dissect.target
#
Subpackages#
dissect.target.containers
dissect.target.containers.asdf
dissect.target.containers.ewf
dissect.target.containers.hdd
dissect.target.containers.hds
dissect.target.containers.qcow2
dissect.target.containers.raw
dissect.target.containers.split
dissect.target.containers.vdi
dissect.target.containers.vhd
dissect.target.containers.vhdx
dissect.target.containers.vmdk
dissect.target.filesystems
dissect.target.filesystems.ad1
dissect.target.filesystems.cb
dissect.target.filesystems.dir
dissect.target.filesystems.exfat
dissect.target.filesystems.extfs
dissect.target.filesystems.fat
dissect.target.filesystems.ffs
dissect.target.filesystems.itunes
dissect.target.filesystems.ntfs
dissect.target.filesystems.smb
dissect.target.filesystems.squashfs
dissect.target.filesystems.tar
dissect.target.filesystems.vmfs
dissect.target.filesystems.xfs
dissect.target.filesystems.zip
dissect.target.helpers
dissect.target.helpers.cache
dissect.target.helpers.config
dissect.target.helpers.descriptor_extensions
dissect.target.helpers.docs
dissect.target.helpers.fsutil
dissect.target.helpers.hashutil
dissect.target.helpers.keychain
dissect.target.helpers.lazy
dissect.target.helpers.loaderutil
dissect.target.helpers.localeutil
dissect.target.helpers.mount
dissect.target.helpers.network_managers
dissect.target.helpers.record
dissect.target.helpers.regutil
dissect.target.helpers.shell_folder_ids
dissect.target.helpers.ssh
dissect.target.helpers.targetd
dissect.target.helpers.utils
dissect.target.loaders
dissect.target.loaders.ad1
dissect.target.loaders.asdf
dissect.target.loaders.cb
dissect.target.loaders.dir
dissect.target.loaders.hyperv
dissect.target.loaders.itunes
dissect.target.loaders.kape
dissect.target.loaders.local
dissect.target.loaders.log
dissect.target.loaders.multiraw
dissect.target.loaders.ovf
dissect.target.loaders.phobos
dissect.target.loaders.profile
dissect.target.loaders.pvm
dissect.target.loaders.pvs
dissect.target.loaders.raw
dissect.target.loaders.remote
dissect.target.loaders.res
dissect.target.loaders.smb
dissect.target.loaders.tanium
dissect.target.loaders.tar
dissect.target.loaders.target
dissect.target.loaders.targetd
dissect.target.loaders.utm
dissect.target.loaders.vb
dissect.target.loaders.vbox
dissect.target.loaders.velociraptor
dissect.target.loaders.vma
dissect.target.loaders.vmwarevm
dissect.target.loaders.vmx
dissect.target.loaders.xva
dissect.target.plugins
dissect.target.plugins.apps
dissect.target.plugins.browsers
dissect.target.plugins.child
dissect.target.plugins.filesystem
dissect.target.plugins.filesystem.ntfs
dissect.target.plugins.filesystem.unix
dissect.target.plugins.filesystem.acquire_handles
dissect.target.plugins.filesystem.acquire_hash
dissect.target.plugins.filesystem.icat
dissect.target.plugins.filesystem.resolver
dissect.target.plugins.filesystem.walkfs
dissect.target.plugins.filesystem.yara
dissect.target.plugins.general
dissect.target.plugins.os
dissect.target.tools
dissect.target.volumes
Submodules#
Package Contents#
Classes#
The class that represents the target that you are talking to. |
- class dissect.target.Target(path: str | pathlib.Path = None)#
The class that represents the target that you are talking to.
Targets are the glue that connects the different
Containers
,Loaders
,Volumes
andFilesystems
together.Loaders
are used to map theContainers
,Volumes
andFilesystems
of the target onto theTarget
object.The plugins of dissect.target get mapped onto the
Target
too. They become available as attributes on aTarget
object. For example,t.hostname
,t.evtx()
. By executing the plugin function with a target, it will perform the function on itself.- Parameters:
path – The path of a target.
