target.plugins.os.windows.dpapi.blob
        
        dissect.target.plugins.os.windows.dpapi.crypto
        
        dissect.target.plugins.os.windows.dpapi.dpapi
        
        dissect.target.plugins.os.windows.dpapi.master_key
        
        dissect.target.plugins.os.windows.exchange
        Toggle navigation of dissect.target.plugins.os.windows.exchange
        
        dissect.target.plugins.os.windows.exchange.exchange
        
        dissect.target.plugins.os.windows.log
        Toggle navigation of dissect.target.plugins.os.windows.log
        
        dissect.target.plugins.os.windows.log.amcache
        
        dissect.target.plugins.os.windows.log.etl
        
        dissect.target.plugins.os.windows.log.evt
        
        dissect.target.plugins.os.windows.log.evtx
        
        dissect.target.plugins.os.windows.log.pfro
        
        dissect.target.plugins.os.windows.log.schedlgu
        
        dissect.target.plugins.os.windows.regf
        Toggle navigation of dissect.target.plugins.os.windows.regf
        
        dissect.target.plugins.os.windows.regf.7zip
        
        dissect.target.plugins.os.windows.regf.appxdebugkeys
        
        dissect.target.plugins.os.windows.regf.auditpol
        
        dissect.target.plugins.os.windows.regf.bam
        
        dissect.target.plugins.os.windows.regf.cit
        
        dissect.target.plugins.os.windows.regf.clsid
        
        dissect.target.plugins.os.windows.regf.firewall
        
        dissect.target.plugins.os.windows.regf.mru
        
        dissect.target.plugins.os.windows.regf.muicache
        
        dissect.target.plugins.os.windows.regf.nethist
        
        dissect.target.plugins.os.windows.regf.recentfilecache
        
        dissect.target.plugins.os.windows.regf.regf
        
        dissect.target.plugins.os.windows.regf.runkeys
        
        dissect.target.plugins.os.windows.regf.shellbags
        
        dissect.target.plugins.os.windows.regf.shimcache
        
        dissect.target.plugins.os.windows.regf.trusteddocs
        
        dissect.target.plugins.os.windows.regf.usb
        
        dissect.target.plugins.os.windows.regf.userassist
        
        dissect.target.plugins.os.windows.task_helpers
        Toggle navigation of dissect.target.plugins.os.windows.task_helpers
        
