dissect.target.loaders.velociraptor#

Module Contents#

Classes#

VelociraptorLoader

Load Rapid7 Velociraptor forensic image files.

Functions#

Attributes#

dissect.target.loaders.velociraptor.log#
dissect.target.loaders.velociraptor.FILESYSTEMS_ROOT = 'uploads'#
dissect.target.loaders.velociraptor.UNIX_ACCESSORS = ['file', 'auto']#
dissect.target.loaders.velociraptor.WINDOWS_ACCESSORS = ['mft', 'ntfs', 'lazy_ntfs', 'ntfs_vss', 'auto']#
dissect.target.loaders.velociraptor.find_fs_directories(path: pathlib.Path) tuple[dissect.target.plugin.OperatingSystem | None, list[pathlib.Path] | None]#
class dissect.target.loaders.velociraptor.VelociraptorLoader(path: pathlib.Path, **kwargs)#

Bases: dissect.target.loaders.dir.DirLoader

Load Rapid7 Velociraptor forensic image files.

References

static detect(path: pathlib.Path) bool#

Detects wether this Loader class can load this specific path.

Parameters:

path – The target path to check.

Returns:

True if the path can be loaded by a Loader instance. False otherwise.

map(target: dissect.target.Target) None#

Maps the loaded path into a Target.

Parameters:

target – The target that we’re mapping into.