- property name: str#
Return a name for this target.
The function is guaranteed to give back some name. The name will be guaranteed to not have slashes, backslashes and spaces. The name won’t be guaranteed to be unique.
- Returns:
The name of a target.
- classmethod set_event_callback(*, event_type: Event | None = None, event_callback: Callable) None #
Sets
event_callbacks
on a Target class.event_callbacks
get used to handle specific events denoted byEvent
. This records events related to the target, such as:a plugin gets registered to the target
a plugin is incompatible with the target
a function succeededs in its execution
a function fails in execution
- send_event(event_type: Event, **kwargs) None #
Notify event callbacks for the given
event_type
.Each event can have multiple callback methods, it calls all the callbacks that fit the corresponding event type.
None
is a catch-all method for event callbacks that always get called.- Parameters:
event_type – The type of event
- apply() None #
Resolve all disks, volumes and filesystems and load an operating system on the current
Target
.
- classmethod open(path: str | pathlib.Path) Target #
Try to find a suitable loader for the given path and load a
Target
from it.- Parameters:
path – Path to load the
Target
from.- Returns:
A Target with a linked
Loader
object.
- classmethod open_raw(path: str | pathlib.Path) Target #
Open a Target with the given path using the
RawLoader
.- Parameters:
path – Path to load the Target from.
- classmethod open_all(paths: list[str | pathlib.Path], include_children: bool = False) Iterator[Target] #
Yield targets from a list of paths.
If the path is a directory, iterate files one directory deep.
- Parameters:
paths – A list of paths to load
Targets
from.- Raises:
TargetError – Raised when not a single
Target
can be loaded.
- open_child(child: str | pathlib.Path) Target #
Open a child target.
- Parameters:
child – The location of a target within the current
Target
.- Returns:
An opened
Target
object of the child target.
- open_children(recursive: bool = False) Iterator[Target] #
Open all the child targets on a
Target
.Will open all discovered child targets if the current
Target
has them, such as VMs on a hypervisor.- Parameters:
recursive – Whether to check the child
Target
for moreTargets
.- Returns:
An interator of
Targets
.
- list_children() Iterator[dissect.target.helpers.record.ChildTargetRecord] #
Lists all child targets that compatible
ChildTargetPlugin
classes can discover.
- add_plugin(plugin_cls: dissect.target.plugin.Plugin | type[dissect.target.plugin.Plugin], check_compatible: bool = True) dissect.target.plugin.Plugin #
Add and register a plugin by class.
- Parameters:
plugin_cls – The plugin to add and register, this can either be a class or instance. When this is a class, it will be instantiated.
check_compatible – A flag that determines if we check whether the plugin is compatible with the
Target
.
- Returns:
The
plugin_cls
instance.- Raises:
UnsupportedPluginError – Raised when plugins were found, but they were incompatible
PluginError – Raised when any other exception occurs while trying to load the plugin.
- get_function(function: str) FunctionTuple #
Attempt to get a given function.
If the function is not already registered, look for plugins that export the function and register them.
- Parameters:
function – Function name to look for.
- Returns:
A tuple of the plugin and the corresponding function.
- Raises:
UnsupportedPluginError – Raised when plugins were found, but they were incompatible
PluginError – Raised when any other exception occurs while trying to load the plugin.
- has_function(function: str) bool #
Return whether this Target supports a given function.
- Parameters:
function – The function name to look for.
- Returns:
True
if the function can be found,False
otherwise.
- __getattr__(attr: str) dissect.target.plugin.Plugin | Any #
Override of the default __getattr__ so plugins and functions can be called from a
Target
object.
- __dir__()#
Override the default __dir__ to provide autocomplete for things like IPython.
- __repr__()#
Return repr(self).