Index _ | A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z _ __add__() (dissect.cstruct.types.pointer.Pointer method) __align__ (dissect.cstruct.types.structure.StructureMetaType attribute) __and__() (dissect.cstruct.types.pointer.Pointer method) __anonymous__ (dissect.cstruct.types.structure.StructureMetaType attribute) __attr__ (dissect.cstruct.types.structure.UnionProxy attribute) __bool__() (dissect.cstruct.types.base.MetaType method) (dissect.cstruct.types.void.Void method) __bytes__() (dissect.cstruct.types.structure.Structure method) (dissect.cstruct.types.structure.UnionProxy method) __call__ (dissect.target.plugins.filesystem.ntfs.mft.MftPlugin attribute) __call__() (dissect.cstruct.types.base.MetaType method) (dissect.cstruct.types.enum.EnumMetaType method) (dissect.cstruct.types.structure.StructureMetaType method) (dissect.cstruct.types.structure.UnionMetaType method) (dissect.ntfs.mft.Mft method) (dissect.target.helpers.lazy.FailedImport method) (dissect.target.helpers.lazy.LazyAttr method) (dissect.target.helpers.record.ExtendableRecordDescriptor method) (dissect.target.plugin.Plugin method) (dissect.target.plugins.os.unix.esxi.esxconf.EsxConfPlugin method) (flow.record.base.DynamicFieldtypeModule method) (flow.record.base.RecordDescriptor method) (flow.record.utils.EventHandler method) __child__ (dissect.target.plugin.FunctionDescriptorLookup attribute) (dissect.target.plugin.PluginDescriptorLookup attribute) __compiled__ (dissect.cstruct.types.structure.StructureMetaType attribute) __complex__ (dissect.fve.bde.information.Datum attribute) (dissect.fve.bde.information.ExternalInfoDatum attribute) (dissect.fve.bde.information.StretchKeyDatum attribute) (dissect.fve.bde.information.UpdateDatum attribute) (dissect.fve.bde.information.UseKeyDatum attribute) (dissect.fve.bde.information.VmkInfoDatum attribute) __contains__() (dissect.cstruct.parser.TokenConsumer method) (dissect.cstruct.types.enum.EnumMetaType method) (dissect.cstruct.types.structure.StructureValuesProxy method) (dissect.database.bsd.tools.rpm.HeaderBlob method) (dissect.database.ese.record.Record method) (dissect.executable.pe.directory.bound_import.BoundImportDirectory method) (dissect.executable.pe.directory.delay_import.DelayImportDirectory method) (dissect.executable.pe.directory.delay_import.DelayImportModule method) (dissect.executable.pe.directory.export.ExportDirectory method) (dissect.executable.pe.directory.imports.ImportDirectory method) (dissect.executable.pe.directory.imports.ImportModule method) (dissect.executable.pe.directory.resource.Resource method) (dissect.executable.pe.directory.resource.ResourceDirectory method) (dissect.ntfs.util.AttributeMap method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.helpers.configutil.ConfigurationParser method) (dissect.target.helpers.regutil.VirtualKey method) (flow.record.fieldtypes.net.ip.ipnetwork method) (flow.record.fieldtypes.net.ipv4.subnet method) (flow.record.fieldtypes.net.ipv4.SubnetList method) (flow.record.selector.CompiledSelector method) (flow.record.selector.NoneObject method) (flow.record.selector.Selector method) (flow.record.selector.TypeMatcherInstance method) __default__() (dissect.cstruct.types.base.BaseArray class method) (dissect.cstruct.types.base.MetaType method) (dissect.cstruct.types.char.Char class method) (dissect.cstruct.types.char.CharArray class method) (dissect.cstruct.types.pointer.Pointer class method) (dissect.cstruct.types.void.VoidArray class method) (dissect.cstruct.types.wchar.Wchar class method) (dissect.cstruct.types.wchar.WcharArray class method) __del__() (dissect.target.helpers.nfs.client.nfs.Client method) (dissect.target.helpers.sunrpc.client.Client method) (dissect.target.loaders.smb.SmbRegistry method) (flow.record.adapter.AbstractWriter method) (flow.record.stream.RecordStreamWriter method) __delitem__() (dissect.cstruct.types.structure.StructureValuesProxy method) __dir__() (dissect.target.target.Target method) __doc__ (dissect.target.helpers.lazy.LazyAttr property) __dynamic_sizes__ (dissect.cstruct.types.structure.Structure attribute) __encoding_map__ (dissect.cstruct.types.wchar.Wchar attribute) __enter__() (acquire.acquire.collector.Collector method) (dissect.database.sqlite3.sqlite3.SQLite3 method) (dissect.hypervisor.disk.vdi.VDI method) (dissect.target.helpers.configutil.ScopeManager method) (dissect.target.helpers.nfs.client.mount.Client method) (dissect.target.helpers.nfs.client.nfs.Client method) (dissect.target.helpers.sunrpc.client.Client method) (flow.record.adapter.AbstractReader method) (flow.record.adapter.AbstractWriter method) __eq__() (dissect.cstruct.parser.Token method) (dissect.cstruct.types.enum.Enum method) (dissect.cstruct.types.flag.Flag method) (dissect.cstruct.types.structure.Union method) (dissect.cstruct.types.void.Void method) (dissect.database.ese.record.Record method) (dissect.database.sqlite3.sqlite3.Column method) (dissect.eventlog.bxml.Token method) (dissect.ntfs.mft.MftRecord method) (dissect.target.helpers.fsutil.stat_result method) (dissect.vmfs.address.Address method) (dissect.volume.vss.BlockDescriptor method) (flow.record.base.Record method) (flow.record.base.RecordDescriptor method) (flow.record.fieldtypes.command method) (flow.record.fieldtypes.net.ip.ipaddress method) (flow.record.fieldtypes.net.ip.ipinterface method) (flow.record.fieldtypes.net.ip.ipnetwork method) (flow.record.fieldtypes.net.ipv4.address method) (flow.record.fieldtypes.path method) (flow.record.fieldtypes.Record method) (flow.record.selector.NoneObject method) (flow.record.selector.TypeMatcherInstance method) __exit__() (acquire.acquire.collector.Collector method) (dissect.database.sqlite3.sqlite3.SQLite3 method) (dissect.hypervisor.disk.vdi.VDI method) (dissect.target.helpers.configutil.ScopeManager method) (dissect.target.helpers.nfs.client.mount.Client method) (dissect.target.helpers.nfs.client.nfs.Client method) (dissect.target.helpers.sunrpc.client.Client method) (flow.record.adapter.AbstractReader method) (flow.record.adapter.AbstractWriter method) __exports__ (dissect.target.plugin.Plugin attribute) __extra__ (dissect.target.exceptions.Error attribute) __failed__ (dissect.target.plugin.PluginRegistry attribute) __fields__ (dissect.cstruct.types.structure.StructureMetaType attribute) __findable__ (dissect.target.plugin.Plugin attribute) (dissect.target.plugins.general.example.ExampleNamespacePlugin attribute) (dissect.target.plugins.general.example.ExamplePlugin attribute) __floordiv__() (dissect.cstruct.types.pointer.Pointer method) __format__() (flow.record.fieldtypes.bytes method) (flow.record.fieldtypes.net.ip.ipaddress method) (flow.record.fieldtypes.string method) __fspath__() (dissect.target.filesystem.DirEntry method) __functions__ (dissect.target.plugin.Plugin attribute) (dissect.target.plugin.PluginRegistry attribute) __ge__() (dissect.database.ese.record.Record method) __getattr__() (dissect.cim.cim.Class method) (dissect.cim.classes.InstanceKey method) (dissect.cstruct.cstruct.cstruct method) (dissect.cstruct.parser.TokenCollection method) (dissect.cstruct.types.pointer.Pointer method) (dissect.cstruct.types.structure.UnionProxy method) (dissect.database.ese.ntds.objects.object.Object method) (dissect.database.ese.record.Record method) (dissect.database.ese.tools.sru.Entry method) (dissect.database.sqlite3.sqlite3.Row method) (dissect.etl.etl.Event method) (dissect.etl.headers.event.EventHeaderExtendedDataItem method) (dissect.hypervisor.disk.vmdk.SparseExtentHeader method) (dissect.ntfs.attr.Attribute method) (dissect.ntfs.usnjrnl.UsnRecord method) (dissect.ntfs.util.AttributeCollection method) (dissect.ntfs.util.AttributeMap method) (dissect.shellitem.lnk.lnk.LnkExtraData method) (dissect.shellitem.lnk.lnk.LnkInfo method) (dissect.shellitem.lnk.lnk.LnkStringData method) (dissect.target.filesystem.EntryList method) (dissect.target.filesystem.LayerFilesystem method) (dissect.target.helpers.lazy.FailedImport method) (dissect.target.helpers.lazy.LazyAttr method) (dissect.target.helpers.lazy.LazyImport method) (dissect.target.plugin.Plugin method) (dissect.target.plugins.os.unix.linux.fortios._os.ConfigNode method) (dissect.target.target.Target method) (dissect.target.tools.shell.ExtendedCmd method) (dissect.util.plist.NSObject method) (flow.record.base.DynamicFieldtypeModule method) (flow.record.base.GroupedRecord method) (flow.record.base.Record method) (flow.record.fieldtypes.Record method) (flow.record.selector.TypeMatcher method) (flow.record.selector.TypeMatcherInstance method) (flow.record.selector.WrappedRecord method) __getattribute__() (dissect.eventlog.wevt_object.WevtObject method) (dissect.thumbcache.thumbcache_file.ThumbcacheFile method) __getitem__() (dissect.cim.classes.PropertyStates method) (dissect.cim.index.Key method) (dissect.cim.mappings.Mapping method) (dissect.cim.objects.TOC method) (dissect.cstruct.types.base.MetaType method) (dissect.cstruct.types.enum.EnumMetaType method) (dissect.cstruct.types.structure.Structure method) (dissect.cstruct.types.structure.StructureValuesProxy method) (dissect.cstruct.types.structure.UnionProxy method) (dissect.database.ese.record.Record method) (dissect.database.ese.tools.impacket.RecordWrapper method) (dissect.database.ese.tools.sru.Entry method) (dissect.database.sqlite3.sqlite3.Row method) (dissect.executable.elf.elf.StringTable method) (dissect.executable.elf.elf.Table method) (dissect.executable.pe.directory.basereloc.BaseRelocationDirectory method) (dissect.executable.pe.directory.bound_import.BoundImportDirectory method) (dissect.executable.pe.directory.debug.DebugDirectory method) (dissect.executable.pe.directory.debug.PogoDebugEntry method) (dissect.executable.pe.directory.delay_import.DelayImportDirectory method) (dissect.executable.pe.directory.delay_import.DelayImportModule method) (dissect.executable.pe.directory.exception.ExceptionDirectory method) (dissect.executable.pe.directory.export.ExportDirectory method) (dissect.executable.pe.directory.iat.IatDirectory method) (dissect.executable.pe.directory.imports.ImportDirectory method) (dissect.executable.pe.directory.imports.ImportModule method) (dissect.executable.pe.directory.resource.Resource method) (dissect.executable.pe.directory.resource.ResourceDirectory method) (dissect.executable.pe.directory.security.SecurityDirectory method) (dissect.executable.pe.directory.tls.TlsDirectory method) (dissect.hypervisor.descriptor.hyperv.HyperVFile method) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry method) (dissect.hypervisor.disk.vhd.BlockAllocationTable method) (dissect.ntfs.util.AttributeMap method) (dissect.ole.ole.Chain method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.helpers.configutil.ConfigurationParser method) (dissect.target.helpers.fsutil.stat_result method) (dissect.target.helpers.regutil.HiveCollection method) (dissect.target.helpers.regutil.KeyCollection method) (dissect.target.target.Collection method) (dissect.thumbcache.thumbcache_file.ThumbcacheFile method) (dissect.util.plist.NSDictionary method) (dissect.util.plist.NSKeyedArchiver method) (dissect.util.plist.NSObject method) (dissect.vmfs.resource.ResourceManager method) (dissect.volume.vss.BlockMap method) (dissect.volume.vss.StoreBitmap method) __gt__() (dissect.database.ese.record.Record method) (flow.record.selector.NoneObject method) (flow.record.selector.TypeMatcherInstance method) __gte__() (flow.record.selector.NoneObject method) (flow.record.selector.TypeMatcherInstance method) __hash__ (dissect.ntfs.mft.MftRecord attribute) __hash__() (dissect.cstruct.types.enum.Enum method) (dissect.cstruct.types.flag.Flag method) (dissect.database.ese.record.Record method) (dissect.vmfs.address.Address method) (flow.record.base.Record method) (flow.record.base.RecordDescriptor method) (flow.record.fieldtypes.datetime method) (flow.record.fieldtypes.net.ip.ipaddress method) (flow.record.fieldtypes.net.ip.ipinterface method) (flow.record.fieldtypes.net.ip.ipnetwork method) (flow.record.fieldtypes.Record method) __init_subclass__() (dissect.apfs.objects.base.Object class method) (dissect.database.ese.ntds.objects.object.Object class method) (dissect.target.plugin.InternalPlugin class method) (dissect.target.plugin.NamespacePlugin class method) (dissect.target.plugin.OSPlugin class method) (dissect.target.plugin.Plugin class method) (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm class method) (dissect.target.plugins.os.windows.dpapi.crypto.HashAlgorithm class method) (dissect.vmfs.address.Address class method) __init_subclass_subplugin__() (dissect.target.plugin.NamespacePlugin method) __int__() (dissect.vmfs.address.Address method) __INTERNAL_PLUGIN_METHOD_NAMES__ (in module dissect.target.plugin) __iter__ (dissect.database.ese.tools.sru.SRU attribute) __iter__() (dissect.archive.vbk.MetaVector method) (dissect.cstruct.types.structure.StructureValuesProxy method) (dissect.database.bsd.tools.rpm.Package method) (dissect.database.bsd.tools.rpm.Packages method) (dissect.database.ese.cursor.Cursor method) (dissect.database.sqlite3.sqlite3.Row method) (dissect.database.sqlite3.sqlite3.Table method) (dissect.etl.etl.Buffer method) (dissect.etl.etl.ETL method) (dissect.eventlog.evt.Evt method) (dissect.eventlog.evtx.Evtx method) (dissect.eventlog.wevt.MAPS_WEVT_TYPE method) (dissect.eventlog.wevt.TTBL_WEVT_TYPE method) (dissect.eventlog.wevt.WEVT method) (dissect.eventlog.wevt.WEVT_TYPE method) (dissect.eventlog.wevtutil.WevtutilWrapper method) (dissect.executable.elf.elf.Table method) (dissect.executable.pe.directory.basereloc.BaseRelocationDirectory method) (dissect.executable.pe.directory.debug.DebugDirectory method) (dissect.executable.pe.directory.debug.PogoDebugEntry method) (dissect.executable.pe.directory.delay_import.DelayImportModule method) (dissect.executable.pe.directory.exception.ExceptionDirectory method) (dissect.executable.pe.directory.export.ExportDirectory method) (dissect.executable.pe.directory.iat.IatDirectory method) (dissect.executable.pe.directory.imports.ImportModule method) (dissect.executable.pe.directory.resource.Resource method) (dissect.executable.pe.directory.resource.ResourceDirectory method) (dissect.executable.pe.directory.security.SecurityDirectory method) (dissect.executable.pe.directory.tls.TlsDirectory method) (dissect.fve.bde.information.Dataset method) (dissect.ntfs.index.Index method) (dissect.ole.ole.Chain method) (dissect.regf.regf.FastLeaf method) (dissect.regf.regf.HashLeaf method) (dissect.regf.regf.IndexLeaf method) (dissect.regf.regf.IndexRoot method) (dissect.regf.regf.KeyIndex method) (dissect.regf.regf.ValueList method) (dissect.target.helpers.cache.CacheWriter method) (dissect.target.helpers.cache.LineReader method) (dissect.target.helpers.configutil.PeekableIterator method) (dissect.target.helpers.fsutil.stat_result method) (dissect.target.helpers.regutil.HiveCollection method) (dissect.target.helpers.regutil.KeyCollection method) (dissect.target.helpers.regutil.ValueCollection method) (dissect.target.plugins.os.unix.locate.gnulocate.GNULocateFile method) (dissect.target.plugins.os.unix.locate.mlocate.MLocateFile method) (dissect.target.plugins.os.unix.locate.plocate.PLocateFile method) (dissect.target.plugins.os.unix.log.atop.AtopFile method) (dissect.target.plugins.os.unix.log.journal.JournalFile method) (dissect.target.plugins.os.unix.log.lastlog.LastLogFile method) (dissect.target.plugins.os.unix.log.utmp.UtmpFile method) (dissect.target.plugins.os.windows.everything.parser.EverythingDB method) (dissect.target.plugins.os.windows.jumplist.AutomaticDestinationFile method) (dissect.target.plugins.os.windows.jumplist.CustomDestinationFile method) (dissect.target.plugins.os.windows.jumplist.JumpListFile method) (dissect.target.plugins.os.windows.regf.shimcache.ShimCache method) (dissect.target.target.Collection method) (flow.record.adapter.AbstractReader method) (flow.record.adapter.avro.AvroReader method) (flow.record.adapter.broker.BrokerReader method) (flow.record.adapter.csvfile.CsvfileReader method) (flow.record.adapter.elastic.ElasticReader method) (flow.record.adapter.jsonfile.JsonfileReader method) (flow.record.adapter.mongo.MongoReader method) (flow.record.adapter.sqlite.SqliteReader method) (flow.record.adapter.stream.StreamReader method) (flow.record.adapter.xlsx.XlsxReader method) (flow.record.selector.TypeMatcherInstance method) (flow.record.stream.RecordStreamReader method) __known_classes__ (dissect.database.ese.ntds.objects.object.Object attribute) __known_types__ (dissect.apfs.objects.base.Object attribute) (dissect.vmfs.address.Address attribute) __le__() (dissect.database.ese.record.Record method) __len__ (dissect.cstruct.types.enum.EnumMetaType attribute) __len__() (dissect.cstruct.parser.TokenConsumer method) (dissect.cstruct.types.base.BaseType method) (dissect.cstruct.types.base.MetaType method) (dissect.cstruct.types.structure.Structure method) (dissect.cstruct.types.structure.StructureValuesProxy method) (dissect.cstruct.types.structure.UnionProxy method) (dissect.executable.pe.directory.basereloc.BaseRelocationDirectory method) (dissect.executable.pe.directory.bound_import.BoundImportDirectory method) (dissect.executable.pe.directory.debug.DebugDirectory method) (dissect.executable.pe.directory.debug.PogoDebugEntry method) (dissect.executable.pe.directory.delay_import.DelayImportDirectory method) (dissect.executable.pe.directory.exception.ExceptionDirectory method) (dissect.executable.pe.directory.iat.IatDirectory method) (dissect.executable.pe.directory.imports.ImportDirectory method) (dissect.executable.pe.directory.resource.ResourceDirectory method) (dissect.executable.pe.directory.security.SecurityDirectory method) (dissect.executable.pe.directory.tls.TlsDirectory method) (dissect.ole.ole.Chain method) (dissect.regf.regf.FastLeaf method) (dissect.regf.regf.HashLeaf method) (dissect.regf.regf.IndexLeaf method) (dissect.regf.regf.IndexRoot method) (dissect.regf.regf.KeyIndex method) (dissect.target.helpers.regutil.HiveCollection method) (dissect.target.helpers.regutil.KeyCollection method) (dissect.target.helpers.regutil.ValueCollection method) (dissect.target.target.Collection method) (flow.record.selector.NoneObject method) __lshift__() (dissect.cstruct.types.pointer.Pointer method) __lt__() (dissect.database.ese.record.Record method) (flow.record.selector.NoneObject method) (flow.record.selector.TypeMatcherInstance method) __lte__() (flow.record.selector.NoneObject method) (flow.record.selector.TypeMatcherInstance method) __MAPPING__ (dissect.target.plugins.os.unix.packagemanager.OperationTypes attribute) __missing__() (flow.record.adapter.text.DefaultMissing method) __mod__() (dissect.cstruct.types.pointer.Pointer method) __mul__() (dissect.cstruct.types.pointer.Pointer method) __multi_volume__ (dissect.target.filesystem.Filesystem attribute) (dissect.target.filesystems.btrfs.BtrfsFilesystem attribute) __namespace__ (dissect.target.plugin.Plugin attribute) (dissect.target.plugins.apps.av.mcafee.McAfeePlugin attribute) (dissect.target.plugins.apps.av.sophos.SophosPlugin attribute) (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) (dissect.target.plugins.apps.av.trendmicro.TrendMicroPlugin attribute) (dissect.target.plugins.apps.browser.brave.BravePlugin attribute) (dissect.target.plugins.apps.browser.browser.BrowserPlugin attribute) (dissect.target.plugins.apps.browser.chrome.ChromePlugin attribute) (dissect.target.plugins.apps.browser.chromium.ChromiumPlugin attribute) (dissect.target.plugins.apps.browser.edge.EdgePlugin attribute) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin attribute) (dissect.target.plugins.apps.browser.iexplore.InternetExplorerPlugin attribute) (dissect.target.plugins.apps.browser.safari.SafariPlugin attribute) (dissect.target.plugins.apps.chat.chat.ChatPlugin attribute) (dissect.target.plugins.apps.chat.msn.MSNPlugin attribute) (dissect.target.plugins.apps.container.container.ContainerPlugin attribute) (dissect.target.plugins.apps.container.docker.DockerPlugin attribute) (dissect.target.plugins.apps.container.podman.PodmanPlugin attribute) (dissect.target.plugins.apps.editor.editor.EditorPlugin attribute) (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadPlugin attribute) (dissect.target.plugins.apps.edr.acquire.AcquirePlugin attribute) (dissect.target.plugins.apps.edr.velociraptor.VelociraptorPlugin attribute) (dissect.target.plugins.apps.productivity.msoffice.MSOffice attribute) (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin attribute) (dissect.target.plugins.apps.remoteaccess.remoteaccess.RemoteAccessPlugin attribute) (dissect.target.plugins.apps.remoteaccess.rustdesk.RustdeskPlugin attribute) (dissect.target.plugins.apps.remoteaccess.splashtop.SplashtopPlugin attribute) (dissect.target.plugins.apps.remoteaccess.teamviewer.TeamViewerPlugin attribute) (dissect.target.plugins.apps.shell.wget.WgetPlugin attribute) (dissect.target.plugins.apps.ssh.openssh.OpenSSHPlugin attribute) (dissect.target.plugins.apps.ssh.opensshd.SSHServerPlugin attribute) (dissect.target.plugins.apps.ssh.putty.PuTTYPlugin attribute) (dissect.target.plugins.apps.ssh.ssh.SSHPlugin attribute) (dissect.target.plugins.apps.virtualization.vmware_workstation.VmwareWorkstationPlugin attribute) (dissect.target.plugins.apps.vpn.openvpn.OpenVPNPlugin attribute) (dissect.target.plugins.apps.vpn.wireguard.WireGuardPlugin attribute) (dissect.target.plugins.apps.webhosting.cpanel.CPanelPlugin attribute) (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) (dissect.target.plugins.apps.webserver.caddy.CaddyPlugin attribute) (dissect.target.plugins.apps.webserver.citrix.CitrixWebserverPlugin attribute) (dissect.target.plugins.apps.webserver.iis.IISLogsPlugin attribute) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin attribute) (dissect.target.plugins.apps.webserver.webserver.WebserverPlugin attribute) (dissect.target.plugins.filesystem.ntfs.mft.MftPlugin attribute) (dissect.target.plugins.general.example.ExampleNamespacePlugin attribute) (dissect.target.plugins.general.users.UsersPlugin attribute) (dissect.target.plugins.os.default.datetime.DateTimePlugin attribute) (dissect.target.plugins.os.default.network.NetworkPlugin attribute) (dissect.target.plugins.os.unix.datetime.UnixDateTimePlugin attribute) (dissect.target.plugins.os.unix.esxi.configstore.ConfigstorePlugin attribute) (dissect.target.plugins.os.unix.esxi.esxconf.EsxConfPlugin attribute) (dissect.target.plugins.os.unix.esxi.vm.VirtualMachinePlugin attribute) (dissect.target.plugins.os.unix.etc.etc.EtcTree attribute) (dissect.target.plugins.os.unix.linux.debian.apt.AptPlugin attribute) (dissect.target.plugins.os.unix.linux.debian.dpkg.DpkgPlugin attribute) (dissect.target.plugins.os.unix.linux.proc.ProcPlugin attribute) (dissect.target.plugins.os.unix.linux.redhat.yum.YumPlugin attribute) (dissect.target.plugins.os.unix.linux.sockets.NetSocketPlugin attribute) (dissect.target.plugins.os.unix.linux.suse.zypper.ZypperPlugin attribute) (dissect.target.plugins.os.unix.locate.gnulocate.GNULocatePlugin attribute) (dissect.target.plugins.os.unix.locate.locate.BaseLocatePlugin attribute) (dissect.target.plugins.os.unix.locate.mlocate.MLocatePlugin attribute) (dissect.target.plugins.os.unix.locate.plocate.PLocatePlugin attribute) (dissect.target.plugins.os.unix.packagemanager.PackageManagerPlugin attribute) (dissect.target.plugins.os.windows.ad.ntds.NtdsPlugin attribute) (dissect.target.plugins.os.windows.amcache.AmcachePlugin attribute) (dissect.target.plugins.os.windows.amcache.AmcachePluginOldMixin attribute) (dissect.target.plugins.os.windows.cam.CamPlugin attribute) (dissect.target.plugins.os.windows.catroot.CatrootPlugin attribute) (dissect.target.plugins.os.windows.certlog.CertLogPlugin attribute) (dissect.target.plugins.os.windows.cim.CimPlugin attribute) (dissect.target.plugins.os.windows.credential.credential.WindowsCredentialPlugin attribute) (dissect.target.plugins.os.windows.credential.credhist.CredHistPlugin attribute) (dissect.target.plugins.os.windows.credential.defaultpassword.DefaultPasswordPlugin attribute) (dissect.target.plugins.os.windows.credential.winlogon.WinlogonPlugin attribute) (dissect.target.plugins.os.windows.datetime.WindowsDateTimePlugin attribute) (dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin attribute) (dissect.target.plugins.os.windows.dpapi.keyprovider.credhist.CredHistKeyProviderPlugin attribute) (dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.defaultpassword.DefaultPasswordKeyProvider attribute) (dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.lsa.LSADefaultPasswordKeyProviderPlugin attribute) (dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.winlogon.WinlogonDefaultPasswordKeyProviderPlugin attribute) (dissect.target.plugins.os.windows.dpapi.keyprovider.empty.EmptyKeyProviderPlugin attribute) (dissect.target.plugins.os.windows.dpapi.keyprovider.keychain.KeychainKeyProviderPlugin attribute) (dissect.target.plugins.os.windows.dpapi.keyprovider.keyprovider.KeyProviderPlugin attribute) (dissect.target.plugins.os.windows.exchange.exchange.ExchangePlugin attribute) (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin attribute) (dissect.target.plugins.os.windows.jumplist.JumpListPlugin attribute) (dissect.target.plugins.os.windows.log.etl.EtlPlugin attribute) (dissect.target.plugins.os.windows.log.mssql.MssqlPlugin attribute) (dissect.target.plugins.os.windows.lsa.LSAPlugin attribute) (dissect.target.plugins.os.windows.notifications.NotificationsPlugin attribute) (dissect.target.plugins.os.windows.rdpcache.RdpCachePlugin attribute) (dissect.target.plugins.os.windows.regf.cit.CITPlugin attribute) (dissect.target.plugins.os.windows.regf.clsid.CLSIDPlugin attribute) (dissect.target.plugins.os.windows.regf.mru.MRUPlugin attribute) (dissect.target.plugins.os.windows.registry.RegistryPlugin attribute) (dissect.target.plugins.os.windows.sru.SRUPlugin attribute) (dissect.target.plugins.os.windows.thumbcache.ThumbcachePlugin attribute) (dissect.target.plugins.os.windows.ual.UalPlugin attribute) (dissect.target.plugins.scrape.scrape.ScrapePlugin attribute) __ne__() (dissect.cstruct.parser.Token method) (dissect.cstruct.types.enum.Enum method) (dissect.cstruct.types.flag.Flag method) (dissect.database.ese.record.Record method) (dissect.target.helpers.fsutil.stat_result method) (dissect.vmfs.address.Address method) (flow.record.selector.NoneObject method) (flow.record.selector.TypeMatcherInstance method) __next__() (dissect.target.helpers.configutil.PeekableIterator method) __noteq__() (flow.record.selector.NoneObject method) (flow.record.selector.TypeMatcherInstance method) __object_class__ (dissect.database.ese.ntds.objects.applicationsettings.ApplicationSettings attribute) (dissect.database.ese.ntds.objects.attributeschema.AttributeSchema attribute) (dissect.database.ese.ntds.objects.builtindomain.BuiltinDomain attribute) (dissect.database.ese.ntds.objects.certificationauthority.CertificationAuthority attribute) (dissect.database.ese.ntds.objects.classschema.ClassSchema attribute) (dissect.database.ese.ntds.objects.classstore.ClassStore attribute) (dissect.database.ese.ntds.objects.computer.Computer attribute) (dissect.database.ese.ntds.objects.configuration.Configuration attribute) (dissect.database.ese.ntds.objects.container.Container attribute) (dissect.database.ese.ntds.objects.controlaccessright.ControlAccessRight attribute) (dissect.database.ese.ntds.objects.crldistributionpoint.CRLDistributionPoint attribute) (dissect.database.ese.ntds.objects.crossref.CrossRef attribute) (dissect.database.ese.ntds.objects.crossrefcontainer.CrossRefContainer attribute) (dissect.database.ese.ntds.objects.dfsconfiguration.DfsConfiguration attribute) (dissect.database.ese.ntds.objects.displayspecifier.DisplaySpecifier attribute) (dissect.database.ese.ntds.objects.dmd.DMD attribute) (dissect.database.ese.ntds.objects.dnsnode.DnsNode attribute) (dissect.database.ese.ntds.objects.dnszone.DnsZone attribute) (dissect.database.ese.ntds.objects.domain.Domain attribute) (dissect.database.ese.ntds.objects.domaindns.DomainDNS attribute) (dissect.database.ese.ntds.objects.domainpolicy.DomainPolicy attribute) (dissect.database.ese.ntds.objects.dsuisettings.DSUISettings attribute) (dissect.database.ese.ntds.objects.filelinktracking.FileLinkTracking attribute) (dissect.database.ese.ntds.objects.foreignsecurityprincipal.ForeignSecurityPrincipal attribute) (dissect.database.ese.ntds.objects.group.Group attribute) (dissect.database.ese.ntds.objects.grouppolicycontainer.GroupPolicyContainer attribute) (dissect.database.ese.ntds.objects.infrastructureupdate.InfrastructureUpdate attribute) (dissect.database.ese.ntds.objects.intersitetransport.InterSiteTransport attribute) (dissect.database.ese.ntds.objects.intersitetransportcontainer.InterSiteTransportContainer attribute) (dissect.database.ese.ntds.objects.ipsecbase.IpsecBase attribute) (dissect.database.ese.ntds.objects.ipsecfilter.IpsecFilter attribute) (dissect.database.ese.ntds.objects.ipsecisakmppolicy.IpsecISAKMPPolicy attribute) (dissect.database.ese.ntds.objects.ipsecnegotiationpolicy.IpsecNegotiationPolicy attribute) (dissect.database.ese.ntds.objects.ipsecnfa.IpsecNFA attribute) (dissect.database.ese.ntds.objects.ipsecpolicy.IpsecPolicy attribute) (dissect.database.ese.ntds.objects.leaf.Leaf attribute) (dissect.database.ese.ntds.objects.linktrackobjectmovetable.LinkTrackObjectMoveTable attribute) (dissect.database.ese.ntds.objects.linktrackvolumetable.LinkTrackVolumeTable attribute) (dissect.database.ese.ntds.objects.locality.Locality attribute) (dissect.database.ese.ntds.objects.lostandfound.LostAndFound attribute) (dissect.database.ese.ntds.objects.msauthz_centralaccesspolicies.MSAuthzCentralAccessPolicies attribute) (dissect.database.ese.ntds.objects.msauthz_centralaccessrules.MSAuthzCentralAccessRules attribute) (dissect.database.ese.ntds.objects.msdfsr_content.MSDFSRContent attribute) (dissect.database.ese.ntds.objects.msdfsr_contentset.MSDFSRContentSet attribute) (dissect.database.ese.ntds.objects.msdfsr_globalsettings.MSDFSRGlobalSettings attribute) (dissect.database.ese.ntds.objects.msdfsr_localsettings.MSDFSRLocalSettings attribute) (dissect.database.ese.ntds.objects.msdfsr_member.MSDFSRMember attribute) (dissect.database.ese.ntds.objects.msdfsr_replicationgroup.MSDFSRReplicationGroup attribute) (dissect.database.ese.ntds.objects.msdfsr_subscriber.MSDFSRSubscriber attribute) (dissect.database.ese.ntds.objects.msdfsr_subscription.MSDFSRSubscription attribute) (dissect.database.ese.ntds.objects.msdfsr_topology.MSDFSRTopology attribute) (dissect.database.ese.ntds.objects.msdns_serversettings.MSDNSServerSettings attribute) (dissect.database.ese.ntds.objects.msds_authnpolicies.MSDSAuthNPolicies attribute) (dissect.database.ese.ntds.objects.msds_authnpolicysilos.MSDSAuthNPolicySilos attribute) (dissect.database.ese.ntds.objects.msds_claimstransformationpolicies.MSDSClaimsTransformationPolicies attribute) (dissect.database.ese.ntds.objects.msds_claimtype.MSDSClaimType attribute) (dissect.database.ese.ntds.objects.msds_claimtypepropertybase.MSDSClaimTypePropertyBase attribute) (dissect.database.ese.ntds.objects.msds_claimtypes.MSDSClaimTypes attribute) (dissect.database.ese.ntds.objects.msds_optionalfeature.MSDSOptionalFeature attribute) (dissect.database.ese.ntds.objects.msds_passwordsettingscontainer.MSDSPasswordSettingsContainer attribute) (dissect.database.ese.ntds.objects.msds_quotacontainer.MSDSQuotaContainer attribute) (dissect.database.ese.ntds.objects.msds_resourceproperties.MSDSResourceProperties attribute) (dissect.database.ese.ntds.objects.msds_resourceproperty.MSDSResourceProperty attribute) (dissect.database.ese.ntds.objects.msds_resourcepropertylist.MSDSResourcePropertyList attribute) (dissect.database.ese.ntds.objects.msds_shadowprincipalcontainer.MSDSShadowPrincipalContainer attribute) (dissect.database.ese.ntds.objects.msds_valuetype.MSDSValueType attribute) (dissect.database.ese.ntds.objects.msimaging_psps.MSImagingPSPs attribute) (dissect.database.ese.ntds.objects.mskds_provserverconfiguration.MSKDSProvServerConfiguration attribute) (dissect.database.ese.ntds.objects.msmqenterprisesettings.MSMQEnterpriseSettings attribute) (dissect.database.ese.ntds.objects.mspki_enterpriseoid.MSPKIEnterpriseOID attribute) (dissect.database.ese.ntds.objects.mspki_privatekeyrecoveryagent.MSPKIPrivateKeyRecoveryAgent attribute) (dissect.database.ese.ntds.objects.msspp_activationobjectscontainer.MSSPPActivationObjectsContainer attribute) (dissect.database.ese.ntds.objects.mstpm_informationobjectscontainer.MSTPMInformationObjectsContainer attribute) (dissect.database.ese.ntds.objects.ntdsconnection.NTDSConnection attribute) (dissect.database.ese.ntds.objects.ntdsdsa.NTDSDSA attribute) (dissect.database.ese.ntds.objects.ntdsservice.NTDSService attribute) (dissect.database.ese.ntds.objects.ntdssitesettings.NTDSSiteSettings attribute) (dissect.database.ese.ntds.objects.ntfrssettings.NTFRSSettings attribute) (dissect.database.ese.ntds.objects.object.Object attribute) (dissect.database.ese.ntds.objects.organizationalperson.OrganizationalPerson attribute) (dissect.database.ese.ntds.objects.organizationalunit.OrganizationalUnit attribute) (dissect.database.ese.ntds.objects.person.Person attribute) (dissect.database.ese.ntds.objects.physicallocation.PhysicalLocation attribute) (dissect.database.ese.ntds.objects.pkicertificatetemplate.PKICertificateTemplate attribute) (dissect.database.ese.ntds.objects.pkienrollmentservice.PKIEnrollmentService attribute) (dissect.database.ese.ntds.objects.querypolicy.QueryPolicy attribute) (dissect.database.ese.ntds.objects.ridmanager.RIDManager attribute) (dissect.database.ese.ntds.objects.ridset.RIDSet attribute) (dissect.database.ese.ntds.objects.rpccontainer.RpcContainer attribute) (dissect.database.ese.ntds.objects.rrasadministrationdictionary.RRASAdministrationDictionary attribute) (dissect.database.ese.ntds.objects.samserver.SamServer attribute) (dissect.database.ese.ntds.objects.secret.Secret attribute) (dissect.database.ese.ntds.objects.securityobject.SecurityObject attribute) (dissect.database.ese.ntds.objects.server.Server attribute) (dissect.database.ese.ntds.objects.serverscontainer.ServersContainer attribute) (dissect.database.ese.ntds.objects.site.Site attribute) (dissect.database.ese.ntds.objects.sitelink.SiteLink attribute) (dissect.database.ese.ntds.objects.sitescontainer.SitesContainer attribute) (dissect.database.ese.ntds.objects.subnetcontainer.SubnetContainer attribute) (dissect.database.ese.ntds.objects.subschema.SubSchema attribute) (dissect.database.ese.ntds.objects.top.Top attribute) (dissect.database.ese.ntds.objects.trusteddomain.TrustedDomain attribute) (dissect.database.ese.ntds.objects.user.User attribute) __or__() (dissect.cstruct.types.pointer.Pointer method) __os__ (dissect.target.plugin.FunctionDescriptorLookup attribute) (dissect.target.plugin.PluginDescriptorLookup attribute) __ostree__ (dissect.target.plugin.PluginRegistry attribute) __path__ (in module flow.record.adapter) __plugins__ (dissect.target.plugin.PluginRegistry attribute) __post_init__() (dissect.hypervisor.disk.vmdk.ExtentDescriptor method) (dissect.target.helpers.nfs.nfs3.CookieVerf method) (dissect.target.helpers.nfs.nfs3.FileHandle method) (dissect.target.helpers.sunrpc.sunrpc.AuthUnix method) (dissect.target.plugins.os.windows.firewall.LogConfig method) (dissect.target.tools.dump.Sink method) __pow__() (dissect.cstruct.types.pointer.Pointer method) __record_descriptors__ (dissect.target.plugin.Plugin attribute) __reduce__() (dissect.target.helpers.compat.path_310.PureDissectPath method) (dissect.target.helpers.compat.path_311.PureDissectPath method) (dissect.target.helpers.compat.path_312.PureDissectPath method) (dissect.target.helpers.compat.path_313.PureDissectPath method) __register__ (dissect.target.loaders.cb.CbRegistry attribute) (dissect.target.loaders.smb.SmbRegistry attribute) (dissect.target.plugin.Plugin attribute) __regular__ (dissect.target.plugin.FunctionDescriptorLookup attribute) (dissect.target.plugin.PluginDescriptorLookup attribute) __repr__() (acquire.acquire.dynamic.windows.named_objects.NamedObject method) (dissect.apfs.objects.base.Object method) (dissect.apfs.objects.btree.BTree method) (dissect.apfs.objects.btree_node.BTreeNode method) (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.FS method) (dissect.apfs.objects.fs.INode method) (dissect.apfs.objects.fs.Snapshot method) (dissect.apfs.objects.fs.XAttr method) (dissect.apfs.objects.keybag.KEK method) (dissect.apfs.objects.keybag.VEK method) (dissect.archive.vbk.Bank method) (dissect.archive.vbk.DirItem method) (dissect.archive.vbk.ExtFibItem method) (dissect.archive.vbk.FibBlockDescriptor method) (dissect.archive.vbk.FibBlockDescriptorV7 method) (dissect.archive.vbk.IncrementItem method) (dissect.archive.vbk.IntFibItem method) (dissect.archive.vbk.MetaBlob method) (dissect.archive.vbk.MetaTableDescriptor method) (dissect.archive.vbk.MetaVector method) (dissect.archive.vbk.PatchItem method) (dissect.archive.vbk.RootDirectory method) (dissect.archive.vbk.SnapshotSlot method) (dissect.archive.vbk.StgBlockDescriptor method) (dissect.archive.vbk.StgBlockDescriptorV7 method) (dissect.archive.vbk.SubFolderItem method) (dissect.archive.vma.Device method) (dissect.archive.vma.Extent method) (dissect.archive.wim.DirectoryEntry method) (dissect.archive.wim.Image method) (dissect.btrfs.btrfs.INode method) (dissect.btrfs.btrfs.Subvolume method) (dissect.cim.cim.Namespace method) (dissect.cim.classes.PropertyReference method) (dissect.cim.classes.QualifierReference method) (dissect.cim.index.Key method) (dissect.cramfs.cramfs.INode method) (dissect.cstruct.expression.Expression method) (dissect.cstruct.parser.Token method) (dissect.cstruct.parser.TokenConsumer method) (dissect.cstruct.types.enum.Enum method) (dissect.cstruct.types.flag.Flag method) (dissect.cstruct.types.pointer.Pointer method) (dissect.cstruct.types.structure.Field method) (dissect.cstruct.types.structure.Structure method) (dissect.cstruct.types.structure.StructureValuesProxy method) (dissect.cstruct.types.structure.UnionProxy method) (dissect.database.bsd.tools.rpm.Package method) (dissect.database.ese.index.Index method) (dissect.database.ese.ntds.objects.object.Object method) (dissect.database.ese.ntds.sd.ACE method) (dissect.database.ese.ntds.sd.ACL method) (dissect.database.ese.ntds.sd.SecurityDescriptor method) (dissect.database.ese.page.BranchNode method) (dissect.database.ese.page.LeafNode method) (dissect.database.ese.page.Page method) (dissect.database.ese.page.Tag method) (dissect.database.ese.record.Record method) (dissect.database.ese.record.TagField method) (dissect.database.ese.table.Column method) (dissect.database.ese.table.Table method) (dissect.database.ese.tools.sru.Entry method) (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher method) (dissect.database.sqlite3.sqlite3.Cell method) (dissect.database.sqlite3.sqlite3.Column method) (dissect.database.sqlite3.sqlite3.Index method) (dissect.database.sqlite3.sqlite3.Page method) (dissect.database.sqlite3.sqlite3.Row method) (dissect.database.sqlite3.sqlite3.SQLite3 method) (dissect.database.sqlite3.sqlite3.Table method) (dissect.database.sqlite3.wal.Frame method) (dissect.etl.etl.Event method) (dissect.etl.etl.EventRecord method) (dissect.etl.headers.event.EventHeaderExtendedDataItem method) (dissect.etl.headers.headers.Header method) (dissect.eventlog.bxml.BxmlSub method) (dissect.eventlog.wevt.WEVT method) (dissect.eventlog.wevt_object.WevtObject method) (dissect.evidence.ad1.ad1.FileEntry method) (dissect.evidence.ad1.ad1.FileMeta method) (dissect.evidence.ad1.ad1.LogicalImage method) (dissect.evidence.ad1.ad1.SegmentFile method) (dissect.evidence.ewf.ewf.HeaderSection method) (dissect.evidence.ewf.ewf.SectionDescriptor method) (dissect.executable.elf.elf.ELF method) (dissect.executable.elf.elf.Section method) (dissect.executable.elf.elf.SectionTable method) (dissect.executable.elf.elf.Segment method) (dissect.executable.elf.elf.SegmentTable method) (dissect.executable.elf.elf.Symbol method) (dissect.executable.pe.directory.base.DataDirectory method) (dissect.executable.pe.directory.basereloc.BaseRelocation method) (dissect.executable.pe.directory.basereloc.BaseRelocationDirectory method) (dissect.executable.pe.directory.bound_import.BoundImportDirectory method) (dissect.executable.pe.directory.com_descriptor.ComStream method) (dissect.executable.pe.directory.debug.CodeViewDebugEntry method) (dissect.executable.pe.directory.debug.DebugDirectory method) (dissect.executable.pe.directory.debug.DebugEntry method) (dissect.executable.pe.directory.debug.PogoDebugEntry method) (dissect.executable.pe.directory.debug.ReproDebugEntry method) (dissect.executable.pe.directory.debug.VcFeatureDebugEntry method) (dissect.executable.pe.directory.delay_import.DelayImportDirectory method) (dissect.executable.pe.directory.delay_import.DelayImportFunction method) (dissect.executable.pe.directory.delay_import.DelayImportModule method) (dissect.executable.pe.directory.exception.ExceptionDirectory method) (dissect.executable.pe.directory.export.ExportDirectory method) (dissect.executable.pe.directory.export.ExportFunction method) (dissect.executable.pe.directory.iat.IatDirectory method) (dissect.executable.pe.directory.imports.ImportDirectory method) (dissect.executable.pe.directory.imports.ImportFunction method) (dissect.executable.pe.directory.imports.ImportModule method) (dissect.executable.pe.directory.resource.Resource method) (dissect.executable.pe.directory.resource.ResourceDataEntry method) (dissect.executable.pe.directory.resource.ResourceDirectory method) (dissect.executable.pe.directory.resource.ResourceDirectoryEntry method) (dissect.executable.pe.directory.security.Certificate method) (dissect.executable.pe.directory.security.SecurityDirectory method) (dissect.executable.pe.directory.tls.TlsDirectory method) (dissect.executable.pe.pe.Section method) (dissect.extfs.extfs.INode method) (dissect.extfs.extfs.XAttr method) (dissect.extfs.journal.CommitBlock method) (dissect.extfs.journal.DescriptorBlock method) (dissect.extfs.journal.DescriptorBlockTag method) (dissect.fat.fat.DirectoryEntry method) (dissect.ffs.ffs.INode method) (dissect.fve.bde.eow.EowBitmap method) (dissect.fve.bde.eow.EowBitmapRecord method) (dissect.fve.bde.information.AesCbc256HmacSha512EncryptedDatum method) (dissect.fve.bde.information.AesCcmEncryptedDatum method) (dissect.fve.bde.information.AsymmetricEncryptedDatum method) (dissect.fve.bde.information.BackupInfoDatum method) (dissect.fve.bde.information.ConcatHashKeyDatum method) (dissect.fve.bde.information.Datum method) (dissect.fve.bde.information.ErrorLogDatum method) (dissect.fve.bde.information.ExportedPublicKeyDatum method) (dissect.fve.bde.information.ExternalInfoDatum method) (dissect.fve.bde.information.GuidDatum method) (dissect.fve.bde.information.Information method) (dissect.fve.bde.information.KeyDatum method) (dissect.fve.bde.information.PublicKeyInfoDatum method) (dissect.fve.bde.information.SimpleDatum method) (dissect.fve.bde.information.SimpleLargeDatum method) (dissect.fve.bde.information.StretchKeyDatum method) (dissect.fve.bde.information.TpmEncryptedBlobDatum method) (dissect.fve.bde.information.UnicodeDatum method) (dissect.fve.bde.information.UpdateDatum method) (dissect.fve.bde.information.UseKeyDatum method) (dissect.fve.bde.information.ValidationEntry method) (dissect.fve.bde.information.ValidationInfoDatum method) (dissect.fve.bde.information.VirtualizationInfoDatum method) (dissect.fve.bde.information.VmkInfoDatum method) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry method) (dissect.hypervisor.descriptor.vbox.HardDisk method) (dissect.hypervisor.descriptor.vbox.Hardware method) (dissect.hypervisor.descriptor.vbox.Machine method) (dissect.hypervisor.descriptor.vbox.Snapshot method) (dissect.hypervisor.descriptor.vbox.VBox method) (dissect.hypervisor.descriptor.vmx.Pair method) (dissect.hypervisor.descriptor.vmx.Phrase method) (dissect.hypervisor.disk.asif.Directory method) (dissect.hypervisor.disk.asif.Table method) (dissect.hypervisor.disk.vmdk.ExtentDescriptor method) (dissect.jffs.jffs2.INode method) (dissect.ntfs.attr.Attribute method) (dissect.ntfs.attr.AttributeHeader method) (dissect.ntfs.attr.AttributeList method) (dissect.ntfs.attr.FileName method) (dissect.ntfs.attr.ReparsePoint method) (dissect.ntfs.attr.StandardInformation method) (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.secure.ACE method) (dissect.ntfs.usnjrnl.UsnRecord method) (dissect.ole.ole.DirectoryEntry method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.regf.regf.KeyNode method) (dissect.regf.regf.KeyValue method) (dissect.shellitem.lnk.lnk.Lnk method) (dissect.shellitem.lnk.lnk.LnkExtraData method) (dissect.shellitem.lnk.lnk.LnkInfo method) (dissect.shellitem.lnk.lnk.LnkStringData method) (dissect.shellitem.lnk.lnk.LnkTargetIdList method) (dissect.squashfs.squashfs.INode method) (dissect.target.container.Container method) (dissect.target.filesystem.DirEntry method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystems.apfs.ApfsFilesystem method) (dissect.target.filesystems.apfs.ApfsVolumeFilesystem method) (dissect.target.filesystems.dir.DirectoryFilesystem method) (dissect.target.filesystems.overlay.Overlay2Filesystem method) (dissect.target.filesystems.overlay.OverlayFilesystem method) (dissect.target.helpers.fsutil.stat_result method) (dissect.target.helpers.lazy.LazyAttr method) (dissect.target.helpers.lazy.LazyImport method) (dissect.target.helpers.regutil.RegistryKey method) (dissect.target.helpers.regutil.RegistryValue method) (dissect.target.helpers.regutil.VirtualHive method) (dissect.target.loader.Loader method) (dissect.target.loaders.cellebrite.CellebriteFilesystem method) (dissect.target.loaders.direct.DirectLoader method) (dissect.target.loaders.itunes.FileInfo method) (dissect.target.loaders.res.File method) (dissect.target.loaders.res.Folder method) (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadTab method) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager method) (dissect.target.plugins.os.windows.credential.credhist.CredHistFile method) (dissect.target.plugins.os.windows.datetime.WindowsTimezone method) (dissect.target.plugins.os.windows.dpapi.blob.Blob method) (dissect.target.plugins.os.windows.everything.parser.EverythingDB method) (dissect.target.plugins.os.windows.regf.cit.Entry method) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK method) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM method) (dissect.target.target.Collection method) (dissect.target.target.Target method) (dissect.target.volume.Volume method) (dissect.target.volume.VolumeSystem method) (dissect.thumbcache.index.IndexEntry method) (dissect.thumbcache.thumbcache_file.ThumbcacheEntry method) (dissect.util.ldap.SearchFilter method) (dissect.util.plist.NSDictionary method) (dissect.util.plist.NSKeyedArchiver method) (dissect.util.plist.NSObject method) (dissect.vmfs.address.Address method) (dissect.vmfs.address.FileBlockAddr method) (dissect.vmfs.address.FileDescriptorAddr method) (dissect.vmfs.address.JournalBlockAddr method) (dissect.vmfs.address.LargeFileBlockAddr method) (dissect.vmfs.address.PointerBlock2Addr method) (dissect.vmfs.address.PointerBlock2Addr64 method) (dissect.vmfs.address.PointerBlockAddr method) (dissect.vmfs.address.PointerBlockAddr64 method) (dissect.vmfs.address.SmallFileBlockAddr method) (dissect.vmfs.address.SubBlockAddr method) (dissect.vmfs.address.SubBlockAddr64 method) (dissect.vmfs.descriptor.DirEntry method) (dissect.vmfs.descriptor.FileDescriptor method) (dissect.vmfs.lvm.Device method) (dissect.vmfs.lvm.LVM method) (dissect.vmfs.lvm.Volume method) (dissect.vmfs.resource.ResourceManager method) (dissect.volume.ddf.ddf.ControllerData method) (dissect.volume.ddf.ddf.DDFPhysicalDisk method) (dissect.volume.ddf.ddf.PhysicalDiskData method) (dissect.volume.ddf.ddf.PhysicalDiskRecord method) (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord method) (dissect.volume.ddf.ddf.VirtualDiskRecord method) (dissect.volume.disk.partition.Partition method) (dissect.volume.lvm.lvm2.LVM2 method) (dissect.volume.lvm.metadata.HistoricalLogicalVolume method) (dissect.volume.lvm.metadata.LogicalVolume method) (dissect.volume.lvm.metadata.PhysicalVolume method) (dissect.volume.lvm.metadata.Segment method) (dissect.volume.lvm.metadata.VolumeGroup method) (dissect.volume.lvm.physical.LVM2Device method) (dissect.volume.vss.BlockDescriptor method) (dissect.volume.vss.Catalog method) (dissect.volume.vss.VSS method) (dissect.xfs.xfs.INode method) (flow.record.base.GroupedRecord method) (flow.record.base.Record method) (flow.record.base.RecordDescriptor method) (flow.record.base.RecordField method) (flow.record.fieldtypes.boolean method) (flow.record.fieldtypes.command method) (flow.record.fieldtypes.datetime method) (flow.record.fieldtypes.digest method) (flow.record.fieldtypes.filesize method) (flow.record.fieldtypes.net.ip.ipaddress method) (flow.record.fieldtypes.net.ip.ipinterface method) (flow.record.fieldtypes.net.ip.ipnetwork method) (flow.record.fieldtypes.net.ipv4.address method) (flow.record.fieldtypes.net.ipv4.subnet method) (flow.record.fieldtypes.path method) (flow.record.fieldtypes.Record method) (flow.record.fieldtypes.uint16 method) (flow.record.fieldtypes.unix_file_mode method) (flow.record.fieldtypes.windows_path method) (flow.record.selector.CompiledSelector method) (flow.record.selector.Selector method) (flow.record.selector.WrappedRecord method) __repr_body__() (dissect.database.ese.ntds.objects.computer.Computer method) (dissect.database.ese.ntds.objects.object.Object method) (dissect.database.ese.ntds.objects.top.Top method) (dissect.database.ese.ntds.objects.user.User method) __repr_suffix__() (dissect.database.ese.ntds.objects.object.Object method) __rshift__() (dissect.cstruct.types.pointer.Pointer method) __rtruediv__() (dissect.target.helpers.compat.path_310.PureDissectPath method) (dissect.target.helpers.compat.path_311.PureDissectPath method) __setattr__() (dissect.cim.classes.InstanceKey method) (dissect.cstruct.types.structure.Union method) (dissect.cstruct.types.structure.UnionProxy method) (flow.record.base.GroupedRecord method) (flow.record.base.Record method) (flow.record.fieldtypes.Record method) __setitem__() (dissect.cstruct.types.structure.StructureValuesProxy method) (dissect.eventlog.utils.KeyValueCollection method) (dissect.target.plugins.apps.vpn.wireguard.MultiDict method) __signature__ (dissect.regf.regf.BigData attribute) (dissect.regf.regf.Cell attribute) (dissect.regf.regf.FastLeaf attribute) (dissect.regf.regf.HashLeaf attribute) (dissect.regf.regf.IndexLeaf attribute) (dissect.regf.regf.IndexRoot attribute) (dissect.regf.regf.KeyNode attribute) (dissect.regf.regf.KeySecurity attribute) (dissect.regf.regf.KeyValue attribute) __sizes__ (dissect.cstruct.types.structure.Structure property) __slots__ (acquire.acquire.dynamic.windows.named_objects.NamedObject attribute) (dissect.archive.wim.Resource attribute) (dissect.cstruct.parser.Token attribute) (dissect.cstruct.types.wchar.Wchar attribute) (dissect.cstruct.types.wchar.WcharArray attribute) (dissect.database.ese.ntds.util.DN attribute) (dissect.database.ese.page.BranchNode attribute) (dissect.database.ese.page.Node attribute) (dissect.database.ese.page.Tag attribute) (dissect.database.ese.record.TagField attribute) (dissect.etl.etl.Event attribute) (dissect.etl.etl.EventRecord attribute) (dissect.etl.headers.event.EventDescriptor attribute) (dissect.etl.headers.event.EventHeaderExtendedDataItem attribute) (dissect.eventlog.wevt_object.BMAP attribute) (dissect.eventlog.wevt_object.CHAN attribute) (dissect.eventlog.wevt_object.EVNT attribute) (dissect.eventlog.wevt_object.KEYW attribute) (dissect.eventlog.wevt_object.LEVL attribute) (dissect.eventlog.wevt_object.OPCO attribute) (dissect.eventlog.wevt_object.PRVA attribute) (dissect.eventlog.wevt_object.TASK attribute) (dissect.eventlog.wevt_object.TEMP attribute) (dissect.eventlog.wevt_object.TEMP_DESCRIPTOR attribute) (dissect.eventlog.wevt_object.VMAP attribute) (dissect.ntfs.attr.Attribute attribute) (dissect.ntfs.attr.AttributeHeader attribute) (dissect.ntfs.attr.AttributeList attribute) (dissect.ntfs.attr.AttributeRecord attribute) (dissect.ntfs.attr.FileName attribute) (dissect.ntfs.attr.ReparsePoint attribute) (dissect.ntfs.attr.StandardInformation attribute) (dissect.target.helpers.compat.path_310.TargetPath attribute) (dissect.target.helpers.compat.path_311.TargetPath attribute) (dissect.target.helpers.compat.path_312.TargetPath attribute) (dissect.target.helpers.compat.path_313.TargetPath attribute) (dissect.target.helpers.fsutil.stat_result attribute) (dissect.thumbcache.thumbcache_file.ThumbcacheFile attribute) (dissect.util.compression.lzxpress_huffman.Node attribute) (dissect.volume.vss.BlockDescriptor attribute) (flow.record.base.Record attribute) (flow.record.fieldtypes.Record attribute) (flow.record.fieldtypes.string attribute) (flow.record.selector.WrappedRecord attribute) __static_sizes__ (dissect.cstruct.types.structure.StructureMetaType attribute) __str__() (acquire.acquire.dynamic.windows.types.UNICODE_STRING method) (dissect.cim.classes.InstanceKey method) (dissect.cim.index.Key method) (dissect.cstruct.types.flag.Flag method) (dissect.cstruct.types.pointer.Pointer method) (dissect.database.ese.record.Record method) (dissect.eventlog.bxml.BxmlSub method) (dissect.eventlog.bxml.BxmlTag method) (dissect.eventlog.bxml.BxmlType method) (dissect.eventlog.bxml.Template method) (dissect.hypervisor.disk.vmdk.DiskDescriptor method) (dissect.hypervisor.disk.vmdk.ExtentDescriptor method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystems.nfs.AuthFlavorNotSupported method) (dissect.target.helpers.nfs.client.mount.MountError method) (dissect.target.helpers.nfs.client.nfs.NfsError method) (flow.record.fieldtypes.boolean method) (flow.record.fieldtypes.datetime method) (flow.record.fieldtypes.net.ip.ipaddress method) (flow.record.fieldtypes.net.ip.ipinterface method) (flow.record.fieldtypes.net.ip.ipnetwork method) (flow.record.fieldtypes.net.ipv4.address method) (flow.record.fieldtypes.net.ipv4.subnet method) (flow.record.fieldtypes.path method) (flow.record.selector.CompiledSelector method) (flow.record.selector.Selector method) (flow.record.selector.WrappedRecord method) __struct__ (dissect.apfs.objects.base.Object attribute) (dissect.apfs.objects.btree_node.BTreeNode attribute) (dissect.apfs.objects.checkpoint_map.CheckpointMap attribute) (dissect.apfs.objects.efi_jumpstart.EfiJumpstart attribute) (dissect.apfs.objects.er_recovery_block.EncryptionRollingRecoveryBlock attribute) (dissect.apfs.objects.er_state.EncryptionRollingState attribute) (dissect.apfs.objects.fs.FS attribute) (dissect.apfs.objects.gbitmap.GBitmap attribute) (dissect.apfs.objects.gbitmap_block.GBitmapBlock attribute) (dissect.apfs.objects.integrity_meta.IntegrityMeta attribute) (dissect.apfs.objects.keybag.Keybag attribute) (dissect.apfs.objects.nx_fusion_wbc.NxFusionWbc attribute) (dissect.apfs.objects.nx_fusion_wbc_list.NxFusionWbcList attribute) (dissect.apfs.objects.nx_reap_list.NxReapList attribute) (dissect.apfs.objects.nx_reaper.NxReaper attribute) (dissect.apfs.objects.nx_superblock.NxSuperblock attribute) (dissect.apfs.objects.omap.ObjectMap attribute) (dissect.apfs.objects.snap_meta_ext.SnapMetaExt attribute) (dissect.apfs.objects.spaceman.Spaceman attribute) (dissect.apfs.objects.spaceman_cab.SpacemanChunkInfoAddressBlock attribute) (dissect.apfs.objects.spaceman_cib.SpacemanChunkInfoBlock attribute) (dissect.archive.vbk.DirItem attribute) (dissect.archive.vbk.FibBlockDescriptor attribute) (dissect.archive.vbk.FibBlockDescriptorV7 attribute) (dissect.archive.vbk.MetaItem attribute) (dissect.archive.vbk.MetaTableDescriptor attribute) (dissect.archive.vbk.StgBlockDescriptor attribute) (dissect.archive.vbk.StgBlockDescriptorV7 attribute) (dissect.fve.bde.information.AesCbc256HmacSha512EncryptedDatum attribute) (dissect.fve.bde.information.AesCcmEncryptedDatum attribute) (dissect.fve.bde.information.BackupInfoDatum attribute) (dissect.fve.bde.information.ConcatHashKeyDatum attribute) (dissect.fve.bde.information.Datum attribute) (dissect.fve.bde.information.ErrorLogDatum attribute) (dissect.fve.bde.information.ExternalInfoDatum attribute) (dissect.fve.bde.information.GuidDatum attribute) (dissect.fve.bde.information.KeyDatum attribute) (dissect.fve.bde.information.SimpleDatum attribute) (dissect.fve.bde.information.SimpleLargeDatum attribute) (dissect.fve.bde.information.StretchKeyDatum attribute) (dissect.fve.bde.information.TpmEncryptedBlobDatum attribute) (dissect.fve.bde.information.UpdateDatum attribute) (dissect.fve.bde.information.UseKeyDatum attribute) (dissect.fve.bde.information.VirtualizationInfoDatum attribute) (dissect.fve.bde.information.VmkInfoDatum attribute) (dissect.regf.regf.BigData attribute) (dissect.regf.regf.Cell attribute) (dissect.regf.regf.FastLeaf attribute) (dissect.regf.regf.HashLeaf attribute) (dissect.regf.regf.IndexLeaf attribute) (dissect.regf.regf.IndexRoot attribute) (dissect.regf.regf.KeyNode attribute) (dissect.regf.regf.KeySecurity attribute) (dissect.regf.regf.KeyValue attribute) __struct_v1__ (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) __struct_v2__ (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) __sub__() (dissect.cstruct.types.pointer.Pointer method) __subloaders__ (dissect.target.loaders.tar.TarLoader attribute) (dissect.target.loaders.zip.ZipLoader attribute) __target__ (dissect.cstruct.types.structure.UnionProxy attribute) __type__ (dissect.apfs.objects.base.Object attribute) (dissect.apfs.objects.btree.BTree attribute) (dissect.apfs.objects.btree_node.BTreeNode attribute) (dissect.apfs.objects.checkpoint_map.CheckpointMap attribute) (dissect.apfs.objects.efi_jumpstart.EfiJumpstart attribute) (dissect.apfs.objects.er_recovery_block.EncryptionRollingRecoveryBlock attribute) (dissect.apfs.objects.er_state.EncryptionRollingState attribute) (dissect.apfs.objects.fs.FS attribute) (dissect.apfs.objects.gbitmap.GBitmap attribute) (dissect.apfs.objects.gbitmap_block.GBitmapBlock attribute) (dissect.apfs.objects.integrity_meta.IntegrityMeta attribute) (dissect.apfs.objects.keybag.ContainerKeybag attribute) (dissect.apfs.objects.keybag.MediaKeybag attribute) (dissect.apfs.objects.keybag.VolumeKeybag attribute) (dissect.apfs.objects.nx_fusion_wbc.NxFusionWbc attribute) (dissect.apfs.objects.nx_fusion_wbc_list.NxFusionWbcList attribute) (dissect.apfs.objects.nx_reap_list.NxReapList attribute) (dissect.apfs.objects.nx_reaper.NxReaper attribute) (dissect.apfs.objects.nx_superblock.NxSuperblock attribute) (dissect.apfs.objects.omap.ObjectMap attribute) (dissect.apfs.objects.snap_meta_ext.SnapMetaExt attribute) (dissect.apfs.objects.spaceman.Spaceman attribute) (dissect.apfs.objects.spaceman_bitmap.SpacemanBitmap attribute) (dissect.apfs.objects.spaceman_cab.SpacemanChunkInfoAddressBlock attribute) (dissect.apfs.objects.spaceman_cib.SpacemanChunkInfoBlock attribute) (dissect.target.container.Container attribute) (dissect.target.containers.asdf.AsdfContainer attribute) (dissect.target.containers.asif.AsifContainer attribute) (dissect.target.containers.ewf.EwfContainer attribute) (dissect.target.containers.fortifw.FortiFirmwareContainer attribute) (dissect.target.containers.hdd.HddContainer attribute) (dissect.target.containers.hds.HdsContainer attribute) (dissect.target.containers.qcow2.QCow2Container attribute) (dissect.target.containers.raw.RawContainer attribute) (dissect.target.containers.split.SplitContainer attribute) (dissect.target.containers.vdi.VdiContainer attribute) (dissect.target.containers.vhd.VhdContainer attribute) (dissect.target.containers.vhdx.VhdxContainer attribute) (dissect.target.containers.vmdk.VmdkContainer attribute) (dissect.target.filesystem.Filesystem attribute) (dissect.target.filesystem.LayerFilesystem attribute) (dissect.target.filesystem.RootFilesystem attribute) (dissect.target.filesystem.VirtualFilesystem attribute) (dissect.target.filesystems.ad1.AD1Filesystem attribute) (dissect.target.filesystems.apfs.ApfsFilesystem attribute) (dissect.target.filesystems.apfs.ApfsVolumeFilesystem attribute) (dissect.target.filesystems.btrfs.BtrfsFilesystem attribute) (dissect.target.filesystems.btrfs.BtrfsSubvolumeFilesystem attribute) (dissect.target.filesystems.cb.CbFilesystem attribute) (dissect.target.filesystems.cpio.CpioFilesystem attribute) (dissect.target.filesystems.cramfs.CramfsFilesystem attribute) (dissect.target.filesystems.dir.DirectoryFilesystem attribute) (dissect.target.filesystems.exfat.ExfatFilesystem attribute) (dissect.target.filesystems.extfs.ExtFilesystem attribute) (dissect.target.filesystems.fat.FatFilesystem attribute) (dissect.target.filesystems.ffs.FfsFilesystem attribute) (dissect.target.filesystems.itunes.ITunesFilesystem attribute) (dissect.target.filesystems.jffs.JffsFilesystem attribute) (dissect.target.filesystems.nfs.NfsFilesystem attribute) (dissect.target.filesystems.ntds.NtdsFilesystem attribute) (dissect.target.filesystems.ntfs.NtfsFilesystem attribute) (dissect.target.filesystems.overlay.Overlay2Filesystem attribute) (dissect.target.filesystems.overlay.OverlayFilesystem attribute) (dissect.target.filesystems.qnxfs.QnxFilesystem attribute) (dissect.target.filesystems.smb.SmbFilesystem attribute) (dissect.target.filesystems.squashfs.SquashFSFilesystem attribute) (dissect.target.filesystems.tar.TarFilesystem attribute) (dissect.target.filesystems.vbk.VbkFilesystem attribute) (dissect.target.filesystems.vmfs.VmfsFilesystem attribute) (dissect.target.filesystems.vmtar.VmtarFilesystem attribute) (dissect.target.filesystems.xfs.XfsFilesystem attribute) (dissect.target.filesystems.zip.ZipFilesystem attribute) (dissect.target.loaders.cellebrite.CellebriteFilesystem attribute) (dissect.target.plugin.ChildTargetPlugin attribute) (dissect.target.plugins.child.colima.ColimaChildTargetPlugin attribute) (dissect.target.plugins.child.docker.DockerChildTargetPlugin attribute) (dissect.target.plugins.child.esxi.ESXiChildTargetPlugin attribute) (dissect.target.plugins.child.hyperv.HyperVChildTargetPlugin attribute) (dissect.target.plugins.child.lima.LimaChildTargetPlugin attribute) (dissect.target.plugins.child.parallels.ParallelsChildTargetPlugin attribute) (dissect.target.plugins.child.podman.PodmanChildTargetPlugin attribute) (dissect.target.plugins.child.proxmox.ProxmoxChildTargetPlugin attribute) (dissect.target.plugins.child.qemu.QemuChildTargetPlugin attribute) (dissect.target.plugins.child.virtualbox.VirtualBoxChildTargetPlugin attribute) (dissect.target.plugins.child.virtuozzo.VirtuozzoChildTargetPlugin attribute) (dissect.target.plugins.child.vmware_workstation.VmwareWorkstationChildTargetPlugin attribute) (dissect.target.plugins.child.wsl.WSLChildTargetPlugin attribute) (dissect.target.volume.VolumeSystem attribute) (dissect.target.volumes.bde.BitlockerVolumeSystem attribute) (dissect.target.volumes.ddf.DdfVolumeSystem attribute) (dissect.target.volumes.disk.DissectVolumeSystem attribute) (dissect.target.volumes.luks.LUKSVolumeSystem attribute) (dissect.target.volumes.lvm.LvmVolumeSystem attribute) (dissect.target.volumes.md.MdVolumeSystem attribute) (dissect.target.volumes.vmfs.VmfsVolumeSystem attribute) (dissect.vmfs.address.Address attribute) (dissect.vmfs.address.FileBlockAddr attribute) (dissect.vmfs.address.FileDescriptorAddr attribute) (dissect.vmfs.address.JournalBlockAddr attribute) (dissect.vmfs.address.LargeFileBlockAddr attribute) (dissect.vmfs.address.PointerBlock2Addr attribute) (dissect.vmfs.address.PointerBlock2Addr64 attribute) (dissect.vmfs.address.PointerBlockAddr attribute) (dissect.vmfs.address.PointerBlockAddr64 attribute) (dissect.vmfs.address.SmallFileBlockAddr attribute) (dissect.vmfs.address.SubBlockAddr attribute) (dissect.vmfs.address.SubBlockAddr64 attribute) (flow.record.fieldtypes.typedlist attribute) __union__ (dissect.cstruct.types.structure.UnionProxy attribute) __updating__ (dissect.cstruct.types.structure.StructureMetaType attribute) __usage__ (in module flow.record.adapter.archive) (in module flow.record.adapter.avro) (in module flow.record.adapter.broker) (in module flow.record.adapter.csvfile) (in module flow.record.adapter.duckdb) (in module flow.record.adapter.elastic) (in module flow.record.adapter.jsonfile) (in module flow.record.adapter.line) (in module flow.record.adapter.mongo) (in module flow.record.adapter.split) (in module flow.record.adapter.splunk) (in module flow.record.adapter.sqlite) (in module flow.record.adapter.stream) (in module flow.record.adapter.text) (in module flow.record.adapter.xlsx) __values__ (dissect.cstruct.types.structure.Structure property) __xor__() (dissect.cstruct.types.pointer.Pointer method) _current (dissect.target.helpers.configutil.ScopeManager attribute) _generate__bool__() (in module dissect.cstruct.types.structure) _generate__eq__() (in module dissect.cstruct.types.structure) _generate__hash__() (in module dissect.cstruct.types.structure) _generate_structure__init__() (in module dissect.cstruct.types.structure) _generate_union__init__() (in module dissect.cstruct.types.structure) _make__bool__() (in module dissect.cstruct.types.structure) _make__eq__() (in module dissect.cstruct.types.structure) _make__hash__() (in module dissect.cstruct.types.structure) _make_structure__init__() (in module dissect.cstruct.types.structure) _make_union__init__() (in module dissect.cstruct.types.structure) _parents (dissect.target.helpers.configutil.ScopeManager attribute) _previous (dissect.target.helpers.configutil.ScopeManager attribute) _public_member (in module codestyle) _read() (dissect.archive.vma.DeviceDataStream method) (dissect.archive.wim.CompressedStream method) (dissect.cramfs.cramfs.BlockStream method) (dissect.evidence.adcrypt.stream.ADCryptStream method) (dissect.evidence.ewf.ewf.EWFStream method) (dissect.hypervisor.disk.vdi.VDIStream method) (dissect.hypervisor.disk.vhd.VHD method) (dissect.hypervisor.disk.vmdk.VMDK method) (dissect.ole.ole.ChainStream method) (dissect.target.filesystems.nfs.NfsStream method) (dissect.target.loaders.mqtt.MqttStream method) (dissect.target.loaders.remote.RemoteStream method) (dissect.util.stream.AlignedStream method) (dissect.volume.vss.StoreStream method) _root (dissect.target.helpers.configutil.ScopeManager attribute) _seek() (dissect.archive.vma.DeviceDataStream method) (dissect.archive.wim.CompressedStream method) (dissect.cramfs.cramfs.BlockStream method) (dissect.evidence.adcrypt.stream.ADCryptStream method) (dissect.evidence.ewf.ewf.EWFStream method) (dissect.hypervisor.disk.vdi.VDIStream method) (dissect.hypervisor.disk.vhd.VHD method) (dissect.hypervisor.disk.vmdk.VMDK method) (dissect.ole.ole.ChainStream method) (dissect.target.filesystems.nfs.NfsStream method) (dissect.target.loaders.mqtt.MqttStream method) (dissect.target.loaders.remote.RemoteStream method) (dissect.util.stream.AlignedStream method) (dissect.volume.vss.StoreStream method) A A12MPPSWITCH (dissect.target.plugins.os.windows.network.IfTypes attribute) AAL2 (dissect.target.plugins.os.windows.network.IfTypes attribute) AAL5 (dissect.target.plugins.os.windows.network.IfTypes attribute) ab (dissect.target.loaders.ab.AndroidBackupLoader attribute) ABNORMAL_PROCESS_EXIT (dissect.target.plugins.os.windows.amcache.PcaGeneralDbType attribute) absolute (dissect.archive.wim.ReparsePoint property) (dissect.ntfs.attr.ReparsePoint property) absolute() (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) absolute_path (dissect.target.loader.Loader attribute) abspath() (in module dissect.target.helpers.polypath) AbstractClient (class in dissect.target.helpers.sunrpc.client) AbstractReader (class in flow.record.adapter) AbstractWriter (class in flow.record.adapter) accelerator (dissect.executable.pe.directory.resource.ResourceDirectory property) accelerator_table() (dissect.executable.pe.directory.resource.ResourceDirectory method) AcceptedReply (class in dissect.target.helpers.sunrpc.sunrpc) AcceptStat (class in dissect.target.helpers.sunrpc.sunrpc) access() (dissect.target.plugins.apps.webserver.apache.ApachePlugin method) (dissect.target.plugins.apps.webserver.caddy.CaddyPlugin method) (dissect.target.plugins.apps.webserver.iis.IISLogsPlugin method) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin method) access_id (acquire.acquire.uploaders.minio.MinIO attribute) access_key (acquire.acquire.uploaders.minio.MinIO attribute) ACCESS_LOG_NAMES (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) (dissect.target.plugins.apps.webserver.citrix.CitrixWebserverPlugin attribute) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin attribute) ACCESS_MASK (class in acquire.acquire.dynamic.windows.ntdll) (in module dissect.database.ese.ntds.sd) (in module dissect.ntfs.c_ntfs) access_mode (dissect.hypervisor.disk.vmdk.ExtentDescriptor attribute) access_paths (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin attribute) access_time (dissect.target.plugins.os.windows.regf.shellbags.SHITEM property) AccessDeniedError account_policy() (dissect.target.plugins.os.unix.bsd.darwin.macos.user.UserPlugin method) ACCOUNTDISABLE (dissect.database.ese.ntds.util.UserAccountControl attribute) AccountPolicyRecord (in module dissect.target.plugins.os.unix.bsd.darwin.macos.user) ACE (class in dissect.database.ese.ntds.sd) (class in dissect.ntfs.secure) ace (dissect.database.ese.ntds.sd.ACL attribute) (dissect.ntfs.secure.ACL attribute) ACE_FLAGS (in module dissect.database.ese.ntds.sd) ACE_OBJECT_FLAGS (in module dissect.database.ese.ntds.sd) (in module dissect.ntfs.c_ntfs) ACE_TYPE (in module dissect.database.ese.ntds.sd) (in module dissect.ntfs.c_ntfs) ack_pingpong (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) ack_threads (dissect.volume.lvm.metadata.VdoPoolSegment attribute) ACL (class in dissect.database.ese.ntds.sd) (class in dissect.ntfs.secure) acmru() (dissect.target.plugins.os.windows.regf.mru.MRUPlugin method) ACMruRecord (in module dissect.target.plugins.os.windows.regf.mru) acquire.acquire module acquire.acquire.acquire module acquire.acquire.collector module acquire.acquire.crypt module acquire.acquire.dynamic module acquire.acquire.dynamic.windows module acquire.acquire.dynamic.windows.collect module acquire.acquire.dynamic.windows.exceptions module acquire.acquire.dynamic.windows.handles module acquire.acquire.dynamic.windows.named_objects module acquire.acquire.dynamic.windows.ntdll module acquire.acquire.dynamic.windows.types module acquire.acquire.esxi module acquire.acquire.gui module acquire.acquire.gui.base module acquire.acquire.gui.win32 module acquire.acquire.hashes module acquire.acquire.log module acquire.acquire.outputs module acquire.acquire.outputs.base module acquire.acquire.outputs.dir module acquire.acquire.outputs.tar module acquire.acquire.outputs.zip module acquire.acquire.tools module acquire.acquire.tools.decrypter module acquire.acquire.uploaders module acquire.acquire.uploaders.minio module acquire.acquire.uploaders.plugin module acquire.acquire.uploaders.plugin_registry module acquire.acquire.utils module acquire.acquire.volatilestream module ACQUIRE_BANNER (in module acquire.acquire.acquire) acquire_children_and_targets() (in module acquire.acquire.acquire) acquire_def (in module acquire.acquire.crypt) acquire_target() (in module acquire.acquire.acquire) AcquireHashRecord (in module dissect.target.plugins.apps.edr.acquire) AcquireOpenHandlesRecord (in module dissect.target.plugins.apps.edr.acquire) AcquirePlugin (class in dissect.target.plugins.apps.edr.acquire) AcquireTarSubLoader (class in dissect.target.loaders.acquire) AcquireZipSubLoader (class in dissect.target.loaders.acquire) ACTION (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) action (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) active_directory (dissect.hypervisor.disk.asif.ASIF attribute) active_header_offset (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) active_record (dissect.fve.bde.eow.EowBitmap property) active_slot (dissect.archive.vbk.VBK attribute) ActiveDirectory (class in acquire.acquire.acquire) ActiveScriptEventConsumerRecord (in module dissect.target.plugins.os.windows.cim) ActivitiesCache (class in acquire.acquire.acquire) activitiescache() (dissect.target.plugins.os.windows.activitiescache.ActivitiesCachePlugin method) ActivitiesCachePlugin (class in dissect.target.plugins.os.windows.activitiescache) ActivitiesCacheRecord (in module dissect.target.plugins.os.windows.activitiescache) activity() (dissect.target.plugins.os.unix.bsd.darwin.ios.generic.GenericPlugin method) (dissect.target.plugins.os.unix.generic.GenericPlugin method) (dissect.target.plugins.os.unix.linux.fortios.generic.GenericPlugin method) (dissect.target.plugins.os.windows.generic.GenericPlugin method) activity_id (dissect.etl.headers.event.EventHeader property) AD1 (class in dissect.evidence.ad1.ad1) ad1 (dissect.evidence.ad1.ad1.FileEntry attribute) (dissect.evidence.ad1.ad1.FileMeta attribute) (dissect.evidence.ad1.stream.AD1Stream attribute) (dissect.target.filesystems.ad1.AD1Filesystem attribute) ad1_def (in module dissect.evidence.ad1.c_ad1) AD1DirEntry (class in dissect.target.filesystems.ad1) AD1Filesystem (class in dissect.target.filesystems.ad1) AD1FilesystemEntry (class in dissect.target.filesystems.ad1) AD1Loader (class in dissect.target.loaders.ad1) AD1Stream (class in dissect.evidence.ad1.stream) ADCrypt (class in dissect.evidence.adcrypt.adcrypt) adcrypt (dissect.evidence.ad1.ad1.AD1 attribute) adcrypt_def (in module dissect.evidence.adcrypt.c_adcrypt) adcrypt_kdf() (in module dissect.evidence.adcrypt.adcrypt) ADCryptStream (class in dissect.evidence.adcrypt.stream) add() (dissect.btrfs.stream.ChunkStream method) (dissect.cstruct.parser.TokenCollection method) (dissect.ntfs.util.AttributeMap method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.helpers.regutil.HiveCollection method) (dissect.target.helpers.regutil.KeyCollection method) (dissect.target.helpers.regutil.ValueCollection method) (dissect.target.target.Collection method) (dissect.util.stream.MappingStream method) (dissect.util.stream.OverlayStream method) (dissect.volume.vss.BlockMap method) (flow.record.fieldtypes.net.ipv4.SubnetList method) add_attributes() (dissect.eventlog.bxml.BxmlTag method) add_bytes() (dissect.evidence.asdf.asdf.AsdfWriter method) add_child_template() (dissect.eventlog.bxml.Template method) add_children() (dissect.eventlog.bxml.BxmlTag method) add_command_collected() (acquire.acquire.collector.CollectionReport method) add_command_failed() (acquire.acquire.collector.CollectionReport method) add_custom_type() (dissect.cstruct.cstruct.cstruct method) add_dir_collected() (acquire.acquire.collector.CollectionReport method) add_dir_failed() (acquire.acquire.collector.CollectionReport method) add_dir_missing() (acquire.acquire.collector.CollectionReport method) add_field() (dissect.cstruct.types.structure.StructureMetaType method) add_file_collected() (acquire.acquire.collector.CollectionReport method) add_file_failed() (acquire.acquire.collector.CollectionReport method) add_file_missing() (acquire.acquire.collector.CollectionReport method) add_func_error() (dissect.target.tools.utils.report.TargetExecutionReport method) add_glob_empty() (acquire.acquire.collector.CollectionReport method) add_glob_failed() (acquire.acquire.collector.CollectionReport method) add_handler() (flow.record.utils.EventHandler method) add_hive() (dissect.target.plugins.os.windows.registry.RegistryPlugin method) ADD_IN_KEY (dissect.target.plugins.apps.productivity.msoffice.MSOffice attribute) add_incompatible_plugin() (dissect.target.tools.utils.report.TargetExecutionReport method) add_layer (dissect.target.filesystem.LayerFilesystem attribute) add_metadata_file() (dissect.evidence.asdf.asdf.AsdfWriter method) add_mounts() (dissect.target.plugins.os.windows._os.WindowsPlugin method) add_path_collected() (acquire.acquire.collector.CollectionReport method) add_path_failed() (acquire.acquire.collector.CollectionReport method) add_path_missing() (acquire.acquire.collector.CollectionReport method) add_plugin() (dissect.target.target.Target method) add_registered_plugin() (dissect.target.tools.utils.report.TargetExecutionReport method) add_sub() (dissect.eventlog.bxml.Template method) add_subkey() (dissect.target.helpers.regutil.VirtualKey method) add_symlink_collected() (acquire.acquire.collector.CollectionReport method) add_symlink_failed() (acquire.acquire.collector.CollectionReport method) add_target_report() (dissect.target.tools.utils.report.ExecutionReport method) add_type() (dissect.cstruct.cstruct.cstruct method) add_value() (dissect.target.helpers.regutil.VirtualKey method) add_virtual_ntfs_filesystem() (in module dissect.target.helpers.loaderutil) additional_header_fields() (dissect.etl.headers.event.EventHeader method) (dissect.etl.headers.headers.ErrorHeader method) (dissect.etl.headers.headers.EventInstanceGUIDHeader method) (dissect.etl.headers.headers.EventInstanceHeader method) (dissect.etl.headers.headers.EventTraceHeader method) (dissect.etl.headers.headers.Header method) (dissect.etl.headers.headers.MessageTraceHeader method) (dissect.etl.headers.system.CompactSystemHeader method) (dissect.etl.headers.system.PerfinfoTraceHeader method) (dissect.etl.headers.system.SystemHeader method) Address (class in dissect.vmfs.address) address (class in flow.record.fieldtypes.net.ipv4) (dissect.apfs.objects.base.Object attribute) (dissect.apfs.objects.btree.BTree attribute) (dissect.executable.pe.directory.base.DataDirectory attribute) (dissect.executable.pe.directory.delay_import.DelayImportFunction attribute) (dissect.executable.pe.directory.export.ExportFunction attribute) (dissect.executable.pe.directory.imports.ImportFunction attribute) (dissect.executable.pe.directory.resource.ResourceEntry attribute) (dissect.vmfs.descriptor.DirEntry attribute) (dissect.vmfs.descriptor.FileDescriptor attribute) (dissect.vmfs.resource.ResourceFile attribute) Address (in module flow.record.fieldtypes.net.ipv4) address_fmt() (in module dissect.vmfs.address) address_thunk (dissect.executable.pe.directory.delay_import.DelayImportFunction attribute) (dissect.executable.pe.directory.imports.ImportFunction attribute) address_type() (in module dissect.vmfs.address) addtype (dissect.cstruct.cstruct.cstruct attribute) adpolicy() (dissect.target.plugins.os.windows.adpolicy.ADPolicyPlugin method) ADPolicyPlugin (class in dissect.target.plugins.os.windows.adpolicy) ADPolicyRecord (in module dissect.target.plugins.os.windows.adpolicy) ads (dissect.target.filesystems.ntfs.NtfsFilesystemEntry attribute) ADSL (dissect.target.plugins.os.windows.network.IfTypes attribute) adtev_def (in module dissect.target.plugins.os.windows.regf.auditpol) aes_ccm_encrypted_key() (dissect.fve.bde.information.VmkInfoDatum method) aes_decrypt() (in module dissect.target.loaders.itunes) (in module dissect.target.plugins.os.unix.linux.fortios._os) aes_unwrap() (in module dissect.apfs.objects.keybag) aes_unwrap_key() (in module dissect.target.loaders.itunes) AesCbc256HmacSha512EncryptedDatum (class in dissect.fve.bde.information) AesCcmEncryptedDatum (class in dissect.fve.bde.information) af (dissect.fve.luks.metadata.Keyslot attribute) AFLANE_8023 (dissect.target.plugins.os.windows.network.IfTypes attribute) AFLANE_8025 (dissect.target.plugins.os.windows.network.IfTypes attribute) ag (dissect.xfs.xfs.INode attribute) (dissect.xfs.xfs.XFS attribute) age (dissect.executable.pe.directory.debug.CodeViewDebugEntry property) agentexecutor() (dissect.target.plugins.os.windows.log.agentexecutor.AgentExecutorLogPlugin method) AgentExecutorLogPlugin (class in dissect.target.plugins.os.windows.log.agentexecutor) AgentExecutorLogRecord (in module dissect.target.plugins.os.windows.log.agentexecutor) AGGFRAG (dissect.target.helpers.network.IANAProtocol attribute) agi (dissect.xfs.xfs.AllocationGroup attribute) AH (dissect.target.helpers.network.IANAProtocol attribute) ALERT (dissect.target.plugins.os.unix.log.journal.JournalMessagePriority attribute) algorithm (dissect.volume.raid.stream.RAID456Stream attribute) alias (dissect.target.plugin.FunctionDescriptor attribute) alias() (in module dissect.target.plugin) align (dissect.cstruct.parser.TokenParser attribute) (dissect.util.stream.AlignedStream attribute) aligned_size (dissect.etl.etl.EventRecord property) AlignedStream (class in dissect.util.stream) alignment (dissect.cstruct.types.base.MetaType attribute) (dissect.cstruct.types.structure.Field attribute) (dissect.executable.elf.elf.Section attribute) (dissect.executable.elf.elf.Segment attribute) ALIGNMENT (in module dissect.hypervisor.disk.c_vhdx) (in module dissect.target.helpers.sunrpc.serializer) all() (dissect.target.plugins.general.users.UsersPlugin method) all_backlinks() (dissect.database.ese.ntds.database.LinkTable method) all_home_paths (dissect.target.plugins.general.users.UsersPlugin property) all_links() (dissect.database.ese.ntds.database.LinkTable method) all_with_home() (dissect.target.plugins.general.users.UsersPlugin method) alloc_bitmap (dissect.fat.exfat.ExFAT attribute) allocated_size (dissect.archive.vbk.StgBlockDescriptor property) (dissect.ntfs.attr.AttributeHeader property) (dissect.ntfs.attr.FileName property) allocation_policy (dissect.volume.lvm.metadata.LogicalVolume attribute) (dissect.volume.lvm.metadata.VolumeGroup attribute) AllocationGroup (class in dissect.xfs.xfs) allow_hard_terminate (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) allow_list (dissect.fve.bde.information.ValidationInfoDatum property) allow_start_on_demand (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) alnum() (dissect.cstruct.expression.ExpressionTokenizer method) ALPC_PORT (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) ALPCGuid (in module dissect.etl.utils) alpha() (dissect.cstruct.expression.ExpressionTokenizer method) alt_separator (dissect.target.filesystem.Filesystem attribute) (dissect.target.filesystem.LayerFilesystem property) (dissect.target.tools.diff.DifferentialCli attribute) ALTERNATE_DATA_STREAM (dissect.target.plugins.filesystem.ntfs.utils.InformationType attribute) alternateshell() (dissect.target.plugins.os.windows.generic.GenericPlugin method) AlternateShellRecord (in module dissect.target.plugins.os.windows.generic) amcache (dissect.target.plugins.os.windows.amcache.AmcachePlugin attribute) amcache_applaunch (dissect.target.plugins.os.windows.amcache.AmcachePlugin attribute) AMCACHE_FILE_KEYS (in module dissect.target.plugins.os.windows.amcache) amcache_install() (dissect.target.plugins.os.windows.log.amcache.AmcacheInstallPlugin method) AMCACHE_PROGRAM_KEYS (in module dissect.target.plugins.os.windows.amcache) AmcacheArpCreateRecord (in module dissect.target.plugins.os.windows.log.amcache) AmcacheFileCreateRecord (in module dissect.target.plugins.os.windows.log.amcache) AmcacheInstallPlugin (class in dissect.target.plugins.os.windows.log.amcache) AmcachePlugin (class in dissect.target.plugins.os.windows.amcache) AmcachePluginOldMixin (class in dissect.target.plugins.os.windows.amcache) AN (dissect.target.helpers.network.IANAProtocol attribute) ancestors() (dissect.database.ese.ntds.objects.object.Object method) anchor (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) AND (dissect.util.ldap.LogicalOperator attribute) ANDROID (dissect.target.plugin.OperatingSystem attribute) AndroidBackup (class in dissect.target.loaders.ab) AndroidBackupLoader (class in dissect.target.loaders.ab) AndroidPlugin (class in dissect.target.plugins.os.unix.linux.android._os) animated_cursor (dissect.executable.pe.directory.resource.ResourceDirectory property) animated_icon (dissect.executable.pe.directory.resource.ResourceDirectory property) ANON_FS_RE (in module dissect.target.loaders.acquire) Anr (dissect.database.ese.ntds.util.SearchFlags attribute) ANSI_COLORS (in module dissect.target.tools.shell) AnsiColors (class in dissect.target.tools.shell) ANSITRING (dissect.eventlog.bxml.BxmlType attribute) ANY (dissect.target.helpers.sunrpc.client.LocalPortPolicy attribute) ANY_0_HOP_PROTOCOL (dissect.target.helpers.network.IANAProtocol attribute) ANY_DISTRIBUTED_FILE_SYSTEM (dissect.target.helpers.network.IANAProtocol attribute) ANY_HOST_INTERNAL_PROTOCOL (dissect.target.helpers.network.IANAProtocol attribute) ANY_LOCAL_NETWORK (dissect.target.helpers.network.IANAProtocol attribute) ANY_PRIVATE_ENCRYPTION_SCHEME (dissect.target.helpers.network.IANAProtocol attribute) AnydeskPlugin (class in dissect.target.plugins.apps.remoteaccess.anydesk) apache_response_time_to_ms() (in module dissect.target.plugins.apps.webserver.apache) ApachePlugin (class in dissect.target.plugins.apps.webserver.apache) APFS (class in dissect.apfs.apfs) apfs_def (in module dissect.apfs.c_apfs) ApfsDirEntry (class in dissect.target.filesystems.apfs) ApfsFilesystem (class in dissect.target.filesystems.apfs) ApfsFilesystemEntry (class in dissect.target.filesystems.apfs) ApfsVolumeFilesystem (class in dissect.target.filesystems.apfs) APM (class in dissect.volume.disk.schemes.apm) apm (dissect.volume.disk.schemes.apm.APM attribute) apm_def (in module dissect.volume.disk.schemes.apm) app_bound_key (dissect.target.plugins.apps.browser.chromium.ChromiumKeys attribute) APP_CONTEXT (in module flow.record.context) app_name (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) app_regf_keys (dissect.target.plugins.os.windows.cam.CamPlugin attribute) Appcompat (class in acquire.acquire.acquire) AppContext (class in flow.record.context) appdb() (dissect.target.plugins.os.windows.notifications.NotificationsPlugin method) appdb_def (in module dissect.target.plugins.os.windows.notifications) appdb_files (dissect.target.plugins.os.windows.notifications.NotificationsPlugin attribute) APPDB_MAGIC (in module dissect.target.plugins.os.windows.notifications) AppDBBadgeRecord (in module dissect.target.plugins.os.windows.notifications) AppDBPushRecord (in module dissect.target.plugins.os.windows.notifications) AppDBRecord (in module dissect.target.plugins.os.windows.notifications) AppDBTileRecord (in module dissect.target.plugins.os.windows.notifications) AppDBToastRecord (in module dissect.target.plugins.os.windows.notifications) append_fs_layer() (dissect.target.filesystem.LayerFilesystem method) append_layer() (dissect.target.filesystem.LayerFilesystem method) appinit() (dissect.target.plugins.os.windows.generic.GenericPlugin method) AppInitRecord (in module dissect.target.plugins.os.windows.generic) applaunches() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) application() (dissect.target.plugins.os.windows.sru.SRUPlugin method) application_data (dissect.database.ese.ntds.sd.ACE attribute) (dissect.ntfs.secure.ACE attribute) application_files() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) APPLICATION_HOST_CONFIG (dissect.target.plugins.apps.webserver.iis.IISLogsPlugin attribute) APPLICATION_IDENTIFIERS (in module dissect.target.helpers.shell_application_ids) application_name (dissect.target.plugins.os.windows.jumplist.JumpListFile attribute) application_timeline() (dissect.target.plugins.os.windows.sru.SRUPlugin method) application_type (dissect.target.plugins.os.windows.jumplist.JumpListFile attribute) ApplicationAppcompatRecord (in module dissect.target.plugins.os.windows.amcache) ApplicationFileAppcompatRecord (in module dissect.target.plugins.os.windows.amcache) ApplicationRecord (in module dissect.target.plugins.os.windows.sru) Applications (class in acquire.acquire.acquire) applications() (dissect.target.plugins.os.unix.applications.UnixApplicationsPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios.applications.IOSApplicationsPlugin method) (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) (dissect.target.plugins.os.windows.regf.applications.WindowsApplicationsPlugin method) ApplicationSettings (class in dissect.database.ese.ntds.objects.applicationsettings) ApplicationTimelineRecord (in module dissect.target.plugins.os.windows.sru) apply() (dissect.target.target.DiskCollection method) (dissect.target.target.FilesystemCollection method) (dissect.target.target.Target method) (dissect.target.target.VolumeCollection method) apply_fixup() (in module dissect.ntfs.util) APPROX (dissect.util.ldap.ComparisonOperator attribute) AppxDebugKeyRecord (in module dissect.target.plugins.os.windows.regf.appxdebugkeys) appxdebugkeys() (dissect.target.plugins.os.windows.regf.appxdebugkeys.AppxDebugKeysPlugin method) AppxDebugKeysPlugin (class in dissect.target.plugins.os.windows.regf.appxdebugkeys) APT_LOG_OPERATIONS (in module dissect.target.plugins.os.unix.linux.debian.apt) AptPlugin (class in dissect.target.plugins.os.unix.linux.debian.apt) ARABIC (dissect.database.ese.lcmapstring.SCRIPT attribute) ARAP (dissect.target.plugins.os.windows.network.IfTypes attribute) ARCH_MAP (in module dissect.target.plugins.os.unix._os) (in module dissect.target.plugins.os.unix.bsd.darwin._os) (in module dissect.target.plugins.os.windows._os) ArcHistoryRecord (in module dissect.target.plugins.apps.productivity.sevenzip) architecture() (dissect.target.plugin.OSPlugin method) (dissect.target.plugins.os.default._os.DefaultOSPlugin method) (dissect.target.plugins.os.unix._os.UnixPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSPlugin method) (dissect.target.plugins.os.windows._os.WindowsPlugin method) ArchiveReader (class in flow.record.adapter.archive) ArchiveWriter (class in flow.record.adapter.archive) ARCNET (dissect.target.plugins.os.windows.network.IfTypes attribute) ARCNET_PLUS (dissect.target.plugins.os.windows.network.IfTypes attribute) area (dissect.fve.luks.metadata.Keyslot attribute) aRepr (in module flow.record.stream) arg() (in module dissect.target.plugin) arg_str_to_arg_list() (in module dissect.target.tools.shell) args (dissect.target.plugin.FunctionDescriptor property) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) (flow.record.fieldtypes.command attribute) (flow.record.fieldtypes.uri property) args_to_uri() (in module dissect.target.tools.utils.cli) ARGUS (dissect.target.helpers.network.IANAProtocol attribute) ARIS (dissect.target.helpers.network.IANAProtocol attribute) Array (class in dissect.cstruct.types.base) ARRAY_MASK (dissect.eventlog.bxml.BxmlTemplateDescriptor attribute) ARRAY_STATES (in module dissect.cim.c_cim) ARRAY_TYPES (in module dissect.database.bsd.tools.rpm) ArraySizeError ArrayType (dissect.cstruct.types.base.MetaType attribute) (dissect.cstruct.types.char.Char attribute) (dissect.cstruct.types.void.Void attribute) (dissect.cstruct.types.wchar.Wchar attribute) artifact_type (acquire.acquire.collector.Record attribute) artifact_value (acquire.acquire.collector.Record attribute) artifacts (dissect.target.plugins.apps.shell.wget.WgetPlugin attribute) ArtifactType (class in acquire.acquire.collector) as_dict() (dissect.database.ese.ntds.objects.object.Object method) (dissect.database.ese.record.Record method) (dissect.database.ese.record.RecordData method) (dissect.database.ese.tools.sru.Entry method) (dissect.hypervisor.descriptor.hyperv.HyperVFile method) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry method) (dissect.target.helpers.configutil.ConfigurationParser method) (dissect.target.tools.shell.AnsiColors class method) (dissect.target.tools.utils.report.ExecutionReport method) (dissect.target.tools.utils.report.TargetExecutionReport method) as_full_map() (dissect.eventlog.bxml.Template method) as_hashlib_method() (acquire.acquire.hashes.HashFunc method) as_map() (dissect.eventlog.bxml.Template method) ASCII_MAP (in module dissect.target.plugins.apps.container.docker) asdf (dissect.evidence.asdf.asdf.AsdfStream attribute) (dissect.target.containers.asdf.AsdfContainer attribute) (dissect.target.loaders.asdf.AsdfLoader attribute) asdf_def (in module dissect.evidence.asdf.c_asdf) AsdfContainer (class in dissect.target.containers.asdf) AsdfLoader (class in dissect.target.loaders.asdf) AsdfSnapshot (class in dissect.evidence.asdf.asdf) AsdfStream (class in dissect.evidence.asdf.asdf) AsdfWriter (class in dissect.evidence.asdf.asdf) ASIF (class in dissect.hypervisor.disk.asif) asif (dissect.hypervisor.disk.asif.DataStream attribute) (dissect.hypervisor.disk.asif.Directory attribute) (dissect.hypervisor.disk.asif.Table attribute) (dissect.target.containers.asif.AsifContainer attribute) asif_def (in module dissect.hypervisor.disk.c_asif) AsifContainer (class in dissect.target.containers.asif) AsnRecord (in module flow.record.tools.geoip) asnrecord_for_ip() (in module flow.record.tools.geoip) assemble_tiles_into_collage() (in module dissect.target.plugins.os.windows.rdpcache) AST_COMPARATORS (in module flow.record.selector) AST_OPERATORS (in module flow.record.selector) asymmetric_encrypted_key() (dissect.fve.bde.information.VmkInfoDatum method) AsymmetricEncryptedDatum (class in dissect.fve.bde.information) ASYNC (dissect.target.plugins.os.windows.network.IfTypes attribute) atime (dissect.apfs.objects.fs.INode property) (dissect.btrfs.btrfs.INode property) (dissect.evidence.ad1.ad1.FileEntry property) (dissect.extfs.extfs.INode property) (dissect.fat.fat.DirectoryEntry property) (dissect.fat.fat.RootDirectory property) (dissect.ffs.ffs.INode property) (dissect.jffs.jffs2.INode property) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx6.INode6 property) (dissect.qnxfs.qnx6.QNX6 attribute) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.xfs.xfs.INode property) atime_ns (dissect.btrfs.btrfs.INode property) (dissect.extfs.extfs.INode property) (dissect.ffs.ffs.INode property) (dissect.xfs.xfs.INode property) atjob_def (in module dissect.target.plugins.os.windows.tasks.job) ATM (dissect.target.plugins.os.windows.network.IfTypes attribute) ATM_DXI (dissect.target.plugins.os.windows.network.IfTypes attribute) ATM_FUNI (dissect.target.plugins.os.windows.network.IfTypes attribute) ATM_IMA (dissect.target.plugins.os.windows.network.IfTypes attribute) ATM_LOGICAL (dissect.target.plugins.os.windows.network.IfTypes attribute) ATM_RADIO (dissect.target.plugins.os.windows.network.IfTypes attribute) ATM_SUBINTERFACE (dissect.target.plugins.os.windows.network.IfTypes attribute) ATM_VCI_ENDPT (dissect.target.plugins.os.windows.network.IfTypes attribute) ATM_VIRTUAL (dissect.target.plugins.os.windows.network.IfTypes attribute) atop() (dissect.target.plugins.os.unix.log.atop.AtopPlugin method) atop_def (in module dissect.target.plugins.os.unix.log.atop) ATOP_GLOB (dissect.target.plugins.os.unix.log.atop.AtopPlugin attribute) ATOP_MAGIC (dissect.target.plugins.os.unix.log.atop.AtopPlugin attribute) ATOP_PATH (dissect.target.plugins.os.unix.log.atop.AtopPlugin attribute) atop_tstat_def (in module dissect.target.plugins.os.unix.log.atop) ATOP_VERSIONS (dissect.target.plugins.os.unix.log.atop.AtopPlugin attribute) AtopFile (class in dissect.target.plugins.os.unix.log.atop) AtopPlugin (class in dissect.target.plugins.os.unix.log.atop) AtopRecord (in module dissect.target.plugins.os.unix.log.atop) attach() (dissect.volume.lvm.metadata.VolumeGroup method) AtTask (class in dissect.target.plugins.os.windows.tasks.job) attr (dissect.hypervisor.descriptor.vmx.VMX attribute) (dissect.hypervisor.disk.vmdk.DiskDescriptor attribute) (dissect.ntfs.attr.FileName attribute) (dissect.ntfs.attr.ReparsePoint attribute) (dissect.ntfs.attr.StandardInformation attribute) attr() (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.MappedFile method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) attr_extents (dissect.xfs.xfs.INode property) attrfork() (dissect.xfs.xfs.INode method) Attribute (class in dissect.ntfs.attr) attribute (dissect.ntfs.attr.Attribute attribute) (dissect.ntfs.index.IndexEntry property) (dissect.util.ldap.SearchFilter attribute) ATTRIBUTE_CLASS_MAP (in module dissect.ntfs.attr) ATTRIBUTE_ENCODE_DECODE_MAP (in module dissect.database.ese.ntds.util) ATTRIBUTE_FLAG_COMPRESSION_MASK (in module dissect.ntfs.c_ntfs) ATTRIBUTE_FLAG_ENCRYPTED (in module dissect.ntfs.c_ntfs) ATTRIBUTE_FLAG_SPARSE (in module dissect.ntfs.c_ntfs) ATTRIBUTE_LIST_ENCODE_DECODE_MAP (in module dissect.database.ese.ntds.util) attribute_type (dissect.ntfs.index.IndexRoot property) ATTRIBUTE_TYPE_CODE (in module dissect.ntfs.c_ntfs) AttributeCollection (class in dissect.ntfs.util) AttributeEntry (class in dissect.database.ese.ntds.schema) AttributeHeader (class in dissect.ntfs.attr) AttributeList (class in dissect.ntfs.attr) AttributeMap (class in dissect.ntfs.util) AttributeRecord (class in dissect.ntfs.attr) attributes (dissect.eventlog.bxml.BxmlTag attribute) (dissect.hypervisor.util.envelope.Envelope attribute) (dissect.ntfs.mft.MftRecord property) (dissect.target.helpers.nfs.nfs3.EntryPlus attribute) (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj attribute) (dissect.target.plugins.os.windows.everything.parser.Record attribute) attributes() (dissect.ntfs.attr.AttributeList method) AttributeSchema (class in dissect.database.ese.ntds.objects.attributeschema) attrsetter() (in module dissect.cstruct.types.structure) attrtyp_to_oid() (dissect.database.ese.ntds.schema.Schema method) audit() (dissect.target.plugins.os.unix.log.audit.AuditPlugin method) AUDIT_REGEX (in module dissect.target.plugins.os.unix.log.audit) AuditPlugin (class in dissect.target.plugins.os.unix.log.audit) auditpol() (dissect.target.plugins.os.windows.regf.auditpol.AuditpolPlugin method) AuditPolicyRecord (in module dissect.target.plugins.os.windows.regf.auditpol) AuditpolPlugin (class in dissect.target.plugins.os.windows.regf.auditpol) AuditRecord (in module dissect.target.plugins.os.unix.log.audit) AUTH_BADCRED (dissect.target.helpers.sunrpc.sunrpc.AuthStat attribute) AUTH_BADVERF (dissect.target.helpers.sunrpc.sunrpc.AuthStat attribute) AUTH_DES (dissect.target.helpers.sunrpc.serializer.AuthFlavor attribute) AUTH_ERROR (dissect.target.helpers.sunrpc.sunrpc.RejectStat attribute) auth_flavors (dissect.target.helpers.nfs.nfs3.MountOK attribute) AUTH_NULL (dissect.target.helpers.sunrpc.serializer.AuthFlavor attribute) auth_null() (in module dissect.target.helpers.sunrpc.client) AUTH_REJECTEDCRED (dissect.target.helpers.sunrpc.sunrpc.AuthStat attribute) AUTH_REJECTEDVERF (dissect.target.helpers.sunrpc.sunrpc.AuthStat attribute) AUTH_SHORT (dissect.target.helpers.sunrpc.serializer.AuthFlavor attribute) AUTH_TOOWEAK (dissect.target.helpers.sunrpc.sunrpc.AuthStat attribute) AUTH_UNIX (dissect.target.helpers.sunrpc.serializer.AuthFlavor attribute) auth_unix() (in module dissect.target.helpers.sunrpc.client) AUTHENTICATOR (in module dissect.database.ese.ntds.pek) AuthFlavor (class in dissect.target.helpers.sunrpc.serializer) AuthFlavorNotSupported authlog() (dissect.target.plugins.os.unix.log.auth.AuthPlugin method) AuthLogRecordBuilder (class in dissect.target.plugins.os.unix.log.auth) AuthNull (class in dissect.target.helpers.sunrpc.sunrpc) AuthNullSerializer (class in dissect.target.helpers.sunrpc.serializer) author (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) authorized_keys() (dissect.target.plugins.apps.ssh.openssh.OpenSSHPlugin method) AuthorizedKeysRecord (in module dissect.target.plugins.apps.ssh.ssh) AuthPlugin (class in dissect.target.plugins.os.unix.log.auth) AuthProtocol (in module dissect.target.helpers.sunrpc.serializer) AuthScheme (class in dissect.target.helpers.sunrpc.client) AuthSerializer (class in dissect.target.helpers.sunrpc.serializer) AuthSetter (in module dissect.target.filesystems.nfs) AuthStat (class in dissect.target.helpers.sunrpc.sunrpc) AuthUnix (class in dissect.target.helpers.sunrpc.sunrpc) AuthUnixSerializer (class in dissect.target.helpers.sunrpc.serializer) auto_backing_file (dissect.hypervisor.disk.qcow2.QCow2 attribute) auto_flush (flow.record.adapter.text.TextWriter attribute) (flow.record.stream.RecordPrinter attribute) auto_upload (acquire.acquire.gui.base.GUI attribute) autocommit_blocks (dissect.volume.lvm.metadata.WriteCacheSegment attribute) autocommit_time (dissect.volume.lvm.metadata.WriteCacheSegment attribute) automatic_destination() (dissect.target.plugins.os.windows.jumplist.JumpListPlugin method) automatic_destinations (dissect.target.plugins.os.windows.jumplist.JumpListPlugin attribute) AutomaticDestinationFile (class in dissect.target.plugins.os.windows.jumplist) Autostart (dissect.target.plugins.apps.productivity.msoffice.LoadBehavior attribute) AV (class in acquire.acquire.acquire) AV_ACTION_TAKEN (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_CLEANABLE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_COMPRESSED (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_CONFIDENCE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_DELETABLE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_DEPTH (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_DOWNLOADED_FROM (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_EVENT (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_EVENT_DATA (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_FILE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_PREVALENCE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_QUARANTINE_ID (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_QUARANTINE_STATUS (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_RISK (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_SCAN_ID (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_STILL_INFECTED (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_TIMESTAMP (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_USER (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_VIRUS (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_VIRUS_ID (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_VIRUS_TYPE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AvailableLZ4 (class in dissect.squashfs.compression) AvailableLZO (class in dissect.squashfs.compression) AVRO_MAGIC (in module flow.record.base) AVRO_TYPE_MAP (in module flow.record.adapter.avro) avro_type_to_flow_type() (in module flow.record.adapter.avro) AvroReader (class in flow.record.adapter.avro) AvroWriter (class in flow.record.adapter.avro) AX_25 (dissect.target.helpers.network.IANAProtocol attribute) B ba_size (dissect.volume.lvm.metadata.PhysicalVolume attribute) ba_start (dissect.volume.lvm.metadata.PhysicalVolume attribute) backing_file (dissect.hypervisor.disk.qcow2.QCow2 attribute) backing_format (dissect.hypervisor.disk.qcow2.QCow2 attribute) backlinks() (dissect.database.ese.ntds.database.LinkTable method) (dissect.database.ese.ntds.objects.object.Object method) backtrace() (flow.record.selector.SelectorResult method) backtrace_info (flow.record.selector.SelectorResult attribute) backup (dissect.target.filesystems.itunes.ITunesFilesystem attribute) (dissect.target.loaders.itunes.FileInfo attribute) (dissect.target.loaders.itunes.ITunesLoader attribute) BackupInfoDatum (class in dissect.fve.bde.information) BAD_CLUSTER (in module dissect.fat.c_fat) BadClusterError bag_def (in module dissect.target.plugins.os.windows.regf.shellbags) bagkeys (dissect.target.plugins.os.windows.regf.shellbags.ShellBagsPlugin attribute) bam() (dissect.target.plugins.os.windows.regf.bam.BamDamPlugin method) bam_def (in module dissect.target.plugins.os.windows.regf.bam) BamDamPlugin (class in dissect.target.plugins.os.windows.regf.bam) BamDamRecord (in module dissect.target.plugins.os.windows.regf.bam) Bank (class in dissect.archive.vbk) banks (dissect.archive.vbk.SnapshotSlot attribute) base (acquire.acquire.collector.Collector attribute) (dissect.executable.pe.directory.export.ExportDirectory property) (dissect.target.filesystems.tar.TarFilesystem attribute) (dissect.target.filesystems.zip.ZipFilesystem attribute) base() (flow.record.base.RecordDescriptor method) BASE_KEY (dissect.target.plugins.apps.productivity.winrar.WinRarPlugin attribute) base_offset (dissect.evidence.ewf.ewf.TableSection attribute) base_path (dissect.target.filesystems.dir.DirectoryFilesystem attribute) (dissect.target.filesystems.overlay.Overlay2Filesystem attribute) (dissect.target.filesystems.overlay.OverlayFilesystem attribute) base_records() (dissect.clfs.blf.BLF method) base_relocations (dissect.executable.pe.pe.PE property) base_use_data (dissect.target.plugins.os.windows.regf.cit.CIT attribute) BaseArray (class in dissect.cstruct.types.base) BaseLocatePlugin (class in dissect.target.plugins.os.unix.locate.locate) basename() (in module dissect.target.helpers.polypath) BaseRecord (class in dissect.clfs.blf) BaseRelocation (class in dissect.executable.pe.directory.basereloc) BaseRelocationDirectory (class in dissect.executable.pe.directory.basereloc) BaseSchema (dissect.database.ese.ntds.util.SystemFlags attribute) BaseService (class in dissect.target.plugins.os.unix.log.auth) BaseTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) BaseType (class in dissect.cstruct.types.base) BaseUseData (class in dissect.target.plugins.os.windows.regf.cit) BaseUseDataBitmaps (class in dissect.target.plugins.os.windows.regf.cit) BASIC_ISDN (dissect.target.plugins.os.windows.network.IfTypes attribute) BASIC_RECORD_FIELDS (in module dissect.target.plugins.apps.webserver.iis) BasicRecordDescriptor (in module dissect.target.plugins.apps.webserver.iis) bat (dissect.hypervisor.disk.hdd.HDS property) (dissect.hypervisor.disk.vhd.DynamicDisk attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) BAT_REGION_GUID (in module dissect.hypervisor.disk.c_vhdx) batch_size (flow.record.adapter.duckdb.DuckdbReader attribute) (flow.record.adapter.duckdb.DuckdbWriter attribute) (flow.record.adapter.sqlite.SqliteReader attribute) (flow.record.adapter.sqlite.SqliteWriter attribute) BBN_RCC_MON (dissect.target.helpers.network.IANAProtocol attribute) BDE (class in dissect.fve.bde.bde) bde (dissect.fve.bde.bde.BitlockerStream attribute) (dissect.target.volumes.bde.BitlockerVolumeSystem attribute) (in module dissect.target.volume) bde_def (in module dissect.fve.bde.c_bde) be_hex_to_int() (in module dissect.target.plugins.os.unix.linux.network) BestEffortBlockStream (class in dissect.vmfs.descriptor) BFFCALLBACK (in module acquire.acquire.gui.win32) BGP_POLICY_ACCOUNTING (dissect.target.plugins.os.windows.network.IfTypes attribute) bias (dissect.target.plugins.os.windows.datetime.TimezoneInformation attribute) (dissect.target.plugins.os.windows.datetime.WindowsTimezone attribute) BigData (class in dissect.regf.regf) Bin (class in dissect.target.helpers.configutil) BIN_MAGIC (in module dissect.target.plugins.os.windows.rdpcache) BINARY (dissect.eventlog.bxml.BxmlType attribute) (dissect.target.helpers.regutil.RegistryValueType attribute) binary_operators (dissect.cstruct.expression.Expression attribute) BinaryAppcompatRecord (in module dissect.target.plugins.os.windows.amcache) bind (dissect.executable.elf.elf.Symbol attribute) bind() (acquire.acquire.collector.Collector method) bind_module() (acquire.acquire.collector.Collector method) BINXML (dissect.eventlog.bxml.BxmlType attribute) bio_rotation (dissect.volume.lvm.metadata.VdoPoolSegment attribute) bio_threads (dissect.volume.lvm.metadata.VdoPoolSegment attribute) BIT (dissect.util.ldap.ComparisonOperator attribute) BIT64_HEADERS (in module dissect.etl.headers.headers) BIT_EMU (dissect.target.helpers.network.IANAProtocol attribute) BitBuffer (class in dissect.cstruct.bitbuffer) BITLOCKER_SIGNATURE (in module dissect.fve.bde.c_bde) BITLOCKER_TO_GO_SIGNATURE (in module dissect.fve.bde.c_bde) BitlockerStream (class in dissect.fve.bde.bde) BitlockerVolumeSystem (class in dissect.target.volumes.bde) BitlockerVolumeSystemError bitmap (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.fve.bde.eow.EowBitmapRecord property) (dissect.volume.vss.BlockDescriptor attribute) (dissect.volume.vss.Store property) bitmap() (dissect.hypervisor.disk.qcow2.L2Table method) bitmap_cache_def (in module dissect.target.plugins.os.windows.rdpcache) bitmap_def (in module dissect.target.plugins.os.windows.rdpcache) BITMAP_ENTRY (in module dissect.fat.c_exfat) BITMAP_FIELDS (in module dissect.target.plugins.os.windows.regf.cit) bitmap_flush_interval (dissect.volume.lvm.metadata.IntegritySegment attribute) bitmap_header (dissect.hypervisor.disk.qcow2.QCow2 attribute) bitmap_size (dissect.fve.bde.eow.EowBitmapRecord property) bitmaps (dissect.fve.bde.eow.EowInformation property) (dissect.target.plugins.os.windows.regf.cit.BaseUseData attribute) BitmapTile (class in dissect.target.plugins.os.windows.rdpcache) BITS (class in acquire.acquire.acquire) bits (dissect.cstruct.types.structure.Field attribute) (dissect.util.compression.lzxpress_huffman.BitString attribute) (dissect.util.stream.BitStream attribute) BitStream (class in dissect.util.stream) BitString (class in dissect.util.compression.lzxpress_huffman) BLACK (dissect.target.helpers.cyber.Color attribute) BLF (class in dissect.clfs.blf) BLF_PATH (dissect.target.plugins.os.windows.clfs.ClfsPlugin attribute) BLK (dissect.target.helpers.nfs.nfs3.FileType attribute) blkstofrags() (in module dissect.ffs.ffs) Blob (class in dissect.target.plugins.os.windows.dpapi.blob) blob (dissect.database.bsd.tools.rpm.Package attribute) (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) blob_data() (dissect.archive.vma.VMA method) blob_def (in module dissect.target.plugins.os.windows.dpapi.blob) blob_string() (dissect.archive.vma.VMA method) block (dissect.apfs.objects.base.Object attribute) (dissect.apfs.objects.btree.BTree attribute) (dissect.extfs.journal.DescriptorBlockTag attribute) (dissect.ffs.ffs.CylinderGroup attribute) (dissect.squashfs.squashfs.INode attribute) (dissect.vmfs.address.FileBlockAddr property) (dissect.vmfs.address.LargeFileBlockAddr property) block_compress (dissect.evidence.asdf.asdf.AsdfWriter attribute) block_count (dissect.apfs.apfs.APFS property) (dissect.apfs.objects.nx_superblock.NxSuperblock property) (dissect.extfs.extfs.ExtFS attribute) block_crc (dissect.evidence.asdf.asdf.AsdfWriter attribute) BLOCK_FLAG (in module dissect.volume.vss) block_id (dissect.archive.vbk.FibBlockDescriptor property) BLOCK_INDENT (in module dissect.target.tools.utils.report) block_length (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm attribute) (dissect.target.plugins.os.windows.dpapi.crypto.HashAlgorithm attribute) block_list (dissect.squashfs.squashfs.INode property) (dissect.volume.vss.Store property) block_log (dissect.squashfs.squashfs.SquashFS attribute) BLOCK_MAGIC (in module dissect.evidence.asdf.asdf) block_map_cache_size_mb (dissect.volume.lvm.metadata.VdoPoolSegment attribute) block_map_era_length (dissect.volume.lvm.metadata.VdoPoolSegment attribute) block_size (dissect.apfs.apfs.APFS property) (dissect.apfs.objects.nx_superblock.NxSuperblock property) (dissect.archive.vbk.FibBlockDescriptor property) (dissect.archive.vbk.MetaTableDescriptor property) (dissect.archive.vbk.VBK attribute) (dissect.extfs.extfs.ExtFS attribute) (dissect.extfs.journal.JDB2 attribute) (dissect.ffs.ffs.FFS attribute) (dissect.fve.crypto.base.Cipher attribute) (dissect.fve.crypto.Cipher attribute) (dissect.hypervisor.disk.asif.ASIF attribute) (dissect.hypervisor.disk.vdi.VDI property) (dissect.hypervisor.disk.vdi.VDIStream attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) (dissect.ntfs.stream.CompressedRunlistStream attribute) (dissect.qnxfs.qnx4.QNX4 attribute) (dissect.qnxfs.qnx6.QNX6 attribute) (dissect.squashfs.squashfs.SquashFS attribute) (dissect.util.stream.RunlistStream attribute) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) (dissect.volume.ddf.ddf.PhysicalDiskRecord attribute) (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) (dissect.volume.dm.btree.BTree attribute) (dissect.volume.dm.thin.ThinDevice attribute) (dissect.volume.lvm.metadata.IntegritySegment attribute) (dissect.xfs.xfs.AllocationGroup attribute) (dissect.xfs.xfs.XFS attribute) BLOCK_SIZE (in module dissect.archive.xva) (in module dissect.eventlog.evt) (in module dissect.target.loaders.phobos) (in module dissect.target.tools.diff) (in module dissect.volume.vss) block_store (dissect.archive.vbk.VBK attribute) block_type (dissect.clfs.blf.BaseRecord attribute) BlockAllocationTable (class in dissect.hypervisor.disk.vhd) (class in dissect.hypervisor.disk.vhdx) BlockDescriptor (class in dissect.volume.vss) BLOCKED (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) BlockHeader (class in dissect.clfs.c_clfs) BlockList (class in dissect.volume.vss) BlockMap (class in dissect.volume.vss) blocks (dissect.archive.vma.Extent attribute) (dissect.cramfs.cramfs.BlockStream attribute) (dissect.cramfs.cramfs.INode property) (dissect.vmfs.descriptor.FileDescriptor property) blocks_offset (dissect.hypervisor.disk.vdi.VDI property) BlockStream (class in dissect.cramfs.cramfs) (class in dissect.vmfs.descriptor) BLUE (dissect.target.helpers.cyber.Color attribute) (dissect.target.tools.shell.AnsiColors attribute) BM_SETCHECK (in module acquire.acquire.gui.win32) BMAP (class in dissect.eventlog.wevt_object) BMP_DATA_OFFSET (in module dissect.target.plugins.os.windows.rdpcache) BMP_MAGIC (in module dissect.target.plugins.os.windows.rdpcache) BN_CLICKED (in module acquire.acquire.gui.win32) BNA (dissect.target.helpers.network.IANAProtocol attribute) body (dissect.target.helpers.sunrpc.sunrpc.Message attribute) body() (dissect.target.plugins.filesystem.ntfs.mft.MftPlugin method) BOLD_BLUE (dissect.target.tools.shell.AnsiColors attribute) BOLD_CYAN (dissect.target.tools.shell.AnsiColors attribute) BOLD_GREEN (dissect.target.tools.shell.AnsiColors attribute) BOLD_MAGENTA (dissect.target.tools.shell.AnsiColors attribute) BOLD_RED (dissect.target.tools.shell.AnsiColors attribute) BOLD_WHITE (dissect.target.tools.shell.AnsiColors attribute) BOLD_YELLOW (dissect.target.tools.shell.AnsiColors attribute) Bool (class in dissect.target.helpers.sunrpc.sunrpc) BOOL (dissect.eventlog.bxml.BxmlType attribute) boolean (class in flow.record.fieldtypes) boolean_argument() (in module flow.record.utils) boolean_field_names (dissect.target.plugins.apps.vpn.openvpn.OpenVPNParser attribute) BOOLEAN_STATES (in module dissect.cim.c_cim) Boot (class in acquire.acquire.acquire) boot() (dissect.target.plugins.os.windows.log.etl.EtlPlugin method) boot_sector (dissect.fve.bde.bde.BDE attribute) (dissect.fve.bde.bde.BootSector attribute) Bootbanks (class in acquire.acquire.acquire) BootSector (class in dissect.fve.bde.bde) bootshell() (dissect.target.plugins.os.windows.generic.GenericPlugin method) BootShellRecord (in module dissect.target.plugins.os.windows.generic) BOOTSTRAP_ATTRIBUTES (in module dissect.database.ese.ntds.schema) BOOTSTRAP_COLUMNS (in module dissect.database.ese.ntds.schema) BOOTSTRAP_OBJECT_CLASSES (in module dissect.database.ese.ntds.schema) BOOTSTRAP_OID_PREFIXES (in module dissect.database.ese.ntds.schema) BootTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) BORDER_PIXEL (in module dissect.target.plugins.os.windows.rdpcache) BOTTOM (acquire.acquire.acquire.ExecutionOrder attribute) bound_address (dissect.executable.pe.directory.delay_import.DelayImportFunction attribute) bound_import (dissect.executable.pe.pe.PE property) bound_module_name (acquire.acquire.collector.Collector attribute) BoundImportDirectory (class in dissect.executable.pe.directory.bound_import) BoundImportForwardReference (class in dissect.executable.pe.directory.bound_import) BoundImportModule (class in dissect.executable.pe.directory.bound_import) bpb (dissect.fat.fat.FATFS attribute) bPrefixData (in module dissect.database.ese.index) bPrefixNull (in module dissect.database.ese.index) bPrefixNullHigh (in module dissect.database.ese.index) bPrefixZeroLength (in module dissect.database.ese.index) BR_SAT_MON (dissect.target.helpers.network.IANAProtocol attribute) BranchNode (class in dissect.database.ese.page) BravePlugin (class in dissect.target.plugins.apps.browser.brave) BrokenIndexError BrokenMftError Broker (class in dissect.target.loaders.mqtt) broker (dissect.target.loaders.mqtt.MqttConnection attribute) (dissect.target.loaders.mqtt.MqttLoader attribute) broker_host (dissect.target.loaders.mqtt.Broker attribute) broker_port (dissect.target.loaders.mqtt.Broker attribute) BrokerReader (class in flow.record.adapter.broker) BrokerWriter (class in flow.record.adapter.broker) BROWSEINFOA (class in acquire.acquire.gui.win32) BROWSER_RECORD_MAP (in module dissect.target.plugins.os.windows.search) BrowserCookieRecord (dissect.target.plugins.apps.browser.brave.BravePlugin attribute) (dissect.target.plugins.apps.browser.chrome.ChromePlugin attribute) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin attribute) (dissect.target.plugins.apps.browser.edge.EdgePlugin attribute) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin attribute) (in module dissect.target.plugins.apps.browser.browser) BrowserDownloadRecord (dissect.target.plugins.apps.browser.brave.BravePlugin attribute) (dissect.target.plugins.apps.browser.chrome.ChromePlugin attribute) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin attribute) (dissect.target.plugins.apps.browser.edge.EdgePlugin attribute) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin attribute) (dissect.target.plugins.apps.browser.iexplore.InternetExplorerPlugin attribute) (in module dissect.target.plugins.apps.browser.browser) BrowserExtensionRecord (dissect.target.plugins.apps.browser.brave.BravePlugin attribute) (dissect.target.plugins.apps.browser.chrome.ChromePlugin attribute) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin attribute) (dissect.target.plugins.apps.browser.edge.EdgePlugin attribute) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin attribute) (in module dissect.target.plugins.apps.browser.browser) BrowserHistoryRecord (dissect.target.plugins.apps.browser.brave.BravePlugin attribute) (dissect.target.plugins.apps.browser.chrome.ChromePlugin attribute) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin attribute) (dissect.target.plugins.apps.browser.edge.EdgePlugin attribute) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin attribute) (dissect.target.plugins.apps.browser.iexplore.InternetExplorerPlugin attribute) (dissect.target.plugins.apps.browser.safari.SafariPlugin attribute) (in module dissect.target.plugins.apps.browser.browser) BrowserPasswordRecord (dissect.target.plugins.apps.browser.brave.BravePlugin attribute) (dissect.target.plugins.apps.browser.chrome.ChromePlugin attribute) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin attribute) (dissect.target.plugins.apps.browser.edge.EdgePlugin attribute) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin attribute) (in module dissect.target.plugins.apps.browser.browser) BrowserPlugin (class in dissect.target.plugins.apps.browser.browser) BS_AUTOCHECKBOX (in module acquire.acquire.gui.win32) BS_CENTER (in module acquire.acquire.gui.win32) BS_CHECKBOX (in module acquire.acquire.gui.win32) BS_FLAT (in module acquire.acquire.gui.win32) BS_PUSHBUTTON (in module acquire.acquire.gui.win32) BS_TO_PAGE() (in module dissect.database.bsd.db) BSC (dissect.target.plugins.os.windows.network.IfTypes attribute) BSD (class in acquire.acquire.acquire) (class in dissect.volume.disk.schemes.bsd) (dissect.target.plugin.OperatingSystem attribute) bsd_def (in module dissect.volume.disk.schemes.bsd) bsd_flags (dissect.apfs.objects.fs.INode property) BsdPlugin (class in dissect.target.plugins.os.unix.bsd._os) BsdProfile (class in acquire.acquire.acquire) bSentinel (in module dissect.database.ese.index) bsf() (in module dissect.ntfs.util) (in module dissect.vmfs.util) btime (dissect.apfs.objects.fs.INode property) (dissect.evidence.ad1.ad1.FileEntry property) (dissect.ffs.ffs.INode property) btime_ns (dissect.ffs.ffs.INode property) btmp() (dissect.target.plugins.os.unix.log.utmp.UtmpPlugin method) btmp_paths (dissect.target.plugins.os.unix.log.utmp.UtmpPlugin attribute) BtmpRecord (in module dissect.target.plugins.os.unix.log.utmp) BTree (class in dissect.apfs.objects.btree) (class in dissect.btrfs.tree) (class in dissect.database.ese.btree) (class in dissect.volume.dm.btree) btree (dissect.apfs.cursor.Cursor attribute) (dissect.apfs.objects.omap.ObjectMap property) (dissect.btrfs.tree.Cursor attribute) BTreeNode (class in dissect.apfs.objects.btree_node) Btrfs (class in dissect.btrfs.btrfs) btrfs (dissect.btrfs.btrfs.INode attribute) (dissect.btrfs.btrfs.Subvolume attribute) (dissect.btrfs.stream.ChunkStream attribute) (dissect.btrfs.tree.BTree attribute) (dissect.target.filesystems.btrfs.BtrfsFilesystem attribute) (dissect.target.filesystems.btrfs.BtrfsSubvolumeFilesystem attribute) BTRFS_BLOCK_GROUP (in module dissect.btrfs.c_btrfs) BTRFS_BLOCK_GROUP_PROFILE_MASK (in module dissect.btrfs.c_btrfs) BTRFS_BLOCK_GROUP_RAID1_MASK (in module dissect.btrfs.c_btrfs) BTRFS_BLOCK_GROUP_RAID56_MASK (in module dissect.btrfs.c_btrfs) BTRFS_BLOCK_GROUP_STRIPE_MASK (in module dissect.btrfs.c_btrfs) BTRFS_BLOCK_GROUP_TYPE_MASK (in module dissect.btrfs.c_btrfs) btrfs_def (in module dissect.btrfs.c_btrfs) BTRFS_RAID_ATTRIBUTES (in module dissect.btrfs.c_btrfs) BtrfsDirEntry (class in dissect.target.filesystems.btrfs) BtrfsFilesystem (class in dissect.target.filesystems.btrfs) BtrfsFilesystemEntry (class in dissect.target.filesystems.btrfs) BtrfsSubvolumeFilesystem (class in dissect.target.filesystems.btrfs) bucket_name (acquire.acquire.uploaders.minio.MinIO attribute) BUCKET_TO_PAGE() (in module dissect.database.bsd.db) buf (dissect.archive.vbk.MetaItem attribute) (dissect.database.bsd.tools.rpm.HeaderBlob attribute) (dissect.database.ese.page.Page attribute) (dissect.ntfs.index.IndexEntry attribute) (dissect.target.loaders.res.UPR attribute) (dissect.target.plugins.os.windows.regf.cit.CIT attribute) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK attribute) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM attribute) (dissect.volume.dm.btree.Node attribute) Buffer (class in dissect.etl.etl) buffer (dissect.ntfs.attr.ReparsePoint attribute) (dissect.util.stream.BitStream attribute) buffer() (dissect.etl.etl.ETL method) buffer_header (dissect.etl.etl.ETL attribute) buffer_sectors (dissect.volume.lvm.metadata.IntegritySegment attribute) buffer_size (dissect.etl.etl.ETL attribute) BUFFER_SIZE (in module acquire.acquire.dynamic.windows.ntdll) (in module dissect.target.helpers.hashutil) BufferedStream (class in dissect.util.stream) BufferFlag (in module dissect.etl.c_etl) buffers (acquire.acquire.tools.decrypter.EncryptedFile attribute) buffers() (dissect.etl.etl.ETL method) buffers_written (dissect.etl.headers.logfile.LogfileHeader property) BufferType (in module dissect.etl.c_etl) build() (dissect.target.plugins.apps.edr.velociraptor.VelociraptorRecordBuilder method) build_pipe() (in module dissect.target.tools.shell) build_pipe_stdout() (in module dissect.target.tools.shell) build_prop_paths (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin attribute) build_record() (dissect.target.plugins.os.unix.log.auth.AuthLogRecordBuilder method) (dissect.target.plugins.os.windows.search.SearchIndexPlugin method) BUILTIN_PROPERTIES (in module dissect.cim.c_cim) builtin_property_name (dissect.cim.classes.PropertyReference property) BUILTIN_QUALIFIERS (in module dissect.cim.c_cim) BuiltinDomain (class in dissect.database.ese.ntds.objects.builtindomain) Bxml (class in dissect.eventlog.bxml) bxml (dissect.eventlog.bxml.BxmlNameReader attribute) BXML_ATTRIBUTE (dissect.eventlog.bxml.BxmlToken attribute) BXML_CLOSE_EMPTY_ELEMENT_TAG (dissect.eventlog.bxml.BxmlToken attribute) BXML_CLOSE_START_ELEMENT_TAG (dissect.eventlog.bxml.BxmlToken attribute) bxml_datastream (dissect.eventlog.bxml.BxmlNameReader attribute) bxml_def (in module dissect.eventlog.bxml) BXML_END (dissect.eventlog.bxml.BxmlToken attribute) BXML_END_ELEMENT (dissect.eventlog.bxml.BxmlToken attribute) BXML_FRAGMENT_HEADER (dissect.eventlog.bxml.BxmlToken attribute) BXML_START_ELEMENT (dissect.eventlog.bxml.BxmlToken attribute) bxml_stream (dissect.eventlog.bxml.Bxml attribute) bxml_struct (in module dissect.eventlog.bxml) BXML_TEMPLATE_INSTANCE (dissect.eventlog.bxml.BxmlToken attribute) BXML_TOKEN_CHAR_REFERENCE (dissect.eventlog.bxml.BxmlToken attribute) BXML_TOKEN_ENTITY_REFERENCE (dissect.eventlog.bxml.BxmlToken attribute) BXML_TOKEN_NORMAL_SUBSTITUTION (dissect.eventlog.bxml.BxmlToken attribute) BXML_TOKEN_OPTIONAL_SUBSTITUTION (dissect.eventlog.bxml.BxmlToken attribute) BXML_VALUE (dissect.eventlog.bxml.BxmlToken attribute) BxmlException BxmlNameReader (class in dissect.eventlog.bxml) BxmlSub (class in dissect.eventlog.bxml) BxmlTag (class in dissect.eventlog.bxml) BxmlTemplateDescriptor (class in dissect.eventlog.bxml) BxmlToken (class in dissect.eventlog.bxml) BxmlType (class in dissect.eventlog.bxml) by_name() (dissect.executable.elf.elf.SectionTable method) by_type() (dissect.executable.elf.elf.SectionTable method) (dissect.executable.elf.elf.SegmentTable method) ByName (in module dissect.volume.vinum.vinum) bytes (class in flow.record.fieldtypes) (dissect.target.loaders.mqtt.MqttTransferRatePerSecond attribute) BYTES_IN_NUMBER (in module dissect.thumbcache.index) bytes_left() (in module dissect.etl.utils) bytes_per_index_buffer (dissect.ntfs.index.IndexRoot property) bytes_received (dissect.target.loaders.mqtt.Broker attribute) BytesDefaultEnum (class in dissect.volume.vinum.config) BZ2_MAGIC (in module flow.record.base) BZIP2 (dissect.target.tools.dump.Compression attribute) BZIP_HEADER (in module dissect.target.plugins.os.windows.everything.parser) C c_acquire (in module acquire.acquire.crypt) c_ad1 (in module dissect.evidence.ad1.c_ad1) c_adcrypt (in module dissect.evidence.adcrypt.c_adcrypt) c_adpolicy (in module dissect.target.plugins.os.windows.adpolicy) c_adtev (in module dissect.target.plugins.os.windows.regf.auditpol) c_apfs (in module dissect.apfs.c_apfs) c_apm (in module dissect.volume.disk.schemes.apm) c_appdb (in module dissect.target.plugins.os.windows.notifications) c_asdf (in module dissect.evidence.asdf.c_asdf) c_asif (in module dissect.hypervisor.disk.c_asif) c_atjob (in module dissect.target.plugins.os.windows.tasks.job) c_atop (in module dissect.target.plugins.os.unix.log.atop) c_bag (in module dissect.target.plugins.os.windows.regf.shellbags) c_bam (in module dissect.target.plugins.os.windows.regf.bam) c_bde (in module dissect.fve.bde.c_bde) c_bitmap_cache (in module dissect.target.plugins.os.windows.rdpcache) c_blob (in module dissect.target.plugins.os.windows.dpapi.blob) c_bmp (in module dissect.target.plugins.os.windows.rdpcache) c_bsd (in module dissect.volume.disk.schemes.bsd) c_btrfs (in module dissect.btrfs.c_btrfs) c_cim (in module dissect.cim.c_cim) c_cit (in module dissect.target.plugins.os.windows.regf.cit) c_clfs (in module dissect.clfs.c_clfs) c_common_elf (in module dissect.executable.elf.c_elf) c_cramfs (in module dissect.cramfs.c_cramfs) c_credhist (in module dissect.target.plugins.os.windows.credential.credhist) c_custom_destination (in module dissect.target.plugins.os.windows.jumplist) c_db (in module dissect.database.bsd.c_db) c_ddf (in module dissect.volume.ddf.c_ddf) c_def (in module dissect.hypervisor.util.envelope) c_defaultpassword (in module dissect.target.plugins.os.windows.credential.defaultpassword) c_defender (in module dissect.target.plugins.os.windows.defender.quarantine) c_dm (in module dissect.volume.dm.c_dm) c_ds (in module dissect.database.ese.ntds.c_ds) c_elevation (in module dissect.target.plugins.apps.browser.chromium) c_elf (dissect.executable.elf.elf.ELF attribute) (dissect.executable.elf.elf.Section attribute) (dissect.executable.elf.elf.SectionTable attribute) (dissect.executable.elf.elf.Segment attribute) (dissect.executable.elf.elf.SegmentTable attribute) (dissect.executable.elf.elf.Symbol attribute) c_elf_32 (in module dissect.executable.elf.c_elf) c_elf_64 (in module dissect.executable.elf.c_elf) c_envelope (in module dissect.hypervisor.util.envelope) c_ese (in module dissect.database.ese.c_ese) c_etl (in module dissect.etl.c_etl) c_etl_global (in module dissect.etl.c_etl) c_evt (in module dissect.eventlog.evt) c_evtx (in module dissect.eventlog.evtx) c_ewf (in module dissect.evidence.ewf.c_ewf) c_exfat (in module dissect.fat.c_exfat) c_ext (in module dissect.extfs.c_ext) c_fat (in module dissect.fat.c_fat) c_ffs (in module dissect.ffs.c_ffs) c_filesystems (dissect.target.plugins.os.windows.everything.parser.EverythingDB attribute) c_gnulocate (in module dissect.target.plugins.os.unix.locate.gnulocate) c_gpt (in module dissect.volume.disk.schemes.gpt) c_hdd (in module dissect.hypervisor.disk.c_hdd) c_header (in module dissect.target.plugins.os.windows.everything.parser) c_header_def (in module dissect.target.plugins.os.windows.everything.parser) c_hyperv (in module dissect.hypervisor.descriptor.c_hyperv) c_jdb2 (in module dissect.extfs.c_jdb2) c_jffs2 (in module dissect.jffs.c_jffs2) c_journal (in module dissect.target.plugins.os.unix.log.journal) c_lastlog (in module dissect.target.plugins.os.unix.log.lastlog) c_ldm (in module dissect.volume.ldm) c_lnk (in module dissect.shellitem.lnk.c_lnk) c_local (in module dissect.target.plugins.apps.container.docker) c_logfile (dissect.etl.headers.logfile.LogfileHeader attribute) c_luks (in module dissect.fve.luks.c_luks) c_lvm (in module dissect.vmfs.c_lvm) (in module dissect.volume.lvm.c_lvm2) c_master_key (in module dissect.target.plugins.os.windows.dpapi.master_key) c_mbr (in module dissect.volume.disk.schemes.mbr) c_md (in module dissect.volume.md.c_md) c_mlocate (in module dissect.target.plugins.os.unix.locate.mlocate) c_ntfs (in module dissect.ntfs.c_ntfs) c_ole (in module dissect.ole.c_ole) c_parser (in module dissect.etl.manifest) c_pe (in module dissect.executable.pe.c_pe) c_pe_def (in module dissect.executable.pe.c_pe) c_pek (in module dissect.database.ese.ntds.c_pek) c_pfwlog (in module dissect.target.plugins.apps.av.trendmicro) c_pid (in module dissect.target.plugins.os.windows.productkey) c_plocate (in module dissect.target.plugins.os.unix.locate.plocate) c_prefetch (in module dissect.target.plugins.os.windows.prefetch) c_qcow2 (in module dissect.hypervisor.disk.c_qcow2) c_qnx4 (in module dissect.qnxfs.c_qnx4) c_qnx6 (in module dissect.qnxfs.c_qnx6) c_qnx6_be (in module dissect.qnxfs.c_qnx6) c_qnx6_le (in module dissect.qnxfs.c_qnx6) c_recent_files (in module dissect.target.plugins.os.windows.regf.recentfilecache) c_record (dissect.clfs.blf.BLF attribute) c_recyclebin (in module dissect.target.plugins.os.windows.recyclebin) c_regf (in module dissect.regf.c_regf) c_rfc4716 (in module dissect.target.plugins.apps.ssh.ssh) c_rpm (in module dissect.database.bsd.tools.c_rpm) c_sam (in module dissect.target.plugins.os.windows.sam) c_sd (in module dissect.database.ese.ntds.c_sd) c_shim (in module dissect.target.plugins.os.windows.regf.shimcache) c_sqlite3 (in module dissect.database.sqlite3.c_sqlite3) c_squashfs (in module dissect.squashfs.c_squashfs) c_thumbcache (in module dissect.thumbcache.c_thumbcache) c_trustrecord (in module dissect.target.plugins.os.windows.regf.trusteddocs) c_tz (in module dissect.target.plugins.os.windows.datetime) c_userassist (in module dissect.target.plugins.os.windows.regf.userassist) c_utmp (in module dissect.target.plugins.os.unix.log.utmp) c_vbk (in module dissect.archive.c_vbk) c_vdi (in module dissect.hypervisor.disk.c_vdi) c_vhd (in module dissect.hypervisor.disk.c_vhd) c_vhdx (in module dissect.hypervisor.disk.c_vhdx) c_vinum (in module dissect.volume.vinum.c_vinum) c_vma (in module dissect.archive.c_vma) c_vmdk (in module dissect.hypervisor.disk.c_vmdk) c_vmfs (in module dissect.vmfs.c_vmfs) c_vss (in module dissect.volume.vss) c_wevt_headers (in module dissect.eventlog.wevt) c_wevt_objects (in module dissect.eventlog.wevt_object) c_wim (in module dissect.archive.c_wim) c_windowstab (in module dissect.target.plugins.apps.editor.windowsnotepad) c_xfs (in module dissect.xfs.c_xfs) cacert_file (dissect.target.loaders.mqtt.Broker attribute) Cache (class in dissect.target.helpers.cache) CACHE (in module dissect.etl.manifest) CACHE_FILENAME (dissect.target.plugins.apps.browser.iexplore.InternetExplorerPlugin attribute) cache_mode (dissect.volume.lvm.metadata.CachePoolSegment attribute) (dissect.volume.lvm.metadata.CacheSegment attribute) cache_offsets (dissect.thumbcache.index.IndexEntry property) CACHE_PATH (dissect.target.plugins.os.windows.rdpcache.RdpCachePlugin attribute) cache_path() (dissect.target.helpers.cache.Cache method) cache_pool (dissect.volume.lvm.metadata.CacheSegment attribute) CACHE_SIZE (in module dissect.target.helpers.mount) cached_sink_writers() (in module dissect.target.tools.dump) cachefiles (dissect.target.plugins.os.windows.activitiescache.ActivitiesCachePlugin attribute) CachePoolSegment (class in dissect.volume.lvm.metadata) CacheSegment (class in dissect.volume.lvm.metadata) CacheWriter (class in dissect.target.helpers.cache) CaddyPlugin (class in dissect.target.plugins.apps.webserver.caddy) calc_descriptor_hash() (flow.record.base.RecordDescriptor static method) calculate_counter_increment() (in module dissect.target.plugins.os.unix.linux.fortios._os) calculate_fingerprints() (in module dissect.target.plugins.apps.ssh.ssh) calculate_last_activity() (in module dissect.target.plugins.os.unix.generic) calculate_samkey() (dissect.target.plugins.os.windows.sam.SamPlugin method) calculate_timestamp() (dissect.etl.etl.ETL method) CalendarTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) CALL (dissect.target.helpers.sunrpc.serializer.MessageType attribute) call() (dissect.target.helpers.cache.Cache method) (dissect.target.helpers.sunrpc.client.AbstractClient method) (dissect.target.helpers.sunrpc.client.Client method) CALLBACK (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) callbacks (dissect.executable.pe.directory.tls.TlsDirectory property) CallBody (class in dissect.target.helpers.sunrpc.sunrpc) camdb (dissect.target.plugins.os.windows.cam.CamPlugin attribute) camdb_path (dissect.target.plugins.os.windows.cam.CamPlugin attribute) CAMEL_CASE_PATTERNS (in module dissect.target.plugins.os.windows.wer) CamGlobalPromptHistoryRecord (in module dissect.target.plugins.os.windows.cam) CamHistory (class in acquire.acquire.acquire) CamIdentityRelationshipHistoryRecord (in module dissect.target.plugins.os.windows.cam) CamPlugin (class in dissect.target.plugins.os.windows.cam) CamRegistryRecord (in module dissect.target.plugins.os.windows.cam) CamUsageHistoryRecord (in module dissect.target.plugins.os.windows.cam) CAN_CYBER (in module dissect.target.helpers.cyber) CannotBeDeleted (dissect.database.ese.ntds.util.SystemFlags attribute) CannotBeMoved (dissect.database.ese.ntds.util.SystemFlags attribute) CannotBeRenamed (dissect.database.ese.ntds.util.SystemFlags attribute) CAP_AUDIT_CONTROL (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_AUDIT_READ (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_AUDIT_WRITE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_BLOCK_SUSPEND (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_BPF (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_CHECKPOINT_RESTORE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_CHOWN (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_DAC_OVERRIDE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_DAC_READ_SEARCH (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_DB_REG_PATH (dissect.target.plugins.os.windows.cam.CamPlugin attribute) CAP_FOWNER (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_FSETID (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_IPC_LOCK (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_IPC_OWNER (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_KILL (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_LEASE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_LINUX_IMMUTABLE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_MAC_ADMIN (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_MAC_OVERRIDE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_MKNOD (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_NET_ADMIN (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_NET_BIND_SERVICE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_NET_BROADCAST (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_NET_RAW (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_PERFMON (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SETFCAP (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SETGID (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SETPCAP (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SETUID (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_ADMIN (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_BOOT (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_CHROOT (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_MODULE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_NICE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_PACCT (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_PTRACE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_RAWIO (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_RESOURCE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_TIME (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_TTY_CONFIG (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYSLOG (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_WAKE_ALARM (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) Capabilities (class in dissect.target.plugins.filesystem.unix.capability) capability_binaries() (dissect.target.plugins.filesystem.unix.capability.CapabilityPlugin method) CapabilityPlugin (class in dissect.target.plugins.filesystem.unix.capability) CapabilityRecord (in module dissect.target.plugins.filesystem.unix.capability) CASE (class in dissect.database.ese.lcmapstring) case (dissect.target.loaders.mqtt.Broker attribute) case() (in module dissect.target.loaders.mqtt) case_sensitive (dissect.target.filesystem.Filesystem attribute) (dissect.target.filesystem.LayerFilesystem property) (dissect.target.loaders.direct.DirectLoader attribute) cat() (in module dissect.target.tools.fs) Catalog (class in dissect.database.ese.table) (class in dissect.volume.vss) catalog (dissect.database.ese.ese.ESE attribute) (dissect.volume.vss.Store attribute) (dissect.volume.vss.VSS attribute) CATALOG_BLOCK_SIZE (in module dissect.volume.vss) CATALOG_COLUMNS (dissect.database.ese.table.Catalog attribute) CATALOG_ENTRY_SIZE (in module dissect.volume.vss) catch_errors() (in module dissect.target.tools.info) catch_sigpipe() (in module dissect.evidence.tools.util) (in module dissect.target.tools.utils.cli) (in module flow.record.utils) catdb() (dissect.target.plugins.os.windows.catroot.CatrootPlugin method) CATEGORIES (dissect.target.plugins.os.windows.regf.shellbags.CONTROL_PANEL_CATEGORY attribute) category (dissect.evidence.ad1.ad1.FileMeta attribute) catroot2_dir (dissect.target.plugins.os.windows.catroot.CatrootPlugin attribute) catroot_dir (dissect.target.plugins.os.windows.catroot.CatrootPlugin attribute) CatrootPlugin (class in dissect.target.plugins.os.windows.catroot) CatrootRecord (in module dissect.target.plugins.os.windows.catroot) CB_TIMEFORMAT (in module dissect.target.filesystems.cb) CbDirEntry (class in dissect.target.filesystems.cb) CbFilesystem (class in dissect.target.filesystems.cb) CbFilesystemEntry (class in dissect.target.filesystems.cb) CbLoader (class in dissect.target.loaders.cb) cbpath (dissect.target.filesystems.cb.CbFilesystemEntry attribute) CbRegistry (class in dissect.target.loaders.cb) CbRegistryHive (class in dissect.target.loaders.cb) CbRegistryKey (class in dissect.target.loaders.cb) CbRegistryValue (class in dissect.target.loaders.cb) CBT (dissect.target.helpers.network.IANAProtocol attribute) CcGuid (in module dissect.etl.utils) ccpp (dissect.executable.pe.directory.debug.VcFeatureDebugEntry property) CCTEMUL (dissect.target.plugins.os.windows.network.IfTypes attribute) cd (dissect.cim.cim.Class property) (dissect.cim.cim.Instance property) CD() (dissect.cim.index.Key method) CDBURN (class in dissect.target.plugins.os.windows.regf.shellbags) Cell (class in dissect.database.sqlite3.sqlite3) (class in dissect.regf.regf) cell (dissect.database.sqlite3.sqlite3.Page attribute) (dissect.regf.regf.Cell attribute) (dissect.regf.regf.RegistryHive attribute) cell_data() (dissect.regf.regf.RegistryHive method) cell_pointers (dissect.database.sqlite3.sqlite3.Page attribute) CellebriteFilesystem (class in dissect.target.loaders.cellebrite) CellebriteLoader (class in dissect.target.loaders.cellebrite) cells() (dissect.database.sqlite3.sqlite3.Page method) (dissect.database.sqlite3.sqlite3.SQLite3 method) CellType (in module dissect.regf.regf) Certificate (class in dissect.executable.pe.directory.security) certificate (dissect.executable.pe.directory.security.Certificate attribute) certificate_extensions() (dissect.target.plugins.os.windows.certlog.CertLogPlugin method) certificate_file (dissect.target.loaders.mqtt.Broker attribute) CertificateExtensionRecord (in module dissect.target.plugins.os.windows.certlog) CertificateRecord (in module dissect.target.helpers.certificate) (in module dissect.target.plugins.os.windows.certlog) certificates() (dissect.target.plugins.apps.webserver.apache.ApachePlugin method) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin method) (dissect.target.plugins.os.windows.certlog.CertLogPlugin method) CertificationAuthority (class in dissect.database.ese.ntds.objects.certificationauthority) CertLog (class in dissect.database.ese.tools.certlog) CertLogPlugin (class in dissect.target.plugins.os.windows.certlog) CertLogRecord (in module dissect.target.plugins.os.windows.certlog) CertLogValue (in module dissect.database.ese.tools.certlog) CES (dissect.target.plugins.os.windows.network.IfTypes attribute) CFTP (dissect.target.helpers.network.IANAProtocol attribute) cg (dissect.ffs.ffs.CylinderGroup attribute) (dissect.ffs.ffs.INode property) cgbase() (in module dissect.ffs.ffs) cgdata() (in module dissect.ffs.ffs) cgdmin() (in module dissect.ffs.ffs) cgimin() (in module dissect.ffs.ffs) cgmeta() (in module dissect.ffs.ffs) cgsblock() (in module dissect.ffs.ffs) cgstart() (in module dissect.ffs.ffs) cgtod() (in module dissect.ffs.ffs) chacha20_decrypt() (in module dissect.target.plugins.os.unix.linux.fortios._os) Chain (class in dissect.ole.ole) chain (dissect.ole.ole.Chain attribute) (dissect.ole.ole.ChainStream attribute) chain() (dissect.fat.fat.FAT method) (dissect.ole.ole.OLE method) ChainStream (class in dissect.ole.ole) CHAN (class in dissect.eventlog.wevt_object) change_time (dissect.apfs.objects.fs.Snapshot property) channel (dissect.etl.headers.event.EventDescriptor attribute) CHANNEL (dissect.target.plugins.os.windows.network.IfTypes attribute) CHAOS (dissect.target.helpers.network.IANAProtocol attribute) Char (class in dissect.cstruct.types.char) CHAR_TRANSLATION (in module dissect.eventlog.wevtutil) CharArray (class in dissect.cstruct.types.char) ChatAttachmentRecord (in module dissect.target.plugins.apps.chat.chat) ChatMessageRecord (in module dissect.target.plugins.apps.chat.chat) ChatPlugin (class in dissect.target.plugins.apps.chat.chat) ChatRecord (in module dissect.target.plugins.apps.chat.chat) ChatUserRecord (in module dissect.target.plugins.apps.chat.chat) chdir() (dissect.target.tools.shell.RegistryCli method) (dissect.target.tools.shell.TargetCli method) check() (dissect.apfs.objects.nx_superblock.NxSuperblock method) check_and_set_acquire_args() (in module acquire.acquire.utils) check_and_set_log_args() (in module acquire.acquire.utils) check_case_insensitive_overlap() (dissect.target.loaders.direct.DirectLoader method) check_compatible() (dissect.target.loaders.cb.CbRegistry method) (dissect.target.loaders.smb.SmbRegistry method) (dissect.target.plugin.NamespacePlugin method) (dissect.target.plugin.OSPlugin method) (dissect.target.plugin.Plugin method) (dissect.target.plugins.apps.av.mcafee.McAfeePlugin method) (dissect.target.plugins.apps.av.sophos.SophosPlugin method) (dissect.target.plugins.apps.av.symantec.SymantecPlugin method) (dissect.target.plugins.apps.av.trendmicro.TrendMicroPlugin method) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin method) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin method) (dissect.target.plugins.apps.browser.iexplore.InternetExplorerPlugin method) (dissect.target.plugins.apps.browser.safari.SafariPlugin method) (dissect.target.plugins.apps.chat.msn.MSNPlugin method) (dissect.target.plugins.apps.container.docker.DockerPlugin method) (dissect.target.plugins.apps.container.podman.PodmanPlugin method) (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadPlugin method) (dissect.target.plugins.apps.edr.acquire.AcquirePlugin method) (dissect.target.plugins.apps.edr.velociraptor.VelociraptorPlugin method) (dissect.target.plugins.apps.other.env.EnvironmentFilePlugin method) (dissect.target.plugins.apps.productivity.msoffice.MSOffice method) (dissect.target.plugins.apps.productivity.sevenzip.SevenZipPlugin method) (dissect.target.plugins.apps.productivity.winrar.WinRarPlugin method) (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin method) (dissect.target.plugins.apps.remoteaccess.rustdesk.RustdeskPlugin method) (dissect.target.plugins.apps.remoteaccess.splashtop.SplashtopPlugin method) (dissect.target.plugins.apps.remoteaccess.teamviewer.TeamViewerPlugin method) (dissect.target.plugins.apps.shell.powershell.PowerShellHistoryPlugin method) (dissect.target.plugins.apps.shell.wget.WgetPlugin method) (dissect.target.plugins.apps.ssh.openssh.OpenSSHPlugin method) (dissect.target.plugins.apps.ssh.opensshd.SSHServerPlugin method) (dissect.target.plugins.apps.ssh.putty.PuTTYPlugin method) (dissect.target.plugins.apps.virtualization.vmware_workstation.VmwareWorkstationPlugin method) (dissect.target.plugins.apps.vpn.openvpn.OpenVPNPlugin method) (dissect.target.plugins.apps.vpn.wireguard.WireGuardPlugin method) (dissect.target.plugins.apps.webhosting.cpanel.CPanelPlugin method) (dissect.target.plugins.apps.webserver.apache.ApachePlugin method) (dissect.target.plugins.apps.webserver.caddy.CaddyPlugin method) (dissect.target.plugins.apps.webserver.citrix.CitrixWebserverPlugin method) (dissect.target.plugins.apps.webserver.iis.IISLogsPlugin method) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin method) (dissect.target.plugins.child.colima.ColimaChildTargetPlugin method) (dissect.target.plugins.child.docker.DockerChildTargetPlugin method) (dissect.target.plugins.child.esxi.ESXiChildTargetPlugin method) (dissect.target.plugins.child.hyperv.HyperVChildTargetPlugin method) (dissect.target.plugins.child.lima.LimaChildTargetPlugin method) (dissect.target.plugins.child.parallels.ParallelsChildTargetPlugin method) (dissect.target.plugins.child.podman.PodmanChildTargetPlugin method) (dissect.target.plugins.child.proxmox.ProxmoxChildTargetPlugin method) (dissect.target.plugins.child.qemu.QemuChildTargetPlugin method) (dissect.target.plugins.child.virtualbox.VirtualBoxChildTargetPlugin method) (dissect.target.plugins.child.virtuozzo.VirtuozzoChildTargetPlugin method) (dissect.target.plugins.child.vmware_workstation.VmwareWorkstationChildTargetPlugin method) (dissect.target.plugins.child.wsl.WSLChildTargetPlugin method) (dissect.target.plugins.filesystem.icat.ICatPlugin method) (dissect.target.plugins.filesystem.ntfs.mft.MftPlugin method) (dissect.target.plugins.filesystem.ntfs.mft_timeline.MftTimelinePlugin method) (dissect.target.plugins.filesystem.ntfs.usnjrnl.UsnjrnlPlugin method) (dissect.target.plugins.filesystem.resolver.ResolverPlugin method) (dissect.target.plugins.filesystem.unix.capability.CapabilityPlugin method) (dissect.target.plugins.filesystem.unix.suid.SuidPlugin method) (dissect.target.plugins.filesystem.walkfs.WalkFsPlugin method) (dissect.target.plugins.filesystem.yara.YaraPlugin method) (dissect.target.plugins.general.example.ExampleNamespacePlugin method) (dissect.target.plugins.general.example.ExamplePlugin method) (dissect.target.plugins.general.loaders.LoaderListPlugin method) (dissect.target.plugins.general.osinfo.OSInfoPlugin method) (dissect.target.plugins.general.plugins.PluginListPlugin method) (dissect.target.plugins.general.users.UsersPlugin method) (dissect.target.plugins.os.default.datetime.DateTimePlugin method) (dissect.target.plugins.os.default.locale.LocalePlugin method) (dissect.target.plugins.os.default.network.NetworkPlugin method) (dissect.target.plugins.os.unix.applications.UnixApplicationsPlugin method) (dissect.target.plugins.os.unix.bsd.citrix.generic.GenericPlugin method) (dissect.target.plugins.os.unix.bsd.citrix.locale.CitrixLocalePlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios.applications.IOSApplicationsPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios.generic.GenericPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios.locale.LocalePlugin method) (dissect.target.plugins.os.unix.bsd.darwin.macos.user.UserPlugin method) (dissect.target.plugins.os.unix.cronjobs.CronjobPlugin method) (dissect.target.plugins.os.unix.datetime.UnixDateTimePlugin method) (dissect.target.plugins.os.unix.esxi.configstore.ConfigstorePlugin method) (dissect.target.plugins.os.unix.esxi.esxconf.EsxConfPlugin method) (dissect.target.plugins.os.unix.esxi.vm.VirtualMachinePlugin method) (dissect.target.plugins.os.unix.etc.etc.EtcTree method) (dissect.target.plugins.os.unix.generic.GenericPlugin method) (dissect.target.plugins.os.unix.history.CommandHistoryPlugin method) (dissect.target.plugins.os.unix.linux.cmdline.CmdlinePlugin method) (dissect.target.plugins.os.unix.linux.debian.apt.AptPlugin method) (dissect.target.plugins.os.unix.linux.debian.dpkg.DpkgPlugin method) (dissect.target.plugins.os.unix.linux.debian.proxmox.vm.VirtualMachinePlugin method) (dissect.target.plugins.os.unix.linux.debian.snap.SnapPlugin method) (dissect.target.plugins.os.unix.linux.environ.EnvironPlugin method) (dissect.target.plugins.os.unix.linux.fortios.generic.GenericPlugin method) (dissect.target.plugins.os.unix.linux.fortios.locale.FortiOSLocalePlugin method) (dissect.target.plugins.os.unix.linux.iptables.IptablesSavePlugin method) (dissect.target.plugins.os.unix.linux.modules.ModulePlugin method) (dissect.target.plugins.os.unix.linux.netstat.NetstatPlugin method) (dissect.target.plugins.os.unix.linux.proc.ProcPlugin method) (dissect.target.plugins.os.unix.linux.processes.ProcProcesses method) (dissect.target.plugins.os.unix.linux.recentlyused.RecentlyUsedPlugin method) (dissect.target.plugins.os.unix.linux.redhat.yum.YumPlugin method) (dissect.target.plugins.os.unix.linux.services.ServicesPlugin method) (dissect.target.plugins.os.unix.linux.sockets.NetSocketPlugin method) (dissect.target.plugins.os.unix.linux.suse.zypper.ZypperPlugin method) (dissect.target.plugins.os.unix.locale.UnixLocalePlugin method) (dissect.target.plugins.os.unix.locate.gnulocate.GNULocatePlugin method) (dissect.target.plugins.os.unix.locate.mlocate.MLocatePlugin method) (dissect.target.plugins.os.unix.locate.plocate.PLocatePlugin method) (dissect.target.plugins.os.unix.log.atop.AtopPlugin method) (dissect.target.plugins.os.unix.log.audit.AuditPlugin method) (dissect.target.plugins.os.unix.log.auth.AuthPlugin method) (dissect.target.plugins.os.unix.log.journal.JournalPlugin method) (dissect.target.plugins.os.unix.log.lastlog.LastLogPlugin method) (dissect.target.plugins.os.unix.log.messages.MessagesPlugin method) (dissect.target.plugins.os.unix.log.utmp.UtmpPlugin method) (dissect.target.plugins.os.unix.shadow.ShadowPlugin method) (dissect.target.plugins.os.unix.trash.GnomeTrashPlugin method) (dissect.target.plugins.os.windows.activitiescache.ActivitiesCachePlugin method) (dissect.target.plugins.os.windows.ad.ntds.NtdsPlugin method) (dissect.target.plugins.os.windows.adpolicy.ADPolicyPlugin method) (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) (dissect.target.plugins.os.windows.cam.CamPlugin method) (dissect.target.plugins.os.windows.catroot.CatrootPlugin method) (dissect.target.plugins.os.windows.certlog.CertLogPlugin method) (dissect.target.plugins.os.windows.cim.CimPlugin method) (dissect.target.plugins.os.windows.clfs.ClfsPlugin method) (dissect.target.plugins.os.windows.credential.credhist.CredHistPlugin method) (dissect.target.plugins.os.windows.credential.defaultpassword.DefaultPasswordPlugin method) (dissect.target.plugins.os.windows.credential.winlogon.WinlogonPlugin method) (dissect.target.plugins.os.windows.datetime.WindowsDateTimePlugin method) (dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.credhist.CredHistKeyProviderPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.defaultpassword.DefaultPasswordKeyProvider method) (dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.lsa.LSADefaultPasswordKeyProviderPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.winlogon.WinlogonDefaultPasswordKeyProviderPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.empty.EmptyKeyProviderPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.keychain.KeychainKeyProviderPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.keyprovider.KeyProviderPlugin method) (dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin method) (dissect.target.plugins.os.windows.exchange.exchange.ExchangePlugin method) (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin method) (dissect.target.plugins.os.windows.generic.GenericPlugin method) (dissect.target.plugins.os.windows.jumplist.JumpListPlugin method) (dissect.target.plugins.os.windows.lnk.LnkPlugin method) (dissect.target.plugins.os.windows.locale.WindowsLocalePlugin method) (dissect.target.plugins.os.windows.log.agentexecutor.AgentExecutorLogPlugin method) (dissect.target.plugins.os.windows.log.amcache.AmcacheInstallPlugin method) (dissect.target.plugins.os.windows.log.etl.EtlPlugin method) (dissect.target.plugins.os.windows.log.evt.WindowsEventlogsMixin method) (dissect.target.plugins.os.windows.log.intunemanagementextension.IntuneManagementExtensionLogParserPlugin method) (dissect.target.plugins.os.windows.log.mssql.MssqlPlugin method) (dissect.target.plugins.os.windows.log.pfro.PfroPlugin method) (dissect.target.plugins.os.windows.log.schedlgu.SchedLgUPlugin method) (dissect.target.plugins.os.windows.lsa.LSAPlugin method) (dissect.target.plugins.os.windows.notifications.NotificationsPlugin method) (dissect.target.plugins.os.windows.prefetch.PrefetchPlugin method) (dissect.target.plugins.os.windows.productkey.WindowsProductKeyPlugin method) (dissect.target.plugins.os.windows.rdpcache.RdpCachePlugin method) (dissect.target.plugins.os.windows.recyclebin.RecyclebinPlugin method) (dissect.target.plugins.os.windows.regf.applications.WindowsApplicationsPlugin method) (dissect.target.plugins.os.windows.regf.appxdebugkeys.AppxDebugKeysPlugin method) (dissect.target.plugins.os.windows.regf.auditpol.AuditpolPlugin method) (dissect.target.plugins.os.windows.regf.bam.BamDamPlugin method) (dissect.target.plugins.os.windows.regf.cit.CITPlugin method) (dissect.target.plugins.os.windows.regf.clsid.CLSIDPlugin method) (dissect.target.plugins.os.windows.regf.mru.MRUPlugin method) (dissect.target.plugins.os.windows.regf.muicache.MuiCachePlugin method) (dissect.target.plugins.os.windows.regf.nethist.NethistPlugin method) (dissect.target.plugins.os.windows.regf.recentfilecache.RecentFileCachePlugin method) (dissect.target.plugins.os.windows.regf.regf.RegfPlugin method) (dissect.target.plugins.os.windows.regf.runkeys.RunKeysPlugin method) (dissect.target.plugins.os.windows.regf.shellbags.ShellBagsPlugin method) (dissect.target.plugins.os.windows.regf.shimcache.ShimcachePlugin method) (dissect.target.plugins.os.windows.regf.trusteddocs.TrustedDocumentsPlugin method) (dissect.target.plugins.os.windows.regf.usb.UsbPlugin method) (dissect.target.plugins.os.windows.regf.userassist.UserAssistPlugin method) (dissect.target.plugins.os.windows.registry.RegistryPlugin method) (dissect.target.plugins.os.windows.sam.SamPlugin method) (dissect.target.plugins.os.windows.search.SearchIndexPlugin method) (dissect.target.plugins.os.windows.services.ServicesPlugin method) (dissect.target.plugins.os.windows.sru.SRUPlugin method) (dissect.target.plugins.os.windows.startupinfo.StartupInfoPlugin method) (dissect.target.plugins.os.windows.syscache.SyscachePlugin method) (dissect.target.plugins.os.windows.thumbcache.ThumbcachePlugin method) (dissect.target.plugins.os.windows.ual.UalPlugin method) (dissect.target.plugins.os.windows.wer.WindowsErrorReportingPlugin method) (dissect.target.plugins.os.windows.wua_history.WuaHistoryPlugin method) (dissect.target.plugins.scrape.qfind.QFindPlugin method) (dissect.target.plugins.scrape.scrape.ScrapePlugin method) (dissect.target.tools.shell.ExtendedCmd static method) (dissect.target.tools.shell.RegistryCli static method) check_dir() (dissect.target.tools.shell.TargetCli method) check_existing() (in module acquire.acquire.tools.decrypter) check_file() (dissect.target.tools.shell.TargetCli method) check_integrity() (dissect.fve.bde.information.Information method) check_key() (dissect.target.tools.shell.RegistryCli method) check_path() (dissect.target.tools.shell.TargetCli method) check_recovery_password() (in module dissect.fve.bde.key) check_value() (dissect.target.tools.shell.RegistryCli method) checkbox (acquire.acquire.gui.win32.Win32 attribute) Checkpoint (class in dissect.database.sqlite3.wal) checkpoint (dissect.database.sqlite3.sqlite3.SQLite3 attribute) checkpoint_objects (dissect.apfs.objects.nx_superblock.NxSuperblock property) CheckpointMap (class in dissect.apfs.objects.checkpoint_map) checkpoints (dissect.database.sqlite3.wal.WAL property) checkpoints() (dissect.database.sqlite3.sqlite3.SQLite3 method) checksum (dissect.apfs.objects.base.Object property) (dissect.evidence.ewf.ewf.SectionDescriptor attribute) checksum() (in module dissect.database.sqlite3.wal) checksum_algorithm (dissect.fve.luks.luks.LUKS attribute) checksum_endian (dissect.database.sqlite3.wal.WAL attribute) checksum_xor() (in module dissect.database.ese.util) child (dissect.database.ese.page.BranchNode attribute) (dissect.ole.ole.DirectoryEntry property) child() (dissect.cim.index.IndexPage method) (dissect.database.ese.ntds.objects.object.Object method) child_of() (dissect.database.ese.ntds.database.DataTable method) child_plugins() (in module dissect.target.plugin) child_templates (dissect.eventlog.bxml.Template attribute) children (dissect.eventlog.bxml.BxmlTag attribute) (dissect.evidence.ad1.ad1.FileEntry property) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry attribute) (dissect.util.compression.lzxpress_huffman.Node attribute) (dissect.util.ldap.SearchFilter attribute) children() (dissect.cim.index.IndexPage method) (dissect.database.ese.ntds.objects.object.Object method) children_of() (dissect.database.ese.ntds.database.DataTable method) ChildTargetPlugin (class in dissect.target.plugin) ChildTargetRecord (in module dissect.target.helpers.record) chmod() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) choose_folder() (acquire.acquire.gui.win32.Win32 method) choose_folder_button (acquire.acquire.gui.win32.Win32 attribute) chpe (dissect.executable.pe.directory.load_config.LoadConfigDirectory property) CHR (dissect.target.helpers.nfs.nfs3.FileType attribute) ChromePlugin (class in dissect.target.plugins.apps.browser.chrome) CHROMIUM_DOWNLOAD_RECORD_FIELDS (in module dissect.target.plugins.apps.browser.chromium) ChromiumKeys (class in dissect.target.plugins.apps.browser.chromium) ChromiumMixin (class in dissect.target.plugins.apps.browser.chromium) ChromiumPlugin (class in dissect.target.plugins.apps.browser.chromium) Chunk (class in dissect.btrfs.stream) chunk_count (dissect.evidence.ewf.ewf.Segment attribute) (dissect.evidence.ewf.ewf.VolumeSection attribute) chunk_ratio (dissect.hypervisor.disk.vhdx.BlockAllocationTable attribute) chunk_size (dissect.archive.wim.CompressedStream attribute) (dissect.evidence.ad1.ad1.LogicalImage attribute) (dissect.evidence.ad1.stream.FileStream attribute) (dissect.evidence.ewf.ewf.EWF attribute) (dissect.fve.bde.eow.EowInformation property) (dissect.hypervisor.disk.asif.ASIF attribute) CHUNK_SIZE (dissect.target.plugins.os.windows.log.evt.EvtPlugin attribute) (dissect.target.plugins.os.windows.log.evtx.EvtxPlugin attribute) chunk_size (dissect.volume.lvm.metadata.CachePoolSegment attribute) (dissect.volume.lvm.metadata.CacheSegment attribute) (dissect.volume.lvm.metadata.SnapshotSegment attribute) (dissect.volume.lvm.metadata.ThinPoolSegment attribute) CHUNK_SIZE (in module acquire.acquire.tools.decrypter) chunks (dissect.btrfs.stream.ChunkStream attribute) (dissect.evidence.ad1.stream.FileStream attribute) chunks() (acquire.acquire.tools.decrypter.EncryptedFile method) ChunkStream (class in dissect.btrfs.stream) ci (dissect.cim.cim.Instance property) (dissect.cim.cim.Namespace property) CI() (dissect.cim.index.Key method) CIM (class in dissect.cim.cim) cim (dissect.cim.cim.Class attribute) (dissect.cim.cim.Instance attribute) (dissect.cim.cim.Namespace attribute) (dissect.cim.classes.ClassDefinition attribute) (dissect.cim.classes.ClassInstance attribute) (dissect.cim.index.Key attribute) (dissect.cim.index.Store attribute) (dissect.cim.mappings.Mapping attribute) (dissect.cim.objects.Store attribute) cim_def (in module dissect.cim.c_cim) CIM_TYPES (in module dissect.cim.c_cim) CIM_TYPES_MAP (in module dissect.cim.c_cim) CimPlugin (class in dissect.target.plugins.os.windows.cim) CimType (in module dissect.cim.c_cim) cipher (acquire.acquire.tools.decrypter.EncryptedFile attribute) Cipher (class in dissect.fve.crypto) (class in dissect.fve.crypto.base) cipher (dissect.apfs.objects.base.Object attribute) (dissect.apfs.objects.btree.BTree attribute) (dissect.fve.crypto.base.IV attribute) (dissect.fve.crypto.dmcrypt.CryptStream attribute) (dissect.hypervisor.descriptor.vmx.Phrase attribute) (dissect.target.filesystems.itunes.EncryptedFileStream attribute) cipher_alg (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry attribute) cipher_algorithm (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) CIPHER_ALGORITHMS (in module dissect.target.plugins.os.windows.dpapi.crypto) cipher_fh (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher attribute) CIPHER_KEY_SIZES (in module dissect.hypervisor.descriptor.vmx) CIPHER_MAP (in module dissect.fve.bde.c_bde) cipher_mode (dissect.fve.luks.luks.LUKS attribute) cipher_name (dissect.fve.luks.luks.LUKS attribute) (dissect.hypervisor.util.envelope.Envelope attribute) cipher_offset (dissect.target.filesystems.itunes.EncryptedFileStream attribute) cipher_page_size (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher attribute) cipher_path (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher attribute) cipher_text (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) CipherAlgorithm (class in dissect.target.plugins.os.windows.dpapi.crypto) CipherStream (class in dissect.target.loaders.ab) CIT (class in dissect.target.plugins.os.windows.regf.cit) cit (dissect.target.plugins.os.windows.regf.cit.BaseUseData attribute) (dissect.target.plugins.os.windows.regf.cit.BaseUseDataBitmaps attribute) (dissect.target.plugins.os.windows.regf.cit.Entry attribute) cit() (dissect.target.plugins.os.windows.regf.cit.CITPlugin method) cit_def (in module dissect.target.plugins.os.windows.regf.cit) CITDPDurationRecord (in module dissect.target.plugins.os.windows.regf.cit) CITDPRecord (in module dissect.target.plugins.os.windows.regf.cit) CITModuleRecord (in module dissect.target.plugins.os.windows.regf.cit) CITPlugin (class in dissect.target.plugins.os.windows.regf.cit) CITPostUpdateUseInfoRecord (in module dissect.target.plugins.os.windows.regf.cit) CITProgramBitmapForegroundRecord (in module dissect.target.plugins.os.windows.regf.cit) CITProgramRecord (in module dissect.target.plugins.os.windows.regf.cit) CITRecords (in module dissect.target.plugins.os.windows.regf.cit) CITRIX (dissect.target.plugin.OperatingSystem attribute) CITRIX_NETSCALER_BASH_HISTORY_RE (in module dissect.target.plugins.os.unix.bsd.citrix.history) CitrixCommandHistoryPlugin (class in dissect.target.plugins.os.unix.bsd.citrix.history) CitrixLocalePlugin (class in dissect.target.plugins.os.unix.bsd.citrix.locale) CitrixPlugin (class in dissect.target.plugins.os.unix.bsd.citrix._os) CitrixWebserverPlugin (class in dissect.target.plugins.apps.webserver.citrix) CITSystemBitmapDisplayPowerRecord (in module dissect.target.plugins.os.windows.regf.cit) CITSystemBitmapDisplayRequestChangeRecord (in module dissect.target.plugins.os.windows.regf.cit) CITSystemBitmapForegroundRecord (in module dissect.target.plugins.os.windows.regf.cit) CITSystemBitmapInputRecord (in module dissect.target.plugins.os.windows.regf.cit) CITSystemBitmapInputTouchRecord (in module dissect.target.plugins.os.windows.regf.cit) CITSystemBitmapUnknownRecord (in module dissect.target.plugins.os.windows.regf.cit) CITSystemRecord (in module dissect.target.plugins.os.windows.regf.cit) CITTelemetryRecord (in module dissect.target.plugins.os.windows.regf.cit) city (dissect.database.ese.ntds.objects.organizationalperson.OrganizationalPerson property) CJK_FIRST (dissect.database.ese.lcmapstring.SCRIPT attribute) CJK_LAST (dissect.database.ese.lcmapstring.SCRIPT attribute) CKA_ID (in module dissect.target.plugins.apps.browser.firefox) Class (class in dissect.cim.cim) class_ (dissect.cim.cim.Instance attribute) (dissect.cim.cim.Property attribute) (dissect.cim.classes.ClassInstance attribute) (dissect.cim.utils.ObjectPath attribute) class_() (dissect.cim.cim.Namespace method) class_definition (dissect.cim.cim.Class attribute) (dissect.cim.cim.Instance attribute) CLASS_FMT (in module dissect.etl.manifest) class_instance (dissect.cim.cim.Instance attribute) (dissect.cim.cim.Namespace attribute) (dissect.cim.classes.ClassInstanceProperty attribute) class_name (dissect.cim.classes.ClassDefinition property) (dissect.cim.classes.ClassInstance property) (dissect.regf.regf.KeyNode attribute) (dissect.target.helpers.regutil.KeyCollection property) (dissect.target.helpers.regutil.RegfKey property) (dissect.target.helpers.regutil.RegistryKey property) (dissect.target.helpers.regutil.VirtualKey property) ClassDefinition (class in dissect.cim.classes) ClassDefinitionProperty (class in dissect.cim.classes) ClassDefinitionPropertyState (class in dissect.cim.c_cim) ClassEntry (class in dissect.database.ese.ntds.schema) classes (dissect.cim.cim.Namespace property) CLASSES (in module dissect.util.plist) CLASSES_ROOTS (dissect.target.plugins.apps.productivity.msoffice.MSOffice attribute) classification (flow.record.adapter.broker.BrokerWriter attribute) CLASSIFICATION_MAP (in module dissect.target.plugins.os.windows.wua_history) ClassInstance (class in dissect.cim.classes) ClassInstanceProperty (class in dissect.cim.classes) ClassInstancePropertyState (class in dissect.cim.c_cim) ClassKey (class in dissect.target.loaders.itunes) ClassSchema (class in dissect.database.ese.ntds.objects.classschema) ClassStore (class in dissect.database.ese.ntds.objects.classstore) clean() (dissect.target.helpers.configutil.ScopeManager method) clean_ips() (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager static method) clean_value() (in module dissect.target.plugins.apps.webserver.apache) CLEANABLE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) cleaner (dissect.volume.lvm.metadata.CacheSegment attribute) (dissect.volume.lvm.metadata.WriteCacheSegment attribute) clear_cache() (dissect.target.loaders.mqtt.Broker method) clear_key() (dissect.fve.bde.information.VmkInfoDatum method) clear_text (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) clfs() (dissect.target.plugins.os.windows.clfs.ClfsPlugin method) CLFS_CONTROL_RECORD_MAGIC_VALUE (in module dissect.clfs.c_clfs) clfs_def (in module dissect.clfs.c_clfs) ClfsPlugin (class in dissect.target.plugins.os.windows.clfs) ClfsRecord (in module dissect.target.plugins.os.windows.clfs) cli_args (dissect.target.tools.utils.report.ExecutionReport attribute) CLI_ARGS_MODULE (in module acquire.acquire.acquire) ClickOnceDeploymentManifestParser (class in dissect.target.plugins.apps.productivity.msoffice) ClickOnceDeploymentManifestParser.Assembly (class in dissect.target.plugins.apps.productivity.msoffice) Client (class in dissect.target.helpers.nfs.client.mount) (class in dissect.target.helpers.nfs.client.nfs) (class in dissect.target.helpers.sunrpc.client) client (flow.record.adapter.mongo.MongoReader attribute) (flow.record.adapter.mongo.MongoWriter attribute) client_access() (dissect.target.plugins.os.windows.ual.UalPlugin method) ClientAccessRecord (in module dissect.target.plugins.os.windows.ual) ClientFactory (in module dissect.target.filesystems.nfs) clipboard() (dissect.target.plugins.apps.virtualization.vmware_workstation.VmwareWorkstationPlugin method) clone_alias() (in module dissect.target.plugin) close (dissect.target.containers.raw.RawContainer attribute) CLOSE (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) close() (acquire.acquire.collector.Collector method) (acquire.acquire.crypt.EncryptedStream method) (acquire.acquire.log.DelayedFileHandler method) (acquire.acquire.outputs.base.Output method) (acquire.acquire.outputs.dir.DirectoryOutput method) (acquire.acquire.outputs.tar.TarOutput method) (acquire.acquire.outputs.zip.ZipOutput method) (dissect.database.ese.tools.impacket.ESENT_DB method) (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher method) (dissect.database.sqlite3.sqlite3.SQLite3 method) (dissect.database.sqlite3.wal.WAL method) (dissect.evidence.asdf.asdf.AsdfWriter method) (dissect.evidence.asdf.stream.HashedStream method) (dissect.evidence.asdf.stream.SubStreamBase method) (dissect.evidence.tools.asdf.dd.Progress method) (dissect.hypervisor.disk.vdi.VDI method) (dissect.target.container.Container method) (dissect.target.containers.asdf.AsdfContainer method) (dissect.target.containers.asif.AsifContainer method) (dissect.target.containers.ewf.EwfContainer method) (dissect.target.containers.fortifw.FortiFirmwareContainer method) (dissect.target.containers.hdd.HddContainer method) (dissect.target.containers.hds.HdsContainer method) (dissect.target.containers.qcow2.QCow2Container method) (dissect.target.containers.split.SplitContainer method) (dissect.target.containers.vdi.VdiContainer method) (dissect.target.containers.vhd.VhdContainer method) (dissect.target.containers.vhdx.VhdxContainer method) (dissect.target.containers.vmdk.VmdkContainer method) (dissect.target.filesystems.smb.SmbStream method) (dissect.target.helpers.cache.CacheWriter method) (dissect.target.helpers.cache.LineWriter method) (dissect.target.helpers.nfs.client.mount.Client method) (dissect.target.helpers.nfs.client.nfs.Client method) (dissect.target.helpers.sunrpc.client.AbstractClient method) (dissect.target.helpers.sunrpc.client.Client method) (dissect.target.loaders.remote.RemoteStreamConnection method) (dissect.target.tools.dump.JsonLinesWriter method) (dissect.util.stream.AlignedStream method) (dissect.vmfs.resource.ResourceManager method) (flow.record.adapter.AbstractReader method) (flow.record.adapter.AbstractWriter method) (flow.record.adapter.archive.ArchiveWriter method) (flow.record.adapter.avro.AvroReader method) (flow.record.adapter.avro.AvroWriter method) (flow.record.adapter.broker.BrokerReader method) (flow.record.adapter.broker.BrokerWriter method) (flow.record.adapter.csvfile.CsvfileReader method) (flow.record.adapter.csvfile.CsvfileWriter method) (flow.record.adapter.elastic.ElasticReader method) (flow.record.adapter.elastic.ElasticWriter method) (flow.record.adapter.jsonfile.JsonfileReader method) (flow.record.adapter.jsonfile.JsonfileWriter method) (flow.record.adapter.line.LineWriter method) (flow.record.adapter.mongo.MongoReader method) (flow.record.adapter.mongo.MongoWriter method) (flow.record.adapter.split.SplitWriter method) (flow.record.adapter.splunk.SplunkWriter method) (flow.record.adapter.sqlite.SqliteWriter method) (flow.record.adapter.stream.StreamReader method) (flow.record.adapter.stream.StreamWriter method) (flow.record.adapter.text.TextWriter method) (flow.record.adapter.xlsx.XlsxReader method) (flow.record.adapter.xlsx.XlsxWriter method) (flow.record.stream.PathTemplateWriter method) (flow.record.stream.RecordPrinter method) (flow.record.stream.RecordStreamReader method) (flow.record.stream.RecordStreamWriter method) close_handle() (in module acquire.acquire.dynamic.windows.ntdll) CLOSE_WAIT (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) closed (flow.record.stream.RecordStreamReader attribute) CloseHandle (in module acquire.acquire.dynamic.windows.ntdll) CLOSING (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) cls (dissect.target.plugin.FunctionDescriptor property) (dissect.target.plugin.PluginDescriptor property) clsid (dissect.shellitem.lnk.lnk.Lnk property) CLSIDPlugin (class in dissect.target.plugins.os.windows.regf.clsid) CLSIDRecord (in module dissect.target.plugins.os.windows.regf.clsid) CLSIDRecordDescriptor (in module dissect.target.plugins.os.windows.regf.clsid) cluster (dissect.fat.fat.DirectoryEntry property) (dissect.fat.fat.RootDirectory property) (dissect.target.filesystems.exfat.ExfatFilesystemEntry attribute) (dissect.vmfs.address.FileDescriptorAddr property) (dissect.vmfs.address.JournalBlockAddr property) (dissect.vmfs.address.PointerBlockAddr property) (dissect.vmfs.address.PointerBlockAddr64 property) (dissect.vmfs.address.SmallFileBlockAddr property) (dissect.vmfs.address.SubBlockAddr property) (dissect.vmfs.address.SubBlockAddr64 property) cluster_bits (dissect.hypervisor.disk.qcow2.QCow2 attribute) cluster_count (dissect.fat.exfat.ExFAT attribute) cluster_heap_sector (dissect.fat.exfat.ExFAT attribute) cluster_offset_mask (dissect.hypervisor.disk.qcow2.QCow2 attribute) cluster_size (dissect.fat.exfat.ExFAT attribute) (dissect.fat.fat.FATFS attribute) (dissect.fve.bde.bde.BootSector attribute) (dissect.hypervisor.disk.hdd.HDS attribute) (dissect.hypervisor.disk.qcow2.QCow2 attribute) (dissect.ntfs.stream.CompressedRunlistStream attribute) (dissect.target.filesystems.exfat.ExfatFilesystem attribute) cluster_size_shift (dissect.ntfs.ntfs.NTFS attribute) cluster_to_sector() (dissect.fat.exfat.ExFAT method) clusters_per_index_buffer (dissect.ntfs.index.IndexRoot property) cmd_attr() (dissect.target.tools.shell.TargetCli method) cmd_cat() (dissect.target.tools.diff.DifferentialCli method) (dissect.target.tools.shell.RegistryCli method) (dissect.target.tools.shell.TargetCli method) cmd_diff() (dissect.target.tools.diff.DifferentialCli method) cmd_enter() (dissect.target.tools.diff.DifferentialCli method) (dissect.target.tools.shell.TargetCli method) cmd_file() (dissect.target.tools.shell.TargetCli method) cmd_find() (dissect.target.tools.diff.DifferentialCli method) (dissect.target.tools.shell.TargetCli method) cmd_hash() (dissect.target.tools.shell.TargetCli method) cmd_hexdump() (dissect.target.tools.diff.DifferentialCli method) (dissect.target.tools.shell.RegistryCli method) (dissect.target.tools.shell.TargetCli method) (in module dissect.target.tools.inspect) cmd_info() (in module dissect.target.tools.inspect) cmd_less() (dissect.target.tools.shell.TargetCli method) cmd_list() (in module dissect.target.tools.inspect) cmd_ll() (dissect.target.tools.shell.TargetCli method) cmd_ls() (dissect.target.tools.diff.DifferentialCli method) (dissect.target.tools.shell.RegistryCli method) (dissect.target.tools.shell.TargetCli method) cmd_md5sum() (dissect.target.tools.shell.TargetCli method) cmd_next() (dissect.target.tools.diff.DifferentialCli method) CMD_PREFIX (dissect.target.tools.shell.ExtendedCmd attribute) cmd_previous() (dissect.target.tools.diff.DifferentialCli method) cmd_readlink() (dissect.target.tools.shell.TargetCli method) cmd_registry() (dissect.target.tools.shell.TargetCli method) cmd_save() (dissect.target.tools.shell.TargetCli method) cmd_set() (dissect.target.tools.diff.DifferentialCli method) cmd_sha1sum() (dissect.target.tools.shell.TargetCli method) cmd_sha256sum() (dissect.target.tools.shell.TargetCli method) cmd_shell() (in module dissect.target.tools.inspect) cmd_stat() (dissect.target.tools.shell.TargetCli method) cmd_tree() (dissect.target.tools.shell.TargetCli method) cmd_zcat() (dissect.target.tools.shell.TargetCli method) cmd_zless() (dissect.target.tools.shell.TargetCli method) cmdline (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) cmdline() (dissect.target.plugins.os.unix.linux.cmdline.CmdlinePlugin method) CmdlinePlugin (class in dissect.target.plugins.os.unix.linux.cmdline) CmdlineRecord (in module dissect.target.plugins.os.unix.linux.cmdline) cmp_default() (in module dissect.apfs.util) cmp_fext() (in module dissect.apfs.util) cmp_fs() (in module dissect.apfs.util) cmp_fs_dir() (in module dissect.apfs.util) cmp_fs_dir_hash() (in module dissect.apfs.util) cmp_fs_extent() (in module dissect.apfs.util) cmp_omap() (in module dissect.apfs.util) cn (dissect.database.ese.ntds.objects.object.Object property) CNR (dissect.target.plugins.os.windows.network.IfTypes attribute) cobj (dissect.evidence.asdf.stream.CompressedStream attribute) cocoatimestamp() (in module dissect.util.ts) code (flow.record.selector.CompiledSelector attribute) code_page (dissect.executable.pe.directory.resource.ResourceDataEntry property) codebase (dissect.target.plugins.apps.productivity.msoffice.ClickOnceDeploymentManifestParser.Assembly attribute) codec (flow.record.adapter.avro.AvroWriter attribute) codepage (dissect.target.plugins.apps.av.sophos.SophosPlugin attribute) (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) (dissect.target.plugins.apps.av.trendmicro.TrendMicroPlugin attribute) CODEPAGE (in module dissect.database.ese.c_ese) codepage() (dissect.target.plugins.os.windows.generic.GenericPlugin method) CODEPAGE_MAP (in module dissect.database.ese.util) codestyle module CodestyleException CodeViewDebugEntry (class in dissect.executable.pe.directory.debug) COFFEE (dissect.target.plugins.os.windows.network.IfTypes attribute) ColimaChildTargetPlugin (class in dissect.target.plugins.child.colima) coll_descriptors (flow.record.adapter.mongo.MongoReader attribute) (flow.record.adapter.mongo.MongoWriter attribute) collapsable_items (dissect.target.plugins.os.unix.linux.network.SystemdNetworkConfigParser attribute) collapse (dissect.target.helpers.configutil.ConfigurationParser attribute) (dissect.target.helpers.configutil.ParserConfig attribute) (dissect.target.helpers.configutil.ParserOptions attribute) collapse_all (dissect.target.helpers.configutil.ConfigurationParser attribute) collapse_inverse (dissect.target.helpers.configutil.ParserConfig attribute) (dissect.target.helpers.configutil.ParserOptions attribute) COLLATION (in module dissect.ntfs.c_ntfs) collation_rule (dissect.ntfs.index.IndexRoot property) collect() (acquire.acquire.collector.Collector method) collect_command_output() (acquire.acquire.collector.Collector method) collect_file_raw() (acquire.acquire.collector.Collector method) collect_glob() (acquire.acquire.collector.Collector method) collect_hashes() (in module acquire.acquire.hashes) collect_named_objects() (in module acquire.acquire.dynamic.windows.collect) collect_open_handles() (in module acquire.acquire.dynamic.windows.collect) collect_path() (acquire.acquire.collector.Collector method) collect_rmmetadata() (acquire.acquire.acquire.NTFS class method) collect_usnjrnl() (acquire.acquire.acquire.NTFS class method) Collection (class in dissect.target.target) collection (flow.record.adapter.mongo.MongoReader attribute) (flow.record.adapter.mongo.MongoWriter attribute) CollectionReport (class in acquire.acquire.collector) Collector (class in acquire.acquire.collector) Color (class in dissect.target.helpers.cyber) COLOR_BG_BLUE (in module dissect.cstruct.utils) COLOR_BG_CYAN (in module dissect.cstruct.utils) COLOR_BG_GREEN (in module dissect.cstruct.utils) COLOR_BG_PURPLE (in module dissect.cstruct.utils) COLOR_BG_RED (in module dissect.cstruct.utils) COLOR_BG_WHITE (in module dissect.cstruct.utils) COLOR_BG_YELLOW (in module dissect.cstruct.utils) COLOR_BLUE (in module dissect.cstruct.utils) COLOR_CYAN (in module dissect.cstruct.utils) COLOR_GREEN (in module dissect.cstruct.utils) COLOR_GREY (in module dissect.target.tools.qfind) COLOR_NORMAL (in module dissect.cstruct.utils) COLOR_PURPLE (in module dissect.cstruct.utils) COLOR_RED (in module dissect.cstruct.utils) COLOR_WHITE (in module dissect.cstruct.utils) COLOR_YELLOW (in module dissect.cstruct.utils) colors (dissect.target.plugins.os.windows.rdpcache.BitmapTile attribute) Column (class in dissect.database.ese.table) (class in dissect.database.sqlite3.sqlite3) column (dissect.database.ese.ntds.schema.AttributeEntry attribute) column() (dissect.database.ese.table.Table method) column_ids (dissect.database.ese.index.Index property) column_names (dissect.database.ese.table.Table property) COLUMN_TYPE_MAP (in module dissect.database.ese.util) COLUMN_TYPES (in module dissect.database.ese.util) columns (dissect.database.ese.index.Index property) (dissect.database.ese.table.Table attribute) (dissect.database.sqlite3.sqlite3.Table attribute) (dissect.target.plugins.os.windows.search.TableRecord attribute) ColumnType (class in dissect.database.ese.util) com_descriptor (dissect.executable.pe.pe.PE property) comctl32 (in module acquire.acquire.gui.win32) ComDescriptorDirectory (class in dissect.executable.pe.directory.com_descriptor) ComHandlerRecord (in module dissect.target.plugins.os.windows.tasks.records) COMMAND (acquire.acquire.collector.ArtifactType attribute) command (class in flow.record.fieldtypes) (dissect.target.loaders.mqtt.Broker attribute) (dissect.target.plugins.os.windows.log.schedlgu.SchedLgU attribute) COMMAND_HISTORY_ABSOLUTE_PATHS (dissect.target.plugins.os.unix.bsd.citrix.history.CitrixCommandHistoryPlugin attribute) COMMAND_HISTORY_RELATIVE_PATHS (dissect.target.plugins.os.unix.bsd.citrix.history.CitrixCommandHistoryPlugin attribute) (dissect.target.plugins.os.unix.history.CommandHistoryPlugin attribute) COMMAND_INFO (dissect.target.loaders.remote.RemoteStreamConnection attribute) command_line (dissect.target.plugins.os.windows.regf.cit.Entry attribute) COMMAND_OUTPUT_BASE (acquire.acquire.collector.Collector attribute) COMMAND_QUIT (dissect.target.loaders.remote.RemoteStreamConnection attribute) COMMAND_READ (dissect.target.loaders.remote.RemoteStreamConnection attribute) commandhistory() (dissect.target.plugins.os.unix.bsd.citrix.history.CitrixCommandHistoryPlugin method) (dissect.target.plugins.os.unix.history.CommandHistoryPlugin method) CommandHistoryPlugin (class in dissect.target.plugins.os.unix.history) CommandHistoryRecord (in module dissect.target.plugins.os.unix.history) CommandLineEventConsumerRecord (in module dissect.target.plugins.os.windows.cim) commandprocautorun() (dissect.target.plugins.os.windows.generic.GenericPlugin method) CommandProcAutoRunRecord (in module dissect.target.plugins.os.windows.generic) comment (dissect.target.plugins.apps.ssh.ssh.SSHPrivateKey attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) comment_example() (in module codestyle) comment_prefixes (dissect.target.helpers.configutil.ConfigurationParser attribute) (dissect.target.helpers.configutil.ParserConfig attribute) (dissect.target.helpers.configutil.ParserOptions attribute) COMMENTS (dissect.target.helpers.configutil.Default attribute) comments (dissect.target.helpers.configutil.Env attribute) (dissect.target.plugins.os.windows.regf.shellbags.NETWORK attribute) ComMetadata (class in dissect.executable.pe.directory.com_descriptor) Commit (class in dissect.database.sqlite3.wal) commit() (dissect.cstruct.types.structure.StructureMetaType method) commit_time (dissect.volume.lvm.metadata.IntegritySegment attribute) CommitBlock (class in dissect.extfs.journal) commits (dissect.database.sqlite3.wal.WAL property) commits() (dissect.extfs.journal.JDB2 method) commits_all() (dissect.extfs.journal.JDB2 method) common() (in module dissect.target.helpers.hashutil) COMMON_APPLICATION_FIELDS (in module dissect.target.helpers.record) COMMON_CERTIFICATE_FIELDS (in module dissect.target.helpers.certificate) COMMON_CONTAINER_FIELDS (in module dissect.target.plugins.apps.container.container) COMMON_DIR_COMBINATIONS (acquire.acquire.acquire.History attribute) COMMON_EDITOR_FIELDS (in module dissect.target.plugins.apps.editor.editor) COMMON_ELEMENTS (in module dissect.target.plugins.apps.vpn.openvpn) (in module dissect.target.plugins.os.windows.cim) (in module dissect.target.plugins.os.windows.log.amcache) COMMON_ELLEMENTS (in module dissect.target.plugins.apps.ssh.ssh) COMMON_FIELDS (in module dissect.target.plugins.apps.chat.chat) COMMON_IMAGE_FIELDS (in module dissect.target.plugins.apps.container.container) COMMON_INTERFACE_ELEMENTS (in module dissect.target.helpers.record) COMMON_LOG_FIELDS (in module dissect.target.plugins.apps.container.container) COMMON_SAVE_PATHS (dissect.target.plugins.os.unix.linux.iptables.IptablesSavePlugin attribute) COMMON_UNIX_FIELDS (in module dissect.target.helpers.record) commonpath() (in module dissect.target.helpers.polypath) compact_formatter() (in module dissect.target.plugins.filesystem.ntfs.mft) COMPACT_RECORD_TYPES (in module dissect.target.plugins.filesystem.ntfs.mft) CompactPrefetchRecord (in module dissect.target.plugins.os.windows.prefetch) CompactSystemHeader (class in dissect.etl.headers.system) COMPAQ_PEER (dissect.target.helpers.network.IANAProtocol attribute) compare() (dissect.apfs.objects.nx_superblock.NxSuperblock method) comparison (dissect.target.tools.diff.DifferentialCli attribute) ComparisonOperator (class in dissect.util.ldap) COMPAT_1 (in module dissect.target.plugins.os.windows.everything.parser) compile() (dissect.cstruct.compiler.Compiler method) (in module dissect.cstruct.compiler) compile_file() (in module dissect.etl.manifest) compile_read() (dissect.cstruct.compiler.Compiler method) compile_xml() (in module dissect.etl.manifest) compile_yara() (in module dissect.target.plugins.filesystem.yara) compiled (dissect.cstruct.parser.CStyleParser attribute) (dissect.cstruct.parser.TokenParser attribute) CompiledSelector (class in flow.record.selector) Compiler (class in dissect.cstruct.compiler) complete_enter() (dissect.target.tools.shell.TargetHubCli method) complete_man() (dissect.target.tools.shell.ExtendedCmd method) completedefault() (dissect.target.tools.diff.DifferentialCli method) (dissect.target.tools.shell.RegistryCli method) (dissect.target.tools.shell.TargetCli method) COMPONENT_ID (dissect.etl.headers.headers.EventProperty attribute) COMPOSITELINK (dissect.target.plugins.os.windows.network.IfTypes attribute) COMPOUND_ACE_TYPE (in module dissect.database.ese.ntds.sd) compound_type (dissect.database.ese.ntds.sd.ACE attribute) (dissect.ntfs.secure.ACE attribute) COMPR_2 (dissect.database.ese.lcmapstring.CASE attribute) COMPR_4 (dissect.database.ese.lcmapstring.CASE attribute) COMPR_6 (dissect.database.ese.lcmapstring.CASE attribute) compress() (dissect.squashfs.compression.Compression method) (in module dissect.util.compression.sevenbit) compressed (dissect.target.loaders.ab.AndroidBackup attribute) (dissect.target.loaders.res.File attribute) COMPRESSED (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) COMPRESSED_FOLDER (class in dissect.target.plugins.os.windows.regf.shellbags) compressed_length_bytes (dissect.target.plugins.os.unix.locate.plocate.PLocateFile attribute) COMPRESSED_MASK (in module dissect.util.compression.lznt1) compressed_size (dissect.archive.vbk.StgBlockDescriptor property) (dissect.archive.wim.CompressedStream attribute) CompressedRunlistStream (class in dissect.ntfs.stream) CompressedStream (class in dissect.archive.wim) (class in dissect.evidence.asdf.stream) compression (acquire.acquire.outputs.tar.TarOutput attribute) Compression (class in dissect.squashfs.compression) (class in dissect.target.tools.dump) compression (dissect.btrfs.stream.Extent attribute) (dissect.target.tools.dump.DumpState attribute) COMPRESSION_FORMAT_DEFAULT (in module dissect.ntfs.c_ntfs) COMPRESSION_FORMAT_LZNT1 (in module dissect.ntfs.c_ntfs) COMPRESSION_FORMAT_NONE (in module dissect.ntfs.c_ntfs) COMPRESSION_SCHEME (in module dissect.database.ese.c_ese) COMPRESSION_TO_EXT (in module dissect.target.tools.dump) compression_type (dissect.archive.vbk.StgBlockDescriptor property) compression_unit (dissect.ntfs.attr.AttributeHeader property) (dissect.ntfs.stream.CompressedRunlistStream attribute) compression_unit_size (dissect.ntfs.stream.CompressedRunlistStream attribute) compute_pem_fingerprints() (in module dissect.target.helpers.certificate) Computer (class in dissect.database.ese.ntds.objects.computer) Computername (dissect.eventlog.evt.Record attribute) computers() (dissect.database.ese.ntds.ntds.NTDS method) (dissect.target.plugins.os.windows.ad.ntds.NtdsPlugin method) ComputerSidRecord (in module dissect.target.plugins.os.windows.generic) ComStream (class in dissect.executable.pe.directory.com_descriptor) con (flow.record.adapter.duckdb.DuckdbReader attribute) (flow.record.adapter.duckdb.DuckdbWriter attribute) (flow.record.adapter.sqlite.SqliteReader attribute) (flow.record.adapter.sqlite.SqliteWriter attribute) CONCAT (dissect.volume.vinum.config.PlexOrg attribute) ConcatHashKeyDatum (class in dissect.fve.bde.information) ConCredentials (in module dissect.target.filesystems.nfs) (in module dissect.target.helpers.sunrpc.client) Confidential (dissect.database.ese.ntds.util.SearchFlags attribute) Config (class in dissect.fve.luks.metadata) (class in dissect.target.plugins.os.unix.bsd.darwin.ios._os) (class in dissect.volume.vinum.vinum) config (dissect.executable.pe.directory.load_config.LoadConfigDirectory property) (dissect.fve.luks.metadata.Metadata attribute) (dissect.target.loaders.containerimage.ContainerImageTarSubLoader attribute) (dissect.target.loaders.utm.UtmLoader attribute) (dissect.target.plugins.apps.webserver.iis.IISLogsPlugin attribute) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager attribute) (dissect.volume.vinum.vinum.VinumPhysicalDisk property) CONFIG (in module acquire.acquire.acquire) config() (dissect.archive.vma.VMA method) (dissect.target.plugins.apps.ssh.opensshd.SSHServerPlugin method) (dissect.target.plugins.apps.virtualization.vmware_workstation.VmwareWorkstationPlugin method) (dissect.target.plugins.apps.vpn.openvpn.OpenVPNPlugin method) (dissect.target.plugins.apps.vpn.wireguard.WireGuardPlugin method) config2 (dissect.volume.vinum.vinum.VinumPhysicalDisk property) CONFIG_CRT (dissect.target.loaders.remote.RemoteStreamConnection attribute) config_globs (dissect.target.plugins.apps.vpn.openvpn.OpenVPNPlugin attribute) CONFIG_GLOBS (dissect.target.plugins.apps.vpn.wireguard.WireGuardPlugin attribute) config_globs (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager attribute) (dissect.target.plugins.os.unix.linux.network_managers.Parser attribute) CONFIG_KEY (dissect.target.loaders.remote.RemoteStreamConnection attribute) CONFIG_KEY_RUNCOMMANDS_FILE (dissect.target.tools.shell.RegistryCli attribute) (dissect.target.tools.shell.TargetCmd attribute) CONFIG_MAP (in module dissect.target.helpers.configutil) CONFIG_NAME (in module dissect.target.helpers.config) CONFIG_PATH (dissect.target.plugins.child.virtuozzo.VirtuozzoChildTargetPlugin attribute) config_paths (dissect.target.plugins.apps.webserver.nginx.NginxPlugin attribute) (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser attribute) (dissect.target.plugins.os.unix.linux.network.SystemdNetworkConfigParser attribute) config_time (dissect.volume.vinum.vinum.VinumPhysicalDisk attribute) ConfigNode (class in dissect.target.plugins.os.unix.linux.fortios._os) configs (dissect.target.plugins.apps.vpn.openvpn.OpenVPNPlugin attribute) (dissect.target.plugins.apps.vpn.wireguard.WireGuardPlugin attribute) configs() (dissect.archive.vma.VMA method) ConfigstorePlugin (class in dissect.target.plugins.os.unix.esxi.configstore) Configuration (class in dissect.database.ese.ntds.objects.configuration) (class in dissect.volume.raid.raid) ConfigurationCanBeMoved (dissect.database.ese.ntds.util.SystemFlags attribute) ConfigurationCanBeMovedWithRestrictions (dissect.database.ese.ntds.util.SystemFlags attribute) ConfigurationCanBeRenamedWithRestrictions (dissect.database.ese.ntds.util.SystemFlags attribute) ConfigurationParser (class in dissect.target.helpers.configutil) ConfigurationParsingError configurations (dissect.volume.raid.raid.RAID attribute) configure() (dissect.target.loaders.remote.RemoteStreamConnection static method) configure_generic_arguments() (in module dissect.target.tools.utils.cli) configure_logging() (in module dissect.target.tools.utils.logging) configure_plugin_arguments() (in module dissect.target.tools.utils.cli) configure_state() (in module dissect.target.tools.dump) CONFIGURED (dissect.target.plugins.apps.container.podman.ContainerState attribute) congestion_window (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) conn (dissect.target.filesystems.smb.SmbFilesystem attribute) (dissect.target.filesystems.smb.SmbStream attribute) (dissect.target.loaders.smb.SmbRegistry attribute) connect() (dissect.target.filesystems.nfs.NfsFilesystem class method) (dissect.target.helpers.nfs.client.mount.Client class method) (dissect.target.helpers.nfs.client.nfs.Client class method) (dissect.target.helpers.sunrpc.client.Client class method) (dissect.target.loaders.mqtt.Broker method) (dissect.target.loaders.remote.RemoteStreamConnection method) connect_port_mapper() (dissect.target.helpers.sunrpc.client.Client class method) connected (dissect.target.loaders.mqtt.Broker attribute) CONNECTED (dissect.target.plugins.os.unix.linux.proc.Sockets.SocketStateType attribute) connection (dissect.target.loaders.mqtt.MqttDiagnosticLine attribute) (dissect.target.loaders.mqtt.MqttLoader attribute) CONSENT_STORES (dissect.target.plugins.os.windows.cam.CamPlugin attribute) CONSOLE_FE_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) CONSOLE_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) ConsoleHostHistoryRecord (in module dissect.target.plugins.apps.shell.powershell) construct_hosts_record() (in module dissect.target.plugins.apps.webserver.nginx) construct_public_key() (in module dissect.target.plugins.apps.ssh.putty) Constructed (dissect.database.ese.ntds.util.SystemFlags attribute) consts (dissect.cstruct.cstruct.cstruct attribute) consume() (dissect.cstruct.expression.ExpressionTokenizer method) (dissect.cstruct.parser.TokenConsumer method) consumerbindings() (dissect.target.plugins.os.windows.cim.CimPlugin method) Container (class in dissect.clfs.blf) (class in dissect.clfs.container) (class in dissect.database.ese.ntds.objects.container) (class in dissect.target.container) container (dissect.apfs.objects.base.Object attribute) (dissect.apfs.objects.btree.BTree attribute) (dissect.target.filesystems.apfs.ApfsFilesystem attribute) (dissect.target.filesystems.apfs.ApfsVolumeFilesystem attribute) ContainerAppcompatRecord (in module dissect.target.plugins.os.windows.amcache) ContainerError ContainerImageTarSubLoader (class in dissect.target.loaders.containerimage) ContainerIndexed (dissect.database.ese.ntds.util.SearchFlags attribute) ContainerKeybag (class in dissect.apfs.objects.keybag) ContainerPlugin (class in dissect.target.plugins.apps.container.container) containers (dissect.clfs.blf.BaseRecord attribute) CONTAINERS (in module dissect.target.container) containers() (dissect.target.plugins.apps.container.docker.DockerPlugin method) (dissect.target.plugins.apps.container.podman.PodmanPlugin method) ContainerState (class in dissect.target.plugins.apps.container.podman) contains() (dissect.evidence.asdf.asdf.AsdfSnapshot method) content (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadTab attribute) CONTENT_TABLES (dissect.target.plugins.os.windows.cam.CamPlugin attribute) contents (dissect.target.plugins.os.unix.linux.proc.Environ attribute) (dissect.volume.lvm.lvm2.LVM2 attribute) Context (class in dissect.clfs.blf) CONTEXT_TABLES (dissect.target.plugins.os.windows.cam.CamPlugin attribute) CONTROL_PANEL (class in dissect.target.plugins.os.windows.regf.shellbags) CONTROL_PANEL_CATEGORY (class in dissect.target.plugins.os.windows.regf.shellbags) CONTROL_PANEL_CPL_FILE (class in dissect.target.plugins.os.windows.regf.shellbags) control_records() (dissect.clfs.blf.BLF method) ControlAccessRight (class in dissect.database.ese.ntds.objects.controlaccessright) controller_data (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) ControllerData (class in dissect.volume.ddf.ddf) ControlRecord (class in dissect.clfs.blf) CONTROLSET_REGEX (in module dissect.target.plugins.os.windows.registry) controlsets (dissect.target.plugins.os.windows.registry.RegistryPlugin property) conv_log_offset (dissect.fve.bde.eow.EowBitmap property) conv_log_size (dissect.fve.bde.eow.EowInformation property) CONV_MAGIC (in module dissect.fve.bde.c_bde) ConVerifier (in module dissect.target.filesystems.nfs) (in module dissect.target.helpers.sunrpc.client) convert_day_num_to_date() (in module dissect.database.ese.tools.ual) convert_email() (in module dissect.target.plugins.apps.chat.msn) convert_ports() (in module dissect.target.plugins.apps.container.docker) (in module dissect.target.plugins.apps.container.podman) convert_time() (in module dissect.target.plugins.os.windows.regf.trusteddocs) convert_timestamp() (in module dissect.target.plugins.apps.container.docker) convert_ts() (in module dissect.evidence.ad1.ad1) convert_value() (in module dissect.target.tools.build_magic) cookie (dissect.target.helpers.nfs.nfs3.EntryPlus attribute) (dissect.target.helpers.nfs.nfs3.ReadDirPlusParams attribute) cookies() (dissect.target.plugins.apps.browser.brave.BravePlugin method) (dissect.target.plugins.apps.browser.chrome.ChromePlugin method) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin method) (dissect.target.plugins.apps.browser.chromium.ChromiumPlugin method) (dissect.target.plugins.apps.browser.edge.EdgePlugin method) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin method) (dissect.target.plugins.apps.browser.iexplore.WebCache method) CookieVerf (class in dissect.target.helpers.nfs.nfs3) cookieverf (dissect.target.helpers.nfs.nfs3.ReadDirPlusParams attribute) (dissect.target.helpers.nfs.nfs3.ReadDirPlusResult attribute) copy() (dissect.target.helpers.fsutil.stat_result class method) copy_block() (dissect.evidence.asdf.asdf.AsdfWriter method) copy_bytes() (dissect.evidence.asdf.asdf.AsdfWriter method) copy_cstruct() (in module dissect.executable.elf.c_elf) copy_identifier (dissect.volume.vss.Store attribute) copy_runlist() (dissect.evidence.asdf.asdf.AsdfWriter method) copy_set_identifier (dissect.volume.vss.Store attribute) copy_stream() (in module dissect.evidence.tools.asdf.dd) CopyHistoryRecord (in module dissect.target.plugins.apps.productivity.sevenzip) CopyWithObject (dissect.database.ese.ntds.util.SearchFlags attribute) CorruptDataError count (dissect.archive.vbk.FibMetaSparseTable attribute) (dissect.archive.vbk.FibStream attribute) (dissect.archive.vbk.MetaTableDescriptor property) (dissect.archive.vbk.MetaVector attribute) (dissect.archive.vbk.RootDirectory attribute) (dissect.archive.vbk.SubFolderItem attribute) (dissect.cim.index.IndexPage attribute) (dissect.cim.objects.TOC attribute) (dissect.eventlog.evtx.Evtx attribute) (dissect.eventlog.wevtutil.WevtutilWrapper attribute) (dissect.evidence.ad1.ad1.SegmentFile attribute) (dissect.regf.regf.FastLeaf property) (dissect.regf.regf.HashLeaf property) (dissect.regf.regf.IndexLeaf property) (dissect.regf.regf.IndexRoot property) (dissect.regf.regf.KeyIndex property) (dissect.target.helpers.nfs.nfs3.ReadParams attribute) (dissect.target.helpers.nfs.nfs3.ReadResult attribute) (dissect.target.plugins.os.unix.locate.gnulocate.GNULocateFile attribute) (flow.record.adapter.duckdb.DuckdbReader attribute) (flow.record.adapter.duckdb.DuckdbWriter attribute) (flow.record.adapter.line.LineWriter attribute) (flow.record.adapter.split.SplitWriter attribute) (flow.record.adapter.sqlite.SqliteReader attribute) (flow.record.adapter.sqlite.SqliteWriter attribute) count_contiguous_subclusters() (in module dissect.hypervisor.disk.qcow2) cow (dissect.vmfs.address.FileBlockAddr property) (dissect.vmfs.address.LargeFileBlockAddr property) (dissect.vmfs.address.PointerBlockAddr property) (dissect.vmfs.address.PointerBlockAddr64 property) (dissect.vmfs.address.SmallFileBlockAddr property) (dissect.vmfs.address.SubBlockAddr property) (dissect.vmfs.address.SubBlockAddr64 property) cow_store (dissect.volume.lvm.metadata.SnapshotSegment attribute) COWD_MAGIC (in module dissect.hypervisor.disk.c_vmdk) cp() (in module dissect.target.tools.fs) CP_TO_NAME (in module dissect.executable.pe.locale_id) CPANEL_LASTLOGIN (in module dissect.target.plugins.apps.webhosting.cpanel) CPANEL_LASTLOGIN_PATTERN (in module dissect.target.plugins.apps.webhosting.cpanel) CPANEL_LOGS_PATH (in module dissect.target.plugins.apps.webhosting.cpanel) CPanelLastloginRecord (in module dissect.target.plugins.apps.webhosting.cpanel) CPanelPlugin (class in dissect.target.plugins.apps.webhosting.cpanel) cpassword (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) CPHB (dissect.target.helpers.network.IANAProtocol attribute) CPIO_MAGIC_CRC (in module dissect.util.cpio) CPIO_MAGIC_NEW (in module dissect.util.cpio) CPIO_MAGIC_OLD (in module dissect.util.cpio) CpioFile() (in module dissect.util.cpio) CpioFilesystem (class in dissect.target.filesystems.cpio) CpioInfo (class in dissect.util.cpio) CPNX (dissect.target.helpers.network.IANAProtocol attribute) CPU_FREQ (dissect.etl.headers.logfile.ReservedFlags attribute) cpu_speed_in_MHz (dissect.etl.headers.logfile.LogfileHeader property) cpu_threads (dissect.volume.lvm.metadata.VdoPoolSegment attribute) cpus (dissect.fve.luks.metadata.KeyslotKdf attribute) CramFS (class in dissect.cramfs.cramfs) cramfs (dissect.target.filesystems.cramfs.CramfsFilesystem attribute) cramfs_def (in module dissect.cramfs.c_cramfs) CramfsDirEntry (class in dissect.target.filesystems.cramfs) CramfsFilesystem (class in dissect.target.filesystems.cramfs) CramfsFilesystemEntry (class in dissect.target.filesystems.cramfs) crc (dissect.evidence.asdf.stream.Crc32Stream attribute) crc32 (dissect.fve.bde.information.Validation property) crc32() (in module dissect.util.hash.crc32) crc32_filobj() (in module dissect.evidence.tools.asdf.verify) crc32c() (in module dissect.util.hash.crc32c) crc32c_native (in module dissect.util.hash) crc32c_python (in module dissect.util.hash) Crc32Stream (class in dissect.evidence.asdf.stream) CRC_SIZE (in module dissect.util.compression.xz) CRCMismatchException create() (dissect.target.loaders.profile.ProfileOSPlugin class method) (dissect.target.loaders.res.ResOSPlugin class method) (dissect.target.plugin.OSPlugin class method) (dissect.target.plugins.os.default._os.DefaultOSPlugin class method) (dissect.target.plugins.os.unix._os.UnixPlugin class method) (dissect.target.plugins.os.unix.bsd.citrix._os.CitrixPlugin class method) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin class method) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin class method) (dissect.target.plugins.os.unix.esxi._os.ESXiPlugin class method) (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin class method) (dissect.target.plugins.os.unix.linux.debian.proxmox._os.ProxmoxPlugin class method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSPlugin class method) (dissect.target.plugins.os.windows._os.WindowsPlugin class method) create_argument_parser() (in module acquire.acquire.utils) (in module dissect.thumbcache.tools.utils) create_cipher() (dissect.target.loaders.itunes.FileInfo method) (in module dissect.fve.crypto) create_cli() (in module dissect.target.tools.shell) create_config() (dissect.target.plugins.os.unix.linux.network_managers.Template method) create_descriptor_table() (in module flow.record.adapter.sqlite) create_extended_descriptor() (in module dissect.target.helpers.record) create_map() (dissect.eventlog.bxml.Template method) create_parser() (dissect.target.helpers.configutil.ParserConfig method) create_record() (in module dissect.target.plugins.os.windows.log.amcache) create_records() (dissect.target.plugins.os.windows.regf.clsid.CLSIDPlugin method) create_sink() (dissect.target.tools.dump.DumpState method) create_state() (in module dissect.target.tools.dump) create_streams() (dissect.target.plugins.scrape.scrape.ScrapePlugin method) create_tar_filesystem() (in module dissect.target.plugins.os.unix.linux.fortios._os) create_time (dissect.apfs.objects.fs.Snapshot property) CREATED (dissect.target.plugins.apps.container.podman.ContainerState attribute) created (dissect.target.tools.diff.DirectoryDifferential attribute) creation_host (dissect.volume.lvm.lvm2.LVM2 attribute) (dissect.volume.lvm.metadata.LogicalVolume attribute) creation_time (dissect.archive.vma.VMA property) (dissect.archive.wim.DirectoryEntry property) (dissect.ntfs.attr.FileName property) (dissect.ntfs.attr.StandardInformation property) (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntryResource attribute) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK_BEEF0004 attribute) (dissect.target.plugins.os.windows.regf.shellbags.MTP_FILE_ENTRY property) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM property) (dissect.volume.lvm.lvm2.LVM2 attribute) (dissect.volume.lvm.metadata.HistoricalLogicalVolume attribute) (dissect.volume.lvm.metadata.LogicalVolume attribute) (dissect.volume.md.md.MDPhysicalDisk attribute) (dissect.volume.vss.Store attribute) creation_time_ns (dissect.archive.wim.DirectoryEntry property) (dissect.ntfs.attr.FileName property) (dissect.ntfs.attr.StandardInformation property) creation_ts (dissect.vmfs.lvm.Volume attribute) creator_back_trace_index (acquire.acquire.dynamic.windows.types.Handle attribute) (acquire.acquire.dynamic.windows.types.SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX property) cred (dissect.target.helpers.sunrpc.sunrpc.CallBody attribute) credentials (dissect.target.helpers.sunrpc.client.AuthScheme attribute) Credentials (in module dissect.target.helpers.nfs.client.nfs) (in module dissect.target.helpers.sunrpc.client) (in module dissect.target.helpers.sunrpc.serializer) (in module dissect.target.helpers.sunrpc.sunrpc) credentials_serializer (dissect.target.helpers.sunrpc.client.AuthScheme attribute) credhist() (dissect.target.plugins.os.windows.credential.credhist.CredHistPlugin method) credhist_def (in module dissect.target.plugins.os.windows.credential.credhist) CredHistEntry (class in dissect.target.plugins.os.windows.credential.credhist) CredHistFile (class in dissect.target.plugins.os.windows.credential.credhist) CredHistKeyProviderPlugin (class in dissect.target.plugins.os.windows.dpapi.keyprovider.credhist) CredHistPlugin (class in dissect.target.plugins.os.windows.credential.credhist) CredHistRecord (in module dissect.target.plugins.os.windows.credential.credhist) CredSystem (class in dissect.target.plugins.os.windows.dpapi.master_key) CRIM (class in dissect.eventlog.wevt) CRIT (dissect.target.plugins.os.unix.log.journal.JournalMessagePriority attribute) CritSecGuid (in module dissect.etl.utils) CRLDistributionPoint (class in dissect.database.ese.ntds.objects.crldistributionpoint) CRLRecord (in module dissect.target.plugins.os.windows.certlog) crls() (dissect.target.plugins.os.windows.certlog.CertLogPlugin method) CronjobPlugin (class in dissect.target.plugins.os.unix.cronjobs) CronjobRecord (in module dissect.target.plugins.os.unix.cronjobs) cronjobs() (dissect.target.plugins.os.unix.cronjobs.CronjobPlugin method) CRONTAB_DIRS (dissect.target.plugins.os.unix.cronjobs.CronjobPlugin attribute) CRONTAB_FILES (dissect.target.plugins.os.unix.cronjobs.CronjobPlugin attribute) crontabs (dissect.target.plugins.os.unix.cronjobs.CronjobPlugin attribute) crop_metadata (dissect.volume.lvm.metadata.ThinPoolSegment attribute) CrossRef (class in dissect.database.ese.ntds.objects.crossref) CrossRefContainer (class in dissect.database.ese.ntds.objects.crossrefcontainer) crtime (dissect.extfs.extfs.INode property) (dissect.xfs.xfs.INode property) crtime_ns (dissect.extfs.extfs.INode property) (dissect.xfs.xfs.INode property) CRTP (dissect.target.helpers.network.IANAProtocol attribute) CRUDP (dissect.target.helpers.network.IANAProtocol attribute) crypt_session_key_type1() (in module dissect.target.plugins.os.windows.dpapi.crypto) crypt_session_key_type2() (in module dissect.target.plugins.os.windows.dpapi.crypto) crypto_header (dissect.hypervisor.disk.qcow2.QCow2 attribute) CryptStream (class in dissect.fve.crypto.dmcrypt) cs (dissect.cstruct.compiler.Compiler attribute) (dissect.cstruct.types.base.MetaType attribute) CS_HREDRAW (in module acquire.acquire.gui.win32) CS_VREDRAW (in module acquire.acquire.gui.win32) csize_mask (dissect.hypervisor.disk.qcow2.QCow2 attribute) csize_shift (dissect.hypervisor.disk.qcow2.QCow2 attribute) cstruct (class in dissect.cstruct.cstruct) (dissect.cstruct.parser.Parser attribute) CStyleParser (class in dissect.cstruct.parser) CSV_COLUMNS (in module acquire.acquire.hashes) CsvfileReader (class in flow.record.adapter.csvfile) CsvfileWriter (class in flow.record.adapter.csvfile) CSVish (class in dissect.target.helpers.configutil) ctime (dissect.apfs.objects.fs.INode property) (dissect.btrfs.btrfs.INode property) (dissect.evidence.ad1.ad1.FileEntry property) (dissect.extfs.extfs.INode property) (dissect.fat.fat.DirectoryEntry property) (dissect.fat.fat.RootDirectory property) (dissect.ffs.ffs.INode property) (dissect.jffs.jffs2.INode property) (dissect.ole.ole.DirectoryEntry attribute) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx6.INode6 property) (dissect.qnxfs.qnx6.QNX6 attribute) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.xfs.xfs.INode property) ctime_ns (dissect.btrfs.btrfs.INode property) (dissect.extfs.extfs.INode property) (dissect.ffs.ffs.INode property) (dissect.xfs.xfs.INode property) ctx (dissect.evidence.asdf.stream.HashedStream attribute) (flow.record.tools.rdump.ProgressMonitor attribute) ctype (dissect.cim.cim.Property property) (dissect.database.ese.table.Column property) ctypes() (in module dissect.cstruct.cstruct) ctypes_type() (in module dissect.cstruct.cstruct) ctz() (in module dissect.hypervisor.disk.c_qcow2) current_offset (dissect.eventlog.bxml.Bxml property) current_path (flow.record.stream.PathTemplateWriter attribute) current_record_number (dissect.eventlog.evt.Evt attribute) current_snapshot (dissect.hypervisor.descriptor.vbox.Machine property) current_state (dissect.fve.bde.information.Information property) CURRENT_VERSION_KEY (dissect.target.plugins.os.windows._os.WindowsPlugin attribute) Cursor (class in dissect.apfs.cursor) (class in dissect.btrfs.tree) (class in dissect.database.ese.cursor) cursor (dissect.executable.pe.directory.resource.ResourceDirectory property) cursor() (dissect.apfs.objects.fs.FS method) (dissect.btrfs.tree.BTree method) (dissect.database.ese.index.Index method) (dissect.database.ese.table.Table method) custom() (in module dissect.target.helpers.hashutil) custom_destination() (dissect.target.plugins.os.windows.jumplist.JumpListPlugin method) custom_destination_def (in module dissect.target.plugins.os.windows.jumplist) custom_destinations (dissect.target.plugins.os.windows.jumplist.JumpListPlugin attribute) custom_obj_renderer() (in module dissect.target.tools.utils.logging) CustomDestinationFile (class in dissect.target.plugins.os.windows.jumplist) CW_USEDEFAULT (in module acquire.acquire.gui.win32) cwd (dissect.target.tools.diff.DifferentialCli attribute) (dissect.target.tools.shell.RegistryCli attribute) (dissect.target.tools.shell.TargetCli attribute) cwd() (dissect.target.helpers.compat.path_310.TargetPath class method) (dissect.target.helpers.compat.path_311.TargetPath class method) (dissect.target.helpers.compat.path_312.TargetPath class method) (dissect.target.helpers.compat.path_313.TargetPath class method) CYAN (dissect.target.helpers.cyber.Color attribute) (dissect.target.tools.shell.AnsiColors attribute) cyber (dissect.target.tools.shell.ExtendedCmd attribute) cyber() (in module dissect.target.helpers.cyber) cyber_print() (in module dissect.target.helpers.cyber) CyberIO (class in dissect.target.helpers.cyber) CyberLoader (class in dissect.target.loaders.cyber) cylinder_group (dissect.ffs.ffs.FFS attribute) cylinder_groups() (dissect.ffs.ffs.FFS method) CylinderGroup (class in dissect.ffs.ffs) CYRILLIC (dissect.database.ese.lcmapstring.SCRIPT attribute) D D (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) d_freq (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) d_state (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) dacl (dissect.database.ese.ntds.sd.SecurityDescriptor attribute) (dissect.ntfs.secure.SecurityDescriptor attribute) DailyTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) DARWIN_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) DarwinPlugin (class in dissect.target.plugins.os.unix.bsd.darwin._os) data (dissect.cim.classes.ClassInstance attribute) (dissect.cim.classes.DataRegion attribute) (dissect.cim.classes.QualifierReference attribute) (dissect.cim.index.IndexPage attribute) (dissect.clfs.c_clfs.BlockHeader attribute) (dissect.database.bsd.db.Page property) (dissect.database.ese.ntds.database.Database attribute) (dissect.database.ese.ntds.sd.ACE attribute) (dissect.database.ese.page.Node attribute) (dissect.database.ese.page.Page attribute) (dissect.database.ese.page.Tag attribute) (dissect.database.ese.record.RecordData attribute) (dissect.database.sqlite3.sqlite3.Cell property) (dissect.database.sqlite3.sqlite3.Page attribute) (dissect.database.sqlite3.wal.Frame property) (dissect.etl.etl.Buffer property) (dissect.etl.headers.event.EventHeaderExtendedDataItem attribute) (dissect.etl.headers.headers.Header attribute) (dissect.etl.headers.logfile.LogfileHeader attribute) Data (dissect.eventlog.evt.Record attribute) data (dissect.eventlog.wevt.WEVT attribute) (dissect.eventlog.wevt.WEVT_TYPE attribute) (dissect.eventlog.wevt_object.WevtObject attribute) (dissect.evidence.ad1.ad1.FileMeta attribute) (dissect.evidence.ewf.ewf.HeaderSection attribute) (dissect.executable.elf.elf.Section property) (dissect.executable.elf.elf.Segment property) (dissect.executable.pe.directory.com_descriptor.ComStream property) (dissect.executable.pe.directory.debug.DebugEntry property) (dissect.executable.pe.directory.resource.ResourceDataEntry property) (dissect.executable.pe.directory.security.Certificate property) (dissect.fve.bde.information.AesCbc256HmacSha512EncryptedDatum property) (dissect.fve.bde.information.AesCcmEncryptedDatum property) (dissect.fve.bde.information.AsymmetricEncryptedDatum property) (dissect.fve.bde.information.Dataset property) (dissect.fve.bde.information.ExportedPublicKeyDatum property) (dissect.fve.bde.information.KeyDatum property) (dissect.fve.bde.information.PublicKeyInfoDatum property) (dissect.fve.bde.information.SimpleDatum property) (dissect.fve.bde.information.SimpleLargeDatum property) (dissect.fve.bde.information.TpmEncryptedBlobDatum property) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.hypervisor.descriptor.vmx.Pair attribute) (dissect.hypervisor.util.envelope.Envelope attribute) (dissect.ntfs.index.IndexBuffer attribute) (dissect.ntfs.index.IndexEntry property) (dissect.ntfs.mft.MftRecord attribute) (dissect.ntfs.secure.ACE attribute) (dissect.regf.regf.BigData property) (dissect.regf.regf.KeyValue property) (dissect.target.helpers.nfs.nfs3.ReadResult attribute) (dissect.target.loaders.cb.CbRegistryKey property) (dissect.target.loaders.mqtt.SeekMessage attribute) (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) (dissect.thumbcache.thumbcache_file.ThumbcacheEntry property) (dissect.util.plist.NSDictionary attribute) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.volume.lvm.metadata.CachePoolSegment attribute) (dissect.volume.lvm.metadata.VdoPoolSegment attribute) (flow.record.selector.RecordContextMatcher attribute) data() (dissect.archive.vbk.MetaBlob method) (dissect.archive.vbk.MetaVector method) (dissect.archive.vbk.MetaVector2 method) (dissect.btrfs.tree.Cursor method) (dissect.cim.objects.DataPage method) (dissect.executable.pe.directory.resource.Resource method) (dissect.ntfs.attr.Attribute method) (dissect.ntfs.attr.AttributeHeader method) (dissect.target.plugins.os.windows.regf.cit.CIT method) data_block (dissect.squashfs.squashfs.INode property) data_block_size (dissect.volume.dm.thin.Metadata attribute) data_checksum (dissect.thumbcache.thumbcache_file.ThumbcacheEntry attribute) DATA_CLUSTER_MAX (in module dissect.fat.c_fat) DATA_CLUSTER_MIN (in module dissect.fat.c_fat) data_copies (dissect.volume.lvm.metadata.RAIDSegment attribute) (dissect.volume.lvm.metadata.Segment attribute) data_directories() (dissect.executable.pe.pe.PE method) data_end (dissect.database.bsd.tools.rpm.HeaderBlob attribute) data_extents (dissect.xfs.xfs.INode property) data_fh (dissect.volume.dm.thin.ThinPool attribute) data_id (dissect.cim.index.Key property) (dissect.volume.lvm.metadata.CacheSegment attribute) data_len (dissect.volume.lvm.metadata.CacheSegment attribute) data_length (dissect.cim.index.Key property) data_mapping (dissect.volume.dm.thin.Metadata attribute) data_offset (dissect.archive.vma.Extent attribute) (dissect.cramfs.cramfs.INode property) (dissect.etl.etl.Buffer property) (dissect.eventlog.bxml.Bxml attribute) (dissect.eventlog.evtx.ElfChnk attribute) (dissect.eventlog.wevt_object.WevtObject attribute) (dissect.evidence.ewf.ewf.SectionDescriptor attribute) (dissect.hypervisor.disk.hdd.HDS attribute) (dissect.hypervisor.disk.vdi.VDI property) (dissect.squashfs.squashfs.INode property) (dissect.volume.lvm.metadata.RAIDSegment attribute) data_page (dissect.cim.index.Key property) DATA_PAGE_SIZE (in module dissect.cim.c_cim) DATA_PATH (dissect.target.plugins.apps.chat.msn.MSNPlugin attribute) data_sectors (dissect.volume.lvm.metadata.IntegritySegment attribute) data_segment (dissect.fve.bde.information.Datum attribute) data_size (dissect.etl.headers.event.EventHeaderExtendedDataItem attribute) (dissect.etl.headers.headers.Header property) (dissect.fve.bde.information.Datum property) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK property) data_start (dissect.database.bsd.tools.rpm.HeaderBlob attribute) (dissect.eventlog.wevt_object.WevtObject attribute) (dissect.volume.lvm.metadata.CacheSegment attribute) data_stream (dissect.fat.fat.FATFS attribute) data_stripes (dissect.btrfs.stream.Chunk attribute) data_vmcx (dissect.target.plugins.child.hyperv.HyperVChildTargetPlugin attribute) Database (class in dissect.database.ese.ntds.database) databases (dissect.target.plugins.os.windows.search.SearchIndexPlugin attribute) DataDirectory (class in dissect.executable.pe.directory.base) datafork() (dissect.xfs.xfs.INode method) DataPage (class in dissect.cim.objects) DataRegion (class in dissect.cim.classes) dataruns (dissect.vmfs.lvm.Volume attribute) (dissect.xfs.xfs.INode property) dataruns() (dissect.extfs.extfs.INode method) (dissect.fat.fat.DirectoryEntry method) (dissect.fat.fat.RootDirectory method) (dissect.ffs.ffs.INode method) (dissect.ntfs.attr.Attribute method) (dissect.ntfs.attr.AttributeHeader method) (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.util.AttributeCollection method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) Dataset (class in dissect.fve.bde.information) dataset (dissect.fve.bde.information.Information attribute) DATASTORE_PATH (dissect.target.plugins.os.windows.wua_history.WuaHistoryPlugin attribute) DATASTORE_UPDATE_TABLE (dissect.target.plugins.os.windows.wua_history.WuaHistoryPlugin attribute) DataStream (class in dissect.hypervisor.disk.asif) (class in dissect.jffs.jffs2) DataTable (class in dissect.database.ese.ntds.database) date (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) date_accessed (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj attribute) (dissect.target.plugins.os.windows.everything.parser.Record attribute) date_added (dissect.apfs.objects.fs.DirectoryEntry property) date_created (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj attribute) (dissect.target.plugins.os.windows.everything.parser.Record attribute) date_modified (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj attribute) (dissect.target.plugins.os.windows.everything.parser.Record attribute) datetime (class in flow.record.fieldtypes) (dissect.fve.bde.information.ExternalInfoDatum property) (dissect.fve.bde.information.VmkInfoDatum property) datetime_fields (flow.record.adapter.avro.AvroReader attribute) DateTimePlugin (class in dissect.target.plugins.os.default.datetime) Datum (class in dissect.fve.bde.information) DATUM_TYPE_MAP (in module dissect.fve.bde.information) daylight_bias (dissect.target.plugins.os.windows.datetime.TimezoneInformation attribute) daylight_date (dissect.target.plugins.os.windows.datetime.TimezoneInformation attribute) DB (class in dissect.database.bsd.db) db (dissect.database.bsd.db.Page attribute) (dissect.database.bsd.tools.rpm.Packages attribute) (dissect.database.ese.btree.BTree attribute) (dissect.database.ese.cursor.Cursor attribute) (dissect.database.ese.index.Index attribute) (dissect.database.ese.ntds.database.DataTable attribute) (dissect.database.ese.ntds.database.LinkTable attribute) (dissect.database.ese.ntds.database.SecurityDescriptorTable attribute) (dissect.database.ese.ntds.ntds.NTDS attribute) (dissect.database.ese.ntds.objects.object.Object attribute) (dissect.database.ese.ntds.query.Query attribute) (dissect.database.ese.page.Page attribute) (dissect.database.ese.record.RecordData attribute) (dissect.database.ese.table.Catalog attribute) (dissect.database.ese.table.Table attribute) (dissect.database.ese.tools.certlog.CertLog attribute) (dissect.database.ese.tools.impacket.ESENT_DB attribute) (dissect.database.ese.tools.sru.SRU attribute) (dissect.database.ese.tools.ual.UAL attribute) (dissect.target.plugins.apps.browser.iexplore.WebCache attribute) (flow.record.adapter.mongo.MongoReader attribute) (flow.record.adapter.mongo.MongoWriter attribute) db_def (in module dissect.database.bsd.c_db) db_insert_record() (in module flow.record.adapter.sqlite) dbe_type (dissect.target.plugins.os.unix.locate.mlocate.MLocate attribute) DbgPrintGuid (in module dissect.etl.utils) DBT (in module dissect.database.bsd.db) dbtofsb() (in module dissect.ffs.ffs) DCCP (dissect.target.helpers.network.IANAProtocol attribute) DCN (dissect.target.plugins.os.windows.network.IfTypes attribute) DCN_MEAS (dissect.target.helpers.network.IANAProtocol attribute) ddb (dissect.hypervisor.disk.vmdk.DiskDescriptor attribute) DDF (class in dissect.volume.ddf.ddf) ddf (dissect.target.volumes.ddf.DdfVolumeSystem attribute) (in module dissect.target.volume) ddf_def (in module dissect.volume.ddf.c_ddf) DDFConfiguration (class in dissect.volume.ddf.ddf) DDFError DDFPhysicalDisk (class in dissect.volume.ddf.ddf) DDFVirtualDisk (class in dissect.volume.ddf.ddf) DdfVolumeSystem (class in dissect.target.volumes.ddf) DDN_X25 (dissect.target.plugins.os.windows.network.IfTypes attribute) DDP (dissect.target.helpers.network.IANAProtocol attribute) DDX (dissect.target.helpers.network.IANAProtocol attribute) DebianPlugin (class in dissect.target.plugins.os.unix.linux.debian._os) debug (dissect.executable.pe.pe.PE property) DEBUG (dissect.target.plugins.os.unix.log.journal.JournalMessagePriority attribute) debug (dissect.target.tools.shell.ExtendedCmd attribute) DEBUG (in module dissect.volume.vss) debug() (dissect.vmfs.descriptor.FileDescriptor method) (dissect.vmfs.resource.ResourceFile method) DebugDirectory (class in dissect.executable.pe.directory.debug) DebugEntry (class in dissect.executable.pe.directory.debug) DECADE (in module dissect.volume.ddf.ddf) DecmpfsStream (class in dissect.apfs.stream) decode() (dissect.util.compression.lzxpress_huffman.BitString method) decode_bit() (in module dissect.database.ese.util) decode_cd_key() (in module dissect.target.plugins.os.windows.productkey) decode_extent() (in module dissect.btrfs.stream) decode_guid() (in module dissect.database.ese.util) decode_name() (in module dissect.regf.regf) (in module dissect.target.plugins.os.windows.regf.cit) decode_oid() (in module dissect.database.ese.ntds.schema) decode_rfc4716() (in module dissect.target.plugins.apps.ssh.ssh) decode_text() (in module dissect.database.ese.util) decode_value() (dissect.target.plugins.os.unix.log.journal.JournalFile method) (in module dissect.database.ese.ntds.util) decode_varint() (in module dissect.target.helpers.protobuf) DecoderEntry (class in dissect.util.compression.lzfse) DECOLOR (in module dissect.ole.c_ole) decompress() (dissect.squashfs.compression.AvailableLZ4 method) (dissect.squashfs.compression.AvailableLZO method) (dissect.squashfs.compression.Compression method) (dissect.squashfs.compression.NativeLZMA method) (dissect.squashfs.compression.NativeXZ method) (dissect.squashfs.compression.NativeZlib method) (dissect.squashfs.compression.NativeZSTD method) (dissect.target.plugins.os.unix.log.atop.AtopFile method) (in module dissect.database.ese.compression) (in module dissect.util.compression.lz4) (in module dissect.util.compression.lzbitmap) (in module dissect.util.compression.lzfse) (in module dissect.util.compression.lznt1) (in module dissect.util.compression.lzo) (in module dissect.util.compression.lzvn) (in module dissect.util.compression.lzxpress) (in module dissect.util.compression.lzxpress_huffman) (in module dissect.util.compression.sevenbit) (in module dissect.util.compression.snappy) decompress_size() (in module dissect.database.ese.compression) decompressor (dissect.archive.wim.CompressedStream attribute) DECOMPRESSOR_MAP (in module dissect.archive.c_wim) DECRYPT (in module dissect.fve.crypto.base) decrypt() (dissect.database.ese.ntds.pek.PEK method) (dissect.fve.bde.information.VmkInfoDatum method) (dissect.fve.crypto.base.Cipher method) (dissect.fve.crypto.Cipher method) (dissect.hypervisor.util.envelope.Envelope method) (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry method) (dissect.target.plugins.os.windows.credential.credhist.CredHistFile method) (dissect.target.plugins.os.windows.dpapi.blob.Blob method) (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm method) decrypt_blob() (dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin method) DECRYPT_CHUNK_SIZE (in module dissect.hypervisor.util.envelope) decrypt_dpapi() (in module dissect.target.plugins.apps.browser.chromium) decrypt_header() (in module acquire.acquire.tools.decrypter) decrypt_master_key() (in module dissect.target.plugins.apps.browser.firefox) decrypt_password() (in module dissect.target.plugins.os.unix.linux.fortios._os) decrypt_rootfs() (in module dissect.target.plugins.os.unix.linux.fortios._os) decrypt_single_hash() (in module dissect.target.plugins.os.windows.sam) decrypt_system_blob() (dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin method) decrypt_unsupported() (in module dissect.target.plugins.apps.browser.chromium) decrypt_user_blob() (dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin method) decrypt_v10_linux() (in module dissect.target.plugins.apps.browser.chromium) decrypt_v10_windows() (in module dissect.target.plugins.apps.browser.chromium) decrypt_v11_linux() (in module dissect.target.plugins.apps.browser.chromium) decrypt_v20_windows() (in module dissect.target.plugins.apps.browser.chromium) decrypt_value() (dissect.target.plugins.apps.browser.chromium.ChromiumMixin method) (in module dissect.target.plugins.apps.browser.firefox) decrypt_with_hash() (dissect.target.plugins.os.windows.dpapi.master_key.MasterKey method) (dissect.target.plugins.os.windows.dpapi.master_key.MasterKeyFile method) decrypt_with_hash_10() (dissect.target.plugins.os.windows.dpapi.master_key.MasterKey method) decrypt_with_hmac() (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm method) decrypt_with_key() (dissect.target.plugins.os.windows.dpapi.master_key.MasterKey method) (dissect.target.plugins.os.windows.dpapi.master_key.MasterKeyFile method) decrypt_with_password() (dissect.target.plugins.os.windows.dpapi.master_key.MasterKey method) (dissect.target.plugins.os.windows.dpapi.master_key.MasterKeyFile method) decrypted (dissect.database.ese.ntds.pek.PEK attribute) (dissect.fve.bde.bde.BDE property) (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry attribute) (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) (dissect.target.plugins.os.windows.dpapi.master_key.MasterKey attribute) (dissect.target.plugins.os.windows.dpapi.master_key.MasterKeyFile property) decryption_keys() (dissect.target.plugins.apps.browser.chromium.ChromiumMixin method) deduplication (dissect.archive.vbk.StgBlockDescriptor property) deep (dissect.target.tools.diff.DifferentialCli attribute) (dissect.target.tools.diff.TargetComparison attribute) DEF_CSTYLE (dissect.cstruct.cstruct.cstruct attribute) DEF_LEGACY (dissect.cstruct.cstruct.cstruct attribute) defang() (in module flow.record.fieldtypes) DEFAULT (acquire.acquire.acquire.BsdProfile attribute) (acquire.acquire.acquire.ESXiProfile attribute) (acquire.acquire.acquire.ExecutionOrder attribute) (acquire.acquire.acquire.LinuxProfile attribute) (acquire.acquire.acquire.MacOSProfile attribute) (acquire.acquire.acquire.ProxmoxProfile attribute) (acquire.acquire.acquire.VolatileProfile attribute) (acquire.acquire.acquire.WindowsProfile attribute) Default (class in dissect.target.helpers.configutil) default (dissect.database.ese.table.Column property) (dissect.target.plugins.os.windows.env.EnvVarDetails attribute) default() (dissect.target.tools.shell.ExtendedCmd method) (dissect.target.tools.shell.TargetHubCli method) (flow.record.base.FieldType class method) (flow.record.fieldtypes.digest class method) (flow.record.fieldtypes.FieldType class method) (flow.record.fieldtypes.typedlist class method) DEFAULT_ASN_DB (in module flow.record.tools.geoip) DEFAULT_BLOCK_SIZE (in module dissect.evidence.asdf.asdf) DEFAULT_CHUNK_SIZE (in module dissect.archive.wim) DEFAULT_CITY_DB (in module flow.record.tools.geoip) DEFAULT_CLUSTER_SIZE (in module dissect.ntfs.c_ntfs) DEFAULT_CONFIG_PATH (dissect.target.plugins.apps.webserver.caddy.CaddyPlugin attribute) DEFAULT_CONFIG_PATHS (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin attribute) DEFAULT_ELEMENTS (in module dissect.target.plugins.os.unix.linux.services) DEFAULT_ENVVAR_PATHS (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) DEFAULT_EXTENSIONS (acquire.acquire.acquire.FileHashes attribute) DEFAULT_FILE_FILTERS (acquire.acquire.acquire.FileHashes attribute) default_formatter() (in module dissect.target.plugins.filesystem.ntfs.mft) DEFAULT_HASH_FUNCS (acquire.acquire.acquire.FileHashes attribute) DEFAULT_HISTDIR (dissect.target.tools.shell.TargetCmd attribute) DEFAULT_HISTDIRFMT (dissect.target.tools.shell.TargetCmd attribute) DEFAULT_HISTFILE (dissect.target.tools.shell.TargetCmd attribute) DEFAULT_HISTFILESIZE (dissect.target.tools.shell.TargetCmd attribute) DEFAULT_HMAC_ALGO (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher attribute) (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher1 attribute) (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher2 attribute) (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher3 attribute) (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher4 attribute) DEFAULT_INDEX_SIZE (in module dissect.ntfs.c_ntfs) DEFAULT_KDF_ALGO (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher attribute) (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher1 attribute) (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher2 attribute) (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher3 attribute) (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher4 attribute) DEFAULT_KDF_ITER (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher attribute) (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher1 attribute) (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher2 attribute) (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher3 attribute) (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher4 attribute) DEFAULT_LM_HASH (in module dissect.target.plugins.os.windows.ad.ntds) DEFAULT_LOG_DIRS (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) (dissect.target.plugins.apps.webserver.iis.IISLogsPlugin attribute) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin attribute) DEFAULT_LOG_PATH (dissect.target.plugins.os.windows.log.agentexecutor.AgentExecutorLogPlugin attribute) DEFAULT_MAX_SCAN_SIZE (in module dissect.target.plugins.filesystem.yara) DEFAULT_NT_HASH (in module dissect.target.plugins.os.windows.ad.ntds) DEFAULT_PAGE_SIZE (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher attribute) (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher1 attribute) (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher2 attribute) (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher3 attribute) (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher4 attribute) DEFAULT_PATHS (acquire.acquire.acquire.FileHashes attribute) (dissect.target.plugins.child.virtualbox.VirtualBoxChildTargetPlugin attribute) DEFAULT_RECORD_COUNT (in module flow.record.adapter.split) DEFAULT_RECORD_SIZE (in module dissect.ntfs.c_ntfs) DEFAULT_RUNCOMMANDS_FILE (dissect.target.tools.shell.ExtendedCmd attribute) (dissect.target.tools.shell.RegistryCli attribute) (dissect.target.tools.shell.TargetCmd attribute) DEFAULT_SECTOR_SIZE (in module dissect.ntfs.c_ntfs) (in module dissect.volume.ddf.ddf) DEFAULT_SERVER_ROOTS (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) default_subvolume (dissect.btrfs.btrfs.Btrfs attribute) DEFAULT_SUFFIX_LENGTH (in module flow.record.adapter.split) DEFAULT_TEMPLATE (flow.record.stream.PathTemplateWriter attribute) DEFAULT_TOP_GUID (in module dissect.hypervisor.disk.hdd) DEFAULT_TS_LOG_FORMAT (in module dissect.target.plugins.os.unix.log.messages) default_value (dissect.cim.cim.Property property) (dissect.cim.classes.ClassInstanceProperty property) (dissect.database.sqlite3.sqlite3.Column attribute) default_values (dissect.cim.classes.PropertyDefaultValues attribute) default_values_data (dissect.cim.classes.ClassDefinition attribute) DefaultByName (in module dissect.volume.vinum.vinum) DefaultMissing (class in flow.record.adapter.text) DefaultOSPlugin (class in dissect.target.plugins.os.default._os) defaultpassword() (dissect.target.plugins.os.windows.credential.defaultpassword.DefaultPasswordPlugin method) defaultpassword_def (in module dissect.target.plugins.os.windows.credential.defaultpassword) DefaultPasswordKeyProvider (class in dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.defaultpassword) DefaultPasswordPlugin (class in dissect.target.plugins.os.windows.credential.defaultpassword) DefaultPasswordRecord (in module dissect.target.plugins.os.windows.credential.defaultpassword) defender_def (in module dissect.target.plugins.os.windows.defender.quarantine) DEFENDER_MPLOG_BLOCK_PATTERNS (in module dissect.target.plugins.os.windows.defender.mplog) DEFENDER_MPLOG_LINE (in module dissect.target.plugins.os.windows.defender.mplog) DEFENDER_MPLOG_PATTERNS (in module dissect.target.plugins.os.windows.defender.mplog) DEFENDER_MPLOG_TS_PATTERN (in module dissect.target.plugins.os.windows.defender.mplog) DEFENDER_QUARANTINE_RC4_KEY (in module dissect.target.plugins.os.windows.defender.quarantine) DefenderFileQuarantineRecord (in module dissect.target.plugins.os.windows.defender.quarantine) DefenderMPLogBMTelemetryRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogDetectionAddRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogDetectionEventRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogEMSRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogExclusionRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogLowfiRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogMinFilBlockedFileRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogMinFilUSSRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogOriginalFileNameRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogProcessImageRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogResourceScanRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogRTPRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogThreatActionRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogThreatRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderQuarantineRecord (in module dissect.target.plugins.os.windows.defender.quarantine) definition (dissect.target.loaders.target.TargetLoader attribute) definition() (flow.record.base.RecordDescriptor method) DEGRADED (dissect.volume.vinum.config.PlexState attribute) (dissect.volume.vinum.config.SDState attribute) delay_import (dissect.executable.pe.pe.PE property) DelayedFileHandler (class in acquire.acquire.log) DelayImportDirectory (class in dissect.executable.pe.directory.delay_import) DelayImportFunction (class in dissect.executable.pe.directory.delay_import) DelayImportModule (class in dissect.executable.pe.directory.delay_import) DELEGATE (class in dissect.target.plugins.os.windows.regf.shellbags) delegate_identifier (dissect.target.plugins.os.windows.regf.shellbags.DELEGATE attribute) DELEGATE_ITEM_IDENTIFIER (in module dissect.target.plugins.os.windows.regf.shellbags) DELETABLE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) delete_expired_task_after (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) deleted (dissect.target.tools.diff.DirectoryDifferential attribute) deleted_content (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadTab attribute) DeletedImmediately (dissect.database.ese.ntds.util.SystemFlags attribute) delta (dissect.util.compression.lzfse.DecoderEntry attribute) (dissect.util.compression.lzfse.ValueDecoderEntry attribute) dereference() (dissect.cstruct.types.pointer.Pointer method) (dissect.ntfs.index.IndexEntry method) derivation (dissect.cim.cim.Class property) derive_key() (dissect.target.loaders.itunes.ITunesBackup method) (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm method) (in module dissect.database.sqlite3.encryption.sqlcipher.sqlcipher) derive_passphrase_key() (in module dissect.fve.luks.luks) derive_password_hash() (in module dissect.target.plugins.os.windows.dpapi.crypto) derive_recovery_key() (in module dissect.fve.bde.key) derive_user_key() (in module dissect.fve.bde.key) des_decrypt() (in module dissect.target.plugins.os.windows.sam) DESC (acquire.acquire.acquire.ActiveDirectory attribute) (acquire.acquire.acquire.ActivitiesCache attribute) (acquire.acquire.acquire.Appcompat attribute) (acquire.acquire.acquire.AV attribute) (acquire.acquire.acquire.BITS attribute) (acquire.acquire.acquire.Bootbanks attribute) (acquire.acquire.acquire.CamHistory attribute) (acquire.acquire.acquire.Devices attribute) (acquire.acquire.acquire.DHCP attribute) (acquire.acquire.acquire.DNS attribute) (acquire.acquire.acquire.Docker attribute) (acquire.acquire.acquire.Drivers attribute) (acquire.acquire.acquire.EDR attribute) (acquire.acquire.acquire.ESXi attribute) (acquire.acquire.acquire.ETL attribute) (acquire.acquire.acquire.EventLogs attribute) (acquire.acquire.acquire.Exchange attribute) (acquire.acquire.acquire.FileHashes attribute) (acquire.acquire.acquire.History attribute) (acquire.acquire.acquire.MacOS attribute) (acquire.acquire.acquire.MacOSApplicationsInfo attribute) (acquire.acquire.acquire.Misc attribute) (acquire.acquire.acquire.Module attribute) (acquire.acquire.acquire.MSSQL attribute) (acquire.acquire.acquire.Netstat attribute) (acquire.acquire.acquire.NTFS attribute) (acquire.acquire.acquire.OpenHandles attribute) (acquire.acquire.acquire.PCA attribute) (acquire.acquire.acquire.PowerShell attribute) (acquire.acquire.acquire.Prefetch attribute) (acquire.acquire.acquire.Proc attribute) (acquire.acquire.acquire.ProcNet attribute) (acquire.acquire.acquire.QuarantinedFiles attribute) (acquire.acquire.acquire.Recents attribute) (acquire.acquire.acquire.RecycleBin attribute) (acquire.acquire.acquire.Registry attribute) (acquire.acquire.acquire.RemoteAccess attribute) (acquire.acquire.acquire.SharePoint attribute) (acquire.acquire.acquire.Startup attribute) (acquire.acquire.acquire.Sys attribute) (acquire.acquire.acquire.Syscache attribute) (acquire.acquire.acquire.TextEditor attribute) (acquire.acquire.acquire.ThumbnailCache attribute) (acquire.acquire.acquire.VMFS attribute) (acquire.acquire.acquire.WBEM attribute) (acquire.acquire.acquire.WebHosting attribute) (acquire.acquire.acquire.Webserver attribute) (acquire.acquire.acquire.WER attribute) (acquire.acquire.acquire.WinArpCache attribute) (acquire.acquire.acquire.WinDnsClientCache attribute) (acquire.acquire.acquire.WindowsNotifications attribute) (acquire.acquire.acquire.WinMemDump attribute) (acquire.acquire.acquire.WinMemFiles attribute) (acquire.acquire.acquire.WinProcEnv attribute) (acquire.acquire.acquire.WinProcesses attribute) (acquire.acquire.acquire.WinRDPSessions attribute) desc (flow.record.adapter.avro.AvroReader attribute) (flow.record.adapter.avro.AvroWriter attribute) (flow.record.adapter.csvfile.CsvfileReader attribute) (flow.record.adapter.csvfile.CsvfileWriter attribute) (flow.record.adapter.xlsx.XlsxReader attribute) descendants (dissect.volume.lvm.metadata.HistoricalLogicalVolume attribute) description (dissect.database.bsd.tools.rpm.Package property) (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) (dissect.target.plugins.os.windows.regf.shellbags.NETWORK attribute) (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) (dissect.volume.lvm.lvm2.LVM2 attribute) description() (dissect.fve.bde.bde.BDE method) DESCRIPTIONS (in module dissect.target.helpers.shell_folder_ids) Descriptor (class in dissect.hypervisor.disk.hdd) descriptor (dissect.archive.vbk.SnapshotSlot attribute) (dissect.etl.headers.event.EventHeader property) (dissect.executable.pe.directory.bound_import.BoundImportForwardReference attribute) (dissect.executable.pe.directory.bound_import.BoundImportModule attribute) (dissect.executable.pe.directory.com_descriptor.ComDescriptorDirectory property) (dissect.executable.pe.directory.delay_import.DelayImportModule attribute) (dissect.executable.pe.directory.imports.ImportModule attribute) (dissect.extfs.journal.DescriptorBlockTag attribute) (dissect.hypervisor.disk.hdd.HDD attribute) (dissect.hypervisor.disk.vmdk.SparseDisk attribute) (dissect.hypervisor.disk.vmdk.VMDK attribute) (dissect.vmfs.descriptor.BestEffortBlockStream attribute) (dissect.vmfs.descriptor.BlockStream attribute) (dissect.vmfs.vmfs.VMFS attribute) descriptor_hash (flow.record.base.RecordDescriptor property) DESCRIPTOR_MASK (dissect.eventlog.bxml.BxmlTemplateDescriptor attribute) descriptor_struct (dissect.eventlog.bxml.BxmlTemplateDescriptor attribute) descriptor_to_schema() (in module flow.record.adapter.avro) DescriptorBlock (class in dissect.extfs.journal) DescriptorBlockTag (class in dissect.extfs.journal) descriptors (dissect.archive.wim.SecurityBlock attribute) (dissect.extfs.journal.CommitBlock attribute) (dissect.volume.vss.Store attribute) (flow.record.adapter.jsonfile.JsonfileWriter attribute) (flow.record.adapter.mongo.MongoReader attribute) (flow.record.adapter.mongo.MongoWriter attribute) (flow.record.base.GroupedRecord attribute) (flow.record.jsonpacker.JsonRecordPacker attribute) (flow.record.packer.RecordPacker attribute) descriptors() (dissect.ntfs.secure.Secure method) descriptors_seen (flow.record.adapter.duckdb.DuckdbReader attribute) (flow.record.adapter.duckdb.DuckdbWriter attribute) (flow.record.adapter.sqlite.SqliteReader attribute) (flow.record.adapter.sqlite.SqliteWriter attribute) descs (flow.record.adapter.xlsx.XlsxWriter attribute) (flow.record.stream.RecordStreamReader attribute) deserialize() (dissect.target.helpers.nfs.serializer.EntryPlusSerializer method) (dissect.target.helpers.nfs.serializer.FileAttributesSerializer method) (dissect.target.helpers.nfs.serializer.Lookup3ResultDeserializer method) (dissect.target.helpers.nfs.serializer.MountResultDeserializer method) (dissect.target.helpers.nfs.serializer.NfsTimeSerializer method) (dissect.target.helpers.nfs.serializer.Read3ResultDeserializer method) (dissect.target.helpers.nfs.serializer.ReadDirPlusResultDeserializer method) (dissect.target.helpers.nfs.serializer.ReadLink3ResultDeserializer method) (dissect.target.helpers.nfs.serializer.ResultDeserializer method) (dissect.target.helpers.nfs.serializer.SpecDataSerializer method) (dissect.target.helpers.sunrpc.serializer.AuthSerializer method) (dissect.target.helpers.sunrpc.serializer.Deserializer method) (dissect.target.helpers.sunrpc.serializer.Int32Serializer method) (dissect.target.helpers.sunrpc.serializer.MessageSerializer method) (dissect.target.helpers.sunrpc.serializer.OpaqueVarLengthSerializer method) (dissect.target.helpers.sunrpc.serializer.StringSerializer method) deserialize_from_bytes() (dissect.target.helpers.sunrpc.serializer.Deserializer method) Deserializer (class in dissect.target.helpers.sunrpc.serializer) DESKTOP (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) desktop_files (dissect.target.plugins.os.unix.applications.UnixApplicationsPlugin attribute) DEST_DIR_CACHE_SIZE (in module dissect.target.tools.dump) DEST_FILENAME_CACHE_SIZE (in module dissect.target.tools.dump) details (acquire.acquire.collector.Record attribute) (dissect.volume.dm.thin.ThinDevice attribute) detect() (dissect.target.container.Container class method) (dissect.target.filesystem.Filesystem class method) (dissect.target.filesystem.LayerFilesystem static method) (dissect.target.filesystem.RootFilesystem static method) (dissect.target.filesystem.VirtualFilesystem static method) (dissect.target.filesystems.cb.CbFilesystem static method) (dissect.target.filesystems.nfs.NfsFilesystem static method) (dissect.target.filesystems.smb.SmbFilesystem static method) (dissect.target.helpers.magic.magic.Magic static method) (dissect.target.loader.Loader static method) (dissect.target.loaders.ab.AndroidBackupLoader static method) (dissect.target.loaders.acquire.AcquireTarSubLoader static method) (dissect.target.loaders.acquire.AcquireZipSubLoader static method) (dissect.target.loaders.ad1.AD1Loader static method) (dissect.target.loaders.asdf.AsdfLoader static method) (dissect.target.loaders.cb.CbLoader static method) (dissect.target.loaders.cellebrite.CellebriteLoader static method) (dissect.target.loaders.containerimage.ContainerImageTarSubLoader static method) (dissect.target.loaders.cyber.CyberLoader static method) (dissect.target.loaders.dir.DirLoader static method) (dissect.target.loaders.direct.DirectLoader static method) (dissect.target.loaders.hyperv.HyperVLoader static method) (dissect.target.loaders.itunes.ITunesLoader static method) (dissect.target.loaders.kape.KapeLoader static method) (dissect.target.loaders.libvirt.LibvirtLoader static method) (dissect.target.loaders.local.LocalLoader static method) (dissect.target.loaders.log.LogLoader static method) (dissect.target.loaders.mqtt.MqttLoader static method) (dissect.target.loaders.multiraw.MultiRawLoader static method) (dissect.target.loaders.nscollector.NsCollectorTarSubLoader static method) (dissect.target.loaders.ova.OvaLoader static method) (dissect.target.loaders.overlay.OverlayLoader static method) (dissect.target.loaders.overlay2.Overlay2Loader static method) (dissect.target.loaders.ovf.OvfLoader static method) (dissect.target.loaders.phobos.PhobosLoader static method) (dissect.target.loaders.profile.ProfileLoader static method) (dissect.target.loaders.profile.ProfileOSPlugin class method) (dissect.target.loaders.proxmox.ProxmoxLoader static method) (dissect.target.loaders.pvm.PvmLoader static method) (dissect.target.loaders.pvs.PvsLoader static method) (dissect.target.loaders.raw.RawLoader static method) (dissect.target.loaders.remote.RemoteLoader static method) (dissect.target.loaders.res.ResLoader static method) (dissect.target.loaders.res.ResOSPlugin class method) (dissect.target.loaders.smb.SmbLoader static method) (dissect.target.loaders.tanium.TaniumLoader static method) (dissect.target.loaders.tar.GenericTarSubLoader static method) (dissect.target.loaders.tar.TarLoader static method) (dissect.target.loaders.tar.TarSubLoader static method) (dissect.target.loaders.target.TargetLoader static method) (dissect.target.loaders.uac.UacLoader static method) (dissect.target.loaders.uac.UacTarSubloader static method) (dissect.target.loaders.uac.UacZipSubLoader static method) (dissect.target.loaders.utm.UtmLoader static method) (dissect.target.loaders.vb.VBLoader static method) (dissect.target.loaders.vbk.VbkLoader static method) (dissect.target.loaders.vbox.VBoxLoader static method) (dissect.target.loaders.velociraptor.VelociraptorLoader static method) (dissect.target.loaders.vma.VmaLoader static method) (dissect.target.loaders.vmsupport.VmSupportLoader static method) (dissect.target.loaders.vmsupport.VmSupportTarSubloader static method) (dissect.target.loaders.vmwarevm.VmwarevmLoader static method) (dissect.target.loaders.vmx.VmxLoader static method) (dissect.target.loaders.xva.XvaLoader static method) (dissect.target.loaders.zip.GenericZipSubLoader static method) (dissect.target.loaders.zip.ZipLoader static method) (dissect.target.loaders.zip.ZipSubLoader static method) (dissect.target.plugin.OSPlugin class method) (dissect.target.plugins.os.default._os.DefaultOSPlugin class method) (dissect.target.plugins.os.unix._os.UnixPlugin class method) (dissect.target.plugins.os.unix.bsd._os.BsdPlugin class method) (dissect.target.plugins.os.unix.bsd.citrix._os.CitrixPlugin class method) (dissect.target.plugins.os.unix.bsd.darwin._os.DarwinPlugin class method) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin class method) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin class method) (dissect.target.plugins.os.unix.bsd.freebsd._os.FreeBsdPlugin class method) (dissect.target.plugins.os.unix.bsd.openbsd._os.OpenBsdPlugin class method) (dissect.target.plugins.os.unix.esxi._os.ESXiPlugin class method) (dissect.target.plugins.os.unix.linux._os.LinuxPlugin class method) (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin class method) (dissect.target.plugins.os.unix.linux.debian._os.DebianPlugin class method) (dissect.target.plugins.os.unix.linux.debian.proxmox._os.ProxmoxPlugin class method) (dissect.target.plugins.os.unix.linux.debian.vyos._os.VyosPlugin class method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSPlugin class method) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager method) (dissect.target.plugins.os.unix.linux.redhat._os.RedHatPlugin class method) (dissect.target.plugins.os.unix.linux.suse._os.SuSEPlugin class method) (dissect.target.plugins.os.windows._os.WindowsPlugin class method) (dissect.target.volume.VolumeSystem class method) detect_fh() (dissect.target.container.Container class method) (dissect.target.containers.fortifw.FortiFirmwareContainer static method) detect_header() (in module dissect.util.cpio) detect_id() (dissect.target.filesystem.Filesystem class method) detect_macho_arch() (in module dissect.target.plugins.os.unix.bsd.darwin._os) detect_path() (dissect.target.container.Container static method) (dissect.target.containers.asdf.AsdfContainer static method) (dissect.target.containers.asif.AsifContainer static method) (dissect.target.containers.ewf.EwfContainer static method) (dissect.target.containers.fortifw.FortiFirmwareContainer static method) (dissect.target.containers.hdd.HddContainer static method) (dissect.target.containers.hds.HdsContainer static method) (dissect.target.containers.qcow2.QCow2Container static method) (dissect.target.containers.raw.RawContainer static method) (dissect.target.containers.split.SplitContainer static method) (dissect.target.containers.vdi.VdiContainer static method) (dissect.target.containers.vhd.VhdContainer static method) (dissect.target.containers.vhdx.VhdxContainer static method) (dissect.target.containers.vmdk.VmdkContainer static method) detect_volume() (dissect.target.volume.LogicalVolumeSystem class method) detection_globs (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager attribute) detection_name (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntry attribute) detection_path (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntryResource attribute) detection_type (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntryResource attribute) dev (dissect.volume.lvm.metadata.PhysicalVolume property) DEV_BSIZE (in module dissect.ffs.ffs) dev_size (dissect.volume.lvm.metadata.PhysicalVolume attribute) dev_start (dissect.volume.raid.stream.Zone attribute) dev_uuid (dissect.btrfs.stream.Stripe attribute) DEVICE (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) Device (class in dissect.archive.vma) (class in dissect.vmfs.lvm) device (dissect.archive.vma.DeviceDataStream attribute) (dissect.target.loaders.cellebrite.Ufd attribute) (dissect.target.loaders.cellebrite.Ufdx attribute) (dissect.volume.lvm.metadata.PhysicalVolume attribute) device() (dissect.archive.vma.VMA method) device_containers() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) device_count (dissect.volume.lvm.metadata.RAIDSegment attribute) device_details (dissect.volume.dm.thin.Metadata attribute) device_id (dissect.volume.dm.thin.ThinDevice attribute) (dissect.volume.lvm.metadata.PhysicalVolume attribute) (dissect.volume.lvm.metadata.ThinSegment attribute) device_id_type (dissect.volume.lvm.metadata.PhysicalVolume attribute) device_identifier (dissect.hypervisor.disk.vmdk.ExtentDescriptor attribute) DEVICE_SUBST (in module acquire.acquire.utils) DeviceDataStream (class in dissect.archive.vma) DeviceInfo (class in dissect.target.loaders.cellebrite) Devices (class in acquire.acquire.acquire) devices (dissect.btrfs.btrfs.Btrfs attribute) (dissect.vmfs.lvm.LVM attribute) (dissect.vmfs.lvm.Volume attribute) (dissect.volume.lvm.lvm2.LVM2 attribute) (dissect.volume.raid.stream.Zone attribute) devices() (dissect.archive.vma.VMA method) devid (dissect.btrfs.stream.Stripe attribute) DfsConfiguration (class in dissect.database.ese.ntds.objects.dfsconfiguration) DGP (dissect.target.helpers.network.IANAProtocol attribute) DGRAM (dissect.target.plugins.os.unix.linux.proc.Sockets.SocketStreamType attribute) DhclientLeaseParser (class in dissect.target.plugins.os.unix.linux.network) DHCP (class in acquire.acquire.acquire) dhcp (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager property) dhcp() (dissect.target.plugins.os.unix.linux._os.LinuxPlugin method) (dissect.target.plugins.os.unix.linux.network.LinuxNetworkPlugin method) dhcp_ipv4 (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) dhcp_ipv6 (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) DhcpLease (class in dissect.target.plugins.os.unix.linux.network) dialect (flow.record.adapter.csvfile.CsvfileReader attribute) dialog (dissect.executable.pe.directory.resource.ResourceDirectory property) dialog_include (dissect.executable.pe.directory.resource.ResourceDirectory property) dictionary (acquire.acquire.dynamic.windows.types.Handle property) dictlist (class in flow.record.fieldtypes) diff (dissect.target.tools.diff.DifferentialEntry attribute) DifferentialCli (class in dissect.target.tools.diff) DifferentialEntry (class in dissect.target.tools.diff) differentiate_plugin_outputs() (dissect.target.tools.diff.TargetComparison method) differentiate_target_filesystems() (in module dissect.target.tools.diff) differentiate_target_plugin_outputs() (in module dissect.target.tools.diff) diffuse() (in module dissect.fve.luks.af) diffuser_a_decrypt() (in module dissect.fve.crypto.elephant) diffuser_a_encrypt() (in module dissect.fve.crypto.elephant) diffuser_b_decrypt() (in module dissect.fve.crypto.elephant) diffuser_b_encrypt() (in module dissect.fve.crypto.elephant) digest (acquire.acquire.tools.decrypter.EncryptedFile attribute) Digest (class in dissect.fve.luks.metadata) digest (class in flow.record.fieldtypes) (dissect.archive.vbk.FibBlockDescriptor property) (dissect.archive.vbk.StgBlockDescriptor property) (dissect.database.bsd.tools.rpm.PackageEntry attribute) (dissect.fve.luks.metadata.Digest attribute) (dissect.hypervisor.util.envelope.Envelope attribute) digest() (dissect.evidence.asdf.stream.Crc32Stream method) (dissect.evidence.asdf.stream.HashedStream method) digest_length (dissect.target.plugins.os.windows.dpapi.crypto.HashAlgorithm attribute) DIGEST_NEEDLES (in module dissect.target.plugins.os.windows.catroot) DIGEST_SIZE (in module dissect.fve.luks.af) digests (dissect.fve.luks.metadata.Metadata attribute) DIGIT (dissect.database.ese.lcmapstring.SCRIPT attribute) digit() (dissect.cstruct.expression.ExpressionTokenizer method) DIGITAL_WRAPPER_OVERHEAD_CHANNEL (dissect.target.plugins.os.windows.network.IfTypes attribute) DIGITALPOWERLINE (dissect.target.plugins.os.windows.network.IfTypes attribute) DIR (acquire.acquire.collector.ArtifactType attribute) (dissect.target.helpers.nfs.nfs3.FileType attribute) dir (dissect.target.helpers.nfs.nfs3.ReadDirPlusParams attribute) dir_attributes (dissect.target.helpers.nfs.client.nfs.ReadDirResult attribute) (dissect.target.helpers.nfs.nfs3.LookupResult attribute) (dissect.target.helpers.nfs.nfs3.ReadDirPlusResult attribute) DIR_COUNT (dissect.target.helpers.nfs.client.mount.Client attribute) (dissect.target.helpers.nfs.client.nfs.Client attribute) dir_count (dissect.target.helpers.nfs.nfs3.ReadDirPlusParams attribute) DIR_ENTRY_SIZE (in module dissect.fat.c_exfat) dir_extensions (acquire.acquire.acquire.History.DirCombinations attribute) dir_handles (dissect.target.helpers.mount.DissectMount attribute) direction (dissect.fve.luks.metadata.Keyslot attribute) DirectLoader (class in dissect.target.loaders.direct) directories (dissect.hypervisor.disk.asif.ASIF attribute) DIRECTORY (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) Directory (class in dissect.database.bsd.tools.rpm) (class in dissect.hypervisor.disk.asif) directory (dissect.executable.pe.directory.bound_import.BoundImportForwardReference attribute) (dissect.executable.pe.directory.bound_import.BoundImportModule attribute) (dissect.executable.pe.directory.export.ExportFunction attribute) (dissect.hypervisor.disk.asif.DataStream attribute) (dissect.hypervisor.disk.asif.Table attribute) (dissect.target.tools.diff.DirectoryDifferential attribute) directory() (dissect.ole.ole.OLE method) DIRECTORY_ALL_ACCESS (acquire.acquire.dynamic.windows.ntdll.ACCESS_MASK attribute) DIRECTORY_CREATE_OBJECT (acquire.acquire.dynamic.windows.ntdll.ACCESS_MASK attribute) DIRECTORY_CREATE_SUBDIRECTORY (acquire.acquire.dynamic.windows.ntdll.ACCESS_MASK attribute) DIRECTORY_MAPPING (in module dissect.target.loaders.ab) DIRECTORY_QUERY (acquire.acquire.dynamic.windows.ntdll.ACCESS_MASK attribute) DIRECTORY_TRAVERSE (acquire.acquire.dynamic.windows.ntdll.ACCESS_MASK attribute) DirectoryDifferential (class in dissect.target.tools.diff) DirectoryDirEntry (class in dissect.target.filesystems.dir) DirectoryEntry (class in dissect.apfs.objects.fs) (class in dissect.archive.wim) (class in dissect.fat.fat) (class in dissect.ole.ole) DirectoryFilesystem (class in dissect.target.filesystems.dir) DirectoryFilesystemEntry (class in dissect.target.filesystems.dir) DirectoryOutput (class in acquire.acquire.outputs.dir) dirent (dissect.fat.fat.DirectoryEntry attribute) DirEntry (class in dissect.jffs.jffs2) (class in dissect.target.filesystem) (class in dissect.vmfs.descriptor) DirItem (class in dissect.archive.vbk) dirlist (dissect.cramfs.cramfs.INode attribute) (dissect.extfs.extfs.INode attribute) (dissect.xfs.xfs.INode attribute) DirLoader (class in dissect.target.loaders.dir) dirname (flow.record.fieldtypes.uri property) dirname() (in module dissect.target.helpers.polypath) DirOpArgs (class in dissect.target.helpers.nfs.nfs3) DirOpArgs3Serializer (class in dissect.target.helpers.nfs.serializer) DIRS (dissect.target.plugins.apps.av.mcafee.McAfeePlugin attribute) (dissect.target.plugins.apps.browser.brave.BravePlugin attribute) (dissect.target.plugins.apps.browser.chrome.ChromePlugin attribute) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin attribute) (dissect.target.plugins.apps.browser.chromium.ChromiumPlugin attribute) (dissect.target.plugins.apps.browser.edge.EdgePlugin attribute) (dissect.target.plugins.apps.browser.iexplore.InternetExplorerPlugin attribute) (dissect.target.plugins.apps.browser.safari.SafariPlugin attribute) dirs (dissect.target.plugins.os.windows.adpolicy.ADPolicyPlugin attribute) dirty (dissect.regf.regf.RegistryHive attribute) DIRTY_NEEDLE (in module dissect.eventlog.evt) disallow_start_on_batteries (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) disallow_start_on_remote_app_session (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) discards (dissect.volume.lvm.metadata.ThinPoolSegment attribute) discover() (dissect.target.plugins.os.unix.linux.network_managers.LinuxNetworkManager method) Disk (class in dissect.hypervisor.disk.vhd) (class in dissect.volume.disk.disk) disk (dissect.target.volume.Volume attribute) (dissect.target.volume.VolumeSystem attribute) (dissect.volume.disk.partition.Partition attribute) (in module dissect.target.volume) disk() (dissect.target.loaders.mqtt.Broker method) DISK_DRIVE_XPATH (dissect.hypervisor.descriptor.ovf.OVF attribute) disk_id (dissect.target.loaders.mqtt.MqttStream attribute) (dissect.target.loaders.remote.RemoteStream attribute) DISK_INDEX_OFFSET (in module dissect.target.loaders.mqtt) disk_length (dissect.btrfs.stream.Extent attribute) disk_map (dissect.volume.raid.raid.VirtualDisk attribute) (dissect.volume.raid.stream.LinearStream attribute) (dissect.volume.raid.stream.RAID0Stream attribute) (dissect.volume.raid.stream.RAID10Stream attribute) (dissect.volume.raid.stream.RAID456Stream attribute) disk_offset (dissect.btrfs.stream.Extent attribute) DISK_XPATH (dissect.hypervisor.descriptor.ovf.OVF attribute) DiskCollection (class in dissect.target.target) DiskDescriptor (class in dissect.hypervisor.disk.vmdk) DiskError diskinfo (dissect.target.loaders.mqtt.Broker attribute) DiskIoGuid (in module dissect.etl.utils) DiskMap (in module dissect.volume.raid.raid) DiskMessage (class in dissect.target.loaders.mqtt) disks (dissect.hypervisor.descriptor.vbox.Hardware property) (dissect.hypervisor.disk.vmdk.VMDK attribute) (dissect.target.loaders.mqtt.InfoMessage attribute) (dissect.target.target.Target attribute) (dissect.volume.ddf.ddf.DDFVirtualDisk attribute) disks() (dissect.archive.xva.XVA method) (dissect.evidence.asdf.asdf.AsdfSnapshot method) (dissect.hypervisor.descriptor.ovf.OVF method) (dissect.hypervisor.descriptor.pvs.PVS method) (dissect.hypervisor.descriptor.vmx.VMX method) DISORG (dissect.volume.vinum.config.PlexOrg attribute) DISPLACEMENT_TABLE (in module dissect.util.compression.lznt1) display (dissect.target.plugins.os.windows.datetime.WindowsTimezone attribute) display() (dissect.target.loaders.mqtt.MqttDiagnosticLine method) display_name (dissect.database.ese.ntds.objects.top.Top property) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) display_power (dissect.target.plugins.os.windows.regf.cit.SystemDataBitmaps attribute) display_request_change (dissect.target.plugins.os.windows.regf.cit.SystemDataBitmaps attribute) DISPLAY_TZINFO (in module flow.record.fieldtypes) DisplaySpecifier (class in dissect.database.ese.ntds.objects.displayspecifier) dissect.apfs module dissect.apfs.apfs module dissect.apfs.c_apfs module dissect.apfs.cursor module dissect.apfs.exception module dissect.apfs.objects module dissect.apfs.objects.base module dissect.apfs.objects.btree module dissect.apfs.objects.btree_node module dissect.apfs.objects.checkpoint_map module dissect.apfs.objects.efi_jumpstart module dissect.apfs.objects.er_recovery_block module dissect.apfs.objects.er_state module dissect.apfs.objects.fs module dissect.apfs.objects.gbitmap module dissect.apfs.objects.gbitmap_block module dissect.apfs.objects.integrity_meta module dissect.apfs.objects.keybag module dissect.apfs.objects.nx_fusion_wbc module dissect.apfs.objects.nx_fusion_wbc_list module dissect.apfs.objects.nx_reap_list module dissect.apfs.objects.nx_reaper module dissect.apfs.objects.nx_superblock module dissect.apfs.objects.omap module dissect.apfs.objects.snap_meta_ext module dissect.apfs.objects.spaceman module dissect.apfs.objects.spaceman_bitmap module dissect.apfs.objects.spaceman_cab module dissect.apfs.objects.spaceman_cib module dissect.apfs.stream module dissect.apfs.util module dissect.archive module dissect.archive.c_vbk module dissect.archive.c_vma module dissect.archive.c_wim module dissect.archive.exceptions module dissect.archive.tools module dissect.archive.tools.backup module dissect.archive.vbk module dissect.archive.vma module dissect.archive.wim module dissect.archive.xva module dissect.btrfs module dissect.btrfs.btrfs module dissect.btrfs.c_btrfs module dissect.btrfs.exceptions module dissect.btrfs.stream module dissect.btrfs.tree module dissect.cim module dissect.cim.c_cim module dissect.cim.cim module dissect.cim.classes module dissect.cim.exceptions module dissect.cim.index module dissect.cim.mappings module dissect.cim.objects module dissect.cim.utils module dissect.clfs module dissect.clfs.blf module dissect.clfs.c_clfs module dissect.clfs.container module dissect.clfs.exceptions module dissect.cramfs module dissect.cramfs.c_cramfs module dissect.cramfs.cramfs module dissect.cramfs.exception module dissect.cstruct module dissect.cstruct.bitbuffer module dissect.cstruct.compiler module dissect.cstruct.cstruct module dissect.cstruct.exceptions module dissect.cstruct.expression module dissect.cstruct.parser module dissect.cstruct.tools module dissect.cstruct.tools.stubgen module dissect.cstruct.types module dissect.cstruct.types.base module dissect.cstruct.types.char module dissect.cstruct.types.enum module dissect.cstruct.types.flag module dissect.cstruct.types.int module dissect.cstruct.types.leb128 module dissect.cstruct.types.packed module dissect.cstruct.types.pointer module dissect.cstruct.types.structure module dissect.cstruct.types.void module dissect.cstruct.types.wchar module dissect.cstruct.utils module dissect.database module dissect.database.bsd module dissect.database.bsd.c_db module dissect.database.bsd.db module dissect.database.bsd.tools module dissect.database.bsd.tools.c_rpm module dissect.database.bsd.tools.rpm module dissect.database.ese module dissect.database.ese.btree module dissect.database.ese.c_ese module dissect.database.ese.compression module dissect.database.ese.cursor module dissect.database.ese.ese module dissect.database.ese.exception module dissect.database.ese.index module dissect.database.ese.lcmapstring module dissect.database.ese.ntds module dissect.database.ese.ntds.c_ds module dissect.database.ese.ntds.c_pek module dissect.database.ese.ntds.c_sd module dissect.database.ese.ntds.database module dissect.database.ese.ntds.ntds module dissect.database.ese.ntds.objects module dissect.database.ese.ntds.objects.applicationsettings module dissect.database.ese.ntds.objects.attributeschema module dissect.database.ese.ntds.objects.builtindomain module dissect.database.ese.ntds.objects.certificationauthority module dissect.database.ese.ntds.objects.classschema module dissect.database.ese.ntds.objects.classstore module dissect.database.ese.ntds.objects.computer module dissect.database.ese.ntds.objects.configuration module dissect.database.ese.ntds.objects.container module dissect.database.ese.ntds.objects.controlaccessright module dissect.database.ese.ntds.objects.crldistributionpoint module dissect.database.ese.ntds.objects.crossref module dissect.database.ese.ntds.objects.crossrefcontainer module dissect.database.ese.ntds.objects.dfsconfiguration module dissect.database.ese.ntds.objects.displayspecifier module dissect.database.ese.ntds.objects.dmd module dissect.database.ese.ntds.objects.dnsnode module dissect.database.ese.ntds.objects.dnszone module dissect.database.ese.ntds.objects.domain module dissect.database.ese.ntds.objects.domaindns module dissect.database.ese.ntds.objects.domainpolicy module dissect.database.ese.ntds.objects.dsuisettings module dissect.database.ese.ntds.objects.filelinktracking module dissect.database.ese.ntds.objects.foreignsecurityprincipal module dissect.database.ese.ntds.objects.group module dissect.database.ese.ntds.objects.grouppolicycontainer module dissect.database.ese.ntds.objects.infrastructureupdate module dissect.database.ese.ntds.objects.intersitetransport module dissect.database.ese.ntds.objects.intersitetransportcontainer module dissect.database.ese.ntds.objects.ipsecbase module dissect.database.ese.ntds.objects.ipsecfilter module dissect.database.ese.ntds.objects.ipsecisakmppolicy module dissect.database.ese.ntds.objects.ipsecnegotiationpolicy module dissect.database.ese.ntds.objects.ipsecnfa module dissect.database.ese.ntds.objects.ipsecpolicy module dissect.database.ese.ntds.objects.leaf module dissect.database.ese.ntds.objects.linktrackobjectmovetable module dissect.database.ese.ntds.objects.linktrackvolumetable module dissect.database.ese.ntds.objects.locality module dissect.database.ese.ntds.objects.lostandfound module dissect.database.ese.ntds.objects.msauthz_centralaccesspolicies module dissect.database.ese.ntds.objects.msauthz_centralaccessrules module dissect.database.ese.ntds.objects.msdfsr_content module dissect.database.ese.ntds.objects.msdfsr_contentset module dissect.database.ese.ntds.objects.msdfsr_globalsettings module dissect.database.ese.ntds.objects.msdfsr_localsettings module dissect.database.ese.ntds.objects.msdfsr_member module dissect.database.ese.ntds.objects.msdfsr_replicationgroup module dissect.database.ese.ntds.objects.msdfsr_subscriber module dissect.database.ese.ntds.objects.msdfsr_subscription module dissect.database.ese.ntds.objects.msdfsr_topology module dissect.database.ese.ntds.objects.msdns_serversettings module dissect.database.ese.ntds.objects.msds_authnpolicies module dissect.database.ese.ntds.objects.msds_authnpolicysilos module dissect.database.ese.ntds.objects.msds_claimstransformationpolicies module dissect.database.ese.ntds.objects.msds_claimtype module dissect.database.ese.ntds.objects.msds_claimtypepropertybase module dissect.database.ese.ntds.objects.msds_claimtypes module dissect.database.ese.ntds.objects.msds_optionalfeature module dissect.database.ese.ntds.objects.msds_passwordsettingscontainer module dissect.database.ese.ntds.objects.msds_quotacontainer module dissect.database.ese.ntds.objects.msds_resourceproperties module dissect.database.ese.ntds.objects.msds_resourceproperty module dissect.database.ese.ntds.objects.msds_resourcepropertylist module dissect.database.ese.ntds.objects.msds_shadowprincipalcontainer module dissect.database.ese.ntds.objects.msds_valuetype module dissect.database.ese.ntds.objects.msimaging_psps module dissect.database.ese.ntds.objects.mskds_provserverconfiguration module dissect.database.ese.ntds.objects.msmqenterprisesettings module dissect.database.ese.ntds.objects.mspki_enterpriseoid module dissect.database.ese.ntds.objects.mspki_privatekeyrecoveryagent module dissect.database.ese.ntds.objects.msspp_activationobjectscontainer module dissect.database.ese.ntds.objects.mstpm_informationobjectscontainer module dissect.database.ese.ntds.objects.ntdsconnection module dissect.database.ese.ntds.objects.ntdsdsa module dissect.database.ese.ntds.objects.ntdsservice module dissect.database.ese.ntds.objects.ntdssitesettings module dissect.database.ese.ntds.objects.ntfrssettings module dissect.database.ese.ntds.objects.object module dissect.database.ese.ntds.objects.organizationalperson module dissect.database.ese.ntds.objects.organizationalunit module dissect.database.ese.ntds.objects.person module dissect.database.ese.ntds.objects.physicallocation module dissect.database.ese.ntds.objects.pkicertificatetemplate module dissect.database.ese.ntds.objects.pkienrollmentservice module dissect.database.ese.ntds.objects.querypolicy module dissect.database.ese.ntds.objects.ridmanager module dissect.database.ese.ntds.objects.ridset module dissect.database.ese.ntds.objects.rpccontainer module dissect.database.ese.ntds.objects.rrasadministrationdictionary module dissect.database.ese.ntds.objects.samserver module dissect.database.ese.ntds.objects.secret module dissect.database.ese.ntds.objects.securityobject module dissect.database.ese.ntds.objects.server module dissect.database.ese.ntds.objects.serverscontainer module dissect.database.ese.ntds.objects.site module dissect.database.ese.ntds.objects.sitelink module dissect.database.ese.ntds.objects.sitescontainer module dissect.database.ese.ntds.objects.subnetcontainer module dissect.database.ese.ntds.objects.subschema module dissect.database.ese.ntds.objects.top module dissect.database.ese.ntds.objects.trusteddomain module dissect.database.ese.ntds.objects.user module dissect.database.ese.ntds.pek module dissect.database.ese.ntds.query module dissect.database.ese.ntds.schema module dissect.database.ese.ntds.sd module dissect.database.ese.ntds.tools module dissect.database.ese.ntds.tools.ntds module dissect.database.ese.ntds.util module dissect.database.ese.page module dissect.database.ese.record module dissect.database.ese.sorting_table module dissect.database.ese.table module dissect.database.ese.tools module dissect.database.ese.tools.certlog module dissect.database.ese.tools.impacket module dissect.database.ese.tools.sru module dissect.database.ese.tools.ual module dissect.database.ese.util module dissect.database.exception module dissect.database.sqlite3 module dissect.database.sqlite3.c_sqlite3 module dissect.database.sqlite3.encryption module dissect.database.sqlite3.encryption.sqlcipher module dissect.database.sqlite3.encryption.sqlcipher.exception module dissect.database.sqlite3.encryption.sqlcipher.sqlcipher module dissect.database.sqlite3.exception module dissect.database.sqlite3.sqlite3 module dissect.database.sqlite3.util module dissect.database.sqlite3.wal module dissect.etl module dissect.etl.c_etl module dissect.etl.etl module dissect.etl.exceptions module dissect.etl.headers module dissect.etl.headers.event module dissect.etl.headers.headers module dissect.etl.headers.logfile module dissect.etl.headers.system module dissect.etl.headers.utils module dissect.etl.manifest module dissect.etl.manifests module dissect.etl.utils module dissect.eventlog module dissect.eventlog.bxml module dissect.eventlog.evt module dissect.eventlog.evtx module dissect.eventlog.exceptions module dissect.eventlog.utils module dissect.eventlog.wevt module dissect.eventlog.wevt_object module dissect.eventlog.wevtutil module dissect.evidence module dissect.evidence.ad1 module dissect.evidence.ad1.ad1 module dissect.evidence.ad1.c_ad1 module dissect.evidence.ad1.stream module dissect.evidence.adcrypt module dissect.evidence.adcrypt.adcrypt module dissect.evidence.adcrypt.c_adcrypt module dissect.evidence.adcrypt.stream module dissect.evidence.asdf module dissect.evidence.asdf.asdf module dissect.evidence.asdf.c_asdf module dissect.evidence.asdf.stream module dissect.evidence.ewf module dissect.evidence.ewf.c_ewf module dissect.evidence.ewf.ewf module dissect.evidence.exception module dissect.evidence.tools module dissect.evidence.tools.adcrypt module dissect.evidence.tools.asdf module dissect.evidence.tools.asdf.dd module dissect.evidence.tools.asdf.meta module dissect.evidence.tools.asdf.repair module dissect.evidence.tools.asdf.verify module dissect.evidence.tools.util module dissect.executable module dissect.executable.elf module dissect.executable.elf.c_elf module dissect.executable.elf.elf module dissect.executable.exception module dissect.executable.macho module dissect.executable.pe module dissect.executable.pe.c_pe module dissect.executable.pe.directory module dissect.executable.pe.directory.base module dissect.executable.pe.directory.basereloc module dissect.executable.pe.directory.bound_import module dissect.executable.pe.directory.com_descriptor module dissect.executable.pe.directory.debug module dissect.executable.pe.directory.delay_import module dissect.executable.pe.directory.exception module dissect.executable.pe.directory.export module dissect.executable.pe.directory.iat module dissect.executable.pe.directory.imports module dissect.executable.pe.directory.load_config module dissect.executable.pe.directory.resource module dissect.executable.pe.directory.security module dissect.executable.pe.directory.tls module dissect.executable.pe.locale_id module dissect.executable.pe.pe module dissect.extfs module dissect.extfs.c_ext module dissect.extfs.c_jdb2 module dissect.extfs.exceptions module dissect.extfs.extfs module dissect.extfs.journal module dissect.fat module dissect.fat.c_exfat module dissect.fat.c_fat module dissect.fat.exceptions module dissect.fat.exfat module dissect.fat.fat module dissect.ffs module dissect.ffs.c_ffs module dissect.ffs.exceptions module dissect.ffs.ffs module dissect.fve module dissect.fve.bde module dissect.fve.bde.bde module dissect.fve.bde.c_bde module dissect.fve.bde.eow module dissect.fve.bde.information module dissect.fve.bde.key module dissect.fve.crypto module dissect.fve.crypto.argon2 module dissect.fve.crypto.base module dissect.fve.crypto.dmcrypt module dissect.fve.crypto.elephant module dissect.fve.crypto.util module dissect.fve.exception module dissect.fve.luks module dissect.fve.luks.af module dissect.fve.luks.c_luks module dissect.fve.luks.luks module dissect.fve.luks.metadata module dissect.fve.tools module dissect.fve.tools.dd module dissect.hypervisor module dissect.hypervisor.descriptor module dissect.hypervisor.descriptor.c_hyperv module dissect.hypervisor.descriptor.hyperv module dissect.hypervisor.descriptor.ovf module dissect.hypervisor.descriptor.pvs module dissect.hypervisor.descriptor.vbox module dissect.hypervisor.descriptor.vmx module dissect.hypervisor.disk module dissect.hypervisor.disk.asif module dissect.hypervisor.disk.c_asif module dissect.hypervisor.disk.c_hdd module dissect.hypervisor.disk.c_qcow2 module dissect.hypervisor.disk.c_vdi module dissect.hypervisor.disk.c_vhd module dissect.hypervisor.disk.c_vhdx module dissect.hypervisor.disk.c_vmdk module dissect.hypervisor.disk.hdd module dissect.hypervisor.disk.qcow2 module dissect.hypervisor.disk.vdi module dissect.hypervisor.disk.vhd module dissect.hypervisor.disk.vhdx module dissect.hypervisor.disk.vmdk module dissect.hypervisor.exceptions module dissect.hypervisor.tools module dissect.hypervisor.tools.envelope module dissect.hypervisor.tools.vmtar module dissect.hypervisor.util module dissect.hypervisor.util.envelope module dissect.hypervisor.util.vmtar module dissect.jffs module dissect.jffs.c_jffs2 module dissect.jffs.exceptions module dissect.jffs.jffs2 module dissect.ntfs module dissect.ntfs.attr module dissect.ntfs.c_ntfs module dissect.ntfs.exceptions module dissect.ntfs.index module dissect.ntfs.mft module dissect.ntfs.ntfs module dissect.ntfs.secure module dissect.ntfs.stream module dissect.ntfs.usnjrnl module dissect.ntfs.util module dissect.ole module dissect.ole.c_ole module dissect.ole.exceptions module dissect.ole.ole module dissect.qnxfs module dissect.qnxfs.c_qnx4 module dissect.qnxfs.c_qnx6 module dissect.qnxfs.exceptions module dissect.qnxfs.qnx4 module dissect.qnxfs.qnx6 module dissect.qnxfs.qnxfs module dissect.regf module dissect.regf.c_regf module dissect.regf.exceptions module dissect.regf.regf module dissect.shellitem module dissect.shellitem.lnk module dissect.shellitem.lnk.c_lnk module dissect.shellitem.lnk.lnk module dissect.shellitem.tools module dissect.shellitem.tools.lnk module dissect.squashfs module dissect.squashfs.c_squashfs module dissect.squashfs.compression module dissect.squashfs.exceptions module dissect.squashfs.squashfs module dissect.target module dissect.target.container module dissect.target.containers module dissect.target.containers.asdf module dissect.target.containers.asif module dissect.target.containers.ewf module dissect.target.containers.fortifw module dissect.target.containers.hdd module dissect.target.containers.hds module dissect.target.containers.qcow2 module dissect.target.containers.raw module dissect.target.containers.split module dissect.target.containers.vdi module dissect.target.containers.vhd module dissect.target.containers.vhdx module dissect.target.containers.vmdk module dissect.target.exceptions module dissect.target.filesystem module dissect.target.filesystems module dissect.target.filesystems.ad1 module dissect.target.filesystems.apfs module dissect.target.filesystems.btrfs module dissect.target.filesystems.cb module dissect.target.filesystems.cpio module dissect.target.filesystems.cramfs module dissect.target.filesystems.dir module dissect.target.filesystems.exfat module dissect.target.filesystems.extfs module dissect.target.filesystems.fat module dissect.target.filesystems.ffs module dissect.target.filesystems.itunes module dissect.target.filesystems.jffs module dissect.target.filesystems.nfs module dissect.target.filesystems.ntds module dissect.target.filesystems.ntfs module dissect.target.filesystems.overlay module dissect.target.filesystems.qnxfs module dissect.target.filesystems.smb module dissect.target.filesystems.squashfs module dissect.target.filesystems.tar module dissect.target.filesystems.vbk module dissect.target.filesystems.vmfs module dissect.target.filesystems.vmtar module dissect.target.filesystems.xfs module dissect.target.filesystems.zip module dissect.target.helpers module dissect.target.helpers.cache module dissect.target.helpers.certificate module dissect.target.helpers.compat module dissect.target.helpers.compat.path_310 module dissect.target.helpers.compat.path_311 module dissect.target.helpers.compat.path_312 module dissect.target.helpers.compat.path_313 module dissect.target.helpers.compat.path_common module dissect.target.helpers.config module dissect.target.helpers.configutil module dissect.target.helpers.cyber module dissect.target.helpers.descriptor_extensions module dissect.target.helpers.docs module dissect.target.helpers.fsutil module dissect.target.helpers.hashutil module dissect.target.helpers.keychain module dissect.target.helpers.lazy module dissect.target.helpers.loaderutil module dissect.target.helpers.localeutil module dissect.target.helpers.logging module dissect.target.helpers.magic module dissect.target.helpers.magic.magic module dissect.target.helpers.magic.mimetypes module dissect.target.helpers.magic.mimetypes.freedesktop module dissect.target.helpers.magic.mimetypes.overrides module dissect.target.helpers.mount module dissect.target.helpers.mui module dissect.target.helpers.network module dissect.target.helpers.nfs module dissect.target.helpers.nfs.client module dissect.target.helpers.nfs.client.mount module dissect.target.helpers.nfs.client.nfs module dissect.target.helpers.nfs.nfs3 module dissect.target.helpers.nfs.serializer module dissect.target.helpers.polypath module dissect.target.helpers.protobuf module dissect.target.helpers.record module dissect.target.helpers.record_modifier module dissect.target.helpers.regex module dissect.target.helpers.regex.ipaddress module dissect.target.helpers.regutil module dissect.target.helpers.scrape module dissect.target.helpers.shell_application_ids module dissect.target.helpers.shell_folder_ids module dissect.target.helpers.sunrpc module dissect.target.helpers.sunrpc.client module dissect.target.helpers.sunrpc.serializer module dissect.target.helpers.sunrpc.sunrpc module dissect.target.helpers.utils module dissect.target.loader module dissect.target.loaders module dissect.target.loaders.ab module dissect.target.loaders.acquire module dissect.target.loaders.ad1 module dissect.target.loaders.asdf module dissect.target.loaders.cb module dissect.target.loaders.cellebrite module dissect.target.loaders.containerimage module dissect.target.loaders.cyber module dissect.target.loaders.dir module dissect.target.loaders.direct module dissect.target.loaders.hyperv module dissect.target.loaders.itunes module dissect.target.loaders.kape module dissect.target.loaders.libvirt module dissect.target.loaders.local module dissect.target.loaders.log module dissect.target.loaders.mqtt module dissect.target.loaders.multiraw module dissect.target.loaders.nscollector module dissect.target.loaders.ova module dissect.target.loaders.overlay module dissect.target.loaders.overlay2 module dissect.target.loaders.ovf module dissect.target.loaders.phobos module dissect.target.loaders.profile module dissect.target.loaders.proxmox module dissect.target.loaders.pvm module dissect.target.loaders.pvs module dissect.target.loaders.raw module dissect.target.loaders.remote module dissect.target.loaders.res module dissect.target.loaders.smb module dissect.target.loaders.tanium module dissect.target.loaders.tar module dissect.target.loaders.target module dissect.target.loaders.uac module dissect.target.loaders.utm module dissect.target.loaders.vb module dissect.target.loaders.vbk module dissect.target.loaders.vbox module dissect.target.loaders.velociraptor module dissect.target.loaders.vma module dissect.target.loaders.vmsupport module dissect.target.loaders.vmwarevm module dissect.target.loaders.vmx module dissect.target.loaders.xva module dissect.target.loaders.zip module dissect.target.plugin module dissect.target.plugins module dissect.target.plugins.apps module dissect.target.plugins.apps.av module dissect.target.plugins.apps.av.mcafee module dissect.target.plugins.apps.av.sophos module dissect.target.plugins.apps.av.symantec module dissect.target.plugins.apps.av.trendmicro module dissect.target.plugins.apps.browser module dissect.target.plugins.apps.browser.brave module dissect.target.plugins.apps.browser.browser module dissect.target.plugins.apps.browser.chrome module dissect.target.plugins.apps.browser.chromium module dissect.target.plugins.apps.browser.edge module dissect.target.plugins.apps.browser.firefox module dissect.target.plugins.apps.browser.iexplore module dissect.target.plugins.apps.browser.safari module dissect.target.plugins.apps.chat module dissect.target.plugins.apps.chat.chat module dissect.target.plugins.apps.chat.msn module dissect.target.plugins.apps.container module dissect.target.plugins.apps.container.container module dissect.target.plugins.apps.container.docker module dissect.target.plugins.apps.container.podman module dissect.target.plugins.apps.editor module dissect.target.plugins.apps.editor.editor module dissect.target.plugins.apps.editor.windowsnotepad module dissect.target.plugins.apps.edr module dissect.target.plugins.apps.edr.acquire module dissect.target.plugins.apps.edr.velociraptor module dissect.target.plugins.apps.other module dissect.target.plugins.apps.other.env module dissect.target.plugins.apps.productivity module dissect.target.plugins.apps.productivity.msoffice module dissect.target.plugins.apps.productivity.sevenzip module dissect.target.plugins.apps.productivity.winrar module dissect.target.plugins.apps.remoteaccess module dissect.target.plugins.apps.remoteaccess.anydesk module dissect.target.plugins.apps.remoteaccess.remoteaccess module dissect.target.plugins.apps.remoteaccess.rustdesk module dissect.target.plugins.apps.remoteaccess.splashtop module dissect.target.plugins.apps.remoteaccess.teamviewer module dissect.target.plugins.apps.shell module dissect.target.plugins.apps.shell.powershell module dissect.target.plugins.apps.shell.wget module dissect.target.plugins.apps.ssh module dissect.target.plugins.apps.ssh.openssh module dissect.target.plugins.apps.ssh.opensshd module dissect.target.plugins.apps.ssh.putty module dissect.target.plugins.apps.ssh.ssh module dissect.target.plugins.apps.virtualization module dissect.target.plugins.apps.virtualization.vmware_workstation module dissect.target.plugins.apps.vpn module dissect.target.plugins.apps.vpn.openvpn module dissect.target.plugins.apps.vpn.wireguard module dissect.target.plugins.apps.webhosting module dissect.target.plugins.apps.webhosting.cpanel module dissect.target.plugins.apps.webserver module dissect.target.plugins.apps.webserver.apache module dissect.target.plugins.apps.webserver.caddy module dissect.target.plugins.apps.webserver.citrix module dissect.target.plugins.apps.webserver.iis module dissect.target.plugins.apps.webserver.nginx module dissect.target.plugins.apps.webserver.webserver module dissect.target.plugins.child module dissect.target.plugins.child.colima module dissect.target.plugins.child.docker module dissect.target.plugins.child.esxi module dissect.target.plugins.child.hyperv module dissect.target.plugins.child.lima module dissect.target.plugins.child.parallels module dissect.target.plugins.child.podman module dissect.target.plugins.child.proxmox module dissect.target.plugins.child.qemu module dissect.target.plugins.child.virtualbox module dissect.target.plugins.child.virtuozzo module dissect.target.plugins.child.vmware_workstation module dissect.target.plugins.child.wsl module dissect.target.plugins.filesystem module dissect.target.plugins.filesystem.icat module dissect.target.plugins.filesystem.ntfs module dissect.target.plugins.filesystem.ntfs.mft module dissect.target.plugins.filesystem.ntfs.mft_timeline module dissect.target.plugins.filesystem.ntfs.usnjrnl module dissect.target.plugins.filesystem.ntfs.utils module dissect.target.plugins.filesystem.resolver module dissect.target.plugins.filesystem.unix module dissect.target.plugins.filesystem.unix.capability module dissect.target.plugins.filesystem.unix.suid module dissect.target.plugins.filesystem.walkfs module dissect.target.plugins.filesystem.yara module dissect.target.plugins.general module dissect.target.plugins.general.example module dissect.target.plugins.general.loaders module dissect.target.plugins.general.osinfo module dissect.target.plugins.general.plugins module dissect.target.plugins.general.users module dissect.target.plugins.os module dissect.target.plugins.os.default module dissect.target.plugins.os.default._os module dissect.target.plugins.os.default.datetime module dissect.target.plugins.os.default.locale module dissect.target.plugins.os.default.network module dissect.target.plugins.os.unix module dissect.target.plugins.os.unix._os module dissect.target.plugins.os.unix.applications module dissect.target.plugins.os.unix.bsd module dissect.target.plugins.os.unix.bsd._os module dissect.target.plugins.os.unix.bsd.citrix module dissect.target.plugins.os.unix.bsd.citrix._os module dissect.target.plugins.os.unix.bsd.citrix.generic module dissect.target.plugins.os.unix.bsd.citrix.history module dissect.target.plugins.os.unix.bsd.citrix.locale module dissect.target.plugins.os.unix.bsd.darwin module dissect.target.plugins.os.unix.bsd.darwin._os module dissect.target.plugins.os.unix.bsd.darwin.ios module dissect.target.plugins.os.unix.bsd.darwin.ios._os module dissect.target.plugins.os.unix.bsd.darwin.ios.applications module dissect.target.plugins.os.unix.bsd.darwin.ios.generic module dissect.target.plugins.os.unix.bsd.darwin.ios.locale module dissect.target.plugins.os.unix.bsd.darwin.macos module dissect.target.plugins.os.unix.bsd.darwin.macos._os module dissect.target.plugins.os.unix.bsd.darwin.macos.network module dissect.target.plugins.os.unix.bsd.darwin.macos.user module dissect.target.plugins.os.unix.bsd.freebsd module dissect.target.plugins.os.unix.bsd.freebsd._os module dissect.target.plugins.os.unix.bsd.openbsd module dissect.target.plugins.os.unix.bsd.openbsd._os module dissect.target.plugins.os.unix.cronjobs module dissect.target.plugins.os.unix.datetime module dissect.target.plugins.os.unix.esxi module dissect.target.plugins.os.unix.esxi._os module dissect.target.plugins.os.unix.esxi.configstore module dissect.target.plugins.os.unix.esxi.esxconf module dissect.target.plugins.os.unix.esxi.vm module dissect.target.plugins.os.unix.etc module dissect.target.plugins.os.unix.etc.etc module dissect.target.plugins.os.unix.generic module dissect.target.plugins.os.unix.history module dissect.target.plugins.os.unix.linux module dissect.target.plugins.os.unix.linux._os module dissect.target.plugins.os.unix.linux.android module dissect.target.plugins.os.unix.linux.android._os module dissect.target.plugins.os.unix.linux.cmdline module dissect.target.plugins.os.unix.linux.debian module dissect.target.plugins.os.unix.linux.debian._os module dissect.target.plugins.os.unix.linux.debian.apt module dissect.target.plugins.os.unix.linux.debian.dpkg module dissect.target.plugins.os.unix.linux.debian.proxmox module dissect.target.plugins.os.unix.linux.debian.proxmox._os module dissect.target.plugins.os.unix.linux.debian.proxmox.vm module dissect.target.plugins.os.unix.linux.debian.snap module dissect.target.plugins.os.unix.linux.debian.vyos module dissect.target.plugins.os.unix.linux.debian.vyos._os module dissect.target.plugins.os.unix.linux.environ module dissect.target.plugins.os.unix.linux.fortios module dissect.target.plugins.os.unix.linux.fortios._os module dissect.target.plugins.os.unix.linux.fortios.generic module dissect.target.plugins.os.unix.linux.fortios.locale module dissect.target.plugins.os.unix.linux.iptables module dissect.target.plugins.os.unix.linux.modules module dissect.target.plugins.os.unix.linux.netstat module dissect.target.plugins.os.unix.linux.network module dissect.target.plugins.os.unix.linux.network_managers module dissect.target.plugins.os.unix.linux.proc module dissect.target.plugins.os.unix.linux.processes module dissect.target.plugins.os.unix.linux.recentlyused module dissect.target.plugins.os.unix.linux.redhat module dissect.target.plugins.os.unix.linux.redhat._os module dissect.target.plugins.os.unix.linux.redhat.yum module dissect.target.plugins.os.unix.linux.services module dissect.target.plugins.os.unix.linux.sockets module dissect.target.plugins.os.unix.linux.suse module dissect.target.plugins.os.unix.linux.suse._os module dissect.target.plugins.os.unix.linux.suse.zypper module dissect.target.plugins.os.unix.locale module dissect.target.plugins.os.unix.locate module dissect.target.plugins.os.unix.locate.gnulocate module dissect.target.plugins.os.unix.locate.locate module dissect.target.plugins.os.unix.locate.mlocate module dissect.target.plugins.os.unix.locate.plocate module dissect.target.plugins.os.unix.log module dissect.target.plugins.os.unix.log.atop module dissect.target.plugins.os.unix.log.audit module dissect.target.plugins.os.unix.log.auth module dissect.target.plugins.os.unix.log.helpers module dissect.target.plugins.os.unix.log.journal module dissect.target.plugins.os.unix.log.lastlog module dissect.target.plugins.os.unix.log.messages module dissect.target.plugins.os.unix.log.utmp module dissect.target.plugins.os.unix.packagemanager module dissect.target.plugins.os.unix.shadow module dissect.target.plugins.os.unix.trash module dissect.target.plugins.os.windows module dissect.target.plugins.os.windows._os module dissect.target.plugins.os.windows.activitiescache module dissect.target.plugins.os.windows.ad module dissect.target.plugins.os.windows.ad.ntds module dissect.target.plugins.os.windows.adpolicy module dissect.target.plugins.os.windows.amcache module dissect.target.plugins.os.windows.cam module dissect.target.plugins.os.windows.catroot module dissect.target.plugins.os.windows.certlog module dissect.target.plugins.os.windows.cim module dissect.target.plugins.os.windows.clfs module dissect.target.plugins.os.windows.credential module dissect.target.plugins.os.windows.credential.credential module dissect.target.plugins.os.windows.credential.credhist module dissect.target.plugins.os.windows.credential.defaultpassword module dissect.target.plugins.os.windows.credential.winlogon module dissect.target.plugins.os.windows.datetime module dissect.target.plugins.os.windows.defender module dissect.target.plugins.os.windows.defender.mplog module dissect.target.plugins.os.windows.defender.quarantine module dissect.target.plugins.os.windows.dpapi module dissect.target.plugins.os.windows.dpapi.blob module dissect.target.plugins.os.windows.dpapi.crypto module dissect.target.plugins.os.windows.dpapi.dpapi module dissect.target.plugins.os.windows.dpapi.keyprovider module dissect.target.plugins.os.windows.dpapi.keyprovider.credhist module dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword module dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.defaultpassword module dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.lsa module dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.winlogon module dissect.target.plugins.os.windows.dpapi.keyprovider.empty module dissect.target.plugins.os.windows.dpapi.keyprovider.keychain module dissect.target.plugins.os.windows.dpapi.keyprovider.keyprovider module dissect.target.plugins.os.windows.dpapi.master_key module dissect.target.plugins.os.windows.env module dissect.target.plugins.os.windows.everything module dissect.target.plugins.os.windows.everything.parser module dissect.target.plugins.os.windows.exchange module dissect.target.plugins.os.windows.exchange.exchange module dissect.target.plugins.os.windows.firewall module dissect.target.plugins.os.windows.generic module dissect.target.plugins.os.windows.jumplist module dissect.target.plugins.os.windows.lnk module dissect.target.plugins.os.windows.locale module dissect.target.plugins.os.windows.log module dissect.target.plugins.os.windows.log.agentexecutor module dissect.target.plugins.os.windows.log.amcache module dissect.target.plugins.os.windows.log.etl module dissect.target.plugins.os.windows.log.evt module dissect.target.plugins.os.windows.log.evtx module dissect.target.plugins.os.windows.log.intunemanagementextension module dissect.target.plugins.os.windows.log.mssql module dissect.target.plugins.os.windows.log.pfro module dissect.target.plugins.os.windows.log.schedlgu module dissect.target.plugins.os.windows.lsa module dissect.target.plugins.os.windows.network module dissect.target.plugins.os.windows.notifications module dissect.target.plugins.os.windows.prefetch module dissect.target.plugins.os.windows.productkey module dissect.target.plugins.os.windows.rdpcache module dissect.target.plugins.os.windows.recyclebin module dissect.target.plugins.os.windows.regf module dissect.target.plugins.os.windows.regf.applications module dissect.target.plugins.os.windows.regf.appxdebugkeys module dissect.target.plugins.os.windows.regf.auditpol module dissect.target.plugins.os.windows.regf.bam module dissect.target.plugins.os.windows.regf.cit module dissect.target.plugins.os.windows.regf.clsid module dissect.target.plugins.os.windows.regf.mru module dissect.target.plugins.os.windows.regf.muicache module dissect.target.plugins.os.windows.regf.nethist module dissect.target.plugins.os.windows.regf.recentfilecache module dissect.target.plugins.os.windows.regf.regf module dissect.target.plugins.os.windows.regf.runkeys module dissect.target.plugins.os.windows.regf.shellbags module dissect.target.plugins.os.windows.regf.shimcache module dissect.target.plugins.os.windows.regf.trusteddocs module dissect.target.plugins.os.windows.regf.usb module dissect.target.plugins.os.windows.regf.userassist module dissect.target.plugins.os.windows.registry module dissect.target.plugins.os.windows.sam module dissect.target.plugins.os.windows.search module dissect.target.plugins.os.windows.services module dissect.target.plugins.os.windows.sru module dissect.target.plugins.os.windows.startupinfo module dissect.target.plugins.os.windows.syscache module dissect.target.plugins.os.windows.tasks module dissect.target.plugins.os.windows.tasks.job module dissect.target.plugins.os.windows.tasks.records module dissect.target.plugins.os.windows.tasks.xml module dissect.target.plugins.os.windows.thumbcache module dissect.target.plugins.os.windows.ual module dissect.target.plugins.os.windows.wer module dissect.target.plugins.os.windows.wua_history module dissect.target.plugins.scrape module dissect.target.plugins.scrape.qfind module dissect.target.plugins.scrape.scrape module dissect.target.target module dissect.target.tools module dissect.target.tools.build_magic module dissect.target.tools.build_pluginlist module dissect.target.tools.dd module dissect.target.tools.diff module dissect.target.tools.dump module dissect.target.tools.fs module dissect.target.tools.info module dissect.target.tools.inspect module dissect.target.tools.mount module dissect.target.tools.qfind module dissect.target.tools.query module dissect.target.tools.reg module dissect.target.tools.shell module dissect.target.tools.utils module dissect.target.tools.utils.cli module dissect.target.tools.utils.fs module dissect.target.tools.utils.logging module dissect.target.tools.utils.report module dissect.target.tools.yara module dissect.target.volume module dissect.target.volumes module dissect.target.volumes.bde module dissect.target.volumes.ddf module dissect.target.volumes.disk module dissect.target.volumes.luks module dissect.target.volumes.lvm module dissect.target.volumes.md module dissect.target.volumes.vmfs module dissect.thumbcache module dissect.thumbcache.c_thumbcache module dissect.thumbcache.exceptions module dissect.thumbcache.index module dissect.thumbcache.thumbcache module dissect.thumbcache.thumbcache_file module dissect.thumbcache.tools module dissect.thumbcache.tools.extract_images module dissect.thumbcache.tools.extract_with_index module dissect.thumbcache.tools.utils module dissect.thumbcache.util module dissect.util module dissect.util.compression module dissect.util.compression.lz4 module dissect.util.compression.lzbitmap module dissect.util.compression.lzfse module dissect.util.compression.lznt1 module dissect.util.compression.lzo module dissect.util.compression.lzvn module dissect.util.compression.lzxpress module dissect.util.compression.lzxpress_huffman module dissect.util.compression.sevenbit module dissect.util.compression.snappy module dissect.util.compression.xz module dissect.util.cpio module dissect.util.encoding module dissect.util.encoding.surrogateescape module dissect.util.exceptions module dissect.util.hash module dissect.util.hash.crc32 module dissect.util.hash.crc32c module dissect.util.hash.jenkins module dissect.util.ldap module dissect.util.plist module dissect.util.sid module dissect.util.stream module dissect.util.tools module dissect.util.tools.dump_nskeyedarchiver module dissect.util.ts module dissect.util.xmemoryview module dissect.vmfs module dissect.vmfs.address module dissect.vmfs.c_lvm module dissect.vmfs.c_vmfs module dissect.vmfs.descriptor module dissect.vmfs.exception module dissect.vmfs.lvm module dissect.vmfs.resource module dissect.vmfs.util module dissect.vmfs.vmfs module dissect.volume module dissect.volume.ddf module dissect.volume.ddf.c_ddf module dissect.volume.ddf.ddf module dissect.volume.disk module dissect.volume.disk.disk module dissect.volume.disk.partition module dissect.volume.disk.schemes module dissect.volume.disk.schemes.apm module dissect.volume.disk.schemes.bsd module dissect.volume.disk.schemes.gpt module dissect.volume.disk.schemes.mbr module dissect.volume.dm module dissect.volume.dm.btree module dissect.volume.dm.c_dm module dissect.volume.dm.thin module dissect.volume.exceptions module dissect.volume.ldm module dissect.volume.lvm module dissect.volume.lvm.c_lvm2 module dissect.volume.lvm.lvm2 module dissect.volume.lvm.metadata module dissect.volume.lvm.physical module dissect.volume.md module dissect.volume.md.c_md module dissect.volume.md.md module dissect.volume.raid module dissect.volume.raid.raid module dissect.volume.raid.stream module dissect.volume.vinum module dissect.volume.vinum.c_vinum module dissect.volume.vinum.config module dissect.volume.vinum.vinum module dissect.volume.vss module dissect.xfs module dissect.xfs.c_xfs module dissect.xfs.exceptions module dissect.xfs.xfs module DissectMount (class in dissect.target.helpers.mount) DissectVolumeSystem (class in dissect.target.volumes.disk) distinguished_name (dissect.database.ese.ntds.objects.object.Object property) DLSW (dissect.target.plugins.os.windows.network.IfTypes attribute) dlt_name (dissect.target.plugins.os.windows.datetime.WindowsTimezone attribute) dm_def (in module dissect.volume.dm.c_dm) DMD (class in dissect.database.ese.ntds.objects.dmd) dmd() (dissect.database.ese.ntds.database.DataTable method) DMError DN (class in dissect.database.ese.ntds.util) dn (dissect.database.ese.ntds.objects.object.Object attribute) dnd_dirs (dissect.target.plugins.apps.virtualization.vmware_workstation.VmwareWorkstationPlugin attribute) DND_PATHS (in module dissect.target.plugins.apps.virtualization.vmware_workstation) DNS (class in acquire.acquire.acquire) dns (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager property) dns() (dissect.target.plugins.os.default.network.NetworkPlugin method) (dissect.target.plugins.os.unix.linux._os.LinuxPlugin method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSPlugin method) dns_ip_patttern (dissect.target.plugins.os.unix.linux.network.SystemdNetworkConfigParser attribute) DnsNode (class in dissect.database.ese.ntds.objects.dnsnode) DnsZone (class in dissect.database.ese.ntds.objects.dnszone) dnt (dissect.database.ese.ntds.objects.object.Object property) (dissect.database.ese.ntds.schema.AttributeEntry attribute) (dissect.database.ese.ntds.schema.ClassEntry attribute) do_alias() (dissect.target.tools.shell.ExtendedCmd method) do_cd() (dissect.target.tools.diff.DifferentialCli method) (dissect.target.tools.shell.RegistryCli method) (dissect.target.tools.shell.TargetCli method) do_clear() (dissect.target.tools.shell.ExtendedCmd method) do_cls() (dissect.target.tools.shell.ExtendedCmd method) do_cyber() (dissect.target.tools.shell.ExtendedCmd method) do_debug() (dissect.target.tools.shell.ExtendedCmd method) do_disks() (dissect.target.tools.shell.TargetCli method) do_enter() (dissect.target.tools.shell.TargetHubCli method) do_exit() (dissect.target.tools.shell.ExtendedCmd method) (dissect.target.tools.shell.TargetHubCli method) do_filesystems() (dissect.target.tools.shell.TargetCli method) do_info() (dissect.target.tools.shell.TargetCli method) do_list() (dissect.target.tools.diff.DifferentialCli method) (dissect.target.tools.shell.TargetHubCli method) do_man() (dissect.target.tools.shell.ExtendedCmd method) do_mounts() (dissect.target.tools.shell.TargetCli method) do_plugin() (dissect.target.tools.diff.DifferentialCli method) do_pwd() (dissect.target.tools.shell.RegistryCli method) (dissect.target.tools.shell.TargetCli method) do_python() (dissect.target.tools.diff.DifferentialCli method) (dissect.target.tools.shell.TargetCmd method) (dissect.target.tools.shell.TargetHubCli method) do_recommend() (dissect.target.tools.shell.RegistryCli method) do_reload() (dissect.target.tools.shell.TargetCli method) do_unalias() (dissect.target.tools.shell.ExtendedCmd method) do_up() (dissect.target.tools.shell.RegistryCli method) do_volumes() (dissect.target.tools.shell.TargetCli method) doc_header (dissect.target.tools.diff.DifferentialCli attribute) (dissect.target.tools.shell.TargetHubCli attribute) doc_header_multiple_targets (dissect.target.tools.diff.DifferentialCli attribute) doc_header_prefix (dissect.target.tools.diff.DifferentialCli attribute) doc_header_suffix (dissect.target.tools.diff.DifferentialCli attribute) Docker (class in acquire.acquire.acquire) DOCKER_ARCHIVE_IMAGE (in module dissect.target.loaders.containerimage) DockerChildTargetPlugin (class in dissect.target.plugins.child.docker) DockerContainerRecord (in module dissect.target.plugins.apps.container.docker) DockerImageRecord (in module dissect.target.plugins.apps.container.docker) DockerLogRecord (in module dissect.target.plugins.apps.container.docker) DockerPlugin (class in dissect.target.plugins.apps.container.docker) DOCSCABLE_DOWNSTREAM (dissect.target.plugins.os.windows.network.IfTypes attribute) DOCSCABLE_MACLAYER (dissect.target.plugins.os.windows.network.IfTypes attribute) DOCSCABLE_UPSTREAM (dissect.target.plugins.os.windows.network.IfTypes attribute) document_stream() (flow.record.adapter.elastic.ElasticWriter method) documentation (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) Domain (class in dissect.database.ese.ntds.objects.domain) domain (dissect.target.loaders.itunes.FileInfo attribute) domain() (dissect.target.plugins.os.unix._os.UnixPlugin method) (dissect.target.plugins.os.unix.bsd.openbsd._os.OpenBsdPlugin method) (dissect.target.plugins.os.unix.esxi._os.ESXiPlugin method) (dissect.target.plugins.os.windows.generic.GenericPlugin method) domain_sid() (dissect.target.plugins.os.windows.generic.GenericPlugin method) DOMAIN_TRANSLATION (in module dissect.target.loaders.itunes) DomainDNS (class in dissect.database.ese.ntds.objects.domaindns) DomainPolicy (class in dissect.database.ese.ntds.objects.domainpolicy) domains_seen() (dissect.target.plugins.os.windows.ual.UalPlugin method) DomainSeenRecord (in module dissect.target.plugins.os.windows.ual) DONT_EXPIRE_PASSWORD (dissect.database.ese.ntds.util.UserAccountControl attribute) DONT_REQUIRE_PREAUTH (dissect.database.ese.ntds.util.UserAccountControl attribute) DOS_EPOCH_YEAR (in module dissect.util.ts) dos_stub (dissect.executable.pe.pe.PE attribute) dostimestamp() (in module dissect.util.ts) DOUBLE (dissect.eventlog.bxml.BxmlType attribute) DOWN (dissect.volume.vinum.config.PlexState attribute) (dissect.volume.vinum.config.SDState attribute) (dissect.volume.vinum.config.VolumeState attribute) Downgrade (dissect.target.plugins.os.unix.packagemanager.OperationTypes attribute) DOWNLOAD_STATES (in module dissect.target.plugins.apps.browser.chromium) downloads() (dissect.target.plugins.apps.browser.brave.BravePlugin method) (dissect.target.plugins.apps.browser.chrome.ChromePlugin method) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin method) (dissect.target.plugins.apps.browser.chromium.ChromiumPlugin method) (dissect.target.plugins.apps.browser.edge.EdgePlugin method) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin method) (dissect.target.plugins.apps.browser.iexplore.InternetExplorerPlugin method) (dissect.target.plugins.apps.browser.iexplore.WebCache method) dp() (dissect.target.plugins.os.windows.regf.cit.CITPlugin method) DPAPI (class in acquire.acquire.acquire) dpapi_hmac() (in module dissect.target.plugins.os.windows.dpapi.crypto) DPAPIPlugin (class in dissect.target.plugins.os.windows.dpapi.dpapi) DpcGuid (in module dissect.etl.utils) DpkgPackageLogRecord (in module dissect.target.plugins.os.unix.linux.debian.dpkg) DpkgPackageStatusRecord (in module dissect.target.plugins.os.unix.linux.debian.dpkg) DpkgPlugin (class in dissect.target.plugins.os.unix.linux.debian.dpkg) drive (dissect.volume.vinum.config.SD attribute) DRIVE_CONTROLLER_GUIDS (in module dissect.target.loaders.hyperv) drive_letter (dissect.target.volume.Volume attribute) DRIVE_LETTER_RE (in module dissect.target.plugins.filesystem.ntfs.utils) DRIVE_LOWER_SUBST (in module acquire.acquire.utils) driveoffset (dissect.volume.vinum.config.SD attribute) DRIVER (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) DRIVER_BLOCKED (dissect.target.plugins.os.windows.amcache.PcaGeneralDbType attribute) Drivers (class in acquire.acquire.acquire) drivers() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) drop_dirty_sinks() (dissect.target.tools.dump.DumpState method) drop_invalid_sinks() (dissect.target.tools.dump.DumpState method) drops (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) DS0 (dissect.target.plugins.os.windows.network.IfTypes attribute) DS0_BUNDLE (dissect.target.plugins.os.windows.network.IfTypes attribute) DS1 (dissect.target.plugins.os.windows.network.IfTypes attribute) DS1_FDL (dissect.target.plugins.os.windows.network.IfTypes attribute) DS3 (dissect.target.plugins.os.windows.network.IfTypes attribute) ds_def (in module dissect.database.ese.ntds.c_ds) dsa() (dissect.database.ese.ntds.database.DataTable method) DSR (dissect.target.helpers.network.IANAProtocol attribute) dst() (dissect.target.plugins.os.windows.datetime.WindowsTimezone method) dst_index (dissect.target.tools.diff.DifferentialCli attribute) dst_target (dissect.target.tools.diff.DifferentialCli property) (dissect.target.tools.diff.TargetComparison attribute) dst_target_entry (dissect.target.tools.diff.DifferentialEntry attribute) DSUISettings (class in dissect.database.ese.ntds.objects.dsuisettings) dt (dissect.apfs.objects.fs.DirectoryEntry property) DT_CENTER (in module acquire.acquire.gui.win32) DT_DIR (in module dissect.target.plugins.os.unix.linux.debian.proxmox._os) DT_MAP (in module dissect.jffs.c_jffs2) DT_REG (in module dissect.target.plugins.os.unix.linux.debian.proxmox._os) DT_SINGLELINE (in module acquire.acquire.gui.win32) DT_VCENTER (in module acquire.acquire.gui.win32) dtime (dissect.extfs.extfs.INode property) DTM (dissect.target.plugins.os.windows.network.IfTypes attribute) DTYPE_NAMES (in module dissect.volume.disk.schemes.bsd) DuckdbReader (class in flow.record.adapter.duckdb) DuckdbWriter (class in flow.record.adapter.duckdb) DUMMY (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) (dissect.target.plugins.os.unix.linux.proc.Sockets.UDPStates attribute) Dump (class in dissect.target.loaders.cellebrite) dump() (dissect.executable.elf.elf.ELF method) dump_data() (dissect.executable.elf.elf.SectionTable method) (dissect.executable.elf.elf.SegmentTable method) dump_entry_data() (in module dissect.thumbcache.tools.extract_images) dump_entry_data_through_index() (in module dissect.thumbcache.tools.extract_with_index) dump_table() (dissect.executable.elf.elf.SectionTable method) (dissect.executable.elf.elf.SegmentTable method) dumps (dissect.cstruct.types.base.BaseType attribute) (dissect.target.loaders.cellebrite.Ufd attribute) dumps() (dissect.cstruct.types.base.MetaType method) DumpState (class in dissect.target.tools.dump) dumpstruct() (in module dissect.cstruct.utils) DUPLICATE_CLOSE_SOURCE (acquire.acquire.dynamic.windows.types.DuplicateHandleFlags attribute) duplicate_handle() (in module acquire.acquire.dynamic.windows.handles) DUPLICATE_SAME_ACCESS (acquire.acquire.dynamic.windows.types.DuplicateHandleFlags attribute) DUPLICATE_SAME_ATTRIBUTES (acquire.acquire.dynamic.windows.types.DuplicateHandleFlags attribute) DuplicateFilter (class in acquire.acquire.dynamic.windows.handles) DuplicateHandle (in module acquire.acquire.dynamic.windows.handles) DuplicateHandleFlags (class in acquire.acquire.dynamic.windows.types) DVB_ASI_IN (dissect.target.plugins.os.windows.network.IfTypes attribute) DVB_ASI_OUT (dissect.target.plugins.os.windows.network.IfTypes attribute) DVBRCC_DOWNSTREAM (dissect.target.plugins.os.windows.network.IfTypes attribute) DVBRCC_MACLAYER (dissect.target.plugins.os.windows.network.IfTypes attribute) DVBRCC_UPSTREAM (dissect.target.plugins.os.windows.network.IfTypes attribute) DWORD (dissect.target.helpers.regutil.RegistryValueType attribute) DWORD_BIG_ENDIAN (dissect.target.helpers.regutil.RegistryValueType attribute) dynamic (class in flow.record.fieldtypes) (dissect.cstruct.types.base.MetaType attribute) (dissect.executable.elf.elf.ELF property) dynamic_dst (dissect.target.plugins.os.windows.datetime.WindowsTimezone attribute) dynamic_fieldtype (in module flow.record.base) DynamicDescriptor() (in module dissect.target.helpers.record) (in module flow.record.base) DynamicDisk (class in dissect.hypervisor.disk.vhd) DynamicFieldtypeModule (class in flow.record.base) DynpropQualifier (class in dissect.cim.classes) Dynprops (class in dissect.cim.classes) dynprops (dissect.cim.classes.ClassInstance attribute) (dissect.cim.classes.Dynprops attribute) dynprops_state (dissect.cim.classes.Dynprops attribute) DYNPROPS_STATES (in module dissect.cim.c_cim) E E1 (dissect.target.plugins.os.windows.network.IfTypes attribute) e_ident (dissect.executable.elf.elf.ELF attribute) EASTASIA_SPECIAL (dissect.database.ese.lcmapstring.SCRIPT attribute) EBOIV (class in dissect.fve.crypto.base) EdgePlugin (class in dissect.target.plugins.apps.browser.edge) EditorPlugin (class in dissect.target.plugins.apps.editor.editor) EDR (class in acquire.acquire.acquire) EfiJumpstart (class in dissect.apfs.objects.efi_jumpstart) EFU (dissect.target.plugins.os.windows.everything.parser.EverythingFSType attribute) EGP (dissect.target.helpers.network.IANAProtocol attribute) EIGRP (dissect.target.helpers.network.IANAProtocol attribute) ElasticReader (class in flow.record.adapter.elastic) ElasticWriter (class in flow.record.adapter.elastic) element (dissect.eventlog.bxml.Template attribute) (dissect.hypervisor.descriptor.vbox.HardDisk attribute) (dissect.hypervisor.descriptor.vbox.Hardware attribute) (dissect.hypervisor.descriptor.vbox.Machine attribute) (dissect.hypervisor.descriptor.vbox.Snapshot attribute) ElementType (in module dissect.target.helpers.sunrpc.serializer) Elephant (class in dissect.fve.crypto.base) elevation_def (in module dissect.target.plugins.apps.browser.chromium) ELF (class in dissect.executable.elf.elf) elf_32_def (in module dissect.executable.elf.c_elf) elf_64_def (in module dissect.executable.elf.c_elf) elf_chunk_stream (dissect.eventlog.bxml.Bxml attribute) (dissect.eventlog.bxml.BxmlNameReader attribute) elf_def (in module dissect.executable.elf.c_elf) Elf_Type (in module dissect.executable.elf.c_elf) ElfChnk (class in dissect.eventlog.evtx) EM_SETPASSWORDCHAR (in module acquire.acquire.gui.win32) EMCON (dissect.target.helpers.network.IANAProtocol attribute) EMERG (dissect.target.plugins.os.unix.log.journal.JournalMessagePriority attribute) emit() (acquire.acquire.log.DelayedFileHandler method) emit_last_message() (dissect.target.exceptions.FatalError method) EMPTY (acquire.acquire.collector.Outcome attribute) Empty (class in dissect.database.sqlite3.sqlite3) empty (dissect.eventlog.evtx.ElfChnk attribute) EMPTY_LM (dissect.target.loaders.smb.SmbLoader attribute) EMPTY_LOGICAL_COLOR_SPACE (in module dissect.target.plugins.os.windows.rdpcache) EMPTY_NT (dissect.target.loaders.smb.SmbLoader attribute) EMPTY_PIXEL (in module dissect.target.plugins.os.windows.rdpcache) EmptyDirectoryError EmptyKeyProviderPlugin (class in dissect.target.plugins.os.windows.dpapi.keyprovider.empty) emptyline() (dissect.target.tools.shell.ExtendedCmd method) (dissect.target.tools.shell.TargetHubCli method) EmptyRecord (in module dissect.target.helpers.record) enabled (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) ENCAP (dissect.target.helpers.network.IANAProtocol attribute) encode_key() (in module dissect.database.ese.index) encode_value() (in module dissect.database.ese.ntds.util) encode_varint() (in module dissect.target.helpers.protobuf) encoding (dissect.database.ese.table.Column property) (dissect.database.sqlite3.sqlite3.SQLite3 attribute) (dissect.fat.fat.FATFS attribute) ENCODING (in module dissect.database.sqlite3.sqlite3) ENCRYPT (in module dissect.fve.crypto.base) encrypt() (dissect.fve.crypto.base.Cipher method) (dissect.fve.crypto.Cipher method) encrypted (dissect.database.ese.ntds.pek.PEK attribute) (dissect.fve.bde.bde.BDE property) (dissect.hypervisor.descriptor.vmx.VMX property) (dissect.target.loaders.ab.AndroidBackup attribute) (dissect.target.loaders.itunes.ITunesBackup attribute) ENCRYPTED_TEXT_PASSWORD_ALLOWED (dissect.database.ese.ntds.util.UserAccountControl attribute) ENCRYPTED_VOLUME_MANAGERS (in module dissect.target.volume) EncryptedFile (class in acquire.acquire.tools.decrypter) EncryptedFileStream (class in dissect.target.filesystems.itunes) EncryptedStream (class in acquire.acquire.crypt) EncryptedVolumeSystem (class in dissect.target.volume) encryption (dissect.btrfs.stream.Extent attribute) (dissect.fve.luks.metadata.KeyslotArea attribute) (dissect.fve.luks.metadata.Segment attribute) (dissect.target.loaders.ab.AndroidBackup attribute) encryption_key (dissect.target.loaders.itunes.FileInfo property) EncryptionRollingRecoveryBlock (class in dissect.apfs.objects.er_recovery_block) EncryptionRollingState (class in dissect.apfs.objects.er_state) end (dissect.etl.etl.ETL attribute) (dissect.executable.elf.elf.Segment property) (dissect.hypervisor.disk.hdd.Storage attribute) END_OF_CLUSTER_MAX (in module dissect.fat.c_fat) END_OF_CLUSTER_MIN (in module dissect.fat.c_fat) end_offset (dissect.eventlog.evt.Evt attribute) end_pos (dissect.target.tools.dump.RecordStreamElement attribute) end_time (dissect.etl.headers.logfile.LogfileHeader property) ended (dissect.ole.ole.Chain attribute) endian (dissect.cstruct.bitbuffer.BitBuffer attribute) (dissect.cstruct.cstruct.cstruct attribute) ENDIANNESS_MAP (in module dissect.cstruct.utils) endpoint (acquire.acquire.uploaders.minio.MinIO attribute) energy_estimator() (dissect.target.plugins.os.windows.sru.SRUPlugin method) energy_usage() (dissect.target.plugins.os.windows.sru.SRUPlugin method) energy_usage_lt() (dissect.target.plugins.os.windows.sru.SRUPlugin method) EnergyEstimatorRecord (in module dissect.target.plugins.os.windows.sru) EnergyUsageLTRecord (in module dissect.target.plugins.os.windows.sru) EnergyUsageRecord (in module dissect.target.plugins.os.windows.sru) enrich_elastic_exception() (in module flow.record.adapter.elastic) ensure_volume() (in module dissect.ntfs.util) entries (dissect.apfs.objects.keybag.Keybag attribute) (dissect.cim.classes.PropertyStates attribute) (dissect.cim.objects.TOC attribute) (dissect.evidence.ewf.ewf.TableSection attribute) (dissect.executable.pe.directory.basereloc.BaseRelocationDirectory property) (dissect.executable.pe.directory.debug.DebugDirectory property) (dissect.executable.pe.directory.debug.PogoDebugEntry property) (dissect.executable.pe.directory.exception.ExceptionDirectory property) (dissect.executable.pe.directory.iat.IatDirectory property) (dissect.executable.pe.directory.security.SecurityDirectory property) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageObjectTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageReplayLog attribute) (dissect.hypervisor.disk.asif.Directory property) (dissect.hypervisor.disk.asif.Table property) (dissect.hypervisor.disk.vhdx.MetadataTable attribute) (dissect.hypervisor.disk.vhdx.ParentLocator attribute) (dissect.hypervisor.disk.vhdx.RegionTable attribute) (dissect.ntfs.attr.AttributeList attribute) (dissect.target.filesystem.LayerFilesystemEntry attribute) (dissect.target.filesystem.VirtualDirectory attribute) (dissect.target.helpers.nfs.client.nfs.ReadDirResult attribute) (dissect.target.helpers.nfs.nfs3.ReadDirPlusResult attribute) (dissect.target.plugins.os.windows.credential.credhist.CredHistFile attribute) (dissect.target.plugins.os.windows.regf.cit.CIT attribute) (dissect.target.target.Collection attribute) (dissect.volume.vss.Catalog attribute) (dissect.volume.vss.RangeList attribute) entries() (dissect.database.bsd.db.Page method) (dissect.database.bsd.tools.rpm.HeaderBlob method) (dissect.database.bsd.tools.rpm.Package method) (dissect.database.bsd.tools.rpm.Packages method) (dissect.database.ese.tools.certlog.CertLog method) (dissect.database.ese.tools.sru.SRU method) (dissect.ntfs.index.Index method) (dissect.ntfs.index.IndexBuffer method) (dissect.ntfs.index.IndexRoot method) (dissect.thumbcache.index.ThumbnailIndex method) (dissect.thumbcache.thumbcache.Thumbcache method) (dissect.thumbcache.thumbcache_file.ThumbcacheFile method) Entry (class in dissect.database.ese.tools.sru) (class in dissect.target.plugins.os.windows.regf.cit) entry (dissect.archive.vbk.MetaItem attribute) (dissect.archive.wim.DirectoryEntry attribute) (dissect.cim.mappings.MappingEntry attribute) (dissect.evidence.ad1.ad1.FileEntry property) (dissect.evidence.ad1.ad1.FileMeta attribute) (dissect.evidence.ad1.ad1.VirtualEntry attribute) (dissect.evidence.ad1.stream.FileStream attribute) (dissect.executable.pe.directory.debug.DebugEntry attribute) (dissect.executable.pe.directory.resource.Resource attribute) (dissect.executable.pe.directory.resource.ResourceDataEntry property) (dissect.executable.pe.directory.resource.ResourceDirectoryEntry property) (dissect.executable.pe.directory.resource.ResourceEntry property) (dissect.extfs.extfs.XAttr attribute) ENTRY (dissect.hypervisor.disk.vhd.BlockAllocationTable attribute) entry (dissect.jffs.jffs2.DirEntry attribute) (dissect.ole.ole.DirectoryEntry attribute) (dissect.target.filesystem.DirEntry attribute) (dissect.target.filesystem.FilesystemEntry attribute) (dissect.target.filesystem.LayerDirEntry attribute) (dissect.target.filesystem.MappedCompressedFile attribute) (dissect.target.filesystem.MappedFile attribute) (dissect.target.filesystem.VirtualDirEntry attribute) (dissect.target.filesystems.ad1.AD1DirEntry attribute) (dissect.target.filesystems.ad1.AD1FilesystemEntry attribute) (dissect.target.filesystems.apfs.ApfsDirEntry attribute) (dissect.target.filesystems.apfs.ApfsFilesystemEntry attribute) (dissect.target.filesystems.btrfs.BtrfsDirEntry attribute) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry attribute) (dissect.target.filesystems.cb.CbDirEntry attribute) (dissect.target.filesystems.cramfs.CramfsDirEntry attribute) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry attribute) (dissect.target.filesystems.dir.DirectoryDirEntry attribute) (dissect.target.filesystems.dir.DirectoryFilesystemEntry attribute) (dissect.target.filesystems.exfat.ExfatDirEntry attribute) (dissect.target.filesystems.extfs.ExtDirEntry attribute) (dissect.target.filesystems.extfs.ExtFilesystemEntry attribute) (dissect.target.filesystems.fat.FatDirEntry attribute) (dissect.target.filesystems.fat.FatFilesystemEntry attribute) (dissect.target.filesystems.ffs.FfsDirEntry attribute) (dissect.target.filesystems.ffs.FfsFilesystemEntry attribute) (dissect.target.filesystems.itunes.ITunesFilesystemDirectoryEntry attribute) (dissect.target.filesystems.itunes.ITunesFilesystemEntry attribute) (dissect.target.filesystems.jffs.JffsDirEntry attribute) (dissect.target.filesystems.jffs.JffsFilesystemEntry attribute) (dissect.target.filesystems.nfs.NfsDirEntry attribute) (dissect.target.filesystems.nfs.NfsFilesystemEntry attribute) (dissect.target.filesystems.ntds.NtdsDirEntry attribute) (dissect.target.filesystems.ntds.NtdsFilesystemEntry attribute) (dissect.target.filesystems.ntfs.NtfsDirEntry attribute) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry attribute) (dissect.target.filesystems.qnxfs.QnxDirEntry attribute) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry attribute) (dissect.target.filesystems.smb.SmbDirEntry attribute) (dissect.target.filesystems.smb.SmbFilesystemEntry attribute) (dissect.target.filesystems.squashfs.SquashFSDirEntry attribute) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry attribute) (dissect.target.filesystems.tar.TarFilesystemDirectoryEntry attribute) (dissect.target.filesystems.vbk.VbkDirEntry attribute) (dissect.target.filesystems.vbk.VbkFilesystemEntry attribute) (dissect.target.filesystems.vmfs.VmfsDirEntry attribute) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry attribute) (dissect.target.filesystems.xfs.XfsDirEntry attribute) (dissect.target.filesystems.xfs.XfsFilesystemEntry attribute) (dissect.target.filesystems.zip.ZipFilesystemEntry attribute) (dissect.target.loaders.res.ResFile attribute) (dissect.target.plugins.os.unix.linux.debian.proxmox._os.ProxmoxConfigDirectoryEntry attribute) (dissect.target.plugins.os.windows.regf.cit.BaseUseData attribute) (dissect.target.plugins.os.windows.regf.cit.Entry attribute) entry() (dissect.database.bsd.db.Page method) (dissect.database.bsd.tools.rpm.HeaderBlob method) (dissect.evidence.ad1.ad1.AD1 method) (dissect.hypervisor.disk.qcow2.L2Table method) entry_count (dissect.fat.fat.FAT attribute) entry_size (dissect.executable.elf.elf.Section attribute) (dissect.hypervisor.disk.qcow2.QCow2Snapshot attribute) EntryList (class in dissect.target.filesystem) EntryPlus (class in dissect.target.helpers.nfs.nfs3) EntryPlusSerializer (class in dissect.target.helpers.nfs.serializer) EntryType (in module dissect.evidence.ad1.ad1) Enum (class in dissect.cstruct.types.enum) EnumMetaType (class in dissect.cstruct.types.enum) EnumType (in module dissect.target.helpers.sunrpc.serializer) Env (class in dissect.target.helpers.configutil) env (dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin property) env_vars (dissect.target.plugins.apps.webserver.apache.ApachePlugin property) Envelope (class in dissect.hypervisor.util.envelope) ENVELOPE_ATTRIBUTE_TYPE_MAP (in module dissect.hypervisor.util.envelope) ENVELOPE_BLOCK_SIZE (in module dissect.hypervisor.util.envelope) EnvelopeAttribute (class in dissect.hypervisor.util.envelope) envfile() (dissect.target.plugins.apps.other.env.EnvironmentFilePlugin method) Environ (class in dissect.target.plugins.os.unix.linux.proc) environ() (dissect.target.plugins.os.unix.linux.environ.EnvironPlugin method) (dissect.target.plugins.os.unix.linux.proc.ProcProcess method) ENVIRONMENT_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) environment_variable_paths() (in module dissect.target.plugin) environment_variables() (dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin method) EnvironmentFilePlugin (class in dissect.target.plugins.apps.other.env) EnvironmentFileRecord (in module dissect.target.plugins.apps.other.env) EnvironmentRecord (in module dissect.target.plugins.os.windows.env) EnvironmentVariablePlugin (class in dissect.target.plugins.os.windows.env) EnvironmentVariableRecord (in module dissect.target.plugins.os.unix.cronjobs) (in module dissect.target.plugins.os.unix.linux.environ) EnvironPlugin (class in dissect.target.plugins.os.unix.linux.environ) EnvVarDetails (class in dissect.target.plugins.os.windows.env) EOC (in module dissect.fat.c_exfat) eof (dissect.target.helpers.nfs.nfs3.ReadDirPlusResult attribute) (dissect.target.helpers.nfs.nfs3.ReadResult attribute) EOF (in module dissect.cstruct.types.base) eol() (dissect.cstruct.expression.ExpressionTokenizer method) (dissect.cstruct.parser.TokenConsumer method) EON (dissect.target.plugins.os.windows.network.IfTypes attribute) EOW_BM_SIGNATURE (in module dissect.fve.bde.c_bde) EOW_BR_SIGNATURE (in module dissect.fve.bde.c_bde) eow_information (dissect.fve.bde.bde.BDE attribute) EOW_INFORMATION_OFFSET_GUID (in module dissect.fve.bde.c_bde) eow_offsets (dissect.fve.bde.bde.BootSector attribute) EOW_SIGNATURE (in module dissect.fve.bde.c_bde) EowBitmap (class in dissect.fve.bde.eow) EowBitmapRecord (class in dissect.fve.bde.eow) EowInformation (class in dissect.fve.bde.eow) ephemeral_objects (dissect.apfs.objects.nx_superblock.NxSuperblock property) EPLRS (dissect.target.plugins.os.windows.network.IfTypes attribute) EPOCH (in module flow.record.adapter.avro) epoch_days_to_datetime() (in module dissect.target.plugins.os.unix.shadow) EQ (dissect.util.ldap.ComparisonOperator attribute) Equal (dissect.ntfs.index.Match attribute) equal() (dissect.cstruct.expression.ExpressionTokenizer method) ERR (dissect.target.plugins.os.unix.log.journal.JournalMessagePriority attribute) ERR_ACCES (dissect.target.helpers.nfs.nfs3.MountStat attribute) (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_BADHANDLE (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_DQUOT (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_EXIST (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_FBIG (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_INVAL (dissect.target.helpers.nfs.nfs3.MountStat attribute) (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_IO (dissect.target.helpers.nfs.nfs3.MountStat attribute) (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_ISDIR (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_MLINK (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_NAMETOOLONG (dissect.target.helpers.nfs.nfs3.MountStat attribute) (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_NODEV (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_NOENT (dissect.target.helpers.nfs.nfs3.MountStat attribute) (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_NOSPC (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_NOTDIR (dissect.target.helpers.nfs.nfs3.MountStat attribute) (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_NOTEMPTY (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_NOTSUPP (dissect.target.helpers.nfs.nfs3.MountStat attribute) ERR_NXIO (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_PERM (dissect.target.helpers.nfs.nfs3.MountStat attribute) (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_REMOTE (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_ROFS (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_SERVERFAULT (dissect.target.helpers.nfs.nfs3.MountStat attribute) ERR_STALE (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_XDEV (dissect.target.helpers.nfs.nfs3.NfsStat attribute) errno (dissect.target.exceptions.FileNotFoundError attribute) (dissect.target.exceptions.IsADirectoryError attribute) (dissect.target.exceptions.NotADirectoryError attribute) (dissect.target.exceptions.NotASymlinkError attribute) (dissect.target.exceptions.SymlinkRecursionError attribute) Error, [1], [2], [3], [4], [5], [6], [7], [8], [9], [10], [11], [12], [13], [14], [15], [16], [17], [18], [19], [20], [21], [22], [23], [24], [25], [26], [27], [28] error() (dissect.target.plugins.apps.webserver.apache.ApachePlugin method) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin method) ERROR_ACCESS_DENIED (acquire.acquire.dynamic.windows.types.ErrorCode attribute) error_handler() (in module dissect.util.encoding.surrogateescape) ERROR_INVALID_PARAMETER (acquire.acquire.dynamic.windows.types.ErrorCode attribute) ERROR_LOG_NAMES (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) (dissect.target.plugins.apps.webserver.citrix.CitrixWebserverPlugin attribute) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin attribute) ERROR_NOT_ALL_ASSIGNED (acquire.acquire.dynamic.windows.types.ErrorCode attribute) ERROR_PARTIAL_COPY (acquire.acquire.dynamic.windows.types.ErrorCode attribute) error_paths (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin attribute) ERROR_SUCCESS (acquire.acquire.dynamic.windows.types.ErrorCode attribute) ErrorCode (class in acquire.acquire.dynamic.windows.types) ErrorHeader (class in dissect.etl.headers.headers) errorlog() (dissect.target.plugins.os.windows.log.mssql.MssqlPlugin method) ErrorLogDatum (class in dissect.fve.bde.information) ErrorSegment (class in dissect.volume.lvm.metadata) es (flow.record.adapter.elastic.ElasticReader attribute) (flow.record.adapter.elastic.ElasticWriter attribute) ES_PASSWORD (in module acquire.acquire.gui.win32) ES_WANTRETURN (in module acquire.acquire.gui.win32) ESCAPE (in module flow.record.adapter.splunk) escape_field_name() (in module flow.record.adapter.splunk) escape_str() (in module dissect.target.tools.utils.cli) ESCON (dissect.target.plugins.os.windows.network.IfTypes attribute) ESE (class in dissect.database.ese.ese) ese (dissect.database.ese.ntds.database.Database attribute) ese_def (in module dissect.database.ese.c_ese) ESENT_DB (class in dissect.database.ese.tools.impacket) ESP (dissect.target.helpers.network.IANAProtocol attribute) ESSIV (class in dissect.fve.crypto.base) ESTABLISHED (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) (dissect.target.plugins.os.unix.linux.proc.Sockets.UDPStates attribute) EsxConfPlugin (class in dissect.target.plugins.os.unix.esxi.esxconf) ESXi (class in acquire.acquire.acquire) ESXI (dissect.target.plugin.OperatingSystem attribute) ESXI_DEV_DIR (in module dissect.target.loaders.local) esxi_memory_context_manager() (in module acquire.acquire.esxi) ESXiChildTargetPlugin (class in dissect.target.plugins.child.esxi) EsxiMemoryManager (class in acquire.acquire.esxi) ESXiPlugin (class in dissect.target.plugins.os.unix.esxi._os) ESXiProfile (class in acquire.acquire.acquire) Etc (class in acquire.acquire.acquire) etc() (dissect.target.plugins.os.unix.etc.etc.EtcTree method) EtcTree (class in dissect.target.plugins.os.unix.etc.etc) ETH_P_802_2 (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_802_3 (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_ALL (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_ARCNET (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_AX25 (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_CAN (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_CONTROL (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_DDCMP (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_DSA (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_ECONET (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_HDLC (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_IEEE802154 (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_IRDA (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_LOCALTALK (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_MOBITEX (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_PHONET (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_PPP_MP (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_PPPTALK (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_SNAP (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_TR_802_2 (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_TRAILER (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_WAN_PPP (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETHERIP (dissect.target.helpers.network.IANAProtocol attribute) ETHERNET (dissect.target.helpers.network.IANAProtocol attribute) ETHERNET_3MBIT (dissect.target.plugins.os.windows.network.IfTypes attribute) ETHERNET_CSMACD (dissect.target.plugins.os.windows.network.IfTypes attribute) ETL (class in acquire.acquire.acquire) (class in dissect.etl.etl) etl (dissect.etl.etl.Buffer attribute) etl() (dissect.target.plugins.os.windows.log.etl.EtlPlugin method) etl_def (in module dissect.etl.c_etl) EtlPlugin (class in dissect.target.plugins.os.windows.log.etl) EtlRecordBuilder (class in dissect.target.plugins.os.windows.log.etl) ETW_REGISTRATION (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) eval() (flow.record.selector.RecordContextMatcher method) evaluate() (dissect.cstruct.expression.Expression method) evaluate_exp() (dissect.cstruct.expression.Expression method) EVENT (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) Event (class in dissect.etl.etl) (class in dissect.target.target) event (dissect.etl.etl.EventRecord property) (flow.record.adapter.elastic.ElasticWriter attribute) EVENT_KEY (dissect.etl.headers.event.ExtType attribute) event_property (dissect.etl.headers.headers.MessageTraceHeader property) event_provider (dissect.eventlog.wevt.WEVT attribute) EVENT_SCHEMA_TL (dissect.etl.headers.event.ExtType attribute) event_values() (dissect.etl.etl.Event method) EventCategory (dissect.eventlog.evt.Record attribute) EventCode (dissect.eventlog.evt.Record attribute) EventCustomerFlag (dissect.eventlog.evt.Record attribute) EventDescriptor (class in dissect.etl.headers.event) EventFacility (dissect.eventlog.evt.Record attribute) EventFilter (class in dissect.target.plugins.os.windows.cim) EventHandler (class in flow.record.utils) EventHeader (class in dissect.etl.headers.event) EventHeaderExtendedDataItem (class in dissect.etl.headers.event) EventID (dissect.eventlog.evt.Record attribute) EventInstanceGUIDHeader (class in dissect.etl.headers.headers) EventInstanceHeader (class in dissect.etl.headers.headers) EVENTLOG_REGISTRY_KEY (dissect.target.plugins.os.windows.log.evt.WindowsEventlogsMixin attribute) EVENTLOGRECORD_SIZE (in module dissect.eventlog.evt) EventLogs (class in acquire.acquire.acquire) EventProperty (class in dissect.etl.headers.headers) EventRecord (class in dissect.etl.etl) EventSeverity (dissect.eventlog.evt.Record attribute) EventTraceConfigGuid (in module dissect.etl.utils) EventTraceGuid (in module dissect.etl.utils) EventTraceHeader (class in dissect.etl.headers.headers) EventTraceSpare1 (in module dissect.etl.utils) EventTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) EventType (dissect.eventlog.evt.Record attribute) EverythingDB (class in dissect.target.plugins.os.windows.everything.parser) EverythingFSType (class in dissect.target.plugins.os.windows.everything.parser) EverythingIndexObj (class in dissect.target.plugins.os.windows.everything.parser) EverythingVarInt (class in dissect.target.plugins.os.windows.everything.parser) evidence (dissect.target.loaders.cellebrite.Ufdx attribute) EVNT (class in dissect.eventlog.wevt_object) Evt (class in dissect.eventlog.evt) evt() (dissect.target.plugins.os.windows.log.evt.EvtPlugin method) evt_def (in module dissect.eventlog.evt) EVT_GLOB (in module dissect.target.plugins.os.windows.log.evt) EVTHANDLE (dissect.eventlog.bxml.BxmlType attribute) EvtPlugin (class in dissect.target.plugins.os.windows.log.evt) EvtRecordDescriptor (in module dissect.target.plugins.os.windows.log.evt) Evtx (class in dissect.eventlog.evtx) evtx() (dissect.target.plugins.os.windows.log.evtx.EvtxPlugin method) evtx_def (in module dissect.eventlog.evtx) EVTX_GLOB (in module dissect.target.plugins.os.windows.log.evtx) EVTXML (dissect.eventlog.bxml.BxmlType attribute) EvtxNameReader (class in dissect.eventlog.bxml) EvtxPlugin (class in dissect.target.plugins.os.windows.log.evtx) EWF (class in dissect.evidence.ewf.ewf) ewf (dissect.evidence.ewf.ewf.EWFStream attribute) (dissect.evidence.ewf.ewf.Segment attribute) ewf_def (in module dissect.evidence.ewf.c_ewf) EwfContainer (class in dissect.target.containers.ewf) EWFError ewfheader (dissect.evidence.ewf.ewf.Segment attribute) EWFStream (class in dissect.evidence.ewf.ewf) example() (dissect.target.plugins.general.example.ExamplePlugin method) example_internal() (dissect.target.plugins.general.example.ExamplePlugin method) example_none() (dissect.target.plugins.general.example.ExamplePlugin method) example_record() (dissect.target.plugins.general.example.ExampleNamespacePlugin method) (dissect.target.plugins.general.example.ExamplePlugin method) example_user_registry_record() (dissect.target.plugins.general.example.ExamplePlugin method) example_yield() (dissect.target.plugins.general.example.ExamplePlugin method) ExampleNamespacePlugin (class in dissect.target.plugins.general.example) ExamplePlugin (class in dissect.target.plugins.general.example) ExampleRecordRecord (in module dissect.target.plugins.general.example) ExampleUserRegistryRecord (in module dissect.target.plugins.general.example) excepthook() (flow.record.adapter.elastic.ElasticWriter method) exception (flow.record.adapter.elastic.ElasticWriter attribute) ExceptionDirectory (class in dissect.executable.pe.directory.exception) exceptions (dissect.executable.pe.pe.PE property) Exchange (class in acquire.acquire.acquire) ExchangePlugin (class in dissect.target.plugins.os.windows.exchange.exchange) exclude (flow.record.adapter.csvfile.CsvfileWriter attribute) (flow.record.adapter.line.LineWriter attribute) (flow.record.stream.RecordFieldRewriter attribute) excluded_functions (dissect.target.tools.dump.DumpState attribute) EXEC_ORDER (acquire.acquire.acquire.Devices attribute) (acquire.acquire.acquire.Module attribute) (acquire.acquire.acquire.Netstat attribute) (acquire.acquire.acquire.Proc attribute) (acquire.acquire.acquire.ProcNet attribute) (acquire.acquire.acquire.Sys attribute) (acquire.acquire.acquire.WinArpCache attribute) (acquire.acquire.acquire.WinDnsClientCache attribute) (acquire.acquire.acquire.WinMemDump attribute) (acquire.acquire.acquire.WinProcEnv attribute) (acquire.acquire.acquire.WinProcesses attribute) (acquire.acquire.acquire.WinRDPSessions attribute) ExecRecord (in module dissect.target.plugins.os.windows.tasks.records) executable (flow.record.fieldtypes.command attribute) execute_function() (in module dissect.target.tools.dump) execute_function_on_target() (in module dissect.target.tools.utils.cli) execute_functions() (in module dissect.target.tools.dump) execute_pipeline() (in module dissect.target.tools.dump) execution_time_limit (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) ExecutionOrder (class in acquire.acquire.acquire) ExecutionReport (class in dissect.target.tools.utils.report) ExFAT (class in dissect.fat.exfat) exfat (dissect.target.filesystems.exfat.ExfatFilesystem attribute) exfat_def (in module dissect.fat.c_exfat) ExfatDirEntry (class in dissect.target.filesystems.exfat) ExfatFilesystem (class in dissect.target.filesystems.exfat) ExfatFilesystemEntry (class in dissect.target.filesystems.exfat) ExfatFileTree (in module dissect.target.filesystems.exfat) exists() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.helpers.compat.path_313.TargetPath method) exit_code (dissect.target.plugins.os.windows.log.schedlgu.SchedLgU attribute) exit_failure() (in module acquire.acquire.acquire) exit_success() (in module acquire.acquire.acquire) EXITED (dissect.target.plugins.apps.container.podman.ContainerState attribute) expand_config_file_paths() (dissect.target.plugins.os.unix.linux.network_managers.Parser method) expand_des_key() (in module dissect.target.plugins.os.windows.sam) expand_env() (dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin method) EXPAND_SZ (dissect.target.helpers.regutil.RegistryValueType attribute) expanduser() (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) EXPANSION (dissect.database.ese.lcmapstring.SCRIPT attribute) EXPECTED_FILES_OR_DIR (in module dissect.target.loaders.vmsupport) explain_selector() (flow.record.selector.Selector method) export() (in module dissect.target.plugin) ExportDirectory (class in dissect.executable.pe.directory.export) exported (dissect.target.plugin.FunctionDescriptor attribute) exported_key() (dissect.fve.bde.information.VmkInfoDatum method) ExportedPublicKeyDatum (class in dissect.fve.bde.information) ExportFunction (class in dissect.executable.pe.directory.export) exports (dissect.executable.pe.pe.PE property) (dissect.target.plugin.PluginDescriptor attribute) Expression (class in dissect.cstruct.expression) expression (dissect.cstruct.expression.Expression attribute) (dissect.cstruct.expression.ExpressionTokenizer attribute) EXPRESSION (dissect.database.sqlite3.sqlite3.Column attribute) expression (flow.record.selector.CompiledSelector attribute) (flow.record.selector.RecordContextMatcher attribute) (flow.record.selector.Selector attribute) (flow.record.stream.RecordFieldRewriter attribute) expression_str (flow.record.selector.RecordContextMatcher attribute) (flow.record.selector.Selector attribute) ExpressionParserError ExpressionTokenizer (class in dissect.cstruct.expression) ExpressionTokenizerError expresssion_str (flow.record.selector.SelectorResult attribute) EXT2 (in module dissect.extfs.c_ext) EXT3 (in module dissect.extfs.c_ext) EXT4 (in module dissect.extfs.c_ext) ext_def (in module dissect.extfs.c_ext) ext_metadata (dissect.vmfs.lvm.Device attribute) ext_type (dissect.etl.headers.event.EventHeaderExtendedDataItem attribute) EXT_TYPE (flow.record.packer.RecordPacker attribute) ExtDirEntry (class in dissect.target.filesystems.extfs) extend() (flow.record.base.RecordDescriptor method) extend_args() (in module dissect.target.tools.shell) extend_record() (in module flow.record.base) ExtendableRecordDescriptor (class in dissect.target.helpers.record) EXTENDED (dissect.util.ldap.ComparisonOperator attribute) EXTENDED_DATA_READERS (in module dissect.etl.headers.event) ExtendedCmd (class in dissect.target.tools.shell) ExtendedDataItemException extension (dissect.target.plugins.os.windows.regf.shellbags.ROOT_FOLDER attribute) (dissect.thumbcache.thumbcache_file.ThumbcacheEntry property) extension() (dissect.target.plugins.os.windows.regf.shellbags.SHITEM method) EXTENSION_A (dissect.database.ese.lcmapstring.SCRIPT attribute) EXTENSION_BLOCK (class in dissect.target.plugins.os.windows.regf.shellbags) EXTENSION_BLOCK_BEEF0004 (class in dissect.target.plugins.os.windows.regf.shellbags) EXTENSION_BLOCK_BEEF0005 (class in dissect.target.plugins.os.windows.regf.shellbags) extensions (dissect.target.plugins.os.windows.regf.shellbags.SHITEM attribute) EXTENSIONS (in module dissect.target.loaders.res) extensions() (dissect.target.plugins.apps.browser.brave.BravePlugin method) (dissect.target.plugins.apps.browser.chrome.ChromePlugin method) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin method) (dissect.target.plugins.apps.browser.chromium.ChromiumPlugin