        dissect.target.plugins.os.windows.task_helpers.tasks_job
        
        dissect.target.plugins.os.windows.task_helpers.tasks_records
        
        dissect.target.plugins.os.windows.task_helpers.tasks_xml
        
        dissect.target.plugins.os.windows.activitiescache
        
        dissect.target.plugins.os.windows.adpolicy
        
        dissect.target.plugins.os.windows.amcache
        
        dissect.target.plugins.os.windows.catroot
        
        dissect.target.plugins.os.windows.cim
        
        dissect.target.plugins.os.windows.clfs
        
        dissect.target.plugins.os.windows.datetime
        
        dissect.target.plugins.os.windows.defender
        
        dissect.target.plugins.os.windows.env
        
        dissect.target.plugins.os.windows.generic
        
        dissect.target.plugins.os.windows.jumplist
        
        dissect.target.plugins.os.windows.lnk
        
        dissect.target.plugins.os.windows.locale
        
        dissect.target.plugins.os.windows.notifications
        
        dissect.target.plugins.os.windows.prefetch
        
        dissect.target.plugins.os.windows.recyclebin
        
        dissect.target.plugins.os.windows.registry
        
        dissect.target.plugins.os.windows.services
        
        dissect.target.plugins.os.windows.sru
        
        dissect.target.plugins.os.windows.startupinfo
        
        dissect.target.plugins.os.windows.syscache
        
        dissect.target.plugins.os.windows.tasks
        
        dissect.target.plugins.os.windows.thumbcache
        
        dissect.target.plugins.os.windows.ual
        
        dissect.target.plugins.os.windows.wer
        
        dissect.target.plugins.os.windows.wua_history
  - dissect.target.tools
    Toggle navigation of dissect.target.tools
  - dissect.target.volumes
    Toggle navigation of dissect.target.volumes
  - dissect.target.container
  - dissect.target.exceptions
  - dissect.target.filesystem
  - dissect.target.loader
  - dissect.target.plugin
  - dissect.target.report
  - dissect.target.target
  - dissect.target.volume
- dissect.thumbcache
  Toggle navigation of dissect.thumbcache
  - dissect.thumbcache.tools
    Toggle navigation of dissect.thumbcache.tools
  - dissect.thumbcache.c_thumbcache
  - dissect.thumbcache.exceptions
  - dissect.thumbcache.index
  - dissect.thumbcache.thumbcache
  - dissect.thumbcache.thumbcache_file
  - dissect.thumbcache.util
- dissect.util
  Toggle navigation of dissect.util
  - dissect.util.compression
    Toggle navigation of dissect.util.compression
  - dissect.util.encoding
    Toggle navigation of dissect.util.encoding
    - dissect.util.encoding.surrogateescape
  - dissect.util.tools
    Toggle navigation of dissect.util.tools
    - dissect.util.tools.dump_nskeyedarchiver
  - dissect.util.cpio
  - dissect.util.crc32c
  - dissect.util.exceptions
  - dissect.util.feature
  - dissect.util.plist
  - dissect.util.sid
  - dissect.util.stream
  - dissect.util.ts
  - dissect.util.xmemoryview
- dissect.vmfs
  Toggle navigation of dissect.vmfs
- dissect.volume
  Toggle navigation of dissect.volume
  - dissect.volume.ddf
    Toggle navigation of dissect.volume.ddf
    - dissect.volume.ddf.c_ddf
    - dissect.volume.ddf.ddf
  - dissect.volume.disk
    Toggle navigation of dissect.volume.disk
    - dissect.volume.disk.schemes
      Toggle navigation of dissect.volume.disk.schemes
    - dissect.volume.disk.disk
    - dissect.volume.disk.partition
  - dissect.volume.dm
    Toggle navigation of dissect.volume.dm
  - dissect.volume.lvm
    Toggle navigation of dissect.volume.lvm
  - dissect.volume.md
    Toggle navigation of dissect.volume.md
    - dissect.volume.md.c_md
    - dissect.volume.md.md
  - dissect.volume.raid
    Toggle navigation of dissect.volume.raid
    - dissect.volume.raid.raid
    - dissect.volume.raid.stream
  - dissect.volume.exceptions
  - dissect.volume.ldm
  - dissect.volume.vss
- dissect.xfs
  Toggle navigation of dissect.xfs
- flow.record
  Toggle navigation of flow.record
  - flow.record.adapter
    Toggle navigation of flow.record.adapter
  - flow.record.fieldtypes
    Toggle navigation of flow.record.fieldtypes
    - flow.record.fieldtypes.net
      Toggle navigation of flow.record.fieldtypes.net
    - flow.record.fieldtypes.credential
  - flow.record.tools
    Toggle navigation of flow.record.tools
    - flow.record.tools.geoip
    - flow.record.tools.rdump
  - flow.record.base
  - flow.record.exceptions
  - flow.record.jsonpacker
  - flow.record.packer
  - flow.record.selector
  - flow.record.stream
  - flow.record.utils
  - flow.record.whitelist

Contributing

Developing for Dissect
Style guide
Tooling
License

Resources

Dissect in Action
Talks and Conferences

Links

Try in your browser
GitHub
PyPI

Toggle table of contents sidebar

`dissect.etl.headers`¶

Submodules¶

dissect.etl.headers.event
dissect.etl.headers.headers
dissect.etl.headers.logfile
dissect.etl.headers.system
dissect.etl.headers.utils

dissect.etl.headers.event

Copyright © 2023, Fox-IT part of NCC Group

Made with Sphinx and @pradyunsg's Furo

On this page

dissect.etl.headers
- Submodules