dissect.target.plugins.child.wsl#

Module Contents#

Classes#

WSLChildTargetPlugin

Child target plugin that yields WSL VHDX file locations.

Functions#

find_wsl_installs

Find all WSL disk files.

dissect.target.plugins.child.wsl.find_wsl_installs(target: dissect.target.target.Target) Iterator[pathlib.Path]#

Find all WSL disk files.

Disk files for working (custom) Linux distributions can be located anywhere on the system. Locations to disk files for each user’s WSL instance is stored in the Windows registry at HKCU\Software\Microsoft\Windows\CurrentVersion\Lxss.

References

class dissect.target.plugins.child.wsl.WSLChildTargetPlugin(target: dissect.target.target.Target)#

Bases: dissect.target.plugin.ChildTargetPlugin

Child target plugin that yields WSL VHDX file locations.

Windows WSL VHDX disk file locations are stored in the Windows registry in HKCU\Software\Microsoft\Windows\CurrentVersion\Lxss.

References

__type__ = 'wsl'#
check_compatible() None#

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

list_children() Iterator[dissect.target.helpers.record.ChildTargetRecord]#

Yield ChildTargetRecord records of all possible child targets on this target.