method) (dissect.target.plugins.apps.browser.edge.EdgePlugin method) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin method) (dissect.target.plugins.apps.editor.editor.EditorPlugin method) Extent (class in dissect.archive.vma) (class in dissect.btrfs.stream) extent_count (dissect.volume.lvm.metadata.Segment attribute) extent_size (dissect.volume.lvm.metadata.VolumeGroup attribute) ExtentDescriptor (class in dissect.hypervisor.disk.vmdk) extents (dissect.btrfs.btrfs.INode attribute) (dissect.btrfs.stream.ExtentStream attribute) (dissect.hypervisor.disk.vmdk.DiskDescriptor attribute) (dissect.ntfs.usnjrnl.UsnRecord attribute) extents() (dissect.archive.vma.VMA method) extents_moved (dissect.volume.lvm.metadata.MirrorSegment attribute) ExtentStream (class in dissect.btrfs.stream) external_key() (dissect.fve.bde.information.ExternalInfoDatum method) external_origin (dissect.volume.lvm.metadata.ThinSegment attribute) ExternalInfoDatum (class in dissect.fve.bde.information) ExtFibItem (class in dissect.archive.vbk) ExtFilesystem (class in dissect.target.filesystems.extfs) ExtFilesystemEntry (class in dissect.target.filesystems.extfs) ExtFS (class in dissect.extfs.extfs) extfs (dissect.extfs.extfs.INode attribute) (dissect.extfs.extfs.XAttr attribute) (dissect.target.filesystems.extfs.ExtFilesystem attribute) EXTFS_NEEDLE (in module dissect.target.loaders.phobos) EXTFS_NEEDLE_OFFSET (in module dissect.target.loaders.phobos) extra (dissect.archive.wim.DirectoryEntry attribute) (dissect.hypervisor.disk.qcow2.QCow2Snapshot attribute) EXTRA_DATA_BLOCK_SIGNATURES (class in dissect.shellitem.lnk.c_lnk) extract_bin() (in module dissect.target.plugins.os.windows.rdpcache) extract_bmc() (in module dissect.target.plugins.os.windows.rdpcache) extract_crypt_details() (in module dissect.target.plugins.os.unix.shadow) extract_drive_letter() (in module dissect.target.loaders.velociraptor) extract_ips() (in module dissect.target.helpers.regex.ipaddress) extract_name() (dissect.eventlog.wevt_object.WevtObject method) extract_nested (dissect.target.plugins.apps.edr.velociraptor.VelociraptorRecordBuilder attribute) extract_user_info() (in module dissect.target.plugins.os.windows.ad.ntds) extract_vbk() (in module dissect.archive.tools.backup) extract_vma() (in module dissect.archive.tools.backup) Extraction (class in dissect.target.loaders.cellebrite) extractions (dissect.target.loaders.cellebrite.Ufdx attribute) extradata (dissect.shellitem.lnk.lnk.Lnk attribute) (dissect.shellitem.lnk.lnk.LnkExtraData attribute) ExtType (class in dissect.etl.headers.event) F factor (dissect.target.loaders.mqtt.Broker attribute) (dissect.target.loaders.mqtt.MqttConnection attribute) failed() (in module dissect.target.plugin) FailedImport (class in dissect.target.helpers.lazy) FAILURE (acquire.acquire.collector.Outcome attribute) FailureDescriptor (class in dissect.target.plugin) FALLBACK_LS_COLORS (in module dissect.target.tools.utils.fs) FALLBACK_SEARCH_PATHS (in module dissect.target.plugins.filesystem.resolver) FALSE (dissect.target.helpers.sunrpc.sunrpc.Bool attribute) far_copies (dissect.volume.raid.stream.RAID10Stream attribute) far_offset (dissect.volume.raid.stream.RAID10Stream attribute) FAST (dissect.target.plugins.os.windows.network.IfTypes attribute) FASTETHER (dissect.target.plugins.os.windows.network.IfTypes attribute) FASTETHER_FX (dissect.target.plugins.os.windows.network.IfTypes attribute) FastLeaf (class in dissect.regf.regf) FAT (class in dissect.fat.fat) fat (dissect.fat.exfat.ExFAT attribute) (dissect.fat.fat.FATFS attribute) fat() (dissect.ole.ole.OLE method) FAT12_EOC (in module dissect.fat.c_fat) fat_def (in module dissect.fat.c_fat) FAT_ENTRY_SIZE (in module dissect.fat.c_exfat) fat_sector (dissect.fat.exfat.ExFAT attribute) fat_sector_count (dissect.fat.exfat.ExFAT attribute) fat_size (dissect.fat.exfat.ExFAT attribute) (dissect.fat.fat.FATFS attribute) FatalError FatDirEntry (class in dissect.target.filesystems.fat) FatFilesystem (class in dissect.target.filesystems.fat) FatFilesystemEntry (class in dissect.target.filesystems.fat) FATFS (class in dissect.fat.fat) fatfs (dissect.target.filesystems.fat.FatFilesystem attribute) Fattype (in module dissect.fat.c_fat) FB (dissect.vmfs.resource.ResourceManager property) FC (dissect.target.helpers.network.IANAProtocol attribute) fd (acquire.acquire.volatilestream.VolatileStream attribute) (dissect.vmfs.descriptor.DirEntry attribute) (dissect.vmfs.resource.ResourceFile attribute) FD (dissect.vmfs.resource.ResourceManager property) FDDI (dissect.target.plugins.os.windows.network.IfTypes attribute) fDerived (dissect.database.ese.record.TagField attribute) feature_table (dissect.hypervisor.disk.qcow2.QCow2 attribute) features (dissect.apfs.objects.fs.FS property) (dissect.apfs.objects.nx_superblock.NxSuperblock property) fext_tree (dissect.apfs.objects.fs.FS property) ff (dissect.target.containers.fortifw.FortiFirmwareContainer attribute) FFS (class in dissect.ffs.ffs) ffs (dissect.target.filesystems.ffs.FfsFilesystem attribute) (dissect.target.loaders.cellebrite.CellebriteLoader attribute) ffs_def (in module dissect.ffs.c_ffs) FfsDirEntry (class in dissect.target.filesystems.ffs) FfsFilesystem (class in dissect.target.filesystems.ffs) FfsFilesystemEntry (class in dissect.target.filesystems.ffs) fguid (dissect.target.loaders.cellebrite.DeviceInfo attribute) fh (acquire.acquire.crypt.EncryptedStream attribute) (acquire.acquire.tools.decrypter.EncryptedFile attribute) (acquire.acquire.volatilestream.VolatileStream attribute) (dissect.apfs.apfs.APFS attribute) (dissect.archive.vbk.VBK attribute) (dissect.archive.vma.Extent attribute) (dissect.archive.vma.VMA attribute) (dissect.archive.wim.CompressedStream attribute) (dissect.archive.wim.DirectoryEntry attribute) (dissect.archive.wim.WIM attribute) (dissect.btrfs.stream.Stripe attribute) (dissect.cim.classes.ClassDefinition attribute) (dissect.cim.classes.ClassInstance attribute) (dissect.cim.classes.DataRegion attribute) (dissect.cim.classes.DynpropQualifier attribute) (dissect.cim.classes.Dynprops attribute) (dissect.cim.classes.PropertyDefaultValues attribute) (dissect.cim.classes.PropertyReference attribute) (dissect.cim.classes.PropertyStates attribute) (dissect.cim.classes.QualifierReference attribute) (dissect.cim.index.IndexPage attribute) (dissect.cim.index.Store attribute) (dissect.cim.objects.DataPage attribute) (dissect.cim.objects.Store attribute) (dissect.cim.objects.TOC attribute) (dissect.clfs.blf.BLF attribute) (dissect.clfs.container.Container attribute) (dissect.cramfs.cramfs.CramFS attribute) (dissect.database.bsd.db.DB attribute) (dissect.database.ese.ese.ESE attribute) (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipherStream attribute) (dissect.database.sqlite3.sqlite3.SQLite3 attribute) (dissect.database.sqlite3.wal.Frame attribute) (dissect.database.sqlite3.wal.WAL attribute) (dissect.etl.etl.Buffer attribute) (dissect.etl.etl.ETL attribute) (dissect.eventlog.evt.Evt attribute) (dissect.eventlog.evtx.Evtx attribute) (dissect.eventlog.wevt.CRIM attribute) (dissect.evidence.ad1.ad1.AD1 attribute) (dissect.evidence.ad1.ad1.LogicalImage attribute) (dissect.evidence.ad1.ad1.SegmentFile attribute) (dissect.evidence.adcrypt.adcrypt.ADCrypt attribute) (dissect.evidence.adcrypt.stream.ADCryptStream attribute) (dissect.evidence.asdf.asdf.AsdfSnapshot attribute) (dissect.evidence.asdf.asdf.AsdfStream attribute) (dissect.evidence.asdf.asdf.AsdfWriter attribute) (dissect.evidence.asdf.stream.SubStreamBase attribute) (dissect.evidence.ewf.ewf.EWF attribute) (dissect.evidence.ewf.ewf.SectionDescriptor attribute) (dissect.evidence.ewf.ewf.Segment attribute) (dissect.executable.elf.elf.ELF attribute) (dissect.executable.elf.elf.Section attribute) (dissect.executable.elf.elf.SectionTable attribute) (dissect.executable.elf.elf.Segment attribute) (dissect.executable.elf.elf.SegmentTable attribute) (dissect.executable.pe.pe.PE attribute) (dissect.extfs.extfs.ExtFS attribute) (dissect.extfs.journal.JDB2 attribute) (dissect.fat.fat.FAT attribute) (dissect.fat.fat.FATFS attribute) (dissect.ffs.ffs.FFS attribute) (dissect.fve.bde.bde.BDE attribute) (dissect.fve.bde.eow.EowBitmap attribute) (dissect.fve.bde.eow.EowBitmapRecord attribute) (dissect.fve.bde.eow.EowInformation attribute) (dissect.fve.crypto.dmcrypt.CryptStream attribute) (dissect.fve.luks.luks.LUKS attribute) (dissect.hypervisor.descriptor.hyperv.HyperVFile attribute) (dissect.hypervisor.descriptor.ovf.OVF attribute) (dissect.hypervisor.disk.asif.ASIF attribute) (dissect.hypervisor.disk.hdd.HDS attribute) (dissect.hypervisor.disk.vdi.VDIStream attribute) (dissect.hypervisor.disk.vhd.BlockAllocationTable attribute) (dissect.hypervisor.disk.vhd.Disk attribute) (dissect.hypervisor.disk.vhd.VHD attribute) (dissect.hypervisor.disk.vhdx.MetadataTable attribute) (dissect.hypervisor.disk.vhdx.ParentLocator attribute) (dissect.hypervisor.disk.vhdx.RegionTable attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) (dissect.hypervisor.disk.vmdk.RawDisk attribute) (dissect.hypervisor.disk.vmdk.SparseDisk attribute) (dissect.hypervisor.util.envelope.Envelope attribute) (dissect.jffs.jffs2.JFFS2 attribute) (dissect.ntfs.attr.AttributeHeader attribute) (dissect.ntfs.index.IndexEntry attribute) (dissect.ntfs.index.IndexRoot attribute) (dissect.ntfs.mft.Mft attribute) (dissect.ntfs.ntfs.NTFS attribute) (dissect.ntfs.usnjrnl.UsnJrnl attribute) (dissect.ole.ole.OLE attribute) (dissect.qnxfs.qnx4.QNX4 attribute) (dissect.qnxfs.qnx6.QNX6 attribute) (dissect.regf.regf.RegistryHive attribute) (dissect.shellitem.lnk.lnk.Lnk attribute) (dissect.shellitem.lnk.lnk.LnkInfo attribute) (dissect.squashfs.squashfs.SquashFS attribute) (dissect.target.container.Container attribute) (dissect.target.containers.fortifw.FortiFirmwareFile attribute) (dissect.target.filesystem.VirtualFileHandle attribute) (dissect.target.filesystems.itunes.EncryptedFileStream attribute) (dissect.target.helpers.cache.LineWriter attribute) (dissect.target.loaders.ab.AndroidBackup attribute) (dissect.target.loaders.res.UPF attribute) (dissect.target.loaders.res.UPR attribute) (dissect.target.loaders.tar.TarLoader attribute) (dissect.target.loaders.zip.ZipLoader attribute) (dissect.target.plugins.os.unix.locate.gnulocate.GNULocateFile attribute) (dissect.target.plugins.os.unix.locate.mlocate.MLocateFile attribute) (dissect.target.plugins.os.unix.locate.plocate.PLocateFile attribute) (dissect.target.plugins.os.unix.log.atop.AtopFile attribute) (dissect.target.plugins.os.unix.log.journal.JournalFile attribute) (dissect.target.plugins.os.unix.log.lastlog.LastLogFile attribute) (dissect.target.plugins.os.unix.log.utmp.UtmpFile attribute) (dissect.target.plugins.os.windows.credential.credhist.CredHistFile attribute) (dissect.target.plugins.os.windows.everything.parser.EverythingDB attribute) (dissect.target.plugins.os.windows.jumplist.JumpListFile attribute) (dissect.target.plugins.os.windows.prefetch.Prefetch attribute) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK attribute) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM attribute) (dissect.target.plugins.os.windows.regf.shimcache.ShimCache attribute) (dissect.target.volume.Volume attribute) (dissect.target.volume.VolumeSystem attribute) (dissect.thumbcache.index.IndexEntry attribute) (dissect.thumbcache.index.ThumbnailIndex attribute) (dissect.thumbcache.thumbcache_file.ThumbcacheFile attribute) (dissect.util.stream.BitStream attribute) (dissect.vmfs.lvm.Device attribute) (dissect.vmfs.resource.ResourceFile attribute) (dissect.vmfs.vmfs.VMFS attribute) (dissect.volume.disk.disk.Disk attribute) (dissect.volume.disk.schemes.apm.APM attribute) (dissect.volume.disk.schemes.bsd.BSD attribute) (dissect.volume.disk.schemes.gpt.GPT attribute) (dissect.volume.disk.schemes.mbr.MBR attribute) (dissect.volume.dm.btree.BTree attribute) (dissect.volume.dm.thin.Metadata attribute) (dissect.volume.lvm.lvm2.LVM2 attribute) (dissect.volume.lvm.physical.LVM2Device attribute) (dissect.volume.raid.raid.PhysicalDisk attribute) (dissect.volume.vinum.vinum.VinumPhysicalDisk attribute) (dissect.volume.vss.Catalog attribute) (dissect.volume.vss.Store attribute) (dissect.volume.vss.VSS attribute) (dissect.xfs.xfs.AllocationGroup attribute) (dissect.xfs.xfs.XFS attribute) fhs (dissect.btrfs.btrfs.Btrfs attribute) FibBlockDescriptor (class in dissect.archive.vbk) FibBlockDescriptorV7 (class in dissect.archive.vbk) FibMetaSparseTable (class in dissect.archive.vbk) FIBRECHANNEL (dissect.target.plugins.os.windows.network.IfTypes attribute) FibStream (class in dissect.archive.vbk) FID (in module dissect.fat.c_exfat) Field (class in dissect.cstruct.types.structure) field_contains() (in module flow.record.selector) field_count (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntryResource attribute) field_equals() (in module flow.record.selector) field_fillers (dissect.target.helpers.record.ExtendableRecordDescriptor attribute) FIELD_IDENTIFIER (in module dissect.target.plugins.os.windows.defender.quarantine) FIELD_MAP (in module dissect.etl.manifest) (in module flow.record.adapter.sqlite) FIELD_MAPPINGS (in module dissect.target.plugins.os.windows.certlog) (in module dissect.target.plugins.os.windows.sru) FIELD_NAME_INVALID_CHARS_RE (in module dissect.target.plugins.apps.webserver.iis) FIELD_NAME_MAP (in module dissect.target.plugins.os.windows.ual) FIELD_NAMES (dissect.target.plugins.os.windows.regf.muicache.MuiCachePlugin attribute) field_regex() (in module flow.record.selector) field_types_for_record_descriptor() (in module flow.record.adapter.line) FIELDFLAG (in module dissect.database.ese.c_ese) fields (dissect.cstruct.types.structure.StructureMetaType attribute) (dissect.target.helpers.configutil.CSVish attribute) (dissect.target.helpers.configutil.ParserConfig attribute) (dissect.target.plugins.os.windows.firewall.LogConfig attribute) (flow.record.adapter.csvfile.CsvfileReader attribute) (flow.record.adapter.csvfile.CsvfileWriter attribute) (flow.record.adapter.line.LineWriter attribute) (flow.record.base.RecordDescriptor property) (flow.record.stream.RecordFieldRewriter attribute) FieldType (class in flow.record.base) (class in flow.record.fieldtypes) fieldtype() (in module flow.record.base) fieldtype_for_value() (in module flow.record.fieldtypes) FIFO (dissect.target.helpers.nfs.nfs3.FileType attribute) FILE (acquire.acquire.collector.ArtifactType attribute) (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) File (class in dissect.database.bsd.tools.rpm) (class in dissect.target.loaders.res) file (dissect.hypervisor.descriptor.hyperv.HyperVStorageFileObject attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageObjectTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageReplayLog attribute) (dissect.hypervisor.disk.hdd.Image attribute) (dissect.ntfs.usnjrnl.UsnRecord property) FILE (dissect.target.helpers.keychain.KeyType attribute) file (dissect.target.helpers.nfs.nfs3.ReadParams attribute) (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadTab attribute) FILE_ATTRIBUTE (in module dissect.archive.c_wim) file_attributes (dissect.clfs.blf.Stream attribute) (dissect.ntfs.attr.FileName property) (dissect.ntfs.attr.StandardInformation property) (dissect.target.helpers.nfs.nfs3.ReadResult attribute) file_block_size (dissect.vmfs.vmfs.VMFS attribute) file_count (flow.record.adapter.split.SplitWriter attribute) file_descriptor (dissect.vmfs.descriptor.DirEntry property) (dissect.vmfs.vmfs.VMFS attribute) FILE_DIFF_RECORD_FIELDS (in module dissect.target.tools.diff) FILE_ENTRY (class in dissect.target.plugins.os.windows.regf.shellbags) (in module dissect.fat.c_exfat) FILE_FILE_NAME_INDEX_PRESENT (in module dissect.ntfs.c_ntfs) file_filter() (acquire.acquire.collector.Collector method) FILE_FORMATTER (in module acquire.acquire.log) FILE_GLOB (dissect.target.plugins.os.windows.log.mssql.MssqlPlugin attribute) file_handles (dissect.target.helpers.mount.DissectMount attribute) file_header (acquire.acquire.tools.decrypter.EncryptedFile property) (dissect.executable.pe.pe.PE attribute) FILE_HEADER_MAGIC (in module dissect.hypervisor.util.envelope) file_id (dissect.apfs.objects.fs.DirectoryEntry property) (dissect.target.filesystems.smb.SmbStream attribute) (dissect.target.loaders.itunes.FileInfo attribute) file_identifier (dissect.hypervisor.disk.vhdx.VHDX attribute) file_info (dissect.target.filesystems.itunes.EncryptedFileStream attribute) FILE_INFORMATION (dissect.target.plugins.filesystem.ntfs.utils.InformationType attribute) FILE_INFORMATION_CLASS (class in acquire.acquire.dynamic.windows.types) file_limit (dissect.target.tools.diff.TargetComparison attribute) FILE_LIMIT (in module dissect.target.tools.diff) FILE_MAGIC (in module acquire.acquire.crypt) (in module dissect.evidence.asdf.asdf) (in module dissect.target.plugins.os.windows.everything.parser) file_name (dissect.ntfs.attr.FileName property) (dissect.target.plugins.os.windows.jumplist.JumpListFile attribute) FILE_NAME_DOS (in module dissect.ntfs.c_ntfs) FILE_NAME_NTFS (in module dissect.ntfs.c_ntfs) FILE_NUMBER_ATTRDEF (in module dissect.ntfs.c_ntfs) FILE_NUMBER_BADCLUS (in module dissect.ntfs.c_ntfs) FILE_NUMBER_BITMAP (in module dissect.ntfs.c_ntfs) FILE_NUMBER_BOOT (in module dissect.ntfs.c_ntfs) FILE_NUMBER_EXTEND (in module dissect.ntfs.c_ntfs) FILE_NUMBER_LOGFILE (in module dissect.ntfs.c_ntfs) FILE_NUMBER_MFT (in module dissect.ntfs.c_ntfs) FILE_NUMBER_MFTMIRR (in module dissect.ntfs.c_ntfs) FILE_NUMBER_ROOT (in module dissect.ntfs.c_ntfs) FILE_NUMBER_SECURE (in module dissect.ntfs.c_ntfs) FILE_NUMBER_UPCASE (in module dissect.ntfs.c_ntfs) FILE_NUMBER_VOLUME (in module dissect.ntfs.c_ntfs) file_object_pointer (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) file_objects (dissect.hypervisor.descriptor.hyperv.HyperVFile attribute) FILE_PARAMETERS_GUID (in module dissect.hypervisor.disk.c_vhdx) file_path (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj attribute) (dissect.target.plugins.os.windows.everything.parser.Record attribute) (dissect.target.plugins.os.windows.regf.cit.Entry attribute) FILE_RECORD_SEGMENT_IN_USE (in module dissect.ntfs.c_ntfs) file_reference (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK_BEEF0004 attribute) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM property) file_size (dissect.eventlog.wevt.CRIM property) (dissect.ntfs.attr.FileName property) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM property) file_type (dissect.target.plugins.os.windows.everything.parser.Record attribute) FILE_VERSION (in module acquire.acquire.crypt) FILE_XPATH (dissect.hypervisor.descriptor.ovf.OVF attribute) FileAppcompatRecord (in module dissect.target.plugins.os.windows.amcache) FileAttributes (class in dissect.target.helpers.nfs.nfs3) FileAttributesSerializer (class in dissect.target.helpers.nfs.serializer) FileBlockAddr (class in dissect.vmfs.address) FileBlockResourceVMFS5 (class in dissect.vmfs.resource) FileClassType (in module dissect.evidence.ad1.ad1) FileCreatedRecord (in module dissect.target.tools.diff) FileDeletedRecord (in module dissect.target.tools.diff) FileDescriptor (class in dissect.vmfs.descriptor) FileDescriptor5 (class in dissect.vmfs.descriptor) FileDescriptor6 (class in dissect.vmfs.descriptor) FileDescriptorAddr (class in dissect.vmfs.address) FileDescriptorResourceVMFS5 (class in dissect.vmfs.resource) FileDescriptorResourceVMFS6 (class in dissect.vmfs.resource) FileEntry (class in dissect.evidence.ad1.ad1) FileHandle (class in dissect.target.helpers.nfs.nfs3) filehandle (dissect.target.helpers.nfs.nfs3.MountOK attribute) FileHashes (class in acquire.acquire.acquire) fileid (dissect.target.helpers.nfs.nfs3.EntryPlus attribute) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) FileInfo (class in dissect.target.loaders.itunes) FileIoGuid (in module dissect.etl.utils) FileLinkTracking (class in dissect.database.ese.ntds.objects.filelinktracking) FileMeta (class in dissect.evidence.ad1.ad1) FileModifiedRecord (in module dissect.target.tools.diff) FileName (class in dissect.ntfs.attr) filename (dissect.extfs.extfs.INode attribute) (dissect.hypervisor.disk.vmdk.ExtentDescriptor attribute) (dissect.ntfs.mft.MftRecord property) (dissect.regf.regf.RegistryHive attribute) (dissect.target.helpers.nfs.nfs3.DirOpArgs attribute) (dissect.xfs.xfs.INode attribute) (flow.record.fieldtypes.uri property) FILENAME_ENTRY (in module dissect.fat.c_exfat) filename_index() (dissect.target.plugins.os.unix.locate.plocate.PLocateFile method) FileNameInformation (acquire.acquire.dynamic.windows.types.FILE_INFORMATION_CLASS attribute) FilenameNotAvailableError filenames() (dissect.ntfs.mft.MftRecord method) FileNotFoundError, [1], [2], [3], [4], [5], [6], [7], [8], [9], [10], [11], [12], [13], [14] filepath (dissect.target.helpers.regutil.RegfHive attribute) FILEPATH (dissect.target.plugins.os.unix.linux.recentlyused.RecentlyUsedPlugin attribute) filerenameop() (dissect.target.plugins.os.windows.generic.GenericPlugin method) FileRenameOperationRecord (in module dissect.target.plugins.os.windows.generic) files (dissect.fat.exfat.ExFAT attribute) (dissect.target.plugins.os.windows.credential.credhist.CredHistPlugin attribute) (in module dissect.target.helpers.magic.mimetypes) files() (dissect.target.loaders.itunes.ITunesBackup method) (dissect.target.loaders.res.UPF method) (dissect.target.plugins.os.windows.amcache.AmcachePluginOldMixin method) (dissect.target.plugins.os.windows.catroot.CatrootPlugin method) filesize (class in flow.record.fieldtypes) (dissect.hypervisor.disk.vmdk.SparseDisk attribute) FileStream (class in dissect.apfs.stream) (class in dissect.evidence.ad1.stream) (class in dissect.squashfs.squashfs) Filesystem (class in dissect.target.filesystem) filesystem (dissect.fat.exfat.ExFAT attribute) FILESYSTEM_OBJECT_TYPE_MAP (in module dissect.apfs.c_apfs) FilesystemCollection (class in dissect.target.target) FilesystemEntry (class in dissect.target.filesystem) FilesystemError FilesystemFilenameCompactRecord (in module dissect.target.plugins.filesystem.ntfs.mft) FilesystemFilenameRecord (in module dissect.target.plugins.filesystem.ntfs.mft) FilesystemMACBRecord (in module dissect.target.plugins.filesystem.ntfs.mft) FilesystemRecord (in module dissect.target.plugins.filesystem.walkfs) filesystems (dissect.apfs.objects.nx_superblock.NxSuperblock property) (dissect.target.plugins.os.windows.everything.parser.EverythingDB attribute) (dissect.target.target.Target attribute) FILESYSTEMS (in module dissect.target.filesystem) filesystems_cstruct() (in module dissect.target.plugins.os.windows.everything.parser) FILESYSTEMS_LEGACY_ROOT (in module dissect.target.loaders.acquire) FILESYSTEMS_ROOT (in module dissect.target.loaders.acquire) (in module dissect.target.loaders.uac) (in module dissect.target.loaders.velociraptor) FilesystemStdCompactRecord (in module dissect.target.plugins.filesystem.ntfs.mft) FilesystemStdRecord (in module dissect.target.plugins.filesystem.ntfs.mft) FILETIME (dissect.etl.headers.logfile.ReservedFlags attribute) (dissect.eventlog.bxml.BxmlType attribute) filetransfer() (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin method) (dissect.target.plugins.apps.remoteaccess.splashtop.SplashtopPlugin method) filetransfer_files (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin attribute) FILETRANSFER_SERVICE_LOGS (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin attribute) FILETRANSFER_USER_LOGS (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin attribute) FileType (class in dissect.target.helpers.nfs.nfs3) filetype (dissect.extfs.extfs.INode property) (dissect.xfs.xfs.INode property) FILETYPES (in module dissect.extfs.c_ext) (in module dissect.xfs.c_xfs) fill() (dissect.ole.ole.Chain method) fill_zero() (in module dissect.evidence.tools.asdf.dd) filled_bytes (dissect.etl.etl.Buffer property) filter (acquire.acquire.collector.Collector attribute) filter() (acquire.acquire.dynamic.windows.handles.DuplicateFilter method) FILTER_CONNECTION_PORT (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) filter_creator_sid (dissect.target.plugins.os.windows.cim.EventFilter attribute) filter_name (dissect.target.plugins.os.windows.cim.EventFilter attribute) filter_out_by_path_match() (in module acquire.acquire.hashes) filter_out_by_value_match() (in module acquire.acquire.hashes) filter_out_huge_files() (in module acquire.acquire.hashes) filter_out_nonfiles() (in module acquire.acquire.hashes) filter_query (dissect.target.plugins.os.windows.cim.EventFilter attribute) filter_query_language (dissect.target.plugins.os.windows.cim.EventFilter attribute) FIN_WAIT1 (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) FIN_WAIT2 (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) finalize() (acquire.acquire.crypt.EncryptedStream method) (dissect.evidence.asdf.stream.CompressedStream method) (dissect.evidence.asdf.stream.Crc32Stream method) (dissect.evidence.asdf.stream.SubStreamBase method) find (dissect.target.plugins.general.users.UsersPlugin attribute) find() (dissect.btrfs.tree.BTree method) (dissect.database.ese.cursor.Cursor method) (dissect.executable.elf.elf.Table method) (dissect.executable.pe.directory.resource.ResourceDirectory method) (dissect.ntfs.util.AttributeMap method) (dissect.target.plugins.scrape.scrape.ScrapePlugin method) find_adapter_for_stream() (in module flow.record.base) find_all() (dissect.database.ese.cursor.Cursor method) (dissect.target.loader.Loader static method) (dissect.target.loaders.mqtt.MqttLoader static method) find_and_filter_plugins() (in module dissect.target.tools.utils.cli) find_and_map_dirs() (in module dissect.target.loaders.dir) find_build_props() (in module dissect.target.plugins.os.unix.linux.android._os) find_clear_vmk() (dissect.fve.bde.information.Dataset method) find_codebases() (dissect.target.plugins.apps.productivity.msoffice.ClickOnceDeploymentManifestParser method) find_containers() (dissect.target.plugins.apps.browser.iexplore.WebCache method) find_crontabs() (dissect.target.plugins.os.unix.cronjobs.CronjobPlugin method) find_current_mapping() (in module dissect.cim.utils) find_databases() (dissect.target.plugins.os.windows.search.SearchIndexPlugin method) find_datum() (dissect.fve.bde.information.Dataset method) find_description() (dissect.fve.bde.information.Dataset method) find_digest() (dissect.fve.luks.luks.LUKS method) find_dirs() (in module dissect.target.loaders.dir) find_dnd_dirs() (dissect.target.plugins.apps.virtualization.vmware_workstation.VmwareWorkstationPlugin method) find_enc_files() (in module acquire.acquire.tools.decrypter) find_entry_path() (in module dissect.target.loaders.dir) find_external_vmk() (dissect.fve.bde.information.Dataset method) find_files() (in module dissect.evidence.ad1.ad1) (in module dissect.evidence.ewf.ewf) (in module dissect.target.containers.split) find_fs_directories() (in module dissect.target.loaders.velociraptor) find_functions() (in module dissect.target.plugin) find_functions_by_record_field_type() (in module dissect.target.plugin) find_fvek() (dissect.fve.bde.information.Dataset method) find_image() (dissect.hypervisor.disk.hdd.Storage method) find_index() (dissect.database.ese.table.Table method) find_installs() (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin method) (dissect.target.plugins.apps.chat.msn.MSNPlugin method) (dissect.target.plugins.apps.container.podman.PodmanPlugin method) (in module dissect.target.plugins.apps.container.docker) find_log_paths() (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin method) find_logs() (dissect.target.plugins.apps.webserver.apache.ApachePlugin method) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin method) find_luks_headers() (in module dissect.fve.luks.luks) find_mdb_files() (dissect.target.plugins.os.windows.ual.UalPlugin method) find_mounts() (dissect.target.plugins.os.windows.regf.usb.UsbPlugin method) find_needle() (in module dissect.eventlog.evt) find_needle_chunks() (in module dissect.target.helpers.scrape) find_needles() (in module dissect.target.helpers.scrape) find_node() (in module dissect.database.ese.btree) find_package_name() (in module dissect.target.plugins.os.windows.catroot) find_passphrase_vmk() (dissect.fve.bde.information.Dataset method) find_profile() (dissect.target.plugins.os.windows.regf.nethist.NethistPlugin method) find_property() (dissect.fve.bde.information.Datum method) find_pvms() (in module dissect.target.plugins.child.parallels) find_pwr_dir() (in module dissect.target.loaders.res) find_recovery_vmk() (dissect.fve.bde.information.Dataset method) find_rule_keys() (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin method) find_segment() (dissect.fve.luks.luks.LUKS method) find_shot() (dissect.hypervisor.disk.hdd.Snapshots method) find_sid() (dissect.target.plugins.os.windows.recyclebin.RecyclebinPlugin method) find_sshd_directory() (in module dissect.target.plugins.apps.ssh.openssh) find_startup_key() (dissect.fve.bde.information.Dataset method) find_subvolume() (dissect.btrfs.btrfs.Btrfs method) find_super_block() (in module dissect.volume.md.md) find_users() (dissect.target.plugins.os.windows.regf.usb.UsbPlugin method) find_virtualization_info() (dissect.fve.bde.information.Dataset method) find_vm_inventory() (in module dissect.target.plugins.apps.virtualization.vmware_workstation) find_vmk() (dissect.fve.bde.information.Dataset method) find_vms() (dissect.target.plugins.child.virtualbox.VirtualBoxChildTargetPlugin method) (in module dissect.target.plugins.child.colima) find_volumes() (dissect.target.plugins.os.windows.regf.usb.UsbPlugin method) find_wsl_installs() (in module dissect.target.plugins.child.wsl) find_xor_key() (in module dissect.target.containers.fortifw) findable (dissect.target.plugin.FunctionDescriptor attribute) (dissect.target.plugin.PluginDescriptor attribute) findall() (in module dissect.target.helpers.utils) finish() (acquire.acquire.gui.base.GUI method) (acquire.acquire.gui.base.Stub method) (acquire.acquire.gui.win32.Win32 method) (acquire.acquire.uploaders.minio.MinIO method) (acquire.acquire.uploaders.plugin.UploaderPlugin method) finished_sinks (dissect.target.tools.dump.DumpState property) FIRE (dissect.target.helpers.network.IANAProtocol attribute) FIREFOX_EXTENSION_RECORD_FIELDS (in module dissect.target.plugins.apps.browser.firefox) FirefoxPlugin (class in dissect.target.plugins.apps.browser.firefox) firewall() (dissect.target.plugins.apps.av.symantec.SymantecPlugin method) first() (dissect.apfs.cursor.Cursor method) (dissect.btrfs.tree.Cursor method) first_data_sector (dissect.fat.fat.FATFS attribute) FistTime (dissect.target.plugins.apps.productivity.msoffice.LoadBehavior attribute) FixedDisk (class in dissect.hypervisor.disk.vhd) fixup_key() (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm method) fixUpPgs (dissect.hypervisor.util.vmtar.VisorTarInfo attribute) Flag (class in dissect.cstruct.types.flag) flag (dissect.hypervisor.util.envelope.EnvelopeAttribute attribute) flag() (dissect.shellitem.lnk.lnk.Lnk method) (dissect.shellitem.lnk.lnk.LnkInfo method) flags (dissect.apfs.objects.btree.BTree property) (dissect.apfs.objects.btree_node.BTreeNode property) (dissect.apfs.objects.fs.FS property) (dissect.apfs.objects.fs.XAttr property) (dissect.apfs.objects.keybag.KEK property) (dissect.apfs.objects.keybag.VEK property) (dissect.archive.vbk.FibBlockDescriptor property) (dissect.archive.wim.Resource attribute) (dissect.cstruct.parser.TokenConsumer attribute) (dissect.database.ese.ntds.sd.ACE property) (dissect.database.ese.page.Page attribute) (dissect.database.ese.page.Tag attribute) (dissect.database.ese.table.Column attribute) (dissect.etl.headers.headers.Marker property) (dissect.eventlog.bxml.Token attribute) (dissect.eventlog.evt.Evt attribute) (dissect.executable.elf.elf.Segment attribute) (dissect.fve.luks.metadata.Config attribute) (dissect.fve.luks.metadata.Segment attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.hypervisor.disk.vdi.VDI property) (dissect.ntfs.attr.AttributeHeader property) (dissect.ntfs.attr.FileName property) (dissect.ntfs.secure.ACE attribute) (dissect.ole.ole.DirectoryEntry attribute) (dissect.shellitem.lnk.lnk.Lnk attribute) (dissect.shellitem.lnk.lnk.LnkInfo attribute) (dissect.shellitem.lnk.lnk.LnkStringData attribute) (dissect.squashfs.squashfs.SquashFS attribute) (dissect.target.loaders.itunes.FileInfo attribute) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) (dissect.thumbcache.index.IndexEntry property) (dissect.volume.disk.partition.Partition attribute) (dissect.volume.lvm.metadata.LogicalVolume attribute) (dissect.volume.lvm.metadata.Segment property) (dissect.volume.lvm.metadata.VolumeGroup attribute) (dissect.volume.vss.BlockDescriptor attribute) flat_fields (flow.record.base.GroupedRecord attribute) flavor (dissect.target.helpers.sunrpc.client.AuthScheme attribute) fletcher64() (in module dissect.apfs.util) float (class in flow.record.fieldtypes) FLOAT (dissect.eventlog.bxml.BxmlType attribute) flow.record module flow.record.adapter module flow.record.adapter.archive module flow.record.adapter.avro module flow.record.adapter.broker module flow.record.adapter.csvfile module flow.record.adapter.duckdb module flow.record.adapter.elastic module flow.record.adapter.jsonfile module flow.record.adapter.line module flow.record.adapter.mongo module flow.record.adapter.split module flow.record.adapter.splunk module flow.record.adapter.sqlite module flow.record.adapter.stream module flow.record.adapter.text module flow.record.adapter.xlsx module flow.record.base module flow.record.context module flow.record.exceptions module flow.record.fieldtypes module flow.record.fieldtypes.credential module flow.record.fieldtypes.net module flow.record.fieldtypes.net.ip module flow.record.fieldtypes.net.ipv4 module flow.record.fieldtypes.net.tcp module flow.record.fieldtypes.net.udp module flow.record.jsonpacker module flow.record.packer module flow.record.selector module flow.record.stream module flow.record.tools module flow.record.tools.geoip module flow.record.tools.rdump module flow.record.utils module flow.record.whitelist module flow_record_tz() (in module flow.record.fieldtypes) flush() (dissect.cstruct.bitbuffer.BitBuffer method) (dissect.target.tools.dump.JsonLinesWriter method) (flow.record.adapter.AbstractWriter method) (flow.record.adapter.archive.ArchiveWriter method) (flow.record.adapter.avro.AvroWriter method) (flow.record.adapter.broker.BrokerWriter method) (flow.record.adapter.csvfile.CsvfileWriter method) (flow.record.adapter.elastic.ElasticWriter method) (flow.record.adapter.jsonfile.JsonfileWriter method) (flow.record.adapter.line.LineWriter method) (flow.record.adapter.mongo.MongoWriter method) (flow.record.adapter.split.SplitWriter method) (flow.record.adapter.splunk.SplunkWriter method) (flow.record.adapter.sqlite.SqliteWriter method) (flow.record.adapter.stream.StreamWriter method) (flow.record.adapter.text.TextWriter method) (flow.record.adapter.xlsx.XlsxWriter method) (flow.record.stream.RecordPrinter method) (flow.record.stream.RecordStreamWriter method) flush_cache() (acquire.acquire.log.DelayedFileHandler method) fmt() (in module dissect.util.tools.dump_nskeyedarchiver) fmt_ls_colors() (in module dissect.target.tools.utils.fs) fn (dissect.target.plugins.os.windows.prefetch.Prefetch attribute) fname (dissect.target.helpers.cache.Cache attribute) fNullSmallPage (dissect.database.ese.record.TagField attribute) folder (acquire.acquire.gui.base.GUI attribute) (acquire.acquire.uploaders.minio.MinIO attribute) Folder (class in dissect.target.loaders.res) folder (dissect.target.loaders.res.File attribute) FOLDER (dissect.target.plugins.os.windows.everything.parser.EverythingFSType attribute) FolderHistoryRecord (in module dissect.target.plugins.apps.productivity.sevenzip) folders (dissect.target.plugins.os.windows.lnk.LnkPlugin attribute) folders() (dissect.target.loaders.res.UPF method) font (dissect.executable.pe.directory.resource.ResourceDirectory property) fontdir (dissect.executable.pe.directory.resource.ResourceDirectory property) footer (acquire.acquire.tools.decrypter.EncryptedFile property) (dissect.evidence.asdf.asdf.AsdfSnapshot attribute) (dissect.hypervisor.disk.vhd.Disk attribute) (dissect.target.plugins.os.windows.jumplist.CustomDestinationFile attribute) FOOTER_AEAD_MAGIC (in module dissect.hypervisor.util.envelope) FOOTER_CRYPTO_MAGIC (in module dissect.hypervisor.util.envelope) FOOTER_MAGIC (in module acquire.acquire.crypt) (in module dissect.evidence.asdf.asdf) foreground (dissect.target.plugins.os.windows.regf.cit.ProgramDataBitmaps attribute) (dissect.target.plugins.os.windows.regf.cit.SystemDataBitmaps attribute) ForeignSecurityPrincipal (class in dissect.database.ese.ntds.objects.foreignsecurityprincipal) format (dissect.archive.vbk.StgBlockDescriptor property) (dissect.hypervisor.descriptor.vbox.HardDisk property) (dissect.volume.lvm.metadata.VolumeGroup attribute) format() (dissect.util.ldap.SearchFilter method) format_body_info() (in module dissect.target.plugins.filesystem.ntfs.mft) FORMAT_CPIO_BIN (in module dissect.util.cpio) FORMAT_CPIO_CRC (in module dissect.util.cpio) FORMAT_CPIO_HPBIN (in module dissect.util.cpio) FORMAT_CPIO_HPODC (in module dissect.util.cpio) FORMAT_CPIO_NEWC (in module dissect.util.cpio) FORMAT_CPIO_ODC (in module dissect.util.cpio) FORMAT_CPIO_UNKNOWN (in module dissect.util.cpio) format_fingerprint() (in module dissect.target.plugins.os.windows.certlog) FORMAT_INFO (in module dissect.target.plugins.filesystem.ntfs.mft) format_major (dissect.database.ese.ese.ESE attribute) format_minor (dissect.database.ese.ese.ESE attribute) format_none_value() (in module dissect.target.plugins.filesystem.ntfs.mft) format_output_name() (in module acquire.acquire.utils) format_serial_number() (in module dissect.target.plugins.os.windows.certlog) format_serial_number_as_hex() (in module dissect.target.helpers.certificate) format_spec (flow.record.adapter.text.TextWriter attribute) format_target_report() (in module dissect.target.tools.utils.report) format_timeline_info() (in module dissect.target.plugins.filesystem.ntfs.mft) format_value() (in module dissect.target.plugins.os.windows.log.evtx) format_version (dissect.archive.vbk.VBK attribute) FORMATING_FUNC (in module dissect.target.plugins.os.windows.certlog) formatted_by (dissect.apfs.objects.fs.FS property) FortiFirmwareContainer (class in dissect.target.containers.fortifw) FortiFirmwareFile (class in dissect.target.containers.fortifw) FORTIOS (dissect.target.plugin.OperatingSystem attribute) FortiOSConfig (class in dissect.target.plugins.os.unix.linux.fortios._os) FortiOSLocalePlugin (class in dissect.target.plugins.os.unix.linux.fortios.locale) FortiOSPlugin (class in dissect.target.plugins.os.unix.linux.fortios._os) FortiOSUserRecord (in module dissect.target.plugins.os.unix.linux.fortios._os) forwarder (dissect.executable.pe.directory.export.ExportFunction attribute) forwarders (dissect.executable.pe.directory.bound_import.BoundImportModule attribute) fp (dissect.target.tools.dump.JsonLinesWriter attribute) (flow.record.adapter.avro.AvroReader attribute) (flow.record.adapter.avro.AvroWriter attribute) (flow.record.adapter.csvfile.CsvfileReader attribute) (flow.record.adapter.csvfile.CsvfileWriter attribute) (flow.record.adapter.jsonfile.JsonfileReader attribute) (flow.record.adapter.jsonfile.JsonfileWriter attribute) (flow.record.adapter.line.LineWriter attribute) (flow.record.adapter.stream.StreamReader attribute) (flow.record.adapter.stream.StreamWriter attribute) (flow.record.adapter.text.TextWriter attribute) (flow.record.adapter.xlsx.XlsxReader attribute) (flow.record.adapter.xlsx.XlsxWriter attribute) (flow.record.stream.RecordPrinter attribute) (flow.record.stream.RecordStreamReader attribute) (flow.record.stream.RecordStreamWriter attribute) FR_DLCI_ENDPT (dissect.target.plugins.os.windows.network.IfTypes attribute) FR_FORWARD (dissect.target.plugins.os.windows.network.IfTypes attribute) fragment (dissect.squashfs.squashfs.FileStream attribute) (flow.record.fieldtypes.uri property) fragment_offset (dissect.squashfs.squashfs.FileStream attribute) fragment_size (dissect.ffs.ffs.FFS attribute) fragment_table (dissect.squashfs.squashfs.SquashFS attribute) Frame (class in dissect.database.sqlite3.wal) frame (dissect.database.sqlite3.wal.WAL attribute) FRAMERELAY (dissect.target.plugins.os.windows.network.IfTypes attribute) FRAMERELAY_INTERCONNECT (dissect.target.plugins.os.windows.network.IfTypes attribute) FRAMERELAY_MPI (dissect.target.plugins.os.windows.network.IfTypes attribute) FRAMERELAY_SERVICE (dissect.target.plugins.os.windows.network.IfTypes attribute) frames() (dissect.database.sqlite3.wal.WAL method) FREE_CLUSTER (in module dissect.fat.c_fat) FreeBsdPlugin (class in dissect.target.plugins.os.unix.bsd.freebsd._os) FreeClusterError FreeSegment (class in dissect.volume.lvm.metadata) fresh_app_context() (in module flow.record.context) FRF16_MFR_BUNDLE (dissect.target.plugins.os.windows.network.IfTypes attribute) from_address() (dissect.apfs.objects.base.Object class method) from_bag_dict() (dissect.target.loaders.itunes.ClassKey class method) from_block() (dissect.apfs.objects.base.Object class method) from_buffer() (in module dissect.target.helpers.magic.magic) from_bytes() (dissect.archive.vbk.DirItem class method) (dissect.archive.vbk.MetaItem class method) (dissect.fve.bde.information.Datum class method) (dissect.ntfs.attr.Attribute class method) (dissect.ntfs.attr.AttributeHeader class method) (dissect.ntfs.mft.MftRecord class method) (dissect.vmfs.descriptor.FileDescriptor static method) from_descriptor() (in module dissect.target.helpers.magic.magic) from_dict() (dissect.fve.luks.metadata.JsonItem class method) (dissect.target.tools.dump.DumpState class method) (dissect.volume.lvm.metadata.MetaBase class method) (dissect.volume.lvm.metadata.Segment class method) from_directory() (dissect.cim.cim.CIM class method) from_directory_information() (acquire.acquire.dynamic.windows.named_objects.NamedObject class method) from_elf() (dissect.executable.elf.elf.SectionTable class method) (dissect.executable.elf.elf.SegmentTable class method) from_entry() (in module dissect.target.helpers.magic.magic) from_fh (in module dissect.target.helpers.magic.magic) from_fh() (dissect.executable.pe.pe.Section class method) (dissect.fve.bde.information.Datum class method) (dissect.ntfs.attr.Attribute class method) (dissect.ntfs.attr.AttributeRecord class method) (dissect.ntfs.mft.MftRecord class method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSConfig class method) from_file() (in module dissect.target.helpers.magic.magic) from_header() (dissect.archive.wim.Resource class method) from_id() (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm class method) (dissect.target.plugins.os.windows.dpapi.crypto.HashAlgorithm class method) from_json() (dissect.fve.luks.metadata.JsonItem class method) from_line() (dissect.target.plugins.os.unix.linux.proc.NetSocket class method) (dissect.target.plugins.os.unix.linux.proc.PacketSocket class method) (dissect.target.plugins.os.unix.linux.proc.UnixSocket class method) (dissect.target.plugins.os.windows.log.schedlgu.SchedLgU class method) from_luks1_header() (dissect.fve.luks.metadata.Metadata class method) from_name() (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm class method) (dissect.target.plugins.os.windows.dpapi.crypto.HashAlgorithm class method) from_path() (dissect.target.tools.dump.DumpState class method) from_posix() (flow.record.fieldtypes.command class method) (flow.record.fieldtypes.path class method) from_record() (dissect.database.ese.ntds.objects.object.Object class method) from_section_table() (dissect.executable.elf.elf.Section class method) from_segment_table() (dissect.executable.elf.elf.Segment class method) from_short_header() (dissect.archive.wim.Resource class method) from_str() (acquire.acquire.dynamic.windows.types.UNICODE_STRING class method) from_stream() (dissect.eventlog.bxml.BxmlTemplateDescriptor class method) from_symbol_table() (dissect.executable.elf.elf.Symbol class method) from_text() (dissect.hypervisor.descriptor.vmx.KeySafe class method) (dissect.hypervisor.util.envelope.KeyStore class method) from_unix() (in module dissect.util.ts) from_unix_ms() (in module dissect.util.ts) from_unix_ns() (in module dissect.util.ts) from_unix_us() (in module dissect.util.ts) from_user_home() (in module acquire.acquire.acquire) from_windows() (flow.record.fieldtypes.command class method) (flow.record.fieldtypes.path class method) (flow.record.fieldtypes.uri class method) from_xml() (dissect.hypervisor.disk.hdd.XMLEntry class method) frombuf() (dissect.hypervisor.util.vmtar.VisorTarInfo class method) (dissect.util.cpio.CpioInfo class method) fromtarfile() (dissect.util.cpio.CpioInfo class method) FS (class in dissect.apfs.objects.fs) fs (dissect.apfs.objects.fs.Snapshot attribute) (dissect.cramfs.cramfs.INode attribute) (dissect.fat.fat.DirectoryEntry attribute) (dissect.fat.fat.RootDirectory attribute) (dissect.ffs.ffs.CylinderGroup attribute) (dissect.ffs.ffs.INode attribute) (dissect.jffs.jffs2.DataStream attribute) (dissect.jffs.jffs2.DirEntry attribute) (dissect.jffs.jffs2.INode attribute) (dissect.qnxfs.qnx4.INode4 attribute) (dissect.qnxfs.qnx6.INode6 attribute) (dissect.squashfs.squashfs.FileStream attribute) (dissect.squashfs.squashfs.INode attribute) (dissect.target.filesystem.DirEntry attribute) (dissect.target.filesystem.FilesystemEntry attribute) (dissect.target.filesystem.LayerDirEntry attribute) (dissect.target.filesystem.RootDirEntry attribute) (dissect.target.filesystem.RootFilesystemEntry attribute) (dissect.target.filesystem.VirtualDirEntry attribute) (dissect.target.filesystems.ad1.AD1DirEntry attribute) (dissect.target.filesystems.ad1.AD1FilesystemEntry attribute) (dissect.target.filesystems.apfs.ApfsDirEntry attribute) (dissect.target.filesystems.apfs.ApfsFilesystemEntry attribute) (dissect.target.filesystems.btrfs.BtrfsDirEntry attribute) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry attribute) (dissect.target.filesystems.btrfs.BtrfsSubvolumeFilesystem attribute) (dissect.target.filesystems.cb.CbDirEntry attribute) (dissect.target.filesystems.cramfs.CramfsDirEntry attribute) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry attribute) (dissect.target.filesystems.dir.DirectoryDirEntry attribute) (dissect.target.filesystems.exfat.ExfatDirEntry attribute) (dissect.target.filesystems.extfs.ExtDirEntry attribute) (dissect.target.filesystems.extfs.ExtFilesystemEntry attribute) (dissect.target.filesystems.fat.FatDirEntry attribute) (dissect.target.filesystems.fat.FatFilesystemEntry attribute) (dissect.target.filesystems.ffs.FfsDirEntry attribute) (dissect.target.filesystems.ffs.FfsFilesystemEntry attribute) (dissect.target.filesystems.itunes.ITunesFilesystemEntry attribute) (dissect.target.filesystems.jffs.JffsDirEntry attribute) (dissect.target.filesystems.jffs.JffsFilesystemEntry attribute) (dissect.target.filesystems.nfs.NfsDirEntry attribute) (dissect.target.filesystems.nfs.NfsFilesystemEntry attribute) (dissect.target.filesystems.ntds.NtdsFilesystemEntry attribute) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry attribute) (dissect.target.filesystems.qnxfs.QnxDirEntry attribute) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry attribute) (dissect.target.filesystems.smb.SmbDirEntry attribute) (dissect.target.filesystems.smb.SmbFilesystemEntry attribute) (dissect.target.filesystems.squashfs.SquashFSDirEntry attribute) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry attribute) (dissect.target.filesystems.vbk.VbkDirEntry attribute) (dissect.target.filesystems.vbk.VbkFilesystemEntry attribute) (dissect.target.filesystems.vmfs.VmfsDirEntry attribute) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry attribute) (dissect.target.filesystems.xfs.XfsDirEntry attribute) (dissect.target.filesystems.xfs.XfsFilesystemEntry attribute) (dissect.target.filesystems.zip.ZipFilesystemEntry attribute) (dissect.target.helpers.mount.DissectMount attribute) (dissect.target.target.Target attribute) (dissect.target.volume.Volume attribute) FS3_AddrType (in module dissect.vmfs.c_vmfs) FS3_Config (in module dissect.vmfs.c_vmfs) FS3_DescriptorType (in module dissect.vmfs.c_vmfs) FS3_ResourceTypeID (in module dissect.vmfs.c_vmfs) FS3_ZeroLevelAddrType (in module dissect.vmfs.c_vmfs) FS6_DirBlockType (in module dissect.vmfs.c_vmfs) fs_attrs() (in module dissect.target.helpers.fsutil) fs_index (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj attribute) fs_name (dissect.fat.exfat.ExFAT attribute) FS_NAMES (in module dissect.volume.disk.schemes.bsd) FS_NEEDLES (in module dissect.target.loaders.phobos) FS_ROOT_TUPLE (dissect.target.loaders.uac.UacTarSubloader attribute) FS_SUPPORTED (dissect.target.plugins.filesystem.icat.ICatPlugin attribute) fs_tree (dissect.btrfs.btrfs.Btrfs attribute) fsb_to_bb() (in module dissect.xfs.xfs) fsbtodb() (in module dissect.ffs.ffs) fsid (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) FT_MAP (in module dissect.btrfs.c_btrfs) ftime (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx6.INode6 property) fua (dissect.volume.lvm.metadata.WriteCacheSegment attribute) FULL (acquire.acquire.acquire.BsdProfile attribute) (acquire.acquire.acquire.ESXiProfile attribute) (acquire.acquire.acquire.LinuxProfile attribute) (acquire.acquire.acquire.MacOSProfile attribute) (acquire.acquire.acquire.ProxmoxProfile attribute) (acquire.acquire.acquire.WindowsProfile attribute) full_path (dissect.btrfs.btrfs.INode property) (dissect.ntfs.usnjrnl.UsnRecord property) full_path() (dissect.ntfs.attr.FileName method) (dissect.ntfs.mft.MftRecord method) full_paths() (dissect.ntfs.mft.MftRecord method) FULL_RESOURCE_DESCRIPTOR (dissect.target.helpers.regutil.RegistryValueType attribute) fullmap() (dissect.eventlog.wevtutil.WevtutilWrapper method) FULLSIZE (dissect.database.ese.lcmapstring.CASE attribute) FULLWIDTH (dissect.database.ese.lcmapstring.CASE attribute) func (dissect.target.helpers.cache.Cache attribute) (dissect.target.plugin.FunctionDescriptor property) (dissect.target.tools.dump.RecordStreamElement attribute) (dissect.target.tools.dump.Sink attribute) FUNC_DOC_TEMPLATE (in module dissect.target.helpers.docs) func_errors (dissect.target.tools.utils.report.TargetExecutionReport attribute) FUNC_EXEC (dissect.target.target.Event attribute) FUNC_EXEC_ERROR (dissect.target.target.Event attribute) func_execs (dissect.target.tools.utils.report.TargetExecutionReport attribute) FUNCTION_OUTPUT_DESCRIPTION (in module dissect.target.helpers.docs) FUNCTION_WHITELIST (in module flow.record.selector) function_with_an_exception() (in module codestyle) FunctionDescriptor (class in dissect.target.plugin) FunctionDescriptorLookup (class in dissect.target.plugin) functions (dissect.executable.pe.directory.delay_import.DelayImportModule property) (dissect.executable.pe.directory.export.ExportDirectory property) (dissect.executable.pe.directory.imports.ImportModule property) (dissect.target.plugin.PluginDescriptor attribute) (dissect.target.tools.dump.DumpState attribute) functions() (in module dissect.target.plugin) FunctionTuple (in module dissect.target.target) fuse_config_p (in module dissect.target.helpers.mount) fuse_conn_info_p (in module dissect.target.helpers.mount) fusion_uuid (dissect.apfs.objects.nx_superblock.NxSuperblock property) FVE_DATUM_ROLE (in module dissect.fve.bde.c_bde) FVE_DATUM_TYPE (in module dissect.fve.bde.c_bde) FVE_KEY_FLAG (in module dissect.fve.bde.c_bde) FVE_KEY_PROTECTOR (in module dissect.fve.bde.c_bde) FVE_KEY_TYPE (in module dissect.fve.bde.c_bde) FVE_STATE (in module dissect.fve.bde.c_bde) fvek_type (dissect.fve.bde.information.Dataset property) fw (dissect.target.containers.fortifw.FortiFirmwareContainer attribute) FW_ACTION (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_APPLICATION (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_BEGIN_TIME (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_DIRECTION (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_END_TIME (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_LOCAL_IP (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_LOCAL_IP6 (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_LOCAL_PORT (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_LOCATION (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_PROTOCOL (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_REMOTE_HOST_NAME (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_REMOTE_IP (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_REMOTE_IP6 (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_REMOTE_PORT (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_REPETITION (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_RULE_ID (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_RULE_NAME (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_SEVERITY (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_TIMESTAMP (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_USER (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) G G703_2MB (dissect.target.plugins.os.windows.network.IfTypes attribute) G703_64K (dissect.target.plugins.os.windows.network.IfTypes attribute) GAME_FOLDER (class in dissect.target.plugins.os.windows.regf.shellbags) GARBAGE_ARGS (dissect.target.helpers.sunrpc.sunrpc.AcceptStat attribute) gateway (dissect.target.plugins.os.unix.linux.network.DhcpLease attribute) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager property) gateway() (dissect.target.plugins.os.unix.linux._os.LinuxPlugin method) gateways (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) (dissect.target.plugins.os.unix.linux.network.ProcConfigParser.ParserContext attribute) gateways() (dissect.target.plugins.os.default.network.NetworkPlugin method) GBitmap (class in dissect.apfs.objects.gbitmap) GBitmapBlock (class in dissect.apfs.objects.gbitmap_block) gdi32 (in module acquire.acquire.gui.win32) GE (dissect.util.ldap.ComparisonOperator attribute) general() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) generate() (dissect.fve.crypto.base.IV method) (dissect.fve.crypto.base.Plain method) (dissect.fve.crypto.base.Plain64 method) (dissect.fve.crypto.base.Plain64BE method) (dissect.fve.crypto.Plain method) (dissect.fve.crypto.Plain64 method) (dissect.fve.crypto.Plain64BE method) (in module dissect.target.plugin) generate_addr() (in module dissect.target.helpers.fsutil) generate_argparse_for_method() (in module dissect.target.tools.utils.cli) generate_argparse_for_plugin() (in module dissect.target.tools.utils.cli) generate_argparse_for_plugin_class() (in module dissect.target.tools.utils.cli) generate_cstruct_stub() (in module dissect.cstruct.tools.stubgen) generate_enum_stub() (in module dissect.cstruct.tools.stubgen) generate_file_stub() (in module dissect.cstruct.tools.stubgen) generate_from_file() (in module dissect.etl.manifest) generate_from_xml() (in module dissect.etl.manifest) generate_functions_json() (in module dissect.target.plugins.general.plugins) generate_functions_overview() (in module dissect.target.plugins.general.plugins) generate_generic_stub() (in module dissect.cstruct.tools.stubgen) generate_record() (in module dissect.target.plugins.filesystem.walkfs) generate_structure_stub() (in module dissect.cstruct.tools.stubgen) generate_typehint() (in module dissect.cstruct.tools.stubgen) GENERATED (in module dissect.target.plugin) generation (dissect.vmfs.lvm.Volume attribute) GENERIC_ATTACHMENT_FIELDS (in module dissect.target.plugins.apps.chat.chat) GENERIC_COOKIE_FIELDS (in module dissect.target.plugins.apps.browser.browser) GENERIC_DOWNLOAD_RECORD_FIELDS (in module dissect.target.plugins.apps.browser.browser) GENERIC_EXTENSION_RECORD_FIELDS (in module dissect.target.plugins.apps.browser.browser) GENERIC_FIELDS (in module dissect.target.plugins.os.windows.ad.ntds) GENERIC_FILE_TRANSFER_RECORD_FIELDS (in module dissect.target.plugins.apps.remoteaccess.remoteaccess) GENERIC_HISTORY_RECORD_FIELDS (in module dissect.target.plugins.apps.browser.browser) GENERIC_LOG_RECORD_FIELDS (in module dissect.target.plugins.apps.remoteaccess.remoteaccess) GENERIC_MESSAGE_FIELDS (in module dissect.target.plugins.apps.chat.chat) GENERIC_PASSWORD_RECORD_FIELDS (in module dissect.target.plugins.apps.browser.browser) GENERIC_TAB_CONTENTS_RECORD_FIELDS (in module dissect.target.plugins.apps.editor.windowsnotepad) GENERIC_THUMBCACHE_FIELDS (in module dissect.target.plugins.os.windows.thumbcache) GENERIC_USER_FIELDS (in module dissect.target.plugins.apps.chat.chat) GenericPlugin (class in dissect.target.plugins.os.unix.bsd.citrix.generic) (class in dissect.target.plugins.os.unix.bsd.darwin.ios.generic) (class in dissect.target.plugins.os.unix.generic) (class in dissect.target.plugins.os.unix.linux.fortios.generic) (class in dissect.target.plugins.os.windows.generic) GenericTarSubLoader (class in dissect.target.loaders.tar) GenericZipSubLoader (class in dissect.target.loaders.zip) GeoRecord (in module flow.record.tools.geoip) georecord_for_ip() (in module flow.record.tools.geoip) get (dissect.archive.vbk.MetaVector attribute) (dissect.database.ese.ntds.database.DataTable attribute) (dissect.fat.fat.FAT attribute) (dissect.hypervisor.disk.vhd.BlockAllocationTable attribute) (dissect.hypervisor.disk.vhdx.BlockAllocationTable attribute) (dissect.ntfs.mft.Mft attribute) get() (acquire.acquire.uploaders.plugin_registry.PluginRegistry method) (dissect.apfs.objects.fs.FS method) (dissect.apfs.objects.fs.INode method) (dissect.archive.vbk.FibMetaSparseTable method) (dissect.archive.vbk.VBK method) (dissect.archive.wim.Image method) (dissect.btrfs.btrfs.Btrfs method) (dissect.btrfs.btrfs.INode method) (dissect.btrfs.btrfs.Subvolume method) (dissect.btrfs.tree.Cursor method) (dissect.cim.objects.Objects method) (dissect.cramfs.cramfs.CramFS method) (dissect.database.ese.ntds.objects.object.Object method) (dissect.database.ese.record.Record method) (dissect.database.ese.record.RecordData method) (dissect.database.sqlite3.sqlite3.Row method) (dissect.eventlog.bxml.BxmlSub method) (dissect.evidence.ad1.ad1.AD1 method) (dissect.executable.pe.directory.resource.ResourceDirectory method) (dissect.executable.pe.directory.resource.ResourceDirectoryEntry method) (dissect.extfs.extfs.ExtFS method) (dissect.fat.fat.FATFS method) (dissect.ffs.ffs.FFS method) (dissect.hypervisor.disk.vhdx.MetadataTable method) (dissect.hypervisor.disk.vhdx.RegionTable method) (dissect.jffs.jffs2.JFFS2 method) (dissect.ntfs.mft.MftRecord method) (dissect.ole.ole.OLE method) (dissect.qnxfs.qnx4.QNX4 method) (dissect.qnxfs.qnx6.QNX6 method) (dissect.squashfs.squashfs.SquashFS method) (dissect.target.filesystem.DirEntry method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerDirEntry method) (dissect.target.filesystem.LayerFilesystem method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.RootDirEntry method) (dissect.target.filesystem.RootFilesystem method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualDirEntry method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualFilesystem method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.ad1.AD1DirEntry method) (dissect.target.filesystems.ad1.AD1Filesystem method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.apfs.ApfsDirEntry method) (dissect.target.filesystems.apfs.ApfsFilesystem method) (dissect.target.filesystems.apfs.ApfsFilesystemEntry method) (dissect.target.filesystems.apfs.ApfsVolumeFilesystem method) (dissect.target.filesystems.btrfs.BtrfsDirEntry method) (dissect.target.filesystems.btrfs.BtrfsFilesystem method) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsSubvolumeFilesystem method) (dissect.target.filesystems.cb.CbDirEntry method) (dissect.target.filesystems.cb.CbFilesystem method) (dissect.target.filesystems.cb.CbFilesystemEntry method) (dissect.target.filesystems.cramfs.CramfsDirEntry method) (dissect.target.filesystems.cramfs.CramfsFilesystem method) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry method) (dissect.target.filesystems.dir.DirectoryDirEntry method) (dissect.target.filesystems.dir.DirectoryFilesystem method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.exfat.ExfatDirEntry method) (dissect.target.filesystems.exfat.ExfatFilesystem method) (dissect.target.filesystems.exfat.ExfatFilesystemEntry method) (dissect.target.filesystems.extfs.ExtDirEntry method) (dissect.target.filesystems.extfs.ExtFilesystem method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.fat.FatDirEntry method) (dissect.target.filesystems.fat.FatFilesystem method) (dissect.target.filesystems.fat.FatFilesystemEntry method) (dissect.target.filesystems.ffs.FfsDirEntry method) (dissect.target.filesystems.ffs.FfsFilesystem method) (dissect.target.filesystems.ffs.FfsFilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystem method) (dissect.target.filesystems.jffs.JffsDirEntry method) (dissect.target.filesystems.jffs.JffsFilesystem method) (dissect.target.filesystems.jffs.JffsFilesystemEntry method) (dissect.target.filesystems.nfs.NfsDirEntry method) (dissect.target.filesystems.nfs.NfsFilesystem method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.ntds.NtdsDirEntry method) (dissect.target.filesystems.ntds.NtdsFilesystem method) (dissect.target.filesystems.ntds.NtdsFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsDirEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystem method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.qnxfs.QnxDirEntry method) (dissect.target.filesystems.qnxfs.QnxFilesystem method) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry method) (dissect.target.filesystems.smb.SmbDirEntry method) (dissect.target.filesystems.smb.SmbFilesystem method) (dissect.target.filesystems.smb.SmbFilesystemEntry method) (dissect.target.filesystems.squashfs.SquashFSDirEntry method) (dissect.target.filesystems.squashfs.SquashFSFilesystem method) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystem method) (dissect.target.filesystems.vbk.VbkDirEntry method) (dissect.target.filesystems.vbk.VbkFilesystem method) (dissect.target.filesystems.vbk.VbkFilesystemEntry method) (dissect.target.filesystems.vmfs.VmfsDirEntry method) (dissect.target.filesystems.vmfs.VmfsFilesystem method) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsDirEntry method) (dissect.target.filesystems.xfs.XfsFilesystem method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystem method) (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) (dissect.target.helpers.configutil.ConfigurationParser method) (dissect.target.helpers.regutil.KeyCollection method) (dissect.target.helpers.regutil.RegistryKey method) (dissect.target.loaders.itunes.FileInfo method) (dissect.target.plugins.general.users.UsersPlugin method) (dissect.target.plugins.os.unix.esxi.configstore.ConfigstorePlugin method) (dissect.target.plugins.os.unix.esxi.esxconf.EsxConfPlugin method) (dissect.target.plugins.os.unix.linux.proc.ProcProcess method) (dissect.target.plugins.os.windows.search.TableRecord method) (dissect.util.plist.NSKeyedArchiver method) (dissect.util.plist.NSObject method) (dissect.vmfs.descriptor.FileDescriptor method) (dissect.vmfs.resource.ResourceManager method) (dissect.vmfs.vmfs.VMFS method) (dissect.xfs.xfs.XFS method) get_actions() (dissect.target.plugins.os.windows.tasks.job.AtTask method) (dissect.target.plugins.os.windows.tasks.xml.XmlTask method) get_all_fields() (flow.record.base.RecordDescriptor method) get_all_keys() (in module dissect.target.helpers.keychain) get_all_paths() (dissect.target.plugin.Plugin method) get_allocation_group() (dissect.xfs.xfs.XFS method) get_app_context() (in module flow.record.context) get_array() (dissect.cim.classes.DataRegion method) get_cache_paths() (dissect.target.plugins.os.windows.thumbcache.ThumbcachePlugin method) get_char() (in module dissect.volume.vinum.config) get_children_info() (in module dissect.target.tools.info) get_class_definition() (dissect.cim.cim.CIM method) get_class_instance() (dissect.cim.cim.CIM method) get_cluster_chain() (dissect.fat.exfat.ExFAT method) get_cluster_type() (in module dissect.hypervisor.disk.qcow2) get_config_value() (dissect.target.plugins.os.unix.linux.network_managers.LinuxNetworkManager method) get_counts_per_module_per_outcome() (acquire.acquire.collector.CollectionReport method) get_creator_sid() (in module dissect.target.plugins.os.windows.cim) get_current_utc_time() (in module dissect.target.tools.dump) get_data_path() (in module dissect.target.plugins.apps.container.docker) get_days_of_week() (dissect.target.plugins.os.windows.tasks.job.AtTask method) get_descriptor() (dissect.volume.vss.BlockMap method) get_device() (dissect.target.loaders.cb.CbLoader method) get_disks_info() (in module dissect.target.tools.info) get_docstring() (in module dissect.target.helpers.docs) get_drive_letter() (in module dissect.target.plugins.filesystem.ntfs.utils) get_dst_range() (in module dissect.target.plugins.os.windows.datetime) get_element() (dissect.target.plugins.os.windows.tasks.xml.XmlTask method) get_entry (dissect.cim.mappings.Mapping attribute) get_external_module_paths() (in module dissect.target.plugin) get_field_tuples() (flow.record.base.RecordDescriptor method) get_file_handler() (in module acquire.acquire.log) get_file_object() (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry method) get_filetime_for_event() (dissect.etl.etl.ETL method) get_filter_name() (in module dissect.target.plugins.os.windows.cim) get_flags_data() (dissect.target.plugins.os.windows.tasks.job.AtTask method) get_formatted_exception() (in module acquire.acquire.utils) get_formatted_report() (dissect.target.tools.utils.report.ExecutionReport method) get_full_formatted_report() (in module acquire.acquire.collector) get_full_path() (in module dissect.ntfs.util) get_full_sink_path() (dissect.target.tools.dump.DumpState method) get_func_description() (in module dissect.target.helpers.docs) get_function() (dissect.target.target.Target method) get_handle_name() (in module acquire.acquire.dynamic.windows.handles) get_handle_type_info() (in module acquire.acquire.dynamic.windows.handles) get_handles() (in module acquire.acquire.dynamic.windows.handles) get_inode (dissect.extfs.extfs.ExtFS attribute) get_inode() (dissect.xfs.xfs.AllocationGroup method) (dissect.xfs.xfs.XFS method) get_invalid_sinks() (dissect.target.tools.dump.DumpState method) get_kernel_hash() (in module dissect.target.plugins.os.unix.linux.fortios._os) get_keys_for_identifier() (dissect.target.volume.EncryptedVolumeSystem method) get_keys_for_identifiers() (dissect.target.volume.EncryptedVolumeSystem method) get_keys_for_provider() (in module dissect.target.helpers.keychain) get_keys_without_identifier() (dissect.target.volume.EncryptedVolumeSystem method) get_keys_without_provider() (in module dissect.target.helpers.keychain) get_log_files() (dissect.target.plugins.apps.av.mcafee.McAfeePlugin method) get_log_paths() (dissect.target.plugins.apps.webserver.caddy.CaddyPlugin method) (dissect.target.plugins.os.unix.log.audit.AuditPlugin method) get_logger() (in module dissect.target.helpers.logging) get_logs() (dissect.target.plugins.os.windows.log.evt.WindowsEventlogsMixin method) get_logs_from_dir() (dissect.target.plugins.os.windows.log.evt.WindowsEventlogsMixin method) get_logs_from_registry() (dissect.target.plugins.os.windows.log.evt.WindowsEventlogsMixin method) get_long_value() (dissect.database.ese.table.Table method) get_meta_blob() (dissect.archive.vbk.VBK method) get_modifier_function() (in module dissect.target.helpers.record_modifier) get_months_of_year() (dissect.target.plugins.os.windows.tasks.job.AtTask method) get_mounts_info() (in module dissect.target.tools.info) get_name() (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES class method) get_names() (dissect.target.tools.shell.ExtendedCmd method) get_nested_attr() (in module dissect.target.tools.dump) get_optional() (in module dissect.target.plugins.os.unix.log.journal) get_owner_and_group() (in module dissect.target.plugins.filesystem.ntfs.utils) get_path_details() (in module acquire.acquire.hashes) get_paths() (dissect.target.plugin.Plugin method) get_paths_from_dir() (in module acquire.acquire.hashes) get_plugin_description() (in module dissect.target.helpers.docs) get_plugin_functions_desc() (in module dissect.target.helpers.docs) get_plugin_output_records() (in module dissect.target.tools.diff) get_plugin_overview() (in module dissect.target.helpers.docs) get_primary_key_from_constraint() (in module dissect.database.sqlite3.util) get_property() (in module dissect.target.tools.info) get_property_value_safe() (in module dissect.target.plugins.os.windows.cim) get_raw() (dissect.target.plugins.os.windows.tasks.xml.XmlTask method) get_record_by_type() (flow.record.base.GroupedRecord method) get_record_size() (in module dissect.target.plugins.filesystem.ntfs.utils) get_records_per_module_per_outcome() (acquire.acquire.collector.CollectionReport method) get_relative_inode() (dissect.xfs.xfs.XFS method) get_relative_sink_path() (in module dissect.target.tools.dump) get_report_summary() (in module acquire.acquire.collector) get_required_fields() (flow.record.base.RecordDescriptor static method) get_resource_stream() (in module dissect.etl.manifest) get_resource_string() (in module dissect.etl.manifest) (in module dissect.target.helpers.localeutil) get_runs() (dissect.hypervisor.disk.vmdk.SparseDisk method) get_sink() (dissect.target.tools.dump.DumpState method) get_sink_dir_by_func() (in module dissect.target.tools.dump) get_sink_dir_by_target() (in module dissect.target.tools.dump) get_sink_filename() (in module dissect.target.tools.dump) get_sink_writer() (in module dissect.target.tools.dump) get_snapshot_chain() (dissect.hypervisor.disk.hdd.Descriptor method) get_spec_additions() (acquire.acquire.acquire.ActiveDirectory class method) (acquire.acquire.acquire.CamHistory class method) (acquire.acquire.acquire.DHCP class method) (acquire.acquire.acquire.EventLogs class method) (acquire.acquire.acquire.Exchange class method) (acquire.acquire.acquire.History class method) (acquire.acquire.acquire.Module class method) (acquire.acquire.acquire.MSSQL class method) (acquire.acquire.acquire.NTDS class method) (acquire.acquire.acquire.Registry class method) (acquire.acquire.acquire.SharePoint class method) (acquire.acquire.acquire.Webserver class method) (acquire.acquire.acquire.WER class method) (acquire.acquire.acquire.WinArpCache class method) (acquire.acquire.acquire.WinMemFiles class method) (acquire.acquire.acquire.WinRDPSessions class method) get_specs() (acquire.acquire.acquire.FileHashes class method) get_state_path() (dissect.target.tools.dump.DumpState class method) get_stdin() (in module flow.record.utils) get_stdout() (in module flow.record.utils) get_string() (dissect.cim.classes.DataRegion method) get_subcluster_range_type() (in module dissect.hypervisor.disk.qcow2) get_subcluster_type() (in module dissect.hypervisor.disk.qcow2) get_table() (dissect.database.ese.tools.sru.SRU method) get_table_entries() (dissect.database.ese.tools.sru.SRU method) get_table_records() (dissect.database.ese.tools.ual.UAL method) (dissect.target.plugins.os.windows.wua_history.WuaHistoryPlugin method) get_tables() (dissect.database.ese.tools.ual.UAL method) get_target_info() (in module dissect.target.tools.info) get_target_logger() (in module dissect.target.target) get_target_report() (dissect.target.tools.utils.report.ExecutionReport method) get_targets() (in module dissect.target.tools.dump) get_tasks() (dissect.target.plugins.os.windows.tasks.xml.ScheduledTasks method) get_token() (dissect.cstruct.expression.ExpressionTokenizer method) get_triggers() (dissect.target.plugins.os.windows.tasks.job.AtTask method) (dissect.target.plugins.os.windows.tasks.xml.XmlTask method) get_type() (in module flow.record.selector) get_user() (dissect.target.plugins.os.windows.registry.RegistryPlugin method) get_user_details() (dissect.target.plugins.os.windows.registry.RegistryPlugin method) get_user_name() (in module acquire.acquire.utils) get_utc_now() (in module acquire.acquire.utils) get_utc_now_str() (in module acquire.acquire.utils) get_value() (dissect.cim.classes.DataRegion method) get_volume_identifier() (in module dissect.target.plugins.filesystem.ntfs.utils) get_volumes_info() (in module dissect.target.tools.info) getattr (dissect.target.helpers.mount.DissectMount attribute) getattr() (dissect.target.helpers.nfs.client.nfs.Client method) GetAttrProc (in module dissect.target.helpers.nfs.nfs3) GetCurrentProcessId (in module acquire.acquire.dynamic.windows.handles) getfields() (flow.record.base.RecordDescriptor method) GetLastError (in module acquire.acquire.dynamic.windows.handles) getNextRow() (dissect.database.ese.tools.impacket.ESENT_DB method) GetPortProc (in module dissect.target.helpers.sunrpc.sunrpc) gettypename() (flow.record.base.DynamicFieldtypeModule method) getxattr (dissect.target.helpers.mount.DissectMount attribute) GGP (dissect.target.helpers.network.IANAProtocol attribute) gid (dissect.apfs.objects.fs.INode property) (dissect.btrfs.btrfs.INode property) (dissect.cramfs.cramfs.INode property) (dissect.jffs.jffs2.INode property) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx6.INode6 property) (dissect.squashfs.squashfs.INode property) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) (dissect.target.helpers.sunrpc.sunrpc.AuthUnix attribute) gids (dissect.target.helpers.sunrpc.sunrpc.AuthUnix attribute) GIGABITETHERNET (dissect.target.plugins.os.windows.network.IfTypes attribute) GLOB (acquire.acquire.collector.ArtifactType attribute) (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadPlugin attribute) glob() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.helpers.compat.path_313.TargetPath method) glob_ext() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.plugins.os.windows.registry.RegistryPlugin method) (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.regutil) glob_ext0() (in module dissect.target.helpers.regutil) glob_ext1() (in module dissect.target.helpers.regutil) GLOB_INDEX_REGEX (in module dissect.target.helpers.regutil) GLOB_MAGIC_REGEX (in module dissect.target.helpers.regutil) glob_split() (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.regutil) GLOBAL (dissect.target.plugins.os.unix.bsd.darwin.ios._os.Config attribute) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin attribute) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin attribute) global_def (in module dissect.etl.c_etl) global_pointer (dissect.executable.pe.pe.PE property) GLOBS (dissect.target.plugins.os.windows.rdpcache.RdpCachePlugin attribute) GMTP (dissect.target.helpers.network.IANAProtocol attribute) GnomeTrashPlugin (class in dissect.target.plugins.os.unix.trash) gnulocate_def (in module dissect.target.plugins.os.unix.locate.gnulocate) GNULocateFile (class in dissect.target.plugins.os.unix.locate.gnulocate) GNULocatePlugin (class in dissect.target.plugins.os.unix.locate.gnulocate) GNULocateRecord (in module dissect.target.plugins.os.unix.locate.gnulocate) GPT (class in dissect.volume.disk.schemes.gpt) gpt (dissect.volume.disk.schemes.gpt.GPT attribute) gpt_def (in module dissect.volume.disk.schemes.gpt) GR303_IDT (dissect.target.plugins.os.windows.network.IfTypes attribute) GR303_RDT (dissect.target.plugins.os.windows.network.IfTypes attribute) grain (dissect.archive.vbk.SnapshotSlot attribute) granted_access (acquire.acquire.dynamic.windows.types.Handle attribute) (acquire.acquire.dynamic.windows.types.SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX property) GRE (dissect.target.helpers.network.IANAProtocol attribute) Greater (dissect.ntfs.index.Match attribute) GREEK (dissect.database.ese.lcmapstring.SCRIPT attribute) GREEN (dissect.target.helpers.cyber.Color attribute) (dissect.target.tools.shell.AnsiColors attribute) Group (class in dissect.database.ese.ntds.objects.group) group (dissect.database.bsd.tools.rpm.PackageEntry attribute) (dissect.database.ese.ntds.sd.SecurityDescriptor attribute) (dissect.etl.headers.system.SystemSpecificHeader property) (dissect.ntfs.secure.SecurityDescriptor attribute) group() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) group_cursor (dissect.executable.pe.directory.resource.ResourceDirectory property) GROUP_GUID_MAP (in module dissect.etl.utils) group_icon (dissect.executable.pe.directory.resource.ResourceDirectory property) group_id (acquire.acquire.esxi.EsxiMemoryManager attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) group_policies() (dissect.database.ese.ntds.ntds.NTDS method) (dissect.target.plugins.os.windows.ad.ntds.NtdsPlugin method) GroupedRecord (class in flow.record.base) GroupPolicyContainer (class in dissect.database.ese.ntds.objects.grouppolicycontainer) groups() (dissect.database.ese.ntds.ntds.NTDS method) (dissect.database.ese.ntds.objects.user.User method) groups_count (dissect.extfs.extfs.ExtFS attribute) groups_offset (dissect.extfs.extfs.ExtFS attribute) GROWABLE (dissect.volume.vinum.config.PlexState attribute) (dissect.volume.vinum.config.SDState attribute) gs (dissect.executable.pe.directory.debug.VcFeatureDebugEntry property) GT (dissect.util.ldap.ComparisonOperator attribute) guard_flags (dissect.executable.pe.directory.load_config.LoadConfigDirectory property) guards (dissect.executable.pe.directory.debug.VcFeatureDebugEntry property) GUI (class in acquire.acquire.gui.base) gui() (acquire.acquire.gui.base.GUI class method) gui_display_text (acquire.acquire.gui.win32.Win32 attribute) guid (dissect.database.ese.ntds.objects.object.Object property) GUID (dissect.etl.headers.headers.EventProperty attribute) (dissect.eventlog.bxml.BxmlType attribute) guid (dissect.evidence.asdf.asdf.AsdfSnapshot attribute) (dissect.evidence.asdf.asdf.AsdfWriter attribute) (dissect.fve.bde.bde.BootSector attribute) (dissect.fve.bde.information.GuidDatum property) (dissect.hypervisor.disk.asif.ASIF attribute) (dissect.hypervisor.disk.hdd.Image attribute) (dissect.hypervisor.disk.hdd.Shot attribute) (dissect.squashfs.squashfs.INode property) (dissect.target.loaders.cellebrite.DeviceInfo attribute) (dissect.target.loaders.res.File attribute) (dissect.target.loaders.res.Folder attribute) (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry attribute) (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) (dissect.target.plugins.os.windows.regf.shellbags.CONTROL_PANEL attribute) (dissect.target.plugins.os.windows.regf.shellbags.GAME_FOLDER attribute) (dissect.target.plugins.os.windows.regf.shellbags.ROOT_FOLDER attribute) (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN0 attribute) (dissect.target.plugins.os.windows.regf.shellbags.USERS_PROPERTY_VIEW attribute) (dissect.target.volume.Volume attribute) (dissect.volume.ddf.ddf.ControllerData attribute) (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) (dissect.volume.ddf.ddf.PhysicalDiskData attribute) (dissect.volume.ddf.ddf.PhysicalDiskRecord attribute) (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) (dissect.volume.ddf.ddf.VirtualDiskRecord attribute) (dissect.volume.disk.partition.Partition attribute) guid_timestamp (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) GuidDatum (class in dissect.fve.bde.information) GUIError GZIP (dissect.target.tools.dump.Compression attribute) GZIP_MAGIC (in module flow.record.base) H H323_GATEKEEPER (dissect.target.plugins.os.windows.network.IfTypes attribute) H323_PROXY (dissect.target.plugins.os.windows.network.IfTypes attribute) Handle (class in acquire.acquire.dynamic.windows.types) handle (dissect.target.helpers.nfs.nfs3.DirOpArgs attribute) (dissect.target.helpers.nfs.nfs3.EntryPlus attribute) (dissect.target.loaders.smb.SmbRegistryHive attribute) (dissect.target.loaders.smb.SmbRegistryKey property) handle_attributes (acquire.acquire.dynamic.windows.types.Handle attribute) (acquire.acquire.dynamic.windows.types.SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX property) handle_cat() (in module dissect.evidence.tools.asdf.meta) handle_hash() (in module dissect.evidence.tools.asdf.meta) handle_ls() (in module dissect.evidence.tools.asdf.meta) handle_type (acquire.acquire.dynamic.windows.types.Handle attribute) handle_value (acquire.acquire.dynamic.windows.types.Handle attribute) (acquire.acquire.dynamic.windows.types.SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX property) HandleNotClosedSuccessfullyError handlers (flow.record.utils.EventHandler attribute) handles() (dissect.target.plugins.apps.edr.acquire.AcquirePlugin method) HardDisk (class in dissect.hypervisor.descriptor.vbox) hardlink_to() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) Hardware (class in dissect.hypervisor.descriptor.vbox) hardware (dissect.hypervisor.descriptor.vbox.Machine property) (dissect.hypervisor.descriptor.vbox.Snapshot property) (dissect.hypervisor.descriptor.vbox.VBox property) has() (dissect.vmfs.resource.ResourceManager method) HAS_ARGON2 (in module dissect.fve.crypto.argon2) HAS_ASN1 (in module dissect.target.helpers.certificate) (in module dissect.target.plugins.apps.browser.firefox) (in module dissect.target.plugins.os.windows.catroot) HAS_AVRO (in module flow.record.base) has_backing_file (dissect.hypervisor.disk.qcow2.QCow2 property) has_backlink() (dissect.database.ese.ntds.database.LinkTable method) has_bek() (dissect.fve.bde.bde.BDE method) HAS_BZ2 (in module flow.record.base) HAS_CARBON_BLACK (in module dissect.target.filesystems.cb) (in module dissect.target.loaders.cb) has_child (dissect.ole.ole.DirectoryEntry property) has_clear_key() (dissect.fve.bde.bde.BDE method) HAS_CRYPTO (in module dissect.apfs.objects.keybag) (in module dissect.database.ese.ntds.pek) (in module dissect.database.sqlite3.encryption.sqlcipher.sqlcipher) (in module dissect.evidence.adcrypt.adcrypt) (in module dissect.evidence.adcrypt.stream) (in module dissect.target.loaders.itunes) (in module dissect.target.plugins.apps.browser.chromium) (in module dissect.target.plugins.apps.browser.firefox) (in module dissect.target.plugins.apps.ssh.putty) (in module dissect.target.plugins.os.unix.linux.fortios._os) (in module dissect.target.plugins.os.windows.dpapi.crypto) (in module dissect.target.plugins.os.windows.dpapi.master_key) (in module dissect.target.plugins.os.windows.lsa) (in module dissect.target.plugins.os.windows.sam) has_data_file (dissect.hypervisor.disk.qcow2.QCow2 property) has_default_value (dissect.cim.c_cim.ClassDefinitionPropertyState attribute) (dissect.cim.cim.Property property) (dissect.cim.classes.ClassInstanceProperty property) has_dynprops (dissect.cim.classes.Dynprops property) HAS_ELASTIC (in module flow.record.adapter.elastic) HAS_ENVELOPE (in module dissect.target.plugins.os.unix.esxi._os) HAS_EXECUTABLE (in module dissect.target.plugins.os.unix.bsd.citrix._os) HAS_FCNTL (in module acquire.acquire.volatilestream) has_field() (in module flow.record.selector) has_function() (dissect.target.target.Target method) HAS_FUSE (in module dissect.target.tools.mount) has_glob_magic() (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.regutil) HAS_HTTPX (in module flow.record.adapter.splunk) HAS_IMPACKET (in module dissect.target.filesystems.smb) (in module dissect.target.loaders.smb) has_left_sibling (dissect.ole.ole.DirectoryEntry property) has_link() (dissect.database.ese.ntds.database.LinkTable method) HAS_LZ4 (in module dissect.target.tools.dump) (in module flow.record.base) has_more (dissect.eventlog.bxml.Token attribute) has_offset() (dissect.volume.vss.StoreBitmap method) HAS_PAHO (in module dissect.target.loaders.mqtt) has_parent (dissect.hypervisor.disk.vhdx.VHDX attribute) has_passphrase() (dissect.fve.bde.bde.BDE method) has_phrase() (dissect.hypervisor.descriptor.vmx.Pair method) HAS_PYCRYPTODOME (in module acquire.acquire.crypt) (in module dissect.hypervisor.descriptor.vmx) (in module dissect.hypervisor.util.envelope) (in module dissect.target.loaders.ab) HAS_PYSTANDALONE (in module acquire.acquire.crypt) (in module dissect.apfs.objects.keybag) (in module dissect.hypervisor.descriptor.vmx) (in module dissect.hypervisor.util.envelope) (in module dissect.target.loaders.itunes) has_recovery_password() (dissect.fve.bde.bde.BDE method) has_right_sibling (dissect.ole.ole.DirectoryEntry property) has_small_pages (dissect.database.ese.ese.ESE property) has_store_data (dissect.volume.vss.Store attribute) has_stream() (dissect.ntfs.mft.MftRecord method) HAS_STRUCTLOG (in module flow.record.tools.rdump) has_subclusters (dissect.hypervisor.disk.qcow2.QCow2 property) HAS_TOML (in module dissect.target.helpers.configutil) HAS_TQDM (in module dissect.evidence.tools.asdf.dd) (in module flow.record.tools.rdump) has_type_reader (dissect.eventlog.bxml.BxmlTemplateDescriptor attribute) HAS_YAML (in module dissect.target.helpers.configutil) (in module dissect.target.plugins.os.unix.linux.network_managers) HAS_YARA (in module dissect.target.plugins.filesystem.yara) HAS_ZONE_INFO (in module flow.record.fieldtypes) HAS_ZSTD (in module dissect.btrfs.stream) (in module dissect.hypervisor.disk.qcow2) (in module dissect.target.plugins.os.unix.locate.plocate) (in module dissect.target.tools.dump) (in module flow.record.base) hash (dissect.apfs.objects.fs.DirectoryEntry property) (dissect.archive.wim.Resource attribute) (dissect.executable.pe.directory.debug.ReproDebugEntry property) (dissect.fve.bde.information.ValidationEntry property) (dissect.fve.luks.metadata.Digest attribute) (dissect.fve.luks.metadata.KeyslotAf attribute) (dissect.fve.luks.metadata.KeyslotArea attribute) (dissect.fve.luks.metadata.KeyslotKdf attribute) HASH (dissect.target.helpers.record_modifier.Modifier attribute) hash (dissect.thumbcache.thumbcache_file.ThumbcacheEntry property) hash() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) hash_alg (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry attribute) hash_algorithm (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) HASH_ALGORITHMS (in module dissect.target.plugins.os.windows.dpapi.crypto) hash_file (dissect.target.plugins.apps.edr.acquire.AcquirePlugin attribute) hash_fileobj() (in module dissect.evidence.tools.asdf.verify) hash_len (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) hash_record (flow.record.adapter.elastic.ElasticWriter attribute) hash_spec (dissect.fve.luks.luks.LUKS attribute) hash_to_image_id() (in module dissect.target.plugins.apps.container.docker) hash_zone_threads (dissect.volume.lvm.metadata.VdoPoolSegment attribute) HashAlgorithm (class in dissect.target.plugins.os.windows.dpapi.crypto) HashedStream (class in dissect.evidence.asdf.stream) hashes() (dissect.target.plugins.apps.edr.acquire.AcquirePlugin method) hashfileobj() (in module dissect.evidence.tools.asdf.meta) HashFunc (class in acquire.acquire.hashes) HashLeaf (class in dissect.regf.regf) hashname() (in module dissect.regf.regf) hashtable() (dissect.target.plugins.os.unix.locate.plocate.PLocateFile method) HAVE_ASTOR (in module flow.record.selector) HCURSOR (in module acquire.acquire.gui.win32) HDD (class in dissect.hypervisor.disk.hdd) hdd (dissect.target.containers.hdd.HddContainer attribute) hdd_def (in module dissect.hypervisor.disk.c_hdd) HddContainer (class in dissect.target.containers.hdd) HDH_1822 (dissect.target.plugins.os.windows.network.IfTypes attribute) HDLC (dissect.target.plugins.os.windows.network.IfTypes attribute) HDS (class in dissect.hypervisor.disk.hdd) hds (dissect.target.containers.hds.HdsContainer attribute) HdsContainer (class in dissect.target.containers.hds) HDSL2 (dissect.target.plugins.os.windows.network.IfTypes attribute) header (acquire.acquire.tools.decrypter.EncryptedFile property) Header (class in dissect.etl.headers.headers) header (dissect.apfs.objects.btree.BTree attribute) (dissect.archive.vbk.Bank attribute) (dissect.archive.vbk.SnapshotSlot attribute) (dissect.archive.vbk.VBK attribute) (dissect.archive.vma.Extent attribute) (dissect.archive.vma.VMA attribute) (dissect.archive.wim.SecurityBlock attribute) (dissect.archive.wim.WIM attribute) (dissect.cim.classes.ClassDefinition attribute) (dissect.cim.classes.ClassInstance attribute) (dissect.clfs.c_clfs.BlockHeader attribute) (dissect.database.bsd.db.Page property) (dissect.database.bsd.tools.rpm.HeaderBlob attribute) (dissect.database.ese.ese.ESE attribute) (dissect.database.ese.ntds.sd.ACE attribute) (dissect.database.ese.ntds.sd.ACL attribute) (dissect.database.ese.ntds.sd.SecurityDescriptor attribute) (dissect.database.ese.page.Page attribute) (dissect.database.ese.record.RecordData attribute) (dissect.database.sqlite3.sqlite3.Page attribute) (dissect.database.sqlite3.sqlite3.SQLite3 attribute) (dissect.database.sqlite3.wal.Frame attribute) (dissect.database.sqlite3.wal.WAL attribute) (dissect.etl.etl.Buffer property) (dissect.etl.etl.EventRecord property) (dissect.etl.headers.headers.Header property) (dissect.etl.headers.logfile.LogfileHeader property) (dissect.eventlog.evt.Evt attribute) (dissect.eventlog.evtx.ElfChnk attribute) (dissect.eventlog.evtx.Evtx attribute) (dissect.eventlog.wevt.CRIM attribute) (dissect.eventlog.wevt.WEVT attribute) (dissect.eventlog.wevt.WEVT_TYPE attribute) (dissect.eventlog.wevt_object.WevtObject attribute) (dissect.evidence.ad1.ad1.LogicalImage attribute) (dissect.evidence.ad1.ad1.SegmentFile attribute) (dissect.evidence.asdf.asdf.AsdfSnapshot attribute) (dissect.evidence.ewf.ewf.EWF attribute) (dissect.evidence.ewf.ewf.Segment attribute) (dissect.evidence.ewf.ewf.TableSection attribute) (dissect.executable.elf.elf.ELF attribute) (dissect.executable.elf.elf.Section attribute) (dissect.executable.elf.elf.Segment attribute) (dissect.executable.pe.directory.export.ExportDirectory property) (dissect.executable.pe.directory.tls.TlsDirectory property) (dissect.executable.pe.pe.Section attribute) (dissect.extfs.journal.CommitBlock attribute) (dissect.extfs.journal.DescriptorBlock attribute) (dissect.fve.bde.eow.EowBitmap attribute) (dissect.fve.bde.eow.EowBitmapRecord attribute) (dissect.fve.bde.eow.EowInformation attribute) (dissect.fve.bde.information.Dataset attribute) (dissect.fve.bde.information.Datum attribute) (dissect.fve.bde.information.Information attribute) (dissect.fve.luks.luks.LUKS attribute) (dissect.hypervisor.descriptor.hyperv.HyperVFile attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageObjectTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageReplayLog attribute) (dissect.hypervisor.disk.asif.ASIF attribute) (dissect.hypervisor.disk.hdd.HDS attribute) (dissect.hypervisor.disk.qcow2.QCow2 attribute) (dissect.hypervisor.disk.qcow2.QCow2Snapshot attribute) (dissect.hypervisor.disk.vdi.VDI attribute) (dissect.hypervisor.disk.vhd.DynamicDisk attribute) (dissect.hypervisor.disk.vhdx.MetadataTable attribute) (dissect.hypervisor.disk.vhdx.ParentLocator attribute) (dissect.hypervisor.disk.vhdx.RegionTable attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) (dissect.hypervisor.disk.vmdk.SparseDisk attribute) (dissect.hypervisor.util.envelope.Envelope attribute) (dissect.ntfs.attr.Attribute attribute) (dissect.ntfs.attr.AttributeHeader attribute) (dissect.ntfs.index.IndexBuffer attribute) (dissect.ntfs.index.IndexEntry attribute) (dissect.ntfs.index.IndexRoot attribute) (dissect.ntfs.mft.MftRecord attribute) (dissect.ntfs.secure.ACE attribute) (dissect.ntfs.secure.ACL attribute) (dissect.ntfs.secure.SecurityDescriptor attribute) (dissect.ntfs.usnjrnl.UsnRecord attribute) (dissect.ole.ole.OLE attribute) (dissect.regf.regf.RegistryHive attribute) (dissect.squashfs.squashfs.INode property) (dissect.target.plugins.os.unix.locate.mlocate.MLocateFile attribute) (dissect.target.plugins.os.unix.locate.plocate.PLocateFile attribute) (dissect.target.plugins.os.unix.log.atop.AtopFile attribute) (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntry attribute) (dissect.target.plugins.os.windows.everything.parser.EverythingDB attribute) (dissect.target.plugins.os.windows.jumplist.CustomDestinationFile attribute) (dissect.target.plugins.os.windows.prefetch.Prefetch attribute) (dissect.target.plugins.os.windows.regf.cit.CIT attribute) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK attribute) (dissect.thumbcache.index.IndexEntry property) (dissect.thumbcache.index.ThumbnailIndex property) (dissect.thumbcache.thumbcache_file.ThumbcacheFile property) (dissect.volume.ddf.ddf.ControllerData attribute) (dissect.volume.ddf.ddf.PhysicalDiskData attribute) (dissect.volume.ddf.ddf.PhysicalDiskRecord attribute) (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) (dissect.volume.ddf.ddf.VirtualDiskRecord attribute) (dissect.volume.dm.btree.Node attribute) (dissect.volume.lvm.physical.LVM2Device attribute) (dissect.volume.vinum.vinum.VinumPhysicalDisk attribute) (dissect.volume.vss.Store attribute) (dissect.volume.vss.VSS attribute) (flow.record.adapter.csvfile.CsvfileWriter attribute) HEADER (in module dissect.target.loaders.cyber) header1 (dissect.fve.luks.luks.LUKS attribute) header2 (dissect.database.ese.page.Page attribute) (dissect.fve.luks.luks.LUKS attribute) header_checksum (dissect.thumbcache.thumbcache_file.ThumbcacheEntry attribute) header_def (in module dissect.eventlog.wevt) header_extensions (dissect.etl.headers.event.EventHeader property) HEADER_FLAG (in module dissect.archive.c_wim) HEADER_FLAGS (dissect.etl.headers.headers.Marker attribute) HEADER_FOOTER_SIZE (in module dissect.util.compression.xz) HEADER_MAGIC (in module acquire.acquire.crypt) HEADER_MASK (dissect.etl.headers.headers.Marker attribute) HEADER_SIZE (dissect.target.plugins.os.unix.locate.plocate.PLocateFile attribute) header_size (dissect.volume.lvm.metadata.VdoPoolSegment attribute) header_type (dissect.etl.headers.headers.Marker property) header_written (flow.record.stream.RecordStreamWriter attribute) HeaderBlob (class in dissect.database.bsd.tools.rpm) headers (dissect.hypervisor.descriptor.hyperv.HyperVFile attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) HEADERS (in module dissect.etl.headers.utils) HeaderSection (class in dissect.evidence.ewf.ewf) HeadOfNamingContext (dissect.database.ese.ntds.util.InstanceType attribute) HeapGuid (in module dissect.etl.utils) HEBREW (dissect.database.ese.lcmapstring.SCRIPT attribute) height (dissect.target.plugins.os.windows.rdpcache.BitmapTile attribute) HEXBIN_SUFFIX (in module dissect.cstruct.expression) hexdigest() (dissect.evidence.asdf.stream.HashedStream method) hexdigit() (dissect.cstruct.expression.ExpressionTokenizer method) hexdump() (in module dissect.cstruct.utils) HEXINT32 (dissect.eventlog.bxml.BxmlType attribute) HEXINT64 (dissect.eventlog.bxml.BxmlType attribute) hidden (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) hiddeninfo (dissect.database.ese.ntds.database.DataTable attribute) hiddentable (dissect.database.ese.ntds.database.DataTable attribute) high (dissect.target.helpers.sunrpc.sunrpc.Mismatch attribute) high_watermark (dissect.volume.lvm.metadata.WriteCacheSegment attribute) highest_page_num (dissect.database.sqlite3.wal.WAL attribute) highest_vcn (dissect.ntfs.attr.AttributeHeader property) HINT_NEEDLE (in module dissect.target.plugins.os.windows.catroot) HIP (dissect.target.helpers.network.IANAProtocol attribute) HIPERLAN2 (dissect.target.plugins.os.windows.network.IfTypes attribute) HIPPI (dissect.target.plugins.os.windows.network.IfTypes attribute) HIPPIINTERFACE (dissect.target.plugins.os.windows.network.IfTypes attribute) HIST_PATH (dissect.target.plugins.apps.chat.msn.MSNPlugin attribute) histdir (dissect.target.tools.shell.TargetCmd attribute) histfilesize (dissect.target.tools.shell.TargetCmd attribute) historical_logical_volumes (dissect.volume.lvm.metadata.VolumeGroup attribute) HistoricalLogicalVolume (class in dissect.volume.lvm.metadata) History (class in acquire.acquire.acquire) history() (dissect.target.plugins.apps.browser.brave.BravePlugin method) (dissect.target.plugins.apps.browser.chrome.ChromePlugin method) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin method) (dissect.target.plugins.apps.browser.chromium.ChromiumPlugin method) (dissect.target.plugins.apps.browser.edge.EdgePlugin method) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin method) (dissect.target.plugins.apps.browser.iexplore.InternetExplorerPlugin method) (dissect.target.plugins.apps.browser.iexplore.WebCache method) (dissect.target.plugins.apps.browser.safari.SafariPlugin method) (dissect.target.plugins.apps.chat.msn.MSNPlugin method) (dissect.target.plugins.apps.editor.editor.EditorPlugin method) (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadPlugin method) (dissect.target.plugins.os.windows.cam.CamPlugin method) History.DirCombinations (class in acquire.acquire.acquire) history_files (acquire.acquire.acquire.History.DirCombinations attribute) HitmanAlertRecord (in module dissect.target.plugins.apps.av.sophos) hitmanlogs() (dissect.target.plugins.apps.av.sophos.SophosPlugin method) hive (dissect.regf.regf.Cell attribute) (dissect.regf.regf.ValueList attribute) (dissect.target.helpers.regutil.RegfHive attribute) (dissect.target.helpers.regutil.RegistryKey attribute) (dissect.target.helpers.regutil.RegistryValue attribute) (dissect.target.loaders.smb.SmbRegistryKey attribute) (dissect.target.plugins.os.windows.syscache.SyscachePlugin attribute) HiveCollection (class in dissect.target.helpers.regutil) HIVES (acquire.acquire.acquire.Registry attribute) hives (dissect.target.helpers.regutil.HiveCollection attribute) (dissect.target.helpers.regutil.RegFlex attribute) HIVES (dissect.target.plugins.apps.productivity.msoffice.MSOffice attribute) HiveUnavailableError HIWORD() (in module acquire.acquire.gui.win32) hmac (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) hmac_algo (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher attribute) hmac_key (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher attribute) HMAC_MAP (in module dissect.hypervisor.descriptor.vmx) hmac_salt (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher attribute) HMP (dissect.target.helpers.network.IANAProtocol attribute) HOMA (dissect.target.helpers.network.IANAProtocol attribute) Home (class in acquire.acquire.acquire) home() (dissect.target.helpers.compat.path_310.TargetPath class method) (dissect.target.helpers.compat.path_311.TargetPath class method) (dissect.target.helpers.compat.path_312.TargetPath class method) (dissect.target.helpers.compat.path_313.TargetPath class method) home_path (dissect.target.plugins.general.users.UserDetails attribute) HOMEDIR_REQUIRED (dissect.database.ese.ntds.util.UserAccountControl attribute) hook_id (dissect.etl.headers.system.SystemSpecificHeader property) HOPOPT (dissect.target.helpers.network.IANAProtocol attribute) host (dissect.target.loaders.cb.CbLoader attribute) (dissect.target.loaders.mqtt.MqttConnection attribute) (flow.record.adapter.splunk.SplunkWriter attribute) host_paths (dissect.target.plugins.apps.webserver.nginx.NginxPlugin attribute) hostname (dissect.cim.utils.ObjectPath attribute) (dissect.target.loaders.remote.RemoteStreamConnection attribute) (flow.record.fieldtypes.uri property) hostname() (dissect.target.loaders.profile.ProfileOSPlugin method) (dissect.target.loaders.res.ResOSPlugin method) (dissect.target.plugin.OSPlugin method) (dissect.target.plugins.os.default._os.DefaultOSPlugin method) (dissect.target.plugins.os.unix._os.UnixPlugin method) (dissect.target.plugins.os.unix.bsd._os.BsdPlugin method) (dissect.target.plugins.os.unix.bsd.citrix._os.CitrixPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin method) (dissect.target.plugins.os.unix.bsd.openbsd._os.OpenBsdPlugin method) (dissect.target.plugins.os.unix.esxi._os.ESXiPlugin method) (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSPlugin method) (dissect.target.plugins.os.windows._os.WindowsPlugin method) HOSTPAD (dissect.target.plugins.os.windows.network.IfTypes attribute) hosts() (dissect.target.plugins.apps.webserver.apache.ApachePlugin method) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin method) HOUR (in module dissect.target.plugins.os.windows.datetime) HSSI (dissect.target.plugins.os.windows.network.IfTypes attribute) hsts() (dissect.target.plugins.apps.shell.wget.WgetPlugin method) html (dissect.executable.pe.directory.resource.ResourceDirectory property) HTTP (flow.record.adapter.splunk.Protocol attribute) HTTPS (flow.record.adapter.splunk.Protocol attribute) human_readable_size() (in module flow.record.fieldtypes) human_size() (in module dissect.target.tools.utils.fs) hwnd (acquire.acquire.gui.win32.Win32 attribute) HYPERCHANNEL (dissect.target.plugins.os.windows.network.IfTypes attribute) hyperv_def (in module dissect.hypervisor.descriptor.c_hyperv) HyperVChildTargetPlugin (class in dissect.target.plugins.child.hyperv) HyperVFile (class in dissect.hypervisor.descriptor.hyperv) HypervisorTraceGuid (in module dissect.etl.utils) HypervisorXTraceGuid (in module dissect.etl.utils) HyperVLoader (class in dissect.target.loaders.hyperv) HyperVStorageFileObject (class in dissect.hypervisor.descriptor.hyperv) HyperVStorageKeyTable (class in dissect.hypervisor.descriptor.hyperv) HyperVStorageKeyTableEntry (class in dissect.hypervisor.descriptor.hyperv) HyperVStorageObjectTable (class in dissect.hypervisor.descriptor.hyperv) HyperVStorageReplayLog (class in dissect.hypervisor.descriptor.hyperv) I I (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) I_NLSP (dissect.target.helpers.network.IANAProtocol attribute) IANAProtocol (class in dissect.target.helpers.network) iat (dissect.executable.pe.pe.PE property) IatDirectory (class in dissect.executable.pe.directory.iat) IATP (dissect.target.helpers.network.IANAProtocol attribute) IBM370PARCHAN (dissect.target.plugins.os.windows.network.IfTypes attribute) icat() (dissect.target.plugins.filesystem.icat.ICatPlugin method) ICatPlugin (class in dissect.target.plugins.filesystem.icat) ICMP (dissect.target.helpers.network.IANAProtocol attribute) icon (dissect.executable.pe.directory.resource.ResourceDirectory property) ICON_ENVIRONMENT_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) iconcache() (dissect.target.plugins.os.windows.thumbcache.ThumbcachePlugin method) IconcacheRecord (in module dissect.target.plugins.os.windows.thumbcache) id (dissect.archive.vma.Device attribute) (dissect.clfs.blf.Container attribute) (dissect.clfs.blf.Stream attribute) (dissect.database.ese.ntds.schema.AttributeEntry attribute) (dissect.database.ese.ntds.schema.ClassEntry attribute) (dissect.etl.headers.event.EventDescriptor attribute) (dissect.etl.headers.headers.MessageTraceHeader property) (dissect.hypervisor.descriptor.vmx.Phrase attribute) (dissect.hypervisor.disk.qcow2.QCow2Snapshot attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) (dissect.hypervisor.util.envelope.KeyStore property) (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm attribute) (dissect.target.plugins.os.windows.dpapi.crypto.HashAlgorithm attribute) (dissect.target.plugins.os.windows.jumplist.JumpListFile property) (dissect.volume.lvm.metadata.HistoricalLogicalVolume attribute) (dissect.volume.lvm.metadata.LogicalVolume attribute) (dissect.volume.lvm.metadata.PhysicalVolume attribute) (dissect.volume.lvm.metadata.VolumeGroup attribute) (dissect.volume.lvm.physical.LVM2Device attribute) (dissect.volume.vinum.vinum.VinumPhysicalDisk attribute) id_map (dissect.database.ese.tools.sru.SRU attribute) id_table (dissect.squashfs.squashfs.SquashFS attribute) idb_flags (dissect.database.ese.index.Index attribute) IDBFLAG (in module dissect.database.ese.c_ese) IDC_ARROW (in module acquire.acquire.gui.win32) identifier (dissect.database.ese.record.TagField attribute) (dissect.database.ese.table.Column attribute) (dissect.eventlog.wevt_object.TEMP attribute) (dissect.fve.bde.information.Dataset attribute) (dissect.fve.bde.information.ExternalInfoDatum property) (dissect.fve.bde.information.VmkInfoDatum property) (dissect.target.helpers.keychain.Key attribute) (dissect.target.loaders.itunes.ITunesBackup property) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK_BEEF0004 attribute) (dissect.target.plugins.os.windows.regf.shellbags.USERS_PROPERTY_VIEW attribute) (dissect.target.plugins.os.windows.regf.shellbags.VOLUME attribute) (dissect.thumbcache.index.IndexEntry property) (dissect.thumbcache.thumbcache_file.ThumbcacheEntry attribute) (flow.record.base.RecordDescriptor property) IDENTIFIER_BYTES (in module dissect.thumbcache.index) identifier_to_str() (in module flow.record.packer) identifiers (dissect.fve.bde.bde.BDE property) identify() (dissect.target.plugins.os.windows.prefetch.Prefetch method) (dissect.target.plugins.os.windows.regf.shimcache.ShimCache method) IDENTITY_DB_FILENAME (dissect.target.plugins.os.windows.ual.UalPlugin attribute) identity_db_parser (dissect.target.plugins.os.windows.ual.UalPlugin attribute) IDENTITY_DB_PATH (dissect.target.plugins.os.windows.ual.UalPlugin attribute) IDI_APPLICATION (in module acquire.acquire.gui.win32) idle_duration (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) idle_restart_on_idle (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) idle_stop_on_idle_end (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) idle_wait_timeout (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) IdleTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) idlist (dissect.shellitem.lnk.lnk.LnkTargetIdList attribute) IDPR (dissect.target.helpers.network.IANAProtocol attribute) IDPR_CMTP (dissect.target.helpers.network.IANAProtocol attribute) IDRP (dissect.target.helpers.network.IANAProtocol attribute) IDSL (dissect.target.plugins.os.windows.network.IfTypes attribute) idx (dissect.eventlog.utils.KeyValueCollection attribute) (dissect.evidence.asdf.asdf.AsdfStream attribute) (dissect.executable.elf.elf.Section attribute) (dissect.executable.elf.elf.Segment attribute) (dissect.executable.elf.elf.Symbol attribute) idx_flags (dissect.database.ese.index.Index attribute) IDX_MEMORY (in module dissect.evidence.asdf.asdf) IDX_METADATA (in module dissect.evidence.asdf.asdf) IDXFLAG (in module dissect.database.ese.c_ese) IEEE1394 (dissect.target.plugins.os.windows.network.IfTypes attribute) IEEE80211 (dissect.target.plugins.os.windows.network.IfTypes attribute) IEEE80212 (dissect.target.plugins.os.windows.network.IfTypes attribute) IEEE8023AD_LAG (dissect.target.plugins.os.windows.network.IfTypes attribute) IF_GSN (dissect.target.plugins.os.windows.network.IfTypes attribute) iface (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) IFMP (dissect.target.helpers.network.IANAProtocol attribute) IfTypes (class in dissect.target.plugins.os.windows.network) IGMP (dissect.target.helpers.network.IANAProtocol attribute) IGNORE_CACHE (in module dissect.target.helpers.cache) IGNORE_FIELDS_FOR_COMPARISON (in module flow.record.base) ignore_fields_for_comparison() (in module flow.record.base) IGNORED_IPS (in module dissect.target.plugins.os.unix.linux.network_managers) IGNORED_SUB_TYPES (in module dissect.target.tools.build_magic) IGNORED_TYPES (in module dissect.target.tools.build_magic) IGP (dissect.target.helpers.network.IANAProtocol attribute) IISLogsPlugin (class in dissect.target.plugins.apps.webserver.iis) IL (dissect.target.helpers.network.IANAProtocol attribute) IL() (dissect.cim.index.Key method) image (acquire.acquire.gui.win32.Win32 attribute) Image (class in dissect.archive.wim) (class in dissect.hypervisor.disk.hdd) image (dissect.archive.wim.DirectoryEntry attribute) image_backing_file (dissect.hypervisor.disk.qcow2.QCow2 attribute) image_base (dissect.executable.pe.pe.PE property) image_data_file (dissect.hypervisor.disk.qcow2.QCow2 attribute) ImageLoadGuid (in module dissect.etl.utils) images (dissect.hypervisor.disk.hdd.Storage attribute) images() (dissect.archive.wim.WIM method) (dissect.target.plugins.apps.container.docker.DockerPlugin method) (dissect.target.plugins.apps.container.podman.PodmanPlugin method) impacket_compat (dissect.database.ese.ese.ESE attribute) import_lazy() (in module dissect.target.helpers.lazy) ImportDirectory (class in dissect.executable.pe.directory.imports) ImportFunction (class in dissect.executable.pe.directory.imports) ImportModule (class in dissect.executable.pe.directory.imports) imports (dissect.executable.pe.pe.PE property) IMT (dissect.target.plugins.os.windows.network.IfTypes attribute) in_cidr() (dissect.target.plugins.os.default.network.NetworkPlugin method) in_transaction (dissect.regf.regf.RegistryHive attribute) in_use (dissect.hypervisor.disk.hdd.HDS attribute) in_use() (dissect.thumbcache.index.IndexEntry method) (dissect.volume.vss.StoreBitmap method) includes (dissect.cstruct.cstruct.cstruct attribute) incoming() (dissect.target.plugins.apps.remoteaccess.teamviewer.TeamViewerPlugin method) incoming_logfiles (dissect.target.plugins.apps.remoteaccess.teamviewer.TeamViewerPlugin attribute) incompatible_features (dissect.apfs.objects.fs.FS property) (dissect.apfs.objects.nx_superblock.NxSuperblock property) INCOMPATIBLE_PLUGIN (dissect.target.target.Event attribute) incompatible_plugins (dissect.target.tools.utils.report.TargetExecutionReport attribute) IncompleteMessage IncrementItem (class in dissect.archive.vbk) indent (flow.record.jsonpacker.JsonRecordPacker attribute) indent() (in module dissect.target.tools.inspect) INDENT_STEP (in module dissect.target.helpers.docs) Indentation (class in dissect.target.helpers.configutil) Index (class in dissect.cim.index) (class in dissect.database.ese.index) (class in dissect.database.sqlite3.sqlite3) (class in dissect.ntfs.index) index (dissect.apfs.objects.fs.FS property) (dissect.cim.cim.Property property) (dissect.cim.classes.ClassDefinitionProperty attribute) (dissect.cim.classes.ClassInstanceProperty property) (dissect.database.ese.cursor.Cursor attribute) (dissect.evidence.adcrypt.stream.ADCryptStream attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTable property) (dissect.hypervisor.disk.asif.Table attribute) (dissect.ntfs.index.IndexBuffer attribute) (dissect.ntfs.index.IndexEntry attribute) (dissect.ntfs.index.IndexRoot attribute) (dissect.target.loaders.mqtt.Broker attribute) (dissect.target.loaders.mqtt.DiskMessage attribute) (dissect.util.compression.lzxpress_huffman.BitString property) (dissect.volume.vss.Store attribute) (flow.record.adapter.elastic.ElasticReader attribute) (flow.record.adapter.elastic.ElasticWriter attribute) index() (dissect.database.ese.table.Table method) (dissect.database.sqlite3.sqlite3.SQLite3 method) (dissect.ntfs.mft.MftRecord method) index_buffer (dissect.ntfs.index.Index attribute) INDEX_ENTRIES (in module dissect.thumbcache.index) index_entries() (dissect.thumbcache.thumbcache.Thumbcache method) INDEX_ENTRY_END (in module dissect.ntfs.c_ntfs) INDEX_ENTRY_NODE (in module dissect.ntfs.c_ntfs) index_memory_size_mb (dissect.volume.lvm.metadata.VdoPoolSegment attribute) INDEX_NODE (in module dissect.ntfs.c_ntfs) INDEX_PAGE_INVALID (in module dissect.cim.c_cim) INDEX_PAGE_INVALID2 (in module dissect.cim.c_cim) INDEX_PAGE_SIZE (in module dissect.cim.c_cim) IndexBuffer (class in dissect.ntfs.index) Indexed (dissect.database.ese.ntds.util.SearchFlags attribute) IndexEntry (class in dissect.ntfs.index) (class in dissect.thumbcache.index) indexes (dissect.database.ese.table.Table attribute) IndexLeaf (class in dissect.regf.regf) IndexPage (class in dissect.cim.index) IndexRecord (in module dissect.target.plugins.os.windows.thumbcache) IndexRoot (class in dissect.ntfs.index) (class in dissect.regf.regf) indices() (dissect.database.sqlite3.sqlite3.SQLite3 method) infer() (dissect.target.plugins.os.unix.packagemanager.OperationTypes class method) infer_access_log_format() (dissect.target.plugins.apps.webserver.apache.ApachePlugin static method) (dissect.target.plugins.apps.webserver.citrix.CitrixWebserverPlugin static method) info (acquire.acquire.gui.win32.Win32 attribute) (dissect.apfs.objects.btree.BTree attribute) (dissect.archive.wim.ReparsePoint attribute) (dissect.executable.pe.directory.debug.CodeViewDebugEntry property) (dissect.executable.pe.directory.debug.VcFeatureDebugEntry property) (dissect.target.loaders.itunes.ITunesBackup attribute) (dissect.target.loaders.mqtt.MqttConnection attribute) INFO (dissect.target.plugins.os.unix.log.journal.JournalMessagePriority attribute) info() (dissect.target.loaders.mqtt.Broker method) (dissect.target.loaders.remote.RemoteStreamConnection method) InfoMessage (class in dissect.target.loaders.mqtt) InfoRecord (in module dissect.target.tools.info) Information (class in dissect.fve.bde.information) information (dissect.fve.bde.bde.BDE attribute) (dissect.volume.vss.Store attribute) information_offset (dissect.fve.bde.information.Information property) INFORMATION_OFFSET_GUID (in module dissect.fve.bde.c_bde) information_offsets (dissect.fve.bde.bde.BootSector attribute) InformationType (class in dissect.target.plugins.filesystem.ntfs.utils) InfrastructureUpdate (class in dissect.database.ese.ntds.objects.infrastructureupdate) inherited_object_type (dissect.database.ese.ntds.sd.ACE attribute) (dissect.ntfs.secure.ACE attribute) Ini (class in dissect.target.helpers.configutil) init() (acquire.acquire.outputs.base.Output method) (dissect.target.helpers.mount.DissectMount method) (dissect.util.compression.lzxpress_huffman.BitString method) init_from_dict() (flow.record.base.RecordDescriptor method) init_from_record() (flow.record.base.RecordDescriptor method) init_state (dissect.volume.ddf.ddf.VirtualDiskRecord attribute) INITCOMMONCONTROLSEX (class in acquire.acquire.gui.win32) initd() (dissect.target.plugins.os.unix.linux.services.ServicesPlugin method) INITD_PATHS (dissect.target.plugins.os.unix.linux.services.ServicesPlugin attribute) initialize() (in module dissect.squashfs.compression) initialize_object_attributes() (in module acquire.acquire.dynamic.windows.ntdll) INITIALIZING (dissect.volume.vinum.config.PlexState attribute) (dissect.volume.vinum.config.SDState attribute) ino_to_cg() (in module dissect.ffs.ffs) ino_to_fsba() (in module dissect.ffs.ffs) ino_to_fsbo() (in module dissect.ffs.ffs) INode (class in dissect.apfs.objects.fs) (class in dissect.btrfs.btrfs) (class in dissect.cramfs.cramfs) (class in dissect.extfs.extfs) (class in dissect.ffs.ffs) (class in dissect.jffs.jffs2) (class in dissect.squashfs.squashfs) (class in dissect.xfs.xfs) inode (dissect.apfs.objects.fs.DirectoryEntry property) (dissect.apfs.objects.fs.FS attribute) (dissect.apfs.objects.fs.INode property) (dissect.apfs.objects.fs.XAttr attribute) (dissect.apfs.stream.DecmpfsStream attribute) (dissect.btrfs.btrfs.INode property) (dissect.btrfs.btrfs.Subvolume attribute) (dissect.cramfs.cramfs.BlockStream attribute) (dissect.cramfs.cramfs.INode property) (dissect.extfs.extfs.INode property) (dissect.extfs.extfs.XAttr attribute) (dissect.ffs.ffs.FFS attribute) (dissect.ffs.ffs.INode property) (dissect.jffs.jffs2.INode property) (dissect.jffs.jffs2.JFFS2 attribute) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx4.QNX4 attribute) (dissect.qnxfs.qnx6.INode6 property) (dissect.qnxfs.qnx6.QNX6 attribute) (dissect.squashfs.squashfs.FileStream attribute) (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) (dissect.xfs.xfs.INode property) INode (in module dissect.target.filesystems.qnxfs) inode() (dissect.cramfs.cramfs.CramFS method) (dissect.squashfs.squashfs.SquashFS method) (dissect.target.filesystem.DirEntry method) INode4 (class in dissect.qnxfs.qnx4) INode6 (class in dissect.qnxfs.qnx6) inode_allocated() (dissect.ffs.ffs.CylinderGroup method) inode_map (dissect.target.plugins.os.unix.linux.proc.ProcPlugin property) inode_number (dissect.squashfs.squashfs.INode property) inode_size (dissect.ffs.ffs.FFS attribute) INODE_STRUCT_MAP (in module dissect.squashfs.c_squashfs) inode_to_pids() (dissect.target.plugins.os.unix.linux.proc.ProcPlugin method) inodes (dissect.jffs.jffs2.INode property) inodes() (dissect.apfs.objects.fs.FS method) input (dissect.target.plugins.os.windows.regf.cit.SystemDataBitmaps attribute) input_field (acquire.acquire.gui.win32.Win32 attribute) input_fields (dissect.target.helpers.record.ExtendableRecordDescriptor attribute) input_touch (dissect.target.plugins.os.windows.regf.cit.SystemDataBitmaps attribute) Install (dissect.target.plugins.os.unix.packagemanager.OperationTypes attribute) install_date() (dissect.target.plugins.os.unix.bsd.citrix.generic.GenericPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios.generic.GenericPlugin method) (dissect.target.plugins.os.unix.generic.GenericPlugin method) (dissect.target.plugins.os.unix.linux.fortios.generic.GenericPlugin method) (dissect.target.plugins.os.windows.generic.GenericPlugin method) install_paths() (dissect.target.plugins.os.windows.exchange.exchange.ExchangePlugin method) installed (dissect.target.plugins.apps.productivity.msoffice.ClickOnceDeploymentManifestParser.Assembly attribute) INSTALLER_FAILED (dissect.target.plugins.os.windows.amcache.PcaGeneralDbType attribute) installs (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin attribute) (dissect.target.plugins.apps.browser.safari.SafariPlugin attribute) (dissect.target.plugins.apps.chat.msn.MSNPlugin attribute) (dissect.target.plugins.apps.container.docker.DockerPlugin attribute) (dissect.target.plugins.apps.container.podman.PodmanPlugin attribute) (dissect.target.plugins.child.wsl.WSLChildTargetPlugin attribute) (dissect.target.plugins.os.unix.linux.debian.snap.SnapPlugin attribute) Instance (class in dissect.cim.cim) instance (dissect.cim.utils.ObjectPath attribute) instance() (dissect.cim.cim.Class method) INSTANCE_INFO (dissect.etl.headers.event.ExtType attribute) instance_type (dissect.database.ese.ntds.objects.object.Object property) InstanceKey (class in dissect.cim.classes) instances (dissect.cim.cim.Class property) (dissect.target.plugins.os.windows.log.mssql.MssqlPlugin attribute) InstanceType (class in dissect.database.ese.ntds.util) Int (class in dissect.cstruct.types.int) INT16 (dissect.eventlog.bxml.BxmlType attribute) INT32 (dissect.eventlog.bxml.BxmlType attribute) Int32Serializer (class in dissect.target.helpers.sunrpc.serializer) INT64 (dissect.eventlog.bxml.BxmlType attribute) INT8 (dissect.eventlog.bxml.BxmlType attribute) int_or_none() (in module dissect.target.plugins.os.unix.log.journal) integrity (dissect.fve.luks.metadata.Segment attribute) integrity_check (dissect.fve.bde.information.Validation attribute) IntegrityMeta (class in dissect.apfs.objects.integrity_meta) IntegritySegment (class in dissect.volume.lvm.metadata) IntEnumMissing (class in dissect.target.helpers.utils) INTERDOMAIN_TRUST_ACCOUNT (dissect.database.ese.ntds.util.UserAccountControl attribute) interface (dissect.target.plugins.os.unix.linux.network.DhcpLease attribute) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager property) interface() (dissect.target.plugins.os.unix.linux._os.LinuxPlugin method) InterfaceRecord (in module dissect.target.plugins.os.default.network) interfaces() (dissect.target.plugins.os.default.network.NetworkPlugin method) (dissect.target.plugins.os.unix.linux.network.DhclientLeaseParser method) (dissect.target.plugins.os.unix.linux.network.LinuxNetworkConfigParser method) (dissect.target.plugins.os.unix.linux.network.LinuxNetworkPlugin method) (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser method) (dissect.target.plugins.os.unix.linux.network.NetworkManagerLeaseParser method) (dissect.target.plugins.os.unix.linux.network.ProcConfigParser method) (dissect.target.plugins.os.unix.linux.network.SyslogConfigParser method) (dissect.target.plugins.os.unix.linux.network.SystemdNetworkConfigParser method) INTERLEAVE (dissect.target.plugins.os.windows.network.IfTypes attribute) interleave_sectors (dissect.volume.lvm.metadata.IntegritySegment attribute) internal (dissect.target.plugin.FunctionDescriptor attribute) internal() (in module dissect.target.plugin) internal_flags (dissect.apfs.objects.fs.INode property) internal_hash (dissect.volume.lvm.metadata.IntegritySegment attribute) internal_metadata (dissect.hypervisor.disk.asif.ASIF property) InternalNamespacePlugin (class in dissect.target.plugin) InternalPlugin (class in dissect.target.plugin) InternetExplorerPlugin (class in dissect.target.plugins.apps.browser.iexplore) InterSiteTransport (class in dissect.database.ese.ntds.objects.intersitetransport) InterSiteTransportContainer (class in dissect.database.ese.ntds.objects.intersitetransportcontainer) IntFibItem (class in dissect.archive.vbk) intunemanagementextension() (dissect.target.plugins.os.windows.log.intunemanagementextension.IntuneManagementExtensionLogParserPlugin method) IntuneManagementExtensionLogParserPlugin (class in dissect.target.plugins.os.windows.log.intunemanagementextension) IntuneManagementExtensionLogRecord (in module dissect.target.plugins.os.windows.log.intunemanagementextension) inType (dissect.eventlog.wevt_object.TEMP_DESCRIPTOR attribute) inum (dissect.btrfs.btrfs.INode attribute) (dissect.extfs.extfs.INode attribute) (dissect.ffs.ffs.INode attribute) (dissect.jffs.jffs2.DataStream attribute) (dissect.jffs.jffs2.DirEntry attribute) (dissect.jffs.jffs2.INode attribute) (dissect.qnxfs.qnx4.INode4 attribute) (dissect.qnxfs.qnx6.INode6 attribute) (dissect.xfs.xfs.INode attribute) InvalidBLFError InvalidBlock InvalidBPB InvalidBufferError InvalidContextError InvalidDatabase, [1] InvalidDatabaseError InvalidDirectoryError InvalidFileError InvalidFilesystemError InvalidHeader (class in dissect.etl.headers.headers) InvalidHeaderError, [1], [2], [3] InvalidHeaderMagic InvalidHookIdException InvalidMarkerError InvalidOperation InvalidPageNumber InvalidPageType InvalidPortMapping InvalidQueryError InvalidRecordBlockError InvalidRecordError InvalidSelectorError InvalidSignature InvalidSignatureError, [1] InvalidSnapshot InvalidSQL InvalidSymbolTableError InvalidTaskError InvalidVirtualDisk inventories (dissect.target.plugins.apps.virtualization.vmware_workstation.VmwareWorkstationPlugin attribute) (dissect.target.plugins.child.vmware_workstation.VmwareWorkstationChildTargetPlugin attribute) inventory() (dissect.target.plugins.os.unix.esxi.vm.VirtualMachinePlugin method) INVENTORY_PATHS (in module dissect.target.plugins.apps.virtualization.vmware_workstation) IO_COMPLETION (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) io_open() (in module dissect.target.helpers.compat.path_common) IO_REPARSE_TAG (in module dissect.archive.c_wim) (in module dissect.ntfs.c_ntfs) IO_STATUS_BLOCK (class in acquire.acquire.dynamic.windows.types) IO_STATUS_BLOCK_DUMMYUNIONNAME (class in acquire.acquire.dynamic.windows.types) IOS (dissect.target.plugin.OperatingSystem attribute) IOSApplicationRecord (in module dissect.target.plugins.os.unix.bsd.darwin.ios.applications) IOSApplicationsPlugin (class in dissect.target.plugins.os.unix.bsd.darwin.ios.applications) IOSPlugin (class in dissect.target.plugins.os.unix.bsd.darwin.ios._os) IOSUserRecord (in module dissect.target.helpers.record) IP (dissect.target.plugins.os.windows.network.IfTypes attribute) ip (flow.record.fieldtypes.net.ip.ipinterface property) ip_interfaces (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) (dissect.target.plugins.os.unix.linux.network.ProcConfigParser.ParserContext attribute) ip_records_from_text_files() (in module flow.record.tools.geoip) IP_REGEX (in module dissect.target.helpers.regex.ipaddress) ipaddress (class in flow.record.fieldtypes.net.ip) IPAddress (in module flow.record.fieldtypes.net.ip) IPCOMP (dissect.target.helpers.network.IANAProtocol attribute) IPCV (dissect.target.helpers.network.IANAProtocol attribute) IPFORWARD (dissect.target.plugins.os.windows.network.IfTypes attribute) ipinterface (class in flow.record.fieldtypes.net.ip) IPIP (dissect.target.helpers.network.IANAProtocol attribute) IPLT (dissect.target.helpers.network.IANAProtocol attribute) ipnetwork (class in flow.record.fieldtypes.net.ip) IPNetwork (in module flow.record.fieldtypes.net.ip) IPOVER_ATM (dissect.target.plugins.os.windows.network.IfTypes attribute) IPOVER_CDLC (dissect.target.plugins.os.windows.network.IfTypes attribute) IPOVER_CLAW (dissect.target.plugins.os.windows.network.IfTypes attribute) IPPC (dissect.target.helpers.network.IANAProtocol attribute) ips (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager property) ips() (dissect.target.loaders.profile.ProfileOSPlugin method) (dissect.target.loaders.res.ResOSPlugin method) (dissect.target.plugin.OSPlugin method) (dissect.target.plugins.os.default._os.DefaultOSPlugin method) (dissect.target.plugins.os.default.network.NetworkPlugin method) (dissect.target.plugins.os.unix.bsd._os.BsdPlugin method) (dissect.target.plugins.os.unix.bsd.citrix._os.CitrixPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin method) (dissect.target.plugins.os.unix.esxi._os.ESXiPlugin method) (dissect.target.plugins.os.unix.linux._os.LinuxPlugin method) (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin method) (dissect.target.plugins.os.unix.linux.debian.vyos._os.VyosPlugin method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSPlugin method) (dissect.target.plugins.os.windows._os.WindowsPlugin method) IpsecBase (class in dissect.database.ese.ntds.objects.ipsecbase) IpsecFilter (class in dissect.database.ese.ntds.objects.ipsecfilter) IpsecISAKMPPolicy (class in dissect.database.ese.ntds.objects.ipsecisakmppolicy) IpsecNegotiationPolicy (class in dissect.database.ese.ntds.objects.ipsecnegotiationpolicy) IpsecNFA (class in dissect.database.ese.ntds.objects.ipsecnfa) IpsecPolicy (class in dissect.database.ese.ntds.objects.ipsecpolicy) IPSWITCH (dissect.target.plugins.os.windows.network.IfTypes attribute) iptables() (dissect.target.plugins.os.unix.linux.iptables.IptablesSavePlugin method) IptablesSavePlugin (class in dissect.target.plugins.os.unix.linux.iptables) IptablesSaveRecord (in module dissect.target.plugins.os.unix.linux.iptables) IPTM (dissect.target.helpers.network.IANAProtocol attribute) IPV4 (dissect.target.helpers.network.IANAProtocol attribute) ipv4 (dissect.target.plugins.os.unix.linux.network.SystemdNetworkConfigParser.DhcpConfig attribute) IPV4_ADDR (in module dissect.target.helpers.regex.ipaddress) IPV4_SEG (in module dissect.target.helpers.regex.ipaddress) IPv4Record (in module flow.record.tools.geoip) IPV6 (dissect.target.helpers.network.IANAProtocol attribute) ipv6 (dissect.target.plugins.os.unix.linux.network.SystemdNetworkConfigParser.DhcpConfig attribute) IPV6_ADDR (in module dissect.target.helpers.regex.ipaddress) IPV6_FRAG (dissect.target.helpers.network.IANAProtocol attribute) IPV6_GROUPS (in module dissect.target.helpers.regex.ipaddress) IPV6_ICMP (dissect.target.helpers.network.IANAProtocol attribute) IPV6_NONXT (dissect.target.helpers.network.IANAProtocol attribute) IPV6_OPTS (dissect.target.helpers.network.IANAProtocol attribute) IPV6_ROUTE (dissect.target.helpers.network.IANAProtocol attribute) IPV6_SEG (in module dissect.target.helpers.regex.ipaddress) IPX_IN_IP (dissect.target.helpers.network.IANAProtocol attribute) IR_TIMER (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) IRTP (dissect.target.helpers.network.IANAProtocol attribute) IS088023_CSMACD (dissect.target.plugins.os.windows.network.IfTypes attribute) is_64bit (dissect.etl.etl.ETL attribute) (dissect.etl.headers.headers.Header property) (dissect.etl.headers.logfile.LogfileHeader property) is_64bit() (dissect.executable.pe.pe.PE method) is_adcrypt() (dissect.evidence.ad1.ad1.AD1 method) (in module dissect.evidence.adcrypt.adcrypt) is_archive() (dissect.fat.fat.DirectoryEntry method) (dissect.fat.fat.RootDirectory method) is_archived() (dissect.archive.vbk.FibBlockDescriptor method) is_array (dissect.eventlog.bxml.BxmlTemplateDescriptor attribute) is_bde_volume() (in module dissect.fve.bde.bde) is_big_value (dissect.regf.regf.KeyValue property) is_binary (dissect.database.ese.table.Column property) is_black (dissect.ole.ole.DirectoryEntry property) is_block_device() (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.INode method) (dissect.btrfs.