dissect.target.loaders.dir

Module Contents

Classes

DirLoader

A base class for loading a specific path and coupling it to a Target.

Functions

map_dirs	Try to map all found directories as filesystems into the given target.
find_dirs	Try to find if path contains an operating system directory layout and return the OS type and detected
os_type_from_path	Try to detect what kind of operating system directory structure path contains.
is_drive_letter_path	Check if a path can be a drive letter, e.g. C or C:.

class dissect.target.loaders.dir.DirLoader(path: pathlib.Path, **kwargs)

Bases: dissect.target.loader.Loader

A base class for loading a specific path and coupling it to a Target.

Implementors of this class are responsible for mapping any type of source data to a Target. Whether that’s to map all VMDK files from a VMX or mapping the contents of a zip file to a virtual filesystem, if it’s something that can be translated to a “disk”, “volume” or “filesystem”, you can write a loader that maps it into a target.

You can do anything you want to manipulate the Target object in your map function, but generally you do one of the following:

• open a Container and add it to target.disks.

• open a Volume and add it to target.volumes.

• open a VirtualFilesystem, add your files into it and add it to target.filesystems.

You don’t need to manually parse volumes or filesystems in your loader, just add the highest level object you have (e.g. a Container of a VMDK file) to the target. However, sometimes you need to get creative. Take a look at the ITunesLoader and TarLoader for some creative examples.

Parameters:

path – The target path to load.

static detect(path: pathlib.Path) → bool

Detects wether this Loader class can load this specific path.

Parameters:

path – The target path to check.

Returns:

True if the path can be loaded by a Loader instance. False otherwise.

map(target: dissect.target.Target) → None

Maps the loaded path into a Target.

Parameters:

target – The target that we’re mapping into.

dissect.target.loaders.dir.map_dirs(target: dissect.target.Target, path: pathlib.Path, **kwargs) → None

Try to map all found directories as filesystems into the given target.

Parameters:

• target – The target to map into.

• path – The path to map from.

• **kwargs – Optional arguments for loaderutil.add_virtual_ntfs_filesystem.

dissect.target.loaders.dir.find_dirs(path: pathlib.Path) → Tuple[str, List[pathlib.Path]]

Try to find if path contains an operating system directory layout and return the OS type and detected directories.

In the case of a Windows layout, try to find if there are directories for each drive letter and return them all.

Parameters:

path – The path to check.

Returns:

A tuple consisting of the found operating system layout and a list of all detected directories.

dissect.target.loaders.dir.os_type_from_path(path: pathlib.Path) → str

Try to detect what kind of operating system directory structure path contains.

The operating system type is returned as a string.

Parameters:

path – The path to check.

Returns:

The detected operating system type, one of windows, linux or osx.

dissect.target.loaders.dir.is_drive_letter_path(path: pathlib.Path) → bool

Check if a path can be a drive letter, e.g. C or C:.

Parameters:

path – The path to check.

Returns:

True if the path can be interpreted as a drive letter or False if it can’t.