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.squashfs.INode method) is_block_in_blob() (dissect.archive.vbk.FibBlockDescriptor method) is_block_in_blob_reserved() (dissect.archive.vbk.FibBlockDescriptor method) is_branch (dissect.database.ese.page.Page property) is_btree (dissect.database.bsd.db.DB property) is_builtin_key (dissect.cim.classes.QualifierReference property) is_builtin_property (dissect.cim.classes.PropertyReference property) is_case_insensitive (dissect.apfs.objects.fs.FS property) is_character_device() (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.INode method) (dissect.btrfs.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.squashfs.INode method) is_cloud_file() (dissect.ntfs.attr.FileName method) (dissect.ntfs.mft.MftRecord method) is_compatible() (dissect.target.plugin.Plugin method) is_compound_ace (dissect.database.ese.ntds.sd.ACE property) (dissect.ntfs.secure.ACE property) is_compressed (dissect.archive.wim.Resource property) is_compressed() (dissect.apfs.objects.fs.INode method) (dissect.archive.vbk.StgBlockDescriptor method) (in module dissect.target.loaders.tar) is_connected() (dissect.target.loaders.remote.RemoteStreamConnection method) is_data_block() (dissect.archive.vbk.StgBlockDescriptor method) is_data_reference (dissect.cim.index.Key property) is_dedup_block() (dissect.archive.vbk.StgBlockDescriptor method) is_default_value (dissect.cim.classes.ClassInstanceProperty property) is_deleted (dissect.database.ese.ntds.objects.object.Object property) is_derived (dissect.database.ese.record.TagField property) is_device() (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.INode method) (dissect.btrfs.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.squashfs.INode method) is_dir() (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.INode method) (dissect.archive.vbk.DirItem method) (dissect.archive.vbk.RootDirectory method) (dissect.archive.vbk.SubFolderItem method) (dissect.archive.wim.DirectoryEntry method) (dissect.btrfs.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.evidence.ad1.ad1.FileEntry method) (dissect.ffs.ffs.INode method) (dissect.jffs.jffs2.INode method) (dissect.ntfs.attr.FileName method) (dissect.ntfs.mft.MftRecord method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.squashfs.INode method) (dissect.target.filesystem.DirEntry method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.apfs.ApfsDirEntry method) (dissect.target.filesystems.apfs.ApfsFilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry method) (dissect.target.filesystems.cb.CbFilesystemEntry method) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.exfat.ExfatFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.fat.FatFilesystemEntry method) (dissect.target.filesystems.ffs.FfsFilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemEntry method) (dissect.target.filesystems.jffs.JffsFilesystemEntry method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.ntds.NtdsDirEntry method) (dissect.target.filesystems.ntds.NtdsFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsDirEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry method) (dissect.target.filesystems.smb.SmbDirEntry method) (dissect.target.filesystems.smb.SmbFilesystemEntry method) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystemEntry method) (dissect.target.filesystems.vbk.VbkDirEntry method) (dissect.target.filesystems.vbk.VbkFilesystemEntry method) (dissect.target.filesystems.vmfs.VmfsDirEntry method) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystemEntry method) (dissect.vmfs.descriptor.FileDescriptor method) is_direct (dissect.target.target.Target property) is_directory() (dissect.fat.fat.DirectoryEntry method) (dissect.fat.fat.RootDirectory method) is_dirty (dissect.target.tools.dump.Sink attribute) is_drive_letter_path() (in module dissect.target.loaders.dir) is_dst() (dissect.target.plugins.os.windows.datetime.WindowsTimezone method) is_empty (dissect.database.ese.page.Page property) is_encrypted (dissect.apfs.objects.base.Object property) (dissect.apfs.objects.fs.FS property) (dissect.hypervisor.descriptor.vbox.HardDisk property) is_encrypted() (in module dissect.target.volume) is_end (dissect.ntfs.index.IndexEntry property) is_enhanced_crypto() (dissect.fve.bde.information.VmkInfoDatum method) is_enhanced_pin() (dissect.fve.bde.information.VmkInfoDatum method) is_eof_record() (in module dissect.eventlog.evt) is_eow (dissect.fve.bde.bde.BitlockerStream attribute) is_ephemeral (dissect.apfs.objects.base.Object property) is_external_file() (dissect.archive.vbk.DirItem method) (dissect.archive.vbk.ExtFibItem method) is_fifo() (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.INode method) (dissect.btrfs.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.squashfs.INode method) is_file() (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.INode method) (dissect.archive.vbk.DirItem method) (dissect.archive.wim.DirectoryEntry method) (dissect.btrfs.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.evidence.ad1.ad1.FileEntry method) (dissect.ffs.ffs.INode method) (dissect.jffs.jffs2.INode method) (dissect.ntfs.attr.FileName method) (dissect.ntfs.mft.MftRecord method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.squashfs.INode method) (dissect.target.filesystem.DirEntry method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.apfs.ApfsDirEntry method) (dissect.target.filesystems.apfs.ApfsFilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry method) (dissect.target.filesystems.cb.CbFilesystemEntry method) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.exfat.ExfatFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.fat.FatFilesystemEntry method) (dissect.target.filesystems.ffs.FfsFilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemEntry method) (dissect.target.filesystems.jffs.JffsFilesystemEntry method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.ntds.NtdsDirEntry method) (dissect.target.filesystems.ntds.NtdsFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsDirEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry method) (dissect.target.filesystems.smb.SmbDirEntry method) (dissect.target.filesystems.smb.SmbFilesystemEntry method) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystemEntry method) (dissect.target.filesystems.vbk.VbkDirEntry method) (dissect.target.filesystems.vbk.VbkFilesystemEntry method) (dissect.target.filesystems.vmfs.VmfsDirEntry method) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystemEntry method) (dissect.vmfs.descriptor.FileDescriptor method) is_file_object_pointer (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) is_fixed (dissect.database.ese.table.Column property) is_forwarder (dissect.volume.vss.BlockDescriptor attribute) is_gzipped (dissect.target.containers.fortifw.FortiFirmwareFile attribute) is_hash (dissect.database.bsd.db.DB property) is_head_of_naming_context (dissect.database.ese.ntds.objects.object.Object property) is_header_record() (in module dissect.eventlog.evt) is_hidden() (dissect.fat.fat.DirectoryEntry method) (dissect.fat.fat.RootDirectory method) is_hyperv_xml() (in module dissect.target.loaders.hyperv) is_index (dissect.database.ese.page.Page property) is_inherited (dissect.cim.c_cim.ClassDefinitionPropertyState attribute) (dissect.cim.cim.Property property) (dissect.cim.classes.ClassInstanceProperty property) is_initialized (dissect.cim.c_cim.ClassInstancePropertyState attribute) (dissect.cim.classes.ClassInstanceProperty property) is_internal (dissect.volume.dm.btree.Node property) is_internal_file() (dissect.archive.vbk.DirItem method) (dissect.archive.vbk.IntFibItem method) is_ipc() (dissect.btrfs.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.squashfs.INode method) is_iso_fmt() (in module dissect.target.plugins.os.unix.log.helpers) is_junction() (dissect.target.filesystem.DirEntry method) (dissect.target.filesystems.dir.DirectoryDirEntry method) (dissect.target.filesystems.ntfs.NtfsDirEntry method) (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) is_leaf (dissect.apfs.objects.btree_node.BTreeNode property) (dissect.database.ese.page.Page property) (dissect.util.compression.lzxpress_huffman.Node attribute) (dissect.volume.dm.btree.Node property) is_legacy() (dissect.archive.vbk.StgBlockDescriptor method) is_local (dissect.database.ese.ntds.objects.object.Object property) (dissect.vmfs.vmfs.VMFS property) is_locked() (dissect.evidence.ad1.ad1.AD1 method) (dissect.evidence.adcrypt.adcrypt.ADCrypt method) is_long_value (dissect.database.ese.page.Page property) is_luks_volume() (in module dissect.fve.luks.luks) is_lvm_volume() (in module dissect.target.volume) is_machine_account() (dissect.database.ese.ntds.objects.user.User method) is_mapped (dissect.cim.mappings.MappingEntry property) is_member() (dissect.database.ese.ntds.objects.group.Group method) is_member_of() (dissect.database.ese.ntds.objects.user.User method) is_metadata (dissect.archive.wim.Resource property) is_minifat (dissect.ole.ole.DirectoryEntry property) is_mount (dissect.target.helpers.compat.path_313.TargetPath attribute) is_mount() (dissect.target.helpers.compat.path_311.TargetPath method) is_mount_point() (dissect.archive.wim.DirectoryEntry method) (dissect.ntfs.attr.FileName method) (dissect.ntfs.mft.MftRecord method) is_multi_volume_filesystem() (in module dissect.target.filesystem) is_multivalue (dissect.database.ese.table.Column property) is_nested() (dissect.util.ldap.SearchFilter method) is_node (dissect.ntfs.index.IndexEntry property) is_nonleaf (dissect.apfs.objects.btree_node.BTreeNode property) is_normal() (dissect.archive.vbk.FibBlockDescriptor method) is_normalization_insensitive (dissect.apfs.objects.fs.FS property) is_nt() (dissect.executable.pe.pe.PE method) is_null (dissect.database.ese.record.TagField property) is_number() (dissect.cstruct.expression.Expression method) is_object_ace (dissect.database.ese.ntds.sd.ACE property) (dissect.ntfs.secure.ACE property) is_onekey (dissect.apfs.objects.fs.FS property) is_os2() (dissect.executable.pe.pe.PE method) is_overlay (dissect.volume.vss.BlockDescriptor attribute) is_parent (dissect.database.ese.page.Page property) is_pe() (dissect.executable.pe.pe.PE method) is_pem() (in module dissect.target.plugins.apps.ssh.ssh) is_phantom (dissect.database.ese.ntds.objects.object.Object property) is_physical (dissect.apfs.objects.base.Object property) is_pkcs8() (in module dissect.target.plugins.apps.ssh.ssh) is_pre_xp (dissect.target.plugins.os.windows.regf.shellbags.FILE_ENTRY attribute) is_primary (dissect.database.ese.index.Index property) is_qnxfs() (in module dissect.qnxfs.qnxfs) is_rdm() (dissect.vmfs.descriptor.FileDescriptor method) is_readonly() (dissect.fat.fat.DirectoryEntry method) (dissect.fat.fat.RootDirectory method) is_recno (dissect.database.bsd.db.DB property) is_red (dissect.ole.ole.DirectoryEntry property) is_related() (dissect.executable.elf.elf.Section method) (dissect.executable.elf.elf.Segment method) is_remnant (dissect.target.plugins.os.windows.rdpcache.BitmapTile attribute) is_reparse_point() (dissect.archive.wim.DirectoryEntry method) (dissect.ntfs.attr.FileName method) (dissect.ntfs.mft.MftRecord method) is_reproducible() (dissect.executable.pe.pe.PE method) is_reserved() (dissect.archive.vbk.FibBlockDescriptor method) (dissect.target.helpers.compat.path_312.PureDissectPath method) is_rfc4716() (in module dissect.target.plugins.apps.ssh.ssh) is_root (dissect.apfs.objects.btree_node.BTreeNode property) (dissect.database.ese.page.Page property) is_root() (dissect.target.helpers.configutil.ScopeManager method) is_saved (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadTab attribute) is_sealed (dissect.apfs.objects.fs.FS property) is_set() (dissect.volume.vss.StoreBitmap method) is_single_valued (dissect.database.ese.ntds.schema.AttributeEntry attribute) is_small_page (dissect.database.ese.page.Page property) is_socket() (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.INode method) (dissect.btrfs.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.squashfs.INode method) is_space_tree (dissect.database.ese.page.Page property) is_spanned (dissect.archive.wim.Resource property) is_sparse() (dissect.archive.vbk.FibBlockDescriptor method) is_standard_ace (dissect.database.ese.ntds.sd.ACE property) (dissect.ntfs.secure.ACE property) is_stdout (flow.record.adapter.split.SplitWriter attribute) is_stdout() (in module flow.record.utils) is_storage (dissect.ole.ole.DirectoryEntry property) is_stream (dissect.ole.ole.DirectoryEntry property) is_symlink() (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.INode method) (dissect.archive.wim.DirectoryEntry method) (dissect.btrfs.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.evidence.ad1.ad1.FileEntry method) (dissect.ffs.ffs.INode method) (dissect.jffs.jffs2.INode method) (dissect.ntfs.attr.FileName method) (dissect.ntfs.mft.MftRecord method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.squashfs.INode method) (dissect.target.filesystem.DirEntry method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.apfs.ApfsDirEntry method) (dissect.target.filesystems.apfs.ApfsFilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry method) (dissect.target.filesystems.cb.CbFilesystemEntry method) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.exfat.ExfatFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.fat.FatFilesystemEntry method) (dissect.target.filesystems.ffs.FfsFilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemEntry method) (dissect.target.filesystems.jffs.JffsFilesystemEntry method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.ntds.NtdsDirEntry method) (dissect.target.filesystems.ntds.NtdsFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsDirEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry method) (dissect.target.filesystems.smb.SmbDirEntry method) (dissect.target.filesystems.smb.SmbFilesystemEntry method) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystemEntry method) (dissect.target.filesystems.vbk.VbkDirEntry method) (dissect.target.filesystems.vbk.VbkFilesystemEntry method) (dissect.target.filesystems.vmfs.VmfsDirEntry method) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystemEntry method) (dissect.vmfs.descriptor.FileDescriptor method) is_system() (dissect.fat.fat.DirectoryEntry method) (dissect.fat.fat.RootDirectory method) (dissect.vmfs.descriptor.FileDescriptor method) is_tagged (dissect.database.ese.table.Column property) is_tar_magic() (in module dissect.target.loaders.tar) is_tarfile (in module dissect.hypervisor.util.vmtar) is_text (dissect.database.ese.table.Column property) is_unencrypted (dissect.apfs.objects.fs.FS property) is_used (dissect.volume.vss.BlockDescriptor attribute) is_user_admin() (in module acquire.acquire.utils) is_v7() (dissect.archive.vbk.VBK method) is_valid (dissect.ole.ole.DirectoryEntry property) is_valid() (dissect.apfs.objects.base.Object method) (dissect.apfs.objects.omap.ObjectMap method) (dissect.fve.bde.eow.EowBitmap method) (dissect.fve.bde.eow.EowBitmapRecord method) (dissect.fve.bde.eow.EowInformation method) (dissect.fve.bde.information.Information method) (dissect.vmfs.lvm.Volume method) is_valid_field_name() (in module flow.record.base) is_valid_kape_dir() (in module dissect.target.loaders.kape) is_valid_kape_file() (in module dissect.target.loaders.kape) is_valid_yara() (in module dissect.target.plugins.filesystem.yara) is_variable (dissect.database.ese.table.Column property) is_virtual (dissect.apfs.objects.base.Object property) is_visible (dissect.volume.lvm.metadata.LogicalVolume property) is_visor (dissect.hypervisor.util.vmtar.VisorTarInfo attribute) is_vmfs5 (dissect.vmfs.vmfs.VMFS property) is_vmfs6 (dissect.vmfs.vmfs.VMFS property) is_volume_id() (dissect.fat.fat.DirectoryEntry method) (dissect.fat.fat.RootDirectory method) is_whiteout() (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.INode method) is_wildcard (dissect.target.helpers.keychain.Key attribute) is_xp_mapping() (in module dissect.cim.utils) isabs() (in module dissect.target.helpers.polypath) IsADirectoryError, [1], [2], [3], [4], [5], [6], [7], [8], [9], [10], [11], [12], [13], [14] ISDN (dissect.target.plugins.os.windows.network.IfTypes attribute) ISDN_S (dissect.target.plugins.os.windows.network.IfTypes attribute) ISDN_U (dissect.target.plugins.os.windows.network.IfTypes attribute) ISIS_OVER_IPV4 (dissect.target.helpers.network.IANAProtocol attribute) isjunction() (in module dissect.target.helpers.compat.path_common) ISO88022_LLC (dissect.target.plugins.os.windows.network.IfTypes attribute) ISO88024_TOKENBUS (dissect.target.plugins.os.windows.network.IfTypes attribute) ISO88025_CRFPRINT (dissect.target.plugins.os.windows.network.IfTypes attribute) ISO88025_FIBER (dissect.target.plugins.os.windows.network.IfTypes attribute) ISO88025_TOKENRING (dissect.target.plugins.os.windows.network.IfTypes attribute) ISO88025R_DTR (dissect.target.plugins.os.windows.network.IfTypes attribute) ISO88026_MAN (dissect.target.plugins.os.windows.network.IfTypes attribute) ISO_8601_PATTERN (in module dissect.target.plugins.apps.edr.velociraptor) ISO_IP (dissect.target.helpers.network.IANAProtocol attribute) iso_readlines() (in module dissect.target.plugins.os.unix.log.helpers) ISO_TP4 (dissect.target.helpers.network.IANAProtocol attribute) isreserved() (in module dissect.target.helpers.polypath) issocket() (dissect.util.cpio.CpioInfo method) ISUP (dissect.target.plugins.os.windows.network.IfTypes attribute) item (dissect.target.plugins.os.windows.regf.shellbags.SHITEM attribute) item() (dissect.apfs.cursor.Cursor method) (dissect.btrfs.tree.Cursor method) ITEMIDLIST (class in acquire.acquire.gui.win32) items (dissect.executable.elf.elf.Table attribute) items() (acquire.acquire.uploaders.plugin_registry.PluginRegistry method) (dissect.btrfs.tree.Cursor method) (dissect.hypervisor.descriptor.hyperv.HyperVFile method) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry method) (dissect.target.helpers.configutil.ConfigurationParser method) iter() (dissect.btrfs.tree.Cursor method) (dissect.database.ese.ntds.database.DataTable method) iter_bitmap() (dissect.target.plugins.os.windows.regf.cit.CIT method) iter_esxi_filesystems() (in module acquire.acquire.acquire) iter_fileobj() (in module dissect.evidence.tools.asdf.verify) iter_inodes() (dissect.ffs.ffs.FFS method) (dissect.squashfs.squashfs.SquashFS method) iter_leaf_nodes() (dissect.database.ese.page.Page method) iter_nt() (dissect.target.plugins.os.windows.regf.shimcache.ShimCache method) iter_ntfs_filesystems() (in module acquire.acquire.acquire) iter_proc() (dissect.target.plugins.os.unix.linux.proc.ProcPlugin method) iter_records() (in module dissect.target.plugins.filesystem.ntfs.mft) iter_subfs() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystems.apfs.ApfsFilesystem method) (dissect.target.filesystems.btrfs.BtrfsFilesystem method) iter_timestamped_records() (in module flow.record.base) iter_vms() (in module dissect.target.plugins.child.parallels) iter_win_8_plus() (dissect.target.plugins.os.windows.regf.shimcache.ShimCache method) iterations (dissect.fve.luks.metadata.Digest attribute) (dissect.fve.luks.metadata.KeyslotKdf attribute) iterdir() (dissect.apfs.objects.fs.INode method) (dissect.archive.vbk.DirItem method) (dissect.archive.vbk.RootDirectory method) (dissect.archive.vbk.SubFolderItem method) (dissect.archive.wim.DirectoryEntry method) (dissect.btrfs.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.evidence.ad1.ad1.FileEntry method) (dissect.executable.pe.directory.resource.ResourceDirectoryEntry method) (dissect.extfs.extfs.INode method) (dissect.fat.fat.DirectoryEntry method) (dissect.fat.fat.RootDirectory method) (dissect.ffs.ffs.INode method) (dissect.jffs.jffs2.INode method) (dissect.ntfs.mft.MftRecord method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.squashfs.INode method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) (dissect.vmfs.descriptor.FileDescriptor method) (dissect.xfs.xfs.INode method) iterfileobj() (in module dissect.evidence.tools.asdf.meta) iterhives() (dissect.target.helpers.regutil.HiveCollection method) (dissect.target.plugins.os.windows.registry.RegistryPlugin method) ITunesBackup (class in dissect.target.loaders.itunes) ITunesFilesystem (class in dissect.target.filesystems.itunes) ITunesFilesystemDirectoryEntry (class in dissect.target.filesystems.itunes) ITunesFilesystemEntry (class in dissect.target.filesystems.itunes) ITunesLoader (class in dissect.target.loaders.itunes) IV (class in dissect.fve.crypto.base) iv (dissect.fve.bde.information.AesCbc256HmacSha512EncryptedDatum property) (dissect.hypervisor.util.envelope.Envelope attribute) iv_length (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm attribute) iv_mode (dissect.fve.crypto.base.Cipher attribute) (dissect.fve.crypto.Cipher attribute) IV_MODE_MAP (in module dissect.fve.crypto) iv_sector_size (dissect.fve.crypto.base.Cipher attribute) (dissect.fve.crypto.Cipher attribute) iv_size (dissect.fve.crypto.base.IV attribute) iv_tweak (dissect.fve.crypto.dmcrypt.CryptStream attribute) (dissect.fve.luks.metadata.Segment attribute) J JAMO_SPECIAL (dissect.database.ese.lcmapstring.SCRIPT attribute) JB (dissect.vmfs.resource.ResourceManager property) JDB2 (class in dissect.extfs.journal) jdb2 (dissect.extfs.journal.CommitBlock attribute) (dissect.extfs.journal.DescriptorBlock attribute) jdb2_def (in module dissect.extfs.c_jdb2) JET_bitIndex (in module dissect.database.ese.c_ese) JET_cbKeyMost_OLD (in module dissect.database.ese.index) JET_coltyp (in module dissect.database.ese.c_ese) JFFS2 (class in dissect.jffs.jffs2) jffs2 (dissect.target.filesystems.jffs.JffsFilesystem attribute) jffs2_def (in module dissect.jffs.c_jffs2) JFFS2_MAGIC_NUMBERS (in module dissect.jffs.c_jffs2) JffsDirEntry (class in dissect.target.filesystems.jffs) JffsFilesystem (class in dissect.target.filesystems.jffs) JffsFilesystemEntry (class in dissect.target.filesystems.jffs) JOB (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) job (dissect.target.plugins.os.windows.log.schedlgu.SchedLgU attribute) JOB_REGEX_PATTERN (in module dissect.target.plugins.os.windows.log.schedlgu) JobGuid (in module dissect.etl.utils) join() (in module dissect.target.helpers.polypath) journal (dissect.extfs.extfs.ExtFS property) journal() (dissect.target.plugins.os.unix.log.journal.JournalPlugin method) journal_block (dissect.extfs.journal.CommitBlock attribute) (dissect.extfs.journal.DescriptorBlock attribute) (dissect.extfs.journal.DescriptorBlockTag attribute) journal_def (in module dissect.target.plugins.os.unix.log.journal) journal_encryption (dissect.fve.luks.metadata.SegmentIntegrity attribute) journal_files (dissect.target.plugins.os.unix.log.journal.JournalPlugin attribute) JOURNAL_GLOB (dissect.target.plugins.os.unix.log.journal.JournalPlugin attribute) journal_integrity (dissect.fve.luks.metadata.SegmentIntegrity attribute) JOURNAL_PATHS (dissect.target.plugins.os.unix.log.journal.JournalPlugin attribute) journal_sectors (dissect.volume.lvm.metadata.IntegritySegment attribute) journal_watermark (dissect.volume.lvm.metadata.IntegritySegment attribute) JournalBlockAddr (class in dissect.vmfs.address) JournalBlockResourceVMFS6 (class in dissect.vmfs.resource) JournalFile (class in dissect.target.plugins.os.unix.log.journal) JournalMessagePriority (class in dissect.target.plugins.os.unix.log.journal) JournalPlugin (class in dissect.target.plugins.os.unix.log.journal) JournalRecord (in module dissect.target.plugins.os.unix.log.journal) Json (class in dissect.target.helpers.configutil) JSON (flow.record.adapter.splunk.SourceType attribute) json_converter (flow.record.adapter.splunk.SplunkWriter attribute) json_packer (flow.record.adapter.elastic.ElasticWriter attribute) json_size (dissect.fve.luks.metadata.Config attribute) JsonfileReader (class in flow.record.adapter.jsonfile) JsonfileWriter (class in flow.record.adapter.jsonfile) JsonItem (class in dissect.fve.luks.metadata) JSONLINES (dissect.target.tools.dump.Serialization attribute) JsonLinesWriter (class in dissect.target.tools.dump) JsonRecordPacker (class in flow.record.jsonpacker) JUMPLIST_FOOTER (in module dissect.shellitem.lnk.c_lnk) JUMPLIST_HEADER_SIZE (in module dissect.shellitem.lnk.c_lnk) JumpListFile (class in dissect.target.plugins.os.windows.jumplist) JumpListPlugin (class in dissect.target.plugins.os.windows.jumplist) JumpListRecord (in module dissect.target.plugins.os.windows.jumplist) K K (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) k (dissect.util.compression.lzfse.DecoderEntry attribute) KANA (dissect.database.ese.lcmapstring.SCRIPT attribute) KapeLoader (class in dissect.target.loaders.kape) KATAKANA (dissect.database.ese.lcmapstring.CASE attribute) kdf (dissect.fve.luks.metadata.Keyslot attribute) kdf_algo (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher attribute) kdf_iter (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher attribute) KEK (class in dissect.apfs.objects.keybag) kek (dissect.target.loaders.itunes.ITunesBackup attribute) KEKBlob (class in dissect.apfs.objects.keybag) keks() (dissect.apfs.objects.keybag.VolumeKeybag method) kernel32 (in module acquire.acquire.dynamic.windows.handles) (in module acquire.acquire.gui.win32) KEY (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) Key (class in dissect.cim.index) (class in dissect.target.helpers.keychain) key (dissect.apfs.objects.fs.XAttr attribute) (dissect.cim.cim.Instance property) (dissect.cim.classes.ClassInstance property) (dissect.cim.classes.QualifierReference property) (dissect.cim.index.IndexPage attribute) (dissect.cim.index.Key attribute) (dissect.database.ese.page.Node attribute) (dissect.database.sqlite3.sqlite3.Cell attribute) (dissect.evidence.adcrypt.adcrypt.ADCrypt attribute) (dissect.evidence.adcrypt.stream.ADCryptStream attribute) (dissect.fve.crypto.base.Cipher attribute) (dissect.fve.crypto.Cipher attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.hypervisor.util.envelope.KeyStore property) (dissect.ntfs.index.IndexEntry property) (dissect.target.helpers.regutil.RegfKey attribute) (dissect.target.loaders.itunes.ClassKey attribute) KEY (dissect.target.plugins.apps.productivity.sevenzip.SevenZipPlugin attribute) key (dissect.target.plugins.os.windows.dpapi.master_key.MasterKey attribute) (dissect.target.plugins.os.windows.dpapi.master_key.MasterKeyFile property) KEY (dissect.target.plugins.os.windows.productkey.WindowsProductKeyPlugin attribute) (dissect.target.plugins.os.windows.regf.auditpol.AuditpolPlugin attribute) (dissect.target.plugins.os.windows.regf.cit.CITPlugin attribute) (dissect.target.plugins.os.windows.regf.nethist.NethistPlugin attribute) (dissect.target.plugins.os.windows.regf.trusteddocs.TrustedDocumentsPlugin attribute) (dissect.target.plugins.os.windows.regf.userassist.UserAssistPlugin attribute) key (dissect.target.plugins.os.windows.registry.RegistryPlugin attribute) KEY (dissect.target.plugins.os.windows.services.ServicesPlugin attribute) key (dissect.volume.dm.btree.Node attribute) (flow.record.adapter.mongo.MongoWriter attribute) KEY (in module dissect.regf.c_regf) key() (dissect.apfs.cursor.Cursor method) (dissect.cim.cim.CIM method) (dissect.target.helpers.regutil.HiveCollection method) (dissect.target.helpers.regutil.RegfHive method) (dissect.target.helpers.regutil.RegistryHive method) (dissect.target.helpers.regutil.VirtualHive method) (dissect.target.loaders.cb.CbRegistryHive method) (dissect.target.loaders.smb.SmbRegistryHive method) key_bag (dissect.target.loaders.itunes.ITunesBackup attribute) key_file (acquire.acquire.tools.decrypter.EncryptedFile attribute) key_fingerprint() (in module acquire.acquire.crypt) key_flags (dissect.fve.bde.information.KeyDatum property) (dissect.fve.bde.information.StretchKeyDatum property) (dissect.fve.bde.information.UseKeyDatum property) key_from_record() (dissect.database.ese.index.Index method) key_hash (dissect.hypervisor.util.envelope.Envelope attribute) (dissect.target.plugins.os.windows.dpapi.master_key.MasterKey attribute) key_info (dissect.hypervisor.util.envelope.Envelope attribute) key_iv_for_kernel_hash() (in module dissect.target.plugins.os.unix.linux.fortios._os) key_iv_from_keychain() (in module dissect.target.plugins.os.unix.linux.fortios._os) key_len (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) key_length (dissect.ntfs.index.IndexEntry property) (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm attribute) key_prefix (dissect.database.ese.page.Node attribute) (dissect.database.ese.page.Page property) key_reference (dissect.cim.classes.QualifierReference attribute) key_server (acquire.acquire.tools.decrypter.EncryptedFile attribute) key_size (dissect.fve.crypto.base.Cipher attribute) (dissect.fve.crypto.Cipher attribute) (dissect.fve.luks.metadata.Keyslot attribute) (dissect.fve.luks.metadata.KeyslotArea attribute) key_size_bytes (dissect.fve.crypto.base.Cipher attribute) (dissect.fve.crypto.Cipher attribute) key_suffix (dissect.database.ese.page.Node attribute) key_tables (dissect.hypervisor.descriptor.hyperv.HyperVFile attribute) key_type (dissect.fve.bde.information.KeyDatum property) (dissect.fve.bde.information.StretchKeyDatum property) (dissect.fve.bde.information.UseKeyDatum property) (dissect.target.helpers.keychain.Key attribute) (dissect.target.loaders.itunes.ClassKey attribute) (dissect.target.plugins.apps.ssh.ssh.SSHPrivateKey attribute) Keybag (class in dissect.apfs.objects.keybag) KeyBag (class in dissect.target.loaders.itunes) keybag (dissect.apfs.apfs.APFS property) (dissect.apfs.objects.fs.FS property) keyboard() (dissect.target.plugins.os.default.locale.LocalePlugin method) (dissect.target.plugins.os.unix.locale.UnixLocalePlugin method) (dissect.target.plugins.os.windows.locale.WindowsLocalePlugin method) Keychain (class in dissect.target.loaders.cellebrite) keychain (dissect.target.plugins.apps.browser.browser.BrowserPlugin attribute) (dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin attribute) KEYCHAIN (in module dissect.target.helpers.keychain) keychain_passwords() (in module dissect.target.plugins.os.windows.credential.credhist) KeychainKeyProviderPlugin (class in dissect.target.plugins.os.windows.dpapi.keyprovider.keychain) KeyCollection (class in dissect.target.helpers.regutil) KeyDataFlag (in module dissect.hypervisor.descriptor.c_hyperv) KeyDataType (in module dissect.hypervisor.descriptor.c_hyperv) KeyDatum (class in dissect.fve.bde.information) KEYED_EVENT (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) KeyIndex (class in dissect.regf.regf) keylocker (dissect.apfs.objects.nx_superblock.NxSuperblock property) KeyNode (class in dissect.regf.regf) KeyNotFoundError KeyProviderPlugin (class in dissect.target.plugins.os.windows.dpapi.keyprovider.keyprovider) keys (dissect.cim.classes.ClassDefinition property) (dissect.database.ese.ntds.pek.PEK property) (dissect.target.helpers.regutil.KeyCollection attribute) (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin attribute) (dissect.target.plugins.os.windows.regf.applications.WindowsApplicationsPlugin attribute) KEYS (dissect.target.plugins.os.windows.regf.bam.BamDamPlugin attribute) (dissect.target.plugins.os.windows.regf.clsid.CLSIDPlugin attribute) (dissect.target.plugins.os.windows.regf.muicache.MuiCachePlugin attribute) (dissect.target.plugins.os.windows.regf.runkeys.RunKeysPlugin attribute) (dissect.target.plugins.os.windows.regf.shellbags.ShellBagsPlugin attribute) (dissect.target.plugins.os.windows.regf.shimcache.ShimcachePlugin attribute) keys (dissect.target.volume.EncryptedVolumeSystem attribute) keys() (dissect.cim.index.IndexPage method) (dissect.hypervisor.descriptor.hyperv.HyperVFile method) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry method) (dissect.target.helpers.configutil.ConfigurationParser method) (dissect.target.helpers.regutil.HiveCollection method) (dissect.target.helpers.regutil.RegistryHive method) (dissect.target.plugins.os.windows.dpapi.keyprovider.credhist.CredHistKeyProviderPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.lsa.LSADefaultPasswordKeyProviderPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.winlogon.WinlogonDefaultPasswordKeyProviderPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.empty.EmptyKeyProviderPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.keychain.KeychainKeyProviderPlugin method) (dissect.target.plugins.os.windows.registry.RegistryPlugin method) (dissect.util.plist.NSObject method) KeySafe (class in dissect.hypervisor.descriptor.vmx) KeySecurity (class in dissect.regf.regf) keyset_id (dissect.archive.vbk.FibBlockDescriptorV7 property) (dissect.archive.vbk.StgBlockDescriptorV7 property) Keyslot (class in dissect.fve.luks.metadata) KeyslotAf (class in dissect.fve.luks.metadata) KeyslotArea (class in dissect.fve.luks.metadata) KeyslotKdf (class in dissect.fve.luks.metadata) keyslots (dissect.fve.luks.luks.LUKS property) (dissect.fve.luks.metadata.Digest attribute) (dissect.fve.luks.metadata.Metadata attribute) (dissect.fve.luks.metadata.Token attribute) keyslots_size (dissect.fve.luks.metadata.Config attribute) KeyStore (class in dissect.hypervisor.util.envelope) KeyType (class in dissect.target.helpers.keychain) (in module dissect.target.helpers.regutil) KeyValue (class in dissect.regf.regf) KeyValueCollection (class in dissect.eventlog.utils) KEYW (class in dissect.eventlog.wevt_object) keywords (dissect.etl.headers.event.EventDescriptor attribute) KNOWN_FILES (in module dissect.target.helpers.configutil) KNOWN_FOLDER_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) known_hosts() (dissect.target.plugins.apps.ssh.openssh.OpenSSHPlugin method) (dissect.target.plugins.apps.ssh.putty.PuTTYPlugin method) KNOWN_SKIP_TYPES (in module dissect.target.volumes.lvm) KnownDllRecord (in module dissect.target.plugins.os.windows.generic) knowndlls() (dissect.target.plugins.os.windows.generic.GenericPlugin method) KnownHostRecord (in module dissect.target.plugins.apps.ssh.ssh) KRYPTOLAN (dissect.target.helpers.network.IANAProtocol attribute) kv (dissect.target.helpers.regutil.RegfValue attribute) kwargs (flow.record.adapter.split.SplitWriter attribute) L l1_table (dissect.hypervisor.disk.qcow2.QCow2 property) (dissect.hypervisor.disk.qcow2.QCow2Snapshot property) (dissect.hypervisor.disk.qcow2.QCow2Stream attribute) l2_bits (dissect.hypervisor.disk.qcow2.QCow2 attribute) l2_size (dissect.hypervisor.disk.qcow2.QCow2 attribute) l2_table (dissect.hypervisor.disk.qcow2.QCow2 attribute) L2_VLAN (dissect.target.plugins.os.windows.network.IfTypes attribute) L2Table (class in dissect.hypervisor.disk.qcow2) L2TP (dissect.target.helpers.network.IANAProtocol attribute) L3_IPVLAN (dissect.target.plugins.os.windows.network.IfTypes attribute) L3_IPXVLAN (dissect.target.plugins.os.windows.network.IfTypes attribute) l_freq (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) l_state (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) label (acquire.acquire.gui.win32.Win32 attribute) (dissect.btrfs.btrfs.Btrfs attribute) (dissect.fve.luks.luks.LUKS attribute) (dissect.vmfs.vmfs.VMFS attribute) label() (dissect.fve.bde.information.ExternalInfoDatum method) (dissect.fve.bde.information.VmkInfoDatum method) LABEL_SCAN_SECTORS (in module dissect.volume.lvm.c_lvm2) LANG_DICT (dissect.target.plugins.os.windows.locale.WindowsLocalePlugin attribute) language() (dissect.target.plugins.os.default.locale.LocalePlugin method) (dissect.target.plugins.os.unix.bsd.citrix.locale.CitrixLocalePlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios.locale.LocalePlugin method) (dissect.target.plugins.os.unix.linux.fortios.locale.FortiOSLocalePlugin method) (dissect.target.plugins.os.unix.locale.UnixLocalePlugin method) (dissect.target.plugins.os.windows.locale.WindowsLocalePlugin method) languages() (dissect.executable.pe.directory.resource.Resource method) LAP_B (dissect.target.plugins.os.windows.network.IfTypes attribute) LAP_D (dissect.target.plugins.os.windows.network.IfTypes attribute) LAP_F (dissect.target.plugins.os.windows.network.IfTypes attribute) LargeFileBlockAddr (class in dissect.vmfs.address) LargeFileBlockResourceVMFS6 (class in dissect.vmfs.resource) LARP (dissect.target.helpers.network.IANAProtocol attribute) last() (dissect.apfs.cursor.Cursor method) (dissect.btrfs.tree.Cursor method) last_access_time (dissect.archive.wim.DirectoryEntry property) (dissect.ntfs.attr.FileName property) (dissect.ntfs.attr.StandardInformation property) (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntryResource attribute) last_access_time_ns (dissect.archive.wim.DirectoryEntry property) (dissect.ntfs.attr.FileName property) (dissect.ntfs.attr.StandardInformation property) last_accessed (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK_BEEF0004 attribute) LAST_ACK (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) last_block (dissect.extfs.extfs.ExtFS attribute) last_change_time (dissect.ntfs.attr.FileName property) (dissect.ntfs.attr.StandardInformation property) last_change_time_ns (dissect.ntfs.attr.FileName property) (dissect.ntfs.attr.StandardInformation property) last_connected (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) last_far_set_size (dissect.volume.raid.stream.RAID10Stream attribute) last_far_set_start (dissect.volume.raid.stream.RAID10Stream attribute) last_modification_time (dissect.ntfs.attr.FileName property) (dissect.ntfs.attr.StandardInformation property) last_modification_time_ns (dissect.ntfs.attr.FileName property) (dissect.ntfs.attr.StandardInformation property) last_modified (dissect.thumbcache.index.IndexEntry property) last_mount (dissect.extfs.extfs.ExtFS attribute) last_update_time (dissect.target.tools.dump.DumpState attribute) last_write_time (dissect.archive.wim.DirectoryEntry property) (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntryResource attribute) last_write_time_ns (dissect.archive.wim.DirectoryEntry property) LastEmptyDirectoryError lastlog() (dissect.target.plugins.os.unix.log.lastlog.LastLogPlugin method) lastlog_def (in module dissect.target.plugins.os.unix.log.lastlog) LastLogFile (class in dissect.target.plugins.os.unix.log.lastlog) lastlogin() (dissect.target.plugins.apps.webhosting.cpanel.CPanelPlugin method) LastLogPlugin (class in dissect.target.plugins.os.unix.log.lastlog) LastLogRecord (in module dissect.target.plugins.os.unix.log.lastlog) lastvisited() (dissect.target.plugins.os.windows.regf.mru.MRUPlugin method) LastVisitedMRURecord (in module dissect.target.plugins.os.windows.regf.mru) latest_timestamp (dissect.target.plugins.os.windows.prefetch.Prefetch property) LATIN (dissect.database.ese.lcmapstring.SCRIPT attribute) lattr() (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.MappedFile method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) LayerDirEntry (class in dissect.target.filesystem) LayerFilesystem (class in dissect.target.filesystem) LayerFilesystemEntry (class in dissect.target.filesystem) layers (dissect.target.filesystem.LayerFilesystem attribute) (dissect.target.loaders.containerimage.ContainerImageTarSubLoader attribute) Layout (class in dissect.volume.raid.stream) layout (dissect.volume.md.md.MDPhysicalDisk attribute) (dissect.volume.raid.raid.VirtualDisk attribute) LazyAttr (class in dissect.target.helpers.lazy) LazyImport (class in dissect.target.helpers.lazy) lchmod() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) LCID_TO_TAG (in module dissect.executable.pe.locale_id) LCMAP_BYTEREV (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_FULLWIDTH (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_HALFWIDTH (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_HASH (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_HIRAGANA (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_KATAKANA (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_LINGUISTIC_CASING (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_LOWERCASE (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_SIMPLIFIED_CHINESE (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_SORTHANDLE (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_SORTKEY (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_TITLECASE (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_TRADITIONAL_CHINESE (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_UPPERCASE (dissect.database.ese.lcmapstring.MapFlags attribute) LCS_WINDOWS_COLOR_SPACE (in module dissect.target.plugins.os.windows.rdpcache) ldirents (dissect.fat.fat.DirectoryEntry attribute) ldm_def (in module dissect.volume.ldm) LE (dissect.util.ldap.ComparisonOperator attribute) Leaf (class in dissect.database.ese.ntds.objects.leaf) LEAF_1 (dissect.target.helpers.network.IANAProtocol attribute) LEAF_2 (dissect.target.helpers.network.IANAProtocol attribute) LeafNode (class in dissect.database.ese.page) LEASERS (in module dissect.target.plugins.os.unix.linux.network) Leases (class in dissect.target.helpers.configutil) LEB128 (class in dissect.cstruct.types.leb128) LEFT_ASYMMETRIC (dissect.volume.raid.stream.Layout attribute) LEFT_ASYMMETRIC_6 (dissect.volume.raid.stream.Layout attribute) left_page (dissect.database.sqlite3.sqlite3.Cell attribute) left_sibling (dissect.ole.ole.DirectoryEntry property) LEFT_SYMMETRIC (dissect.volume.raid.stream.Layout attribute) LEFT_SYMMETRIC_6 (dissect.volume.raid.stream.Layout attribute) len_types (dissect.eventlog.wevt.WEVT property) length (dissect.btrfs.stream.Chunk attribute) (dissect.btrfs.stream.Extent attribute) (dissect.hypervisor.disk.vhdx.MetadataTable attribute) (dissect.ntfs.index.IndexEntry property) (dissect.util.compression.lzxpress_huffman.Symbol attribute) (dissect.volume.vinum.config.SD attribute) Less (dissect.ntfs.index.Match attribute) Level (class in dissect.volume.raid.stream) level (dissect.apfs.objects.btree_node.BTreeNode property) (dissect.cim.cim.Property property) (dissect.cim.classes.ClassDefinitionProperty attribute) (dissect.cim.classes.ClassInstanceProperty property) (dissect.etl.headers.event.EventDescriptor attribute) (dissect.volume.md.md.MDPhysicalDisk attribute) (dissect.volume.raid.raid.VirtualDisk attribute) (dissect.volume.raid.stream.RAID456Stream attribute) LEVL (class in dissect.eventlog.wevt_object) lexists() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) LFB (dissect.vmfs.resource.ResourceManager property) LibvirtLoader (class in dissect.target.loaders.libvirt) likely_unchanged() (in module dissect.target.tools.diff) LimaChildTargetPlugin (class in dissect.target.plugins.child.lima) limit (dissect.target.tools.diff.DifferentialCli attribute) line_reader() (dissect.target.helpers.configutil.Default method) LINEAR (dissect.volume.raid.stream.Level attribute) LinearStream (class in dissect.volume.raid.stream) LineReader (class in dissect.target.helpers.cache) lineterminator (flow.record.adapter.csvfile.CsvfileWriter attribute) LineWriter (class in dissect.target.helpers.cache) (class in flow.record.adapter.line) LINGUISTIC_IGNORECASE (dissect.database.ese.lcmapstring.MapFlags attribute) LINGUISTIC_IGNOREDIACRITIC (dissect.database.ese.lcmapstring.MapFlags attribute) link (dissect.btrfs.btrfs.INode property) (dissect.cramfs.cramfs.INode property) (dissect.database.ese.ntds.database.Database attribute) (dissect.executable.elf.elf.Section property) (dissect.extfs.extfs.INode property) (dissect.ffs.ffs.INode property) (dissect.jffs.jffs2.INode property) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx6.INode6 property) (dissect.squashfs.squashfs.INode property) LINK (dissect.target.helpers.regutil.RegistryValueType attribute) link (dissect.vmfs.descriptor.FileDescriptor property) (dissect.xfs.xfs.INode property) link() (dissect.target.filesystem.LayerFilesystem method) (dissect.target.filesystem.VirtualFilesystem method) LINK_EXTRA_DATA_HEADER_SIZE (in module dissect.shellitem.lnk.c_lnk) link_header (dissect.shellitem.lnk.lnk.Lnk attribute) LINK_HEADER_SIZE (in module dissect.shellitem.lnk.c_lnk) link_id (dissect.database.ese.ntds.schema.AttributeEntry attribute) link_info (dissect.shellitem.lnk.lnk.LnkInfo attribute) LINK_INFO_BODY_SIZE (in module dissect.shellitem.lnk.c_lnk) LINK_INFO_HEADER_SIZE (in module dissect.shellitem.lnk.c_lnk) link_inode (dissect.btrfs.btrfs.INode property) (dissect.ffs.ffs.INode property) (dissect.jffs.jffs2.INode property) (dissect.squashfs.squashfs.INode property) link_to() (dissect.target.helpers.compat.path_311.TargetPath method) linkage (dissect.etl.headers.event.EventHeaderExtendedDataItem attribute) linkinfo (dissect.shellitem.lnk.lnk.Lnk attribute) linkinfo_body (dissect.shellitem.lnk.lnk.LnkInfo attribute) linkinfo_header (dissect.shellitem.lnk.lnk.LnkInfo attribute) links() (dissect.database.ese.ntds.database.LinkTable method) (dissect.database.ese.ntds.objects.object.Object method) LinkTable (class in dissect.database.ese.ntds.database) LinkTrackObjectMoveTable (class in dissect.database.ese.ntds.objects.linktrackobjectmovetable) LinkTrackVolumeTable (class in dissect.database.ese.ntds.objects.linktrackvolumetable) LINUX (dissect.target.filesystems.cb.OS attribute) (dissect.target.plugin.OperatingSystem attribute) LINUX_DEV_DIR (in module dissect.target.loaders.local) LINUX_DRIVE_REGEX (in module dissect.target.loaders.local) LinuxNetworkConfigParser (class in dissect.target.plugins.os.unix.linux.network) LinuxNetworkManager (class in dissect.target.plugins.os.unix.linux.network_managers) LinuxNetworkPlugin (class in dissect.target.plugins.os.unix.linux.network) LinuxPlugin (class in dissect.target.plugins.os.unix.linux._os) LinuxProfile (class in acquire.acquire.acquire) LinuxServiceRecord (in module dissect.target.plugins.os.unix.linux.services) list_adapters() (in module flow.record.tools.rdump) list_children() (dissect.target.plugin.ChildTargetPlugin method) (dissect.target.plugins.child.colima.ColimaChildTargetPlugin method) (dissect.target.plugins.child.docker.DockerChildTargetPlugin method) (dissect.target.plugins.child.esxi.ESXiChildTargetPlugin method) (dissect.target.plugins.child.hyperv.HyperVChildTargetPlugin method) (dissect.target.plugins.child.lima.LimaChildTargetPlugin method) (dissect.target.plugins.child.parallels.ParallelsChildTargetPlugin method) (dissect.target.plugins.child.podman.PodmanChildTargetPlugin method) (dissect.target.plugins.child.proxmox.ProxmoxChildTargetPlugin method) (dissect.target.plugins.child.qemu.QemuChildTargetPlugin method) (dissect.target.plugins.child.virtualbox.VirtualBoxChildTargetPlugin method) (dissect.target.plugins.child.virtuozzo.VirtuozzoChildTargetPlugin method) (dissect.target.plugins.child.vmware_workstation.VmwareWorkstationChildTargetPlugin method) (dissect.target.plugins.child.wsl.WSLChildTargetPlugin method) (dissect.target.target.Target method) (in module dissect.target.tools.utils.cli) list_plugins() (in module dissect.target.tools.utils.cli) listdir (dissect.btrfs.btrfs.INode attribute) (dissect.jffs.jffs2.INode attribute) (dissect.squashfs.squashfs.INode attribute) listdir() (dissect.apfs.objects.fs.INode method) (dissect.archive.vbk.DirItem method) (dissect.archive.wim.DirectoryEntry method) (dissect.cramfs.cramfs.INode method) (dissect.evidence.ad1.ad1.FileEntry method) (dissect.executable.pe.directory.resource.ResourceDirectoryEntry method) (dissect.extfs.extfs.INode method) (dissect.ffs.ffs.INode method) (dissect.ntfs.mft.MftRecord method) (dissect.ole.ole.DirectoryEntry method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.vmfs.descriptor.FileDescriptor method) (dissect.xfs.xfs.INode method) listdir_ext() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) LISTEN (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) (dissect.target.plugins.os.unix.linux.proc.Sockets.UDPStates attribute) LISTENING (dissect.target.plugins.os.unix.linux.proc.Sockets.SocketStateType attribute) ListUnwrapper (class in dissect.target.helpers.configutil) listxattr (dissect.target.helpers.mount.DissectMount attribute) literal_bits (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) literal_freq (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) literal_state (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) lmd_bits (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) Lnk (class in dissect.shellitem.lnk.lnk) LNK (dissect.target.helpers.nfs.nfs3.FileType attribute) lnk() (dissect.target.plugins.os.windows.lnk.LnkPlugin method) lnk_def (in module dissect.shellitem.lnk.c_lnk) lnk_entries() (dissect.target.plugins.os.windows.lnk.LnkPlugin method) LNK_GUID (in module dissect.target.plugins.os.windows.jumplist) LnkExtraData (class in dissect.shellitem.lnk.lnk) LnkInfo (class in dissect.shellitem.lnk.lnk) LnkPlugin (class in dissect.target.plugins.os.windows.lnk) LnkRecord (in module dissect.target.plugins.os.windows.lnk) LnkStringData (class in dissect.shellitem.lnk.lnk) LnkTargetIdList (class in dissect.shellitem.lnk.lnk) load() (dissect.cstruct.cstruct.cstruct method) (dissect.database.ese.ntds.schema.Schema method) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.Config class method) (flow.record.fieldtypes.net.ipv4.SubnetList method) (in module dissect.target.helpers.config) (in module dissect.target.plugin) load_behavior (dissect.target.plugins.apps.productivity.msoffice.NativePluginStatus attribute) load_child() (in module acquire.acquire.acquire) load_config (dissect.executable.pe.pe.PE property) load_entrypoint_plugins() (acquire.acquire.uploaders.plugin_registry.PluginRegistry method) load_module() (in module dissect.cstruct.tools.stubgen) load_module_from_file() (in module dissect.target.plugin) load_module_from_name() (in module dissect.target.plugin) load_modules_from_paths() (in module dissect.target.plugin) load_plugin() (dissect.target.target.Target method) load_state() (in module dissect.target.tools.dump) load_user_hives() (dissect.target.plugins.os.windows.registry.RegistryPlugin method) LoadBehavior (class in dissect.target.plugins.apps.productivity.msoffice) LoadConfigDirectory (class in dissect.executable.pe.directory.load_config) loaded (dissect.target.plugins.apps.productivity.msoffice.NativePluginStatus attribute) Loader (class in dissect.target.loader) loader (dissect.target.loaders.vbk.VbkLoader attribute) LoaderError LoaderListPlugin (class in dissect.target.plugins.general.loaders) loaders() (dissect.target.plugins.general.loaders.LoaderListPlugin method) loadfile() (dissect.cstruct.cstruct.cstruct method) local() (dissect.target.plugins.os.default.datetime.DateTimePlugin method) local_address (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) local_def (in module dissect.target.plugins.apps.container.docker) local_groups_to_users() (in module dissect.target.plugins.os.unix.linux.fortios._os) local_ip (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) local_module() (in module acquire.acquire.acquire) local_port (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) local_wintimestamp() (in module dissect.target.plugins.os.windows.regf.cit) LocalePlugin (class in dissect.target.plugins.os.default.locale) (class in dissect.target.plugins.os.unix.bsd.darwin.ios.locale) Locality (class in dissect.database.ese.ntds.objects.locality) localized_name (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK_BEEF0004 attribute) LocalLoader (class in dissect.target.loaders.local) LocalPortPolicy (class in dissect.target.helpers.sunrpc.client) LOCALTALK (dissect.target.plugins.os.windows.network.IfTypes attribute) locate() (dissect.target.plugins.os.unix.locate.gnulocate.GNULocatePlugin method) (dissect.target.plugins.os.unix.locate.mlocate.MLocatePlugin method) (dissect.target.plugins.os.unix.locate.plocate.PLocatePlugin method) location (dissect.hypervisor.descriptor.vbox.HardDisk property) locators (dissect.hypervisor.descriptor.vmx.KeySafe attribute) lock_args (dissect.volume.lvm.metadata.LogicalVolume attribute) (dissect.volume.lvm.metadata.VolumeGroup attribute) lock_info (dissect.vmfs.descriptor.FileDescriptor property) lock_type (dissect.volume.lvm.metadata.VolumeGroup attribute) LOCKOUT (dissect.database.ese.ntds.util.UserAccountControl attribute) log (dissect.target.loaders.remote.RemoteStreamConnection attribute) (dissect.target.target.Target attribute) (in module acquire.acquire.acquire) (in module acquire.acquire.collector) (in module acquire.acquire.dynamic.windows.collect) (in module acquire.acquire.dynamic.windows.handles) (in module acquire.acquire.hashes) (in module acquire.acquire.log) (in module acquire.acquire.tools.decrypter) (in module acquire.acquire.uploaders.plugin_registry) (in module dissect.apfs.apfs) (in module dissect.archive.tools.backup) (in module dissect.cstruct.compiler) (in module dissect.cstruct.tools.stubgen) (in module dissect.database.ese.ntds.query) (in module dissect.database.sqlite3.wal) (in module dissect.eventlog.evtx) (in module dissect.evidence.ewf.ewf) (in module dissect.evidence.tools.adcrypt) (in module dissect.extfs.extfs) (in module dissect.ffs.ffs) (in module dissect.fve.bde.bde) (in module dissect.hypervisor.disk.vhdx) (in module dissect.hypervisor.disk.vmdk) (in module dissect.jffs.jffs2) (in module dissect.regf.regf) (in module dissect.shellitem.lnk.lnk) (in module dissect.shellitem.tools.lnk) (in module dissect.target.container) (in module dissect.target.containers.fortifw) (in module dissect.target.filesystem) (in module dissect.target.filesystems.apfs) (in module dissect.target.filesystems.overlay) (in module dissect.target.filesystems.smb) (in module dissect.target.filesystems.tar) (in module dissect.target.filesystems.xfs) (in module dissect.target.filesystems.zip) (in module dissect.target.helpers.config) (in module dissect.target.helpers.configutil) (in module dissect.target.helpers.keychain) (in module dissect.target.helpers.loaderutil) (in module dissect.target.helpers.mount) (in module dissect.target.helpers.utils) (in module dissect.target.loaders.acquire) (in module dissect.target.loaders.cellebrite) (in module dissect.target.loaders.containerimage) (in module dissect.target.loaders.direct) (in module dissect.target.loaders.hyperv) (in module dissect.target.loaders.mqtt) (in module dissect.target.loaders.remote) (in module dissect.target.loaders.tar) (in module dissect.target.loaders.uac) (in module dissect.target.loaders.velociraptor) (in module dissect.target.plugin) (in module dissect.target.plugins.apps.browser.firefox) (in module dissect.target.plugins.apps.container.docker) (in module dissect.target.plugins.apps.ssh.putty) (in module dissect.target.plugins.filesystem.yara) (in module dissect.target.plugins.os.unix._os) (in module dissect.target.plugins.os.unix.linux.network_managers) (in module dissect.target.plugins.os.unix.log.helpers) (in module dissect.target.plugins.os.unix.log.journal) (in module dissect.target.plugins.os.windows.credential.credhist) (in module dissect.target.plugins.os.windows.dpapi.master_key) (in module dissect.target.plugins.os.windows.everything.parser) (in module dissect.target.plugins.os.windows.jumplist) (in module dissect.target.plugins.os.windows.log.schedlgu) (in module dissect.target.plugins.os.windows.regf.shellbags) (in module dissect.target.target) (in module dissect.target.tools.dd) (in module dissect.target.tools.diff) (in module dissect.target.tools.dump) (in module dissect.target.tools.fs) (in module dissect.target.tools.info) (in module dissect.target.tools.inspect) (in module dissect.target.tools.mount) (in module dissect.target.tools.qfind) (in module dissect.target.tools.query) (in module dissect.target.tools.reg) (in module dissect.target.tools.shell) (in module dissect.target.tools.yara) (in module dissect.target.volume) (in module dissect.target.volumes.bde) (in module dissect.target.volumes.luks) (in module dissect.target.volumes.lvm) (in module dissect.volume.ldm) (in module dissect.volume.lvm.lvm2) (in module dissect.volume.vinum.config) (in module dissect.volume.vinum.vinum) (in module dissect.volume.vss) (in module dissect.xfs.xfs) (in module flow.record.adapter.elastic) (in module flow.record.adapter.splunk) (in module flow.record.base) (in module flow.record.jsonpacker) (in module flow.record.stream) (in module flow.record.tools.rdump) log() (dissect.target.plugins.os.unix.linux.debian.dpkg.DpkgPlugin method) LOG_DB_GLOB (dissect.target.plugins.os.windows.ual.UalPlugin attribute) LOG_DIR (dissect.target.plugins.os.windows.log.intunemanagementextension.IntuneManagementExtensionLogParserPlugin attribute) LOG_DIR_PATH (dissect.target.plugins.os.unix.linux.debian.apt.AptPlugin attribute) (dissect.target.plugins.os.unix.linux.redhat.yum.YumPlugin attribute) (dissect.target.plugins.os.unix.linux.suse.zypper.ZypperPlugin attribute) log_dirs (dissect.target.plugins.apps.webserver.iis.IISLogsPlugin property) LOG_FILE_FIREWALL (dissect.target.plugins.apps.av.trendmicro.TrendMicroPlugin attribute) log_file_handler (in module acquire.acquire.acquire) LOG_FILE_INFECTIONS (dissect.target.plugins.apps.av.trendmicro.TrendMicroPlugin attribute) LOG_FILE_PATTERN (dissect.target.plugins.apps.av.mcafee.McAfeePlugin attribute) LOG_FILE_REGEX (in module dissect.target.plugins.apps.webserver.caddy) log_filename (dissect.etl.headers.logfile.LogfileHeader attribute) log_files (dissect.target.plugins.apps.remoteaccess.rustdesk.RustdeskPlugin attribute) (dissect.target.plugins.apps.remoteaccess.splashtop.SplashtopPlugin attribute) (dissect.target.plugins.os.unix.log.messages.MessagesPlugin attribute) LOG_FILES_GLOB (dissect.target.plugins.os.unix.linux.debian.apt.AptPlugin attribute) (dissect.target.plugins.os.unix.linux.redhat.yum.YumPlugin attribute) (dissect.target.plugins.os.unix.linux.suse.zypper.ZypperPlugin attribute) (in module dissect.target.plugins.os.unix.linux.debian.dpkg) LOG_FOLDER (dissect.target.plugins.apps.av.trendmicro.TrendMicroPlugin attribute) LOG_FORMAT_ACCESS_COMBINED (in module dissect.target.plugins.apps.webserver.apache) LOG_FORMAT_ACCESS_COMMON (in module dissect.target.plugins.apps.webserver.apache) LOG_FORMAT_ACCESS_VHOST_COMBINED (in module dissect.target.plugins.apps.webserver.apache) LOG_FORMAT_CITRIX_NETSCALER_ACCESS_COMBINED_RESPONSE_TIME (in module dissect.target.plugins.apps.webserver.citrix) LOG_FORMAT_CITRIX_NETSCALER_ACCESS_COMBINED_RESPONSE_TIME_WITH_HEADERS (in module dissect.target.plugins.apps.webserver.citrix) LOG_FORMAT_ERROR_COMMON (in module dissect.target.plugins.apps.webserver.apache) log_func_error() (dissect.target.tools.utils.report.ExecutionReport method) log_func_execution() (dissect.target.tools.utils.report.ExecutionReport method) log_incompatible_plugin() (dissect.target.tools.utils.report.ExecutionReport method) LOG_PATHS (dissect.target.plugins.apps.remoteaccess.splashtop.SplashtopPlugin attribute) log_paths (dissect.target.plugins.apps.webserver.caddy.CaddyPlugin attribute) (dissect.target.plugins.os.unix.log.audit.AuditPlugin attribute) (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin attribute) LOG_PATTERN (in module dissect.target.plugins.os.windows.log.agentexecutor) (in module dissect.target.plugins.os.windows.log.intunemanagementextension) log_progress() (in module dissect.target.tools.dump) LOG_RECORD_NAME (in module dissect.target.plugins.apps.webserver.iis) LOG_REGEX (in module dissect.target.plugins.apps.webserver.caddy) log_registered_plugin() (dissect.target.tools.utils.report.ExecutionReport method) LOG_SEP_AV (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) LOG_SEP_NET (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) LOG_SOPHOS_HITMAN (dissect.target.plugins.apps.av.sophos.SophosPlugin attribute) LOG_SOPHOS_HOME (dissect.target.plugins.apps.av.sophos.SophosPlugin attribute) LOG_TIME_FORMAT (dissect.target.plugins.os.unix.linux.iptables.IptablesSavePlugin attribute) LogConfig (class in dissect.target.plugins.os.windows.firewall) logfile (dissect.target.plugins.os.windows.log.pfro.PfroPlugin attribute) logfile_def (in module dissect.etl.headers.logfile) logfile_header (dissect.etl.etl.ETL attribute) LogfileHeader (class in dissect.etl.headers.logfile) logfiles (dissect.target.plugins.apps.remoteaccess.teamviewer.TeamViewerPlugin attribute) LogFormat (class in dissect.target.plugins.apps.webserver.apache) logger (flow.record.adapter.duckdb.DuckdbReader attribute) (flow.record.adapter.duckdb.DuckdbWriter attribute) (flow.record.adapter.sqlite.SqliteReader attribute) (flow.record.adapter.sqlite.SqliteWriter attribute) (in module flow.record.adapter.duckdb) (in module flow.record.adapter.sqlite) (in module flow.record.tools.geoip) logger_name (dissect.etl.headers.logfile.LogfileHeader attribute) LOGGING_KEYS (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin attribute) LOGGING_TRACE_LEVEL (in module flow.record.utils) logical_image (dissect.evidence.ad1.ad1.AD1 attribute) logical_num (dissect.cim.index.IndexPage attribute) (dissect.cim.objects.DataPage attribute) logical_page() (dissect.cim.objects.Store method) LOGICAL_SECTOR_SIZE_GUID (in module dissect.hypervisor.disk.c_vhdx) logical_threads (dissect.volume.lvm.metadata.VdoPoolSegment attribute) logical_volume (dissect.volume.lvm.metadata.Segment property) LOGICAL_VOLUME_MANAGERS (in module dissect.target.volume) logical_volumes (dissect.volume.lvm.metadata.VolumeGroup attribute) LogicalImage (class in dissect.evidence.ad1.ad1) LogicalOperator (class in dissect.util.ldap) LogicalVolume (class in dissect.volume.lvm.metadata) LogicalVolumeSystem (class in dissect.target.volume) LogLoader (class in dissect.target.loaders.log) logon_type (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) LogonTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) LOGS (dissect.target.plugins.apps.av.sophos.SophosPlugin attribute) (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) logs (dissect.target.plugins.os.windows.log.amcache.AmcacheInstallPlugin attribute) logs() (dissect.target.plugins.apps.av.symantec.SymantecPlugin method) (dissect.target.plugins.apps.container.docker.DockerPlugin method) (dissect.target.plugins.apps.container.podman.PodmanPlugin method) (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin method) (dissect.target.plugins.apps.remoteaccess.rustdesk.RustdeskPlugin method) (dissect.target.plugins.apps.remoteaccess.splashtop.SplashtopPlugin method) (dissect.target.plugins.apps.remoteaccess.teamviewer.TeamViewerPlugin method) (dissect.target.plugins.apps.webserver.iis.IISLogsPlugin method) (dissect.target.plugins.apps.webserver.webserver.WebserverPlugin method) (dissect.target.plugins.os.unix.linux.debian.apt.AptPlugin method) (dissect.target.plugins.os.unix.linux.redhat.yum.YumPlugin method) (dissect.target.plugins.os.unix.linux.suse.zypper.ZypperPlugin method) (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin method) LOGS_DIR_PATH (dissect.target.plugins.os.windows.log.evt.EvtPlugin attribute) (dissect.target.plugins.os.windows.log.evt.WindowsEventlogsMixin attribute) (dissect.target.plugins.os.windows.log.evtx.EvtxPlugin attribute) LOGS_DIRS (dissect.target.loaders.log.LogLoader attribute) long_name (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK_BEEF0004 attribute) lookup (dissect.apfs.objects.omap.ObjectMap attribute) (dissect.cstruct.parser.TokenCollection attribute) (dissect.cstruct.types.structure.StructureMetaType attribute) (dissect.database.bsd.db.Page property) (dissect.hypervisor.disk.vhdx.MetadataTable attribute) (dissect.hypervisor.disk.vhdx.RegionTable attribute) (dissect.ntfs.secure.Secure attribute) lookup() (dissect.cim.index.Index method) (dissect.database.ese.ntds.database.DataTable method) (dissect.database.ese.ntds.schema.Schema method) (dissect.target.helpers.nfs.client.nfs.Client method) (dissect.util.compression.lzxpress_huffman.BitString method) (dissect.volume.dm.btree.BTree method) (in module dissect.etl.manifest) (in module dissect.target.plugin) Lookup3ResultDeserializer (class in dissect.target.helpers.nfs.serializer) lookup8() (in module dissect.util.hash.jenkins) lookup8_quads() (in module dissect.util.hash.jenkins) lookup_attribute() (dissect.database.ese.ntds.schema.Schema method) lookup_class() (dissect.database.ese.ntds.schema.Schema method) lookup_guid() (in module dissect.etl.utils) lookup_oid() (dissect.database.ese.ntds.schema.Schema method) lookup_table (dissect.squashfs.squashfs.SquashFS attribute) lookup_thunk (dissect.executable.pe.directory.imports.ImportFunction attribute) LookupProc (in module dissect.target.helpers.nfs.nfs3) LookupResult (class in dissect.target.helpers.nfs.nfs3) lookups (dissect.cstruct.cstruct.cstruct attribute) LostAndFound (class in dissect.database.ese.ntds.objects.lostandfound) low (dissect.target.helpers.sunrpc.sunrpc.Mismatch attribute) low_watermark (dissect.volume.lvm.metadata.WriteCacheSegment attribute) lower() (in module flow.record.selector) lowest_vcn (dissect.ntfs.attr.AttributeHeader property) LOWORD() (in module acquire.acquire.gui.win32) LRESULT (in module acquire.acquire.gui.win32) ls() (in module dissect.target.tools.fs) LS_COLORS (in module dissect.target.tools.utils.fs) ls_scandir() (in module dissect.target.tools.utils.fs) LSADefaultPasswordKeyProviderPlugin (class in dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.lsa) lsakey (dissect.target.plugins.os.windows.lsa.LSAPlugin property) LSAPlugin (class in dissect.target.plugins.os.windows.lsa) LSASecretRecord (in module dissect.target.plugins.os.windows.lsa) lsmod() (dissect.target.plugins.os.unix.linux.modules.ModulePlugin method) lsn_archive_tail (dissect.clfs.blf.Stream attribute) lsn_base (dissect.clfs.blf.Stream attribute) lsn_flush (dissect.clfs.blf.Stream attribute) lsn_last (dissect.clfs.blf.Stream attribute) lsn_physical_base (dissect.clfs.blf.Stream attribute) lstat() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.MappedFile method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.apfs.ApfsFilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry method) (dissect.target.filesystems.cb.CbFilesystemEntry method) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.exfat.ExfatFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.fat.FatFilesystemEntry method) (dissect.target.filesystems.ffs.FfsFilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemDirectoryEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemEntry method) (dissect.target.filesystems.jffs.JffsFilesystemEntry method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.ntds.NtdsFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry method) (dissect.target.filesystems.smb.SmbFilesystemEntry method) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystemDirectoryEntry method) (dissect.target.filesystems.tar.TarFilesystemEntry method) (dissect.target.filesystems.vbk.VbkFilesystemEntry method) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystemEntry method) (dissect.target.loaders.res.ResFile method) (dissect.target.plugins.os.unix.linux.debian.proxmox._os.ProxmoxConfigDirectoryEntry method) (dissect.target.plugins.os.unix.linux.debian.proxmox._os.ProxmoxConfigFileEntry method) LT (dissect.util.ldap.ComparisonOperator attribute) LUID (class in acquire.acquire.dynamic.windows.types) LUID_AND_ATTRIBUTES (class in acquire.acquire.dynamic.windows.types) LUKS (class in dissect.fve.luks.luks) luks (dissect.target.volumes.luks.LUKSVolumeSystem attribute) (in module dissect.target.volume) LUKS2_MAGIC_1ST (in module dissect.fve.luks.c_luks) LUKS2_MAGIC_2ND (in module dissect.fve.luks.c_luks) luks_def (in module dissect.fve.luks.c_luks) LUKS_MAGIC (in module dissect.fve.luks.c_luks) LUKSVolumeSystem (class in dissect.target.volumes.luks) LUKSVolumeSystemError lv (dissect.volume.lvm.metadata.Segment property) (dissect.volume.lvm.metadata.VolumeGroup property) lv_page (dissect.database.ese.table.Table property) LVM (class in dissect.vmfs.lvm) lvm (dissect.target.volumes.lvm.LvmVolumeSystem attribute) (dissect.target.volumes.vmfs.VmfsVolumeSystem attribute) (in module dissect.target.volume) LVM2 (class in dissect.volume.lvm.lvm2) LVM2Device (class in dissect.volume.lvm.physical) LVM2Error lvm_def (in module dissect.vmfs.c_lvm) (in module dissect.volume.lvm.c_lvm2) LvmVolumeSystem (class in dissect.target.volumes.lvm) LZ4 (dissect.target.tools.dump.Compression attribute) LZ4_MAGIC (in module flow.record.base) lz4_python (in module dissect.util.compression) LZFSE_COMPRESSEDLZVN_BLOCK_MAGIC (in module dissect.util.compression.lzfse) LZFSE_COMPRESSEDV1_BLOCK_MAGIC (in module dissect.util.compression.lzfse) LZFSE_COMPRESSEDV2_BLOCK_MAGIC (in module dissect.util.compression.lzfse) LZFSE_ENCODE_D_STATES (in module dissect.util.compression.lzfse) LZFSE_ENCODE_D_SYMBOLS (in module dissect.util.compression.lzfse) LZFSE_ENCODE_L_STATES (in module dissect.util.compression.lzfse) LZFSE_ENCODE_L_SYMBOLS (in module dissect.util.compression.lzfse) LZFSE_ENCODE_LITERAL_STATES (in module dissect.util.compression.lzfse) LZFSE_ENCODE_LITERAL_SYMBOLS (in module dissect.util.compression.lzfse) LZFSE_ENCODE_M_STATES (in module dissect.util.compression.lzfse) LZFSE_ENCODE_M_SYMBOLS (in module dissect.util.compression.lzfse) LZFSE_ENDOFSTREAM_BLOCK_MAGIC (in module dissect.util.compression.lzfse) LZFSE_LITERALS_PER_BLOCK (in module dissect.util.compression.lzfse) LZFSE_MATCHES_PER_BLOCK (in module dissect.util.compression.lzfse) LZFSE_UNCOMPRESSED_BLOCK_MAGIC (in module dissect.util.compression.lzfse) LZFSECompressedBlockHeader (class in dissect.util.compression.lzfse) lzo_python (in module dissect.util.compression) M m_freq (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) m_state (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) mac (dissect.fve.bde.information.AesCbc256HmacSha512EncryptedDatum property) (dissect.fve.bde.information.AesCcmEncryptedDatum property) (dissect.hypervisor.descriptor.vmx.Pair attribute) MAC (dissect.target.filesystems.cb.OS attribute) mac_address (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) macb_aggregator() (in module dissect.target.plugins.filesystem.ntfs.mft) Machine (class in dissect.hypervisor.descriptor.vbox) machine (dissect.executable.pe.pe.PE property) (dissect.hypervisor.descriptor.vbox.VBox attribute) machine() (dissect.target.plugins.os.windows.regf.clsid.CLSIDPlugin method) machine_key (dissect.target.plugins.os.windows.dpapi.master_key.CredSystem attribute) MACHINE_NAME (dissect.target.loaders.smb.SmbLoader attribute) machine_sid() (dissect.target.plugins.os.windows.generic.GenericPlugin method) machinename (dissect.target.helpers.sunrpc.sunrpc.AuthUnix attribute) MacOS (class in acquire.acquire.acquire) MACOS (dissect.target.plugin.OperatingSystem attribute) MacOSApplicationsInfo (class in acquire.acquire.acquire) MacOSInterfaceRecord (in module dissect.target.helpers.record) MacOSNetworkPlugin (class in dissect.target.plugins.os.unix.bsd.darwin.macos.network) MacOSPlugin (class in dissect.target.plugins.os.unix.bsd.darwin.macos._os) MacOSProfile (class in acquire.acquire.acquire) MacOSUserRecord (in module dissect.target.helpers.record) macs() (dissect.target.plugins.os.default.network.NetworkPlugin method) MAGENTA (dissect.target.helpers.cyber.Color attribute) (dissect.target.tools.shell.AnsiColors attribute) Magic (class in dissect.target.helpers.magic.magic) magic (dissect.target.plugins.os.windows.jumplist.CustomDestinationFile attribute) MAGIC_ACTIVE (in module dissect.volume.vinum.c_vinum) MAGIC_FOOTER (dissect.target.plugins.os.windows.jumplist.CustomDestinationFile attribute) MAGIC_INACTIVE (in module dissect.volume.vinum.c_vinum) MAGIC_NT52 (in module dissect.target.plugins.os.windows.regf.shimcache) MAGIC_NT61 (in module dissect.target.plugins.os.windows.regf.shimcache) MAGIC_WIN10 (in module dissect.target.plugins.os.windows.regf.shimcache) MAGIC_WIN81 (in module dissect.target.plugins.os.windows.regf.shimcache) MagicResult (in module dissect.target.helpers.magic.magic) MagicSignature (in module dissect.target.helpers.magic.magic) main() (in module acquire.acquire.acquire) (in module acquire.acquire.tools.decrypter) (in module dissect.archive.tools.backup) (in module dissect.cstruct.tools.stubgen) (in module dissect.database.bsd.tools.rpm) (in module dissect.database.ese.ntds.tools.ntds) (in module dissect.database.ese.tools.certlog) (in module dissect.database.ese.tools.sru) (in module dissect.database.ese.tools.ual) (in module dissect.evidence.tools.adcrypt) (in module dissect.evidence.tools.asdf.dd) (in module dissect.evidence.tools.asdf.meta) (in module dissect.evidence.tools.asdf.repair) (in module dissect.evidence.tools.asdf.verify) (in module dissect.fve.tools.dd) (in module dissect.hypervisor.tools.envelope) (in module dissect.hypervisor.tools.vmtar) (in module dissect.shellitem.tools.lnk) (in module dissect.target.containers.fortifw) (in module dissect.target.loaders.ab) (in module dissect.target.tools.build_magic) (in module dissect.target.tools.build_pluginlist) (in module dissect.target.tools.dd) (in module dissect.target.tools.diff) (in module dissect.target.tools.dump) (in module dissect.target.tools.fs) (in module dissect.target.tools.info) (in module dissect.target.tools.inspect) (in module dissect.target.tools.mount) (in module dissect.target.tools.qfind) (in module dissect.target.tools.query) (in module dissect.target.tools.reg) (in module dissect.target.tools.shell) (in module dissect.target.tools.yara) (in module dissect.thumbcache.tools.extract_images) (in module dissect.thumbcache.tools.extract_with_index) (in module dissect.util.tools.dump_nskeyedarchiver) (in module flow.record.tools.geoip) (in module flow.record.tools.rdump) main_globals (in module dissect.database.ese.tools.impacket) major (dissect.cramfs.cramfs.INode property) (dissect.squashfs.squashfs.SquashFS attribute) major_version (dissect.vmfs.lvm.Device attribute) (dissect.vmfs.vmfs.VMFS attribute) make() (dissect.vmfs.address.Address class method) (dissect.vmfs.address.FileBlockAddr class method) (dissect.vmfs.address.FileDescriptorAddr class method) (dissect.vmfs.address.JournalBlockAddr class method) (dissect.vmfs.address.LargeFileBlockAddr class method) (dissect.vmfs.address.PointerBlockAddr class method) (dissect.vmfs.address.PointerBlockAddr64 class method) (dissect.vmfs.address.SmallFileBlockAddr class method) (dissect.vmfs.address.SubBlockAddr class method) (dissect.vmfs.address.SubBlockAddr64 class method) make_cli_args_overview() (in module dissect.target.tools.utils.report) make_fs_object_key() (in module dissect.apfs.util) make_key() (dissect.database.ese.cursor.Cursor method) (dissect.database.ese.index.Index method) make_keys() (dissect.target.helpers.regutil.VirtualHive method) make_plugin_import_errors_overview() (in module dissect.target.tools.utils.report) make_selector() (in module flow.record.selector) make_target_pairs() (in module dissect.target.tools.diff) make_type() (dissect.vmfs.address.Address class method) makedirs() (dissect.target.filesystem.VirtualFilesystem method) MalformedElfChnkException managed_by() (dissect.database.ese.ntds.objects.computer.Computer method) (dissect.database.ese.ntds.objects.dnszone.DnsZone method) (dissect.database.ese.ntds.objects.domainpolicy.DomainPolicy method) (dissect.database.ese.ntds.objects.group.Group method) (dissect.database.ese.ntds.objects.ntdsdsa.NTDSDSA method) (dissect.database.ese.ntds.objects.ntdssitesettings.NTDSSiteSettings method) (dissect.database.ese.ntds.objects.ntfrssettings.NTFRSSettings method) (dissect.database.ese.ntds.objects.organizationalunit.OrganizationalUnit method) (dissect.database.ese.ntds.objects.physicallocation.PhysicalLocation method) (dissect.database.ese.ntds.objects.server.Server method) (dissect.database.ese.ntds.objects.site.Site method) managed_objects() (dissect.database.ese.ntds.objects.user.User method) managers (dissect.target.plugins.os.unix.linux.network_managers.LinuxNetworkManager attribute) MANAGERS (in module dissect.target.plugins.os.unix.linux.network) (in module dissect.target.plugins.os.unix.linux.network_managers) MANET (dissect.target.helpers.network.IANAProtocol attribute) manifest (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.target.loaders.containerimage.ContainerImageTarSubLoader attribute) (dissect.target.loaders.itunes.ITunesBackup attribute) manifest_db (dissect.target.loaders.itunes.ITunesBackup attribute) ManifestNotFoundError Manual (dissect.target.plugins.apps.productivity.msoffice.LoadBehavior attribute) map (dissect.cim.index.Store attribute) (dissect.cim.objects.Store attribute) (dissect.hypervisor.disk.vdi.VDIStream attribute) (dissect.volume.vss.BlockList attribute) (dissect.volume.vss.BlockMap attribute) MAP (in module dissect.target.helpers.magic.mimetypes) map() (dissect.target.loader.Loader method) (dissect.target.loaders.ab.AndroidBackupLoader method) (dissect.target.loaders.acquire.AcquireTarSubLoader method) (dissect.target.loaders.acquire.AcquireZipSubLoader method) (dissect.target.loaders.ad1.AD1Loader method) (dissect.target.loaders.asdf.AsdfLoader method) (dissect.target.loaders.cb.CbLoader method) (dissect.target.loaders.cellebrite.CellebriteLoader method) (dissect.target.loaders.containerimage.ContainerImageTarSubLoader method) (dissect.target.loaders.cyber.CyberLoader method) (dissect.target.loaders.dir.DirLoader method) (dissect.target.loaders.direct.DirectLoader method) (dissect.target.loaders.hyperv.HyperVLoader method) (dissect.target.loaders.itunes.ITunesLoader method) (dissect.target.loaders.kape.KapeLoader method) (dissect.target.loaders.libvirt.LibvirtLoader method) (dissect.target.loaders.local.LocalLoader method) (dissect.target.loaders.log.LogLoader method) (dissect.target.loaders.mqtt.MqttLoader method) (dissect.target.loaders.multiraw.MultiRawLoader method) (dissect.target.loaders.nscollector.NsCollectorTarSubLoader method) (dissect.target.loaders.overlay.OverlayLoader method) (dissect.target.loaders.overlay2.Overlay2Loader method) (dissect.target.loaders.ovf.OvfLoader method) (dissect.target.loaders.phobos.PhobosLoader method) (dissect.target.loaders.profile.ProfileLoader method) (dissect.target.loaders.proxmox.ProxmoxLoader method) (dissect.target.loaders.pvs.PvsLoader method) (dissect.target.loaders.raw.RawLoader method) (dissect.target.loaders.remote.RemoteLoader method) (dissect.target.loaders.res.ResLoader method) (dissect.target.loaders.smb.SmbLoader method) (dissect.target.loaders.tanium.TaniumLoader method) (dissect.target.loaders.tar.GenericTarSubLoader method) (dissect.target.loaders.tar.TarLoader method) (dissect.target.loaders.tar.TarSubLoader method) (dissect.target.loaders.target.TargetLoader method) (dissect.target.loaders.uac.UacLoader method) (dissect.target.loaders.uac.UacTarSubloader method) (dissect.target.loaders.uac.UacZipSubLoader method) (dissect.target.loaders.utm.UtmLoader method) (dissect.target.loaders.vb.VBLoader method) (dissect.target.loaders.vbk.VbkLoader method) (dissect.target.loaders.vbox.VBoxLoader method) (dissect.target.loaders.velociraptor.VelociraptorLoader method) (dissect.target.loaders.vma.VmaLoader method) (dissect.target.loaders.vmsupport.VmSupportLoader method) (dissect.target.loaders.vmsupport.VmSupportTarSubloader method) (dissect.target.loaders.vmx.VmxLoader method) (dissect.target.loaders.xva.XvaLoader method) (dissect.target.loaders.zip.GenericZipSubLoader method) (dissect.target.loaders.zip.ZipLoader method) (dissect.target.loaders.zip.ZipSubLoader method) map_definition() (dissect.target.helpers.regutil.RegFlex method) map_dir() (dissect.target.filesystem.VirtualFilesystem method) map_dir_from_tar() (dissect.target.filesystem.VirtualFilesystem method) map_dirs() (in module dissect.target.loaders.dir) map_esxi_drives() (in module dissect.target.loaders.local) map_file() (dissect.target.filesystem.VirtualFilesystem method) map_file_entry() (dissect.target.filesystem.VirtualFilesystem method) map_file_fh() (dissect.target.filesystem.VirtualFilesystem method) map_file_from_tar() (dissect.target.filesystem.VirtualFilesystem method) map_fs() (dissect.target.filesystem.VirtualFilesystem method) map_hive() (dissect.target.helpers.regutil.VirtualHive method) map_key() (dissect.target.helpers.regutil.VirtualHive method) map_linux_drives() (in module dissect.target.loaders.local) map_solaris_drives() (in module dissect.target.loaders.local) map_string() (in module dissect.database.ese.lcmapstring) map_type (dissect.cim.cim.CIM attribute) map_value() (dissect.target.helpers.regutil.VirtualHive method) map_windows_drives() (in module dissect.target.loaders.local) map_windows_mounted_drives() (in module dissect.target.loaders.local) MapFlags (class in dissect.database.ese.lcmapstring) MapNetworkDriveMRURecord (in module dissect.target.plugins.os.windows.regf.mru) MappedCompressedFile (class in dissect.target.filesystem) MappedFile (class in dissect.target.filesystem) Mapping (class in dissect.cim.mappings) mapping (dissect.cim.mappings.Mapping attribute) (dissect.eventlog.bxml.Template attribute) (dissect.thumbcache.thumbcache.Thumbcache property) MAPPING_FILE_CLEAN (in module dissect.cim.c_cim) MAPPING_PAGE_ID_MASK (in module dissect.cim.c_cim) MAPPING_PAGE_UNAVAIL (in module dissect.cim.c_cim) MappingEntry (class in dissect.cim.mappings) MAPPINGS (dissect.target.plugins.os.windows.registry.RegistryPlugin attribute) mappings() (dissect.target.plugins.os.windows.registry.RegistryPlugin method) MappingStream (class in dissect.util.stream) MAPS_WEVT_TYPE (class in dissect.eventlog.wevt) mark_as_finished() (dissect.target.tools.dump.DumpState method) Marker (class in dissect.etl.headers.headers) marker (dissect.etl.headers.headers.Header property) (dissect.etl.headers.headers.Marker attribute) Marker (dissect.target.helpers.regutil.RegistryKey attribute) MARKER_INFECTION (dissect.target.plugins.apps.av.mcafee.McAfeePlugin attribute) (dissect.target.plugins.apps.av.sophos.SophosPlugin attribute) (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) MARKER_MASK (dissect.etl.headers.headers.Marker attribute) MARKER_SUSPICIOUS_TCP_CONNECTION (dissect.target.plugins.apps.av.mcafee.McAfeePlugin attribute) MARKER_SUSPICIOUS_UDP_CONNECTION (dissect.target.plugins.apps.av.mcafee.McAfeePlugin attribute) mask (dissect.database.ese.ntds.sd.ACE attribute) (dissect.ntfs.secure.ACE attribute) (dissect.util.compression.lzxpress_huffman.BitString attribute) (flow.record.fieldtypes.net.ipv4.subnet attribute) mask() (in module dissect.fat.fat) master_key_def (in module dissect.target.plugins.os.windows.dpapi.master_key) master_keys (dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin property) MasterKey (class in dissect.target.plugins.os.windows.dpapi.master_key) MasterKeyFile (class in dissect.target.plugins.os.windows.dpapi.master_key) Match (class in dissect.ntfs.index) match (dissect.cstruct.parser.Token attribute) match() (dissect.cstruct.expression.ExpressionTokenizer method) (flow.record.selector.CompiledSelector method) (flow.record.selector.Selector method) MATCH_MAP (in module dissect.target.helpers.configutil) match_record_with_context() (in module flow.record.context) matched (flow.record.context.AppContext attribute) matcher (flow.record.selector.Selector attribute) matches() (flow.record.selector.RecordContextMatcher method) matrix() (in module dissect.target.helpers.cyber) MATRIX_CHARS (in module dissect.target.helpers.cyber) MATRIX_FRAME_DELAY (in module dissect.target.helpers.cyber) MATRIX_MAX_CASCADES (in module dissect.target.helpers.cyber) MATRIX_MAX_COLS (in module dissect.target.helpers.cyber) MATRIX_MAX_SPEED (in module dissect.target.helpers.cyber) MATRIX_REVEAL_SECONDS (in module dissect.target.helpers.cyber) max_age (dissect.volume.lvm.metadata.WriteCacheSegment attribute) MAX_BLOCK_TABLE_SIZE (in module dissect.evidence.asdf.asdf) MAX_COUNT (dissect.target.helpers.nfs.client.mount.Client attribute) (dissect.target.helpers.nfs.client.nfs.Client attribute) max_count (dissect.target.helpers.nfs.nfs3.ReadDirPlusParams attribute) max_degraded (dissect.volume.raid.stream.RAID456Stream attribute) max_discard (dissect.volume.lvm.metadata.VdoPoolSegment attribute) max_entries (dissect.hypervisor.disk.vhd.BlockAllocationTable attribute) (dissect.volume.dm.btree.Node attribute) MAX_ENTRIES_PER_TABLE (dissect.archive.vbk.FibMetaSparseTable attribute) MAX_FILE_SIZE_BYTES (acquire.acquire.acquire.FileHashes attribute) MAX_IDX (in module dissect.evidence.asdf.asdf) MAX_IMM_OFFSET (in module dissect.thumbcache.index) max_lv (dissect.volume.lvm.metadata.VolumeGroup attribute) MAX_OPEN_SEGMENTS (in module dissect.evidence.ad1.ad1) (in module dissect.evidence.ewf.ewf) max_payload_size (dissect.database.sqlite3.sqlite3.Cell attribute) max_pv (dissect.volume.lvm.metadata.VolumeGroup attribute) MAX_READ_LENGTH (in module dissect.util.compression.lzo) MAX_RECONNECTS (dissect.target.loaders.remote.RemoteStreamConnection attribute) max_recovery_rate (dissect.volume.lvm.metadata.RAIDSegment attribute) max_retries (flow.record.adapter.elastic.ElasticWriter attribute) MAX_SHORT_READS (dissect.target.loaders.remote.RemoteStreamConnection attribute) max_size (dissect.hypervisor.disk.asif.ASIF attribute) MAX_STATES (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) MAXSIZE (dissect.target.helpers.nfs.nfs3.CookieVerf attribute) (dissect.target.helpers.nfs.nfs3.FileHandle attribute) maxsplit (dissect.target.helpers.configutil.CSVish attribute) may_contain (dissect.database.ese.ntds.objects.classschema.ClassSchema property) MB (in module dissect.hypervisor.disk.c_vhdx) MBR (class in dissect.volume.disk.schemes.mbr) mbr (dissect.volume.disk.schemes.gpt.GPT attribute) (dissect.volume.disk.schemes.mbr.MBR attribute) mbr_def (in module dissect.volume.disk.schemes.mbr) McAfeeMscFirewallRecord (in module dissect.target.plugins.apps.av.mcafee) McAfeeMscLogRecord (in module dissect.target.plugins.apps.av.mcafee) McAfeePlugin (class in dissect.target.plugins.apps.av.mcafee) MD (class in dissect.volume.md.md) md (dissect.target.volumes.md.MdVolumeSystem attribute) (in module dissect.target.volume) MD5 (acquire.acquire.hashes.HashFunc attribute) md5 (dissect.evidence.ad1.ad1.FileEntry property) (flow.record.fieldtypes.digest property) md5() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (in module dissect.target.helpers.hashutil) md_alignment (dissect.vmfs.vmfs.VMFS attribute) md_def (in module dissect.volume.md.c_md) mdb_paths (dissect.target.plugins.os.windows.ual.UalPlugin attribute) MDConfiguration (class in dissect.volume.md.md) MDError MDPhysicalDisk (class in dissect.volume.md.md) MDVirtualDisk (class in dissect.volume.md.md) MdVolumeSystem (class in dissect.target.volumes.md) media (dissect.hypervisor.descriptor.vbox.Machine property) (dissect.hypervisor.descriptor.vbox.VBox property) MediaKeybag (class in dissect.apfs.objects.keybag) MEDIAMAILOVERIP (dissect.target.plugins.os.windows.network.IfTypes attribute) mem_scheme (acquire.acquire.esxi.EsxiMemoryManager attribute) members() (dissect.database.ese.ntds.objects.group.Group method) (dissect.evidence.asdf.asdf.Metadata method) memory (dissect.fve.luks.metadata.KeyslotKdf attribute) memory_size (dissect.executable.elf.elf.Segment attribute) menu (dissect.executable.pe.directory.resource.ResourceDirectory property) merge (dissect.volume.lvm.metadata.ThinSegment attribute) merge() (dissect.target.helpers.configutil.ConfigurationParser method) (in module dissect.fve.luks.af) merge_record_descriptors() (in module flow.record.base) merging_store (dissect.volume.lvm.metadata.SnapshotSegment attribute) MERIT_INP (dissect.target.helpers.network.IANAProtocol attribute) Message (class in dissect.target.helpers.sunrpc.sunrpc) message (dissect.target.helpers.nfs.client.mount.MountError attribute) (dissect.target.helpers.nfs.client.nfs.NfsError attribute) message() (acquire.acquire.gui.base.GUI method) (acquire.acquire.gui.base.Stub method) (acquire.acquire.gui.win32.Win32 method) MESSAGE_FLAGS (dissect.etl.headers.headers.Marker attribute) message_table (dissect.executable.pe.directory.resource.ResourceDirectory property) messages() (dissect.target.plugins.os.unix.log.messages.MessagesPlugin method) MessageSerializer (class in dissect.target.helpers.sunrpc.serializer) MessagesPlugin (class in dissect.target.plugins.os.unix.log.messages) MessagesRecord (in module dissect.target.plugins.os.unix.log.messages) MessageTraceHeader (class in dissect.etl.headers.headers) MessageType (class in dissect.target.helpers.sunrpc.serializer) meta (dissect.evidence.ad1.ad1.FileEntry property) meta_dev (dissect.volume.lvm.metadata.IntegritySegment attribute) meta_uuid (dissect.xfs.xfs.XFS attribute) MetaBase (class in dissect.volume.lvm.metadata) MetaBlob (class in dissect.archive.vbk) metablocks (dissect.clfs.blf.BLF attribute) Metadata (class in dissect.evidence.asdf.asdf) (class in dissect.fve.luks.metadata) (class in dissect.volume.dm.thin) metadata (dissect.evidence.asdf.asdf.AsdfSnapshot attribute) (dissect.executable.pe.directory.com_descriptor.ComDescriptorDirectory property) (dissect.executable.pe.directory.com_descriptor.ComMetadata property) (dissect.executable.pe.directory.com_descriptor.ComStream attribute) (dissect.hypervisor.disk.asif.ASIF attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) (dissect.target.loaders.itunes.FileInfo attribute) (dissect.target.loaders.res.UPF attribute) (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntry attribute) (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntryResource attribute) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.vmfs.lvm.Device attribute) (dissect.vmfs.resource.ResourceFile attribute) (dissect.volume.dm.thin.ThinPool attribute) (dissect.volume.lvm.lvm2.LVM2 attribute) (dissect.volume.lvm.metadata.CachePoolSegment attribute) (dissect.volume.lvm.metadata.ThinPoolSegment attribute) (dissect.volume.lvm.physical.LVM2Device property) METADATA_BASE (acquire.acquire.collector.Collector attribute) metadata_block_size (dissect.volume.dm.thin.Metadata attribute) metadata_copies (dissect.volume.lvm.metadata.VolumeGroup attribute) metadata_fh (dissect.volume.dm.thin.ThinPool attribute) metadata_fields (flow.record.adapter.elastic.ElasticWriter attribute) metadata_format (dissect.volume.lvm.metadata.CachePoolSegment attribute) (dissect.volume.lvm.metadata.CacheSegment attribute) metadata_header (dissect.hypervisor.disk.asif.ASIF attribute) metadata_id (dissect.volume.lvm.metadata.CacheSegment attribute) metadata_len (dissect.volume.lvm.metadata.CacheSegment attribute) METADATA_MAP (dissect.hypervisor.disk.vhdx.MetadataTable attribute) metadata_only (dissect.volume.lvm.metadata.WriteCacheSegment attribute) METADATA_PREFIX (dissect.target.loaders.asdf.AsdfLoader attribute) METADATA_REGION_GUID (in module dissect.hypervisor.disk.c_vhdx) metadata_start (dissect.volume.lvm.metadata.CacheSegment attribute) metadata_uuid (dissect.btrfs.btrfs.Btrfs attribute) MetadataTable (class in dissect.hypervisor.disk.vhdx) MetaItem (class in dissect.archive.vbk) MetaTableDescriptor (class in dissect.archive.vbk) MetaType (class in dissect.cstruct.types.base) (in module dissect.evidence.ad1.ad1) MetaVector (class in dissect.archive.vbk) MetaVector2 (class in dissect.archive.vbk) method_data (dissect.cim.classes.ClassDefinition attribute) method_name (dissect.target.plugin.FunctionDescriptor attribute) metrics (dissect.target.plugins.os.windows.prefetch.Prefetch attribute) MF_SIGLINK (dissect.target.plugins.os.windows.network.IfTypes attribute) MFE_NSP (dissect.target.helpers.network.IANAProtocol attribute) Mft (class in dissect.ntfs.mft) mft (dissect.ntfs.ntfs.NTFS attribute) mft_timeline() (dissect.target.plugins.filesystem.ntfs.mft_timeline.MftTimelinePlugin method) MftNotAvailableError MftPlugin (class in dissect.target.plugins.filesystem.ntfs.mft) MftRecord (class in dissect.ntfs.mft) MftTimelinePlugin (class in dissect.target.plugins.filesystem.ntfs.mft_timeline) MICP (dissect.target.helpers.network.IANAProtocol attribute) MIN_BITMAPS_SIZE (dissect.target.plugins.os.windows.regf.cit.BaseUseData attribute) (dissect.target.plugins.os.windows.regf.cit.SystemData attribute) MIN_IPV4 (dissect.target.helpers.network.IANAProtocol attribute) min_payload_size (dissect.database.sqlite3.sqlite3.Cell attribute) min_recovery_rate (dissect.volume.lvm.metadata.RAIDSegment attribute) MIN_SPAN_STATS_SIZE (dissect.target.plugins.os.windows.regf.cit.BaseUseData attribute) (dissect.target.plugins.os.windows.regf.cit.SystemData attribute) MIN_STATS_SIZE (dissect.target.plugins.os.windows.regf.cit.BaseUseData attribute) (dissect.target.plugins.os.windows.regf.cit.SystemData attribute) mini_cutoff (dissect.ole.ole.OLE attribute) mini_sector_size (dissect.ole.ole.OLE attribute) MiniChain (class in dissect.ole.ole) minichain() (dissect.ole.ole.OLE method) minifat() (dissect.ole.ole.OLE method) MINIMAL (acquire.acquire.acquire.BsdProfile attribute) (acquire.acquire.acquire.ESXiProfile attribute) (acquire.acquire.acquire.LinuxProfile attribute) (acquire.acquire.acquire.MacOSProfile attribute) (acquire.acquire.acquire.ProxmoxProfile attribute) (acquire.acquire.acquire.WindowsProfile attribute) minimal_size (dissect.etl.headers.event.EventHeader property) (dissect.etl.headers.headers.ErrorHeader property) (dissect.etl.headers.headers.EventInstanceGUIDHeader property) (dissect.etl.headers.headers.EventInstanceHeader property) (dissect.etl.headers.headers.EventTraceHeader property) (dissect.etl.headers.headers.Header property) (dissect.etl.headers.headers.MessageTraceHeader property) (dissect.etl.headers.logfile.LogfileHeader property) (dissect.etl.headers.system.SystemSpecificHeader property) MINIMAL_SIZE (dissect.fve.bde.information.Datum attribute) minimum_io_size (dissect.volume.lvm.metadata.VdoPoolSegment attribute) MinIO (class in acquire.acquire.uploaders.minio) ministream (dissect.ole.ole.OLE attribute) minor (dissect.cramfs.cramfs.INode property) (dissect.squashfs.squashfs.SquashFS attribute) minor_version (dissect.vmfs.lvm.Device attribute) (dissect.vmfs.vmfs.VMFS attribute) minutes_duration_to_iso() (dissect.target.plugins.os.windows.tasks.job.AtTask method) MIO_X25 (dissect.target.plugins.os.windows.network.IfTypes attribute) mirror_count (dissect.volume.lvm.metadata.MirrorSegment attribute) mirror_log (dissect.volume.lvm.metadata.MirrorSegment attribute) mirrors (dissect.volume.lvm.metadata.MirrorSegment attribute) MirrorSegment (class in dissect.volume.lvm.metadata) Misc (class in acquire.acquire.acquire) misc_macos_user_homes() (in module acquire.acquire.acquire) MISC_MAPPING (in module acquire.acquire.acquire) misc_unix_user_homes() (in module acquire.acquire.acquire) misc_user_paths() (dissect.target.plugin.OSPlugin method) (dissect.target.plugins.os.default._os.DefaultOSPlugin method) (dissect.target.plugins.os.unix._os.UnixPlugin method) (dissect.target.plugins.os.unix.bsd.darwin._os.DarwinPlugin method) (dissect.target.plugins.os.windows._os.WindowsPlugin method) misc_windows_user_homes() (in module acquire.acquire.acquire) Mismatch (class in dissect.target.helpers.sunrpc.sunrpc) MismatchXidError MISSING (acquire.acquire.collector.Outcome attribute) mkdir() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) mkfs_time (dissect.squashfs.squashfs.SquashFS attribute) mkts() (in module dissect.target.plugins.os.windows.activitiescache) mkversion (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) MLocate (class in dissect.target.plugins.os.unix.locate.mlocate) mlocate_def (in module dissect.target.plugins.os.unix.locate.mlocate) MLocateFile (class in dissect.target.plugins.os.unix.locate.mlocate) MLocatePlugin (class in dissect.target.plugins.os.unix.locate.mlocate) MLocateRecord (in module dissect.target.plugins.os.unix.locate.mlocate) MNS_LOGON_ACCOUNT (dissect.database.ese.ntds.util.UserAccountControl attribute) MOBILITY_HEADER (dissect.target.helpers.network.IANAProtocol attribute) ModBoundGuid (in module dissect.etl.utils) mode (dissect.apfs.objects.fs.INode property) (dissect.btrfs.btrfs.INode property) (dissect.cramfs.cramfs.INode property) (dissect.database.bsd.tools.rpm.PackageEntry attribute) (dissect.ffs.ffs.INode property) (dissect.fve.luks.metadata.Keyslot attribute) (dissect.hypervisor.util.envelope.KeyStore attribute) (dissect.jffs.jffs2.INode property) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx6.INode6 property) (dissect.squashfs.squashfs.INode property) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) (dissect.target.loaders.itunes.FileInfo property) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.volume.lvm.metadata.IntegritySegment attribute) model (dissect.target.loaders.cellebrite.DeviceInfo attribute) MODEM (dissect.target.plugins.os.windows.network.IfTypes attribute) modification_time (dissect.target.plugins.os.windows.regf.shellbags.FILE_ENTRY property) (dissect.target.plugins.os.windows.regf.shellbags.MTP_FILE_ENTRY property) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM property) (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN_0x74 property) modified (dissect.target.tools.diff.DirectoryDifferential attribute) modified_by (dissect.apfs.objects.fs.FS property) Modifier (class in dissect.target.helpers.record_modifier) ModifierFunc (in module dissect.target.helpers.record_modifier) MODPATH (in module dissect.etl.manifest) module acquire.acquire acquire.acquire.acquire acquire.acquire.collector acquire.acquire.crypt acquire.acquire.dynamic acquire.acquire.dynamic.windows acquire.acquire.dynamic.windows.collect acquire.acquire.dynamic.windows.exceptions acquire.acquire.dynamic.windows.handles acquire.acquire.dynamic.windows.named_objects acquire.acquire.dynamic.windows.ntdll acquire.acquire.dynamic.windows.types acquire.acquire.esxi acquire.acquire.gui acquire.acquire.gui.base acquire.acquire.gui.win32 acquire.acquire.hashes acquire.acquire.log acquire.acquire.outputs acquire.acquire.outputs.base acquire.acquire.outputs.dir acquire.acquire.outputs.tar acquire.acquire.outputs.zip acquire.acquire.tools acquire.acquire.tools.decrypter acquire.acquire.uploaders acquire.acquire.uploaders.minio acquire.acquire.uploaders.plugin acquire.acquire.uploaders.plugin_registry acquire.acquire.utils acquire.acquire.volatilestream codestyle dissect.apfs dissect.apfs.apfs dissect.apfs.c_apfs dissect.apfs.cursor dissect.apfs.exception dissect.apfs.objects dissect.apfs.objects.base dissect.apfs.objects.btree dissect.apfs.objects.btree_node dissect.apfs.objects.checkpoint_map dissect.apfs.objects.efi_jumpstart dissect.apfs.objects.er_recovery_block dissect.apfs.objects.er_state dissect.apfs.objects.fs dissect.apfs.objects.gbitmap dissect.apfs.objects.gbitmap_block dissect.apfs.objects.integrity_meta dissect.apfs.objects.keybag dissect.apfs.objects.nx_fusion_wbc dissect.apfs.objects.nx_fusion_wbc_list dissect.apfs.objects.nx_reap_list dissect.apfs.objects.nx_reaper dissect.apfs.objects.nx_superblock dissect.apfs.objects.omap dissect.apfs.objects.snap_meta_ext dissect.apfs.objects.spaceman dissect.apfs.objects.spaceman_bitmap dissect.apfs.objects.spaceman_cab dissect.apfs.objects.spaceman_cib dissect.apfs.stream dissect.apfs.util dissect.archive dissect.archive.c_vbk dissect.archive.c_vma dissect.archive.c_wim dissect.archive.exceptions dissect.archive.tools dissect.archive.tools.backup dissect.archive.vbk dissect.archive.vma dissect.archive.wim dissect.archive.xva dissect.btrfs dissect.btrfs.btrfs dissect.btrfs.c_btrfs dissect.btrfs.exceptions dissect.btrfs.stream dissect.btrfs.tree dissect.cim dissect.cim.c_cim dissect.cim.cim dissect.cim.classes dissect.cim.exceptions dissect.cim.index dissect.cim.mappings dissect.cim.objects dissect.cim.utils dissect.clfs dissect.clfs.blf dissect.clfs.c_clfs dissect.clfs.container dissect.clfs.exceptions dissect.cramfs dissect.cramfs.c_cramfs dissect.cramfs.cramfs dissect.cramfs.exception dissect.cstruct dissect.cstruct.bitbuffer dissect.cstruct.compiler dissect.cstruct.cstruct dissect.cstruct.exceptions dissect.cstruct.expression dissect.cstruct.parser dissect.cstruct.tools dissect.cstruct.tools.stubgen dissect.cstruct.types dissect.cstruct.types.base dissect.cstruct.types.char dissect.cstruct.types.enum dissect.cstruct.types.flag dissect.cstruct.types.int dissect.cstruct.types.leb128 dissect.cstruct.types.packed dissect.cstruct.types.pointer dissect.cstruct.types.structure dissect.cstruct.types.void dissect.cstruct.types.wchar dissect.cstruct.utils dissect.database dissect.database.bsd dissect.database.bsd.c_db dissect.database.bsd.db dissect.database.bsd.tools dissect.database.bsd.tools.c_rpm dissect.database.bsd.tools.rpm dissect.database.ese dissect.database.ese.btree dissect.database.ese.c_ese dissect.database.ese.compression dissect.database.ese.cursor dissect.database.ese.ese dissect.database.ese.exception dissect.database.ese.index dissect.database.ese.lcmapstring dissect.database.ese.ntds dissect.database.ese.ntds.c_ds dissect.database.ese.ntds.c_pek dissect.database.ese.ntds.c_sd dissect.database.ese.ntds.database dissect.database.ese.ntds.ntds dissect.database.ese.ntds.objects dissect.database.ese.ntds.objects.applicationsettings dissect.database.ese.ntds.objects.attributeschema dissect.database.ese.ntds.objects.builtindomain dissect.database.ese.ntds.objects.certificationauthority dissect.database.ese.ntds.objects.classschema dissect.database.ese.ntds.objects.classstore dissect.database.ese.ntds.objects.computer dissect.database.ese.ntds.objects.configuration dissect.database.ese.ntds.objects.container dissect.database.ese.ntds.objects.controlaccessright dissect.database.ese.ntds.objects.crldistributionpoint dissect.database.ese.ntds.objects.crossref dissect.database.ese.ntds.objects.crossrefcontainer dissect.database.ese.ntds.objects.dfsconfiguration dissect.database.ese.ntds.objects.displayspecifier dissect.database.ese.ntds.objects.dmd dissect.database.ese.ntds.objects.dnsnode dissect.database.ese.ntds.objects.dnszone dissect.database.ese.ntds.objects.domain dissect.database.ese.ntds.objects.domaindns dissect.database.ese.ntds.objects.domainpolicy dissect.database.ese.ntds.objects.dsuisettings dissect.database.ese.ntds.objects.filelinktracking dissect.database.ese.ntds.objects.foreignsecurityprincipal dissect.database.ese.ntds.objects.group dissect.database.ese.ntds.objects.grouppolicycontainer dissect.database.ese.ntds.objects.infrastructureupdate dissect.database.ese.ntds.objects.intersitetransport dissect.database.ese.ntds.objects.intersitetransportcontainer dissect.database.ese.ntds.objects.ipsecbase dissect.database.ese.ntds.objects.ipsecfilter dissect.database.ese.ntds.objects.ipsecisakmppolicy dissect.database.ese.ntds.objects.ipsecnegotiationpolicy dissect.database.ese.ntds.objects.ipsecnfa dissect.database.ese.ntds.objects.ipsecpolicy dissect.database.ese.ntds.objects.leaf dissect.database.ese.ntds.objects.linktrackobjectmovetable dissect.database.ese.ntds.objects.linktrackvolumetable dissect.database.ese.ntds.objects.locality dissect.database.ese.ntds.objects.lostandfound dissect.database.ese.ntds.objects.msauthz_centralaccesspolicies dissect.database.ese.ntds.objects.msauthz_centralaccessrules dissect.database.ese.ntds.objects.msdfsr_content dissect.database.ese.ntds.objects.msdfsr_contentset dissect.database.ese.ntds.objects.msdfsr_globalsettings dissect.database.ese.ntds.objects.msdfsr_localsettings dissect.database.ese.ntds.objects.msdfsr_member dissect.database.ese.ntds.objects.msdfsr_replicationgroup dissect.database.ese.ntds.objects.msdfsr_subscriber dissect.database.ese.ntds.objects.msdfsr_subscription dissect.database.ese.ntds.objects.msdfsr_topology dissect.database.ese.ntds.objects.msdns_serversettings dissect.database.ese.ntds.objects.msds_authnpolicies dissect.database.ese.ntds.objects.msds_authnpolicysilos dissect.database.ese.ntds.objects.msds_claimstransformationpolicies dissect.database.ese.ntds.objects.msds_claimtype dissect.database.ese.ntds.objects.msds_claimtypepropertybase dissect.database.ese.ntds.objects.msds_claimtypes dissect.database.ese.ntds.objects.msds_optionalfeature dissect.database.ese.ntds.objects.msds_passwordsettingscontainer dissect.database.ese.ntds.objects.msds_quotacontainer dissect.database.ese.ntds.objects.msds_resourceproperties dissect.database.ese.ntds.objects.msds_resourceproperty dissect.database.ese.ntds.objects.msds_resourcepropertylist dissect.database.ese.ntds.objects.msds_shadowprincipalcontainer dissect.database.ese.ntds.objects.msds_valuetype dissect.database.ese.ntds.objects.msimaging_psps dissect.database.ese.ntds.objects.mskds_provserverconfiguration dissect.database.ese.ntds.objects.msmqenterprisesettings dissect.database.ese.ntds.objects.mspki_enterpriseoid dissect.database.ese.ntds.objects.mspki_privatekeyrecoveryagent dissect.database.ese.ntds.objects.msspp_activationobjectscontainer dissect.database.ese.ntds.objects.mstpm_informationobjectscontainer dissect.database.ese.ntds.objects.ntdsconnection dissect.database.ese.ntds.objects.ntdsdsa dissect.database.ese.ntds.objects.ntdsservice dissect.database.ese.ntds.objects.ntdssitesettings dissect.database.ese.ntds.objects.ntfrssettings dissect.database.ese.ntds.objects.object dissect.database.ese.ntds.objects.organizationalperson dissect.database.ese.ntds.objects.organizationalunit dissect.database.ese.ntds.objects.person dissect.database.ese.ntds.objects.physicallocation dissect.database.ese.ntds.objects.pkicertificatetemplate dissect.database.ese.ntds.objects.pkienrollmentservice dissect.database.ese.ntds.objects.querypolicy dissect.database.ese.ntds.objects.ridmanager dissect.database.ese.ntds.objects.ridset dissect.database.ese.ntds.objects.rpccontainer dissect.database.ese.ntds.objects.rrasadministrationdictionary dissect.database.ese.ntds.objects.samserver dissect.database.ese.ntds.objects.secret dissect.database.ese.ntds.objects.securityobject dissect.database.ese.ntds.objects.server dissect.database.ese.ntds.objects.serverscontainer dissect.database.ese.ntds.objects.site dissect.database.ese.ntds.objects.sitelink dissect.database.ese.ntds.objects.sitescontainer dissect.database.ese.ntds.objects.subnetcontainer dissect.database.ese.ntds.objects.subschema dissect.database.ese.ntds.objects.top dissect.database.ese.ntds.objects.trusteddomain dissect.database.ese.ntds.objects.user dissect.database.ese.ntds.pek dissect.database.ese.ntds.query dissect.database.ese.ntds.schema dissect.database.ese.ntds.sd dissect.database.ese.ntds.tools dissect.database.ese.ntds.tools.ntds dissect.database.ese.ntds.util dissect.database.ese.page dissect.database.ese.record dissect.database.ese.sorting_table dissect.database.ese.table dissect.database.ese.tools dissect.database.ese.tools.certlog dissect.database.ese.tools.impacket dissect.database.ese.tools.sru dissect.database.ese.tools.ual dissect.database.ese.util dissect.database.exception dissect.database.sqlite3 dissect.database.sqlite3.c_sqlite3 dissect.database.sqlite3.encryption dissect.database.sqlite3.encryption.sqlcipher dissect.database.sqlite3.encryption.sqlcipher.exception dissect.database.sqlite3.encryption.sqlcipher.sqlcipher dissect.database.sqlite3.exception dissect.database.sqlite3.sqlite3 dissect.database.sqlite3.util dissect.database.sqlite3.wal dissect.etl dissect.etl.c_etl dissect.etl.etl dissect.etl.exceptions dissect.etl.headers dissect.etl.headers.event dissect.etl.headers.headers dissect.etl.headers.logfile dissect.etl.headers.system dissect.etl.headers.utils dissect.etl.manifest dissect.etl.manifests dissect.etl.utils dissect.eventlog dissect.eventlog.bxml dissect.eventlog.evt dissect.eventlog.evtx dissect.eventlog.exceptions dissect.eventlog.utils dissect.eventlog.wevt dissect.eventlog.wevt_object dissect.eventlog.wevtutil dissect.evidence dissect.evidence.ad1 dissect.evidence.ad1.ad1 dissect.evidence.ad1.c_ad1 dissect.evidence.ad1.stream dissect.evidence.adcrypt dissect.evidence.adcrypt.adcrypt dissect.evidence.adcrypt.c_adcrypt dissect.evidence.adcrypt.stream dissect.evidence.asdf dissect.evidence.asdf.asdf dissect.evidence.asdf.c_asdf dissect.evidence.asdf.stream dissect.evidence.ewf dissect.evidence.ewf.c_ewf dissect.evidence.ewf.ewf dissect.evidence.exception dissect.evidence.tools dissect.evidence.tools.adcrypt dissect.evidence.tools.asdf dissect.evidence.tools.asdf.dd dissect.evidence.tools.asdf.meta dissect.evidence.tools.asdf.repair dissect.evidence.tools.asdf.verify dissect.evidence.tools.util dissect.executable dissect.executable.elf dissect.executable.elf.c_elf dissect.executable.elf.elf dissect.executable.exception dissect.executable.macho dissect.executable.pe dissect.executable.pe.c_pe dissect.executable.pe.directory dissect.executable.pe.directory.base dissect.executable.pe.directory.basereloc dissect.executable.pe.directory.bound_import dissect.executable.pe.directory.com_descriptor dissect.executable.pe.directory.debug dissect.executable.pe.directory.delay_import dissect.executable.pe.directory.exception dissect.executable.pe.directory.export dissect.executable.pe.directory.iat dissect.executable.pe.directory.imports dissect.executable.pe.directory.load_config dissect.executable.pe.directory.resource dissect.executable.pe.directory.security dissect.executable.pe.directory.tls dissect.executable.pe.locale_id dissect.executable.pe.pe dissect.extfs dissect.extfs.c_ext dissect.extfs.c_jdb2 dissect.extfs.exceptions dissect.extfs.extfs dissect.extfs.journal dissect.fat dissect.fat.c_exfat dissect.fat.c_fat dissect.fat.exceptions dissect.fat.exfat dissect.fat.fat dissect.ffs dissect.ffs.c_ffs dissect.ffs.exceptions dissect.ffs.ffs dissect.fve dissect.fve.bde dissect.fve.bde.bde dissect.fve.bde.c_bde dissect.fve.bde.eow dissect.fve.bde.information dissect.fve.bde.key dissect.fve.crypto dissect.fve.crypto.argon2 dissect.fve.crypto.base dissect.fve.crypto.dmcrypt dissect.fve.crypto.elephant dissect.fve.crypto.util dissect.fve.exception dissect.fve.luks dissect.fve.luks.af dissect.fve.luks.c_luks dissect.fve.luks.luks dissect.fve.luks.metadata dissect.fve.tools dissect.fve.tools.dd dissect.hypervisor dissect.hypervisor.descriptor dissect.hypervisor.descriptor.c_hyperv dissect.hypervisor.descriptor.hyperv dissect.hypervisor.descriptor.ovf dissect.hypervisor.descriptor.pvs dissect.hypervisor.descriptor.vbox dissect.hypervisor.descriptor.vmx dissect.hypervisor.disk dissect.hypervisor.disk.asif dissect.hypervisor.disk.c_asif dissect.hypervisor.disk.c_hdd dissect.hypervisor.disk.c_qcow2 dissect.hypervisor.disk.c_vdi dissect.hypervisor.disk.c_vhd dissect.hypervisor.disk.c_vhdx dissect.hypervisor.disk.c_vmdk dissect.hypervisor.disk.hdd dissect.hypervisor.disk.qcow2 dissect.hypervisor.disk.vdi dissect.hypervisor.disk.vhd dissect.hypervisor.disk.vhdx dissect.hypervisor.disk.vmdk dissect.hypervisor.exceptions dissect.hypervisor.tools dissect.hypervisor.tools.envelope dissect.hypervisor.tools.vmtar dissect.hypervisor.util dissect.hypervisor.util.envelope dissect.hypervisor.util.vmtar dissect.jffs dissect.jffs.c_jffs2 dissect.jffs.exceptions dissect.jffs.jffs2 dissect.ntfs dissect.ntfs.attr dissect.ntfs.c_ntfs dissect.ntfs.exceptions dissect.ntfs.index dissect.ntfs.mft dissect.ntfs.ntfs dissect.ntfs.secure dissect.ntfs.stream dissect.ntfs.usnjrnl dissect.ntfs.util dissect.ole dissect.ole.c_ole dissect.ole.exceptions dissect.ole.ole dissect.qnxfs dissect.qnxfs.c_qnx4 dissect.qnxfs.c_qnx6 dissect.qnxfs.exceptions dissect.qnxfs.qnx4 dissect.qnxfs.qnx6 dissect.qnxfs.qnxfs dissect.regf dissect.regf.c_regf dissect.regf.exceptions dissect.regf.regf dissect.shellitem dissect.shellitem.lnk dissect.shellitem.lnk.c_lnk dissect.shellitem.lnk.lnk dissect.shellitem.tools dissect.shellitem.tools.lnk dissect.squashfs dissect.squashfs.c_squashfs dissect.squashfs.compression dissect.squashfs.exceptions dissect.squashfs.squashfs dissect.target dissect.target.container dissect.target.containers dissect.target.containers.asdf dissect.target.containers.asif dissect.target.containers.ewf dissect.target.containers.fortifw dissect.target.containers.hdd dissect.target.containers.hds dissect.target.containers.qcow2 dissect.target.containers.raw dissect.target.containers.split dissect.target.containers.vdi dissect.target.containers.vhd dissect.target.containers.vhdx dissect.target.containers.vmdk dissect.target.exceptions dissect.target.filesystem dissect.target.filesystems dissect.target.filesystems.ad1 dissect.target.filesystems.apfs dissect.target.filesystems.btrfs dissect.target.filesystems.cb dissect.target.filesystems.cpio dissect.target.filesystems.cramfs dissect.target.filesystems.dir dissect.target.filesystems.exfat dissect.target.filesystems.extfs dissect.target.filesystems.fat dissect.target.filesystems.ffs dissect.target.filesystems.itunes dissect.target.filesystems.jffs dissect.target.filesystems.nfs dissect.target.filesystems.ntds dissect.target.filesystems.ntfs dissect.target.filesystems.overlay dissect.target.filesystems.qnxfs dissect.target.filesystems.smb dissect.target.filesystems.squashfs dissect.target.filesystems.tar dissect.target.filesystems.vbk dissect.target.filesystems.vmfs dissect.target.filesystems.vmtar dissect.target.filesystems.xfs dissect.target.filesystems.zip dissect.target.helpers dissect.target.helpers.cache dissect.target.helpers.certificate dissect.target.helpers.compat dissect.target.helpers.compat.path_310 dissect.target.helpers.compat.path_311 dissect.target.helpers.compat.path_312 dissect.target.helpers.compat.path_313 dissect.target.helpers.compat.path_common dissect.target.helpers.config dissect.target.helpers.configutil dissect.target.helpers.cyber dissect.target.helpers.descriptor_extensions dissect.target.helpers.docs dissect.target.helpers.fsutil dissect.target.helpers.hashutil dissect.target.helpers.keychain dissect.target.helpers.lazy dissect.target.helpers.loaderutil dissect.target.helpers.localeutil dissect.target.helpers.logging dissect.target.helpers.magic dissect.target.helpers.magic.magic dissect.target.helpers.magic.mimetypes dissect.target.helpers.magic.mimetypes.freedesktop dissect.target.helpers.magic.mimetypes.overrides dissect.target.helpers.mount dissect.target.helpers.mui dissect.target.helpers.network dissect.target.helpers.nfs dissect.target.helpers.nfs.client dissect.target.helpers.nfs.client.mount dissect.target.helpers.nfs.client.nfs dissect.target.helpers.nfs.nfs3 dissect.target.helpers.nfs.serializer dissect.target.helpers.polypath dissect.target.helpers.protobuf dissect.target.helpers.record dissect.target.helpers.record_modifier dissect.target.helpers.regex dissect.target.helpers.regex.ipaddress dissect.target.helpers.regutil dissect.target.helpers.scrape dissect.target.helpers.shell_application_ids dissect.target.helpers.shell_folder_ids dissect.target.helpers.sunrpc dissect.target.helpers.sunrpc.client dissect.target.helpers.sunrpc.serializer dissect.target.helpers.sunrpc.sunrpc dissect.target.helpers.utils dissect.target.loader dissect.target.loaders dissect.target.loaders.ab dissect.target.loaders.acquire dissect.target.loaders.ad1 dissect.target.loaders.asdf dissect.target.loaders.cb dissect.target.loaders.cellebrite dissect.target.loaders.containerimage dissect.target.loaders.cyber dissect.target.loaders.dir dissect.target.loaders.direct dissect.target.loaders.hyperv dissect.target.loaders.itunes dissect.target.loaders.kape dissect.target.loaders.libvirt dissect.target.loaders.local dissect.target.loaders.log dissect.target.loaders.mqtt dissect.target.loaders.multiraw dissect.target.loaders.nscollector dissect.target.loaders.ova dissect.target.loaders.overlay dissect.target.loaders.overlay2 dissect.target.loaders.ovf dissect.target.loaders.phobos dissect.target.loaders.profile dissect.target.loaders.proxmox dissect.target.loaders.pvm dissect.target.loaders.pvs dissect.target.loaders.raw dissect.target.loaders.remote dissect.target.loaders.res dissect.target.loaders.smb dissect.target.loaders.tanium dissect.target.loaders.tar dissect.target.loaders.target dissect.target.loaders.uac dissect.target.loaders.utm dissect.target.loaders.vb dissect.target.loaders.vbk dissect.target.loaders.vbox dissect.target.loaders.velociraptor dissect.target.loaders.vma dissect.target.loaders.vmsupport dissect.target.loaders.vmwarevm dissect.target.loaders.vmx dissect.target.loaders.xva dissect.target.loaders.zip dissect.target.plugin dissect.target.plugins dissect.target.plugins.apps dissect.target.plugins.apps.av dissect.target.plugins.apps.av.mcafee dissect.target.plugins.apps.av.sophos dissect.target.plugins.apps.av.symantec dissect.target.plugins.apps.av.trendmicro dissect.target.plugins.apps.browser dissect.target.plugins.apps.browser.brave dissect.target.plugins.apps.browser.browser dissect.target.plugins.apps.browser.chrome dissect.target.plugins.apps.browser.chromium dissect.target.plugins.apps.browser.edge dissect.target.plugins.apps.browser.firefox dissect.target.plugins.apps.browser.iexplore dissect.target.plugins.apps.browser.safari dissect.target.plugins.apps.chat dissect.target.plugins.apps.chat.chat dissect.target.plugins.apps.chat.msn dissect.target.plugins.apps.container dissect.target.plugins.apps.container.container dissect.target.plugins.apps.container.docker dissect.target.plugins.apps.container.podman dissect.target.plugins.apps.editor dissect.target.plugins.apps.editor.editor dissect.target.plugins.apps.editor.windowsnotepad dissect.target.plugins.apps.edr dissect.target.plugins.apps.edr.acquire dissect.target.plugins.apps.edr.velociraptor dissect.target.plugins.apps.other dissect.target.plugins.apps.other.env dissect.target.plugins.apps.productivity dissect.target.plugins.apps.productivity.msoffice dissect.target.plugins.apps.productivity.sevenzip dissect.target.plugins.apps.productivity.winrar dissect.target.plugins.apps.remoteaccess dissect.target.plugins.apps.remoteaccess.anydesk dissect.target.plugins.apps.remoteaccess.remoteaccess dissect.target.plugins.apps.remoteaccess.rustdesk dissect.target.plugins.apps.remoteaccess.splashtop dissect.target.plugins.apps.remoteaccess.teamviewer dissect.target.plugins.apps.shell dissect.target.plugins.apps.shell.powershell dissect.target.plugins.apps.shell.wget dissect.target.plugins.apps.ssh dissect.target.plugins.apps.ssh.openssh dissect.target.plugins.apps.ssh.opensshd dissect.target.plugins.apps.ssh.putty dissect.target.plugins.apps.ssh.ssh dissect.target.plugins.apps.virtualization dissect.target.plugins.apps.virtualization.vmware_workstation dissect.target.plugins.apps.vpn dissect.target.plugins.apps.vpn.openvpn dissect.target.plugins.apps.vpn.wireguard dissect.target.plugins.apps.webhosting dissect.target.plugins.apps.webhosting.cpanel dissect.target.plugins.apps.webserver dissect.target.plugins.apps.webserver.apache dissect.target.plugins.apps.webserver.caddy dissect.target.plugins.apps.webserver.citrix dissect.target.plugins.apps.webserver.iis dissect.target.plugins.apps.webserver.nginx dissect.target.plugins.apps.webserver.webserver dissect.target.plugins.child dissect.target.plugins.child.colima dissect.target.plugins.child.docker dissect.target.plugins.child.esxi dissect.target.plugins.child.hyperv dissect.target.plugins.child.lima dissect.target.plugins.child.parallels dissect.target.plugins.child.podman dissect.target.plugins.child.proxmox dissect.target.plugins.child.qemu dissect.target.plugins.child.virtualbox dissect.target.plugins.child.virtuozzo dissect.target.plugins.child.vmware_workstation dissect.target.plugins.child.wsl dissect.target.plugins.filesystem dissect.target.plugins.filesystem.icat dissect.target.plugins.filesystem.ntfs dissect.target.plugins.filesystem.ntfs.mft dissect.target.plugins.filesystem.ntfs.mft_timeline dissect.target.plugins.filesystem.ntfs.usnjrnl dissect.target.plugins.filesystem.ntfs.utils dissect.target.plugins.filesystem.resolver dissect.target.plugins.filesystem.unix dissect.target.plugins.filesystem.unix.capability dissect.target.plugins.filesystem.unix.suid dissect.target.plugins.filesystem.walkfs dissect.target.plugins.filesystem.yara dissect.target.plugins.general dissect.target.plugins.general.example dissect.target.plugins.general.loaders dissect.target.plugins.general.osinfo dissect.target.plugins.general.plugins dissect.target.plugins.general.users dissect.target.plugins.os dissect.target.plugins.os.default dissect.target.plugins.os.default._os dissect.target.plugins.os.default.datetime dissect.target.plugins.os.default.locale dissect.target.plugins.os.default.network dissect.target.plugins.os.unix dissect.target.plugins.os.unix._os dissect.target.plugins.os.unix.applications dissect.target.plugins.os.unix.bsd dissect.target.plugins.os.unix.bsd._os dissect.target.plugins.os.unix.bsd.citrix dissect.target.plugins.os.unix.bsd.citrix._os dissect.target.plugins.os.unix.bsd.citrix.generic dissect.target.plugins.os.unix.bsd.citrix.history dissect.target.plugins.os.unix.bsd.citrix.locale dissect.target.plugins.os.unix.bsd.darwin dissect.target.plugins.os.unix.bsd.darwin._os dissect.target.plugins.os.unix.bsd.darwin.ios dissect.target.plugins.os.unix.bsd.darwin.ios._os dissect.target.plugins.os.unix.bsd.darwin.ios.applications dissect.target.plugins.os.unix.bsd.darwin.ios.generic dissect.target.plugins.os.unix.bsd.darwin.ios.locale dissect.target.plugins.os.unix.bsd.darwin.macos dissect.target.plugins.os.unix.bsd.darwin.macos._os dissect.target.plugins.os.unix.bsd.darwin.macos.network dissect.target.plugins.os.unix.bsd.darwin.macos.user dissect.target.plugins.os.unix.bsd.freebsd dissect.target.plugins.os.unix.bsd.freebsd._os dissect.target.plugins.os.unix.bsd.openbsd dissect.target.plugins.os.unix.bsd.openbsd._os dissect.target.plugins.os.unix.cronjobs dissect.target.plugins.os.unix.datetime dissect.target.plugins.os.unix.esxi dissect.target.plugins.os.unix.esxi._os dissect.target.plugins.os.unix.esxi.configstore dissect.target.plugins.os.unix.esxi.esxconf dissect.target.plugins.os.unix.esxi.vm dissect.target.plugins.os.unix.etc dissect.target.plugins.os.unix.etc.etc dissect.target.plugins.os.unix.generic dissect.target.plugins.os.unix.history dissect.target.plugins.os.unix.linux dissect.target.plugins.os.unix.linux._os dissect.target.plugins.os.unix.linux.android dissect.target.plugins.os.unix.linux.android._os dissect.target.plugins.os.unix.linux.cmdline dissect.target.plugins.os.unix.linux.debian dissect.target.plugins.os.unix.linux.debian._os dissect.target.plugins.os.unix.linux.debian.apt dissect.target.plugins.os.unix.linux.debian.dpkg dissect.target.plugins.os.unix.linux.debian.proxmox dissect.target.plugins.os.unix.linux.debian.proxmox._os dissect.target.plugins.os.unix.linux.debian.proxmox.vm dissect.target.plugins.os.unix.linux.debian.snap dissect.target.plugins.os.unix.linux.debian.vyos dissect.target.plugins.os.unix.linux.debian.vyos._os dissect.target.plugins.os.unix.linux.environ dissect.target.plugins.os.unix.linux.fortios dissect.target.plugins.os.unix.linux.fortios._os dissect.target.plugins.os.unix.linux.fortios.generic dissect.target.plugins.os.unix.linux.fortios.locale dissect.target.plugins.os.unix.linux.iptables dissect.target.plugins.os.unix.linux.modules dissect.target.plugins.os.unix.linux.netstat dissect.target.plugins.os.unix.linux.network dissect.target.plugins.os.unix.linux.network_managers dissect.target.plugins.os.unix.linux.proc dissect.target.plugins.os.unix.linux.processes dissect.target.plugins.os.unix.linux.recentlyused dissect.target.plugins.os.unix.linux.redhat dissect.target.plugins.os.unix.linux.redhat._os dissect.target.plugins.os.unix.linux.redhat.yum dissect.target.plugins.os.unix.linux.services dissect.target.plugins.os.unix.linux.sockets dissect.target.plugins.os.unix.linux.suse dissect.target.plugins.os.unix.linux.suse._os dissect.target.plugins.os.unix.linux.suse.zypper dissect.target.plugins.os.unix.locale dissect.target.plugins.os.unix.locate dissect.target.plugins.os.unix.locate.gnulocate dissect.target.plugins.os.unix.locate.locate dissect.target.plugins.os.unix.locate.mlocate dissect.target.plugins.os.unix.locate.plocate dissect.target.plugins.os.unix.log dissect.target.plugins.os.unix.log.atop dissect.target.plugins.os.unix.log.audit dissect.target.plugins.os.unix.log.auth dissect.target.plugins.os.unix.log.helpers dissect.target.plugins.os.unix.log.journal dissect.target.plugins.os.unix.log.lastlog dissect.target.plugins.os.unix.log.messages dissect.target.plugins.os.unix.log.utmp dissect.target.plugins.os.unix.packagemanager dissect.target.plugins.os.unix.shadow dissect.target.plugins.os.unix.trash dissect.target.plugins.os.windows dissect.target.plugins.os.windows._os dissect.target.plugins.os.windows.activitiescache dissect.target.plugins.os.windows.ad dissect.target.plugins.os.windows.ad.ntds dissect.target.plugins.os.windows.adpolicy dissect.target.plugins.os.windows.amcache dissect.target.plugins.os.windows.cam dissect.target.plugins.os.windows.catroot dissect.target.plugins.os.windows.certlog dissect.target.plugins.os.windows.cim dissect.target.plugins.os.windows.clfs dissect.target.plugins.os.windows.credential dissect.target.plugins.os.windows.credential.credential dissect.target.plugins.os.windows.credential.credhist dissect.target.plugins.os.windows.credential.defaultpassword dissect.target.plugins.os.windows.credential.winlogon dissect.target.plugins.os.windows.datetime dissect.target.plugins.os.windows.defender dissect.target.plugins.os.windows.defender.mplog dissect.target.plugins.os.windows.defender.quarantine dissect.target.plugins.os.windows.dpapi dissect.target.plugins.os.windows.dpapi.blob dissect.target.plugins.os.windows.dpapi.crypto dissect.target.plugins.os.windows.dpapi.dpapi dissect.target.plugins.os.windows.dpapi.keyprovider dissect.target.plugins.os.windows.dpapi.keyprovider.credhist dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.defaultpassword dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.lsa dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.winlogon dissect.target.plugins.os.windows.dpapi.keyprovider.empty dissect.target.plugins.os.windows.dpapi.keyprovider.keychain dissect.target.plugins.os.windows.dpapi.keyprovider.keyprovider dissect.target.plugins.os.windows.dpapi.master_key dissect.target.plugins.os.windows.env dissect.target.plugins.os.windows.everything dissect.target.plugins.os.windows.everything.parser dissect.target.plugins.os.windows.exchange dissect.target.plugins.os.windows.exchange.exchange dissect.target.plugins.os.windows.firewall dissect.target.plugins.os.windows.generic dissect.target.plugins.os.windows.jumplist dissect.target.plugins.os.windows.lnk dissect.target.plugins.os.windows.locale dissect.target.plugins.os.windows.log dissect.target.plugins.os.windows.log.agentexecutor dissect.target.plugins.os.windows.log.amcache dissect.target.plugins.os.windows.log.etl dissect.target.plugins.os.windows.log.evt dissect.target.plugins.os.windows.log.evtx dissect.target.plugins.os.windows.log.intunemanagementextension dissect.target.plugins.os.windows.log.mssql dissect.target.plugins.os.windows.log.pfro dissect.target.plugins.os.windows.log.schedlgu dissect.target.plugins.os.windows.lsa dissect.target.plugins.os.windows.network dissect.target.plugins.os.windows.notifications dissect.target.plugins.os.windows.prefetch dissect.target.plugins.os.windows.productkey dissect.target.plugins.os.windows.rdpcache dissect.target.plugins.os.windows.recyclebin dissect.target.plugins.os.windows.regf dissect.target.plugins.os.windows.regf.applications dissect.target.plugins.os.windows.regf.appxdebugkeys dissect.target.plugins.os.windows.regf.auditpol dissect.target.plugins.os.windows.regf.bam dissect.target.plugins.os.windows.regf.cit dissect.target.plugins.os.windows.regf.clsid dissect.target.plugins.os.windows.regf.mru dissect.target.plugins.os.windows.regf.muicache dissect.target.plugins.os.windows.regf.nethist dissect.target.plugins.os.windows.regf.recentfilecache dissect.target.plugins.os.windows.regf.regf dissect.target.plugins.os.windows.regf.runkeys dissect.target.plugins.os.windows.regf.shellbags dissect.target.plugins.os.windows.regf.shimcache dissect.target.plugins.os.windows.regf.trusteddocs dissect.target.plugins.os.windows.regf.usb dissect.target.plugins.os.windows.regf.userassist dissect.target.plugins.os.windows.registry dissect.target.plugins.os.windows.sam dissect.target.plugins.os.windows.search dissect.target.plugins.os.windows.services dissect.target.plugins.os.windows.sru dissect.target.plugins.os.windows.startupinfo dissect.target.plugins.os.windows.syscache dissect.target.plugins.os.windows.tasks dissect.target.plugins.os.windows.tasks.job dissect.target.plugins.os.windows.tasks.records dissect.target.plugins.os.windows.tasks.xml dissect.target.plugins.os.windows.thumbcache dissect.target.plugins.os.windows.ual dissect.target.plugins.os.windows.wer dissect.target.plugins.os.windows.wua_history dissect.target.plugins.scrape dissect.target.plugins.scrape.qfind dissect.target.plugins.scrape.scrape dissect.target.target dissect.target.tools dissect.target.tools.build_magic dissect.target.tools.build_pluginlist dissect.target.tools.dd dissect.target.tools.diff dissect.target.tools.dump dissect.target.tools.fs dissect.target.tools.info dissect.target.tools.inspect dissect.target.tools.mount dissect.target.tools.qfind dissect.target.tools.query dissect.target.tools.reg dissect.target.tools.shell dissect.target.tools.utils dissect.target.tools.utils.cli dissect.target.tools.utils.fs dissect.target.tools.utils.logging dissect.target.tools.utils.report dissect.target.tools.yara dissect.target.volume dissect.target.volumes dissect.target.volumes.bde dissect.target.volumes.ddf dissect.target.volumes.disk dissect.target.volumes.luks dissect.target.volumes.lvm dissect.target.volumes.md dissect.target.volumes.vmfs dissect.thumbcache dissect.thumbcache.c_thumbcache dissect.thumbcache.exceptions dissect.thumbcache.index dissect.thumbcache.thumbcache dissect.thumbcache.thumbcache_file dissect.thumbcache.tools dissect.thumbcache.tools.extract_images dissect.thumbcache.tools.extract_with_index dissect.thumbcache.tools.utils dissect.thumbcache.util dissect.util dissect.util.compression dissect.util.compression.lz4 dissect.util.compression.lzbitmap dissect.util.compression.lzfse dissect.util.compression.lznt1 dissect.util.compression.lzo dissect.util.compression.lzvn dissect.util.compression.lzxpress dissect.util.compression.lzxpress_huffman dissect.util.compression.sevenbit dissect.util.compression.snappy dissect.util.compression.xz dissect.util.cpio dissect.util.encoding dissect.util.encoding.surrogateescape dissect.util.exceptions dissect.util.hash dissect.util.hash.crc32 dissect.util.hash.crc32c dissect.util.hash.jenkins dissect.util.ldap dissect.util.plist dissect.util.sid dissect.util.stream dissect.util.tools dissect.util.tools.dump_nskeyedarchiver dissect.util.ts dissect.util.xmemoryview dissect.vmfs dissect.vmfs.address dissect.vmfs.c_lvm dissect.vmfs.c_vmfs dissect.vmfs.descriptor dissect.vmfs.exception dissect.vmfs.lvm dissect.vmfs.resource dissect.vmfs.util dissect.vmfs.vmfs dissect.volume dissect.volume.ddf dissect.volume.ddf.c_ddf dissect.volume.ddf.ddf dissect.volume.disk dissect.volume.disk.disk dissect.volume.disk.partition dissect.volume.disk.schemes dissect.volume.disk.schemes.apm dissect.volume.disk.schemes.bsd dissect.volume.disk.schemes.gpt dissect.volume.disk.schemes.mbr dissect.volume.dm dissect.volume.dm.btree dissect.volume.dm.c_dm dissect.volume.dm.thin dissect.volume.exceptions dissect.volume.ldm dissect.volume.lvm dissect.volume.lvm.c_lvm2 dissect.volume.lvm.lvm2 dissect.volume.lvm.metadata dissect.volume.lvm.physical dissect.volume.md dissect.volume.md.c_md dissect.volume.md.md dissect.volume.raid dissect.volume.raid.raid dissect.volume.raid.stream dissect.volume.vinum dissect.volume.vinum.c_vinum dissect.volume.vinum.config dissect.volume.vinum.vinum dissect.volume.vss dissect.xfs dissect.xfs.c_xfs dissect.xfs.exceptions dissect.xfs.xfs flow.record flow.record.adapter flow.record.adapter.archive flow.record.adapter.avro flow.record.adapter.broker flow.record.adapter.csvfile flow.record.adapter.duckdb flow.record.adapter.elastic flow.record.adapter.jsonfile flow.record.adapter.line flow.record.adapter.mongo flow.record.adapter.split flow.record.adapter.splunk flow.record.adapter.sqlite flow.record.adapter.stream flow.record.adapter.text flow.record.adapter.xlsx flow.record.base flow.record.context flow.record.exceptions flow.record.fieldtypes flow.record.fieldtypes.credential flow.record.fieldtypes.net flow.record.fieldtypes.net.ip flow.record.fieldtypes.net.ipv4 flow.record.fieldtypes.net.tcp flow.record.fieldtypes.net.udp flow.record.jsonpacker flow.record.packer flow.record.selector flow.record.stream flow.record.tools flow.record.tools.geoip flow.record.tools.rdump flow.record.utils flow.record.whitelist Module (class in acquire.acquire.acquire) (class in dissect.target.plugins.os.unix.linux.modules) module (dissect.executable.pe.directory.delay_import.DelayImportFunction attribute) (dissect.executable.pe.directory.imports.ImportFunction attribute) (dissect.squashfs.compression.AvailableLZ4 attribute) (dissect.squashfs.compression.AvailableLZO attribute) (dissect.squashfs.compression.Compression attribute) (dissect.squashfs.compression.NativeLZMA attribute) (dissect.squashfs.compression.NativeXZ attribute) (dissect.squashfs.compression.NativeZlib attribute) (dissect.squashfs.compression.NativeZSTD property) (dissect.target.plugin.FailureDescriptor attribute) (dissect.target.plugin.FunctionDescriptor attribute) (dissect.target.plugin.PluginDescriptor attribute) module_arg() (in module acquire.acquire.acquire) MODULE_LOOKUP (in module acquire.acquire.acquire) module_name (acquire.acquire.collector.Record attribute) MODULE_PATH (in module dissect.target.container) (in module dissect.target.filesystem) (in module dissect.target.plugin) ModulePlugin (class in dissect.target.plugins.os.unix.linux.modules) ModuleRecord (in module dissect.target.plugins.os.unix.linux.modules) modules (dissect.executable.pe.directory.bound_import.BoundImportDirectory property) (dissect.executable.pe.directory.delay_import.DelayImportDirectory property) (dissect.executable.pe.directory.imports.ImportDirectory property) MODULES (in module acquire.acquire.acquire) modules() (dissect.target.plugins.os.windows.regf.cit.CITPlugin method) MongoReader (class in flow.record.adapter.mongo) MongoWriter (class in flow.record.adapter.mongo) monitor (dissect.target.loaders.mqtt.Broker attribute) MonthlyDateTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) MonthlyDowTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) MORE_MASK (dissect.eventlog.bxml.Token attribute) mount (dissect.target.filesystem.VirtualFilesystem attribute) mount() (dissect.target.filesystem.LayerFilesystem method) (dissect.target.helpers.nfs.client.mount.Client method) MOUNT_LETTER_MAP (dissect.target.plugins.os.windows.regf.usb.UsbPlugin attribute) mount_name (dissect.ffs.ffs.FFS attribute) mount_stat (dissect.target.helpers.nfs.client.mount.MountError attribute) MountError MountOK (class in dissect.target.helpers.nfs.nfs3) MountProc (in module dissect.target.helpers.nfs.nfs3) MountProgram (in module dissect.target.helpers.nfs.nfs3) MountResultDeserializer (class in dissect.target.helpers.nfs.serializer) mounts (dissect.target.filesystem.LayerFilesystem attribute) MountStat (class in dissect.target.helpers.nfs.nfs3) MPC (dissect.target.plugins.os.windows.network.IfTypes attribute) MPLS (dissect.target.plugins.os.windows.network.IfTypes attribute) MPLS_IN_IP (dissect.target.helpers.network.IANAProtocol attribute) MPLS_TUNNEL (dissect.target.plugins.os.windows.network.IfTypes attribute) mqtt_client (dissect.target.loaders.mqtt.Broker attribute) MqttConnection (class in dissect.target.loaders.mqtt) MqttDiagnosticLine (class in dissect.target.loaders.mqtt) MqttLoader (class in dissect.target.loaders.mqtt) MqttStream (class in dissect.target.loaders.mqtt) MqttTransferRatePerSecond (class in dissect.target.loaders.mqtt) MRUPlugin (class in dissect.target.plugins.os.windows.regf.mru) MSAuthzCentralAccessPolicies (class in dissect.database.ese.ntds.objects.msauthz_centralaccesspolicies) MSAuthzCentralAccessRules (class in dissect.database.ese.ntds.objects.msauthz_centralaccessrules) msc() (dissect.target.plugins.apps.av.mcafee.McAfeePlugin method) MSDFSRContent (class in dissect.database.ese.ntds.objects.msdfsr_content) MSDFSRContentSet (class in dissect.database.ese.ntds.objects.msdfsr_contentset) MSDFSRGlobalSettings (class in dissect.database.ese.ntds.objects.msdfsr_globalsettings) MSDFSRLocalSettings (class in dissect.database.ese.ntds.objects.msdfsr_localsettings) MSDFSRMember (class in dissect.database.ese.ntds.objects.msdfsr_member) MSDFSRReplicationGroup (class in dissect.database.ese.ntds.objects.msdfsr_replicationgroup) MSDFSRSubscriber (class in dissect.database.ese.ntds.objects.msdfsr_subscriber) MSDFSRSubscription (class in dissect.database.ese.ntds.objects.msdfsr_subscription) MSDFSRTopology (class in dissect.database.ese.ntds.objects.msdfsr_topology) MSDNSServerSettings (class in dissect.database.ese.ntds.objects.msdns_serversettings) MSDSAuthNPolicies (class in dissect.database.ese.ntds.objects.msds_authnpolicies) MSDSAuthNPolicySilos (class in dissect.database.ese.ntds.objects.msds_authnpolicysilos) MSDSClaimsTransformationPolicies (class in dissect.database.ese.ntds.objects.msds_claimstransformationpolicies) MSDSClaimType (class in dissect.database.ese.ntds.objects.msds_claimtype) MSDSClaimTypePropertyBase (class in dissect.database.ese.ntds.objects.msds_claimtypepropertybase) MSDSClaimTypes (class in dissect.database.ese.ntds.objects.msds_claimtypes) MSDSL (dissect.target.plugins.os.windows.network.IfTypes attribute) MSDSOptionalFeature (class in dissect.database.ese.ntds.objects.msds_optionalfeature) MSDSPasswordSettingsContainer (class in dissect.database.ese.ntds.objects.msds_passwordsettingscontainer) MSDSQuotaContainer (class in dissect.database.ese.ntds.objects.msds_quotacontainer) MSDSResourceProperties (class in dissect.database.ese.ntds.objects.msds_resourceproperties) MSDSResourceProperty (class in dissect.database.ese.ntds.objects.msds_resourceproperty) MSDSResourcePropertyList (class in dissect.database.ese.ntds.objects.msds_resourcepropertylist) MSDSShadowPrincipalContainer (class in dissect.database.ese.ntds.objects.msds_shadowprincipalcontainer) MSDSValueType (class in dissect.database.ese.ntds.objects.msds_valuetype) MSG_ACCEPTED (dissect.target.helpers.sunrpc.serializer.ReplyStat attribute) MSG_DENIED (dissect.target.helpers.sunrpc.serializer.ReplyStat attribute) MSGPACK (dissect.target.tools.dump.Serialization attribute) msgs (acquire.acquire.dynamic.windows.handles.DuplicateFilter attribute) MSImagingPSPs (class in dissect.database.ese.ntds.objects.msimaging_psps) MSKDSProvServerConfiguration (class in dissect.database.ese.ntds.objects.mskds_provserverconfiguration) MSMQEnterpriseSettings (class in dissect.database.ese.ntds.objects.msmqenterprisesettings) MSNPlugin (class in dissect.target.plugins.apps.chat.msn) MSOffice (class in dissect.target.plugins.apps.productivity.msoffice) msoffice() (dissect.target.plugins.os.windows.regf.mru.MRUPlugin method) MSOfficeMRURecord (in module dissect.target.plugins.os.windows.regf.mru) MSPKIEnterpriseOID (class in dissect.database.ese.ntds.objects.mspki_enterpriseoid) MSPKIPrivateKeyRecoveryAgent (class in dissect.database.ese.ntds.objects.mspki_privatekeyrecoveryagent) MSSPPActivationObjectsContainer (class in dissect.database.ese.ntds.objects.msspp_activationobjectscontainer) MSSQL (class in acquire.acquire.acquire) MSSQL_KEY_GLOB (dissect.target.plugins.os.windows.log.mssql.MssqlPlugin attribute) MssqlErrorlogRecord (in module dissect.target.plugins.os.windows.log.mssql) MssqlPlugin (class in dissect.target.plugins.os.windows.log.mssql) MSTPMInformationObjectsContainer (class in dissect.database.ese.ntds.objects.mstpm_informationobjectscontainer) mstsc() (dissect.target.plugins.os.windows.regf.mru.MRUPlugin method) mtime (dissect.apfs.objects.fs.FS property) (dissect.apfs.objects.fs.INode property) (dissect.btrfs.btrfs.INode property) (dissect.database.bsd.tools.rpm.PackageEntry attribute) (dissect.evidence.ad1.ad1.FileEntry property) (dissect.extfs.extfs.INode property) (dissect.fat.fat.DirectoryEntry property) (dissect.fat.fat.RootDirectory property) (dissect.ffs.ffs.INode property) (dissect.jffs.jffs2.INode property) (dissect.ole.ole.DirectoryEntry attribute) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx6.INode6 property) (dissect.squashfs.squashfs.INode property) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.xfs.xfs.INode property) mtime_ns (dissect.btrfs.btrfs.INode property) (dissect.extfs.extfs.INode property) (dissect.ffs.ffs.INode property) (dissect.xfs.xfs.INode property) MTP (dissect.target.helpers.network.IANAProtocol attribute) MTP_FILE_ENTRY (class in dissect.target.plugins.os.windows.regf.shellbags) MTP_VOLUME (class in dissect.target.plugins.os.windows.regf.shellbags) mui_id (dissect.eventlog.wevt_object.TASK attribute) MUI_TZ_MAP (in module dissect.target.helpers.mui) muicache() (dissect.target.plugins.os.windows.regf.muicache.MuiCachePlugin method) MuiCachePlugin (class in dissect.target.plugins.os.windows.regf.muicache) MuiCacheRecord (in module dissect.target.plugins.os.windows.regf.muicache) MULTI_SZ (dissect.target.helpers.regutil.RegistryValueType attribute) MultiDict (class in dissect.target.plugins.apps.vpn.wireguard) MultiRawLoader (class in dissect.target.loaders.multiraw) must_contain (dissect.database.ese.ntds.objects.classschema.ClassSchema property) MUTANT (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) MUTEX (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) mutiple_instances_policy (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) MUX (dissect.target.helpers.network.IANAProtocol attribute) MVL (dissect.target.plugins.os.windows.network.IfTypes attribute) MYRINET (dissect.target.plugins.os.windows.network.IfTypes attribute) mz_header (dissect.executable.pe.pe.PE attribute) N N (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) n_literal_payload_bytes (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) n_literals (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) n_lmd_payload_bytes (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) n_matches (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) n_payload_bytes (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) n_raw_bytes (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) name (acquire.acquire.dynamic.windows.named_objects.NamedObject attribute) (acquire.acquire.dynamic.windows.types.Handle attribute) (acquire.acquire.dynamic.windows.types.OBJECT_DIRECTORY_INFORMATION property) (acquire.acquire.dynamic.windows.types.PUBLIC_OBJECT_TYPE_INFORMATION property) (dissect.apfs.objects.fs.DirectoryEntry property) (dissect.apfs.objects.fs.FS property) (dissect.apfs.objects.fs.INode property) (dissect.apfs.objects.fs.Snapshot property) (dissect.apfs.objects.fs.XAttr property) (dissect.archive.vbk.DirItem attribute) (dissect.archive.vbk.RootDirectory attribute) (dissect.archive.vma.Device attribute) (dissect.archive.wim.DirectoryEntry attribute) (dissect.cim.cim.Class property) (dissect.cim.cim.Instance property) (dissect.cim.cim.Namespace attribute) (dissect.cim.cim.Property property) (dissect.cim.classes.ClassInstanceProperty property) (dissect.clfs.blf.Container attribute) (dissect.clfs.blf.Stream attribute) (dissect.cramfs.cramfs.INode property) (dissect.cstruct.types.structure.Field attribute) (dissect.database.bsd.tools.rpm.Package property) (dissect.database.ese.index.Index attribute) (dissect.database.ese.ntds.objects.object.Object property) (dissect.database.ese.ntds.schema.AttributeEntry attribute) (dissect.database.ese.ntds.schema.ClassEntry attribute) (dissect.database.ese.table.Column attribute) (dissect.database.ese.table.Table attribute) (dissect.database.ese.util.ColumnType attribute) (dissect.database.sqlite3.sqlite3.Column attribute) (dissect.database.sqlite3.sqlite3.Index attribute) (dissect.database.sqlite3.sqlite3.Table attribute) (dissect.eventlog.bxml.BxmlTag attribute) (dissect.eventlog.wevt_object.WevtName attribute) (dissect.evidence.ad1.ad1.FileEntry property) (dissect.evidence.ad1.ad1.LogicalImage attribute) (dissect.executable.elf.elf.Section property) (dissect.executable.elf.elf.Symbol property) (dissect.executable.pe.directory.bound_import.BoundImportForwardReference property) (dissect.executable.pe.directory.bound_import.BoundImportModule property) (dissect.executable.pe.directory.com_descriptor.ComStream attribute) (dissect.executable.pe.directory.delay_import.DelayImportModule property) (dissect.executable.pe.directory.export.ExportDirectory property) (dissect.executable.pe.directory.export.ExportFunction attribute) (dissect.executable.pe.directory.imports.ImportModule property) (dissect.executable.pe.directory.resource.Resource attribute) (dissect.executable.pe.pe.Section property) (dissect.extfs.extfs.XAttr attribute) (dissect.fat.fat.DirectoryEntry attribute) (dissect.fat.fat.RootDirectory attribute) (dissect.ffs.ffs.INode attribute) (dissect.hypervisor.descriptor.vbox.Machine property) (dissect.hypervisor.descriptor.vbox.Snapshot property) (dissect.hypervisor.descriptor.vbox.VBox property) (dissect.hypervisor.disk.qcow2.QCow2Snapshot attribute) (dissect.jffs.jffs2.DirEntry property) (dissect.ntfs.attr.Attribute property) (dissect.ntfs.attr.AttributeHeader property) (dissect.ntfs.index.Index attribute) (dissect.ole.ole.DirectoryEntry attribute) (dissect.qnxfs.qnx4.INode4 property) (dissect.regf.regf.KeyNode attribute) (dissect.squashfs.squashfs.INode attribute) (dissect.target.filesystem.DirEntry attribute) (dissect.target.filesystem.FilesystemEntry attribute) (dissect.target.helpers.nfs.nfs3.EntryPlus attribute) (dissect.target.helpers.regutil.KeyCollection property) (dissect.target.helpers.regutil.RegfKey property) (dissect.target.helpers.regutil.RegfValue property) (dissect.target.helpers.regutil.RegistryKey property) (dissect.target.helpers.regutil.RegistryValue property) (dissect.target.helpers.regutil.ValueCollection property) (dissect.target.helpers.regutil.VirtualKey property) (dissect.target.helpers.regutil.VirtualValue property) (dissect.target.loaders.cb.CbRegistryKey property) (dissect.target.loaders.cb.CbRegistryValue property) (dissect.target.loaders.containerimage.ContainerImageTarSubLoader attribute) (dissect.target.loaders.res.File attribute) (dissect.target.loaders.res.Folder attribute) (dissect.target.loaders.smb.SmbRegistryHive attribute) (dissect.target.loaders.smb.SmbRegistryKey property) (dissect.target.loaders.smb.SmbRegistryValue property) (dissect.target.plugin.FunctionDescriptor attribute) (dissect.target.plugins.apps.webserver.apache.LogFormat attribute) (dissect.target.plugins.os.unix.linux.modules.Module attribute) (dissect.target.plugins.os.unix.linux.network.DhcpLease attribute) (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) (dissect.target.plugins.os.unix.linux.network.ProcConfigParser.ParserContext attribute) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager attribute) (dissect.target.plugins.os.unix.linux.network_managers.Template attribute) (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) (dissect.target.plugins.os.windows.datetime.WindowsTimezone attribute) (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm attribute) (dissect.target.plugins.os.windows.dpapi.crypto.HashAlgorithm attribute) (dissect.target.plugins.os.windows.env.EnvVarDetails attribute) (dissect.target.plugins.os.windows.jumplist.JumpListFile property) (dissect.target.plugins.os.windows.regf.shellbags.CDBURN property) (dissect.target.plugins.os.windows.regf.shellbags.COMPRESSED_FOLDER property) (dissect.target.plugins.os.windows.regf.shellbags.CONTROL_PANEL property) (dissect.target.plugins.os.windows.regf.shellbags.CONTROL_PANEL_CATEGORY property) (dissect.target.plugins.os.windows.regf.shellbags.CONTROL_PANEL_CPL_FILE property) (dissect.target.plugins.os.windows.regf.shellbags.DELEGATE property) (dissect.target.plugins.os.windows.regf.shellbags.FILE_ENTRY property) (dissect.target.plugins.os.windows.regf.shellbags.GAME_FOLDER property) (dissect.target.plugins.os.windows.regf.shellbags.MTP_FILE_ENTRY property) (dissect.target.plugins.os.windows.regf.shellbags.MTP_VOLUME property) (dissect.target.plugins.os.windows.regf.shellbags.NETWORK property) (dissect.target.plugins.os.windows.regf.shellbags.ROOT_FOLDER property) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM property) (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN property) (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN0 property) (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN1 property) (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN_0x74 property) (dissect.target.plugins.os.windows.regf.shellbags.URI property) (dissect.target.plugins.os.windows.regf.shellbags.USERS_PROPERTY_VIEW property) (dissect.target.plugins.os.windows.regf.shellbags.VOLUME property) (dissect.target.target.Target property) (dissect.target.tools.diff.DifferentialEntry attribute) (dissect.target.volume.Volume attribute) (dissect.vmfs.descriptor.DirEntry attribute) (dissect.vmfs.lvm.Volume attribute) (dissect.volume.ddf.ddf.VirtualDiskRecord attribute) (dissect.volume.disk.partition.Partition attribute) (dissect.volume.lvm.metadata.HistoricalLogicalVolume attribute) (dissect.volume.lvm.metadata.LogicalVolume property) (dissect.volume.lvm.metadata.PhysicalVolume property) (dissect.volume.lvm.metadata.Segment property) (dissect.volume.lvm.metadata.VolumeGroup property) (dissect.volume.raid.raid.VirtualDisk attribute) (dissect.volume.vinum.config.Plex attribute) (dissect.volume.vinum.config.SD attribute) (dissect.volume.vinum.config.Volume attribute) (dissect.volume.vinum.vinum.VinumPhysicalDisk attribute) (dissect.xfs.xfs.XFS attribute) (flow.record.base.GroupedRecord attribute) (flow.record.base.RecordDescriptor attribute) (flow.record.base.RecordField attribute) (flow.record.stream.PathTemplateWriter attribute) name() (in module flow.record.selector) name_hash (dissect.cim.classes.ClassInstance attribute) name_offset (dissect.cim.classes.PropertyReference attribute) name_thunk (dissect.executable.pe.directory.delay_import.DelayImportFunction attribute) NAME_TO_CP (in module dissect.executable.pe.locale_id) NAME_TO_GUID_MAP (in module dissect.database.ese.tools.sru) NamedObject (class in acquire.acquire.dynamic.windows.named_objects) NamedObjectType (class in acquire.acquire.dynamic.windows.named_objects) NAMEOID_TO_NAME (in module dissect.target.helpers.certificate) names (dissect.apfs.objects.fs.INode property) (dissect.eventlog.evtx.ElfChnk attribute) (dissect.eventlog.wevt_object.TEMP attribute) names() (dissect.evidence.asdf.asdf.Metadata method) (in module flow.record.selector) Namespace (class in dissect.cim.cim) namespace (dissect.cim.cim.Class attribute) (dissect.cim.cim.Instance attribute) (dissect.cim.utils.ObjectPath attribute) (dissect.target.plugin.FunctionDescriptor attribute) (dissect.target.plugin.PluginDescriptor attribute) namespace() (dissect.cim.cim.CIM method) (dissect.cim.cim.Namespace method) NAMESPACE_CLASS_NAME (in module dissect.cim.c_cim) NamespacePlugin (class in dissect.target.plugin) namespaces (dissect.cim.cim.Namespace property) NamingContextDeleting (dissect.database.ese.ntds.util.InstanceType attribute) NamingContextUnderConstruction (dissect.database.ese.ntds.util.InstanceType attribute) NARP (dissect.target.helpers.network.IANAProtocol attribute) native() (dissect.target.plugins.apps.productivity.msoffice.MSOffice method) NATIVE_TYPE_MAP (in module dissect.database.ese.tools.sru) NativeLZMA (class in dissect.squashfs.compression) NativePluginStatus (class in dissect.target.plugins.apps.productivity.msoffice) NativeXZ (class in dissect.squashfs.compression) NativeZlib (class in dissect.squashfs.compression) NativeZSTD (class in dissect.squashfs.compression) nblocks (dissect.ffs.ffs.INode property) (dissect.xfs.xfs.INode property) ncdnt (dissect.database.ese.ntds.objects.object.Object property) ndis() (dissect.target.plugins.os.windows.generic.GenericPlugin method) NdisRecord (in module dissect.target.plugins.os.windows.generic) near_copies (dissect.volume.raid.stream.RAID10Stream attribute) NEEDLE (dissect.target.plugins.os.windows.log.evt.EvtPlugin attribute) (dissect.target.plugins.os.windows.log.evtx.EvtxPlugin attribute) Needle (in module dissect.target.helpers.scrape) needs_backing_file (dissect.hypervisor.disk.qcow2.QCow2 property) needs_data_file (dissect.hypervisor.disk.qcow2.QCow2 property) net (flow.record.fieldtypes.net.ipv4.subnet attribute) (in module flow.record.base) NetAddress (in module dissect.target.plugins.os.unix.linux.network) NETBLT (dissect.target.helpers.network.IANAProtocol attribute) NethistPlugin (class in dissect.target.plugins.os.windows.regf.nethist) netloc (flow.record.fieldtypes.uri property) netmask (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager property) (flow.record.fieldtypes.net.ip.ipinterface property) (flow.record.fieldtypes.net.ip.ipnetwork property) netmask() (dissect.target.plugins.os.unix.linux._os.LinuxPlugin method) NetSocket (class in dissect.target.plugins.os.unix.linux.proc) NetSocketPlugin (class in dissect.target.plugins.os.unix.linux.sockets) NetSocketRecord (in module dissect.target.plugins.os.unix.linux.sockets) Netstat (class in acquire.acquire.acquire) netstat() (dissect.target.plugins.os.unix.linux.netstat.NetstatPlugin method) NETSTAT_HEADER (in module dissect.target.plugins.os.unix.linux.netstat) NETSTAT_TEMPLATE (in module dissect.target.plugins.os.unix.linux.netstat) NetstatPlugin (class in dissect.target.plugins.os.unix.linux.netstat) Network (class in acquire.acquire.acquire) NETWORK (class in dissect.target.plugins.os.windows.regf.shellbags) network (flow.record.fieldtypes.net.ip.ipinterface property) network_connectivity() (dissect.target.plugins.os.windows.sru.SRUPlugin method) network_data() (dissect.target.plugins.os.windows.sru.SRUPlugin method) network_history() (dissect.target.plugins.os.windows.regf.nethist.NethistPlugin method) network_manager (dissect.target.plugins.os.unix.linux._os.LinuxPlugin attribute) network_profile_name (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) network_settings_id (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) network_settings_name (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) NetworkConnectivityRecord (in module dissect.target.plugins.os.windows.sru) NetworkDataRecord (in module dissect.target.plugins.os.windows.sru) networkdrive() (dissect.target.plugins.os.windows.regf.mru.MRUPlugin method) NetworkHistoryRecord (in module dissect.target.plugins.os.windows.regf.nethist) NetworkManager (class in dissect.target.plugins.os.unix.linux.network_managers) NetworkManagerConfigParser (class in dissect.target.plugins.os.unix.linux.network) NetworkManagerConfigParser.ParserContext (class in dissect.target.plugins.os.unix.linux.network) NetworkManagerLeaseParser (class in dissect.target.plugins.os.unix.linux.network) NetworkPlugin (class in dissect.target.plugins.os.default.network) new_file_handler() (in module acquire.acquire.log) NEW_SYN_RECV (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) next (dissect.cstruct.parser.TokenConsumer property) (dissect.evidence.ad1.ad1.FileMeta attribute) (dissect.evidence.ewf.ewf.SectionDescriptor attribute) next() (dissect.apfs.cursor.Cursor method) (dissect.btrfs.tree.Cursor method) (dissect.database.ese.btree.BTree method) (dissect.database.ese.cursor.Cursor method) next_buffer (dissect.etl.etl.Buffer property) next_node() (dissect.btrfs.tree.Cursor method) next_page (dissect.database.ese.page.Page attribute) next_page() (dissect.database.ese.btree.BTree method) next_state (dissect.fve.bde.information.Information property) next_store (dissect.volume.vss.Store attribute) NFAS (dissect.target.plugins.os.windows.network.IfTypes attribute) nfs_volume_uuid() (in module dissect.target.plugins.os.unix.esxi._os) NfsDirEntry (class in dissect.target.filesystems.nfs) NfsError NfsFilesystem (class in dissect.target.filesystems.nfs) NfsFilesystemEntry (class in dissect.target.filesystems.nfs) NfsProgram (in module dissect.target.helpers.nfs.nfs3) NfsStat (class in dissect.target.helpers.nfs.nfs3) nfsstat (dissect.target.helpers.nfs.client.nfs.NfsError attribute) NfsStream (class in dissect.target.filesystems.nfs) NfsTime (class in dissect.target.helpers.nfs.nfs3) NfsTimeSerializer (class in dissect.target.helpers.nfs.serializer) NfsVersion (in module dissect.target.helpers.nfs.nfs3) NginxPlugin (class in dissect.target.plugins.apps.webserver.nginx) nkeys (dissect.apfs.objects.btree_node.BTreeNode property) nlink (dissect.jffs.jffs2.INode property) (dissect.qnxfs.qnx4.INode4 property) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) nms() (in module dissect.target.helpers.cyber) NMS_JUMBLE_LOOP_SPEED (in module dissect.target.helpers.cyber) NMS_JUMBLE_SECONDS (in module dissect.target.helpers.cyber) NMS_MASK_TABLE (in module dissect.target.helpers.cyber) NMS_REVEAL_LOOP_SPEED (in module dissect.target.helpers.cyber) NMS_REVEAL_SECONDS (in module dissect.target.helpers.cyber) NMS_TYPE_EFFECT_SPEED (in module dissect.target.helpers.cyber) no_cache (dissect.target.helpers.cache.Cache attribute) NO_COLOR (in module dissect.target.tools.qfind) NO_DOCS (in module dissect.target.helpers.docs) NO_VOLUME_LABEL_ENTRY (in module dissect.fat.c_exfat) NoCellData Node (class in dissect.database.ese.page) (class in dissect.util.compression.lzxpress_huffman) (class in dissect.volume.dm.btree) node (dissect.database.ese.record.RecordData attribute) node() (dissect.database.ese.btree.BTree method) (dissect.database.ese.page.Page method) node_count (dissect.database.ese.page.Page attribute) node_size (dissect.btrfs.btrfs.Btrfs attribute) node_vcn (dissect.ntfs.index.IndexEntry property) nodes() (dissect.database.ese.page.Page method) nofua (dissect.volume.lvm.metadata.WriteCacheSegment attribute) noheader (dissect.target.plugins.os.windows.regf.shimcache.ShimCache attribute) NoMoreEntriesError NoMoreEventsError nonce (dissect.fve.bde.information.AesCcmEncryptedDatum property) nonce_counter (dissect.fve.bde.information.AesCcmEncryptedDatum property) nonce_time (dissect.fve.bde.information.AesCcmEncryptedDatum property) NONE (dissect.target.helpers.regutil.RegistryValueType attribute) (dissect.target.plugins.apps.container.podman.ContainerState attribute) (dissect.target.tools.dump.Compression attribute) NONE_OBJECT (in module flow.record.selector) NoNeighbourPageError NoneObject (class in flow.record.selector) NONSPACE_MARK (dissect.database.ese.lcmapstring.SCRIPT attribute) noop() (in module dissect.database.ese.record) NORM_IGNORECASE (dissect.database.ese.lcmapstring.MapFlags attribute) NORM_IGNOREKANATYPE (dissect.database.ese.lcmapstring.MapFlags attribute) NORM_IGNORENONSPACE (dissect.database.ese.lcmapstring.MapFlags attribute) NORM_IGNORESYMBOLS (dissect.database.ese.lcmapstring.MapFlags attribute) NORM_IGNOREWIDTH (dissect.database.ese.lcmapstring.MapFlags attribute) NORM_LINGUISTIC_CASING (dissect.database.ese.lcmapstring.MapFlags attribute) NORMAL_ACCOUNT (dissect.database.ese.ntds.util.UserAccountControl attribute) NORMAL_SUBCLUSTER_TYPES (in module dissect.hypervisor.disk.c_qcow2) normalise_field_name() (in module dissect.target.plugins.apps.webserver.iis) normalize() (flow.record.fieldtypes.uri static method) (in module dissect.target.helpers.polypath) normalize_fieldname() (in module flow.record.base) normalize_language() (in module dissect.target.helpers.localeutil) normalize_path() (in module acquire.acquire.utils) normalize_timezone() (in module dissect.target.helpers.localeutil) normpath() (in module dissect.target.helpers.polypath) NOT (dissect.util.ldap.LogicalOperator attribute) NOT_DELEGATED (dissect.database.ese.ntds.util.UserAccountControl attribute) NotADirectoryError, [1], [2], [3], [4], [5], [6], [7], [8], [9], [10], [11], [12], [13], [14] NotAFileError, [1] NotAnIndexFileError NotAnRDMFileError NotAReparsePointError, [1] NotASymlinkError, [1], [2], [3], [4], [5], [6], [7], [8], [9], [10], [11] NotFoundError NOTICE (dissect.target.plugins.os.unix.log.journal.JournalMessagePriority attribute) NOTIFICATIONS_DIR (in module dissect.target.plugins.os.windows.notifications) NotificationsPlugin (class in dissect.target.plugins.os.windows.notifications) NotReplicated (dissect.database.ese.ntds.util.SystemFlags attribute) now (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) now() (in module dissect.util.ts) NoWriteAheadLog nr_of_items (dissect.eventlog.wevt.WEVT_TYPE property) ns (dissect.cim.cim.Class property) (dissect.cim.cim.Instance property) NS (dissect.hypervisor.descriptor.ovf.OVF attribute) ns (flow.record.selector.CompiledSelector attribute) NS (in module dissect.hypervisor.descriptor.vbox) ns (in module dissect.target.plugins.os.unix.linux.recentlyused) NS() (dissect.cim.index.Key method) NsCollectorTarSubLoader (class in dissect.target.loaders.nscollector) NSDictionary (class in dissect.util.plist) nseconds (dissect.target.helpers.nfs.nfs3.NfsTime attribute) NSFNET_IGP (dissect.target.helpers.network.IANAProtocol attribute) NSH (dissect.target.helpers.network.IANAProtocol attribute) NSIP (dissect.target.plugins.os.windows.network.IfTypes attribute) nskeyed (dissect.util.plist.NSObject attribute) NSKeyedArchiver (class in dissect.util.plist) NSObject (class in dissect.util.plist) nt (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry attribute) nt52_entry_type() (in module dissect.target.plugins.os.windows.regf.shimcache) nt61_entry_type() (in module dissect.target.plugins.os.windows.regf.shimcache) ntdll (in module acquire.acquire.dynamic.windows.ntdll) NTDS (class in acquire.acquire.acquire) (class in dissect.database.ese.ntds.ntds) ntds (dissect.target.filesystems.ntds.NtdsFilesystem attribute) (dissect.target.plugins.os.windows.ad.ntds.NtdsPlugin property) NTDS_PARAMETERS_DB_VALUE (in module dissect.target.plugins.os.windows.ad.ntds) NTDS_PARAMETERS_REGISTRY_PATH (in module dissect.target.plugins.os.windows.ad.ntds) NtdsComputerRecord (in module dissect.target.plugins.os.windows.ad.ntds) NTDSConnection (class in dissect.database.ese.ntds.objects.ntdsconnection) NtdsDirEntry (class in dissect.target.filesystems.ntds) NTDSDSA (class in dissect.database.ese.ntds.objects.ntdsdsa) NtdsFilesystem (class in dissect.target.filesystems.ntds) NtdsFilesystemEntry (class in dissect.target.filesystems.ntds) NtdsGPORecord (in module dissect.target.plugins.os.windows.ad.ntds) NtdsPlugin (class in dissect.target.plugins.os.windows.ad.ntds) NTDSService (class in dissect.database.ese.ntds.objects.ntdsservice) NTDSSiteSettings (class in dissect.database.ese.ntds.objects.ntdssitesettings) NtdsUserRecord (in module dissect.target.plugins.os.windows.ad.ntds) NTFRSSettings (class in dissect.database.ese.ntds.objects.ntfrssettings) NTFS (class in acquire.acquire.acquire) (class in dissect.ntfs.ntfs) ntfs (dissect.ntfs.mft.Mft attribute) (dissect.ntfs.mft.MftRecord attribute) (dissect.ntfs.usnjrnl.UsnJrnl attribute) (dissect.target.filesystems.ntfs.NtfsFilesystem attribute) NTFS (dissect.target.plugins.os.windows.everything.parser.EverythingFSType attribute) ntfs_def (in module dissect.ntfs.c_ntfs) ntfs_filesystems (dissect.target.plugins.filesystem.ntfs.mft.MftPlugin attribute) NTFS_NEEDLE (in module dissect.target.loaders.phobos) NTFS_SIGNATURE (in module dissect.ntfs.c_ntfs) NtfsDirEntry (class in dissect.target.filesystems.ntfs) NtfsFilesystem (class in dissect.target.filesystems.ntfs) NtfsFilesystemEntry (class in dissect.target.filesystems.ntfs) NtOpenDirectoryObject (in module acquire.acquire.dynamic.windows.ntdll) NtQueryDirectoryObject (in module acquire.acquire.dynamic.windows.ntdll) NtQueryInformationFile (in module acquire.acquire.dynamic.windows.ntdll) NtQueryObject (in module acquire.acquire.dynamic.windows.ntdll) NtQuerySystemInformation (in module acquire.acquire.dynamic.windows.ntdll) NTSTATUS (in module acquire.acquire.dynamic.windows.types) NtStatusCode (class in acquire.acquire.dynamic.windows.ntdll) ntversion (dissect.target.plugins.os.windows.regf.shimcache.ShimCache attribute) ntversion() (dissect.target.plugins.os.windows.generic.GenericPlugin method) NULL (dissect.eventlog.bxml.BxmlType attribute) (in module acquire.acquire.dynamic.windows.types) NULL_GUID (in module dissect.hypervisor.disk.hdd) null_terminated (dissect.cstruct.types.base.BaseArray attribute) NullGuid (in module dissect.etl.utils) NullPointerDereference NullSessionPipeRecord (in module dissect.target.plugins.os.windows.generic) nullsessionpipes() (dissect.target.plugins.os.windows.generic.GenericPlugin method) num (dissect.database.ese.page.Node attribute) (dissect.database.ese.page.Page attribute) (dissect.database.ese.page.Tag attribute) (dissect.database.sqlite3.sqlite3.Page attribute) (dissect.executable.elf.elf.Table attribute) (dissect.ffs.ffs.CylinderGroup attribute) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) (dissect.xfs.xfs.AllocationGroup attribute) NUM_APPDB_CHUNKS (in module dissect.target.plugins.os.windows.notifications) num_blocks (dissect.cramfs.cramfs.BlockStream attribute) (dissect.qnxfs.qnx6.QNX6 attribute) num_difat_entries (dissect.ole.ole.OLE attribute) num_disks (dissect.volume.raid.raid.VirtualDisk attribute) num_entries (dissect.cstruct.types.base.BaseArray attribute) (dissect.evidence.ewf.ewf.TableSection attribute) (dissect.volume.dm.btree.Node attribute) num_fat_entries (dissect.ole.ole.OLE attribute) num_fields (dissect.target.helpers.configutil.CSVish attribute) num_inodes (dissect.qnxfs.qnx6.QNX6 attribute) NUM_OVERFLOW_SLOTS (dissect.target.plugins.os.unix.locate.plocate.PLocateFile attribute) num_properties (dissect.cim.classes.PropertyStates attribute) num_stripes (dissect.btrfs.stream.Chunk attribute) number (dissect.evidence.ad1.ad1.SegmentFile attribute) (dissect.target.volume.Volume attribute) (dissect.volume.ddf.ddf.VirtualDiskRecord attribute) (dissect.volume.disk.partition.Partition attribute) number_of_blocks (dissect.hypervisor.disk.vdi.VDI property) NVP_II (dissect.target.helpers.network.IANAProtocol attribute) NxFusionWbc (class in dissect.apfs.objects.nx_fusion_wbc) NxFusionWbcList (class in dissect.apfs.objects.nx_fusion_wbc_list) NxReaper (class in dissect.apfs.objects.nx_reaper) NxReapList (class in dissect.apfs.objects.nx_reap_list) NxSuperblock (class in dissect.apfs.objects.nx_superblock) O oatimestamp() (in module dissect.util.ts) obj (dissect.util.plist.NSObject attribute) (in module dissect.target.helpers.magic.mimetypes) OBJ_ATTR (class in acquire.acquire.dynamic.windows.ntdll) obj_attributes (dissect.target.helpers.nfs.nfs3.LookupResult attribute) (dissect.target.helpers.nfs.nfs3.ReadlinkResult attribute) OBJ_CASE_INSENSITIVE (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) OBJ_EXCLUSIVE (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) OBJ_FORCE_ACCESS_CHECK (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) OBJ_IGNORE_IMPERSONATED_DEVICEMAP (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) OBJ_INHERIT (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) OBJ_KERNEL_HANDLE (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) OBJ_OPENIF (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) OBJ_OPENLINK (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) OBJ_PERMANENT (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) OBJ_VALID_ATTRIBUTES (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) object (acquire.acquire.dynamic.windows.types.Handle attribute) (acquire.acquire.dynamic.windows.types.SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX property) Object (class in dissect.apfs.objects.base) (class in dissect.database.ese.ntds.objects.object) object (dissect.apfs.objects.base.Object attribute) (dissect.apfs.objects.btree.BTree attribute) (dissect.apfs.objects.btree_node.BTreeNode attribute) (dissect.apfs.objects.checkpoint_map.CheckpointMap attribute) (dissect.apfs.objects.efi_jumpstart.EfiJumpstart attribute) (dissect.apfs.objects.er_recovery_block.EncryptionRollingRecoveryBlock attribute) (dissect.apfs.objects.er_state.EncryptionRollingState attribute) (dissect.apfs.objects.fs.FS attribute) (dissect.apfs.objects.gbitmap.GBitmap attribute) (dissect.apfs.objects.gbitmap_block.GBitmapBlock attribute) (dissect.apfs.objects.integrity_meta.IntegrityMeta attribute) (dissect.apfs.objects.keybag.Keybag attribute) (dissect.apfs.objects.nx_fusion_wbc.NxFusionWbc attribute) (dissect.apfs.objects.nx_fusion_wbc_list.NxFusionWbcList attribute) (dissect.apfs.objects.nx_reap_list.NxReapList attribute) (dissect.apfs.objects.nx_reaper.NxReaper attribute) (dissect.apfs.objects.nx_superblock.NxSuperblock attribute) (dissect.apfs.objects.omap.ObjectMap attribute) (dissect.apfs.objects.snap_meta_ext.SnapMetaExt attribute) (dissect.apfs.objects.spaceman.Spaceman attribute) (dissect.apfs.objects.spaceman_cab.SpacemanChunkInfoAddressBlock attribute) (dissect.apfs.objects.spaceman_cib.SpacemanChunkInfoBlock attribute) (dissect.target.helpers.nfs.nfs3.LookupResult attribute) object() (dissect.cim.index.Key method) OBJECT_ATTRIBUTES (class in acquire.acquire.dynamic.windows.ntdll) object_category (dissect.database.ese.ntds.objects.object.Object property) object_class (dissect.database.ese.ntds.objects.object.Object property) OBJECT_DIRECTORY_INFORMATION (class in acquire.acquire.dynamic.windows.types) object_flags (dissect.database.ese.ntds.sd.ACE attribute) OBJECT_INFORMATION_CLASS (class in acquire.acquire.dynamic.windows.types) object_tables (dissect.hypervisor.descriptor.hyperv.HyperVFile attribute) object_type (dissect.database.ese.ntds.sd.ACE attribute) (dissect.ntfs.secure.ACE attribute) object_type_index (acquire.acquire.dynamic.windows.types.Handle attribute) (acquire.acquire.dynamic.windows.types.SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX property) ObjectBasicInformation (acquire.acquire.dynamic.windows.types.OBJECT_INFORMATION_CLASS attribute) ObjectEntryType (in module dissect.hypervisor.descriptor.c_hyperv) ObjectGuid (in module dissect.etl.utils) objectid (dissect.btrfs.btrfs.Subvolume attribute) ObjectMap (class in dissect.apfs.objects.omap) ObjectNameInformation (acquire.acquire.dynamic.windows.types.OBJECT_INFORMATION_CLASS attribute) ObjectPath (class in dissect.cim.utils) Objects (class in dissect.cim.objects) objects (dissect.cim.cim.CIM attribute) objects() (dissect.cim.index.Key method) (dissect.cim.objects.DataPage method) ObjectTypeInformation (acquire.acquire.dynamic.windows.types.OBJECT_INFORMATION_CLASS attribute) OCI_IMAGE (in module dissect.target.loaders.containerimage) oci_layers() (in module dissect.target.filesystems.overlay) OFFICE_COMPONENTS (dissect.target.plugins.apps.productivity.msoffice.MSOffice attribute) OFFICE_DEFAULT_ROOT (dissect.target.plugins.apps.productivity.msoffice.MSOffice attribute) OFFICE_DEFAULT_USER_STARTUP (dissect.target.plugins.apps.productivity.msoffice.MSOffice attribute) OFFICE_KEY (dissect.target.plugins.apps.productivity.msoffice.MSOffice attribute) OFFICE_STARTUP_OPTIONS (dissect.target.plugins.apps.productivity.msoffice.MSOffice attribute) OfficeNativeAddinRecord (in module dissect.target.plugins.apps.productivity.msoffice) OfficeStartupItem (in module dissect.target.plugins.apps.productivity.msoffice) OfficeWebAddinRecord (in module dissect.target.plugins.apps.productivity.msoffice) offset (dissect.archive.vbk.Bank attribute) (dissect.archive.vbk.SnapshotSlot attribute) (dissect.archive.vbk.StgBlockDescriptor property) (dissect.archive.vma.Extent attribute) (dissect.archive.wim.CompressedStream attribute) (dissect.archive.wim.Resource attribute) (dissect.btrfs.stream.Chunk attribute) (dissect.btrfs.stream.Extent attribute) (dissect.btrfs.stream.Stripe attribute) (dissect.cim.cim.Property property) (dissect.cim.classes.ClassDefinitionProperty attribute) (dissect.cim.classes.ClassInstanceProperty property) (dissect.clfs.blf.Stream attribute) (dissect.clfs.c_clfs.BlockHeader attribute) (dissect.clfs.container.Container attribute) (dissect.cramfs.cramfs.INode attribute) (dissect.cstruct.types.structure.Field attribute) (dissect.database.bsd.db.Page attribute) (dissect.database.ese.page.Tag attribute) (dissect.database.ese.table.Column property) (dissect.database.sqlite3.sqlite3.Cell attribute) (dissect.database.sqlite3.sqlite3.Page attribute) (dissect.database.sqlite3.wal.Frame attribute) (dissect.etl.etl.Buffer attribute) (dissect.eventlog.wevt.WEVT attribute) (dissect.eventlog.wevt.WEVT_TYPE attribute) (dissect.eventlog.wevt_object.WevtObject attribute) (dissect.evidence.ad1.ad1.FileEntry attribute) (dissect.evidence.ad1.ad1.FileMeta attribute) (dissect.evidence.ad1.ad1.LogicalImage attribute) (dissect.evidence.ewf.ewf.SectionDescriptor attribute) (dissect.evidence.ewf.ewf.Segment attribute) (dissect.evidence.ewf.ewf.TableSection attribute) (dissect.executable.elf.elf.Section attribute) (dissect.executable.elf.elf.SectionTable attribute) (dissect.executable.elf.elf.Segment attribute) (dissect.executable.elf.elf.SegmentTable attribute) (dissect.executable.pe.directory.com_descriptor.ComStream attribute) (dissect.ffs.ffs.CylinderGroup attribute) (dissect.fve.bde.eow.EowBitmap attribute) (dissect.fve.bde.eow.EowInformation attribute) (dissect.fve.bde.information.Information attribute) (dissect.fve.crypto.dmcrypt.CryptStream attribute) (dissect.fve.luks.metadata.KeyslotArea attribute) (dissect.fve.luks.metadata.Segment attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageFileObject attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageObjectTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageReplayLog attribute) (dissect.hypervisor.disk.asif.Directory attribute) (dissect.hypervisor.disk.asif.Table attribute) (dissect.hypervisor.disk.qcow2.L2Table attribute) (dissect.hypervisor.disk.qcow2.QCow2Snapshot attribute) (dissect.hypervisor.disk.vhd.BlockAllocationTable attribute) (dissect.hypervisor.disk.vhdx.BlockAllocationTable attribute) (dissect.hypervisor.disk.vhdx.MetadataTable attribute) (dissect.hypervisor.disk.vhdx.ParentLocator attribute) (dissect.hypervisor.disk.vhdx.RegionTable attribute) (dissect.hypervisor.disk.vmdk.RawDisk attribute) (dissect.hypervisor.disk.vmdk.SparseDisk attribute) (dissect.ntfs.attr.AttributeHeader attribute) (dissect.ntfs.index.IndexBuffer attribute) (dissect.ntfs.index.IndexEntry attribute) (dissect.ntfs.mft.MftRecord attribute) (dissect.ntfs.usnjrnl.UsnRecord attribute) (dissect.ole.ole.ChainStream attribute) (dissect.squashfs.squashfs.INode attribute) (dissect.target.helpers.nfs.nfs3.ReadParams attribute) (dissect.target.loaders.res.File attribute) (dissect.target.volume.Volume attribute) (dissect.util.stream.RangeStream attribute) (dissect.volume.disk.partition.Partition attribute) (dissect.volume.disk.schemes.mbr.MBR attribute) (dissect.volume.raid.raid.PhysicalDisk attribute) (dissect.volume.vss.BlockList attribute) (dissect.volume.vss.RangeList attribute) (dissect.volume.vss.StoreBitmap attribute) offset_data (dissect.hypervisor.util.vmtar.VisorTarInfo attribute) offset_into_cluster() (in module dissect.hypervisor.disk.qcow2) offset_into_subcluster() (in module dissect.hypervisor.disk.qcow2) offset_to_data (dissect.executable.pe.directory.resource.ResourceDataEntry property) offset_to_l1_index() (in module dissect.hypervisor.disk.qcow2) offset_to_l2_index() (in module dissect.hypervisor.disk.qcow2) offset_to_sc_index() (in module dissect.hypervisor.disk.qcow2) offsets (dissect.target.containers.split.SplitContainer attribute) oid (dissect.apfs.cursor.Cursor attribute) (dissect.apfs.objects.base.Object property) (dissect.apfs.objects.fs.INode attribute) (dissect.apfs.stream.FileStream attribute) OK (dissect.target.helpers.nfs.nfs3.MountStat attribute) (dissect.target.helpers.nfs.nfs3.NfsStat attribute) oldest_record_number (dissect.eventlog.evt.Evt attribute) OLE (class in dissect.ole.ole) ole (dissect.ole.ole.Chain attribute) (dissect.ole.ole.DirectoryEntry attribute) (dissect.target.plugins.os.windows.jumplist.AutomaticDestinationFile attribute) ole32 (in module acquire.acquire.gui.win32) ole_def (in module dissect.ole.c_ole) om_object_class (dissect.database.ese.ntds.schema.AttributeEntry attribute) om_syntax (dissect.database.ese.ntds.schema.AttributeEntry attribute) omap (dissect.apfs.cursor.Cursor attribute) (dissect.apfs.objects.fs.FS property) (dissect.apfs.objects.nx_superblock.NxSuperblock property) on_descriptor (flow.record.jsonpacker.JsonRecordPacker attribute) (flow.record.packer.RecordPacker attribute) on_new_descriptor() (flow.record.stream.RecordStreamWriter method) OnDemand (dissect.target.plugins.apps.productivity.msoffice.LoadBehavior attribute) ONLY_READ_CACHE (in module dissect.target.helpers.cache) OP_EOS (in module dissect.util.compression.lzvn) OP_LRG_D (in module dissect.util.compression.lzvn) OP_LRG_L (in module dissect.util.compression.lzvn) OP_LRG_M (in module dissect.util.compression.lzvn) OP_MED_D (in module dissect.util.compression.lzvn) OP_NOP (in module dissect.util.compression.lzvn) OP_PRE_D (in module dissect.util.compression.lzvn) OP_SML_D (in module dissect.util.compression.lzvn) OP_SML_L (in module dissect.util.compression.lzvn) OP_SML_M (in module dissect.util.compression.lzvn) OP_UDEF (in module dissect.util.compression.lzvn) opaque (dissect.target.helpers.nfs.nfs3.CookieVerf attribute) (dissect.target.helpers.nfs.nfs3.FileHandle attribute) OpaqueVarLengthSerializer (class in dissect.target.helpers.sunrpc.serializer) OPCO (class in dissect.eventlog.wevt_object) opcode (dissect.etl.headers.event.EventDescriptor attribute) (dissect.etl.headers.event.EventHeader property) (dissect.etl.headers.headers.MessageTraceHeader attribute) (dissect.etl.headers.system.SystemSpecificHeader property) open (in module dissect.hypervisor.util.vmtar) open() (dissect.apfs.objects.fs.INode method) (dissect.apfs.objects.fs.Snapshot method) (dissect.apfs.objects.fs.XAttr method) (dissect.archive.vbk.DirItem method) (dissect.archive.vbk.IntFibItem method) (dissect.archive.vma.Device method) (dissect.archive.wim.DirectoryEntry method) (dissect.archive.wim.Resource method) (dissect.archive.xva.XVA method) (dissect.btrfs.btrfs.INode method) (dissect.cim.classes.DataRegion method) (dissect.clfs.c_clfs.BlockHeader method) (dissect.cramfs.cramfs.INode method) (dissect.database.sqlite3.sqlite3.Page method) (dissect.etl.etl.Buffer method) (dissect.evidence.ad1.ad1.AD1 method) (dissect.evidence.ad1.ad1.FileEntry method) (dissect.evidence.asdf.asdf.AsdfSnapshot method) (dissect.evidence.asdf.asdf.Metadata method) (dissect.evidence.ewf.ewf.EWF method) (dissect.executable.pe.directory.com_descriptor.ComStream method) (dissect.executable.pe.directory.debug.DebugEntry method) (dissect.executable.pe.directory.resource.Resource method) (dissect.executable.pe.directory.resource.ResourceDataEntry method) (dissect.executable.pe.pe.PE method) (dissect.executable.pe.pe.Section method) (dissect.extfs.extfs.INode method) (dissect.extfs.journal.DescriptorBlockTag method) (dissect.fat.fat.DirectoryEntry method) (dissect.fat.fat.RootDirectory method) (dissect.ffs.ffs.INode method) (dissect.fve.bde.bde.BDE method) (dissect.fve.luks.luks.LUKS method) (dissect.hypervisor.descriptor.hyperv.HyperVStorageFileObject method) (dissect.hypervisor.disk.asif.ASIF method) (dissect.hypervisor.disk.hdd.HDD method) (dissect.hypervisor.disk.qcow2.QCow2 method) (dissect.hypervisor.disk.qcow2.QCow2Snapshot method) (dissect.hypervisor.disk.vdi.VDI method) (dissect.jffs.jffs2.INode method) (dissect.ntfs.attr.Attribute method) (dissect.ntfs.attr.AttributeHeader method) (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.util.AttributeCollection method) (dissect.ole.ole.Chain method) (dissect.ole.ole.DirectoryEntry method) (dissect.ole.ole.MiniChain method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.regf.regf.RegistryHive method) (dissect.squashfs.squashfs.INode method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.MappedCompressedFile method) (dissect.target.filesystem.MappedFile method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.apfs.ApfsFilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry method) (dissect.target.filesystems.cb.CbFilesystemEntry method) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.exfat.ExfatFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.fat.FatFilesystemEntry method) (dissect.target.filesystems.ffs.FfsFilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemEntry method) (dissect.target.filesystems.jffs.JffsFilesystemEntry method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.ntds.NtdsFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry method) (dissect.target.filesystems.smb.SmbFilesystemEntry method) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystemEntry method) (dissect.target.filesystems.vbk.VbkFilesystemEntry method) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystemEntry method) (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) (dissect.target.helpers.mount.DissectMount method) (dissect.target.loaders.ab.AndroidBackup method) (dissect.target.loaders.itunes.ITunesBackup method) (dissect.target.loaders.res.File method) (dissect.target.loaders.res.ResFile method) (dissect.target.loaders.res.UPR method) (dissect.target.plugins.os.unix.linux.debian.proxmox._os.ProxmoxConfigFileEntry method) (dissect.target.target.Target class method) (dissect.vmfs.descriptor.FileDescriptor method) (dissect.vmfs.lvm.Volume method) (dissect.vmfs.resource.ResourceManager method) (dissect.volume.disk.partition.Partition method) (dissect.volume.dm.thin.ThinPool method) (dissect.volume.lvm.metadata.LogicalVolume method) (dissect.volume.lvm.metadata.MirrorSegment method) (dissect.volume.lvm.metadata.Segment method) (dissect.volume.lvm.metadata.StripedSegment method) (dissect.volume.lvm.metadata.ThinPoolSegment method) (dissect.volume.lvm.metadata.ThinSegment method) (dissect.volume.lvm.physical.LVM2Device method) (dissect.volume.raid.raid.PhysicalDisk method) (dissect.volume.raid.raid.VirtualDisk method) (dissect.volume.vss.Store method) (dissect.xfs.xfs.INode method) (in module dissect.target.container) (in module dissect.target.filesystem) (in module dissect.target.loader) (in module dissect.target.volume) (in module dissect.util.cpio) open_all() (dissect.target.target.Target class method) (dissect.target.volume.LogicalVolumeSystem class method) (dissect.target.volumes.ddf.DdfVolumeSystem class method) (dissect.target.volumes.lvm.LvmVolumeSystem class method) (dissect.target.volumes.md.MdVolumeSystem class method) (dissect.target.volumes.vmfs.VmfsVolumeSystem class method) open_child() (dissect.target.target.Target method) open_children() (dissect.target.target.Target method) open_decompress() (in module dissect.target.helpers.fsutil) open_direct() (dissect.target.target.Target class method) open_directory_object() (in module acquire.acquire.dynamic.windows.ntdll) open_encrypted() (in module dissect.target.volume) open_fve() (in module dissect.fve.tools.dd) open_handles_file (dissect.target.plugins.apps.edr.acquire.AcquirePlugin attribute) open_kape_file() (in module dissect.target.loaders.kape) open_lvm() (in module dissect.target.volume) OPEN_METH (dissect.hypervisor.util.vmtar.VisorTarFile attribute) open_multi_volume() (in module dissect.target.filesystem) open_parent() (in module dissect.hypervisor.disk.vhdx) (in module dissect.hypervisor.disk.vmdk) open_path() (in module dissect.target.tools.dump) (in module flow.record.base) open_path_or_stream() (in module flow.record.base) open_pool (dissect.volume.lvm.metadata.ThinPoolSegment attribute) open_process() (in module acquire.acquire.dynamic.windows.handles) open_raw() (dissect.target.target.Target class method) open_reader() (dissect.target.helpers.cache.Cache method) open_shell() (in module dissect.target.tools.shell) open_stream() (in module flow.record.base) open_subvolume (dissect.btrfs.btrfs.Btrfs attribute) open_subvolume() (dissect.target.filesystems.btrfs.BtrfsFilesystem method) open_target() (in module dissect.target.tools.utils.cli) open_targets() (in module dissect.target.tools.utils.cli) OPEN_TYPES (in module dissect.target.volumes.lvm) open_writer() (dissect.target.helpers.cache.Cache method) OPEN_WRITERS_LIMIT (in module dissect.target.tools.dump) OpenBsdPlugin (class in dissect.target.plugins.os.unix.bsd.openbsd._os) opendir() (dissect.target.helpers.mount.DissectMount method) opened (acquire.acquire.log.DelayedFileHandler attribute) OpenHandles (class in acquire.acquire.acquire) OpenProcess (in module acquire.acquire.dynamic.windows.handles) OpenProcessError OpenProcessToken (in module acquire.acquire.dynamic.windows.handles) opensave() (dissect.target.plugins.os.windows.regf.mru.MRUPlugin method) OpenSaveMRURecord (in module dissect.target.plugins.os.windows.regf.mru) OpenSSHPlugin (class in dissect.target.plugins.apps.ssh.openssh) OpenSSHUserRecordDescriptor (in module dissect.target.plugins.apps.ssh.ssh) openTable() (dissect.database.ese.tools.impacket.ESENT_DB method) OpenVPNClient (in module dissect.target.plugins.apps.vpn.openvpn) OpenVPNParser (class in dissect.target.plugins.apps.vpn.openvpn) OpenVPNPlugin (class in dissect.target.plugins.apps.vpn.openvpn) OpenVPNServer (in module dissect.target.plugins.apps.vpn.openvpn) OperatingSystem (class in dissect.target.plugin) OperationTypes (class in dissect.target.plugins.os.unix.packagemanager) operator (dissect.util.ldap.SearchFilter attribute) operator() (dissect.cstruct.expression.ExpressionTokenizer method) OPTICAL_CHANNEL (dissect.target.plugins.os.windows.network.IfTypes attribute) OPTICAL_TRANSPORT (dissect.target.plugins.os.windows.network.IfTypes attribute) optimize_ldap_query() (in module dissect.util.ldap) optional_header (dissect.executable.pe.pe.PE attribute) options (dissect.target.loaders.log.LogLoader attribute) (dissect.target.plugins.os.unix.linux.network_managers.Parser attribute) (dissect.target.plugins.os.unix.linux.network_managers.Template attribute) OR (dissect.util.ldap.LogicalOperator attribute) ordinal (dissect.executable.pe.directory.export.ExportFunction property) org (dissect.volume.vinum.config.Plex attribute) org_to_layout (in module dissect.volume.vinum.vinum) org_to_level (in module dissect.volume.vinum.vinum) OrganizationalPerson (class in dissect.database.ese.ntds.objects.organizationalperson) OrganizationalUnit (class in dissect.database.ese.ntds.objects.organizationalunit) origin (dissect.volume.lvm.metadata.CacheSegment attribute) (dissect.volume.lvm.metadata.HistoricalLogicalVolume attribute) (dissect.volume.lvm.metadata.IntegritySegment attribute) (dissect.volume.lvm.metadata.SnapshotSegment attribute) (dissect.volume.lvm.metadata.ThinSegment attribute) (dissect.volume.lvm.metadata.WriteCacheSegment attribute) original_offset (dissect.volume.vss.BlockDescriptor attribute) original_size (dissect.archive.wim.CompressedStream attribute) (dissect.archive.wim.Resource attribute) orphaned() (dissect.target.plugins.os.unix.esxi.vm.VirtualMachinePlugin method) OS (class in dissect.target.filesystems.cb) os (dissect.target.loaders.cellebrite.DeviceInfo attribute) os() (dissect.target.loaders.profile.ProfileOSPlugin method) (dissect.target.loaders.res.ResOSPlugin method) (dissect.target.plugin.OSPlugin method) (dissect.target.plugins.os.default._os.DefaultOSPlugin method) (dissect.target.plugins.os.unix._os.UnixPlugin method) (dissect.target.plugins.os.unix.bsd._os.BsdPlugin method) (dissect.target.plugins.os.unix.bsd.citrix._os.CitrixPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin method) (dissect.target.plugins.os.unix.esxi._os.ESXiPlugin method) (dissect.target.plugins.os.unix.linux._os.LinuxPlugin method) (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin method) (dissect.target.plugins.os.unix.linux.debian.proxmox._os.ProxmoxPlugin method) (dissect.target.plugins.os.unix.linux.debian.vyos._os.VyosPlugin method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSPlugin method) (dissect.target.plugins.os.windows._os.WindowsPlugin method) os2_header (dissect.executable.pe.pe.PE attribute) os_crypt_key (dissect.target.plugins.apps.browser.chromium.ChromiumKeys attribute) os_match() (in module dissect.target.plugin) OS_MODULE_PATH (in module dissect.target.plugin) os_plugins() (in module dissect.target.plugin) os_tree() (dissect.target.plugin.OSPlugin method) os_type_from_path() (in module dissect.target.loaders.dir) osinfo() (dissect.target.plugins.general.osinfo.OSInfoPlugin method) OSInfoPlugin (class in dissect.target.plugins.general.osinfo) OSInfoRecord (in module dissect.target.plugins.general.osinfo) OSPFIGP (dissect.target.helpers.network.IANAProtocol attribute) OSPlugin (class in dissect.target.plugin) OSX (dissect.target.plugin.OperatingSystem attribute) Other (dissect.target.plugins.os.unix.packagemanager.OperationTypes attribute) OTHER (dissect.target.plugins.os.windows.network.IfTypes attribute) other_well_known_objects (dissect.database.ese.ntds.objects.object.Object property) otime (dissect.btrfs.btrfs.INode property) otime_ns (dissect.btrfs.btrfs.INode property) OUTBOUND (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) outcome (acquire.acquire.collector.Record attribute) Outcome (class in acquire.acquire.collector) output (acquire.acquire.collector.Collector attribute) Output (class in acquire.acquire.outputs.base) output (dissect.target.plugin.FunctionDescriptor attribute) output_dir (dissect.target.tools.dump.DumpState attribute) OUTPUTS (in module dissect.target.plugin) outType (dissect.eventlog.wevt_object.TEMP_DESCRIPTOR attribute) ova (dissect.archive.xva.XVA property) (dissect.target.loaders.ova.OvaLoader attribute) OvaLoader (class in dissect.target.loaders.ova) overflow_data() (in module dissect.database.bsd.db) overlay (dissect.volume.vss.BlockDescriptor attribute) Overlay2Filesystem (class in dissect.target.filesystems.overlay) Overlay2Loader (class in dissect.target.loaders.overlay2) OverlayFilesystem (class in dissect.target.filesystems.overlay) OverlayLoader (class in dissect.target.loaders.overlay) overlays (dissect.util.stream.OverlayStream attribute) OverlayStream (class in dissect.util.stream) OVF (class in dissect.hypervisor.descriptor.ovf) OvfLoader (class in dissect.target.loaders.ovf) owner (dissect.database.ese.ntds.sd.SecurityDescriptor attribute) (dissect.ntfs.secure.SecurityDescriptor attribute) (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) owner() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) owner_id (dissect.ntfs.attr.StandardInformation property) P P (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) p16() (in module dissect.cstruct.utils) p32() (in module dissect.cstruct.utils) p64() (in module dissect.cstruct.utils) p8() (in module dissect.cstruct.utils) pack() (dissect.target.tools.dump.SortedKeysJsonRecordPacker method) (flow.record.jsonpacker.JsonRecordPacker method) (flow.record.packer.RecordPacker method) (in module dissect.cstruct.utils) pack_descriptors (flow.record.jsonpacker.JsonRecordPacker attribute) pack_obj() (flow.record.jsonpacker.JsonRecordPacker method) (flow.record.packer.RecordPacker method) Package (class in dissect.database.bsd.tools.rpm) PACKAGE_NAME_NEEDLE (in module dissect.target.plugins.os.windows.catroot) PackageEntry (class in dissect.database.bsd.tools.rpm) PackageManagerLogRecord (in module dissect.target.plugins.os.unix.packagemanager) PackageManagerPlugin (class in dissect.target.plugins.os.unix.packagemanager) Packages (class in dissect.database.bsd.tools.rpm) packb (in module flow.record.packer) packchar (dissect.cstruct.types.packed.Packed attribute) Packed (class in dissect.cstruct.types.packed) packed_size (dissect.target.loaders.res.File attribute) packer (dissect.target.tools.dump.JsonLinesWriter attribute) (flow.record.adapter.jsonfile.JsonfileReader attribute) (flow.record.adapter.jsonfile.JsonfileWriter attribute) (flow.record.adapter.splunk.SplunkWriter attribute) (flow.record.stream.RecordStreamReader attribute) (flow.record.stream.RecordStreamWriter attribute) packer_on_new_descriptor() (flow.record.adapter.jsonfile.JsonfileWriter method) packet() (dissect.target.plugins.os.unix.linux.proc.Sockets method) (dissect.target.plugins.os.unix.linux.sockets.NetSocketPlugin method) PacketSocket (class in dissect.target.plugins.os.unix.linux.proc) PacketSocketRecord (in module dissect.target.plugins.os.unix.linux.sockets) PaddingTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) Page (class in dissect.database.bsd.db) (class in dissect.database.ese.page) (class in dissect.database.sqlite3.sqlite3) page (dissect.archive.vbk.Bank attribute) (dissect.archive.vbk.FibMetaSparseTable attribute) (dissect.archive.vbk.FibStream attribute) (dissect.archive.vbk.MetaTableDescriptor property) (dissect.archive.vbk.MetaVector attribute) (dissect.archive.vbk.PropertiesDictionary attribute) (dissect.cim.index.IndexPage attribute) (dissect.database.bsd.db.DB attribute) (dissect.database.ese.ese.ESE attribute) (dissect.database.ese.page.Tag attribute) (dissect.database.sqlite3.sqlite3.Cell attribute) (dissect.database.sqlite3.sqlite3.Index attribute) (dissect.database.sqlite3.sqlite3.SQLite3 attribute) (dissect.database.sqlite3.sqlite3.Table attribute) page() (dissect.archive.vbk.SnapshotSlot method) (dissect.archive.vbk.VBK method) (dissect.cim.index.Store method) (dissect.cim.objects.Store method) page_count (dissect.database.sqlite3.sqlite3.SQLite3 attribute) (dissect.database.sqlite3.wal.Frame property) PAGE_FLAG (in module dissect.database.ese.c_ese) page_num (dissect.cim.index.IndexPage attribute) page_number (dissect.cim.objects.DataPage attribute) (dissect.database.sqlite3.wal.Frame property) page_size (dissect.database.bsd.db.DB attribute) (dissect.database.ese.ese.ESE attribute) (dissect.database.sqlite3.sqlite3.SQLite3 attribute) PAGE_SIZE (in module dissect.archive.c_vbk) PAGE_TYPES (in module dissect.database.sqlite3.sqlite3) PageFaultGuid (in module dissect.etl.utils) pages() (dissect.archive.vbk.MetaBlob method) (dissect.database.ese.ese.ESE method) (dissect.database.sqlite3.sqlite3.SQLite3 method) PAINTSTRUCT (class in acquire.acquire.gui.win32) Pair (class in dissect.hypervisor.descriptor.vmx) Palette (in module dissect.cstruct.utils) PamUnixService (class in dissect.target.plugins.os.unix.log.auth) PanelPathRecord (in module dissect.target.plugins.apps.productivity.sevenzip) PARA (dissect.target.plugins.os.windows.network.IfTypes attribute) PARALLELS_SYSTEM_PATHS (in module dissect.target.plugins.child.parallels) PARALLELS_USER_PATHS (in module dissect.target.plugins.child.parallels) ParallelsChildTargetPlugin (class in dissect.target.plugins.child.parallels) params (dissect.target.helpers.sunrpc.sunrpc.CallBody attribute) (flow.record.fieldtypes.uri property) Params (in module dissect.target.helpers.sunrpc.client) parent (dissect.apfs.objects.fs.INode property) (dissect.btrfs.btrfs.INode attribute) (dissect.btrfs.btrfs.Subvolume attribute) (dissect.fat.fat.DirectoryEntry attribute) (dissect.ffs.ffs.INode attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.hypervisor.descriptor.vbox.HardDisk attribute) (dissect.hypervisor.descriptor.vbox.Machine property) (dissect.hypervisor.descriptor.vbox.Snapshot attribute) (dissect.hypervisor.disk.hdd.HDS attribute) (dissect.hypervisor.disk.hdd.Shot attribute) (dissect.hypervisor.disk.vdi.VDI attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) (dissect.hypervisor.disk.vmdk.SparseDisk attribute) (dissect.hypervisor.disk.vmdk.VMDK attribute) (dissect.jffs.jffs2.INode attribute) (dissect.ntfs.usnjrnl.UsnRecord property) (dissect.squashfs.squashfs.INode attribute) (dissect.target.helpers.compat.path_310.PureDissectPath property) (dissect.target.helpers.compat.path_311.PureDissectPath property) (dissect.target.loaders.res.Folder attribute) (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) (dissect.target.plugins.os.unix.locate.mlocate.MLocate attribute) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM attribute) (dissect.vmfs.descriptor.FileDescriptor property) (flow.record.fieldtypes.path property) (in module flow.record.whitelist) parent() (dissect.cim.cim.Namespace method) (dissect.database.ese.ntds.objects.object.Object method) parent_guid (dissect.etl.headers.headers.EventInstanceGUIDHeader property) parent_index (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj attribute) parent_inum (dissect.jffs.jffs2.DirEntry attribute) parent_locator (dissect.hypervisor.disk.vhdx.VHDX attribute) PARENT_LOCATOR_GUID (in module dissect.hypervisor.disk.c_vhdx) parent_name (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) ParentLocator (class in dissect.hypervisor.disk.vhdx) ParentNamingContextHeld (dissect.database.ese.ntds.util.InstanceType attribute) parents (dissect.apfs.objects.fs.INode property) (dissect.btrfs.btrfs.INode property) (dissect.target.helpers.compat.path_310.PureDissectPath property) (dissect.target.helpers.compat.path_311.PureDissectPath property) PARITY_0 (dissect.volume.raid.stream.Layout attribute) PARITY_0_6 (dissect.volume.raid.stream.Layout attribute) PARITY_N (dissect.volume.raid.stream.Layout attribute) PARITY_N_6 (dissect.volume.raid.stream.Layout attribute) parse (dissect.database.ese.util.ColumnType attribute) parse() (dissect.cstruct.parser.CStyleParser method) (dissect.cstruct.parser.Parser method) (dissect.cstruct.parser.TokenParser method) (dissect.hypervisor.descriptor.vmx.VMX class method) (dissect.hypervisor.disk.vmdk.DiskDescriptor class method) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager method) (dissect.target.plugins.os.unix.linux.network_managers.Parser method) (dissect.target.plugins.os.unix.log.auth.BaseService class method) (dissect.target.plugins.os.unix.log.auth.PamUnixService class method) (dissect.target.plugins.os.unix.log.auth.PkexecService class method) (dissect.target.plugins.os.unix.log.auth.SshdService class method) (dissect.target.plugins.os.unix.log.auth.SudoService class method) (dissect.target.plugins.os.unix.log.auth.SuService class method) (dissect.target.plugins.os.unix.log.auth.SystemdLogindService class method) (dissect.target.plugins.os.windows.prefetch.Prefetch method) (dissect.util.ldap.SearchFilter class method) (dissect.vmfs.address.Address static method) (dissect.vmfs.address.FileBlockAddr static method) (dissect.vmfs.address.FileDescriptorAddr static method) (dissect.vmfs.address.JournalBlockAddr static method) (dissect.vmfs.address.LargeFileBlockAddr static method) (dissect.vmfs.address.PointerBlockAddr static method) (dissect.vmfs.address.PointerBlockAddr64 static method) (dissect.vmfs.address.SmallFileBlockAddr static method) (dissect.vmfs.address.SubBlockAddr static method) (dissect.vmfs.address.SubBlockAddr64 static method) (in module dissect.shellitem.tools.lnk) (in module dissect.target.helpers.configutil) parse_acquire_args() (in module acquire.acquire.utils) parse_address() (dissect.vmfs.resource.FileBlockResourceVMFS5 method) (dissect.vmfs.resource.FileDescriptorResourceVMFS5 method) (dissect.vmfs.resource.FileDescriptorResourceVMFS6 method) (dissect.vmfs.resource.JournalBlockResourceVMFS6 method) (dissect.vmfs.resource.LargeFileBlockResourceVMFS6 method) (dissect.vmfs.resource.PointerBlock2ResourceVMFS5 method) (dissect.vmfs.resource.PointerBlock2ResourceVMFS6 method) (dissect.vmfs.resource.PointerBlockResourceVMFS5 method) (dissect.vmfs.resource.PointerBlockResourceVMFS6 method) (dissect.vmfs.resource.ResourceFile method) (dissect.vmfs.resource.SmallFileBlockResourceVMFS6 method) (dissect.vmfs.resource.SubBlockResourceVMFS5 method) (dissect.vmfs.resource.SubBlockResourceVMFS6 method) parse_arguments() (in module dissect.target.tools.dump) parse_attr() (in module dissect.target.plugins.filesystem.unix.capability) parse_autodetect_format_log() (in module dissect.target.plugins.apps.webserver.iis) parse_boot_cfg() (in module dissect.target.plugins.os.unix.esxi._os) parse_bxml() (in module dissect.eventlog.bxml) parse_cell_data() (dissect.regf.regf.RegistryHive method) parse_chunk() (in module dissect.eventlog.evt) parse_cipher_spec() (in module dissect.fve.crypto) parse_color_data() (in module dissect.target.plugins.os.windows.rdpcache) parse_config() (dissect.target.plugins.apps.webserver.nginx.NginxPlugin method) (in module dissect.target.helpers.configutil) parse_config_store() (in module dissect.target.plugins.os.unix.esxi.configstore) parse_datetime_iso() (in module dissect.target.tools.dump) parse_debian_centos_dhclient_lease() (in module dissect.target.plugins.os.unix.linux.network) parse_def() (in module flow.record.base) parse_device_name() (in module dissect.target.plugins.os.windows.regf.usb) parse_dynamic_dst() (in module dissect.target.plugins.os.windows.datetime) parse_entry() (in module dissect.target.plugins.filesystem.unix.capability) parse_esedb() (dissect.target.plugins.os.windows.search.SearchIndexPlugin method) parse_esx_conf() (in module dissect.target.plugins.os.unix.esxi.esxconf) parse_file() (dissect.target.helpers.configutil.Bin method) (dissect.target.helpers.configutil.ConfigurationParser method) (dissect.target.helpers.configutil.CSVish method) (dissect.target.helpers.configutil.Default method) (dissect.target.helpers.configutil.Env method) (dissect.target.helpers.configutil.Indentation method) (dissect.target.helpers.configutil.Ini method) (dissect.target.helpers.configutil.Json method) (dissect.target.helpers.configutil.Leases method) (dissect.target.helpers.configutil.SystemD method) (dissect.target.helpers.configutil.Toml method) (dissect.target.helpers.configutil.Txt method) (dissect.target.helpers.configutil.Xml method) (dissect.target.helpers.configutil.Yaml method) (dissect.target.plugins.apps.vpn.openvpn.OpenVPNParser method) (dissect.target.plugins.os.windows.amcache.AmcachePluginOldMixin method) parse_files() (in module dissect.target.plugins.os.windows.everything.parser) parse_fish_history() (dissect.target.plugins.os.unix.history.CommandHistoryPlugin method) parse_flex_value() (in module dissect.target.helpers.regutil) parse_folder() (in module dissect.target.plugins.os.windows.everything.parser) parse_folders() (in module dissect.target.plugins.os.windows.everything.parser) parse_freedesktop_xml() (in module dissect.target.tools.build_magic) parse_fs_object_key() (in module dissect.apfs.util) parse_fsblock() (in module dissect.xfs.xfs) parse_fstab() (in module dissect.target.plugins.os.unix._os) parse_generic_history() (dissect.target.plugins.os.unix.history.CommandHistoryPlugin method) parse_host_user() (in module dissect.target.plugins.apps.ssh.putty) parse_iis_datetime() (in module dissect.target.plugins.apps.webserver.iis) parse_iis_format_log() (in module dissect.target.plugins.apps.webserver.iis) parse_inventory_application() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) parse_inventory_application_file() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) parse_inventory_application_shortcut() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) parse_inventory_device_container() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) parse_inventory_driver_binary() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) parse_inventory_file() (in module dissect.target.plugins.apps.virtualization.vmware_workstation) parse_ip() (in module dissect.target.plugins.os.unix.linux.proc) parse_json_line() (in module dissect.target.plugins.apps.webserver.nginx) parse_key() (dissect.target.plugins.apps.productivity.sevenzip.SevenZipPlugin method) parse_key_bag() (in module dissect.target.loaders.itunes) parse_key_type() (in module dissect.target.helpers.keychain) parse_known_host() (in module dissect.target.plugins.apps.ssh.openssh) parse_lnk_file() (in module dissect.target.plugins.os.windows.lnk) parse_log_date_time() (in module dissect.target.plugins.os.unix.linux.debian.dpkg) parse_log_line() (in module dissect.target.plugins.os.unix.linux.debian.dpkg) parse_metadata() (in module dissect.volume.lvm.physical) parse_metrics() (dissect.target.plugins.os.windows.prefetch.Prefetch method) parse_mru_ex_key() (in module dissect.target.plugins.os.windows.regf.mru) parse_mru_key() (in module dissect.target.plugins.os.windows.regf.mru) parse_netscaler_bash_history() (dissect.target.plugins.os.unix.bsd.citrix.history.CitrixCommandHistoryPlugin method) parse_netscaler_cli_history() (dissect.target.plugins.os.unix.bsd.citrix.history.CitrixCommandHistoryPlugin method) parse_network_manager_centos_dhcp_lease() (in module dissect.target.plugins.os.unix.linux.network) parse_network_manager_dhcp_lease_new() (in module dissect.target.plugins.os.unix.linux.network) parse_network_manager_dhcp_lease_old() (in module dissect.target.plugins.os.unix.linux.network) parse_networkd_dhcp_lease() (in module dissect.target.plugins.os.unix.linux.network) parse_nsarray() (in module dissect.util.plist) parse_nsdata() (in module dissect.util.plist) parse_nsdate() (in module dissect.util.plist) parse_nsset() (in module dissect.util.plist) parse_nsurl() (in module dissect.util.plist) parse_nsuuid() (in module dissect.util.plist) parse_object_path() (in module dissect.cim.utils) parse_office_mru() (in module dissect.target.plugins.os.windows.regf.mru) parse_office_mru_key() (in module dissect.target.plugins.os.windows.regf.mru) parse_options_string() (in module dissect.target.helpers.utils) parse_path() (in module flow.record.adapter.mongo) parse_path_uri() (in module dissect.target.helpers.loaderutil) parse_payload() (in module dissect.etl.etl) parse_prefix_map() (in module dissect.database.ese.ntds.schema) parse_programs() (dissect.target.plugins.os.windows.amcache.AmcachePluginOldMixin method) parse_recently_used_xbel() (in module dissect.target.plugins.os.unix.linux.recentlyused) parse_record() (in module dissect.eventlog.evt) parse_shell_item_list() (in module dissect.target.plugins.os.windows.regf.shellbags) parse_sqlite() (dissect.target.plugins.os.windows.search.SearchIndexPlugin method) parse_ssh_key() (in module dissect.target.plugins.apps.ssh.openssh) parse_ssh_public_key_file() (in module dissect.target.plugins.apps.ssh.openssh) parse_start() (in module dissect.target.plugins.apps.remoteaccess.teamviewer) parse_start_element() (dissect.eventlog.bxml.Bxml method) parse_status_block() (in module dissect.target.plugins.os.unix.linux.debian.dpkg) parse_systemtime_transition() (in module dissect.target.plugins.os.windows.datetime) parse_table_columns_constraints() (in module dissect.database.sqlite3.util) parse_ts() (in module dissect.target.plugins.os.unix.linux.recentlyused) (in module dissect.target.plugins.os.windows.regf.nethist) (in module dissect.target.plugins.os.windows.startupinfo) parse_tzi() (in module dissect.target.plugins.os.windows.datetime) parse_ubuntu_cloud_init_dhcp_lease() (in module dissect.target.plugins.os.unix.linux.network) parse_unix_dhcp_leases() (in module dissect.target.plugins.os.unix.linux.network_managers) parse_unix_dhcp_log_messages() (in module dissect.target.plugins.os.unix.linux.network_managers) parse_v1() (dissect.util.compression.lzfse.LZFSECompressedBlockHeader class method) parse_v2() (dissect.util.compression.lzfse.LZFSECompressedBlockHeader class method) parse_value() (in module dissect.regf.regf) parse_version() (in module dissect.target.plugins.os.unix.linux.fortios._os) parse_vinum_config() (in module dissect.volume.vinum.config) parse_w3c_format_log() (in module dissect.target.plugins.apps.webserver.iis) parse_win_datetime() (in module dissect.target.plugins.os.windows.amcache) parse_win_timestamp() (in module dissect.target.plugins.os.windows.amcache) parse_x509() (in module dissect.target.helpers.certificate) parse_zsh_history() (dissect.target.plugins.os.unix.history.CommandHistoryPlugin method) parsed_data (dissect.target.helpers.configutil.ConfigurationParser attribute) (dissect.target.helpers.configutil.Env attribute) (dissect.target.helpers.configutil.Ini attribute) parsed_path (dissect.target.loader.Loader attribute) parsed_query (dissect.target.loader.Loader attribute) parsed_schema (flow.record.adapter.avro.AvroWriter attribute) ParseError Parser (class in dissect.cstruct.parser) (class in dissect.target.plugins.os.unix.linux.network_managers) parser (dissect.target.helpers.compat.path_313.PureDissectPath attribute) (dissect.target.helpers.configutil.ParserConfig attribute) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager attribute) (dissect.target.plugins.os.unix.linux.network_managers.Template attribute) ParserConfig (class in dissect.target.helpers.configutil) ParserError ParserOptions (class in dissect.target.helpers.configutil) part_number (dissect.archive.wim.Resource attribute) PARTITION (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) Partition (class in dissect.volume.disk.partition) partition() (dissect.database.ese.ntds.objects.object.Object method) PARTITION_TYPES (in module dissect.volume.disk.partition) partition_uuid (dissect.hypervisor.disk.vmdk.ExtentDescriptor attribute) partitions (dissect.volume.disk.disk.Disk attribute) (dissect.volume.disk.schemes.apm.APM attribute) (dissect.volume.disk.schemes.bsd.BSD attribute) (dissect.volume.disk.schemes.gpt.GPT attribute) (dissect.volume.disk.schemes.mbr.MBR attribute) parts() (dissect.cim.index.Key method) pass2key (dissect.hypervisor.descriptor.vmx.Phrase attribute) PASS2KEY_MAP (in module dissect.hypervisor.descriptor.vmx) pass_shown (acquire.acquire.gui.win32.Win32 attribute) passphrase (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher attribute) PASSPHRASE (dissect.target.helpers.keychain.KeyType attribute) PASSWD_CANT_CHANGE (dissect.database.ese.ntds.util.UserAccountControl attribute) PASSWD_FILES (dissect.target.plugins.os.unix._os.UnixPlugin attribute) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin attribute) PASSWD_NOTREQD (dissect.database.ese.ntds.util.UserAccountControl attribute) password (class in flow.record.fieldtypes.credential) (dissect.target.loaders.mqtt.Broker attribute) (flow.record.fieldtypes.uri property) PASSWORD_EXPIRED (dissect.database.ese.ntds.util.UserAccountControl attribute) password_hint (dissect.apfs.objects.fs.FS property) password_hint() (dissect.apfs.objects.keybag.VolumeKeybag method) passwords() (dissect.target.plugins.apps.browser.brave.BravePlugin method) (dissect.target.plugins.apps.browser.chrome.ChromePlugin method) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin method) (dissect.target.plugins.apps.browser.chromium.ChromiumPlugin method) (dissect.target.plugins.apps.browser.edge.EdgePlugin method) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin method) (dissect.target.plugins.os.unix.shadow.ShadowPlugin method) patch() (dissect.executable.elf.elf.Segment method) patched (dissect.executable.elf.elf.Segment attribute) PatchItem (class in dissect.archive.vbk) PATH (acquire.acquire.collector.ArtifactType attribute) path (acquire.acquire.outputs.dir.DirectoryOutput attribute) (acquire.acquire.outputs.tar.TarOutput attribute) (acquire.acquire.outputs.zip.ZipOutput attribute) (class in flow.record.fieldtypes) (dissect.apfs.objects.fs.INode property) (dissect.btrfs.btrfs.INode property) (dissect.btrfs.btrfs.Subvolume property) (dissect.database.bsd.tools.rpm.PackageEntry attribute) (dissect.database.sqlite3.sqlite3.SQLite3 attribute) (dissect.database.sqlite3.wal.WAL attribute) (dissect.eventlog.evtx.ElfChnk attribute) (dissect.eventlog.evtx.Evtx attribute) (dissect.eventlog.wevtutil.WevtutilWrapper attribute) (dissect.fat.fat.DirectoryEntry property) (dissect.fat.fat.RootDirectory property) (dissect.hypervisor.disk.hdd.Descriptor attribute) (dissect.hypervisor.disk.hdd.HDD attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) (dissect.regf.regf.KeyNode property) (dissect.target.filesystem.DirEntry attribute) (dissect.target.filesystem.FilesystemEntry attribute) (dissect.target.filesystems.smb.SmbStream attribute) (dissect.target.helpers.cache.CacheWriter attribute) (dissect.target.helpers.cache.LineReader attribute) (dissect.target.helpers.regutil.KeyCollection property) (dissect.target.helpers.regutil.RegfKey property) (dissect.target.helpers.regutil.RegistryKey property) (dissect.target.helpers.regutil.VirtualKey property) (dissect.target.loader.Loader attribute) (dissect.target.loaders.cb.CbRegistryKey property) (dissect.target.loaders.cellebrite.Dump attribute) (dissect.target.loaders.cellebrite.Extraction attribute) (dissect.target.loaders.cellebrite.Keychain attribute) (dissect.target.loaders.cellebrite.Ufd attribute) (dissect.target.loaders.cellebrite.Ufdx attribute) (dissect.target.loaders.res.File property) (dissect.target.loaders.res.Folder property) (dissect.target.loaders.smb.SmbRegistryKey property) (dissect.target.plugin.FunctionDescriptor attribute) (dissect.target.plugin.PluginDescriptor attribute) PATH (dissect.target.plugins.child.hyperv.HyperVChildTargetPlugin attribute) (dissect.target.plugins.child.virtuozzo.VirtuozzoChildTargetPlugin attribute) (dissect.target.plugins.os.unix.bsd.darwin.ios.applications.IOSApplicationsPlugin attribute) path (dissect.target.plugins.os.unix.linux.modules.Module attribute) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) (dissect.target.plugins.os.unix.locate.gnulocate.GNULocatePlugin attribute) (dissect.target.plugins.os.unix.locate.mlocate.MLocate attribute) (dissect.target.plugins.os.unix.locate.mlocate.MLocatePlugin attribute) (dissect.target.plugins.os.unix.locate.plocate.PLocatePlugin attribute) (dissect.target.plugins.os.windows.ad.ntds.NtdsPlugin attribute) (dissect.target.tools.diff.DifferentialEntry attribute) (dissect.target.tools.dump.DumpState property) (dissect.target.tools.dump.Sink attribute) (flow.record.adapter.archive.ArchiveWriter attribute) (flow.record.adapter.split.SplitWriter attribute) (flow.record.base.DynamicFieldtypeModule attribute) (flow.record.fieldtypes.uri property) path() (dissect.target.filesystem.Filesystem method) path_extensions() (dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin method) path_information (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) (dissect.volume.ddf.ddf.PhysicalDiskRecord attribute) path_query (dissect.target.target.Target attribute) PATH_REPLACEMENTS (in module dissect.target.loaders.res) path_scheme (dissect.target.target.Target attribute) path_template (flow.record.stream.PathTemplateWriter attribute) pathenvironment() (dissect.target.plugins.os.windows.generic.GenericPlugin method) pathext (dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin property) PathextRecord (in module dissect.target.plugins.os.windows.env) PathHistoryRecord (in module dissect.target.plugins.apps.productivity.sevenzip) paths (dissect.apfs.objects.fs.INode property) (dissect.target.loaders.direct.DirectLoader attribute) PATHS (dissect.target.plugins.apps.shell.powershell.PowerShellHistoryPlugin attribute) paths (dissect.target.plugins.child.colima.ColimaChildTargetPlugin attribute) (dissect.target.plugins.child.lima.LimaChildTargetPlugin attribute) PATHS (dissect.target.plugins.os.unix.linux.debian.snap.SnapPlugin attribute) (dissect.target.plugins.os.unix.trash.GnomeTrashPlugin attribute) paths (dissect.target.plugins.os.windows.adpolicy.ADPolicyPlugin attribute) PATHS (dissect.target.plugins.os.windows.log.etl.EtlPlugin attribute) (dissect.target.plugins.os.windows.log.schedlgu.SchedLgUPlugin attribute) paths (dissect.target.plugins.os.windows.log.schedlgu.SchedLgUPlugin attribute) paths() (dissect.btrfs.btrfs.INode method) (dissect.target.plugins.os.windows.rdpcache.RdpCachePlugin method) PathTemplateWriter (class in flow.record.stream) pattern (dissect.target.plugins.apps.webserver.apache.LogFormat attribute) PATTERN_IPTABLES_SAVE_GENERATED (in module dissect.target.plugins.os.unix.linux.iptables) PATTERN_IPTABLES_SAVE_POLICY (in module dissect.target.plugins.os.unix.linux.iptables) PATTERN_IPTABLES_SAVE_RULE (in module dissect.target.plugins.os.unix.linux.iptables) patterns (dissect.cstruct.parser.TokenCollection attribute) PATTERNS (in module dissect.target.helpers.magic.mimetypes) pause_writeback (dissect.volume.lvm.metadata.WriteCacheSegment attribute) paused (dissect.fve.bde.bde.BDE property) PAUSED (dissect.target.plugins.apps.container.podman.ContainerState attribute) payload (dissect.etl.headers.headers.Header property) (dissect.etl.headers.logfile.LogfileHeader property) (dissect.eventlog.wevt.WEVT_TYPE attribute) payload_offset (dissect.etl.headers.headers.MessageTraceHeader attribute) payload_size (dissect.eventlog.wevt.WEVT attribute) payload_types (dissect.eventlog.wevt.WEVT property) PB (dissect.vmfs.resource.ResourceManager property) pb() (dissect.hypervisor.disk.vhdx.BlockAllocationTable method) PB2 (dissect.vmfs.resource.ResourceManager property) pbeWithSha1AndTripleDES_CBC (in module dissect.target.plugins.apps.browser.firefox) pbkdf2() (in module dissect.target.plugins.os.windows.dpapi.crypto) PBKDF2_SALT (in module dissect.hypervisor.util.envelope) PBM_DELTAPOS (in module acquire.acquire.gui.win32) PBM_SETPOS (in module acquire.acquire.gui.win32) PBM_SETRANGE (in module acquire.acquire.gui.win32) PBM_SETRANGE32 (in module acquire.acquire.gui.win32) PBM_SETSTEP (in module acquire.acquire.gui.win32) PBM_STEPIT (in module acquire.acquire.gui.win32) PBS_SMOOTH (in module acquire.acquire.gui.win32) PCA (class in acquire.acquire.acquire) PCA_RESOLVE_CALLED (dissect.target.plugins.os.windows.amcache.PcaGeneralDbType attribute) PcaAppLaunchAppcompatRecord (in module dissect.target.plugins.os.windows.amcache) PcaGeneralAppcompatRecord (in module dissect.target.plugins.os.windows.amcache) PcaGeneralDbType (class in dissect.target.plugins.os.windows.amcache) pcr_bitmap (dissect.fve.bde.information.TpmEncryptedBlobDatum property) pdb (dissect.executable.pe.directory.debug.CodeViewDebugEntry property) pdb_path() (dissect.executable.pe.pe.PE method) pdnt (dissect.database.ese.ntds.objects.object.Object property) PE (class in dissect.executable.pe.pe) pe (dissect.executable.pe.directory.base.DataDirectory attribute) (dissect.executable.pe.directory.debug.DebugEntry attribute) (dissect.executable.pe.directory.delay_import.DelayImportModule attribute) (dissect.executable.pe.directory.imports.ImportModule attribute) (dissect.executable.pe.pe.Section attribute) (dissect.executable.pe.pe.VirtualStream attribute) pe_count (dissect.volume.lvm.metadata.PhysicalVolume attribute) pe_start (dissect.volume.lvm.metadata.PhysicalVolume attribute) PEBS_INDEX (dissect.etl.headers.event.ExtType attribute) peek() (dissect.target.helpers.configutil.PeekableIterator method) (dissect.util.stream.AlignedStream method) (dissect.util.stream.BitStream method) PeekableIterator (class in dissect.target.helpers.configutil) peers (dissect.target.loaders.mqtt.MqttLoader attribute) peers() (dissect.target.loaders.mqtt.Broker method) PEK (class in dissect.database.ese.ntds.pek) pek (dissect.database.ese.ntds.database.DataTable property) (dissect.database.ese.ntds.ntds.NTDS property) (dissect.database.ese.ntds.objects.domaindns.DomainDNS property) (dissect.database.ese.ntds.pek.PEK attribute) pek_def (in module dissect.database.ese.ntds.c_pek) PEM_ENCRYPTED (in module dissect.target.plugins.apps.ssh.ssh) PEM_MARKER_END_DSA (in module dissect.target.plugins.apps.ssh.ssh) PEM_MARKER_END_EC (in module dissect.target.plugins.apps.ssh.ssh) PEM_MARKER_END_RSA (in module dissect.target.plugins.apps.ssh.ssh) PEM_MARKER_START_DSA (in module dissect.target.plugins.apps.ssh.ssh) PEM_MARKER_START_EC (in module dissect.target.plugins.apps.ssh.ssh) PEM_MARKER_START_RSA (in module dissect.target.plugins.apps.ssh.ssh) pending_updates_count (dissect.target.tools.dump.DumpState attribute) PENDING_UPDATES_LIMIT (in module dissect.target.tools.dump) perf_freq (dissect.etl.headers.logfile.LogfileHeader property) PerfinfoGuid (in module dissect.etl.utils) PerfinfoTraceHeader (class in dissect.etl.headers.system) PERFORMANCE_FREQ (dissect.etl.headers.logfile.ReservedFlags attribute) PERFORMANCE_TIMESTAMP (dissect.etl.headers.headers.EventProperty attribute) persist() (dissect.target.tools.dump.DumpState method) persist_execution_report() (in module acquire.acquire.utils) (in module dissect.target.tools.utils.cli) persist_processing_state() (in module dissect.target.tools.dump) persisted_state() (in module dissect.target.tools.dump) Person (class in dissect.database.ese.ntds.objects.person) PF (in module dissect.executable.elf.c_elf) pfro() (dissect.target.plugins.os.windows.log.pfro.PfroPlugin method) PfroPlugin (class in dissect.target.plugins.os.windows.log.pfro) PfroRecord (in module dissect.target.plugins.os.windows.log.pfro) pfwlog_def (in module dissect.target.plugins.apps.av.trendmicro) PGM (dissect.target.helpers.network.IANAProtocol attribute) pgno (dissect.database.bsd.db.Page attribute) pgnoFDPMSO (in module dissect.database.ese.c_ese) pgnoFDPMSO_NameIndex (in module dissect.database.ese.c_ese) pgnoFDPMSO_RootObjectIndex (in module dissect.database.ese.c_ese) pgnoFDPMSOShadow (in module dissect.database.ese.c_ese) PhobosLoader (class in dissect.target.loaders.phobos) Phrase (class in dissect.hypervisor.descriptor.vmx) physical_address (dissect.executable.elf.elf.Segment attribute) physical_disk_data (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) physical_disk_records (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) physical_disk_sequence (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) physical_disks (dissect.volume.raid.raid.Configuration attribute) physical_page() (dissect.cim.objects.Store method) PHYSICAL_SECTOR_SIZE_GUID (in module dissect.hypervisor.disk.c_vhdx) physical_threads (dissect.volume.lvm.metadata.VdoPoolSegment attribute) physical_volumes (dissect.volume.lvm.metadata.VolumeGroup attribute) PhysicalDisk (class in dissect.volume.raid.raid) PhysicalDiskData (class in dissect.volume.ddf.ddf) PhysicalDiskRecord (class in dissect.volume.ddf.ddf) PhysicalLocation (class in dissect.database.ese.ntds.objects.physicallocation) PhysicalVolume (class in dissect.volume.lvm.metadata) pid (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) pid_def (in module dissect.target.plugins.os.windows.productkey) PIM (dissect.target.helpers.network.IANAProtocol attribute) PIPE (dissect.target.helpers.network.IANAProtocol attribute) PKCS8_MARKER_END (in module dissect.target.plugins.apps.ssh.ssh) PKCS8_MARKER_END_ENCRYPTED (in module dissect.target.plugins.apps.ssh.ssh) PKCS8_MARKER_START (in module dissect.target.plugins.apps.ssh.ssh) PKCS8_MARKER_START_ENCRYPTED (in module dissect.target.plugins.apps.ssh.ssh) PkexecService (class in dissect.target.plugins.os.unix.log.auth) PKICertificateTemplate (class in dissect.database.ese.ntds.objects.pkicertificatetemplate) PKIEnrollmentService (class in dissect.database.ese.ntds.objects.pkienrollmentservice) Plain (class in dissect.fve.crypto) (class in dissect.fve.crypto.base) Plain64 (class in dissect.fve.crypto) (class in dissect.fve.crypto.base) Plain64BE (class in dissect.fve.crypto) (class in dissect.fve.crypto.base) PLC (dissect.target.plugins.os.windows.network.IfTypes attribute) Plex (class in dissect.volume.vinum.config) plex (dissect.volume.vinum.config.SD attribute) (dissect.volume.vinum.vinum.VinumPlexDisk attribute) plexes (dissect.volume.vinum.config.VinumConfigs attribute) (dissect.volume.vinum.vinum.Config attribute) (dissect.volume.vinum.vinum.VinumMirrorDisk attribute) plexoffset (dissect.volume.vinum.config.SD attribute) PlexOrg (class in dissect.volume.vinum.config) PlexState (class in dissect.volume.vinum.config) plist (dissect.util.plist.NSKeyedArchiver attribute) plocate_def (in module dissect.target.plugins.os.unix.locate.plocate) PLocateFile (class in dissect.target.plugins.os.unix.locate.plocate) PLocatePlugin (class in dissect.target.plugins.os.unix.locate.plocate) PLocateRecord (in module dissect.target.plugins.os.unix.locate.plocate) plug_and_play (dissect.executable.pe.directory.resource.ResourceDirectory property) Plugin (class in dissect.target.plugin) plugin_function_with_argparser() (in module dissect.target.tools.utils.cli) plugin_import_errors (dissect.target.tools.utils.report.ExecutionReport attribute) PluginDescriptor (class in dissect.target.plugin) PluginDescriptorLookup (class in dissect.target.plugin) PluginError PluginListPlugin (class in dissect.target.plugins.general.plugins) PluginNotFoundError PluginRegistry (class in acquire.acquire.uploaders.plugin_registry) (class in dissect.target.plugin) plugins (acquire.acquire.uploaders.plugin_registry.PluginRegistry attribute) PLUGINS (in module dissect.target.plugin) plugins() (dissect.target.plugins.general.plugins.PluginListPlugin method) (in module dissect.target.plugin) PMAP_PORT (dissect.target.helpers.sunrpc.client.Client attribute) PMC_COUNTERS (dissect.etl.headers.event.ExtType attribute) PNNI (dissect.target.helpers.network.IANAProtocol attribute) PodmanChildTargetPlugin (class in dissect.target.plugins.child.podman) PodmanContainerRecord (in module dissect.target.plugins.apps.container.podman) PodmanImageRecord (in module dissect.target.plugins.apps.container.podman) PodmanLogRecord (in module dissect.target.plugins.apps.container.podman) PodmanPlugin (class in dissect.target.plugins.apps.container.podman) PogoDebugEntry (class in dissect.executable.pe.directory.debug) Pointer (class in dissect.cstruct.types.pointer) pointer (dissect.cstruct.cstruct.cstruct attribute) (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) POINTER32 (dissect.etl.headers.headers.EventProperty attribute) POINTER64 (dissect.etl.headers.headers.EventProperty attribute) pointer_size (dissect.etl.etl.ETL attribute) (dissect.etl.headers.logfile.LogfileHeader property) pointer_to_raw_data (dissect.executable.pe.pe.Section property) PointerBlock2Addr (class in dissect.vmfs.address) PointerBlock2Addr64 (class in dissect.vmfs.address) PointerBlock2ResourceVMFS5 (class in dissect.vmfs.resource) PointerBlock2ResourceVMFS6 (class in dissect.vmfs.resource) PointerBlockAddr (class in dissect.vmfs.address) PointerBlockAddr64 (class in dissect.vmfs.address) PointerBlockResourceVMFS5 (class in dissect.vmfs.resource) PointerBlockResourceVMFS6 (class in dissect.vmfs.resource) policy (dissect.volume.lvm.metadata.CachePoolSegment attribute) (dissect.volume.lvm.metadata.CacheSegment attribute) POLICY_CATEGORIES (in module dissect.target.plugins.os.windows.regf.auditpol) policy_def (in module dissect.target.plugins.os.windows.adpolicy) POLICY_MAP (in module dissect.target.plugins.os.windows.regf.auditpol) policy_settings (dissect.volume.lvm.metadata.CachePoolSegment attribute) (dissect.volume.lvm.metadata.CacheSegment attribute) POLICY_VALUES (in module dissect.target.plugins.os.windows.regf.auditpol) pool (dissect.volume.dm.thin.ThinDevice attribute) (dissect.volume.lvm.metadata.ThinPoolSegment attribute) PoolGuid (in module dissect.etl.utils) pop() (dissect.apfs.cursor.Cursor method) (dissect.btrfs.tree.Cursor method) (dissect.target.helpers.configutil.ScopeManager method) populate_role_guid_map() (dissect.target.plugins.os.windows.ual.UalPlugin method) port (class in flow.record.fieldtypes.net.tcp) (class in flow.record.fieldtypes.net.udp) (dissect.target.helpers.sunrpc.sunrpc.PortMapping attribute) (dissect.target.loaders.remote.RemoteStreamConnection attribute) (flow.record.adapter.splunk.SplunkWriter attribute) (flow.record.fieldtypes.uri property) Port (in module flow.record.fieldtypes.net.tcp) (in module flow.record.fieldtypes.net.udp) port() (in module dissect.target.loaders.mqtt) PORTABLE_DEVICES (dissect.target.plugins.os.windows.regf.usb.UsbPlugin attribute) PortMapping (class in dissect.target.helpers.sunrpc.sunrpc) PortMappingSerializer (class in dissect.target.helpers.sunrpc.serializer) pos (dissect.cstruct.expression.ExpressionTokenizer attribute) POS (dissect.target.plugins.os.windows.network.IfTypes attribute) posix_command (class in flow.record.fieldtypes) posix_path (class in flow.record.fieldtypes) post() (dissect.fve.crypto.base.IV method) postloop() (dissect.target.tools.shell.TargetCmd method) PowerGuid (in module dissect.etl.utils) PowerShell (class in acquire.acquire.acquire) powershell_history() (dissect.target.plugins.apps.shell.powershell.PowerShellHistoryPlugin method) PowerShellHistoryPlugin (class in dissect.target.plugins.apps.shell.powershell) ppid (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) PPP (dissect.target.plugins.os.windows.network.IfTypes attribute) PPPMULTILINKBUNDLE (dissect.target.plugins.os.windows.network.IfTypes attribute) pre_vc11 (dissect.executable.pe.directory.debug.VcFeatureDebugEntry property) precedence() (dissect.cstruct.expression.Expression method) precedence_levels (dissect.cstruct.expression.Expression attribute) predicted_tick (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) Prefetch (class in acquire.acquire.acquire) (class in dissect.target.plugins.os.windows.prefetch) prefetch() (dissect.target.plugins.os.windows.prefetch.PrefetchPlugin method) prefetch_def (in module dissect.target.plugins.os.windows.prefetch) prefetch_factor_inc (dissect.target.loaders.mqtt.MqttConnection attribute) prefetch_version_structs (in module dissect.target.plugins.os.windows.prefetch) prefetchdir (dissect.target.plugins.os.windows.prefetch.PrefetchPlugin attribute) PrefetchPlugin (class in dissect.target.plugins.os.windows.prefetch) PrefetchRecord (in module dissect.target.plugins.os.windows.prefetch) prefix (dissect.extfs.extfs.XAttr attribute) (dissect.target.filesystems.cb.CbFilesystem attribute) PREFIXES (in module dissect.target.loaders.dir) preheader (dissect.hypervisor.disk.vdi.VDI attribute) preloop() (dissect.target.tools.shell.ExtendedCmd method) (dissect.target.tools.shell.TargetCmd method) prepare_client() (acquire.acquire.uploaders.minio.MinIO method) (acquire.acquire.uploaders.plugin.UploaderPlugin method) prepare_insert_sql() (in module flow.record.adapter.sqlite) prepare_ls_colors() (in module dissect.target.tools.utils.fs) prepend_fs_layer() (dissect.target.filesystem.LayerFilesystem method) prepend_layer() (dissect.target.filesystem.LayerFilesystem method) PreserveTombstone (dissect.database.ese.ntds.util.SearchFlags attribute) prev (dissect.target.loaders.mqtt.MqttConnection attribute) prev() (dissect.apfs.cursor.Cursor method) (dissect.btrfs.tree.Cursor method) (dissect.database.ese.btree.BTree method) (dissect.database.ese.cursor.Cursor method) prev_node() (dissect.btrfs.tree.Cursor method) prev_page() (dissect.database.ese.btree.BTree method) previous (dissect.cstruct.parser.TokenConsumer attribute) previous_bitmap (dissect.volume.vss.Store property) previous_page (dissect.database.ese.page.Page attribute) previous_path (dissect.target.plugins.os.unix.locate.gnulocate.GNULocateFile attribute) previous_store (dissect.volume.vss.Store attribute) previous_timestamps (dissect.target.plugins.os.windows.prefetch.Prefetch property) primary_element_count (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) primary_group_id (dissect.database.ese.ntds.objects.user.User property) primary_header (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) primary_header_offset (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) primary_index (dissect.database.ese.table.Table property) PRIMARY_ISDN (dissect.target.plugins.os.windows.network.IfTypes attribute) primary_key (dissect.database.sqlite3.sqlite3.Table attribute) primary_raid_level (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) principal_id (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) print_acquire_warning() (in module acquire.acquire.acquire) print_disks_overview() (in module acquire.acquire.acquire) print_error() (in module flow.record.tools.rdump) print_extensive_file_stat_listing() (in module dissect.target.tools.utils.fs) print_ls() (in module dissect.target.tools.utils.fs) print_name (dissect.archive.wim.ReparsePoint property) (dissect.ntfs.attr.ReparsePoint property) print_object() (in module dissect.util.tools.dump_nskeyedarchiver) print_stat() (in module dissect.target.tools.utils.fs) print_target_info() (in module dissect.target.tools.info) print_volumes_overview() (in module acquire.acquire.acquire) print_xattr() (in module dissect.target.tools.utils.fs) PRINTABLE (in module dissect.cstruct.utils) priority (dissect.fve.bde.information.VmkInfoDatum property) (dissect.fve.luks.metadata.Keyslot attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) private_id (dissect.apfs.objects.fs.INode property) private_key_file (dissect.target.loaders.mqtt.Broker attribute) private_key_filter() (in module acquire.acquire.acquire) private_keys() (dissect.target.plugins.apps.ssh.openssh.OpenSSHPlugin method) PrivateKeyRecord (in module dissect.target.plugins.apps.ssh.ssh) PRIVILEGED (dissect.target.helpers.sunrpc.client.LocalPortPolicy attribute) PRM (dissect.target.helpers.network.IANAProtocol attribute) Proc (class in acquire.acquire.acquire) PROC_STAT_NAMES (in module dissect.target.plugins.os.unix.linux.proc) PROC_UNAVAIL (dissect.target.helpers.sunrpc.sunrpc.AcceptStat attribute) ProcConfigParser (class in dissect.target.plugins.os.unix.linux.network) ProcConfigParser.ParserContext (class in dissect.target.plugins.os.unix.linux.network) procedure (dissect.target.helpers.sunrpc.sunrpc.CallBody attribute) (dissect.target.helpers.sunrpc.sunrpc.ProcedureDescriptor attribute) ProcedureDescriptor (class in dissect.target.helpers.sunrpc.sunrpc) ProcedureParams (in module dissect.target.helpers.sunrpc.serializer) (in module dissect.target.helpers.sunrpc.sunrpc) ProcedureResults (in module dissect.target.helpers.sunrpc.serializer) (in module dissect.target.helpers.sunrpc.sunrpc) PROCESS (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) process() (dissect.database.ese.ntds.query.Query method) (dissect.target.helpers.logging.TargetLogAdapter method) (dissect.target.plugins.os.unix.linux.proc.ProcPlugin method) PROCESS_ALL_ACCESS (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) PROCESS_CREATE_PROCESS (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) PROCESS_CREATE_THREAD (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) PROCESS_DUP_HANDLE (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) process_generic_arguments() (in module dissect.target.tools.utils.cli) process_id (dissect.etl.headers.event.EventHeader property) (dissect.etl.headers.headers.EventInstanceGUIDHeader property) (dissect.etl.headers.headers.EventTraceHeader property) (dissect.etl.headers.headers.MessageTraceHeader property) (dissect.etl.headers.system.CompactSystemHeader property) (dissect.etl.headers.system.SystemHeader property) process_plugin_arguments() (in module dissect.target.tools.utils.cli) PROCESS_QUERY_INFORMATION (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) process_rules() (in module dissect.target.plugins.filesystem.yara) PROCESS_SET_INFORMATION (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) PROCESS_SET_QUOTA (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) PROCESS_START_KEY (dissect.etl.headers.event.ExtType attribute) PROCESS_TERMINATE (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) process_token_sid_type (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) PROCESS_VM_OPERATION (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) PROCESS_VM_READ (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) PROCESS_VM_WRITE (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) ProcessAccess (class in acquire.acquire.dynamic.windows.types) processes() (dissect.target.plugins.os.unix.linux.proc.ProcPlugin method) (dissect.target.plugins.os.unix.linux.processes.ProcProcesses method) ProcessGuid (in module dissect.etl.utils) processor_time (dissect.etl.headers.system.SystemHeader property) ProcessStateEnum (class in dissect.target.plugins.os.unix.linux.proc) ProcessToken (class in acquire.acquire.dynamic.windows.types) ProcNet (class in acquire.acquire.acquire) ProcPlugin (class in dissect.target.plugins.os.unix.linux.proc) ProcProcess (class in dissect.target.plugins.os.unix.linux.proc) ProcProcesses (class in dissect.target.plugins.os.unix.linux.processes) ProcProcessRecord (in module dissect.target.plugins.os.unix.linux.processes) produce_target_func_pairs() (in module dissect.target.tools.dump) productkey() (dissect.target.plugins.os.windows.productkey.WindowsProductKeyPlugin method) profile (dissect.volume.lvm.metadata.LogicalVolume attribute) (dissect.volume.lvm.metadata.VolumeGroup attribute) PROFILE_KEY (dissect.target.plugins.os.windows.regf.nethist.NethistPlugin attribute) ProfileLoader (class in dissect.target.loaders.profile) ProfileOSPlugin (class in dissect.target.loaders.profile) PROFILES (in module acquire.acquire.acquire) PROG_MISMATCH (dissect.target.helpers.sunrpc.sunrpc.AcceptStat attribute) PROG_UNAVAIL (dissect.target.helpers.sunrpc.sunrpc.AcceptStat attribute) program (dissect.target.helpers.sunrpc.sunrpc.CallBody attribute) (dissect.target.helpers.sunrpc.sunrpc.PortMapping attribute) (dissect.target.helpers.sunrpc.sunrpc.ProcedureDescriptor attribute) program_data (dissect.target.plugins.os.windows.regf.cit.Entry attribute) ProgramDataBitmaps (class in dissect.target.plugins.os.windows.regf.cit) programs() (dissect.target.plugins.os.windows.amcache.AmcachePluginOldMixin method) ProgramsAppcompatRecord (in module dissect.target.plugins.os.windows.amcache) ProgramUseData (class in dissect.target.plugins.os.windows.regf.cit) progress (acquire.acquire.gui.win32.Win32 property) Progress (class in dissect.evidence.tools.asdf.dd) progress (in module acquire.acquire.tools.decrypter) (in module dissect.archive.tools.backup) (in module dissect.fve.tools.dd) progress_bar (acquire.acquire.gui.win32.Win32 attribute) (flow.record.tools.rdump.ProgressMonitor attribute) progress_handler() (in module dissect.target.tools.qfind) PROGRESS_LOG_STEP (in module acquire.acquire.hashes) ProgressMonitor (class in flow.record.tools.rdump) prompt (dissect.target.tools.diff.DifferentialCli property) (dissect.target.tools.shell.RegistryCli property) (dissect.target.tools.shell.TargetCli property) (dissect.target.tools.shell.TargetHubCli attribute) prompt_base (dissect.target.tools.shell.RegistryCli attribute) (dissect.target.tools.shell.TargetCli attribute) prompt_ps1 (dissect.target.tools.shell.TargetCmd attribute) PROP_BWA_P2MP (dissect.target.plugins.os.windows.network.IfTypes attribute) PROP_CNLS (dissect.target.plugins.os.windows.network.IfTypes attribute) PROP_DOCS_WIRELESS_DOWNSTREAM (dissect.target.plugins.os.windows.network.IfTypes attribute) PROP_DOCS_WIRELESS_MACLAYER (dissect.target.plugins.os.windows.network.IfTypes attribute) PROP_DOCS_WIRELESS_UPSTREAM (dissect.target.plugins.os.windows.network.IfTypes attribute) PROP_MULTIPLEXOR (dissect.target.plugins.os.windows.network.IfTypes attribute) PROP_POINT2POINT_SERIAL (dissect.target.plugins.os.windows.network.IfTypes attribute) PROP_VIRTUAL (dissect.target.plugins.os.windows.network.IfTypes attribute) PROP_WIRELESS_P2P (dissect.target.plugins.os.windows.network.IfTypes attribute) properties (dissect.archive.vbk.DirItem property) (dissect.cim.cim.Class property) (dissect.cim.cim.Instance property) (dissect.cim.classes.ClassDefinition property) (dissect.cim.classes.ClassInstance property) (dissect.cim.classes.PropertyDefaultValues attribute) (dissect.fve.bde.information.Datum property) (dissect.hypervisor.descriptor.vbox.HardDisk property) properties_length (dissect.cim.cim.Class property) PropertiesDictionary (class in dissect.archive.vbk) Property (class in dissect.cim.cim) property (dissect.cim.classes.ClassDefinitionProperty attribute) property_data (dissect.cim.classes.ClassDefinition attribute) property_default_values (dissect.cim.cim.Class property) property_offset (dissect.cim.classes.PropertyReference attribute) property_reference (dissect.cim.classes.PropertyReference attribute) property_references (dissect.cim.classes.ClassDefinition attribute) property_states (dissect.cim.classes.ClassInstance attribute) PROPERTY_STORE_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) PropertyDefaultValues (class in dissect.cim.classes) PropertyReference (class in dissect.cim.classes) PropertyStates (class in dissect.cim.classes) props (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin attribute) (dissect.target.target.Target attribute) protection_class (dissect.target.loaders.itunes.ClassKey attribute) PROTEON_10MBIT (dissect.target.plugins.os.windows.network.IfTypes attribute) PROTEON_80MBIT (dissect.target.plugins.os.windows.network.IfTypes attribute) ProtobufVarint (class in dissect.target.helpers.protobuf) Protocol (class in dissect.target.helpers.sunrpc.sunrpc) (class in flow.record.adapter.splunk) protocol (dissect.target.helpers.sunrpc.sunrpc.PortMapping attribute) PROTOCOL (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) protocol (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) (flow.record.adapter.splunk.SplunkWriter attribute) (flow.record.fieldtypes.uri property) protocol_string (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) protocol_type (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) PROV_TRAITS (dissect.etl.headers.event.ExtType attribute) provided (dissect.target.filesystems.nfs.AuthFlavorNotSupported attribute) provider (dissect.database.ese.tools.sru.Entry attribute) (dissect.target.helpers.keychain.Key attribute) (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) provider_id (dissect.etl.headers.event.EventHeader property) (dissect.etl.headers.headers.Header property) (dissect.etl.headers.headers.MessageTraceHeader property) (dissect.etl.headers.system.SystemSpecificHeader property) (dissect.eventlog.wevt.WEVT property) provider_id() (dissect.etl.etl.Event method) provider_name() (dissect.etl.etl.Event method) PROXMOX (dissect.target.plugin.OperatingSystem attribute) ProxmoxChildTargetPlugin (class in dissect.target.plugins.child.proxmox) ProxmoxConfigDirectoryEntry (class in dissect.target.plugins.os.unix.linux.debian.proxmox._os) ProxmoxConfigFileEntry (class in dissect.target.plugins.os.unix.linux.debian.proxmox._os) ProxmoxLoader (class in dissect.target.loaders.proxmox) ProxmoxPlugin (class in dissect.target.plugins.os.unix.linux.debian.proxmox._os) ProxmoxProfile (class in acquire.acquire.acquire) PRVA (class in dissect.eventlog.wevt_object) PSM_KEY (dissect.etl.headers.event.ExtType attribute) PT (in module dissect.executable.elf.c_elf) PTP (dissect.target.helpers.network.IANAProtocol attribute) PUA_FIRST (dissect.database.ese.lcmapstring.SCRIPT attribute) PUA_LAST (dissect.database.ese.lcmapstring.SCRIPT attribute) public_key (dissect.target.loaders.itunes.ClassKey attribute) (dissect.target.plugins.apps.ssh.ssh.SSHPrivateKey attribute) public_key_info() (dissect.fve.bde.information.VmkInfoDatum method) public_keys() (dissect.target.plugins.apps.ssh.openssh.OpenSSHPlugin method) PUBLIC_OBJECT_TYPE_INFORMATION (class in acquire.acquire.dynamic.windows.types) PublicKeyInfoDatum (class in dissect.fve.bde.information) PublicKeyRecord (in module dissect.target.plugins.apps.ssh.ssh) publisher (flow.record.adapter.broker.BrokerWriter attribute) PUNCTUATION (dissect.database.ese.lcmapstring.SCRIPT attribute) PUNICODE_STRING (in module acquire.acquire.dynamic.windows.types) PUP (dissect.target.helpers.network.IANAProtocol attribute) PureDissectPath (class in dissect.target.helpers.compat.path_310) (class in dissect.target.helpers.compat.path_311) (class in dissect.target.helpers.compat.path_312) (class in dissect.target.helpers.compat.path_313) push() (dissect.apfs.cursor.Cursor method) (dissect.btrfs.tree.Cursor method) (dissect.target.helpers.configutil.ScopeManager method) push_notification() (dissect.target.plugins.os.windows.sru.SRUPlugin method) PushNotificationRecord (in module dissect.target.plugins.os.windows.sru) PuTTYPlugin (class in dissect.target.plugins.apps.ssh.putty) PuTTYSessionRecord (in module dissect.target.plugins.apps.ssh.putty) PuTTYUserRecordDescriptor (in module dissect.target.plugins.apps.ssh.putty) puu() (dissect.target.plugins.os.windows.regf.cit.CITPlugin method) pv (dissect.volume.lvm.metadata.VolumeGroup property) pvlen (dissect.database.bsd.tools.rpm.HeaderBlob attribute) PvmLoader (class in dissect.target.loaders.pvm) pvms (dissect.target.plugins.child.parallels.ParallelsChildTargetPlugin attribute) PVOID (in module acquire.acquire.dynamic.windows.types) PVP (dissect.target.helpers.network.IANAProtocol attribute) PVS (class in dissect.hypervisor.descriptor.pvs) PvsLoader (class in dissect.target.loaders.pvs) PY_311 (in module dissect.cstruct.types.enum) PY_311_OR_HIGHER (in module flow.record.fieldtypes) PY_312 (in module dissect.cstruct.types.enum) PY_312_OR_HIGHER (in module flow.record.fieldtypes) PY_313_OR_HIGHER (in module flow.record.fieldtypes) python_compile (in module dissect.cstruct.compiler) python_shell() (in module dissect.target.tools.shell) Q QCow2 (class in dissect.hypervisor.disk.qcow2) qcow2 (dissect.hypervisor.disk.qcow2.L2Table attribute) (dissect.hypervisor.disk.qcow2.QCow2Snapshot attribute) (dissect.hypervisor.disk.qcow2.QCow2Stream attribute) (dissect.target.containers.qcow2.QCow2Container attribute) qcow2_def (in module dissect.hypervisor.disk.c_qcow2) QCOW2_INCOMPAT_MASK (in module dissect.hypervisor.disk.c_qcow2) QCOW2_MAGIC (in module dissect.hypervisor.disk.c_qcow2) QCOW2_MAGIC_BYTES (in module dissect.hypervisor.disk.c_qcow2) QCow2ClusterType (in module dissect.hypervisor.disk.c_qcow2) QCow2Container (class in dissect.target.containers.qcow2) QCow2Snapshot (class in dissect.hypervisor.disk.qcow2) QCow2Stream (class in dissect.hypervisor.disk.qcow2) QCow2SubclusterType (in module dissect.hypervisor.disk.c_qcow2) QemuChildTargetPlugin (class in dissect.target.plugins.child.qemu) qfind() (dissect.target.plugins.scrape.qfind.QFindPlugin method) QFindMatchRecord (in module dissect.target.plugins.scrape.qfind) QFindPlugin (class in dissect.target.plugins.scrape.qfind) QLLC (dissect.target.plugins.os.windows.network.IfTypes attribute) QNX (dissect.target.helpers.network.IANAProtocol attribute) QNX4 (class in dissect.qnxfs.qnx4) qnx4_def (in module dissect.qnxfs.c_qnx4) QNX6 (class in dissect.qnxfs.qnx6) qnx6_def (in module dissect.qnxfs.c_qnx6) QnxDirEntry (class in dissect.target.filesystems.qnxfs) QnxFilesystem (class in dissect.target.filesystems.qnxfs) QnxFilesystemEntry (class in dissect.target.filesystems.qnxfs) qnxfs (dissect.target.filesystems.qnxfs.QnxFilesystem attribute) QNXFS() (in module dissect.qnxfs.qnxfs) Qualifier (class in dissect.cim.classes) qualifier_reference (dissect.cim.classes.QualifierReference attribute) qualifier_references (dissect.cim.classes.ClassDefinition attribute) (dissect.cim.classes.ClassDefinitionProperty attribute) (dissect.cim.classes.ClassInstance attribute) QualifierReference (class in dissect.cim.classes) qualifiers (dissect.cim.cim.Property property) (dissect.cim.classes.ClassDefinition property) (dissect.cim.classes.ClassDefinitionProperty attribute) (dissect.cim.classes.ClassInstance property) (dissect.cim.classes.ClassInstanceProperty property) qualname (dissect.target.plugin.FunctionDescriptor attribute) (dissect.target.plugin.PluginDescriptor attribute) quarantine_id (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntry attribute) QUARANTINE_SUCCESS (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) QuarantinedFiles (class in acquire.acquire.acquire) QuarantineEntry (class in dissect.target.plugins.os.windows.defender.quarantine) QuarantineEntryResource (class in dissect.target.plugins.os.windows.defender.quarantine) Query (class in dissect.database.ese.ntds.query) query (dissect.database.ese.ntds.query.Query attribute) (dissect.util.ldap.SearchFilter attribute) (flow.record.fieldtypes.uri property) query() (dissect.cim.cim.CIM method) (dissect.cim.cim.Namespace method) (dissect.database.ese.ntds.database.DataTable method) (dissect.database.ese.ntds.ntds.NTDS method) query_directory_object() (in module acquire.acquire.dynamic.windows.ntdll) query_port_mapping() (dissect.target.helpers.sunrpc.client.Client method) QueryPolicy (class in dissect.database.ese.ntds.objects.querypolicy) queue (dissect.cstruct.expression.Expression attribute) (flow.record.adapter.elastic.ElasticWriter attribute) quit() (acquire.acquire.gui.win32.Win32 method) quitting (acquire.acquire.gui.win32.Win32 attribute) QWORD (dissect.target.helpers.regutil.RegistryValueType attribute) R r (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) R (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) (in module dissect.target.loaders.mqtt) RADIO_MAC (dissect.target.plugins.os.windows.network.IfTypes attribute) RADSL (dissect.target.plugins.os.windows.network.IfTypes attribute) RAID (class in dissect.volume.raid.raid) RAID0 (dissect.volume.raid.stream.Level attribute) raid0_lvs (dissect.volume.lvm.metadata.RAIDSegment attribute) RAID0Stream (class in dissect.volume.raid.stream) RAID1 (dissect.volume.raid.stream.Level attribute) RAID10 (dissect.volume.raid.stream.Level attribute) RAID10Stream (class in dissect.volume.raid.stream) RAID3 (dissect.volume.raid.stream.Level attribute) RAID4 (dissect.volume.raid.stream.Level attribute) RAID456Stream (class in dissect.volume.raid.stream) RAID5 (dissect.volume.raid.stream.Level attribute) (dissect.volume.vinum.config.PlexOrg attribute) RAID6 (dissect.volume.raid.stream.Level attribute) raid_disks (dissect.volume.md.md.MDPhysicalDisk attribute) (dissect.volume.raid.stream.RAID10Stream attribute) raid_level_qualifier (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) RAIDError raids (dissect.volume.lvm.metadata.RAIDSegment attribute) RAIDSegment (class in dissect.volume.lvm.metadata) range_list (dissect.volume.vss.Store property) RangeList (class in dissect.volume.vss) RangeStream (class in dissect.util.stream) raw (dissect.database.bsd.db.Page property) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.hypervisor.disk.vmdk.DiskDescriptor attribute) (dissect.hypervisor.disk.vmdk.ExtentDescriptor attribute) RAW (dissect.target.helpers.keychain.KeyType attribute) raw (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry attribute) (dissect.target.plugins.os.windows.firewall.LogConfig attribute) (dissect.target.volume.Volume attribute) (dissect.vmfs.descriptor.DirEntry attribute) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.volume.disk.partition.Partition attribute) raw() (dissect.target.plugins.os.unix.linux.proc.Sockets method) (dissect.target.plugins.os.unix.linux.sockets.NetSocketPlugin method) raw6() (dissect.target.plugins.os.unix.linux.proc.Sockets method) raw_data (dissect.etl.headers.event.EventHeaderExtendedDataItem attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) raw_page() (dissect.database.sqlite3.sqlite3.SQLite3 method) raw_size (dissect.executable.pe.pe.Section property) RawContainer (class in dissect.target.containers.raw) (in module dissect.target.container) RawDisk (class in dissect.hypervisor.disk.vmdk) RawLoader (class in dissect.target.loaders.raw) (in module dissect.target.loader) rc4_crypt() (in module dissect.target.plugins.os.windows.defender.quarantine) rcdata (dissect.executable.pe.directory.resource.ResourceDirectory property) rdev (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) rdm_mapping (dissect.vmfs.descriptor.FileDescriptor property) RDP (dissect.target.helpers.network.IANAProtocol attribute) RdpCachePlugin (class in dissect.target.plugins.os.windows.rdpcache) RDPCacheRecord (in module dissect.target.plugins.os.windows.rdpcache) RE_ACCESS_COMMON_PATTERN (in module dissect.target.plugins.apps.webserver.apache) RE_ACCESS_LOG (in module dissect.target.plugins.apps.webserver.nginx) RE_ACCESS_LOG_DIRECTIVE (in module dissect.target.plugins.apps.webserver.nginx) RE_ANSI_ESCAPE (in module dissect.target.plugins.apps.container.docker) re_cdata (in module dissect.target.plugins.apps.av.mcafee) RE_CITRIX_NETSCALER_BASH_HISTORY_DATE (in module dissect.target.plugins.os.unix.bsd.citrix.history) RE_CLOUD_INIT_LINE (in module dissect.target.plugins.os.unix.log.messages) RE_CONFIG_CUSTOM_LOG_DIRECTIVE (in module dissect.target.plugins.apps.webserver.apache) RE_CONFIG_EOL (in module dissect.volume.vinum.config) RE_CONFIG_ERRORLOG_DIRECTIVE (in module dissect.target.plugins.apps.webserver.apache) RE_CONFIG_HOSTNAME (in module dissect.target.plugins.os.unix.bsd.citrix._os) RE_CONFIG_INCLUDE (in module dissect.target.plugins.apps.webserver.apache) RE_CONFIG_IP (in module dissect.target.plugins.os.unix.bsd.citrix._os) RE_CONFIG_ROOT (in module dissect.target.plugins.apps.webserver.apache) RE_CONFIG_TIMEZONE (in module dissect.target.plugins.os.unix.bsd.citrix.locale) RE_CONFIG_USER (in module dissect.target.plugins.os.unix.bsd.citrix._os) RE_CRONJOB (in module dissect.target.plugins.os.unix.cronjobs) RE_CTR_LOG (in module dissect.target.plugins.apps.container.podman) RE_DEVICE_NAME (in module dissect.target.plugins.os.windows.regf.usb) RE_DOCKER_NS (in module dissect.target.plugins.apps.container.docker) RE_ENV_VAR_IN_STRING (in module dissect.target.plugins.apps.webserver.apache) RE_ENVVAR (in module dissect.target.plugins.os.unix.cronjobs) RE_ERROR_COMMON_PATTERN (in module dissect.target.plugins.apps.webserver.apache) RE_ERROR_LOG (in module dissect.target.plugins.apps.webserver.nginx) RE_ERROR_LOG_DIRECTIVE (in module dissect.target.plugins.apps.webserver.nginx) RE_EXTENDED_BASH (in module dissect.target.plugins.os.unix.history) RE_EXTENDED_ZSH (in module dissect.target.plugins.os.unix.history) RE_EXTENT_DESCRIPTOR (in module dissect.hypervisor.disk.vmdk) re_field (in module dissect.target.plugins.os.windows.log.amcache) RE_FISH (in module dissect.target.plugins.os.unix.history) re_illegal_characters (in module dissect.target.plugins.os.windows.log.evt) (in module dissect.target.plugins.os.windows.log.evtx) RE_INCLUDE_DIRECTIVE (in module dissect.target.plugins.apps.webserver.nginx) RE_KV (dissect.target.helpers.configutil.Env attribute) RE_LINE (in module dissect.target.plugins.os.unix.log.helpers) RE_LOADER_CONFIG_KERNEL_VERSION (in module dissect.target.plugins.os.unix.bsd.citrix._os) RE_LOG (in module dissect.target.plugins.apps.remoteaccess.teamviewer) RE_LOG_LINE (in module dissect.target.plugins.apps.remoteaccess.rustdesk) RE_MASTER_KEY (dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin attribute) RE_MSG_SEAT (dissect.target.plugins.os.unix.log.auth.SystemdLogindService attribute) RE_MSG_SESSION_LOGGED_OUT (dissect.target.plugins.os.unix.log.auth.SystemdLogindService attribute) RE_MSG_SESSION_NEW (dissect.target.plugins.os.unix.log.auth.SystemdLogindService attribute) RE_MSG_SESSION_NEW_VARIANT (dissect.target.plugins.os.unix.log.auth.SystemdLogindService attribute) RE_MSG_SESSION_REMOVED (dissect.target.plugins.os.unix.log.auth.SystemdLogindService attribute) RE_MSG_WATCHING (dissect.target.plugins.os.unix.log.auth.SystemdLogindService attribute) re_NOFLAG (in module dissect.target.plugins.scrape.qfind) re_normalize_path (in module dissect.target.helpers.polypath) RE_NORMALIZE_PATH (in module flow.record.fieldtypes) re_normalize_sbs_path (in module dissect.target.helpers.polypath) RE_PAM_UNIX (dissect.target.plugins.os.unix.log.auth.PamUnixService attribute) RE_PATH_SPLIT (in module dissect.target.plugins.os.windows.services) RE_PATH_SPLIT_FALLBACK (in module dissect.target.plugins.os.windows.services) RE_PKEXEC_COMMAND (dissect.target.plugins.os.unix.log.auth.PkexecService attribute) re_quoted (in module dissect.target.plugins.filesystem.resolver) RE_RAW_DISK (in module dissect.target.loaders.vbk) RE_REFERER_USER_AGENT_PATTERN (in module dissect.target.plugins.apps.webserver.apache) RE_REMOTE_PATTERN (in module dissect.target.plugins.apps.webserver.apache) RE_RESPONSE_TIME_PATTERN (in module dissect.target.plugins.apps.webserver.apache) RE_SSHD_PORTREGEX (dissect.target.plugins.os.unix.log.auth.SshdService attribute) RE_START (in module dissect.target.plugins.apps.remoteaccess.teamviewer) re_strip_tags (in module dissect.target.plugins.apps.av.mcafee) RE_SU_BY (dissect.target.plugins.os.unix.log.auth.SuService attribute) RE_SU_COMMAND (dissect.target.plugins.os.unix.log.auth.SuService attribute) RE_SU_ON (dissect.target.plugins.os.unix.log.auth.SuService attribute) RE_SUDO_COMMAND (dissect.target.plugins.os.unix.log.auth.SudoService attribute) RE_TIMESTAMP_PATTERN (in module dissect.target.plugins.os.windows.log.mssql) RE_TS (in module dissect.target.plugins.apps.remoteaccess.splashtop) (in module dissect.target.plugins.os.unix.linux.redhat.yum) (in module dissect.target.plugins.os.unix.log.helpers) RE_TS_ISO (in module dissect.target.plugins.os.unix.log.helpers) RE_URL (in module dissect.target.plugins.os.windows.search) RE_USER (dissect.target.plugins.os.unix.log.auth.SshdService attribute) (in module dissect.target.plugins.os.unix.log.auth) RE_VALID_FIELD_NAME (in module flow.record.base) RE_VALID_KEY_CHARS (in module dissect.target.plugins.os.windows.wer) RE_VALID_KEY_START_CHARS (in module dissect.target.plugins.os.windows.wer) RE_VALID_RECORD_TYPE_NAME (in module flow.record.base) RE_VIRTUALHOST (in module dissect.target.plugins.apps.webserver.apache) RE_VOLUME_ID (in module dissect.target.loaders.proxmox) REACH_DSL (dissect.target.plugins.os.windows.network.IfTypes attribute) read (dissect.hypervisor.disk.vmdk.RawDisk attribute) (dissect.target.containers.raw.RawContainer attribute) (dissect.target.loaders.mqtt.MqttConnection attribute) (flow.record.context.AppContext attribute) read() (dissect.cstruct.bitbuffer.BitBuffer method) (dissect.cstruct.cstruct.cstruct method) (dissect.cstruct.types.base.MetaType method) (dissect.eventlog.bxml.BxmlNameReader method) (dissect.eventlog.bxml.EvtxNameReader method) (dissect.eventlog.bxml.WevtNameReader method) (dissect.eventlog.evtx.ElfChnk method) (dissect.hypervisor.descriptor.hyperv.HyperVStorageFileObject method) (dissect.target.container.Container method) (dissect.target.containers.asdf.AsdfContainer method) (dissect.target.containers.asif.AsifContainer method) (dissect.target.containers.ewf.EwfContainer method) (dissect.target.containers.fortifw.FortiFirmwareContainer method) (dissect.target.containers.hdd.HddContainer method) (dissect.target.containers.hds.HdsContainer method) (dissect.target.containers.qcow2.QCow2Container method) (dissect.target.containers.split.SplitContainer method) (dissect.target.containers.vdi.VdiContainer method) (dissect.target.containers.vhd.VhdContainer method) (dissect.target.containers.vhdx.VhdxContainer method) (dissect.target.containers.vmdk.VmdkContainer method) (dissect.target.helpers.mount.DissectMount method) (dissect.target.loaders.mqtt.Broker method) (dissect.target.loaders.remote.RemoteStreamConnection method) (dissect.target.volume.Volume method) (dissect.util.compression.lzxpress_huffman.BitString method) (dissect.util.stream.AlignedStream method) (dissect.util.stream.BitStream method) (dissect.vmfs.resource.ResourceFile method) (dissect.vmfs.resource.ResourceManager method) (flow.record.stream.RecordStreamReader method) Read3ArgsSerializer (class in dissect.target.helpers.nfs.serializer) Read3ResultDeserializer (class in dissect.target.helpers.nfs.serializer) read_ahead (dissect.volume.lvm.metadata.LogicalVolume attribute) read_attribute() (dissect.eventlog.bxml.Bxml method) read_bin_file() (dissect.target.plugins.os.windows.recyclebin.RecyclebinPlugin method) read_binxml_fragment() (in module dissect.eventlog.bxml) read_block() (dissect.extfs.journal.JDB2 method) (dissect.volume.vss.Store method) (in module dissect.volume.vss) read_block_data() (in module dissect.volume.vss) read_char_reference() (dissect.eventlog.bxml.Bxml method) read_chunk (dissect.evidence.ewf.ewf.TableSection attribute) READ_CHUNK_SIZE (dissect.target.helpers.nfs.client.mount.Client attribute) (dissect.target.helpers.nfs.client.nfs.Client attribute) read_descriptor_array() (in module dissect.eventlog.bxml) read_descriptors_from_stream() (dissect.eventlog.bxml.BxmlTemplateDescriptor class method) read_entity_reference() (dissect.eventlog.bxml.Bxml method) read_etl_files() (dissect.target.plugins.os.windows.log.etl.EtlPlugin method) read_etl_records() (dissect.target.plugins.os.windows.log.etl.EtlRecordBuilder method) read_file() (dissect.target.helpers.configutil.ConfigurationParser method) read_filename() (dissect.target.plugins.os.windows.prefetch.Prefetch method) read_footer() (in module dissect.hypervisor.disk.vhd) read_fragment_header() (dissect.eventlog.bxml.Bxml method) read_guid() (in module dissect.eventlog.bxml) read_instance_info() (in module dissect.etl.headers.event) read_key_subkeys() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) read_list() (dissect.cim.classes.PropertyReference class method) (dissect.cim.classes.QualifierReference class method) read_name_from_stream() (dissect.eventlog.bxml.Bxml method) read_null_terminated_wstring() (in module dissect.regf.regf) read_page() (dissect.cim.index.Store method) (dissect.database.ese.ese.ESE method) read_provider_traits() (in module dissect.etl.headers.event) read_record() (dissect.etl.etl.Buffer method) (in module dissect.database.sqlite3.sqlite3) read_records() (dissect.target.plugins.os.windows.certlog.CertLogPlugin method) (dissect.target.plugins.os.windows.sru.SRUPlugin method) read_recycle_bin() (dissect.target.plugins.os.windows.recyclebin.RecyclebinPlugin method) read_sb() (dissect.ffs.ffs.FFS static method) read_sectors() (dissect.evidence.ewf.ewf.Segment method) (dissect.evidence.ewf.ewf.TableSection method) (dissect.hypervisor.disk.vhd.Disk method) (dissect.hypervisor.disk.vhd.DynamicDisk method) (dissect.hypervisor.disk.vhd.FixedDisk method) (dissect.hypervisor.disk.vhdx.VHDX method) (dissect.hypervisor.disk.vmdk.RawDisk method) (dissect.hypervisor.disk.vmdk.SparseDisk method) (dissect.hypervisor.disk.vmdk.VMDK method) (dissect.volume.lvm.physical.LVM2Device method) read_sid() (in module dissect.eventlog.bxml) (in module dissect.util.sid) read_stack_trace() (in module dissect.etl.headers.event) read_stack_trace64() (in module dissect.etl.headers.event) read_status_blocks() (in module dissect.target.plugins.os.unix.linux.debian.dpkg) read_systemtime() (in module dissect.eventlog.bxml) read_table() (flow.record.adapter.sqlite.SqliteReader method) read_table_records() (dissect.target.plugins.os.windows.ual.UalPlugin method) read_template_instance() (dissect.eventlog.bxml.Bxml method) read_token() (dissect.eventlog.bxml.Bxml method) read_truncated_name() (in module dissect.target.plugins.os.windows.everything.parser) read_uuid() (in module dissect.etl.headers.event) read_value() (dissect.eventlog.bxml.Bxml method) (in module dissect.eventlog.bxml) read_varint() (in module dissect.target.plugins.os.windows.everything.parser) read_wstrings() (in module dissect.target.plugins.os.windows.regf.mru) readable() (dissect.target.filesystem.VirtualFileHandle method) (dissect.util.stream.AlignedStream method) (dissect.util.stream.BitStream method) readall() (dissect.util.stream.AlignedStream method) (dissect.util.stream.ZlibStream method) readdir() (dissect.target.helpers.mount.DissectMount method) (dissect.target.helpers.nfs.client.nfs.Client method) ReadDirPlusParams (class in dissect.target.helpers.nfs.nfs3) ReadDirPlusParamsSerializer (class in dissect.target.helpers.nfs.serializer) ReadDirPlusProc (in module dissect.target.helpers.nfs.nfs3) ReadDirPlusResult (class in dissect.target.helpers.nfs.nfs3) ReadDirPlusResultDeserializer (class in dissect.target.helpers.nfs.serializer) ReadDirResult (class in dissect.target.helpers.nfs.client.nfs) reader (dissect.target.helpers.cache.CacheWriter attribute) (flow.record.adapter.avro.AvroReader attribute) (flow.record.adapter.csvfile.CsvfileReader attribute) readfile() (dissect.target.helpers.nfs.client.nfs.Client method) ReadFileProc (in module dissect.target.helpers.nfs.nfs3) readheader() (flow.record.stream.RecordStreamReader method) readinto() (dissect.target.container.Container method) (dissect.target.filesystem.VirtualFileHandle method) (dissect.target.volume.Volume method) (dissect.util.stream.AlignedStream method) (in module dissect.target.helpers.utils) readline (in module dissect.target.tools.shell) readline_escape() (in module dissect.target.tools.shell) readlink() (dissect.apfs.objects.fs.INode method) (dissect.archive.wim.DirectoryEntry method) (dissect.evidence.ad1.ad1.FileEntry method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.apfs.ApfsFilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry method) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.ffs.FfsFilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemEntry method) (dissect.target.filesystems.jffs.JffsFilesystemEntry method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.ntds.NtdsFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry method) (dissect.target.filesystems.smb.SmbFilesystemEntry method) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystemEntry method) (dissect.target.filesystems.vbk.VbkFilesystemEntry method) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystemEntry method) (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) (dissect.target.helpers.mount.DissectMount method) (dissect.target.helpers.nfs.client.nfs.Client method) ReadLink3ResultDeserializer (class in dissect.target.helpers.nfs.serializer) readlink_ext() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystems.itunes.ITunesFilesystemEntry method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystemEntry method) ReadLinkProc (in module dissect.target.helpers.nfs.nfs3) ReadlinkResult (class in dissect.target.helpers.nfs.nfs3) readoffset() (dissect.util.stream.AlignedStream method) ReadParams (class in dissect.target.helpers.nfs.nfs3) ReadResult (class in dissect.target.helpers.nfs.nfs3) reads() (dissect.cstruct.types.base.MetaType method) ready (acquire.acquire.gui.base.GUI attribute) realpath() (in module dissect.target.helpers.compat.path_common) rebind_auth() (dissect.target.helpers.nfs.client.nfs.Client method) (dissect.target.helpers.sunrpc.client.AbstractClient method) (dissect.target.helpers.sunrpc.client.Client method) rec (flow.record.selector.RecordContextMatcher attribute) recalculate (dissect.volume.lvm.metadata.IntegritySegment attribute) recent_files_def (in module dissect.target.plugins.os.windows.regf.recentfilecache) recentdocs() (dissect.target.plugins.os.windows.regf.mru.MRUPlugin method) RecentDocsRecord (in module dissect.target.plugins.os.windows.regf.mru) recentfilecache() (dissect.target.plugins.os.windows.regf.recentfilecache.RecentFileCachePlugin method) RecentFileCachePlugin (class in dissect.target.plugins.os.windows.regf.recentfilecache) RecentFileCacheRecord (in module dissect.target.plugins.os.windows.regf.recentfilecache) recently_used() (dissect.target.plugins.os.unix.linux.recentlyused.RecentlyUsedPlugin method) RecentlyUsedApplicationRecord (in module dissect.target.plugins.os.unix.linux.recentlyused) RecentlyUsedIconRecord (in module dissect.target.plugins.os.unix.linux.recentlyused) RecentlyUsedPlugin (class in dissect.target.plugins.os.unix.linux.recentlyused) RecentlyUsedRecord (in module dissect.target.plugins.os.unix.linux.recentlyused) Recents (class in acquire.acquire.acquire) reconfigure_log_file() (in module acquire.acquire.log) RECONNECT_WAIT (dissect.target.loaders.remote.RemoteStreamConnection attribute) Record (class in acquire.acquire.collector) (class in dissect.database.ese.record) (class in dissect.eventlog.evt) (class in dissect.target.plugins.os.windows.everything.parser) (class in flow.record.base) (class in flow.record.fieldtypes) record (class in flow.record.fieldtypes) (dissect.clfs.blf.BaseRecord attribute) (dissect.clfs.blf.TruncateRecord attribute) (dissect.database.ese.index.Index attribute) (dissect.database.ese.ntds.objects.object.Object attribute) (dissect.database.ese.record.TagField attribute) (dissect.database.ese.table.Column attribute) (dissect.database.ese.table.Table attribute) (dissect.database.ese.tools.sru.Entry attribute) (dissect.eventlog.evt.Record attribute) (dissect.ntfs.attr.Attribute attribute) (dissect.ntfs.attr.AttributeHeader attribute) (dissect.ntfs.attr.AttributeRecord attribute) (dissect.ntfs.index.Index attribute) (dissect.ntfs.secure.Secure attribute) (dissect.target.plugin.FunctionDescriptor property) (dissect.target.plugins.os.windows.search.TableRecord attribute) (dissect.target.tools.dump.RecordStreamElement attribute) (flow.record.selector.WrappedRecord attribute) record() (dissect.database.ese.cursor.Cursor method) (dissect.target.loaders.mqtt.MqttTransferRatePerSecond method) record_buffer (flow.record.adapter.splunk.SplunkWriter attribute) RECORD_BUFFER_LIMIT (in module flow.record.adapter.splunk) RECORD_CLASS_TEMPLATE (in module flow.record.base) record_count (dissect.target.tools.dump.DumpState property) (dissect.target.tools.dump.Sink attribute) record_descriptor_for_fields (flow.record.stream.RecordFieldRewriter attribute) RECORD_DIFF_RECORD_FIELDS (in module dissect.target.tools.diff) record_length (dissect.ntfs.attr.AttributeHeader property) record_name (dissect.target.plugins.apps.edr.velociraptor.VelociraptorRecordBuilder attribute) RECORD_NAME (dissect.target.plugins.os.unix.log.auth.AuthLogRecordBuilder attribute) (dissect.target.plugins.os.windows.log.etl.EtlRecordBuilder attribute) (dissect.target.plugins.os.windows.log.evtx.EvtxPlugin attribute) (in module dissect.target.plugins.os.unix.linux.services) record_output() (in module dissect.target.tools.query) RECORD_PACK_EXT_TYPE (in module flow.record.packer) RECORD_PACK_TYPE_DATETIME (in module flow.record.packer) RECORD_PACK_TYPE_DESCRIPTOR (in module flow.record.packer) RECORD_PACK_TYPE_FIELDTYPE (in module flow.record.packer) RECORD_PACK_TYPE_GROUPEDRECORD (in module flow.record.packer) RECORD_PACK_TYPE_RECORD (in module flow.record.packer) RECORD_PACK_TYPE_VARINT (in module flow.record.packer) record_stream() (in module flow.record.stream) record_stream_for_path() (flow.record.stream.PathTemplateWriter method) record_to_document() (flow.record.adapter.elastic.ElasticWriter method) record_to_splunk_http_api_json() (in module flow.record.adapter.splunk) record_to_splunk_json() (in module flow.record.adapter.splunk) record_to_splunk_kv_line() (in module flow.record.adapter.splunk) record_to_splunk_tcp_api_json() (in module flow.record.adapter.splunk) RECORD_TYPE (in module dissect.volume.vss) RECORD_TYPE_MAP (in module flow.record.adapter.avro) RECORD_TYPES (in module dissect.target.plugins.filesystem.ntfs.mft) RECORD_VERSION (in module flow.record.base) RecordAdapter() (in module flow.record.base) RecordAdapterNotFound RecordArchiver (class in flow.record.stream) RecordContextMatcher (class in flow.record.selector) RecordCreatedRecord (in module dissect.target.tools.diff) RecordData (class in dissect.database.ese.record) RecordDeletedRecord (in module dissect.target.tools.diff) RecordDescriptor (class in flow.record.base) RecordDescriptorError RecordDescriptorExtensionBase (class in dissect.target.helpers.descriptor_extensions) RecordDescriptorNotFound RecordField (class in flow.record.base) RecordFieldRewriter (class in flow.record.stream) RecordFieldSet (class in flow.record.base) RecordNumber (dissect.eventlog.evt.Record attribute) RecordOutput() (in module flow.record.stream) RecordPacker (class in flow.record.packer) RecordPrinter (class in flow.record.stream) RecordReader() (in module flow.record.base) records (dissect.apfs.objects.fs.INode property) (dissect.fve.bde.eow.EowBitmap property) RECORDS (flow.record.adapter.splunk.SourceType attribute) records (flow.record.base.GroupedRecord attribute) records() (dissect.apfs.objects.fs.FS method) (dissect.clfs.container.Container method) (dissect.database.bsd.db.DB method) (dissect.database.ese.table.Table method) (dissect.database.ese.tools.certlog.CertLog method) (dissect.ntfs.usnjrnl.UsnJrnl method) (dissect.target.plugins.filesystem.ntfs.mft.MftPlugin method) RECORDSTREAM_MAGIC (in module flow.record.base) RECORDSTREAM_MAGIC_DEPTH (in module flow.record.base) RecordStreamElement (class in dissect.target.tools.dump) RecordStreamReader (class in flow.record.stream) RecordStreamWriter (class in flow.record.stream) recordType (flow.record.base.RecordDescriptor attribute) recordtype (flow.record.stream.RecordStreamReader attribute) RecordUnchangedRecord (in module dissect.target.tools.diff) RecordValue (in module dissect.database.ese.util) RecordWrapper (class in dissect.database.ese.tools.impacket) RecordWriter() (in module flow.record.base) recover() (dissect.target.plugins.os.windows.rdpcache.RdpCachePlugin method) recover_quarantined_file_streams() (in module dissect.target.plugins.os.windows.defender.quarantine) recover_string() (in module dissect.target.helpers.scrape) RECOVERY_KEY (dissect.target.helpers.keychain.KeyType attribute) recurse() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (in module dissect.target.helpers.fsutil) recursor() (in module dissect.target.tools.reg) RecycleBin (class in acquire.acquire.acquire) recyclebin() (dissect.target.plugins.os.windows.recyclebin.RecyclebinPlugin method) recyclebin_def (in module dissect.target.plugins.os.windows.recyclebin) recyclebin_filter() (in module acquire.acquire.acquire) recyclebin_paths (dissect.target.plugins.os.windows.recyclebin.RecyclebinPlugin attribute) RecyclebinPlugin (class in dissect.target.plugins.os.windows.recyclebin) RecycleBinRecord (in module dissect.target.plugins.os.windows.recyclebin) RED (dissect.target.helpers.cyber.Color attribute) (dissect.target.tools.shell.AnsiColors attribute) RedHatPlugin (class in dissect.target.plugins.os.unix.linux.redhat._os) ref (dissect.archive.xva.XVAStream attribute) (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) refcnt (dissect.target.plugins.os.unix.linux.modules.Module attribute) reference (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) (dissect.volume.ddf.ddf.PhysicalDiskData attribute) (dissect.volume.ddf.ddf.PhysicalDiskRecord attribute) reference() (dissect.cim.index.Key method) reference_count (dissect.archive.wim.Resource attribute) referenced_fields (flow.record.selector.SelectorResult attribute) ReferenceNotFoundError references (dissect.hypervisor.descriptor.ovf.OVF attribute) references() (dissect.cim.index.Key method) REFS (dissect.target.plugins.os.windows.everything.parser.EverythingFSType attribute) REG (dissect.target.helpers.nfs.nfs3.FileType attribute) REG_BINARY (in module dissect.regf.c_regf) REG_DWORD (in module dissect.regf.c_regf) REG_DWORD_BIG_ENDIAN (in module dissect.regf.c_regf) REG_EXPAND_SZ (in module dissect.regf.c_regf) REG_FULL_RESOURCE_DESCRIPTOR (in module dissect.regf.c_regf) reg_keys (dissect.target.plugins.os.windows.env.EnvVarDetails attribute) REG_LINK (in module dissect.regf.c_regf) REG_MULTI_SZ (in module dissect.regf.c_regf) REG_NONE (in module dissect.regf.c_regf) REG_QWORD (in module dissect.regf.c_regf) REG_RESOURCE_LIST (in module dissect.regf.c_regf) REG_RESOURCE_REQUIREMENTS_LIST (in module dissect.regf.c_regf) REG_SZ (in module dissect.regf.c_regf) reg_value (dissect.target.plugins.os.windows.env.EnvVarDetails attribute) REGEX_IPV4 (in module flow.record.tools.geoip) REGEX_PACKAGE_NAMES (in module dissect.target.plugins.os.unix.linux.debian.apt) regf() (dissect.target.plugins.os.windows.regf.regf.RegfPlugin method) regf_def (in module dissect.regf.c_regf) RegfHive (class in dissect.target.helpers.regutil) RegfKey (class in dissect.target.helpers.regutil) RegFlex (class in dissect.target.helpers.regutil) RegFlexHive (class in dissect.target.helpers.regutil) RegFlexKey (class in dissect.target.helpers.regutil) RegFlexValue (class in dissect.target.helpers.regutil) RegfPlugin (class in dissect.target.plugins.os.windows.regf.regf) RegfValue (class in dissect.target.helpers.regutil) region_offset (dissect.fve.bde.eow.EowBitmap property) region_size (dissect.fve.bde.eow.EowBitmap property) (dissect.volume.lvm.metadata.MirrorSegment attribute) (dissect.volume.lvm.metadata.RAIDSegment attribute) region_table (dissect.hypervisor.disk.vhdx.VHDX attribute) region_tables (dissect.hypervisor.disk.vhdx.VHDX attribute) RegionTable (class in dissect.hypervisor.disk.vhdx) register() (acquire.acquire.uploaders.plugin_registry.PluginRegistry method) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager method) (flow.record.jsonpacker.JsonRecordPacker method) (flow.record.packer.RecordPacker method) (in module dissect.target.container) (in module dissect.target.filesystem) (in module dissect.target.loader) (in module dissect.target.plugin) register_aliases() (dissect.target.tools.shell.ExtendedCmd method) register_key() (in module dissect.target.helpers.keychain) register_keychain_file() (in module dissect.target.helpers.keychain) register_module() (in module acquire.acquire.acquire) register_wildcard_value() (in module dissect.target.helpers.keychain) registered (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager property) REGISTERED_PLUGIN (dissect.target.target.Event attribute) registered_plugins (dissect.target.tools.utils.report.TargetExecutionReport attribute) RegistrationTrigger (in module dissect.target.plugins.os.windows.tasks.records) registry (acquire.acquire.collector.CollectionReport attribute) Registry (class in acquire.acquire.acquire) registry (dissect.target.tools.shell.RegistryCli attribute) registry() (dissect.target.plugins.os.windows.cam.CamPlugin method) RegistryCli (class in dissect.target.tools.shell) RegistryCorruptError RegistryError RegistryGuid (in module dissect.etl.utils) RegistryHive (class in dissect.regf.regf) (class in dissect.target.helpers.regutil) RegistryKey (class in dissect.target.helpers.regutil) RegistryKeyNotFoundError, [1] RegistryKeyNotFoundException RegistryKeyRecord (in module dissect.target.plugins.os.windows.regf.regf) RegistryPlugin (class in dissect.target.plugins.os.windows.registry) RegistryRecordDescriptorExtension (class in dissect.target.helpers.descriptor_extensions) RegistryValue (class in dissect.target.helpers.regutil) RegistryValueNotFoundError, [1] RegistryValueRecord (in module dissect.target.plugins.os.windows.regf.regf) RegistryValueType (class in dissect.target.helpers.regutil) REGKEY_GLOBS (dissect.target.plugins.os.windows.regf.appxdebugkeys.AppxDebugKeysPlugin attribute) REGULAR_1822 (dissect.target.plugins.os.windows.network.IfTypes attribute) RejectedReply (class in dissect.target.helpers.sunrpc.sunrpc) RejectStat (class in dissect.target.helpers.sunrpc.sunrpc) RELATED_ACTIVITY_ID (dissect.etl.headers.event.ExtType attribute) related_sections() (dissect.executable.elf.elf.SectionTable method) related_segments() (dissect.executable.elf.elf.SegmentTable method) relative (dissect.archive.wim.ReparsePoint property) (dissect.ntfs.attr.ReparsePoint property) relative_inum (dissect.xfs.xfs.INode attribute) relative_offset (dissect.volume.vss.BlockDescriptor attribute) relative_path (dissect.target.loaders.itunes.FileInfo attribute) relative_to() (dissect.target.helpers.compat.path_310.PureDissectPath method) (dissect.target.helpers.compat.path_311.PureDissectPath method) RelativeStream (class in dissect.util.stream) release (dissect.database.bsd.tools.rpm.Package property) release() (dissect.target.helpers.mount.DissectMount method) releasedir() (dissect.target.helpers.mount.DissectMount method) reload() (dissect.target.target.Target method) relpath() (in module dissect.target.helpers.polypath) rem_address (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) remainder (dissect.etl.headers.headers.Marker property) REMAINDER_MASK (dissect.etl.headers.headers.Marker attribute) remote_ip (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) remote_port (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) RemoteAccess (class in acquire.acquire.acquire) RemoteAccessFileTransferRecord (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin attribute) (dissect.target.plugins.apps.remoteaccess.splashtop.SplashtopPlugin attribute) (in module dissect.target.plugins.apps.remoteaccess.remoteaccess) RemoteAccessLogRecord (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin attribute) (dissect.target.plugins.apps.remoteaccess.rustdesk.RustdeskPlugin attribute) (dissect.target.plugins.apps.remoteaccess.splashtop.SplashtopPlugin attribute) (dissect.target.plugins.apps.remoteaccess.teamviewer.TeamViewerPlugin attribute) (in module dissect.target.plugins.apps.remoteaccess.remoteaccess) RemoteAccessPlugin (class in dissect.target.plugins.apps.remoteaccess.remoteaccess) RemoteLoader (class in dissect.target.loaders.remote) RemoteStream (class in dissect.target.loaders.remote) RemoteStreamConnection (class in dissect.target.loaders.remote) removal_time (dissect.volume.lvm.metadata.HistoricalLogicalVolume attribute) Remove (dissect.target.plugins.os.unix.packagemanager.OperationTypes attribute) remove() (acquire.acquire.uploaders.plugin_registry.PluginRegistry method) (dissect.util.stream.BitStream method) remove_fs_layer() (dissect.target.filesystem.LayerFilesystem method) remove_handler() (flow.record.utils.EventHandler method) remove_layer() (dissect.target.filesystem.LayerFilesystem method) REMOVING (dissect.target.plugins.apps.container.podman.ContainerState attribute) rename() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) render_stacktrace_only_in_debug_or_less() (in module dissect.target.tools.utils.logging) repair_checksum() (in module dissect.util.compression.xz) reparse_point (dissect.archive.wim.DirectoryEntry property) reparse_point_name (dissect.ntfs.mft.MftRecord property) reparse_point_record (dissect.ntfs.mft.MftRecord property) reparse_point_substitute_name (dissect.ntfs.mft.MftRecord property) ReparsePoint (class in dissect.archive.wim) (class in dissect.ntfs.attr) replace() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) replace_dash_with_none() (in module dissect.target.plugins.apps.webserver.iis) REPLACE_LIST (in module flow.record.adapter.text) REPLACEMENTS (in module dissect.target.plugins.filesystem.resolver) replay_logs (dissect.hypervisor.descriptor.hyperv.HyperVFile attribute) ReplicaNotInstantiated (dissect.database.ese.ntds.util.InstanceType attribute) ReplicatedToGlobalCatalog (dissect.database.ese.ntds.util.SystemFlags attribute) REPLY (dissect.target.helpers.sunrpc.serializer.MessageType attribute) ReplyStat (class in dissect.target.helpers.sunrpc.serializer) repo() (dissect.target.plugins.os.windows.cim.CimPlugin method) report (acquire.acquire.collector.Collector attribute) ReproDebugEntry (class in dissect.executable.pe.directory.debug) reprsid() (in module dissect.eventlog.evt) request_attributes() (dissect.target.plugins.os.windows.certlog.CertLogPlugin method) REQUEST_DISPOSITION (in module dissect.database.ese.tools.certlog) REQUEST_STATUS_CODE (in module dissect.database.ese.tools.certlog) REQUEST_TYPE (in module dissect.database.ese.tools.certlog) RequestAttributeRecord (in module dissect.target.plugins.os.windows.certlog) RequestRecord (in module dissect.target.plugins.os.windows.certlog) requests() (dissect.target.plugins.os.windows.certlog.CertLogPlugin method) required_privileges (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) requirements (dissect.fve.luks.metadata.Config attribute) reserved (acquire.acquire.dynamic.windows.types.Handle attribute) (acquire.acquire.dynamic.windows.types.SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX property) (dissect.hypervisor.disk.asif.DataStream attribute) reserved1 (dissect.etl.headers.event.EventHeaderExtendedDataItem attribute) reserved2 (dissect.etl.headers.event.EventHeaderExtendedDataItem attribute) RESERVED_255 (dissect.target.helpers.network.IANAProtocol attribute) RESERVED_FIELDS (in module flow.record.adapter.splunk) (in module flow.record.base) RESERVED_IDX (in module dissect.evidence.asdf.asdf) RESERVED_RDUMP_FIELDS (in module flow.record.adapter.splunk) reserved_regions() (dissect.fve.bde.bde.BDE method) RESERVED_SPLUNK_APP_FIELDS (in module flow.record.adapter.splunk) RESERVED_SPLUNK_FIELDS (in module flow.record.adapter.splunk) ReservedFlags (class in dissect.etl.headers.logfile) RESET (dissect.target.tools.shell.AnsiColors attribute) reset() (acquire.acquire.esxi.EsxiMemoryManager method) (dissect.apfs.cursor.Cursor method) (dissect.btrfs.tree.Cursor method) (dissect.cstruct.bitbuffer.BitBuffer method) (dissect.database.ese.btree.BTree method) (dissect.database.ese.cursor.Cursor method) reset_flags() (dissect.cstruct.parser.TokenConsumer method) ResFile (class in dissect.target.loaders.res) reshape_count (dissect.volume.lvm.metadata.Segment attribute) RESHDR_FLAG (in module dissect.archive.c_wim) resident (dissect.ntfs.attr.Attribute property) (dissect.ntfs.attr.AttributeHeader property) (dissect.ntfs.mft.MftRecord property) ResLoader (class in dissect.target.loaders.res) RESOLVE (dissect.target.helpers.record_modifier.Modifier attribute) resolve() (dissect.cstruct.cstruct.cstruct method) (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) (dissect.target.plugins.filesystem.resolver.ResolverPlugin method) resolve_address() (dissect.vmfs.resource.FileBlockResourceVMFS5 method) (dissect.vmfs.resource.LargeFileBlockResourceVMFS6 method) (dissect.vmfs.resource.ResourceFile method) (dissect.vmfs.resource.SmallFileBlockResourceVMFS6 method) resolve_attr_path() (in module flow.record.selector) resolve_default() (dissect.target.plugins.filesystem.resolver.ResolverPlugin method) resolve_fs() (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj method) resolve_glob_path() (dissect.target.tools.shell.TargetCli method) resolve_id() (dissect.database.ese.tools.sru.SRU method) resolve_key() (dissect.target.tools.shell.RegistryCli method) resolve_link() (in module dissect.target.helpers.fsutil) resolve_path (dissect.btrfs.btrfs.Subvolume attribute) resolve_path() (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj method) (dissect.target.tools.shell.TargetCli method) resolve_windows() (dissect.target.plugins.filesystem.resolver.ResolverPlugin method) resolved_config_paths (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) ResolveError ResolverPlugin (class in dissect.target.plugins.filesystem.resolver) ResOSPlugin (class in dissect.target.loaders.res) Resource (class in dissect.archive.wim) (class in dissect.executable.pe.directory.resource) resource (dissect.vmfs.address.FileDescriptorAddr property) (dissect.vmfs.address.JournalBlockAddr property) (dissect.vmfs.address.PointerBlockAddr property) (dissect.vmfs.address.PointerBlockAddr64 property) (dissect.vmfs.address.SmallFileBlockAddr property) (dissect.vmfs.address.SubBlockAddr property) (dissect.vmfs.address.SubBlockAddr64 property) resource_id (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntryResource attribute) RESOURCE_LIST (dissect.target.helpers.regutil.RegistryValueType attribute) RESOURCE_REQUIREMENTS_LIST (dissect.target.helpers.regutil.RegistryValueType attribute) RESOURCE_TYPE_ABBREVIATIONS (in module dissect.vmfs.resource) RESOURCE_TYPE_MAP_VMFS5 (in module dissect.vmfs.resource) RESOURCE_TYPE_MAP_VMFS6 (in module dissect.vmfs.resource) ResourceDataEntry (class in dissect.executable.pe.directory.resource) ResourceDirectory (class in dissect.executable.pe.directory.resource) ResourceDirectoryEntry (class in dissect.executable.pe.directory.resource) ResourceEntry (class in dissect.executable.pe.directory.resource) ResourceFile (class in dissect.vmfs.resource) ResourceManager (class in dissect.vmfs.resource) resources (dissect.archive.wim.WIM property) (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.pe.PE property) (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntry attribute) (dissect.vmfs.resource.ResourceManager attribute) (dissect.vmfs.vmfs.VMFS attribute) restansmit (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) restart_on_failure_count (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) restart_on_failure_interval (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) result (acquire.acquire.gui.win32.Win32 attribute) (dissect.target.helpers.sunrpc.sunrpc.RejectedReply attribute) (flow.record.selector.SelectorResult attribute) ResultDeserializer (class in dissect.target.helpers.nfs.serializer) results (dissect.target.helpers.sunrpc.sunrpc.AcceptedReply attribute) Results (in module dissect.target.helpers.sunrpc.client) results() (dissect.target.plugins.apps.edr.velociraptor.VelociraptorPlugin method) results_dir (dissect.target.plugins.apps.edr.velociraptor.VelociraptorPlugin attribute) ResultType (in module dissect.target.helpers.nfs.serializer) retries (dissect.target.loaders.mqtt.MqttConnection attribute) reveal_text (acquire.acquire.gui.win32.Win32 attribute) reverse (dissect.volume.vss.BlockMap attribute) reverse() (dissect.cim.mappings.Mapping method) reverse_read() (in module dissect.target.helpers.fsutil) reverse_readlines() (in module dissect.target.helpers.fsutil) reverse_search() (in module dissect.target.loaders.res) revision (dissect.database.ese.ntds.sd.ACL property) (dissect.executable.pe.directory.security.Certificate property) rewrite() (flow.record.stream.RecordFieldRewriter method) REWRITE_CACHE (in module dissect.target.helpers.cache) RFC1483 (dissect.target.plugins.os.windows.network.IfTypes attribute) rfc4716_def (in module dissect.target.plugins.apps.ssh.ssh) RFC4716_MAGIC (in module dissect.target.plugins.apps.ssh.ssh) RFC4716_MARKER_END (in module dissect.target.plugins.apps.ssh.ssh) RFC4716_MARKER_START (in module dissect.target.plugins.apps.ssh.ssh) RFC4716_NONE (in module dissect.target.plugins.apps.ssh.ssh) RFC4716_PADDING (in module dissect.target.plugins.apps.ssh.ssh) RFC877_X25 (dissect.target.plugins.os.windows.network.IfTypes attribute) rglob() (dissect.target.helpers.compat.path_313.TargetPath method) rid (dissect.database.ese.ntds.objects.object.Object property) rid_to_key() (in module dissect.target.plugins.os.windows.sam) RIDManager (class in dissect.database.ese.ntds.objects.ridmanager) RIDSet (class in dissect.database.ese.ntds.objects.ridset) RIGHT_ASYMMETRIC (dissect.volume.raid.stream.Layout attribute) RIGHT_ASYMMETRIC_6 (dissect.volume.raid.stream.Layout attribute) right_page (dissect.database.sqlite3.sqlite3.Page attribute) right_sibling (dissect.ole.ole.DirectoryEntry property) RIGHT_SYMMETRIC (dissect.volume.raid.stream.Layout attribute) RIGHT_SYMMETRIC_6 (dissect.volume.raid.stream.Layout attribute) rmdir() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) rmem (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) ROHC (dissect.target.helpers.network.IANAProtocol attribute) role (dissect.apfs.objects.fs.FS property) (dissect.fve.bde.information.Datum property) role_access() (dissect.target.plugins.os.windows.ual.UalPlugin method) role_guid_map (dissect.target.plugins.os.windows.ual.UalPlugin attribute) RoleAccessRecord (in module dissect.target.plugins.os.windows.ual) root (acquire.acquire.dynamic.windows.named_objects.NamedObject attribute) (dissect.apfs.objects.btree.BTree attribute) (dissect.apfs.objects.fs.FS attribute) (dissect.archive.vbk.MetaBlob attribute) (dissect.archive.vbk.RootDirectory attribute) (dissect.archive.vbk.SubFolderItem attribute) (dissect.archive.vbk.VBK attribute) (dissect.archive.wim.Image attribute) (dissect.btrfs.btrfs.Btrfs attribute) (dissect.btrfs.btrfs.Subvolume property) (dissect.cim.cim.CIM attribute) (dissect.cramfs.cramfs.CramFS attribute) (dissect.database.ese.btree.BTree attribute) (dissect.database.ese.index.Index property) (dissect.database.ese.table.Table property) (dissect.evidence.ad1.ad1.AD1 attribute) (dissect.extfs.extfs.ExtFS attribute) (dissect.fat.fat.FATFS attribute) (dissect.ffs.ffs.FFS attribute) (dissect.hypervisor.descriptor.hyperv.HyperVFile attribute) (dissect.jffs.jffs2.JFFS2 attribute) (dissect.ntfs.index.Index attribute) (dissect.ntfs.mft.Mft property) (dissect.ole.ole.OLE attribute) (dissect.qnxfs.qnx4.QNX4 attribute) (dissect.qnxfs.qnx6.QNX6 attribute) (dissect.squashfs.squashfs.SquashFS attribute) (dissect.target.filesystem.LayerFilesystem attribute) (dissect.target.filesystem.VirtualFilesystem attribute) (dissect.target.loaders.itunes.ITunesBackup attribute) (dissect.target.plugins.os.unix.linux.proc.ProcProcess attribute) (dissect.vmfs.vmfs.VMFS attribute) (dissect.volume.dm.btree.BTree attribute) (dissect.xfs.xfs.XFS attribute) root() (dissect.database.ese.ntds.database.DataTable method) (dissect.database.ese.ntds.ntds.NTDS method) (dissect.regf.regf.RegistryHive method) (dissect.target.helpers.regutil.RegfHive method) (dissect.target.helpers.regutil.RegistryHive method) (dissect.target.plugins.os.windows.registry.RegistryPlugin method) root_cause_str() (dissect.target.exceptions.UnsupportedPluginError method) root_dir_cluster (dissect.fat.exfat.ExFAT attribute) root_dir_sector (dissect.fat.exfat.ExFAT attribute) root_directory (dissect.fat.exfat.ExFAT attribute) root_dirs (acquire.acquire.acquire.History.DirCombinations attribute) root_domain() (dissect.database.ese.ntds.database.DataTable method) (dissect.database.ese.ntds.ntds.NTDS method) ROOT_FOLDER (class in dissect.target.plugins.os.windows.regf.shellbags) root_item (dissect.btrfs.tree.BTree attribute) root_key (dissect.target.loaders.cb.CbRegistryHive attribute) root_manifest_path (dissect.target.plugins.apps.productivity.msoffice.ClickOnceDeploymentManifestParser attribute) ROOT_NAMESPACE_NAME (in module dissect.cim.c_cim) root_offset (dissect.btrfs.tree.BTree attribute) root_page (dissect.cim.index.Store attribute) (dissect.database.ese.table.Catalog attribute) (dissect.database.ese.table.Table attribute) root_tree (dissect.apfs.objects.fs.FS property) RootDirectory (class in dissect.archive.vbk) (class in dissect.fat.fat) RootDirEntry (class in dissect.target.filesystem) RootFilesystem (class in dissect.target.filesystem) RootFilesystemEntry (class in dissect.target.filesystem) rotate_existing_file() (flow.record.stream.PathTemplateWriter method) rotate_parity_count (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) ROTATING_N_CONTINUE (dissect.volume.raid.stream.Layout attribute) ROTATING_N_RESTART (dissect.volume.raid.stream.Layout attribute) ROTATING_ZERO_RESTART (dissect.volume.raid.stream.Layout attribute) rounds (dissect.hypervisor.descriptor.vmx.Phrase attribute) Row (class in dissect.database.sqlite3.sqlite3) row() (dissect.database.sqlite3.sqlite3.Table method) rows() (dissect.database.sqlite3.sqlite3.Table method) RPC_MISMATCH (dissect.target.helpers.sunrpc.sunrpc.RejectStat attribute) rpc_version (dissect.target.helpers.sunrpc.sunrpc.CallBody attribute) RpcContainer (class in dissect.database.ese.ntds.objects.rpccontainer) rpm_def (in module dissect.database.bsd.tools.c_rpm) RRASAdministrationDictionary (class in dissect.database.ese.ntds.objects.rrasadministrationdictionary) RS232 (dissect.target.plugins.os.windows.network.IfTypes attribute) RSRB (dissect.target.plugins.os.windows.network.IfTypes attribute) rsrc (dissect.executable.pe.directory.resource.ResourceEntry attribute) RSVP (dissect.target.helpers.network.IANAProtocol attribute) RSVP_E2E_IGNORE (dissect.target.helpers.network.IANAProtocol attribute) RtlNtStatusToDosError (in module acquire.acquire.dynamic.windows.ntdll) RULE_KEYS (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin attribute) rules() (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin method) Run (in module dissect.fve.bde.bde) run() (acquire.acquire.acquire.FileHashes class method) (acquire.acquire.acquire.Module class method) (acquire.acquire.acquire.OpenHandles class method) (acquire.acquire.acquire.SSH class method) (dissect.target.plugins.os.windows.regf.mru.MRUPlugin method) run_as (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) run_cli() (in module dissect.target.tools.shell) RUN_ENCRYPTED (dissect.fve.bde.bde.BitlockerStream attribute) run_level (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) run_only_idle (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) run_only_network_available (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) RUN_PLAIN (dissect.fve.bde.bde.BitlockerStream attribute) RUN_SPARSE (dissect.fve.bde.bde.BitlockerStream attribute) RUN_VISTA_HEADER (dissect.fve.bde.bde.BitlockerStream attribute) RunKeyRecord (in module dissect.target.plugins.os.windows.regf.runkeys) runkeys() (dissect.target.plugins.os.windows.regf.runkeys.RunKeysPlugin method) RunKeysPlugin (class in dissect.target.plugins.os.windows.regf.runkeys) runlist (dissect.ntfs.stream.CompressedRunlistStream property) (dissect.util.stream.RunlistStream property) runlist() (dissect.fat.exfat.ExFAT method) (dissect.fat.fat.FAT method) RunlistStream (class in dissect.util.stream) RunMRURecord (in module dissect.target.plugins.os.windows.regf.mru) RUNNING (dissect.target.plugins.apps.container.podman.ContainerState attribute) runs (dissect.vmfs.lvm.VolumeStream attribute) runs() (dissect.fve.bde.eow.EowBitmap method) (dissect.fve.bde.eow.EowBitmapRecord method) runtime (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) RustdeskPlugin (class in dissect.target.plugins.apps.remoteaccess.rustdesk) rva (dissect.executable.pe.directory.basereloc.BaseRelocation attribute) RVD (dissect.target.helpers.network.IANAProtocol attribute) rx_queue (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) S S (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) sacl (dissect.database.ese.ntds.sd.SecurityDescriptor attribute) (dissect.ntfs.secure.SecurityDescriptor attribute) SafariPlugin (class in dissect.target.plugins.apps.browser.safari) salt (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher attribute) (dissect.fve.bde.information.StretchKeyDatum property) (dissect.fve.luks.metadata.Digest attribute) (dissect.fve.luks.metadata.KeyslotKdf attribute) (dissect.hypervisor.descriptor.vmx.Phrase attribute) (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) sam() (dissect.target.plugins.os.windows.sam.SamPlugin method) sam_account_name (dissect.database.ese.ntds.objects.group.Group property) (dissect.database.ese.ntds.objects.user.User property) sam_account_type (dissect.database.ese.ntds.objects.user.User property) SAM_ALIAS_OBJECT (dissect.database.ese.ntds.util.SAMAccountType attribute) SAM_APP_BASIC_GROUP (dissect.database.ese.ntds.util.SAMAccountType attribute) SAM_APP_QUERY_GROUP (dissect.database.ese.ntds.util.SAMAccountType attribute) sam_def (in module dissect.target.plugins.os.windows.sam) SAM_DOMAIN_OBJECT (dissect.database.ese.ntds.util.SAMAccountType attribute) SAM_GROUP_OBJECT (dissect.database.ese.ntds.util.SAMAccountType attribute) SAM_KEY (dissect.target.plugins.os.windows.sam.SamPlugin attribute) SAM_MACHINE_ACCOUNT (dissect.database.ese.ntds.util.SAMAccountType attribute) SAM_NON_SECURITY_ALIAS_OBJECT (dissect.database.ese.ntds.util.SAMAccountType attribute) SAM_NON_SECURITY_GROUP_OBJECT (dissect.database.ese.ntds.util.SAMAccountType attribute) SAM_TRUST_ACCOUNT (dissect.database.ese.ntds.util.SAMAccountType attribute) SAM_USER_OBJECT (dissect.database.ese.ntds.util.SAMAccountType attribute) SAMAccountType (class in dissect.database.ese.ntds.util) SamPlugin (class in dissect.target.plugins.os.windows.sam) SamRecord (in module dissect.target.plugins.os.windows.sam) SamServer (class in dissect.database.ese.ntds.objects.samserver) sanitize_fieldvalues() (in module flow.record.adapter.xlsx) SAT_EXPAK (dissect.target.helpers.network.IANAProtocol attribute) SAT_MON (dissect.target.helpers.network.IANAProtocol attribute) sb (dissect.apfs.apfs.APFS attribute) (dissect.btrfs.btrfs.Btrfs attribute) (dissect.cramfs.cramfs.CramFS attribute) (dissect.extfs.extfs.ExtFS attribute) (dissect.extfs.journal.JDB2 attribute) (dissect.ffs.ffs.FFS attribute) (dissect.qnxfs.qnx6.QNX6 attribute) (dissect.squashfs.squashfs.SquashFS attribute) SB (dissect.vmfs.resource.ResourceManager property) sb (dissect.volume.dm.thin.Metadata attribute) (dissect.xfs.xfs.AllocationGroup attribute) (dissect.xfs.xfs.XFS attribute) sb() (dissect.hypervisor.disk.vhdx.BlockAllocationTable method) sb2 (dissect.qnxfs.qnx6.QNX6 attribute) SBLOCKSEARCH (in module dissect.ffs.ffs) sbs (dissect.apfs.apfs.APFS attribute) scan_id (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntry attribute) scandir() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.apfs.ApfsFilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry method) (dissect.target.filesystems.cb.CbFilesystemEntry method) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.exfat.ExfatFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.fat.FatFilesystemEntry method) (dissect.target.filesystems.ffs.FfsFilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemEntry method) (dissect.target.filesystems.jffs.JffsFilesystemEntry method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.ntds.NtdsFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry method) (dissect.target.filesystems.smb.SmbFilesystemEntry method) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystemEntry method) (dissect.target.filesystems.vbk.VbkFilesystemEntry method) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystemEntry method) (dissect.target.tools.diff.TargetComparison method) (dissect.target.tools.shell.RegistryCli method) (in module dissect.target.helpers.compat.path_common) SCC_SP (dissect.target.helpers.network.IANAProtocol attribute) SchedLgU (class in dissect.target.plugins.os.windows.log.schedlgu) schedlgu() (dissect.target.plugins.os.windows.log.schedlgu.SchedLgUPlugin method) SCHEDLGU_REGEX_PATTERN (in module dissect.target.plugins.os.windows.log.schedlgu) SchedLgUPlugin (class in dissect.target.plugins.os.windows.log.schedlgu) SchedLgURecord (in module dissect.target.plugins.os.windows.log.schedlgu) ScheduledTasks (class in dissect.target.plugins.os.windows.tasks.xml) Schema (class in dissect.database.ese.ntds.schema) schema (dissect.database.ese.ntds.database.DataTable attribute) (flow.record.adapter.avro.AvroReader attribute) (flow.record.adapter.avro.AvroWriter attribute) schema_to_descriptor() (in module flow.record.adapter.avro) scheme (dissect.volume.disk.disk.Disk attribute) (flow.record.fieldtypes.uri property) scope() (in module dissect.target.tools.inspect) ScopeManager (class in dissect.target.helpers.configutil) SCPS (dissect.target.helpers.network.IANAProtocol attribute) scrape_blocks() (in module dissect.evidence.asdf.asdf) scrape_chunks() (in module dissect.target.helpers.scrape) scrape_chunks_from_disks() (dissect.target.plugins.scrape.scrape.ScrapePlugin method) scrape_needles_from_disks() (dissect.target.plugins.scrape.scrape.ScrapePlugin method) scrape_pos() (in module dissect.target.loaders.phobos) scraped_evt() (dissect.target.plugins.os.windows.log.evt.EvtPlugin method) scraped_evtx() (dissect.target.plugins.os.windows.log.evtx.EvtxPlugin method) ScrapePlugin (class in dissect.target.plugins.scrape.scrape) SCRIPT (class in dissect.database.ese.lcmapstring) (dissect.database.ese.ntds.util.UserAccountControl attribute) SCTP (dissect.target.helpers.network.IANAProtocol attribute) SD (class in dissect.volume.vinum.config) sd (dissect.database.ese.ntds.database.Database attribute) (dissect.database.ese.ntds.objects.object.Object property) sd() (dissect.database.ese.ntds.database.SecurityDescriptorTable method) sd_def (in module dissect.database.ese.ntds.c_sd) sdl (dissect.executable.pe.directory.debug.VcFeatureDebugEntry property) SDLC (dissect.target.plugins.os.windows.network.IfTypes attribute) sdp_cpu_provider() (dissect.target.plugins.os.windows.sru.SRUPlugin method) sdp_network_provider() (dissect.target.plugins.os.windows.sru.SRUPlugin method) sdp_physical_disk_provider() (dissect.target.plugins.os.windows.sru.SRUPlugin method) sdp_volume_provider() (dissect.target.plugins.os.windows.sru.SRUPlugin method) SdpCpuProviderRecord (in module dissect.target.plugins.os.windows.sru) SdpNetworkProviderRecord (in module dissect.target.plugins.os.windows.sru) SdpPhysicalDiskProviderRecord (in module dissect.target.plugins.os.windows.sru) SdpVolumeProviderRecord (in module dissect.target.plugins.os.windows.sru) SDRP (dissect.target.helpers.network.IANAProtocol attribute) sds (dissect.ntfs.secure.Secure attribute) (dissect.volume.vinum.config.VinumConfigs attribute) (dissect.volume.vinum.vinum.Config attribute) (dissect.volume.vinum.vinum.VinumPlexDisk attribute) SDSL (dissect.target.plugins.os.windows.network.IfTypes attribute) SDState (class in dissect.volume.vinum.config) search() (dissect.apfs.cursor.Cursor method) (dissect.apfs.objects.btree.BTree method) (dissect.btrfs.tree.Cursor method) (dissect.database.ese.btree.BTree method) (dissect.database.ese.cursor.Cursor method) (dissect.database.ese.index.Index method) (dissect.database.ese.ntds.database.DataTable method) (dissect.database.ese.ntds.ntds.NTDS method) (dissect.database.ese.table.Table method) (dissect.ntfs.index.Index method) (dissect.target.plugins.os.windows.search.SearchIndexPlugin method) search_flags (dissect.database.ese.ntds.schema.AttributeEntry attribute) search_key() (dissect.database.ese.cursor.Cursor method) (dissect.database.ese.index.Index method) SearchFilter (class in dissect.util.ldap) SearchFlags (class in dissect.database.ese.ntds.util) SearchIndexActivityRecord (in module dissect.target.plugins.os.windows.search) SearchIndexPlugin (class in dissect.target.plugins.os.windows.search) SearchIndexRecord (in module dissect.target.plugins.os.windows.search) SearchIndexRecords (in module dissect.target.plugins.os.windows.search) secondary_element_count (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) secondary_element_seq (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) secondary_header (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) secondary_header_offset (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) SECONDARY_HEADER_OFFSETS (in module dissect.fve.luks.c_luks) secondary_raid_level (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) seconds (dissect.target.helpers.nfs.nfs3.NfsTime attribute) Secret (class in dissect.database.ese.ntds.objects.secret) secrets() (dissect.target.plugins.os.windows.lsa.LSAPlugin method) sect (dissect.ole.ole.Chain attribute) SECTION (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) Section (class in dissect.executable.elf.elf) (class in dissect.executable.pe.pe) section (dissect.evidence.ewf.ewf.HeaderSection attribute) (dissect.evidence.ewf.ewf.TableSection attribute) (dissect.evidence.ewf.ewf.VolumeSection attribute) (dissect.executable.pe.pe.SectionStream attribute) SectionDescriptor (class in dissect.evidence.ewf.ewf) sections (dissect.evidence.ewf.ewf.Segment attribute) (dissect.executable.elf.elf.ELF attribute) (dissect.executable.pe.pe.PE attribute) (dissect.target.plugins.os.unix.linux.network_managers.Parser attribute) (dissect.target.plugins.os.unix.linux.network_managers.Template attribute) SectionStream (class in dissect.executable.pe.pe) SectionTable (class in dissect.executable.elf.elf) sector_count (dissect.evidence.ewf.ewf.Segment attribute) (dissect.evidence.ewf.ewf.TableSection attribute) (dissect.evidence.ewf.ewf.VolumeSection attribute) (dissect.hypervisor.disk.vmdk.RawDisk attribute) (dissect.hypervisor.disk.vmdk.SparseDisk attribute) (dissect.hypervisor.disk.vmdk.VMDK attribute) sector_offset (dissect.evidence.ewf.ewf.Segment attribute) (dissect.evidence.ewf.ewf.TableSection attribute) (dissect.hypervisor.disk.vmdk.RawDisk attribute) (dissect.hypervisor.disk.vmdk.SparseDisk attribute) SECTOR_SHIFT (in module dissect.ntfs.c_ntfs) sector_size (dissect.btrfs.btrfs.Btrfs attribute) (dissect.btrfs.stream.ExtentStream attribute) (dissect.evidence.ewf.ewf.EWFStream attribute) (dissect.evidence.ewf.ewf.VolumeSection attribute) (dissect.fat.exfat.ExFAT attribute) (dissect.fat.fat.FATFS attribute) (dissect.fve.bde.bde.BDE property) (dissect.fve.bde.bde.BitlockerStream attribute) (dissect.fve.bde.bde.BootSector attribute) (dissect.fve.crypto.base.Cipher attribute) (dissect.fve.crypto.Cipher attribute) (dissect.fve.crypto.dmcrypt.CryptStream attribute) (dissect.fve.luks.metadata.KeyslotArea attribute) (dissect.fve.luks.metadata.Segment attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) (dissect.ole.ole.ChainStream attribute) (dissect.ole.ole.OLE attribute) (dissect.target.loaders.mqtt.DiskMessage attribute) (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) (dissect.volume.disk.disk.Disk attribute) (dissect.volume.disk.schemes.apm.APM attribute) (dissect.volume.disk.schemes.bsd.BSD attribute) (dissect.volume.disk.schemes.gpt.GPT attribute) (dissect.volume.disk.schemes.mbr.MBR attribute) SECTOR_SIZE (in module dissect.clfs.c_clfs) (in module dissect.hypervisor.disk.c_hdd) (in module dissect.hypervisor.disk.c_vhd) (in module dissect.hypervisor.disk.c_vmdk) (in module dissect.ntfs.c_ntfs) (in module dissect.volume.dm.c_dm) (in module dissect.volume.lvm.c_lvm2) (in module dissect.volume.md.c_md) (in module dissect.volume.vinum.c_vinum) sector_size_shift (dissect.ntfs.ntfs.NTFS attribute) sector_to_cluster() (dissect.fat.exfat.ExFAT method) sectors (dissect.hypervisor.disk.vmdk.DiskDescriptor attribute) (dissect.hypervisor.disk.vmdk.ExtentDescriptor attribute) (dissect.volume.md.md.MDPhysicalDisk attribute) sectors_per_bit (dissect.volume.lvm.metadata.IntegritySegment attribute) sectors_per_block (dissect.apfs.apfs.APFS property) Secure (class in dissect.ntfs.secure) secure (dissect.ntfs.ntfs.NTFS attribute) SECURE_VMTP (dissect.target.helpers.network.IANAProtocol attribute) security (dissect.archive.wim.Image attribute) (dissect.executable.pe.pe.PE property) security_cookie (dissect.executable.pe.directory.load_config.LoadConfigDirectory property) security_descriptor (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) security_id (dissect.ntfs.attr.StandardInformation property) SECURITY_POLICY_KEY (dissect.target.plugins.os.windows.lsa.LSAPlugin attribute) SecurityBlock (class in dissect.archive.wim) SecurityDescriptor (class in dissect.database.ese.ntds.sd) (class in dissect.ntfs.secure) SecurityDescriptorTable (class in dissect.database.ese.ntds.database) SecurityDirectory (class in dissect.executable.pe.directory.security) SecurityObject (class in dissect.database.ese.ntds.objects.securityobject) seek (dissect.hypervisor.disk.vmdk.RawDisk attribute) (dissect.target.containers.raw.RawContainer attribute) seek() (acquire.acquire.crypt.EncryptedStream method) (acquire.acquire.tools.decrypter.EncryptedFile method) (acquire.acquire.volatilestream.VolatileStream method) (dissect.database.ese.cursor.Cursor method) (dissect.evidence.asdf.stream.SubStreamBase method) (dissect.target.container.Container method) (dissect.target.containers.asdf.AsdfContainer method) (dissect.target.containers.asif.AsifContainer method) (dissect.target.containers.ewf.EwfContainer method) (dissect.target.containers.fortifw.FortiFirmwareContainer method) (dissect.target.containers.hdd.HddContainer method) (dissect.target.containers.hds.HdsContainer method) (dissect.target.containers.qcow2.QCow2Container method) (dissect.target.containers.split.SplitContainer method) (dissect.target.containers.vdi.VdiContainer method) (dissect.target.containers.vhd.VhdContainer method) (dissect.target.containers.vhdx.VhdxContainer method) (dissect.target.containers.vmdk.VmdkContainer method) (dissect.target.filesystem.VirtualFileHandle method) (dissect.target.loaders.mqtt.Broker method) (dissect.target.volume.Volume method) (dissect.util.stream.AlignedStream method) (dissect.util.stream.BitStream method) seek_and_return() (in module dissect.thumbcache.util) seek_key() (dissect.database.ese.cursor.Cursor method) seekable() (acquire.acquire.tools.decrypter.EncryptedFile method) (acquire.acquire.volatilestream.VolatileStream method) (dissect.target.container.Container method) (dissect.target.filesystem.VirtualFileHandle method) (dissect.target.volume.Volume method) (dissect.util.stream.AlignedStream method) (dissect.util.stream.BitStream method) SeekMessage (class in dissect.target.loaders.mqtt) seen_paths (acquire.acquire.collector.CollectionReport attribute) Segment (class in dissect.evidence.ewf.ewf) (class in dissect.executable.elf.elf) (class in dissect.fve.luks.metadata) (class in dissect.volume.lvm.metadata) segment (dissect.evidence.ewf.ewf.HeaderSection attribute) (dissect.evidence.ewf.ewf.TableSection attribute) (dissect.evidence.ewf.ewf.VolumeSection attribute) (dissect.ntfs.mft.MftRecord attribute) segment() (dissect.evidence.ad1.ad1.AD1 method) (dissect.evidence.ewf.ewf.EWF method) segment_count (dissect.volume.lvm.metadata.LogicalVolume attribute) segment_reference() (in module dissect.ntfs.util) SegmentFile (class in dissect.evidence.ad1.ad1) SegmentIntegrity (class in dissect.fve.luks.metadata) segments (dissect.executable.elf.elf.ELF attribute) (dissect.fve.luks.metadata.Digest attribute) (dissect.fve.luks.metadata.Metadata attribute) (dissect.volume.lvm.metadata.LogicalVolume property) segments() (dissect.ntfs.mft.Mft method) SegmentTable (class in dissect.executable.elf.elf) select_event_header() (in module dissect.etl.headers.utils) select_header() (dissect.target.plugins.os.windows.recyclebin.RecyclebinPlugin method) Selector (class in flow.record.selector) selector (flow.record.adapter.avro.AvroReader attribute) (flow.record.adapter.csvfile.CsvfileReader attribute) (flow.record.adapter.duckdb.DuckdbReader attribute) (flow.record.adapter.elastic.ElasticReader attribute) (flow.record.adapter.jsonfile.JsonfileReader attribute) (flow.record.adapter.mongo.MongoReader attribute) (flow.record.adapter.sqlite.SqliteReader attribute) (flow.record.adapter.xlsx.XlsxReader attribute) (flow.record.stream.RecordStreamReader attribute) selector_backtrace (flow.record.selector.RecordContextMatcher attribute) selector_backtrace_verbosity (flow.record.selector.RecordContextMatcher attribute) SelectorResult (class in flow.record.selector) SEMAPHORE (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) send_event() (dissect.target.target.Target method) SendEmailRecord (in module dissect.target.plugins.os.windows.tasks.records) SendMessage (in module acquire.acquire.gui.win32) sensor (dissect.target.loaders.cb.CbLoader attribute) separator (dissect.target.helpers.configutil.ConfigurationParser attribute) SEPARATOR (dissect.target.helpers.configutil.Default attribute) separator (dissect.target.helpers.configutil.ParserConfig attribute) (dissect.target.helpers.configutil.ParserOptions attribute) SEPFirewallRecord (in module dissect.target.plugins.apps.av.symantec) SEPLogRecord (in module dissect.target.plugins.apps.av.symantec) seqno (dissect.volume.lvm.metadata.VolumeGroup attribute) SEQPACKET (dissect.target.plugins.os.unix.linux.proc.Sockets.SocketStreamType attribute) SEQUENCE (dissect.etl.headers.headers.EventProperty attribute) sequence (dissect.extfs.journal.CommitBlock attribute) (dissect.extfs.journal.DescriptorBlock attribute) sequence_number (dissect.etl.headers.headers.MessageTraceHeader property) (dissect.fve.bde.eow.EowBitmapRecord property) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTable property) (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) serial (dissect.ntfs.ntfs.NTFS property) (dissect.target.volume.VolumeSystem attribute) (dissect.volume.disk.disk.Disk property) serial_number_as_int() (in module dissect.target.plugins.os.windows.certlog) SERIAL_TYPES (in module dissect.database.sqlite3.sqlite3) serialise_record_column_values() (in module dissect.database.ese.record) Serializable (in module dissect.target.helpers.sunrpc.serializer) Serialization (class in dissect.target.tools.dump) serialization (dissect.target.tools.dump.DumpState attribute) serialize() (dissect.target.helpers.nfs.serializer.DirOpArgs3Serializer method) (dissect.target.helpers.nfs.serializer.Read3ArgsSerializer method) (dissect.target.helpers.nfs.serializer.ReadDirPlusParamsSerializer method) (dissect.target.helpers.sunrpc.serializer.AuthSerializer method) (dissect.target.helpers.sunrpc.serializer.Int32Serializer method) (dissect.target.helpers.sunrpc.serializer.MessageSerializer method) (dissect.target.helpers.sunrpc.serializer.OpaqueVarLengthSerializer method) (dissect.target.helpers.sunrpc.serializer.PortMappingSerializer method) (dissect.target.helpers.sunrpc.serializer.Serializer method) (dissect.target.helpers.sunrpc.serializer.StringSerializer method) (dissect.target.tools.dump.DumpState method) serialize_handles_into_csv() (in module acquire.acquire.dynamic.windows.handles) serialize_into_csv() (in module acquire.acquire.hashes) serialize_obj() (in module dissect.target.tools.dump) Serializer (class in dissect.target.helpers.sunrpc.serializer) SERIALIZERS (in module dissect.target.tools.dump) Server (class in dissect.database.ese.ntds.objects.server) SERVER_GLOBS (dissect.target.plugins.apps.remoteaccess.rustdesk.RustdeskPlugin attribute) SERVER_ID_MAP (in module dissect.target.plugins.os.windows.wua_history) server_root (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) SERVER_SELECTION_MAP (in module dissect.target.plugins.os.windows.wua_history) server_sid (dissect.database.ese.ntds.sd.ACE attribute) (dissect.ntfs.secure.ACE attribute) SERVER_TRUST_ACCOUNT (dissect.database.ese.ntds.util.UserAccountControl attribute) servers() (dissect.database.ese.ntds.ntds.NTDS method) ServersContainer (class in dissect.database.ese.ntds.objects.serverscontainer) SERVICE_ENUMS (in module dissect.target.plugins.os.windows.services) SERVICE_GLOBS (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin attribute) ServiceRecord (in module dissect.target.plugins.os.windows.services) SERVICES (dissect.target.plugins.os.unix.log.auth.AuthLogRecordBuilder attribute) services() (dissect.target.plugins.os.unix.linux.services.ServicesPlugin method) (dissect.target.plugins.os.windows.services.ServicesPlugin method) ServicesPlugin (class in dissect.target.plugins.os.unix.linux.services) (class in dissect.target.plugins.os.windows.services) SESPARSE_MAGIC (in module dissect.hypervisor.disk.c_vmdk) SESSION (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) session (dissect.target.filesystems.cb.CbFilesystem attribute) (dissect.target.loaders.cb.CbLoader attribute) (dissect.target.loaders.cb.CbRegistry attribute) (dissect.target.loaders.cb.CbRegistryHive attribute) (dissect.target.loaders.cb.CbRegistryKey attribute) (flow.record.adapter.splunk.SplunkWriter attribute) sessionmanager() (dissect.target.plugins.os.windows.generic.GenericPlugin method) SessionManagerRecord (in module dissect.target.plugins.os.windows.generic) sessions() (dissect.target.plugins.apps.ssh.putty.PuTTYPlugin method) SessionStateChangeTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) set() (dissect.eventlog.bxml.BxmlSub method) (dissect.target.plugins.os.unix.linux.fortios._os.ConfigNode method) set_cli_args() (dissect.target.tools.utils.report.ExecutionReport method) set_event_callback() (dissect.target.target.Target class method) set_event_callbacks() (dissect.target.tools.utils.report.ExecutionReport method) set_filename() (acquire.acquire.log.DelayedFileHandler method) set_ignored_fields_for_comparison() (in module flow.record.base) set_name() (dissect.target.plugins.os.unix.linux.network_managers.Template method) set_name_reader() (dissect.eventlog.bxml.Bxml method) set_plugin_stats() (dissect.target.tools.utils.report.ExecutionReport method) set_stream() (acquire.acquire.log.DelayedFileHandler method) SetLastError (in module acquire.acquire.dynamic.windows.handles) setup() (acquire.acquire.esxi.EsxiMemoryManager method) setup_logger() (in module dissect.cstruct.tools.stubgen) setup_logging() (in module acquire.acquire.log) (in module acquire.acquire.tools.decrypter) (in module dissect.archive.tools.backup) sevenzip() (dissect.target.plugins.apps.productivity.sevenzip.SevenZipPlugin method) SevenZipPlugin (class in dissect.target.plugins.apps.productivity.sevenzip) SevenZipRecord (in module dissect.target.plugins.apps.productivity.sevenzip) SEVERITY (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) SFB (dissect.vmfs.resource.ResourceManager property) SHA1 (acquire.acquire.hashes.HashFunc attribute) sha1 (dissect.evidence.ad1.ad1.FileEntry property) (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry attribute) (flow.record.fieldtypes.digest property) sha1() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (in module dissect.target.helpers.hashutil) SHA256 (acquire.acquire.hashes.HashFunc attribute) sha256 (flow.record.fieldtypes.digest property) sha256() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (in module dissect.target.helpers.hashutil) SHADOW_FILES (dissect.target.plugins.os.unix.shadow.ShadowPlugin attribute) ShadowPlugin (class in dissect.target.plugins.os.unix.shadow) shard (acquire.acquire.gui.base.GUI property) share_name (dissect.target.filesystems.smb.SmbFilesystem attribute) (dissect.target.filesystems.smb.SmbStream attribute) SharePoint (class in acquire.acquire.acquire) SHDSL (dissect.target.plugins.os.windows.network.IfTypes attribute) shell32 (in module acquire.acquire.gui.win32) shell_identifier (dissect.target.plugins.os.windows.regf.shellbags.DELEGATE attribute) shell_items (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK_BEEF0005 attribute) ShellBagRecord (in module dissect.target.plugins.os.windows.regf.shellbags) shellbags() (dissect.target.plugins.os.windows.regf.shellbags.ShellBagsPlugin method) ShellBagsPlugin (class in dissect.target.plugins.os.windows.regf.shellbags) shift_size (dissect.fve.luks.metadata.KeyslotArea attribute) SHIM6 (dissect.target.helpers.network.IANAProtocol attribute) shim_def (in module dissect.target.plugins.os.windows.regf.shimcache) SHIM_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) ShimCache (class in dissect.target.plugins.os.windows.regf.shimcache) shimcache() (dissect.target.plugins.os.windows.regf.shimcache.ShimcachePlugin method) SHIMCACHE_WIN_TYPE (class in dissect.target.plugins.os.windows.regf.shimcache) ShimCacheGeneratorType (in module dissect.target.plugins.os.windows.regf.shimcache) ShimcachePlugin (class in dissect.target.plugins.os.windows.regf.shimcache) ShimcacheRecord (in module dissect.target.plugins.os.windows.regf.shimcache) SHITEM (class in dissect.target.plugins.os.windows.regf.shellbags) SHITEMID (class in acquire.acquire.gui.win32) SHN (in module dissect.executable.elf.c_elf) short_name (dissect.archive.wim.DirectoryEntry attribute) (dissect.fat.fat.DirectoryEntry attribute) (dissect.fat.fat.RootDirectory attribute) ShortcutAppcompatRecord (in module dissect.target.plugins.os.windows.amcache) shortcuts() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) SHORTNAMES (dissect.target.plugins.os.windows.registry.RegistryPlugin attribute) Shot (class in dissect.hypervisor.disk.hdd) shots (dissect.hypervisor.disk.hdd.Snapshots attribute) should_ignore_file() (in module dissect.target.plugins.os.unix.linux.services) should_ignore_ip() (in module dissect.target.plugins.os.unix.linux.network_managers) should_stop (flow.record.tools.rdump.ProgressMonitor attribute) show() (acquire.acquire.gui.base.GUI method) (acquire.acquire.gui.win32.Win32 method) show_duplicates() (in module acquire.acquire.tools.decrypter) ShowMessageRecord (in module dissect.target.plugins.os.windows.tasks.records) SHT (in module dissect.executable.elf.c_elf) shutdown() (dissect.target.plugins.os.windows.log.etl.EtlPlugin method) sibling_id (dissect.apfs.objects.fs.DirectoryEntry property) (dissect.apfs.objects.fs.INode attribute) sibling_link (dissect.apfs.objects.fs.INode property) siblings (dissect.apfs.objects.fs.INode property) sid (dissect.database.ese.ntds.objects.object.Object property) (dissect.database.ese.ntds.sd.ACE attribute) SID (dissect.etl.headers.event.ExtType attribute) (dissect.eventlog.bxml.BxmlType attribute) sid (dissect.ntfs.secure.ACE attribute) (dissect.ole.ole.DirectoryEntry attribute) sid() (dissect.target.plugins.os.windows.generic.GenericPlugin method) sign (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) sign_computed (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) signature (dissect.eventlog.wevt.WEVT_TYPE attribute) (dissect.executable.pe.directory.debug.CodeViewDebugEntry property) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK property) SIGNATURE (in module dissect.ole.c_ole) SIGNATURE_BETA (in module dissect.ole.c_ole) SIGNATURE_MASK (in module dissect.util.compression.lznt1) signed (dissect.cstruct.types.int.Int attribute) (dissect.cstruct.types.leb128.LEB128 attribute) sii (dissect.ntfs.secure.Secure attribute) SimpleDatum (class in dissect.fve.bde.information) SimpleLargeDatum (class in dissect.fve.bde.information) Sink (class in dissect.target.tools.dump) sink_path (dissect.target.tools.dump.RecordStreamElement attribute) sink_records() (in module dissect.target.tools.dump) sinks (dissect.target.tools.dump.DumpState attribute) SIP (dissect.target.plugins.os.windows.network.IfTypes attribute) Site (class in dissect.database.ese.ntds.objects.site) SiteLink (class in dissect.database.ese.ntds.objects.sitelink) SitesContainer (class in dissect.database.ese.ntds.objects.sitescontainer) size (dissect.apfs.objects.fs.INode property) (dissect.archive.vbk.Bank attribute) (dissect.archive.vbk.DirItem property) (dissect.archive.vbk.ExtFibItem property) (dissect.archive.vbk.IncrementItem property) (dissect.archive.vbk.IntFibItem property) (dissect.archive.vbk.PatchItem property) (dissect.archive.vbk.SnapshotSlot property) (dissect.archive.vma.Device attribute) (dissect.archive.vma.Extent attribute) (dissect.archive.wim.Resource attribute) (dissect.btrfs.btrfs.INode property) (dissect.cim.classes.DataRegion attribute) (dissect.clfs.blf.Container attribute) (dissect.cramfs.cramfs.INode property) (dissect.cstruct.types.base.MetaType attribute) (dissect.database.bsd.tools.rpm.PackageEntry attribute) (dissect.database.ese.ntds.sd.ACE property) (dissect.database.ese.ntds.sd.ACL property) (dissect.database.ese.page.Tag attribute) (dissect.database.ese.table.Column property) (dissect.database.ese.util.ColumnType attribute) (dissect.database.sqlite3.sqlite3.Cell attribute) (dissect.etl.etl.Buffer property) (dissect.etl.etl.EventRecord property) (dissect.etl.headers.event.EventHeaderExtendedDataItem attribute) (dissect.etl.headers.headers.Header property) (dissect.etl.headers.system.SystemSpecificHeader property) (dissect.eventlog.bxml.BxmlTemplateDescriptor property) (dissect.eventlog.wevt.WEVT property) (dissect.eventlog.wevt.WEVT_TYPE property) (dissect.evidence.ad1.ad1.AD1 attribute) (dissect.evidence.ad1.ad1.FileEntry property) (dissect.evidence.ad1.ad1.SegmentFile attribute) (dissect.evidence.ewf.ewf.EWF attribute) (dissect.evidence.ewf.ewf.SectionDescriptor attribute) (dissect.evidence.ewf.ewf.Segment attribute) (dissect.evidence.ewf.ewf.TableSection attribute) (dissect.evidence.tools.asdf.dd.Progress attribute) (dissect.executable.elf.elf.Section attribute) (dissect.executable.elf.elf.SectionTable attribute) (dissect.executable.elf.elf.Segment attribute) (dissect.executable.elf.elf.SegmentTable attribute) (dissect.executable.elf.elf.Symbol attribute) (dissect.executable.pe.directory.base.DataDirectory attribute) (dissect.executable.pe.directory.com_descriptor.ComStream attribute) (dissect.executable.pe.directory.debug.DebugEntry property) (dissect.executable.pe.directory.resource.ResourceDataEntry property) (dissect.executable.pe.directory.security.Certificate property) (dissect.extfs.extfs.INode property) (dissect.fat.fat.DirectoryEntry property) (dissect.fat.fat.RootDirectory property) (dissect.ffs.ffs.INode property) (dissect.fve.bde.eow.EowBitmap property) (dissect.fve.bde.eow.EowBitmapRecord property) (dissect.fve.bde.eow.EowInformation property) (dissect.fve.bde.information.Datum property) (dissect.fve.bde.information.Information property) (dissect.fve.luks.metadata.KeyslotArea attribute) (dissect.fve.luks.metadata.Segment attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageFileObject attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.hypervisor.disk.asif.ASIF attribute) (dissect.hypervisor.disk.qcow2.QCow2 attribute) (dissect.hypervisor.disk.vdi.VDI property) (dissect.hypervisor.disk.vhd.Disk attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) (dissect.hypervisor.disk.vmdk.SparseDisk attribute) (dissect.hypervisor.util.envelope.Envelope attribute) (dissect.jffs.jffs2.INode property) (dissect.ntfs.attr.AttributeHeader property) (dissect.ntfs.index.IndexBuffer attribute) (dissect.ole.ole.Chain attribute) (dissect.ole.ole.DirectoryEntry attribute) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx6.INode6 property) (dissect.regf.regf.KeyValue property) (dissect.shellitem.lnk.lnk.LnkInfo attribute) (dissect.shellitem.lnk.lnk.LnkTargetIdList attribute) (dissect.squashfs.squashfs.INode property) (dissect.squashfs.squashfs.SquashFS attribute) (dissect.target.container.Container attribute) (dissect.target.filesystems.exfat.ExfatFilesystemEntry attribute) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) (dissect.target.loaders.ab.AndroidBackup attribute) (dissect.target.loaders.itunes.FileInfo property) (dissect.target.loaders.res.File attribute) (dissect.target.plugins.os.unix.linux.modules.Module attribute) (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj attribute) (dissect.target.plugins.os.windows.everything.parser.Record attribute) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK property) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM attribute) (dissect.target.volume.Volume attribute) (dissect.util.stream.AlignedStream attribute) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.vmfs.lvm.Device attribute) (dissect.vmfs.lvm.Volume attribute) (dissect.volume.ddf.ddf.PhysicalDiskRecord attribute) (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) (dissect.volume.disk.partition.Partition attribute) (dissect.volume.lvm.physical.LVM2Device attribute) (dissect.volume.raid.raid.PhysicalDisk attribute) (dissect.volume.raid.raid.VirtualDisk attribute) (dissect.volume.vss.Store attribute) (dissect.xfs.xfs.INode property) size() (dissect.archive.wim.DirectoryEntry method) (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.util.AttributeCollection method) size_bytes (dissect.target.tools.dump.Sink attribute) SIZE_MASK (in module dissect.util.compression.lznt1) size_threshold (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) size_to_clusters() (in module dissect.hypervisor.disk.qcow2) size_to_subclusters() (in module dissect.hypervisor.disk.qcow2) SIZET (dissect.eventlog.bxml.BxmlType attribute) sk (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) SKIP (dissect.target.helpers.network.IANAProtocol attribute) skip() (dissect.util.compression.lzxpress_huffman.BitString method) skip_lines (dissect.target.helpers.configutil.Default attribute) skip_list (acquire.acquire.collector.Collector attribute) SKIP_TABLES (in module dissect.database.ese.tools.certlog) (in module dissect.database.ese.tools.sru) (in module dissect.database.ese.tools.ual) sl (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) slab_size_mb (dissect.volume.lvm.metadata.VdoPoolSegment attribute) SLIP (dissect.target.plugins.os.windows.network.IfTypes attribute) slot (dissect.archive.vbk.MetaBlob attribute) slot1 (dissect.archive.vbk.VBK attribute) slot2 (dissect.archive.vbk.VBK attribute) SLUG_RE (in module dissect.target.helpers.utils) slugify() (in module dissect.target.helpers.utils) slugify_descriptor_name() (in module dissect.target.tools.dump) SM (dissect.target.helpers.network.IANAProtocol attribute) SmallFileBlockAddr (class in dissect.vmfs.address) SmallFileBlockResourceVMFS6 (class in dissect.vmfs.resource) SMARTCARD_REQUIRED (dissect.database.ese.ntds.util.UserAccountControl attribute) SmbDirEntry (class in dissect.target.filesystems.smb) SmbFilesystem (class in dissect.target.filesystems.smb) SmbFilesystemEntry (class in dissect.target.filesystems.smb) SmbLoader (class in dissect.target.loaders.smb) SmbRegistry (class in dissect.target.loaders.smb) SmbRegistryHive (class in dissect.target.loaders.smb) SmbRegistryKey (class in dissect.target.loaders.smb) SmbRegistryValue (class in dissect.target.loaders.smb) SmbStream (class in dissect.target.filesystems.smb) SMDS_DXI (dissect.target.plugins.os.windows.network.IfTypes attribute) SMDS_ICIP (dissect.target.plugins.os.windows.network.IfTypes attribute) SMP (dissect.target.helpers.network.IANAProtocol attribute) snap() (dissect.target.plugins.os.unix.linux.debian.snap.SnapPlugin method) snap_id (dissect.vmfs.lvm.Volume attribute) snap_meta_tree (dissect.apfs.objects.fs.FS property) SnapMetaExt (class in dissect.apfs.objects.snap_meta_ext) SnapPlugin (class in dissect.target.plugins.os.unix.linux.debian.snap) Snapshot (class in dissect.apfs.objects.fs) (class in dissect.hypervisor.descriptor.vbox) Snapshots (class in dissect.hypervisor.disk.hdd) snapshots (dissect.apfs.objects.fs.FS property) (dissect.hypervisor.descriptor.vbox.Machine property) (dissect.hypervisor.descriptor.vbox.VBox property) (dissect.hypervisor.disk.hdd.Descriptor attribute) (dissect.hypervisor.disk.qcow2.QCow2 property) SnapshotSegment (class in dissect.volume.lvm.metadata) SnapshotSlot (class in dissect.archive.vbk) SnapshotTableEntry (in module dissect.evidence.asdf.asdf) SNP (dissect.target.helpers.network.IANAProtocol attribute) SOCK (dissect.target.helpers.nfs.nfs3.FileType attribute) sock (flow.record.adapter.splunk.SplunkWriter attribute) SOCKET_TIMEOUT (dissect.target.loaders.remote.RemoteStreamConnection attribute) Sockets (class in dissect.target.plugins.os.unix.linux.proc) sockets (dissect.target.plugins.os.unix.linux.proc.ProcPlugin attribute) (dissect.target.plugins.os.unix.linux.sockets.NetSocketPlugin attribute) Sockets.PacketProtocolTypes (class in dissect.target.plugins.os.unix.linux.proc) Sockets.SocketStateType (class in dissect.target.plugins.os.unix.linux.proc) Sockets.SocketStreamType (class in dissect.target.plugins.os.unix.linux.proc) Sockets.TCPStates (class in dissect.target.plugins.os.unix.linux.proc) Sockets.UDPStates (class in dissect.target.plugins.os.unix.linux.proc) software (dissect.target.plugins.os.windows.firewall.LogConfig attribute) SOFTWARE_LOOPBACK (dissect.target.plugins.os.windows.network.IfTypes attribute) SOLARIS_DEV_DIR (in module dissect.target.loaders.local) SOLARIS_DRIVE_REGEX (in module dissect.target.loaders.local) some_other_way_of_using_a_variable_comment (in module codestyle) some_random_variable (in module codestyle) SONET (dissect.target.plugins.os.windows.network.IfTypes attribute) SONET_OVERHEAD_CHANNEL (dissect.target.plugins.os.windows.network.IfTypes attribute) SONET_PATH (dissect.target.plugins.os.windows.network.IfTypes attribute) SONET_VT (dissect.target.plugins.os.windows.network.IfTypes attribute) sophoshomelogs() (dissect.target.plugins.apps.av.sophos.SophosPlugin method) SophosLogRecord (in module dissect.target.plugins.apps.av.sophos) SophosPlugin (class in dissect.target.plugins.apps.av.sophos) SORT_DIGITSASNUMBERS (dissect.database.ese.lcmapstring.MapFlags attribute) sort_files() (in module acquire.acquire.acquire) SORT_STRINGSORT (dissect.database.ese.lcmapstring.MapFlags attribute) SortedKeysJsonRecordPacker (class in dissect.target.tools.dump) source (dissect.target.loaders.cellebrite.CellebriteFilesystem attribute) (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) (dissect.util.compression.lzxpress_huffman.BitString attribute) (flow.record.adapter.broker.BrokerWriter attribute) source_count (flow.record.context.AppContext attribute) source_size (dissect.archive.vbk.StgBlockDescriptor property) source_total (flow.record.context.AppContext attribute) SourceName (dissect.eventlog.evt.Record attribute) SourceType (class in flow.record.adapter.splunk) SPACE (dissect.database.sqlite3.sqlite3.Column attribute) Spaceman (class in dissect.apfs.objects.spaceman) SpacemanBitmap (class in dissect.apfs.objects.spaceman_bitmap) SpacemanChunkInfoAddressBlock (class in dissect.apfs.objects.spaceman_cab) SpacemanChunkInfoBlock (class in dissect.apfs.objects.spaceman_cib) span_stats (dissect.target.plugins.os.windows.regf.cit.BaseUseData attribute) SPARSE_BYTES (in module dissect.evidence.asdf.asdf) SparseDisk (class in dissect.hypervisor.disk.vmdk) SparseExtentHeader (class in dissect.hypervisor.disk.vmdk) SPEC (acquire.acquire.acquire.ActiveDirectory attribute) (acquire.acquire.acquire.ActivitiesCache attribute) (acquire.acquire.acquire.Appcompat attribute) (acquire.acquire.acquire.Applications attribute) (acquire.acquire.acquire.AV attribute) (acquire.acquire.acquire.BITS attribute) (acquire.acquire.acquire.Boot attribute) (acquire.acquire.acquire.BSD attribute) (acquire.acquire.acquire.DNS attribute) (acquire.acquire.acquire.Docker attribute) (acquire.acquire.acquire.DPAPI attribute) (acquire.acquire.acquire.Drivers attribute) (acquire.acquire.acquire.EDR attribute) (acquire.acquire.acquire.ESXi attribute) (acquire.acquire.acquire.Etc attribute) (acquire.acquire.acquire.ETL attribute) (acquire.acquire.acquire.History attribute) (acquire.acquire.acquire.Home attribute) (acquire.acquire.acquire.MacOS attribute) (acquire.acquire.acquire.MacOSApplicationsInfo attribute) (acquire.acquire.acquire.Misc attribute) (acquire.acquire.acquire.Module attribute) (acquire.acquire.acquire.MSSQL attribute) (acquire.acquire.acquire.Netstat attribute) (acquire.acquire.acquire.Network attribute) (acquire.acquire.acquire.NTDS attribute) (acquire.acquire.acquire.PCA attribute) (acquire.acquire.acquire.PowerShell attribute) (acquire.acquire.acquire.Prefetch attribute) (acquire.acquire.acquire.QuarantinedFiles attribute) (acquire.acquire.acquire.Recents attribute) (acquire.acquire.acquire.Registry attribute) (acquire.acquire.acquire.RemoteAccess attribute) (acquire.acquire.acquire.SSH attribute) (acquire.acquire.acquire.Startup attribute) (acquire.acquire.acquire.Syscache attribute) (acquire.acquire.acquire.Tasks attribute) (acquire.acquire.acquire.TextEditor attribute) (acquire.acquire.acquire.ThumbnailCache attribute) (acquire.acquire.acquire.Var attribute) (acquire.acquire.acquire.WBEM attribute) (acquire.acquire.acquire.WebHosting attribute) (acquire.acquire.acquire.WinDnsClientCache attribute) (acquire.acquire.acquire.WindowsNotifications attribute) (acquire.acquire.acquire.WinMemFiles attribute) (acquire.acquire.acquire.WinProcEnv attribute) (acquire.acquire.acquire.WinProcesses attribute) SpecData (class in dissect.target.helpers.nfs.nfs3) specdata1 (dissect.target.helpers.nfs.nfs3.SpecData attribute) specdata2 (dissect.target.helpers.nfs.nfs3.SpecData attribute) SpecDataSerializer (class in dissect.target.helpers.nfs.serializer) SPECIAL_FOLDER_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) SplashtopPlugin (class in dissect.target.plugins.apps.remoteaccess.splashtop) split() (in module dissect.target.helpers.polypath) split_column_def() (in module dissect.database.sqlite3.util) split_into_records() (in module dissect.target.plugins.os.unix.linux.debian.apt) split_package_names() (in module dissect.target.plugins.os.unix.linux.debian.apt) split_sql_list() (in module dissect.database.sqlite3.util) SplitContainer (class in dissect.target.containers.split) splitdrive (in module dissect.target.helpers.polypath) splitext (in module dissect.target.helpers.polypath) SplitIoGuid (in module dissect.etl.utils) splitroot() (in module dissect.target.helpers.polypath) SplitWriter (class in flow.record.adapter.split) SplunkReader (class in flow.record.adapter.splunk) SplunkWriter (class in flow.record.adapter.splunk) SPRITE_RPC (dissect.target.helpers.network.IANAProtocol attribute) SPS (dissect.target.helpers.network.IANAProtocol attribute) sql (dissect.database.sqlite3.sqlite3.Index attribute) (dissect.database.sqlite3.sqlite3.Table attribute) SQLCipher (class in dissect.database.sqlite3.encryption.sqlcipher.sqlcipher) sqlcipher (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipherStream attribute) SQLCipher1 (class in dissect.database.sqlite3.encryption.sqlcipher.sqlcipher) SQLCipher2 (class in dissect.database.sqlite3.encryption.sqlcipher.sqlcipher) SQLCipher3 (class in dissect.database.sqlite3.encryption.sqlcipher.sqlcipher) SQLCipher4 (class in dissect.database.sqlite3.encryption.sqlcipher.sqlcipher) SQLCipherError SQLCipherStream (class in dissect.database.sqlite3.encryption.sqlcipher.sqlcipher) sqlite (dissect.database.sqlite3.sqlite3.Index attribute) (dissect.database.sqlite3.sqlite3.Page attribute) (dissect.database.sqlite3.sqlite3.Table attribute) SQLite3 (class in dissect.database.sqlite3.sqlite3) sqlite3_def (in module dissect.database.sqlite3.c_sqlite3) SQLITE3_HEADER_MAGIC (in module dissect.database.sqlite3.sqlite3) SQLITE_FIELD_MAP (in module flow.record.adapter.sqlite) SqliteReader (class in flow.record.adapter.sqlite) SqliteWriter (class in flow.record.adapter.sqlite) SquashFS (class in dissect.squashfs.squashfs) squashfs (dissect.target.filesystems.squashfs.SquashFSFilesystem attribute) squashfs_def (in module dissect.squashfs.c_squashfs) SquashFSDirEntry (class in dissect.target.filesystems.squashfs) SquashFSFilesystem (class in dissect.target.filesystems.squashfs) SquashFSFilesystemEntry (class in dissect.target.filesystems.squashfs) src_index (dissect.target.tools.diff.DifferentialCli attribute) src_target (dissect.target.tools.diff.DifferentialCli property) (dissect.target.tools.diff.TargetComparison attribute) src_target_entry (dissect.target.tools.diff.DifferentialEntry attribute) SRP (dissect.target.helpers.network.IANAProtocol attribute) (dissect.target.plugins.os.windows.network.IfTypes attribute) SRU (class in dissect.database.ese.tools.sru) sru (dissect.database.ese.tools.sru.Entry attribute) SRUPlugin (class in dissect.target.plugins.os.windows.sru) SRURecord (in module dissect.target.plugins.os.windows.sru) SS7_SIGLINK (dissect.target.plugins.os.windows.network.IfTypes attribute) SS_LEFT (in module acquire.acquire.gui.win32) SSCOPMCE (dissect.target.helpers.network.IANAProtocol attribute) SSH (class in acquire.acquire.acquire) ssh_directory_globs() (dissect.target.plugins.apps.ssh.openssh.OpenSSHPlugin method) SSHD_BOOLEAN_FIELDS (in module dissect.target.plugins.apps.ssh.opensshd) SSHD_BOOLEAN_VALUES (in module dissect.target.plugins.apps.ssh.opensshd) sshd_config_path (dissect.target.plugins.apps.ssh.opensshd.SSHServerPlugin attribute) SSHD_DIRECTORIES (dissect.target.plugins.apps.ssh.openssh.OpenSSHPlugin attribute) sshd_directory (dissect.target.plugins.apps.ssh.openssh.OpenSSHPlugin attribute) (dissect.target.plugins.apps.ssh.opensshd.SSHServerPlugin attribute) SSHD_INTEGER_FIELDS (in module dissect.target.plugins.apps.ssh.opensshd) SSHD_MULTIPLE_DEFINITIONS_ALLOWED_FIELDS (in module dissect.target.plugins.apps.ssh.opensshd) SshdService (class in dissect.target.plugins.os.unix.log.auth) SSHPlugin (class in dissect.target.plugins.apps.ssh.ssh) SSHPrivateKey (class in dissect.target.plugins.apps.ssh.ssh) SSHServerPlugin (class in dissect.target.plugins.apps.ssh.opensshd) ST (dissect.target.helpers.network.IANAProtocol attribute) st_atime (dissect.target.helpers.fsutil.stat_result attribute) st_atime_ns (dissect.target.helpers.fsutil.stat_result attribute) st_birthtime (dissect.target.helpers.fsutil.stat_result attribute) st_birthtime_ns (dissect.target.helpers.fsutil.stat_result attribute) st_blksize (dissect.target.helpers.fsutil.stat_result attribute) st_blocks (dissect.target.helpers.fsutil.stat_result attribute) st_ctime (dissect.target.helpers.fsutil.stat_result attribute) st_ctime_ns (dissect.target.helpers.fsutil.stat_result attribute) st_dev (dissect.target.helpers.fsutil.stat_result attribute) st_file_attributes (dissect.target.helpers.fsutil.stat_result attribute) st_flags (dissect.target.helpers.fsutil.stat_result attribute) st_fstype (dissect.target.helpers.fsutil.stat_result attribute) st_gen (dissect.target.helpers.fsutil.stat_result attribute) st_gid (dissect.target.helpers.fsutil.stat_result attribute) st_ino (dissect.target.helpers.fsutil.stat_result attribute) st_mode (dissect.target.helpers.fsutil.stat_result attribute) st_mtime (dissect.target.helpers.fsutil.stat_result attribute) st_mtime_ns (dissect.target.helpers.fsutil.stat_result attribute) st_nlink (dissect.target.helpers.fsutil.stat_result attribute) st_rdev (dissect.target.helpers.fsutil.stat_result attribute) st_reparse_tag (dissect.target.helpers.fsutil.stat_result attribute) st_size (dissect.target.helpers.fsutil.stat_result attribute) st_uid (dissect.target.helpers.fsutil.stat_result attribute) STABLE (in module dissect.regf.regf) stack (dissect.cstruct.expression.Expression attribute) STACK_TRACE32 (dissect.etl.headers.event.ExtType attribute) STACK_TRACE64 (dissect.etl.headers.event.ExtType attribute) STACKTOSTACK (dissect.target.plugins.os.windows.network.IfTypes attribute) stacktrace (dissect.target.plugin.FailureDescriptor attribute) StackWalkGuid (in module dissect.etl.utils) stamp (dissect.target.helpers.sunrpc.sunrpc.AuthUnix attribute) standard_bias (dissect.target.plugins.os.windows.datetime.TimezoneInformation attribute) standard_date (dissect.target.plugins.os.windows.datetime.TimezoneInformation attribute) standard_header_fields() (dissect.etl.headers.headers.Header method) STANDARD_INFORMATION (dissect.target.plugins.filesystem.ntfs.utils.InformationType attribute) STANDARD_RIGHTS_ALL (in module acquire.acquire.dynamic.windows.ntdll) StandardInformation (class in dissect.ntfs.attr) STARLAN (dissect.target.plugins.os.windows.network.IfTypes attribute) start (dissect.etl.etl.ETL attribute) (dissect.hypervisor.disk.hdd.Storage attribute) (dissect.ole.ole.DirectoryEntry attribute) start() (dissect.target.loaders.mqtt.MqttDiagnosticLine method) (flow.record.tools.rdump.ProgressMonitor method) start_block (dissect.squashfs.squashfs.FileStream attribute) start_button (acquire.acquire.gui.win32.Win32 attribute) start_extent (dissect.volume.lvm.metadata.Segment attribute) start_in (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) start_offset (dissect.eventlog.evt.Evt attribute) start_sector (dissect.hypervisor.disk.vmdk.ExtentDescriptor attribute) start_time (dissect.etl.etl.ETL attribute) (dissect.etl.headers.logfile.LogfileHeader property) (dissect.target.tools.dump.DumpState attribute) start_update() (dissect.cstruct.types.structure.StructureMetaType method) start_when_available (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) starting_block (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) starttime (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) Startup (class in acquire.acquire.acquire) startup() (dissect.target.plugins.apps.productivity.msoffice.MSOffice method) startupinfo() (dissect.target.plugins.os.windows.startupinfo.StartupInfoPlugin method) StartupInfoPlugin (class in dissect.target.plugins.os.windows.startupinfo) StartupInfoRecord (in module dissect.target.plugins.os.windows.startupinfo) stat (dissect.target.filesystem.DirEntry attribute) (dissect.target.helpers.sunrpc.sunrpc.AcceptedReply attribute) (dissect.target.helpers.sunrpc.sunrpc.RejectedReply attribute) stat() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.MappedFile method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualDirEntry method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.ad1.AD1DirEntry method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.apfs.ApfsDirEntry method) (dissect.target.filesystems.apfs.ApfsFilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsDirEntry method) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry method) (dissect.target.filesystems.cb.CbDirEntry method) (dissect.target.filesystems.cb.CbFilesystemEntry method) (dissect.target.filesystems.cramfs.CramfsDirEntry method) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry method) (dissect.target.filesystems.dir.DirectoryDirEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.exfat.ExfatDirEntry method) (dissect.target.filesystems.exfat.ExfatFilesystemEntry method) (dissect.target.filesystems.extfs.ExtDirEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.fat.FatDirEntry method) (dissect.target.filesystems.fat.FatFilesystemEntry method) (dissect.target.filesystems.ffs.FfsDirEntry method) (dissect.target.filesystems.ffs.FfsFilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemDirectoryEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemEntry method) (dissect.target.filesystems.jffs.JffsDirEntry method) (dissect.target.filesystems.jffs.JffsFilesystemEntry method) (dissect.target.filesystems.nfs.NfsDirEntry method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.ntds.NtdsDirEntry method) (dissect.target.filesystems.ntds.NtdsFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsDirEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.qnxfs.QnxDirEntry method) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry method) (dissect.target.filesystems.smb.SmbDirEntry method) (dissect.target.filesystems.smb.SmbFilesystemEntry method) (dissect.target.filesystems.squashfs.SquashFSDirEntry method) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystemDirectoryEntry method) (dissect.target.filesystems.tar.TarFilesystemEntry method) (dissect.target.filesystems.vbk.VbkDirEntry method) (dissect.target.filesystems.vbk.VbkFilesystemEntry method) (dissect.target.filesystems.vmfs.VmfsDirEntry method) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsDirEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystemEntry method) (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) (dissect.target.loaders.res.ResFile method) (dissect.target.plugins.os.unix.linux.proc.ProcProcess method) (in module dissect.target.tools.fs) stat_modestr() (in module dissect.target.tools.utils.fs) stat_result (class in dissect.target.helpers.fsutil) STAT_TEMPLATE (in module dissect.target.tools.utils.fs) state (dissect.apfs.cursor.Cursor property) (dissect.cim.classes.ClassInstanceProperty attribute) (dissect.cim.classes.PropertyDefaultValues attribute) (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) (dissect.vmfs.lvm.Volume attribute) (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) (dissect.volume.ddf.ddf.PhysicalDiskRecord attribute) (dissect.volume.ddf.ddf.VirtualDiskRecord attribute) (dissect.volume.vinum.config.Plex attribute) (dissect.volume.vinum.config.SD attribute) (dissect.volume.vinum.config.Volume attribute) state_cls (dissect.cim.classes.PropertyStates attribute) STATE_FILE_NAME (in module dissect.target.tools.dump) state_offset (dissect.fve.bde.information.Information property) state_size (dissect.fve.bde.information.Information property) state_string (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) stats (dissect.target.plugins.os.windows.regf.cit.BaseUseData attribute) status (dissect.qnxfs.qnx4.INode4 property) (dissect.target.loaders.itunes.ITunesBackup attribute) (dissect.target.plugins.os.windows.log.schedlgu.SchedLgU attribute) (dissect.volume.lvm.metadata.LogicalVolume attribute) (dissect.volume.lvm.metadata.PhysicalVolume attribute) (dissect.volume.lvm.metadata.VolumeGroup attribute) status() (dissect.target.plugins.os.unix.linux.debian.dpkg.DpkgPlugin method) (in module dissect.evidence.tools.asdf.verify) STATUS_ACCESS_DENIED (acquire.acquire.dynamic.windows.ntdll.NtStatusCode attribute) STATUS_BUFFER_OVERFLOW (acquire.acquire.dynamic.windows.ntdll.NtStatusCode attribute) STATUS_EXIT (in module acquire.acquire.tools.decrypter) STATUS_FIELD_MAPPINGS (in module dissect.target.plugins.os.unix.linux.debian.dpkg) STATUS_FIELDS_TO_EXTRACT (in module dissect.target.plugins.os.unix.linux.debian.dpkg) STATUS_FILE_NAME (in module dissect.target.plugins.os.unix.linux.debian.dpkg) STATUS_FLAG_ALLOCATABLE (in module dissect.volume.lvm.c_lvm2) STATUS_FLAG_READ (in module dissect.volume.lvm.c_lvm2) STATUS_FLAG_RESIZEABLE (in module dissect.volume.lvm.c_lvm2) STATUS_FLAG_VISIBLE (in module dissect.volume.lvm.c_lvm2) STATUS_FLAG_WRITE (in module dissect.volume.lvm.c_lvm2) STATUS_INFO (in module acquire.acquire.tools.decrypter) STATUS_INFO_LENGTH_MISMATCH (acquire.acquire.dynamic.windows.ntdll.NtStatusCode attribute) STATUS_INVALID_HANDLE (acquire.acquire.dynamic.windows.ntdll.NtStatusCode attribute) STATUS_MAP (in module dissect.target.plugins.os.windows.wua_history) STATUS_MORE_ENTRIES (acquire.acquire.dynamic.windows.ntdll.NtStatusCode attribute) STATUS_NO_MORE_ENTRIES (acquire.acquire.dynamic.windows.ntdll.NtStatusCode attribute) STATUS_START (in module acquire.acquire.tools.decrypter) STATUS_SUCCESS (acquire.acquire.dynamic.windows.ntdll.NtStatusCode attribute) STATUS_UPDATE (in module acquire.acquire.tools.decrypter) STB (in module dissect.executable.elf.c_elf) std_name (dissect.target.plugins.os.windows.datetime.WindowsTimezone attribute) StgBlockDescriptor (class in dissect.archive.vbk) StgBlockDescriptorV7 (class in dissect.archive.vbk) STGTY (in module dissect.ole.c_ole) STILL_INFECTED (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) stop() (flow.record.tools.rdump.ProgressMonitor method) stop_going_on_batteries (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) STOPPED (dissect.target.plugins.apps.container.podman.ContainerState attribute) STOPPING (dissect.target.plugins.apps.container.podman.ContainerState attribute) Storage (class in dissect.hypervisor.disk.hdd) storage_data (dissect.hypervisor.disk.hdd.Descriptor attribute) storage_type (dissect.apfs.objects.base.Object property) StorageData (class in dissect.hypervisor.disk.hdd) storages (dissect.hypervisor.disk.hdd.StorageData attribute) StorageStream (class in dissect.hypervisor.disk.hdd) Store (class in dissect.cim.index) (class in dissect.cim.objects) (class in dissect.volume.vss) store (dissect.cim.index.Index attribute) (dissect.cim.index.IndexPage attribute) (dissect.cim.objects.DataPage attribute) (dissect.cim.objects.Objects attribute) (dissect.hypervisor.util.envelope.KeyStore attribute) (dissect.volume.vss.BlockList attribute) (dissect.volume.vss.RangeList attribute) (dissect.volume.vss.StoreBitmap attribute) (dissect.volume.vss.StoreStream attribute) STORE_BLOCK_SIZE (in module dissect.volume.vss) STORE_BLOCKLIST_ENTRY_SIZE (in module dissect.volume.vss) store_offset (dissect.volume.vss.BlockDescriptor attribute) STORE_RANGELIST_ENTRY_SIZE (in module dissect.volume.vss) store_volume_identifier (dissect.volume.vss.VSS property) StoreBitmap (class in dissect.volume.vss) stores (dissect.volume.vss.Catalog attribute) StoreStream (class in dissect.volume.vss) STP (dissect.target.helpers.network.IANAProtocol attribute) str_to_bool() (in module dissect.target.plugins.os.windows.tasks.xml) Stream (class in dissect.clfs.blf) stream (dissect.cstruct.bitbuffer.BitBuffer attribute) (dissect.eventlog.evtx.ElfChnk attribute) (dissect.evidence.ad1.ad1.AD1 attribute) (dissect.evidence.ad1.stream.FileStream attribute) (dissect.target.containers.asif.AsifContainer attribute) (dissect.target.containers.hdd.HddContainer attribute) (dissect.target.containers.qcow2.QCow2Container attribute) (dissect.target.loaders.mqtt.MqttStream attribute) (dissect.target.loaders.remote.RemoteLoader attribute) (dissect.target.loaders.remote.RemoteStream attribute) STREAM (dissect.target.plugins.os.unix.linux.proc.Sockets.SocketStreamType attribute) stream (flow.record.adapter.stream.StreamReader attribute) (flow.record.adapter.stream.StreamWriter attribute) (flow.record.stream.PathTemplateWriter attribute) stream() (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher method) (in module dissect.fve.tools.dd) (in module flow.record.base) STREAM_ATTRIBUTES (in module dissect.target.plugins.os.windows.defender.quarantine) STREAM_BUFFER_SIZE (in module dissect.util.stream) STREAM_ENTRY (in module dissect.fat.c_exfat) STREAM_FORMATTER (in module acquire.acquire.log) STREAM_ID (in module dissect.target.plugins.os.windows.defender.quarantine) stream_type_string (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) streaming_bulk_thread() (flow.record.adapter.elastic.ElasticWriter method) StreamReader (class in flow.record.adapter.stream) streams (dissect.archive.wim.DirectoryEntry attribute) (dissect.clfs.blf.BaseRecord attribute) (dissect.executable.pe.directory.com_descriptor.ComMetadata property) (dissect.hypervisor.disk.hdd.StorageStream attribute) streams() (dissect.evidence.asdf.asdf.AsdfSnapshot method) StreamWriter (class in flow.record.adapter.stream) StrEnum (class in acquire.acquire.utils) (class in dissect.target.helpers.utils) stretch() (in module dissect.fve.bde.key) stretch_key() (dissect.fve.bde.information.VmkInfoDatum method) stretch_keys() (dissect.fve.bde.information.VmkInfoDatum method) StretchKeyDatum (class in dissect.fve.bde.information) strictly_positive() (in module dissect.target.loaders.mqtt) string (class in flow.record.fieldtypes) STRING (dissect.database.sqlite3.sqlite3.Column attribute) (dissect.eventlog.bxml.BxmlType attribute) string (dissect.executable.pe.directory.resource.ResourceDirectory property) string() (dissect.cim.index.IndexPage method) string_data (dissect.shellitem.lnk.lnk.LnkStringData attribute) string_table() (dissect.executable.pe.directory.resource.ResourceDirectory method) stringdata (dissect.shellitem.lnk.lnk.Lnk attribute) stringlist (class in flow.record.fieldtypes) Strings (dissect.eventlog.evt.Record attribute) StringSerializer (class in dissect.target.helpers.sunrpc.serializer) StringTable (class in dissect.executable.elf.elf) strip_log() (in module dissect.target.plugins.apps.container.docker) strip_namespace() (dissect.target.plugins.os.windows.tasks.xml.ScheduledTasks method) (dissect.target.plugins.os.windows.tasks.xml.XmlTask method) STRIP_RE (in module dissect.target.helpers.utils) strip_size (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) Stripe (class in dissect.btrfs.stream) stripe_count (dissect.volume.lvm.metadata.RAIDSegment attribute) (dissect.volume.lvm.metadata.StripedSegment attribute) stripe_length (dissect.btrfs.stream.Chunk attribute) stripe_size (dissect.btrfs.btrfs.Btrfs attribute) (dissect.volume.lvm.metadata.RAIDSegment attribute) (dissect.volume.lvm.metadata.StripedSegment attribute) (dissect.volume.raid.raid.VirtualDisk attribute) STRIPED (dissect.volume.vinum.config.PlexOrg attribute) StripedSegment (class in dissect.volume.lvm.metadata) stripes (dissect.btrfs.stream.Chunk attribute) (dissect.fve.luks.metadata.KeyslotAf attribute) (dissect.volume.lvm.metadata.StripedSegment attribute) stripesize (dissect.volume.vinum.config.Plex attribute) strong (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) STRUCT (dissect.target.plugins.os.windows.regf.shellbags.CDBURN attribute) (dissect.target.plugins.os.windows.regf.shellbags.COMPRESSED_FOLDER attribute) (dissect.target.plugins.os.windows.regf.shellbags.CONTROL_PANEL attribute) (dissect.target.plugins.os.windows.regf.shellbags.CONTROL_PANEL_CATEGORY attribute) (dissect.target.plugins.os.windows.regf.shellbags.CONTROL_PANEL_CPL_FILE attribute) (dissect.target.plugins.os.windows.regf.shellbags.DELEGATE attribute) (dissect.target.plugins.os.windows.regf.shellbags.FILE_ENTRY attribute) (dissect.target.plugins.os.windows.regf.shellbags.GAME_FOLDER attribute) (dissect.target.plugins.os.windows.regf.shellbags.MTP_FILE_ENTRY attribute) (dissect.target.plugins.os.windows.regf.shellbags.MTP_VOLUME attribute) (dissect.target.plugins.os.windows.regf.shellbags.NETWORK attribute) (dissect.target.plugins.os.windows.regf.shellbags.ROOT_FOLDER attribute) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM attribute) (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN0 attribute) (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN1 attribute) (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN_0x74 attribute) (dissect.target.plugins.os.windows.regf.shellbags.URI attribute) (dissect.target.plugins.os.windows.regf.shellbags.USERS_PROPERTY_VIEW attribute) (dissect.target.plugins.os.windows.regf.shellbags.VOLUME attribute) STRUCT_FMT (in module dissect.etl.manifest) Structure (class in dissect.cstruct.types.structure) StructureMetaType (class in dissect.cstruct.types.structure) StructureValuesProxy (class in dissect.cstruct.types.structure) STT (in module dissect.executable.elf.c_elf) Stub (class in acquire.acquire.gui.base) STV (in module dissect.executable.elf.c_elf) sub_block_size (dissect.vmfs.vmfs.VMFS attribute) sub_id (dissect.eventlog.bxml.BxmlSub attribute) sub_stripes (dissect.btrfs.stream.Chunk attribute) SubBlockAddr (class in dissect.vmfs.address) SubBlockAddr64 (class in dissect.vmfs.address) SubBlockResourceVMFS5 (class in dissect.vmfs.resource) SubBlockResourceVMFS6 (class in dissect.vmfs.resource) subcluster_bits (dissect.hypervisor.disk.qcow2.QCow2 attribute) subcluster_size (dissect.hypervisor.disk.qcow2.QCow2 attribute) subclusters_per_cluster (dissect.hypervisor.disk.qcow2.QCow2 attribute) SubFolderItem (class in dissect.archive.vbk) subfs (dissect.target.filesystems.btrfs.BtrfsFilesystem attribute) subitem (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN_0x74 attribute) subkey() (dissect.regf.regf.FastLeaf method) (dissect.regf.regf.HashLeaf method) (dissect.regf.regf.IndexLeaf method) (dissect.regf.regf.IndexRoot method) (dissect.regf.regf.KeyIndex method) (dissect.regf.regf.KeyNode method) (dissect.target.helpers.regutil.KeyCollection method) (dissect.target.helpers.regutil.RegfKey method) (dissect.target.helpers.regutil.RegistryKey method) (dissect.target.helpers.regutil.VirtualKey method) (dissect.target.loaders.cb.CbRegistryKey method) (dissect.target.loaders.smb.SmbRegistryKey method) (dissect.target.plugins.os.windows.registry.RegistryPlugin method) subkeys() (dissect.regf.regf.KeyNode method) (dissect.target.helpers.regutil.KeyCollection method) (dissect.target.helpers.regutil.RegfKey method) (dissect.target.helpers.regutil.RegistryKey method) (dissect.target.helpers.regutil.VirtualKey method) (dissect.target.loaders.cb.CbRegistryKey method) (dissect.target.loaders.smb.SmbRegistryKey method) subloader (dissect.target.loaders.tar.TarLoader attribute) (dissect.target.loaders.zip.ZipLoader attribute) subnet (class in flow.record.fieldtypes.net.ipv4) Subnet (in module flow.record.fieldtypes.net.ipv4) SubnetContainer (class in dissect.database.ese.ntds.objects.subnetcontainer) SubnetList (class in flow.record.fieldtypes.net.ipv4) subnets (flow.record.fieldtypes.net.ipv4.SubnetList attribute) subs (dissect.eventlog.bxml.Template attribute) SubSchema (class in dissect.database.ese.ntds.objects.subschema) subscriber (flow.record.adapter.broker.BrokerReader attribute) SUBSCRIPT (dissect.database.ese.lcmapstring.CASE attribute) subscription (flow.record.adapter.broker.BrokerReader attribute) substitute_name (dissect.archive.wim.ReparsePoint property) (dissect.ntfs.attr.ReparsePoint property) substitute_token_and_add_to_template() (dissect.eventlog.bxml.Bxml method) SubStreamBase (class in dissect.evidence.asdf.stream) subtype (dissect.apfs.objects.base.Object property) Subvolume (class in dissect.btrfs.btrfs) subvolume (dissect.btrfs.btrfs.INode attribute) (dissect.target.filesystems.btrfs.BtrfsFilesystem attribute) subvolumes() (dissect.btrfs.btrfs.Btrfs method) SUCCESS (acquire.acquire.collector.Outcome attribute) (dissect.target.helpers.sunrpc.sunrpc.AcceptStat attribute) SudoService (class in dissect.target.plugins.os.unix.log.auth) suffix_length (flow.record.adapter.split.SplitWriter attribute) suid_binaries() (dissect.target.plugins.filesystem.unix.suid.SuidPlugin method) SuidPlugin (class in dissect.target.plugins.filesystem.unix.suid) SuidRecord (in module dissect.target.plugins.filesystem.unix.suid) summary (dissect.database.bsd.tools.rpm.Package property) SUN_ND (dissect.target.helpers.network.IANAProtocol attribute) SUNDAY (in module dissect.target.plugins.os.windows.datetime) SundayFirstCalendar (in module dissect.target.plugins.os.windows.datetime) super_class_name (dissect.cim.classes.ClassDefinition property) supported (dissect.target.filesystems.nfs.AuthFlavorNotSupported attribute) SUPPORTED_TYPES (in module dissect.cstruct.compiler) suppress() (in module dissect.target.loaders.mqtt) SuSEPlugin (class in dissect.target.plugins.os.unix.linux.suse._os) SuService (class in dissect.target.plugins.os.unix.log.auth) SW_SHOWNORMAL (in module acquire.acquire.gui.win32) swap() (in module dissect.cstruct.utils) swap16() (in module dissect.cstruct.utils) swap32() (in module dissect.cstruct.utils) swap64() (in module dissect.cstruct.utils) SWIPE (dissect.target.helpers.network.IANAProtocol attribute) switching (dissect.fve.bde.bde.BDE property) SymantecPlugin (class in dissect.target.plugins.apps.av.symantec) Symbol (class in dissect.executable.elf.elf) (class in dissect.util.compression.lzxpress_huffman) symbol (dissect.executable.elf.elf.Symbol attribute) (dissect.util.compression.lzfse.DecoderEntry attribute) (dissect.util.compression.lzxpress_huffman.Node attribute) (dissect.util.compression.lzxpress_huffman.Symbol attribute) symbol() (dissect.etl.etl.Event method) SYMBOL_1 (dissect.database.ese.lcmapstring.SCRIPT attribute) SYMBOL_2 (dissect.database.ese.lcmapstring.SCRIPT attribute) SYMBOL_3 (dissect.database.ese.lcmapstring.SCRIPT attribute) SYMBOL_4 (dissect.database.ese.lcmapstring.SCRIPT attribute) SYMBOL_5 (dissect.database.ese.lcmapstring.SCRIPT attribute) SYMBOL_6 (dissect.database.ese.lcmapstring.SCRIPT attribute) symbol_table (dissect.clfs.blf.Context attribute) symbol_tables (dissect.executable.elf.elf.ELF attribute) SYMBOLIC_LINK (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) SymbolTable (class in dissect.executable.elf.elf) SYMLINK (acquire.acquire.collector.ArtifactType attribute) symlink() (dissect.target.filesystem.LayerFilesystem method) (dissect.target.filesystem.VirtualFilesystem method) SYMLINK_FLAG (in module dissect.archive.c_wim) symlink_to() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) SymlinkRecursionError SymlinkUnavailableException SYN_RECV (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) SYN_SENT (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) SYNCHRONIZE (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) syntax (dissect.database.ese.ntds.schema.AttributeEntry attribute) SYNTAX_ENCODE_DECODE_MAP (in module dissect.database.ese.ntds.util) Sys (class in acquire.acquire.acquire) Syscache (class in acquire.acquire.acquire) syscache() (dissect.target.plugins.os.windows.syscache.SyscachePlugin method) SyscachePlugin (class in dissect.target.plugins.os.windows.syscache) SyscacheRecord (in module dissect.target.plugins.os.windows.syscache) syskey (dissect.target.plugins.os.windows.lsa.LSAPlugin property) SyslogConfigParser (class in dissect.target.plugins.os.unix.linux.network) sysmodules() (dissect.target.plugins.os.unix.linux.modules.ModulePlugin method) SYSOBJ (in module dissect.database.ese.c_ese) system (dissect.cim.cim.CIM attribute) SYSTEM (dissect.target.plugins.os.unix.bsd.darwin.ios._os.Config attribute) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin attribute) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin attribute) (dissect.target.plugins.os.windows.registry.RegistryPlugin attribute) SYSTEM_APPS (dissect.target.plugins.os.unix.applications.UnixApplicationsPlugin attribute) system_data (dissect.target.plugins.os.windows.regf.cit.CIT attribute) SYSTEM_DIRS (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin attribute) system_flags (dissect.database.ese.ntds.objects.object.Object property) SYSTEM_GLOBS (dissect.target.plugins.apps.remoteaccess.teamviewer.TeamViewerPlugin attribute) SYSTEM_HANDLE_INFORMATION_EX (class in acquire.acquire.dynamic.windows.types) SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX (class in acquire.acquire.dynamic.windows.types) system_header (dissect.etl.headers.logfile.LogfileHeader attribute) system_id (dissect.volume.lvm.metadata.VolumeGroup attribute) system_identities() (dissect.target.plugins.os.windows.ual.UalPlugin method) SYSTEM_INCOMING_GLOBS (dissect.target.plugins.apps.remoteaccess.teamviewer.TeamViewerPlugin attribute) SYSTEM_INFORMATION_CLASS (class in acquire.acquire.dynamic.windows.types) SYSTEM_KEY (dissect.target.plugins.os.windows.lsa.LSAPlugin attribute) system_may_contain (dissect.database.ese.ntds.objects.classschema.ClassSchema property) system_must_contain (dissect.database.ese.ntds.objects.classschema.ClassSchema property) SYSTEM_NAMESPACE_NAME (in module dissect.cim.c_cim) SYSTEM_PATHS (dissect.target.plugins.apps.container.podman.PodmanPlugin attribute) (dissect.target.plugins.os.unix.applications.UnixApplicationsPlugin attribute) (dissect.target.plugins.os.windows.search.SearchIndexPlugin attribute) SYSTEM_SID (dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin attribute) SystemD (class in dissect.target.helpers.configutil) systemd() (dissect.target.plugins.os.unix.linux.services.ServicesPlugin method) SYSTEMD_PATHS (dissect.target.plugins.os.unix.linux.services.ServicesPlugin attribute) SystemData (class in dissect.target.plugins.os.windows.regf.cit) SystemDataBitmaps (class in dissect.target.plugins.os.windows.regf.cit) SystemdLogindService (class in dissect.target.plugins.os.unix.log.auth) SystemdNetworkConfigParser (class in dissect.target.plugins.os.unix.linux.network) SystemdNetworkConfigParser.DhcpConfig (class in dissect.target.plugins.os.unix.linux.network) SystemExtendedHandleInformation (acquire.acquire.dynamic.windows.types.SYSTEM_INFORMATION_CLASS attribute) SystemFlags (class in dissect.database.ese.ntds.util) SystemHandleInformation (acquire.acquire.dynamic.windows.types.SYSTEM_INFORMATION_CLASS attribute) SystemHeader (class in dissect.etl.headers.system) SystemIdentityRecord (in module dissect.target.plugins.os.windows.ual) SYSTEMINFO (dissect.etl.headers.headers.EventProperty attribute) SystemSpecificHeader (class in dissect.etl.headers.system) SYSTEMTIME (dissect.eventlog.bxml.BxmlType attribute) SYSVOL_SUBST (in module acquire.acquire.utils) SYSVOL_UPPER_SUBST (in module acquire.acquire.utils) SZ (dissect.target.helpers.regutil.RegistryValueType attribute) T T (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) t (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) T (in module acquire.acquire.uploaders.plugin_registry) (in module dissect.archive.vbk) (in module dissect.cstruct.cstruct) (in module dissect.cstruct.types.base) (in module dissect.cstruct.types.packed) (in module dissect.cstruct.types.pointer) (in module dissect.executable.elf.elf) (in module dissect.target.helpers.utils) (in module dissect.target.loaders.local) (in module dissect.target.target) (in module dissect.volume.vinum.vinum) Table (class in dissect.database.ese.table) (class in dissect.database.sqlite3.sqlite3) (class in dissect.executable.elf.elf) (class in dissect.hypervisor.disk.asif) table (dissect.archive.vbk.FibStream attribute) (dissect.database.ese.cursor.Cursor attribute) (dissect.database.ese.index.Index attribute) (dissect.database.ese.ntds.database.DataTable attribute) (dissect.database.ese.ntds.database.LinkTable attribute) (dissect.database.ese.ntds.database.SecurityDescriptorTable attribute) (dissect.database.ese.record.RecordData attribute) (dissect.database.ese.tools.sru.Entry attribute) (dissect.evidence.asdf.asdf.AsdfSnapshot attribute) (dissect.evidence.asdf.asdf.AsdfStream attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry attribute) (dissect.hypervisor.disk.asif.Directory attribute) (dissect.target.plugins.os.windows.search.TableRecord attribute) (in module dissect.database.ese.sorting_table) table() (dissect.database.ese.ese.ESE method) (dissect.database.ese.table.Catalog method) (dissect.database.sqlite3.sqlite3.SQLite3 method) TABLE_FIELD (dissect.target.plugins.apps.av.mcafee.McAfeePlugin attribute) TABLE_LOG (dissect.target.plugins.apps.av.mcafee.McAfeePlugin attribute) table_name (dissect.database.sqlite3.sqlite3.Index attribute) (dissect.database.sqlite3.sqlite3.Table attribute) table_names() (flow.record.adapter.sqlite.SqliteReader method) table_offsets (dissect.evidence.ewf.ewf.Segment attribute) TableRecord (class in dissect.target.plugins.os.windows.search) tables (dissect.database.ese.table.Catalog attribute) (dissect.evidence.ewf.ewf.Segment attribute) tables() (dissect.database.ese.ese.ESE method) (dissect.database.ese.tools.certlog.CertLog method) (dissect.database.sqlite3.sqlite3.SQLite3 method) TableSection (class in dissect.evidence.ewf.ewf) Tag (class in dissect.database.ese.page) tag (dissect.archive.wim.ReparsePoint attribute) (dissect.database.ese.page.Node attribute) (dissect.database.ese.page.Tag attribute) (dissect.extfs.journal.DescriptorBlockTag attribute) (dissect.ntfs.attr.ReparsePoint property) (flow.record.adapter.splunk.SplunkWriter attribute) tag() (dissect.database.ese.page.Page method) tag_count (dissect.database.ese.page.Page attribute) TAG_FLAG (in module dissect.database.ese.c_ese) tag_header (dissect.ntfs.attr.ReparsePoint attribute) tag_map (dissect.database.bsd.tools.rpm.HeaderBlob attribute) TAG_MASKS (in module dissect.util.compression.lznt1) tag_reserved (dissect.database.ese.page.Page attribute) tag_size (dissect.volume.lvm.metadata.IntegritySegment attribute) TAG_TO_LCID (in module dissect.executable.pe.locale_id) TagField (class in dissect.database.ese.record) TAGFLD_HEADER (in module dissect.database.ese.c_ese) tags (dissect.volume.lvm.metadata.LogicalVolume attribute) (dissect.volume.lvm.metadata.PhysicalVolume attribute) (dissect.volume.lvm.metadata.Segment attribute) (dissect.volume.lvm.metadata.VolumeGroup attribute) tags() (dissect.database.ese.page.Page method) (dissect.extfs.journal.DescriptorBlock method) TaniumLoader (class in dissect.target.loaders.tanium) tar (dissect.archive.xva.XVA attribute) (dissect.evidence.asdf.asdf.Metadata attribute) (dissect.target.loaders.tar.TarLoader attribute) (dissect.target.loaders.tar.TarSubLoader attribute) TAR_COMPRESSION_METHODS (in module acquire.acquire.outputs.tar) TAR_EXT (in module dissect.target.loaders.tar) TAR_EXT_COMP (in module dissect.target.loaders.tar) TAR_MAGIC (in module dissect.target.loaders.tar) TAR_MAGIC_COMP (in module dissect.target.loaders.tar) TarFilesystem (class in dissect.target.filesystems.tar) (in module dissect.target.filesystem) TarFilesystemDirectoryEntry (class in dissect.target.filesystems.tar) TarFilesystemEntry (class in dissect.target.filesystems.tar) tarfs (dissect.target.loaders.containerimage.ContainerImageTarSubLoader attribute) target (acquire.acquire.collector.CollectionReport attribute) (acquire.acquire.collector.Collector attribute) Target (class in dissect.target.target) target (dissect.target.filesystem.RootFilesystem attribute) (dissect.target.filesystem.VirtualSymlink attribute) (dissect.target.helpers.nfs.nfs3.ReadlinkResult attribute) (dissect.target.plugin.Plugin attribute) (dissect.target.plugins.apps.browser.iexplore.WebCache attribute) (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin attribute) (dissect.target.plugins.os.unix.linux.debian.vyos._os.VyosPlugin attribute) (dissect.target.plugins.os.unix.linux.network_managers.LinuxNetworkManager attribute) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager attribute) (dissect.target.plugins.os.unix.linux.network_managers.Parser attribute) (dissect.target.plugins.os.unix.linux.proc.ProcProcess attribute) (dissect.target.plugins.os.unix.linux.proc.Sockets attribute) (dissect.target.plugins.os.unix.log.auth.AuthLogRecordBuilder attribute) (dissect.target.plugins.os.unix.log.journal.JournalFile attribute) (dissect.target.plugins.os.windows.log.schedlgu.SchedLgUPlugin attribute) (dissect.target.target.Collection attribute) (dissect.target.tools.dump.RecordStreamElement attribute) (dissect.target.tools.shell.TargetCmd attribute) (dissect.target.tools.utils.report.TargetExecutionReport attribute) target_fields (dissect.target.helpers.record.ExtendableRecordDescriptor attribute) target_idlist (dissect.shellitem.lnk.lnk.Lnk attribute) (dissect.shellitem.lnk.lnk.LnkTargetIdList attribute) target_path (dissect.target.tools.dump.Sink attribute) target_paths (dissect.target.tools.dump.DumpState attribute) target_reports (dissect.target.tools.utils.report.ExecutionReport attribute) target_shell() (in module dissect.target.tools.shell) TargetCli (class in dissect.target.tools.shell) TargetCmd (class in dissect.target.tools.shell) TargetComparison (class in dissect.target.tools.diff) TargetError TargetExecutionReport (class in dissect.target.tools.utils.report) TargetHubCli (class in dissect.target.tools.shell) TargetLoader (class in dissect.target.loaders.target) TargetLogAdapter (class in dissect.target.helpers.logging) TargetPath (class in dissect.target.helpers.compat.path_310) (class in dissect.target.helpers.compat.path_311) (class in dissect.target.helpers.compat.path_312) (class in dissect.target.helpers.compat.path_313) TargetPathNotFoundError TargetRecordDescriptor (in module dissect.target.helpers.record) TargetRecordDescriptorExtension (class in dissect.target.helpers.descriptor_extensions) targets (dissect.target.tools.diff.DifferentialCli attribute) (dissect.target.tools.shell.TargetHubCli attribute) TarLoader (class in dissect.target.loaders.tar) TarOutput (class in acquire.acquire.outputs.tar) TarSubLoader (class in dissect.target.loaders.tar) TASK (class in dissect.eventlog.wevt_object) task (dissect.etl.headers.event.EventDescriptor attribute) task_element (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) task_name (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) task_path (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.ScheduledTasks attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) Tasks (class in acquire.acquire.acquire) tasks (dissect.target.plugins.os.windows.tasks.xml.ScheduledTasks attribute) TBHISTORY_COLUMN_MAP (in module dissect.target.plugins.os.windows.wua_history) tbz (dissect.vmfs.address.FileBlockAddr property) (dissect.vmfs.address.LargeFileBlockAddr property) (dissect.vmfs.address.SmallFileBlockAddr property) TCF (dissect.target.helpers.network.IANAProtocol attribute) TCP (dissect.target.helpers.network.IANAProtocol attribute) (dissect.target.helpers.sunrpc.sunrpc.Protocol attribute) (flow.record.adapter.splunk.Protocol attribute) tcp() (dissect.target.plugins.os.unix.linux.proc.Sockets method) (dissect.target.plugins.os.unix.linux.sockets.NetSocketPlugin method) tcp6() (dissect.target.plugins.os.unix.linux.proc.Sockets method) TCP_CLOSE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) TCP_INIT (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) TCP_KEEPCNT (dissect.target.helpers.sunrpc.client.Client attribute) TCP_KEEPIDLE (dissect.target.helpers.sunrpc.client.Client attribute) TCP_KEEPINTVL (dissect.target.helpers.sunrpc.client.Client attribute) TcpIpGuid (in module dissect.etl.utils) TDLC (dissect.target.plugins.os.windows.network.IfTypes attribute) TeamviewerIncomingRecord (in module dissect.target.plugins.apps.remoteaccess.teamviewer) TeamViewerPlugin (class in dissect.target.plugins.apps.remoteaccess.teamviewer) Tee (in module dissect.target.helpers.cache) telemetry() (dissect.target.plugins.os.windows.regf.cit.CITPlugin method) tell (dissect.hypervisor.disk.vmdk.RawDisk attribute) (dissect.target.containers.raw.RawContainer attribute) tell() (acquire.acquire.crypt.EncryptedStream method) (dissect.evidence.asdf.stream.SubStreamBase method) (dissect.target.container.Container method) (dissect.target.containers.asdf.AsdfContainer method) (dissect.target.containers.asif.AsifContainer method) (dissect.target.containers.ewf.EwfContainer method) (dissect.target.containers.fortifw.FortiFirmwareContainer method) (dissect.target.containers.hdd.HddContainer method) (dissect.target.containers.hds.HdsContainer method) (dissect.target.containers.qcow2.QCow2Container method) (dissect.target.containers.split.SplitContainer method) (dissect.target.containers.vdi.VdiContainer method) (dissect.target.containers.vhd.VhdContainer method) (dissect.target.containers.vhdx.VhdxContainer method) (dissect.target.containers.vmdk.VmdkContainer method) (dissect.target.volume.Volume method) (dissect.util.stream.AlignedStream method) (dissect.util.stream.BitStream method) TEMP (class in dissect.eventlog.wevt_object) temp (dissect.target.helpers.cache.CacheWriter attribute) TEMP_DESCRIPTOR (class in dissect.eventlog.wevt_object) TEMP_DUPLICATE_ACCOUNT (dissect.database.ese.ntds.util.UserAccountControl attribute) Template (class in dissect.eventlog.bxml) (class in dissect.target.plugins.os.unix.linux.network_managers) template (dissect.eventlog.bxml.Bxml attribute) (dissect.eventlog.wevt_object.TEMP attribute) (dissect.target.plugins.os.unix.linux.network_managers.Parser attribute) TEMPLATE (in module dissect.target.tools.build_magic) TEMPLATE_ID_INFECTION (dissect.target.plugins.apps.av.mcafee.McAfeePlugin attribute) templates (dissect.eventlog.bxml.Bxml attribute) (dissect.eventlog.evtx.ElfChnk attribute) TEMPLATES (in module dissect.target.plugins.os.unix.linux.network_managers) TerminalServerMRURecord (in module dissect.target.plugins.os.windows.regf.mru) TERMPAD (dissect.target.plugins.os.windows.network.IfTypes attribute) test (dissect.volume.vss.StoreBitmap attribute) text (dissect.fve.bde.information.UnicodeDatum property) TextEditor (class in acquire.acquire.acquire) textPgs (dissect.hypervisor.util.vmtar.VisorTarInfo attribute) TextWriter (class in flow.record.adapter.text) thin_pool (dissect.volume.lvm.metadata.ThinSegment attribute) ThinDevice (class in dissect.volume.dm.thin) ThinPool (class in dissect.volume.dm.thin) ThinPoolSegment (class in dissect.volume.lvm.metadata) ThinSegment (class in dissect.volume.lvm.metadata) THREAD (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) thread (acquire.acquire.gui.base.GUI attribute) (flow.record.adapter.elastic.ElasticWriter attribute) (flow.record.tools.rdump.ProgressMonitor attribute) thread_id (dissect.etl.headers.event.EventHeader property) (dissect.etl.headers.headers.EventInstanceGUIDHeader property) (dissect.etl.headers.headers.EventTraceHeader property) (dissect.etl.headers.headers.MessageTraceHeader property) (dissect.etl.headers.system.CompactSystemHeader property) (dissect.etl.headers.system.SystemHeader property) ThreadGuid (in module dissect.etl.utils) ThreadPoolGuid (in module dissect.etl.utils) threat_id (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntry attribute) Thumbcache (class in dissect.thumbcache.thumbcache) thumbcache() (dissect.target.plugins.os.windows.thumbcache.ThumbcachePlugin method) thumbcache_def (in module dissect.thumbcache.c_thumbcache) ThumbcacheEntry (class in dissect.thumbcache.thumbcache_file) ThumbcacheFile (class in dissect.thumbcache.thumbcache_file) ThumbcachePlugin (class in dissect.target.plugins.os.windows.thumbcache) ThumbcacheRecord (in module dissect.target.plugins.os.windows.thumbcache) ThumbnailCache (class in acquire.acquire.acquire) ThumbnailIndex (class in dissect.thumbcache.index) ThumbnailType (class in dissect.thumbcache.util) tile_to_bitmap() (in module dissect.target.plugins.os.windows.rdpcache) time (dissect.fve.luks.metadata.KeyslotKdf attribute) time_delta (dissect.etl.headers.headers.Header property) (dissect.etl.headers.headers.MessageTraceHeader property) time_format (dissect.target.plugins.os.windows.firewall.LogConfig attribute) TIME_WAIT (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) TimeGenerated (dissect.eventlog.evt.Record attribute) timeline() (dissect.target.plugins.filesystem.ntfs.mft.MftPlugin method) timeout (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) timeout() (in module acquire.acquire.volatilestream) TIMER (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) timestamp (acquire.acquire.tools.decrypter.EncryptedFile property) (dissect.cim.classes.ClassDefinition property) TIMESTAMP (dissect.etl.headers.headers.EventProperty attribute) timestamp (dissect.etl.headers.headers.Header property) (dissect.evidence.asdf.asdf.AsdfSnapshot attribute) (dissect.executable.pe.directory.bound_import.BoundImportForwardReference property) (dissect.executable.pe.directory.bound_import.BoundImportModule property) (dissect.executable.pe.directory.debug.DebugEntry property) (dissect.executable.pe.directory.delay_import.DelayImportModule property) (dissect.executable.pe.directory.export.ExportDirectory property) (dissect.executable.pe.directory.imports.ImportModule property) (dissect.executable.pe.directory.load_config.LoadConfigDirectory property) (dissect.executable.pe.directory.resource.ResourceDirectoryEntry property) (dissect.executable.pe.pe.PE property) (dissect.ntfs.usnjrnl.UsnRecord property) (dissect.regf.regf.KeyNode property) (dissect.target.helpers.regutil.KeyCollection property) (dissect.target.helpers.regutil.RegfKey property) (dissect.target.helpers.regutil.RegistryKey property) (dissect.target.helpers.regutil.VirtualKey property) (dissect.target.loaders.cb.CbRegistryKey property) (dissect.target.loaders.smb.SmbRegistryKey property) (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntry attribute) (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) (dissect.volume.vinum.config.Plex attribute) (dissect.volume.vinum.config.SD attribute) (dissect.volume.vinum.config.Volume attribute) timestamp_base (dissect.etl.headers.logfile.LogfileHeader attribute) timestamp_ns (dissect.ntfs.usnjrnl.UsnRecord property) timestamp_scale (dissect.etl.headers.logfile.LogfileHeader attribute) TimestampRecord (in module flow.record.base) timestamps (dissect.target.loaders.mqtt.MqttTransferRatePerSecond attribute) (dissect.target.loaders.res.File attribute) TimeTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) TimeWritten (dissect.eventlog.evt.Record attribute) timezone() (dissect.target.plugins.os.default.locale.LocalePlugin method) (dissect.target.plugins.os.unix.bsd.citrix.locale.CitrixLocalePlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios.locale.LocalePlugin method) (dissect.target.plugins.os.unix.linux.fortios.locale.FortiOSLocalePlugin method) (dissect.target.plugins.os.unix.locale.UnixLocalePlugin method) (dissect.target.plugins.os.windows.locale.WindowsLocalePlugin method) timezone_from_path() (in module dissect.target.plugins.os.unix.locale) TimezoneInformation (class in dissect.target.plugins.os.windows.datetime) tls (dissect.executable.pe.pe.PE property) TlsDirectory (class in dissect.executable.pe.directory.tls) TLSP (dissect.target.helpers.network.IANAProtocol attribute) to_base64() (in module flow.record.utils) to_bytes() (in module flow.record.utils) to_list() (in module dissect.target.helpers.utils) to_native_str() (in module flow.record.utils) to_record() (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext method) (dissect.target.plugins.os.unix.linux.network.ProcConfigParser.ParserContext method) to_str() (in module flow.record.utils) to_unix() (in module dissect.util.ts) to_unix_ms() (in module dissect.util.ts) to_unix_ns() (in module dissect.util.ts) to_unix_us() (in module dissect.util.ts) to_utc() (dissect.target.plugins.os.default.datetime.DateTimePlugin method) TOC (class in dissect.cim.objects) toc (dissect.apfs.objects.btree_node.BTreeNode property) (dissect.cim.classes.ClassInstance attribute) (dissect.cim.objects.DataPage attribute) TOK (dissect.cstruct.parser.TokenParser attribute) TOKEN (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) Token (class in dissect.cstruct.parser) (class in dissect.eventlog.bxml) (class in dissect.fve.luks.metadata) token (dissect.cstruct.parser.Token attribute) (dissect.eventlog.bxml.Token attribute) TOKEN_ADJUST_PRIVILEGES (acquire.acquire.dynamic.windows.types.ProcessToken attribute) TOKEN_CONFIG_MAP (in module dissect.volume.vinum.config) TOKEN_MASK (dissect.eventlog.bxml.Token attribute) TOKEN_PRIVILEGES (class in acquire.acquire.dynamic.windows.types) TOKEN_QUERY (acquire.acquire.dynamic.windows.types.ProcessToken attribute) TokenCollection (class in dissect.cstruct.parser) TokenConsumer (class in dissect.cstruct.parser) tokenize() (dissect.cstruct.expression.ExpressionTokenizer method) (in module dissect.volume.vinum.config) TokenizeError TOKENIZER_EXPRESSION (dissect.database.sqlite3.sqlite3.Column attribute) TokenParser (class in dissect.cstruct.parser) tokens (dissect.cstruct.expression.Expression attribute) (dissect.cstruct.expression.ExpressionTokenizer attribute) (dissect.cstruct.parser.TokenCollection attribute) (dissect.cstruct.parser.TokenConsumer attribute) (dissect.fve.luks.metadata.Metadata attribute) Toml (class in dissect.target.helpers.configutil) TOP (acquire.acquire.acquire.ExecutionOrder attribute) Top (class in dissect.database.ese.ntds.objects.top) top (dissect.target.filesystem.VirtualDirectory attribute) (dissect.target.helpers.regutil.VirtualKey attribute) (dissect.util.plist.NSKeyedArchiver attribute) top_guid (dissect.hypervisor.disk.hdd.Snapshots attribute) topo (dissect.target.loaders.mqtt.Broker attribute) topo() (dissect.target.loaders.mqtt.MqttConnection method) topology() (dissect.target.loaders.mqtt.Broker method) total_bits (dissect.util.compression.lzfse.ValueDecoderEntry attribute) total_entries (dissect.thumbcache.index.ThumbnailIndex property) total_peers (dissect.target.loaders.mqtt.MqttDiagnosticLine attribute) total_sectors (dissect.fat.fat.FATFS attribute) total_size (dissect.target.loaders.mqtt.DiskMessage attribute) touch() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) TP_WORKER_FACTORY (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) tpm_encrypted_blob() (dissect.fve.bde.information.VmkInfoDatum method) TpmEncryptedBlobDatum (class in dissect.fve.bde.information) TPPP (dissect.target.helpers.network.IANAProtocol attribute) TR008 (dissect.target.plugins.os.windows.network.IfTypes attribute) tr_tm_when (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) trace() (dissect.target.helpers.logging.TargetLogAdapter method) (dissect.target.helpers.logging.TraceLogger method) trace_files (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin attribute) TRACE_LEVEL (in module dissect.target.helpers.logging) TraceLogger (class in dissect.target.helpers.logging) TRACKER_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) trailer_data (dissect.target.containers.fortifw.FortiFirmwareFile attribute) trailer_offset (dissect.target.containers.fortifw.FortiFirmwareFile attribute) transaction_id (dissect.volume.lvm.metadata.ThinPoolSegment attribute) (dissect.volume.lvm.metadata.ThinSegment attribute) transform_app_id() (in module dissect.target.plugins.os.windows.sru) transform_timestamp() (in module dissect.target.plugins.os.windows.sru) TRANSFORMS (in module dissect.target.plugins.os.windows.sru) translate() (dissect.target.plugins.os.unix.linux.network_managers.Parser method) translate_file_path() (in module dissect.target.loaders.itunes) translate_network_config() (dissect.target.plugins.os.unix.linux.network_managers.Parser method) translate_partition_type() (in module dissect.volume.disk.partition) translate_timezone() (in module dissect.target.plugins.os.unix.linux.fortios.locale) translate_tz() (in module dissect.target.plugins.os.windows.datetime) translated_path (dissect.target.loaders.itunes.FileInfo attribute) TRANSPHDLC (dissect.target.plugins.os.windows.network.IfTypes attribute) transport_agents() (dissect.target.plugins.os.windows.exchange.exchange.ExchangePlugin method) trash() (dissect.target.plugins.os.unix.trash.GnomeTrashPlugin method) trashes (dissect.target.plugins.os.unix.trash.GnomeTrashPlugin attribute) TrashRecord (in module dissect.target.plugins.os.unix.trash) tree (dissect.btrfs.btrfs.Subvolume property) (dissect.executable.pe.directory.resource.ResourceDirectory attribute) tree_id (dissect.target.filesystems.smb.SmbStream attribute) TrendMicroPlugin (class in dissect.target.plugins.apps.av.trendmicro) TrendMicroWFFirewallRecord (in module dissect.target.plugins.apps.av.trendmicro) TrendMicroWFLogRecord (in module dissect.target.plugins.apps.av.trendmicro) trie_ip_line_re (dissect.target.plugins.os.unix.linux.network.ProcConfigParser attribute) TRIGRAM_SIZE_BYTES (dissect.target.plugins.os.unix.locate.plocate.PLocateFile attribute) TRUE (dissect.target.helpers.sunrpc.sunrpc.Bool attribute) truncate_records() (dissect.clfs.blf.BLF method) TruncateRecord (class in dissect.clfs.blf) TRUNK_1 (dissect.target.helpers.network.IANAProtocol attribute) TRUNK_2 (dissect.target.helpers.network.IANAProtocol attribute) TRUSTED_FOR_DELEGATION (dissect.database.ese.ntds.util.UserAccountControl attribute) TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION (dissect.database.ese.ntds.util.UserAccountControl attribute) trusteddocs() (dissect.target.plugins.os.windows.regf.trusteddocs.TrustedDocumentsPlugin method) TrustedDocumentsPlugin (class in dissect.target.plugins.os.windows.regf.trusteddocs) TrustedDocumentsRecord (in module dissect.target.plugins.os.windows.regf.trusteddocs) TrustedDomain (class in dissect.database.ese.ntds.objects.trusteddomain) trustrecord_def (in module dissect.target.plugins.os.windows.regf.trusteddocs) trusts() (dissect.database.ese.ntds.ntds.NTDS method) try_decode_sz() (in module dissect.regf.regf) try_idna() (in module dissect.target.plugins.apps.browser.browser) ts (dissect.extfs.journal.CommitBlock attribute) (dissect.hypervisor.descriptor.vbox.Snapshot property) (dissect.target.helpers.regutil.RegistryKey property) (dissect.target.plugins.os.unix.locate.mlocate.MLocate attribute) (dissect.target.plugins.os.unix.log.utmp.UtmpRecord attribute) (dissect.target.plugins.os.windows.log.schedlgu.SchedLgU attribute) ts() (dissect.etl.etl.Event method) ts1 (dissect.cim.classes.ClassInstance attribute) ts2 (dissect.cim.classes.ClassInstance attribute) TS_ID (dissect.etl.headers.event.ExtType attribute) ts_ns (dissect.target.plugins.os.unix.locate.mlocate.MLocate attribute) ts_to_ns() (in module dissect.ntfs.util) TTBL_WEVT_TYPE (class in dissect.eventlog.wevt) TUNNEL (dissect.target.plugins.os.windows.network.IfTypes attribute) TUNNEL_NAME_RE (dissect.target.plugins.apps.vpn.wireguard.WireGuardPlugin attribute) TupleIndexed (dissect.database.ese.ntds.util.SearchFlags attribute) tx_cycle() (flow.record.adapter.duckdb.DuckdbWriter method) (flow.record.adapter.sqlite.SqliteWriter method) tx_queue (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) tx_rx_queue (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) Txt (class in dissect.target.helpers.configutil) TYPE (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) type (dissect.apfs.objects.base.Object property) (dissect.apfs.objects.fs.DirectoryEntry property) (dissect.apfs.objects.fs.INode property) (dissect.apfs.objects.keybag.Keybag property) (dissect.archive.vbk.DirItem property) (dissect.archive.vbk.FibBlockDescriptor property) (dissect.archive.vbk.FibMetaSparseTable attribute) (dissect.archive.vbk.MetaVector attribute) (dissect.btrfs.btrfs.INode property) (dissect.btrfs.stream.Chunk attribute) (dissect.cim.cim.Property property) (dissect.cim.classes.ClassDefinitionProperty attribute) (dissect.cim.classes.ClassInstanceProperty property) (dissect.cim.classes.QualifierReference attribute) (dissect.clfs.blf.Container attribute) (dissect.clfs.blf.Context attribute) (dissect.clfs.blf.Stream attribute) (dissect.cstruct.types.base.BaseArray attribute) (dissect.cstruct.types.enum.EnumMetaType attribute) (dissect.cstruct.types.pointer.Pointer attribute) (dissect.cstruct.types.structure.Field attribute) (dissect.database.bsd.db.Page property) (dissect.database.ese.ntds.sd.ACE property) (dissect.database.ese.table.Column attribute) (dissect.database.sqlite3.sqlite3.Index attribute) (dissect.database.sqlite3.sqlite3.Table attribute) (dissect.evidence.ad1.ad1.FileEntry property) (dissect.evidence.ad1.ad1.FileMeta attribute) (dissect.evidence.ewf.ewf.SectionDescriptor attribute) (dissect.executable.elf.elf.Section attribute) (dissect.executable.elf.elf.Segment attribute) (dissect.executable.elf.elf.Symbol attribute) (dissect.executable.pe.directory.basereloc.BaseRelocation attribute) (dissect.executable.pe.directory.debug.DebugEntry property) (dissect.executable.pe.directory.resource.Resource attribute) (dissect.executable.pe.directory.security.Certificate property) (dissect.ffs.ffs.INode property) (dissect.fve.bde.information.Datum property) (dissect.fve.luks.metadata.Digest attribute) (dissect.fve.luks.metadata.Keyslot attribute) (dissect.fve.luks.metadata.KeyslotAf attribute) (dissect.fve.luks.metadata.KeyslotArea attribute) (dissect.fve.luks.metadata.KeyslotKdf attribute) (dissect.fve.luks.metadata.Segment attribute) (dissect.fve.luks.metadata.SegmentIntegrity attribute) (dissect.fve.luks.metadata.Token attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.hypervisor.descriptor.vbox.HardDisk property) (dissect.hypervisor.disk.hdd.Image attribute) (dissect.hypervisor.disk.vdi.VDI property) (dissect.hypervisor.disk.vhdx.ParentLocator attribute) (dissect.hypervisor.disk.vmdk.ExtentDescriptor attribute) (dissect.hypervisor.util.envelope.EnvelopeAttribute attribute) (dissect.jffs.jffs2.DirEntry attribute) (dissect.jffs.jffs2.INode property) (dissect.ntfs.attr.Attribute property) (dissect.ntfs.attr.AttributeHeader property) (dissect.ntfs.secure.ACE property) (dissect.ole.ole.DirectoryEntry attribute) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx6.INode6 property) (dissect.regf.regf.KeyValue property) (dissect.squashfs.squashfs.INode property) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) (dissect.target.helpers.regutil.RegFlexValue property) (dissect.target.helpers.regutil.RegfValue property) (dissect.target.helpers.regutil.RegistryValue property) (dissect.target.helpers.regutil.ValueCollection property) (dissect.target.helpers.regutil.VirtualValue property) (dissect.target.loaders.cb.CbRegistryValue property) (dissect.target.loaders.cellebrite.Dump attribute) (dissect.target.loaders.cellebrite.Extraction attribute) (dissect.target.loaders.cellebrite.Keychain attribute) (dissect.target.loaders.smb.SmbRegistryValue property) (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) (dissect.target.plugins.os.windows.jumplist.JumpListFile property) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM attribute) (dissect.target.volume.Volume attribute) (dissect.thumbcache.index.IndexEntry attribute) (dissect.thumbcache.index.ThumbnailIndex property) (dissect.vmfs.address.Address property) (dissect.vmfs.descriptor.DirEntry attribute) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.vmfs.resource.ResourceFile attribute) (dissect.volume.ddf.ddf.ControllerData attribute) (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) (dissect.volume.ddf.ddf.PhysicalDiskRecord attribute) (dissect.volume.ddf.ddf.VirtualDiskRecord attribute) (dissect.volume.disk.partition.Partition attribute) (dissect.volume.lvm.metadata.LogicalVolume property) (dissect.volume.lvm.metadata.Segment attribute) (flow.record.base.RecordField attribute) type_flags (dissect.apfs.objects.base.Object property) type_id (dissect.eventlog.bxml.BxmlTemplateDescriptor attribute) TYPE_MAP (in module dissect.squashfs.c_squashfs) (in module dissect.util.cpio) TYPE_MAX (dissect.etl.headers.event.ExtType attribute) type_name (acquire.acquire.dynamic.windows.named_objects.NamedObject attribute) (acquire.acquire.dynamic.windows.types.OBJECT_DIRECTORY_INFORMATION property) (dissect.volume.disk.partition.Partition attribute) TYPE_PARSERS (in module dissect.database.bsd.tools.rpm) TYPE_POSIX (in module flow.record.fieldtypes) TYPE_READERS (in module dissect.eventlog.bxml) TYPE_SIZE_MAP (in module dissect.database.bsd.tools.rpm) type_str (dissect.volume.disk.partition.Partition attribute) TYPE_VARIATIONS (in module dissect.target.plugins.os.windows.regf.shimcache) TYPE_WINDOWS (in module flow.record.fieldtypes) typedefs (dissect.cstruct.cstruct.cstruct attribute) typedlist (class in flow.record.fieldtypes) TypeMatcher (class in flow.record.selector) TypeMatcherInstance (class in flow.record.selector) typename (flow.record.base.RecordField attribute) types (dissect.database.sqlite3.sqlite3.Cell property) TYPES (dissect.volume.disk.schemes.bsd.BSD attribute) (flow.record.packer.RecordPacker attribute) (in module dissect.target.helpers.magic.mimetypes) (in module dissect.target.helpers.magic.mimetypes.freedesktop) (in module dissect.target.helpers.magic.mimetypes.overrides) tz() (dissect.target.plugins.os.default.datetime.DateTimePlugin method) (dissect.target.plugins.os.windows.datetime.WindowsDateTimePlugin method) tz_def (in module dissect.target.plugins.os.windows.datetime) tzi (dissect.target.plugins.os.windows.datetime.WindowsTimezone attribute) tzinfo (dissect.target.filesystems.fat.FatFilesystem attribute) (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) tzinfo() (dissect.target.plugins.os.default.datetime.DateTimePlugin method) (dissect.target.plugins.os.unix.datetime.UnixDateTimePlugin method) (dissect.target.plugins.os.windows.datetime.WindowsDateTimePlugin method) tzname() (dissect.target.plugins.os.windows.datetime.WindowsTimezone method) U u16() (in module dissect.cstruct.utils) u32() (in module dissect.cstruct.utils) u64() (in module dissect.cstruct.utils) u8() (in module dissect.cstruct.utils) UAC_CHECK_FILE (in module dissect.target.loaders.uac) UacLoader (class in dissect.target.loaders.uac) UacTarSubloader (class in dissect.target.loaders.uac) UacZipSubLoader (class in dissect.target.loaders.uac) UAL (class in dissect.database.ese.tools.ual) UalPlugin (class in dissect.target.plugins.os.windows.ual) UalValue (in module dissect.database.ese.tools.ual) UDP (dissect.target.helpers.network.IANAProtocol attribute) (dissect.target.helpers.sunrpc.sunrpc.Protocol attribute) udp() (dissect.target.plugins.os.unix.linux.proc.Sockets method) (dissect.target.plugins.os.unix.linux.sockets.NetSocketPlugin method) udp6() (dissect.target.plugins.os.unix.linux.proc.Sockets method) UDP_DATA (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) UDP_LITE (dissect.target.helpers.network.IANAProtocol attribute) UdpIpGuid (in module dissect.etl.utils) Ufd (class in dissect.target.loaders.cellebrite) ufd (dissect.target.loaders.cellebrite.CellebriteLoader attribute) Ufdx (class in dissect.target.loaders.cellebrite) ufdx (dissect.target.loaders.cellebrite.CellebriteLoader attribute) ufstimestamp (in module dissect.util.ts) uid (dissect.apfs.objects.fs.INode property) (dissect.btrfs.btrfs.INode property) (dissect.cramfs.cramfs.INode property) (dissect.jffs.jffs2.INode property) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx6.INode6 property) (dissect.squashfs.squashfs.INode property) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) (dissect.target.helpers.sunrpc.sunrpc.AuthUnix attribute) (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) uint16 (class in flow.record.fieldtypes) UINT16 (dissect.eventlog.bxml.BxmlType attribute) uint32 (class in flow.record.fieldtypes) UINT32 (dissect.eventlog.bxml.BxmlType attribute) UInt32Serializer (class in dissect.target.helpers.sunrpc.serializer) UINT64 (dissect.eventlog.bxml.BxmlType attribute) UINT8 (dissect.eventlog.bxml.BxmlType attribute) ulDAEMagic (in module dissect.database.ese.c_ese) ULTRA (dissect.target.plugins.os.windows.network.IfTypes attribute) UmsEventGuid (in module dissect.etl.utils) UNALLOCATED_SUBCLUSTER_TYPES (in module dissect.hypervisor.disk.c_qcow2) unary_operators (dissect.cstruct.expression.Expression attribute) unbiased_ordinal (dissect.executable.pe.directory.export.ExportFunction attribute) unbind() (acquire.acquire.collector.Collector method) unbox() (dissect.fve.bde.information.AesCcmEncryptedDatum method) unchanged (dissect.target.tools.diff.DirectoryDifferential attribute) UnexpectedResponse UNICODE_STRING (class in acquire.acquire.dynamic.windows.types) UnicodeDatum (class in dissect.fve.bde.information) unified_scheduling_engine (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) UnimplementedHeader (class in dissect.etl.headers.headers) Union (class in dissect.cstruct.types.structure) UnionMetaType (class in dissect.cstruct.types.structure) UnionProxy (class in dissect.cstruct.types.structure) unique_key() (in module dissect.target.plugins.os.windows.log.evtx) unique_process_id (acquire.acquire.dynamic.windows.types.Handle attribute) (acquire.acquire.dynamic.windows.types.SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX property) UNIX (dissect.target.plugin.OperatingSystem attribute) unix() (dissect.target.plugins.os.unix.linux.proc.Sockets method) (dissect.target.plugins.os.unix.linux.sockets.NetSocketPlugin method) UNIX_ACCESSORS (in module dissect.target.loaders.velociraptor) unix_file_mode (class in flow.record.fieldtypes) unix_now() (in module dissect.util.ts) unix_now_ms() (in module dissect.util.ts) unix_now_ns() (in module dissect.util.ts) unix_now_us() (in module dissect.util.ts) UnixApplicationRecord (in module dissect.target.plugins.os.unix.applications) UnixApplicationsPlugin (class in dissect.target.plugins.os.unix.applications) UnixConfigTreeRecord (in module dissect.target.plugins.os.unix.etc.etc) UnixDateTimePlugin (class in dissect.target.plugins.os.unix.datetime) UnixInterfaceRecord (in module dissect.target.helpers.record) UnixKeyboardRecord (in module dissect.target.plugins.os.unix.locale) UnixLocalePlugin (class in dissect.target.plugins.os.unix.locale) UnixPlugin (class in dissect.target.plugins.os.unix._os) UnixShadowRecord (in module dissect.target.plugins.os.unix.shadow) UnixSocket (class in dissect.target.plugins.os.unix.linux.proc) UnixSocketRecord (in module dissect.target.plugins.os.unix.linux.sockets) UnixUserRecord (in module dissect.target.helpers.record) UNKNOWN (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) (class in dissect.target.plugins.os.windows.regf.shellbags) (dissect.etl.headers.event.ExtType attribute) (dissect.target.plugins.apps.container.podman.ContainerState attribute) (dissect.target.plugins.os.windows.amcache.PcaGeneralDbType attribute) unknown (dissect.target.plugins.os.windows.regf.cit.SystemDataBitmaps attribute) UNKNOWN0 (class in dissect.target.plugins.os.windows.regf.shellbags) UNKNOWN1 (class in dissect.target.plugins.os.windows.regf.shellbags) UNKNOWN_0x74 (class in dissect.target.plugins.os.windows.regf.shellbags) UNKNOWN_BYTES (in module dissect.thumbcache.thumbcache_file) unknown_extensions (dissect.hypervisor.disk.qcow2.QCow2 attribute) unknown_extra (dissect.hypervisor.disk.qcow2.QCow2Snapshot attribute) unknown_fields (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntryResource attribute) UnknownSignatureException UnknownThumbnailTypeError unlink() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) unload_address (dissect.executable.pe.directory.delay_import.DelayImportFunction attribute) unlock() (dissect.apfs.objects.fs.FS method) (dissect.database.ese.ntds.pek.PEK method) (dissect.evidence.ad1.ad1.AD1 method) (dissect.evidence.adcrypt.adcrypt.ADCrypt method) (dissect.fve.bde.bde.BDE method) (dissect.fve.luks.luks.LUKS method) (dissect.hypervisor.descriptor.vmx.Pair method) (dissect.target.loaders.ab.AndroidBackup method) unlock_volume() (dissect.target.volumes.bde.BitlockerVolumeSystem method) (dissect.target.volumes.luks.LUKSVolumeSystem method) unlock_with_bek() (dissect.fve.bde.bde.BDE method) unlock_with_bek_file() (dissect.target.volumes.bde.BitlockerVolumeSystem method) unlock_with_clear_key() (dissect.fve.bde.bde.BDE method) unlock_with_fvek() (dissect.fve.bde.bde.BDE method) (dissect.target.volumes.bde.BitlockerVolumeSystem method) unlock_with_key_fh() (dissect.fve.luks.luks.LUKS method) unlock_with_key_file() (dissect.fve.luks.luks.LUKS method) (dissect.target.volumes.luks.LUKSVolumeSystem method) unlock_with_passcode_key() (dissect.target.loaders.itunes.KeyBag method) unlock_with_passphrase() (dissect.fve.bde.bde.BDE method) (dissect.fve.luks.luks.LUKS method) (dissect.target.volumes.bde.BitlockerVolumeSystem method) (dissect.target.volumes.luks.LUKSVolumeSystem method) unlock_with_phrase() (dissect.hypervisor.descriptor.vmx.Pair method) (dissect.hypervisor.descriptor.vmx.VMX method) unlock_with_recovery_key() (dissect.target.volumes.bde.BitlockerVolumeSystem method) unlock_with_recovery_password() (dissect.fve.bde.bde.BDE method) unlock_with_volume_encryption_key() (dissect.target.volumes.luks.LUKSVolumeSystem method) unlocked (dissect.database.ese.ntds.pek.PEK property) (dissect.fve.bde.bde.BDE property) (dissect.fve.luks.luks.LUKS property) (dissect.target.loaders.ab.AndroidBackup attribute) UNMAPPED_PAGE_VALUE (in module dissect.cim.c_cim) UnmappedPageError unmatched (flow.record.context.AppContext attribute) unmount_time (dissect.apfs.objects.fs.FS property) unpack() (flow.record.jsonpacker.JsonRecordPacker method) (flow.record.packer.RecordPacker method) (in module dissect.cstruct.utils) unpack_obj() (flow.record.jsonpacker.JsonRecordPacker method) (flow.record.packer.RecordPacker method) unpack_timestamps() (in module dissect.target.plugins.os.windows.regf.usb) unpackb (in module flow.record.packer) unseal_with_phrase() (dissect.hypervisor.descriptor.vmx.KeySafe method) UNSORTABLE (dissect.database.ese.lcmapstring.SCRIPT attribute) UnsupportedDataforkException UnsupportedPluginError UnsupportedVersion unwrap() (dissect.apfs.objects.keybag.KEK method) (dissect.apfs.objects.keybag.VEK method) (dissect.hypervisor.descriptor.vmx.Phrase method) (dissect.target.helpers.configutil.ListUnwrapper static method) (dissect.target.loaders.itunes.ClassKey method) (dissect.target.loaders.itunes.KeyBag method) unwrapped (dissect.target.loaders.itunes.ClassKey property) up (dissect.target.filesystem.VirtualDirectory attribute) UP (dissect.volume.vinum.config.PlexState attribute) (dissect.volume.vinum.config.SDState attribute) (dissect.volume.vinum.config.VolumeState attribute) upcase_table (dissect.fat.exfat.ExFAT attribute) UPCASE_TABLE_ENTRY (in module dissect.fat.c_exfat) Update (dissect.target.plugins.os.unix.packagemanager.OperationTypes attribute) update() (dissect.evidence.tools.asdf.dd.Progress method) (dissect.target.helpers.configutil.ScopeManager method) (dissect.target.tools.dump.DumpState method) (in module dissect.util.hash.crc32) (in module dissect.util.hash.crc32c) update_descriptor_columns() (in module flow.record.adapter.sqlite) update_interval (flow.record.tools.rdump.ProgressMonitor attribute) update_prev() (dissect.target.helpers.configutil.ScopeManager method) update_progress_bar() (flow.record.tools.rdump.ProgressMonitor method) update_time (dissect.volume.md.md.MDPhysicalDisk attribute) UpdateDatum (class in dissect.fve.bde.information) UPF (class in dissect.target.loaders.res) upf (dissect.target.loaders.res.File attribute) (dissect.target.loaders.res.Folder attribute) upload_available (acquire.acquire.gui.base.GUI attribute) upload_file() (acquire.acquire.uploaders.minio.MinIO method) (acquire.acquire.uploaders.plugin.UploaderPlugin method) upload_files() (in module acquire.acquire.acquire) upload_files_using_uploader() (in module acquire.acquire.uploaders.plugin) upload_label (acquire.acquire.gui.win32.Win32 attribute) UploaderPlugin (class in acquire.acquire.uploaders.plugin) UploaderRegistry (in module acquire.acquire.uploaders.plugin_registry) UPPER (dissect.database.ese.lcmapstring.CASE attribute) upper() (in module flow.record.selector) UPR (class in dissect.target.loaders.res) uptime (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) URI (class in dissect.target.plugins.os.windows.regf.shellbags) uri (class in flow.record.fieldtypes) (dissect.target.plugins.os.windows.regf.shellbags.URI attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) (flow.record.adapter.elastic.ElasticReader attribute) (flow.record.adapter.elastic.ElasticWriter attribute) usable_page_size (dissect.database.sqlite3.sqlite3.SQLite3 attribute) usage_counter (dissect.archive.vbk.StgBlockDescriptor property) USAGE_FORMAT_TMPL (in module dissect.target.tools.utils.cli) USB (dissect.target.plugins.os.windows.network.IfTypes attribute) usb() (dissect.target.plugins.os.windows.regf.usb.UsbPlugin method) USB_DEVICE_PROPERTY_KEYS (in module dissect.target.plugins.os.windows.regf.usb) USB_STOR (dissect.target.plugins.os.windows.regf.usb.UsbPlugin attribute) UsbPlugin (class in dissect.target.plugins.os.windows.regf.usb) UsbRegistryRecord (in module dissect.target.plugins.os.windows.regf.usb) use_compression (dissect.volume.lvm.metadata.VdoPoolSegment attribute) use_data (dissect.target.plugins.os.windows.regf.cit.Entry attribute) use_deduplication (dissect.volume.lvm.metadata.VdoPoolSegment attribute) use_default_value (dissect.cim.c_cim.ClassInstancePropertyState attribute) USE_DES_KEY_ONLY (dissect.database.ese.ntds.util.UserAccountControl attribute) use_key() (dissect.fve.bde.information.VmkInfoDatum method) use_keys() (dissect.fve.bde.information.VmkInfoDatum method) use_metadata_hints (dissect.volume.lvm.metadata.VdoPoolSegment attribute) use_sparse_index (dissect.volume.lvm.metadata.VdoPoolSegment attribute) used (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) used_by (dissect.target.plugins.os.unix.linux.modules.Module attribute) used_entries (dissect.thumbcache.index.ThumbnailIndex property) UseKeyDatum (class in dissect.fve.bde.information) User (class in dissect.database.ese.ntds.objects.user) user (dissect.database.bsd.tools.rpm.PackageEntry attribute) (dissect.target.plugins.general.users.UserDetails attribute) (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) user() (dissect.target.plugins.os.windows.regf.clsid.CLSIDPlugin method) user32 (in module acquire.acquire.gui.win32) user_account_control (dissect.database.ese.ntds.objects.user.User property) user_config_paths (dissect.target.plugins.apps.vpn.openvpn.OpenVPNPlugin attribute) USER_DIRS (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin attribute) user_env() (dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin method) user_flags (dissect.ole.ole.DirectoryEntry attribute) USER_GLOBS (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin attribute) (dissect.target.plugins.apps.remoteaccess.rustdesk.RustdeskPlugin attribute) (dissect.target.plugins.apps.remoteaccess.teamviewer.TeamViewerPlugin attribute) user_id (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) user_key (dissect.target.plugins.os.windows.dpapi.master_key.CredSystem attribute) user_metadata (dissect.hypervisor.disk.asif.ASIF property) USER_MOUNTS (dissect.target.plugins.os.windows.regf.usb.UsbPlugin attribute) USER_PATH (dissect.target.plugins.os.unix.bsd.darwin.macos.user.UserPlugin attribute) USER_PATHS (dissect.target.plugins.apps.container.podman.PodmanPlugin attribute) (dissect.target.plugins.child.virtualbox.VirtualBoxChildTargetPlugin attribute) (dissect.target.plugins.os.unix.applications.UnixApplicationsPlugin attribute) (dissect.target.plugins.os.windows.search.SearchIndexPlugin attribute) user_sid (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry attribute) USER_VARIABLES (dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin attribute) UserAccountControl (class in dissect.database.ese.ntds.util) userassist() (dissect.target.plugins.os.windows.regf.userassist.UserAssistPlugin method) userassist_def (in module dissect.target.plugins.os.windows.regf.userassist) UserAssistPlugin (class in dissect.target.plugins.os.windows.regf.userassist) UserAssistRecord (in module dissect.target.plugins.os.windows.regf.userassist) UserAssistRecordDescriptor (in module dissect.target.plugins.os.windows.regf.userassist) UserDetails (class in dissect.target.plugins.general.users) userdirs (dissect.target.plugins.apps.browser.chromium.ChromiumMixin attribute) username (class in flow.record.fieldtypes.credential) (dissect.target.loaders.mqtt.Broker attribute) (flow.record.fieldtypes.uri property) UserPlugin (class in dissect.target.plugins.os.unix.bsd.darwin.macos.user) UserRecord (in module dissect.target.plugins.general.users) UserRecordDescriptorExtension (class in dissect.target.helpers.descriptor_extensions) UserRegistryRecordDescriptor (in module dissect.target.plugins.os.windows.generic) (in module dissect.target.plugins.os.windows.regf.mru) users() (dissect.database.ese.ntds.ntds.NTDS method) (dissect.target.loaders.profile.ProfileOSPlugin method) (dissect.target.loaders.res.ResOSPlugin method) (dissect.target.plugin.OSPlugin method) (dissect.target.plugins.os.default._os.DefaultOSPlugin method) (dissect.target.plugins.os.unix._os.UnixPlugin method) (dissect.target.plugins.os.unix.bsd.citrix._os.CitrixPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin method) (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSPlugin method) (dissect.target.plugins.os.windows._os.WindowsPlugin method) (dissect.target.plugins.os.windows.ad.ntds.NtdsPlugin method) users_dirs (dissect.target.plugins.apps.browser.iexplore.InternetExplorerPlugin attribute) users_files (dissect.target.plugins.os.unix.linux.recentlyused.RecentlyUsedPlugin attribute) USERS_PROPERTY_VIEW (class in dissect.target.plugins.os.windows.regf.shellbags) users_tabs (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadPlugin attribute) UserSid (dissect.eventlog.evt.Record attribute) UsersPlugin (class in dissect.target.plugins.general.users) uses_pbkdf2() (dissect.fve.bde.information.VmkInfoDatum method) USN_PAGE_SIZE (in module dissect.ntfs.c_ntfs) UsnJrnl (class in dissect.ntfs.usnjrnl) usnjrnl (dissect.ntfs.ntfs.NTFS attribute) (dissect.ntfs.usnjrnl.UsnRecord attribute) usnjrnl() (dissect.target.plugins.filesystem.ntfs.usnjrnl.UsnjrnlPlugin method) USNJRNL_PATHS (in module dissect.target.loaders.kape) UsnjrnlPlugin (class in dissect.target.plugins.filesystem.ntfs.usnjrnl) UsnjrnlRecord (in module dissect.target.plugins.filesystem.ntfs.usnjrnl) UsnRecord (class in dissect.ntfs.usnjrnl) ut_addr (dissect.target.plugins.os.unix.log.utmp.UtmpRecord attribute) ut_host (dissect.target.plugins.os.unix.log.utmp.UtmpRecord attribute) ut_id (dissect.target.plugins.os.unix.log.utmp.UtmpRecord attribute) ut_line (dissect.target.plugins.os.unix.log.utmp.UtmpRecord attribute) ut_pid (dissect.target.plugins.os.unix.log.utmp.UtmpRecord attribute) ut_type (dissect.target.plugins.os.unix.log.utmp.UtmpRecord attribute) ut_user (dissect.target.plugins.os.unix.log.utmp.UtmpRecord attribute) UTC (in module flow.record.fieldtypes) (in module flow.record.packer) utcoffset() (dissect.target.plugins.os.windows.datetime.WindowsTimezone method) UTI (dissect.target.helpers.network.IANAProtocol attribute) UtmLoader (class in dissect.target.loaders.utm) utmp_def (in module dissect.target.plugins.os.unix.log.utmp) UTMP_FIELDS (in module dissect.target.plugins.os.unix.log.utmp) utmp_paths (dissect.target.plugins.os.unix.log.utmp.UtmpPlugin attribute) UtmpFile (class in dissect.target.plugins.os.unix.log.utmp) UtmpPlugin (class in dissect.target.plugins.os.unix.log.utmp) UtmpRecord (class in dissect.target.plugins.os.unix.log.utmp) uuid (dissect.apfs.apfs.APFS property) (dissect.apfs.objects.fs.FS property) (dissect.apfs.objects.keybag.KEK property) (dissect.apfs.objects.keybag.VEK property) (dissect.apfs.objects.nx_superblock.NxSuperblock property) (dissect.archive.vma.Extent attribute) (dissect.archive.vma.VMA attribute) (dissect.btrfs.btrfs.Btrfs attribute) (dissect.btrfs.btrfs.Subvolume property) (dissect.extfs.extfs.ExtFS attribute) (dissect.fve.luks.luks.LUKS attribute) (dissect.hypervisor.descriptor.vbox.HardDisk property) (dissect.hypervisor.descriptor.vbox.Machine property) (dissect.hypervisor.descriptor.vbox.Snapshot property) (dissect.hypervisor.descriptor.vbox.VBox property) (dissect.target.loaders.itunes.ClassKey attribute) (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) (dissect.vmfs.lvm.Device attribute) (dissect.vmfs.lvm.Volume attribute) (dissect.vmfs.vmfs.VMFS attribute) (dissect.volume.raid.raid.VirtualDisk attribute) (dissect.xfs.xfs.XFS attribute) uuid1timestamp() (in module dissect.util.ts) V V11 (dissect.target.plugins.os.windows.network.IfTypes attribute) V35 (dissect.target.plugins.os.windows.network.IfTypes attribute) V36 (dissect.target.plugins.os.windows.network.IfTypes attribute) V37 (dissect.target.plugins.os.windows.network.IfTypes attribute) va_to_rva() (dissect.executable.pe.pe.PE method) val (flow.record.fieldtypes.net.ip.ipaddress attribute) (flow.record.fieldtypes.net.ip.ipinterface attribute) (flow.record.fieldtypes.net.ip.ipnetwork attribute) (flow.record.fieldtypes.net.ipv4.address attribute) valid (dissect.clfs.blf.ControlRecord property) (dissect.database.sqlite3.wal.Frame property) VALID_BPB_MEDIA (in module dissect.fat.c_fat) valid_max_banks (dissect.archive.vbk.SnapshotSlot attribute) valid_signatures (dissect.eventlog.wevt.WEVT_TYPE attribute) validate_bpb() (in module dissect.fat.fat) validate_header() (dissect.etl.headers.event.EventHeaderExtendedDataItem method) validate_ntstatus() (in module acquire.acquire.dynamic.windows.ntdll) validate_signature() (in module dissect.eventlog.wevt) Validation (class in dissect.fve.bde.information) validation (dissect.fve.bde.information.Information attribute) (dissect.fve.bde.information.Validation attribute) ValidationEntry (class in dissect.fve.bde.information) ValidationInfoDatum (class in dissect.fve.bde.information) value (dissect.apfs.objects.fs.DirectoryEntry attribute) (dissect.apfs.objects.fs.Snapshot attribute) (dissect.apfs.objects.fs.XAttr attribute) (dissect.cim.classes.ClassInstanceProperty property) (dissect.cim.classes.Qualifier attribute) (dissect.cim.classes.QualifierReference attribute) (dissect.cstruct.parser.Token attribute) (dissect.database.ese.util.ColumnType attribute) (dissect.eventlog.bxml.BxmlSub attribute) (dissect.executable.elf.elf.Symbol property) (dissect.extfs.extfs.XAttr attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.hypervisor.util.envelope.EnvelopeAttribute attribute) (dissect.regf.regf.KeyValue property) (dissect.target.helpers.keychain.Key attribute) (dissect.target.helpers.regutil.RegFlexValue property) (dissect.target.helpers.regutil.RegfValue property) (dissect.target.helpers.regutil.RegistryValue property) (dissect.target.helpers.regutil.ValueCollection property) (dissect.target.helpers.regutil.VirtualValue property) (dissect.target.loaders.cb.CbRegistryValue property) (dissect.target.loaders.smb.SmbRegistryValue property) (dissect.util.ldap.SearchFilter attribute) (dissect.vmfs.address.Address attribute) (flow.record.fieldtypes.boolean attribute) (flow.record.fieldtypes.uint16 attribute) (flow.record.fieldtypes.uint32 attribute) VALUE (in module dissect.regf.c_regf) value() (dissect.apfs.cursor.Cursor method) (dissect.database.bsd.tools.rpm.HeaderBlob method) (dissect.regf.regf.KeyNode method) (dissect.target.helpers.regutil.RegistryKey method) (dissect.target.loaders.mqtt.MqttTransferRatePerSecond method) (dissect.target.plugins.os.windows.registry.RegistryPlugin method) (dissect.volume.dm.btree.Node method) value_based_on_shndx() (dissect.executable.elf.elf.Symbol method) value_bits (dissect.util.compression.lzfse.ValueDecoderEntry attribute) value_size (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.volume.dm.btree.Node attribute) value_type (dissect.eventlog.bxml.BxmlTemplateDescriptor property) ValueCollection (class in dissect.target.helpers.regutil) ValueDecoderEntry (class in dissect.util.compression.lzfse) ValueList (class in dissect.regf.regf) values (dissect.database.sqlite3.sqlite3.Cell property) (dissect.target.helpers.regutil.ValueCollection attribute) VALUES (dissect.target.plugins.os.windows.productkey.WindowsProductKeyPlugin attribute) values() (dissect.hypervisor.descriptor.hyperv.HyperVFile method) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry method) (dissect.regf.regf.KeyNode method) (dissect.target.helpers.regutil.KeyCollection method) (dissect.target.helpers.regutil.RegfKey method) (dissect.target.helpers.regutil.RegistryKey method) (dissect.target.helpers.regutil.VirtualKey method) (dissect.target.loaders.cb.CbRegistryKey method) (dissect.target.loaders.smb.SmbRegistryKey method) (dissect.target.plugins.os.windows.registry.RegistryPlugin method) ValueType (in module dissect.target.helpers.regutil) Var (class in acquire.acquire.acquire) variable (dissect.target.plugins.os.unix.linux.proc.Environ attribute) VARIABLES (dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin attribute) varint (class in flow.record.fieldtypes) varint() (in module dissect.database.sqlite3.sqlite3) (in module dissect.ntfs.util) (in module dissect.util.compression.snappy) vbase (dissect.util.compression.lzfse.ValueDecoderEntry attribute) VBK (class in dissect.archive.vbk) vbk (dissect.archive.vbk.Bank attribute) (dissect.archive.vbk.FibMetaSparseTable attribute) (dissect.archive.vbk.FibStream attribute) (dissect.archive.vbk.MetaItem attribute) (dissect.archive.vbk.MetaVector attribute) (dissect.archive.vbk.PropertiesDictionary attribute) (dissect.archive.vbk.SnapshotSlot attribute) (dissect.target.filesystems.vbk.VbkFilesystem attribute) vbk_def (in module dissect.archive.c_vbk) VbkDirEntry (class in dissect.target.filesystems.vbk) VBKError VbkFilesystem (class in dissect.target.filesystems.vbk) VbkFilesystemEntry (class in dissect.target.filesystems.vbk) vbkfs (dissect.target.loaders.vbk.VbkLoader attribute) VbkLoader (class in dissect.target.loaders.vbk) VBLoader (class in dissect.target.loaders.vb) VBox (class in dissect.hypervisor.descriptor.vbox) vbox (dissect.hypervisor.descriptor.vbox.HardDisk attribute) (dissect.hypervisor.descriptor.vbox.Hardware attribute) (dissect.hypervisor.descriptor.vbox.Machine attribute) (dissect.hypervisor.descriptor.vbox.Snapshot attribute) vboxes (dissect.target.plugins.child.virtualbox.VirtualBoxChildTargetPlugin attribute) VBoxLoader (class in dissect.target.loaders.vbox) vbr (dissect.fat.exfat.ExFAT attribute) VcFeatureDebugEntry (class in dissect.executable.pe.directory.debug) vdcr (dissect.volume.ddf.ddf.DDFVirtualDisk attribute) VDI (class in dissect.hypervisor.disk.vdi) vdi (dissect.hypervisor.disk.vdi.VDIStream attribute) (dissect.target.containers.vdi.VdiContainer attribute) vdi_def (in module dissect.hypervisor.disk.c_vdi) VDI_IMAGE_BLOCK_FREE (in module dissect.hypervisor.disk.c_vdi) VDI_IMAGE_BLOCK_ZERO (in module dissect.hypervisor.disk.c_vdi) VDI_IMAGE_SIGNATURE (in module dissect.hypervisor.disk.c_vdi) VdiContainer (class in dissect.target.containers.vdi) VDIStream (class in dissect.hypervisor.disk.vdi) vdo_offset (dissect.volume.lvm.metadata.VdoSegment attribute) vdo_pool (dissect.volume.lvm.metadata.VdoSegment attribute) VdoPoolSegment (class in dissect.volume.lvm.metadata) VdoSegment (class in dissect.volume.lvm.metadata) vdr (dissect.volume.ddf.ddf.DDFVirtualDisk attribute) VDSL (dissect.target.plugins.os.windows.network.IfTypes attribute) VEK (class in dissect.apfs.objects.keybag) vek() (dissect.apfs.objects.keybag.ContainerKeybag method) VEKBlob (class in dissect.apfs.objects.keybag) VELOCIRAPTOR_RESULTS (in module dissect.target.plugins.apps.edr.velociraptor) VelociraptorDirectoryFilesystem (class in dissect.target.loaders.velociraptor) VelociraptorLoader (class in dissect.target.loaders.velociraptor) VelociraptorPlugin (class in dissect.target.plugins.apps.edr.velociraptor) VelociraptorRecordBuilder (class in dissect.target.plugins.apps.edr.velociraptor) VelociraptorZipFilesystem (class in dissect.target.loaders.velociraptor) vendor (dissect.target.loaders.cellebrite.DeviceInfo attribute) verbose (flow.record.adapter.line.LineWriter attribute) VERBOSITY_ALL (flow.record.selector.Selector attribute) VERBOSITY_BRANCHES (flow.record.selector.Selector attribute) VERBOSITY_NONE (flow.record.selector.Selector attribute) verf (dissect.target.helpers.sunrpc.sunrpc.AcceptedReply attribute) (dissect.target.helpers.sunrpc.sunrpc.CallBody attribute) verifier (dissect.target.helpers.sunrpc.client.AuthScheme attribute) Verifier (in module dissect.target.helpers.nfs.client.nfs) (in module dissect.target.helpers.sunrpc.client) (in module dissect.target.helpers.sunrpc.serializer) (in module dissect.target.helpers.sunrpc.sunrpc) verifier_serializer (dissect.target.helpers.sunrpc.client.AuthScheme attribute) verify (dissect.archive.xva.XVAStream attribute) (dissect.hypervisor.util.envelope.Envelope attribute) verify() (acquire.acquire.tools.decrypter.EncryptedFile method) (dissect.apfs.objects.keybag.KEK method) (dissect.apfs.objects.keybag.VEK method) (dissect.archive.vbk.Bank method) (dissect.archive.vbk.SnapshotSlot method) verify_hmac (dissect.database.sqlite3.encryption.sqlcipher.sqlcipher.SQLCipher attribute) VerifyError version (dissect.archive.vma.VMA attribute) (dissect.database.bsd.tools.rpm.Package property) (dissect.database.ese.ese.ESE attribute) (dissect.database.ese.ntds.pek.PEK property) (dissect.etl.headers.event.EventDescriptor attribute) (dissect.etl.headers.headers.Header property) (dissect.etl.headers.headers.MessageTraceHeader property) (dissect.evidence.ad1.ad1.LogicalImage attribute) (dissect.executable.pe.directory.com_descriptor.ComMetadata property) (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.fve.bde.bde.BDE property) (dissect.fve.bde.information.Information property) (dissect.fve.bde.information.Validation property) (dissect.hypervisor.descriptor.hyperv.HyperVFile property) (dissect.hypervisor.disk.asif.Directory attribute) (dissect.hypervisor.util.envelope.Envelope attribute) (dissect.jffs.jffs2.DirEntry attribute) (dissect.regf.regf.RegistryHive attribute) (dissect.target.helpers.sunrpc.sunrpc.CallBody attribute) (dissect.target.helpers.sunrpc.sunrpc.PortMapping attribute) (dissect.target.helpers.sunrpc.sunrpc.ProcedureDescriptor attribute) (dissect.target.loaders.ab.AndroidBackup attribute) VERSION (dissect.target.plugins.os.unix.bsd.darwin.ios._os.Config attribute) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin attribute) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin attribute) version (dissect.target.plugins.os.unix.log.atop.AtopFile attribute) (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry attribute) (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) (dissect.target.plugins.os.windows.everything.parser.EverythingDB attribute) (dissect.target.plugins.os.windows.firewall.LogConfig attribute) (dissect.target.plugins.os.windows.jumplist.CustomDestinationFile attribute) (dissect.target.plugins.os.windows.log.schedlgu.SchedLgU attribute) (dissect.target.plugins.os.windows.prefetch.Prefetch attribute) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK property) (dissect.target.plugins.os.windows.regf.shimcache.ShimCache attribute) (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) (dissect.thumbcache.index.ThumbnailIndex property) (dissect.thumbcache.thumbcache_file.ThumbcacheFile property) (dissect.volume.lvm.lvm2.LVM2 attribute) (dissect.xfs.xfs.XFS attribute) VERSION (in module acquire.acquire.acquire) version (in module acquire.acquire.acquire) VERSION (in module dissect.evidence.asdf.asdf) version (in module flow.record.tools.rdump) version() (dissect.target.loaders.profile.ProfileOSPlugin method) (dissect.target.loaders.res.ResOSPlugin method) (dissect.target.plugin.OSPlugin method) (dissect.target.plugins.os.default._os.DefaultOSPlugin method) (dissect.target.plugins.os.unix.bsd.citrix._os.CitrixPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin method) (dissect.target.plugins.os.unix.bsd.freebsd._os.FreeBsdPlugin method) (dissect.target.plugins.os.unix.bsd.openbsd._os.OpenBsdPlugin method) (dissect.target.plugins.os.unix.esxi._os.ESXiPlugin method) (dissect.target.plugins.os.unix.linux._os.LinuxPlugin method) (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin method) (dissect.target.plugins.os.unix.linux.debian.proxmox._os.ProxmoxPlugin method) (dissect.target.plugins.os.unix.linux.debian.vyos._os.VyosPlugin method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSPlugin method) (dissect.target.plugins.os.windows._os.WindowsPlugin method) version_match() (in module dissect.target.plugins.os.windows.everything.parser) VERSION_NT52 (dissect.target.plugins.os.windows.regf.shimcache.SHIMCACHE_WIN_TYPE attribute) VERSION_NT61 (dissect.target.plugins.os.windows.regf.shimcache.SHIMCACHE_WIN_TYPE attribute) VERSION_WIN10 (dissect.target.plugins.os.windows.regf.shimcache.SHIMCACHE_WIN_TYPE attribute) VERSION_WIN10_CREATORS (dissect.target.plugins.os.windows.regf.shimcache.SHIMCACHE_WIN_TYPE attribute) VERSION_WIN81 (dissect.target.plugins.os.windows.regf.shimcache.SHIMCACHE_WIN_TYPE attribute) VERSION_WIN81_NO_HEADER (dissect.target.plugins.os.windows.regf.shimcache.SHIMCACHE_WIN_TYPE attribute) VERSIONS (dissect.target.plugins.os.windows.jumplist.CustomDestinationFile attribute) vfh (dissect.executable.pe.pe.PE attribute) vfs (dissect.target.filesystems.apfs.ApfsFilesystem attribute) VFS_CAP_FLAGS_EFFECTIVE (in module dissect.target.plugins.filesystem.unix.capability) VFS_CAP_FLAGS_MASK (in module dissect.target.plugins.filesystem.unix.capability) VFS_CAP_REVISION_1 (in module dissect.target.plugins.filesystem.unix.capability) VFS_CAP_REVISION_2 (in module dissect.target.plugins.filesystem.unix.capability) VFS_CAP_REVISION_3 (in module dissect.target.plugins.filesystem.unix.capability) VFS_CAP_REVISION_MASK (in module dissect.target.plugins.filesystem.unix.capability) VFS_CAP_REVISION_SHIFT (in module dissect.target.plugins.filesystem.unix.capability) VFS_CAP_U32_1 (in module dissect.target.plugins.filesystem.unix.capability) VFS_CAP_U32_2 (in module dissect.target.plugins.filesystem.unix.capability) VFS_CAP_U32_3 (in module dissect.target.plugins.filesystem.unix.capability) vfu() (dissect.target.plugins.os.windows.sru.SRUPlugin method) VfuRecord (in module dissect.target.plugins.os.windows.sru) vg (dissect.volume.lvm.lvm2.LVM2 property) (dissect.volume.lvm.metadata.HistoricalLogicalVolume property) (dissect.volume.lvm.metadata.LogicalVolume property) (dissect.volume.lvm.metadata.PhysicalVolume property) VHD (class in dissect.hypervisor.disk.vhd) vhd (dissect.target.containers.vhd.VhdContainer attribute) vhd_def (in module dissect.hypervisor.disk.c_vhd) VhdContainer (class in dissect.target.containers.vhd) VHDX (class in dissect.hypervisor.disk.vhdx) vhdx (dissect.hypervisor.disk.vhdx.BlockAllocationTable attribute) (dissect.target.containers.vhdx.VhdxContainer attribute) vhdx_def (in module dissect.hypervisor.disk.c_vhdx) VHDX_PARENT_LOCATOR_GUID (in module dissect.hypervisor.disk.c_vhdx) VhdxContainer (class in dissect.target.containers.vhdx) VINES (dissect.target.helpers.network.IANAProtocol attribute) Vinum (class in dissect.volume.vinum.vinum) vinum_def (in module dissect.volume.vinum.c_vinum) VinumConfigs (class in dissect.volume.vinum.config) VinumConfiguration (class in dissect.volume.vinum.vinum) VinumMirrorDisk (class in dissect.volume.vinum.vinum) VinumPhysicalDisk (class in dissect.volume.vinum.vinum) VinumPhysicalDiskDescriptor (in module dissect.volume.vinum.vinum) VinumPlexDisk (class in dissect.volume.vinum.vinum) virtual (dissect.executable.pe.pe.PE attribute) virtual_address (dissect.executable.elf.elf.Segment attribute) (dissect.executable.pe.pe.Section property) virtual_disk (dissect.volume.raid.stream.LinearStream attribute) (dissect.volume.raid.stream.RAID0Stream attribute) (dissect.volume.raid.stream.RAID10Stream attribute) (dissect.volume.raid.stream.RAID456Stream attribute) virtual_disk_configuration_record (dissect.volume.ddf.ddf.DDFVirtualDisk property) virtual_disk_configuration_records (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) VIRTUAL_DISK_ID_GUID (in module dissect.hypervisor.disk.c_vhdx) virtual_disk_record (dissect.volume.ddf.ddf.DDFVirtualDisk property) virtual_disk_records (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) VIRTUAL_DISK_SIZE_GUID (in module dissect.hypervisor.disk.c_vhdx) virtual_disks (dissect.volume.raid.raid.Configuration attribute) virtual_extents (dissect.volume.lvm.metadata.VdoPoolSegment attribute) virtual_hosts (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) virtual_machines() (dissect.target.plugins.os.windows.ual.UalPlugin method) virtual_offset (dissect.hypervisor.disk.asif.Table attribute) virtual_size (dissect.executable.pe.pe.Section property) VirtualBoxChildTargetPlugin (class in dissect.target.plugins.child.virtualbox) VirtualDirectory (class in dissect.target.filesystem) VirtualDirEntry (class in dissect.target.filesystem) VirtualDisk (class in dissect.volume.raid.raid) VirtualDiskConfigurationRecord (class in dissect.volume.ddf.ddf) VirtualDiskRecord (class in dissect.volume.ddf.ddf) VirtualEntry (class in dissect.evidence.ad1.ad1) VirtualFile (class in dissect.target.filesystem) VirtualFileHandle (class in dissect.target.filesystem) VirtualFilesystem (class in dissect.target.filesystem) VirtualHive (class in dissect.target.helpers.regutil) VIRTUALIPADDRESS (dissect.target.plugins.os.windows.network.IfTypes attribute) VirtualizationInfoDatum (class in dissect.fve.bde.information) virtualized_block_offset (dissect.fve.bde.information.Information property) (dissect.fve.bde.information.VirtualizationInfoDatum property) virtualized_block_size (dissect.fve.bde.information.VirtualizationInfoDatum property) virtualized_sectors (dissect.fve.bde.information.Information property) VirtualKey (class in dissect.target.helpers.regutil) VirtualMachineInventoryRecord (in module dissect.target.plugins.os.unix.esxi.vm) VirtualMachineOrphanRecord (in module dissect.target.plugins.os.unix.esxi.vm) VirtualMachinePlugin (class in dissect.target.plugins.os.unix.esxi.vm) (class in dissect.target.plugins.os.unix.linux.debian.proxmox.vm) VirtualMachineRecord (in module dissect.target.plugins.os.unix.linux.debian.proxmox.vm) (in module dissect.target.plugins.os.windows.ual) VirtualStream (class in dissect.executable.pe.pe) VirtualSymlink (class in dissect.target.filesystem) VirtualValue (class in dissect.target.helpers.regutil) VirtuozzoChildTargetPlugin (class in dissect.target.plugins.child.virtuozzo) VIRUS_TYPE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) VISA (dissect.target.helpers.network.IANAProtocol attribute) visibility (dissect.executable.elf.elf.Symbol attribute) visoropen() (dissect.hypervisor.util.vmtar.VisorTarFile class method) VisorTarFile (class in dissect.hypervisor.util.vmtar) VisorTarInfo (class in dissect.hypervisor.util.vmtar) VISTA_AND_ABOVE_IDLIST_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) vlan (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) VlanIdByInterface (in module dissect.target.plugins.os.unix.linux.network) VlvIndexed (dissect.database.ese.ntds.util.SearchFlags attribute) vm_xml (dissect.target.plugins.child.hyperv.HyperVChildTargetPlugin attribute) VMA (class in dissect.archive.vma) vma (dissect.archive.vma.Device attribute) (dissect.archive.vma.DeviceDataStream attribute) (dissect.target.loaders.vma.VmaLoader attribute) vma_def (in module dissect.archive.c_vma) VMA_EXTENT_MAGIC (in module dissect.archive.c_vma) VMA_MAGIC (in module dissect.archive.c_vma) VmaLoader (class in dissect.target.loaders.vma) VMAP (class in dissect.eventlog.wevt_object) vmcx (dissect.target.loaders.hyperv.HyperVLoader attribute) VMDK (class in dissect.hypervisor.disk.vmdk) vmdk (dissect.target.containers.vmdk.VmdkContainer attribute) vmdk_def (in module dissect.hypervisor.disk.c_vmdk) VMDK_MAGIC (in module dissect.hypervisor.disk.c_vmdk) VmdkContainer (class in dissect.target.containers.vmdk) VMFS (class in acquire.acquire.acquire) (class in dissect.vmfs.vmfs) vmfs (dissect.target.filesystems.vmfs.VmfsFilesystem attribute) (dissect.vmfs.descriptor.DirEntry attribute) (dissect.vmfs.descriptor.FileDescriptor attribute) (dissect.vmfs.resource.ResourceFile attribute) (dissect.vmfs.resource.ResourceManager attribute) (in module dissect.target.volume) vmfs_def (in module dissect.vmfs.c_vmfs) vmfs_uuid() (in module dissect.vmfs.util) VmfsDirEntry (class in dissect.target.filesystems.vmfs) VmfsFilesystem (class in dissect.target.filesystems.vmfs) VmfsFilesystemEntry (class in dissect.target.filesystems.vmfs) VmfsVolumeSystem (class in dissect.target.volumes.vmfs) VmkInfoDatum (class in dissect.fve.bde.information) vmlist() (dissect.target.plugins.os.unix.linux.debian.proxmox.vm.VirtualMachinePlugin method) VmSupportLoader (class in dissect.target.loaders.vmsupport) VmSupportTarSubloader (class in dissect.target.loaders.vmsupport) VmtarFilesystem (class in dissect.target.filesystems.vmtar) VMTP (dissect.target.helpers.network.IANAProtocol attribute) VmwareDragAndDropRecord (in module dissect.target.plugins.apps.virtualization.vmware_workstation) VmwareVirtualMachineRecord (in module dissect.target.plugins.apps.virtualization.vmware_workstation) VmwarevmLoader (class in dissect.target.loaders.vmwarevm) VmwareWorkstationChildTargetPlugin (class in dissect.target.plugins.child.vmware_workstation) VmwareWorkstationPlugin (class in dissect.target.plugins.apps.virtualization.vmware_workstation) VMX (class in dissect.hypervisor.descriptor.vmx) vmx (dissect.target.loaders.vmx.VmxLoader attribute) VmxLoader (class in dissect.target.loaders.vmx) VOICE_EM (dissect.target.plugins.os.windows.network.IfTypes attribute) VOICE_ENCAP (dissect.target.plugins.os.windows.network.IfTypes attribute) VOICE_FXO (dissect.target.plugins.os.windows.network.IfTypes attribute) VOICE_FXS (dissect.target.plugins.os.windows.network.IfTypes attribute) VOICE_OVERIP (dissect.target.plugins.os.windows.network.IfTypes attribute) VOICEOVERATM (dissect.target.plugins.os.windows.network.IfTypes attribute) VOICEOVERFRAMERELAY (dissect.target.plugins.os.windows.network.IfTypes attribute) Void (class in dissect.cstruct.types.void) VoidArray (class in dissect.cstruct.types.void) VOLATILE (in module acquire.acquire.acquire) (in module dissect.regf.regf) VOLATILE_LINUX_PATHS (in module dissect.target.loaders.local) VolatileProfile (class in acquire.acquire.acquire) VolatileStream (class in acquire.acquire.volatilestream) VOLUME (class in dissect.target.plugins.os.windows.regf.shellbags) Volume (class in dissect.target.volume) (class in dissect.vmfs.lvm) (class in dissect.volume.vinum.config) volume (dissect.apfs.objects.fs.DirectoryEntry attribute) (dissect.apfs.objects.fs.INode attribute) (dissect.apfs.stream.FileStream attribute) (dissect.evidence.ewf.ewf.EWF attribute) (dissect.evidence.ewf.ewf.Segment attribute) (dissect.evidence.ewf.ewf.VolumeSection attribute) (dissect.target.filesystem.Filesystem attribute) (dissect.vmfs.lvm.VolumeStream attribute) (dissect.volume.vinum.config.Plex attribute) (dissect.volume.vinum.vinum.VinumMirrorDisk attribute) (dissect.volume.vinum.vinum.VinumPlexDisk attribute) volume_group (dissect.volume.lvm.lvm2.LVM2 attribute) (dissect.volume.lvm.metadata.HistoricalLogicalVolume property) (dissect.volume.lvm.metadata.LogicalVolume property) (dissect.volume.lvm.metadata.PhysicalVolume property) VOLUME_HEADER_OFFSET (in module dissect.volume.vss) volume_id (dissect.fat.fat.FATFS attribute) (dissect.qnxfs.qnx6.QNX6 attribute) volume_identifier (dissect.volume.vss.VSS property) volume_keybag() (dissect.apfs.objects.keybag.ContainerKeybag method) volume_label (dissect.fat.exfat.ExFAT attribute) (dissect.fat.fat.FATFS attribute) VOLUME_LABEL_ENTRY (in module dissect.fat.c_exfat) volume_name (dissect.extfs.extfs.ExtFS attribute) (dissect.ffs.ffs.FFS attribute) (dissect.ntfs.ntfs.NTFS property) (dissect.target.plugins.os.windows.regf.shellbags.VOLUME attribute) volume_size (dissect.volume.vss.Store attribute) VolumeCollection (class in dissect.target.target) VolumeGroup (class in dissect.volume.lvm.metadata) VolumeKeybag (class in dissect.apfs.objects.keybag) VolumeNotAvailableError, [1] volumes (dissect.apfs.apfs.APFS property) (dissect.target.plugins.os.windows.prefetch.Prefetch attribute) (dissect.target.target.Target attribute) (dissect.target.volume.VolumeSystem property) (dissect.vmfs.lvm.Device attribute) (dissect.vmfs.lvm.LVM attribute) (dissect.volume.vinum.config.VinumConfigs attribute) (dissect.volume.vinum.vinum.Config attribute) VolumeSection (class in dissect.evidence.ewf.ewf) VolumeState (class in dissect.volume.vinum.config) VolumeStream (class in dissect.vmfs.lvm) VolumeSystem (class in dissect.target.volume) VolumeSystemError VRRP (dissect.target.helpers.network.IANAProtocol attribute) vs (dissect.target.container.Container attribute) (dissect.target.volume.Volume attribute) vs_version_info() (dissect.executable.pe.directory.resource.ResourceDirectory method) VSS (class in dissect.volume.vss) vss (dissect.volume.vss.Catalog attribute) vss_def (in module dissect.volume.vss) VSS_IDENTIFIER (in module dissect.volume.vss) vxd (dissect.executable.pe.directory.resource.ResourceDirectory property) VYOS (dissect.target.plugin.OperatingSystem attribute) VyosPlugin (class in dissect.target.plugins.os.unix.linux.debian.vyos._os) W W (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) WAIT_COMPLETION_PACKET (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) wait_for_quit() (acquire.acquire.gui.base.GUI method) (acquire.acquire.gui.base.Stub method) wait_for_start() (acquire.acquire.gui.base.GUI method) (acquire.acquire.gui.base.Stub method) wake_to_run (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) WAL (class in dissect.database.sqlite3.wal) wal (dissect.database.sqlite3.sqlite3.SQLite3 attribute) (dissect.database.sqlite3.wal.Frame attribute) WAL_HEADER_MAGIC (in module dissect.database.sqlite3.wal) WAL_HEADER_MAGIC_BE (in module dissect.database.sqlite3.wal) WAL_HEADER_MAGIC_LE (in module dissect.database.sqlite3.wal) walk() (dissect.apfs.cursor.Cursor method) (dissect.btrfs.tree.Cursor method) (dissect.database.ese.ntds.database.DataTable method) (dissect.database.ese.ntds.ntds.NTDS method) (dissect.extfs.journal.JDB2 method) (dissect.ole.ole.DirectoryEntry method) (dissect.regf.regf.RegistryHive method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) (dissect.target.plugins.os.windows.regf.regf.RegfPlugin method) (in module dissect.target.helpers.fsutil) (in module dissect.target.tools.fs) walk_agi() (dissect.xfs.xfs.AllocationGroup method) (dissect.xfs.xfs.XFS method) walk_ext() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (in module dissect.target.helpers.fsutil) walk_extents() (dissect.xfs.xfs.AllocationGroup method) (dissect.xfs.xfs.XFS method) walk_large_tree() (dissect.xfs.xfs.XFS method) walk_small_tree() (dissect.xfs.xfs.XFS method) walk_tree() (dissect.xfs.xfs.AllocationGroup method) (in module dissect.database.sqlite3.sqlite3) walkdir() (dissect.target.tools.diff.TargetComparison method) walkfs() (dissect.target.plugins.filesystem.walkfs.WalkFsPlugin method) WalkFsPlugin (class in dissect.target.plugins.filesystem.walkfs) WARNING (dissect.target.plugins.os.unix.log.journal.JournalMessagePriority attribute) was_path_seen() (acquire.acquire.collector.CollectionReport method) wb (flow.record.adapter.xlsx.XlsxReader attribute) (flow.record.adapter.xlsx.XlsxWriter attribute) WB_EXPAK (dissect.target.helpers.network.IANAProtocol attribute) WB_MON (dissect.target.helpers.network.IANAProtocol attribute) WBEM (class in acquire.acquire.acquire) Wchar (class in dissect.cstruct.types.wchar) WcharArray (class in dissect.cstruct.types.wchar) web() (dissect.target.plugins.apps.productivity.msoffice.MSOffice method) WebCache (class in dissect.target.plugins.apps.browser.iexplore) WebHosting (class in acquire.acquire.acquire) webkittimestamp() (in module dissect.util.ts) Webserver (class in acquire.acquire.acquire) WebserverAccessLogRecord (in module dissect.target.plugins.apps.webserver.webserver) WebserverCertificateRecord (in module dissect.target.plugins.apps.webserver.webserver) WebserverErrorLogRecord (in module dissect.target.plugins.apps.webserver.webserver) WebserverHostRecord (in module dissect.target.plugins.apps.webserver.webserver) WebserverPlugin (class in dissect.target.plugins.apps.webserver.webserver) WeeklyTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) well_known_objects (dissect.database.ese.ntds.objects.object.Object property) WER (class in acquire.acquire.acquire) wer() (dissect.target.plugins.os.windows.wer.WindowsErrorReportingPlugin method) wer_files (dissect.target.plugins.os.windows.wer.WindowsErrorReportingPlugin attribute) WER_LOG_DIRS (dissect.target.plugins.os.windows.wer.WindowsErrorReportingPlugin attribute) WESP (dissect.target.helpers.network.IANAProtocol attribute) WEVT (class in dissect.eventlog.wevt) wevt_headers() (dissect.eventlog.wevt.CRIM method) wevt_object_def (in module dissect.eventlog.wevt_object) WEVT_TYPE (class in dissect.eventlog.wevt) WevtName (class in dissect.eventlog.wevt_object) WevtNameReader (class in dissect.eventlog.bxml) WevtObject (class in dissect.eventlog.wevt_object) WevtutilWrapper (class in dissect.eventlog.wevtutil) wffirewall() (dissect.target.plugins.apps.av.trendmicro.TrendMicroPlugin method) wflogs() (dissect.target.plugins.apps.av.trendmicro.TrendMicroPlugin method) WgetHstsRecord (in module dissect.target.plugins.apps.shell.wget) WgetPlugin (class in dissect.target.plugins.apps.shell.wget) when_changed (dissect.database.ese.ntds.objects.object.Object property) when_created (dissect.database.ese.ntds.objects.object.Object property) WHITE (dissect.target.helpers.cyber.Color attribute) (dissect.target.tools.shell.AnsiColors attribute) WHITE_BRUSH (in module acquire.acquire.gui.win32) WHITELIST (in module flow.record.whitelist) WHITELIST_TREE (in module flow.record.whitelist) width (dissect.target.plugins.os.windows.rdpcache.BitmapTile attribute) WIM (class in dissect.archive.wim) wim (dissect.archive.wim.Image attribute) (dissect.archive.wim.Resource attribute) wim_def (in module dissect.archive.c_wim) WIM_IMAGE_TAG (in module dissect.archive.c_wim) Win32 (class in acquire.acquire.gui.win32) win_10_path() (in module dissect.target.plugins.os.windows.regf.shimcache) win_8_path() (in module dissect.target.plugins.os.windows.regf.shimcache) WIN_DATETIME_FIELDS (dissect.database.ese.tools.ual.UAL attribute) WinArpCache (class in acquire.acquire.acquire) WinDnsClientCache (class in acquire.acquire.acquire) window_size (dissect.target.loaders.mqtt.MqttTransferRatePerSecond attribute) WINDOWS (dissect.target.filesystems.cb.OS attribute) (dissect.target.plugin.OperatingSystem attribute) WINDOWS_10 (dissect.thumbcache.util.ThumbnailType attribute) WINDOWS_7 (dissect.thumbcache.util.ThumbnailType attribute) WINDOWS_81 (dissect.thumbcache.util.ThumbnailType attribute) WINDOWS_ACCESSORS (in module dissect.target.loaders.velociraptor) windows_command (class in flow.record.fieldtypes) WINDOWS_DRIVE_FIXED (in module dissect.target.loaders.local) WINDOWS_ERROR_INSUFFICIENT_BUFFER (in module dissect.target.loaders.local) WINDOWS_MEMBERS (in module dissect.target.loaders.tar) windows_path (class in flow.record.fieldtypes) WINDOWS_STATION (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) WINDOWS_VISTA (dissect.thumbcache.util.ThumbnailType attribute) WINDOWS_ZONE_MAP (in module dissect.target.helpers.localeutil) WindowsApplicationRecord (in module dissect.target.plugins.os.windows.regf.applications) WindowsApplicationsPlugin (class in dissect.target.plugins.os.windows.regf.applications) WindowsCredentialPlugin (class in dissect.target.plugins.os.windows.credential.credential) WindowsDateTimePlugin (class in dissect.target.plugins.os.windows.datetime) WindowsDynamicError WindowsErrorReportingPlugin (class in dissect.target.plugins.os.windows.wer) WindowsEventlogsMixin (class in dissect.target.plugins.os.windows.log.evt) WindowsFirewallLogRecord (in module dissect.target.plugins.os.windows.firewall) WindowsFirewallPlugin (class in dissect.target.plugins.os.windows.firewall) WindowsInterfaceRecord (in module dissect.target.helpers.record) WindowsKeyboardRecord (in module dissect.target.plugins.os.windows.locale) WindowsLocalePlugin (class in dissect.target.plugins.os.windows.locale) WindowsNetworkPlugin (class in dissect.target.plugins.os.windows.network) WindowsNotepadPlugin (class in dissect.target.plugins.apps.editor.windowsnotepad) WindowsNotepadSavedTabRecord (in module dissect.target.plugins.apps.editor.windowsnotepad) WindowsNotepadTab (class in dissect.target.plugins.apps.editor.windowsnotepad) WindowsNotepadUnsavedTabRecord (in module dissect.target.plugins.apps.editor.windowsnotepad) WindowsNotifications (class in acquire.acquire.acquire) WindowsPlugin (class in dissect.target.plugins.os.windows._os) WindowsProductKeyPlugin (class in dissect.target.plugins.os.windows.productkey) WindowsProductKeyRecord (in module dissect.target.plugins.os.windows.productkey) WindowsProfile (class in acquire.acquire.acquire) windowstab_def (in module dissect.target.plugins.apps.editor.windowsnotepad) WindowsTimezone (class in dissect.target.plugins.os.windows.datetime) WindowsUserRecord (in module dissect.target.helpers.record) winlogon() (dissect.target.plugins.os.windows.credential.winlogon.WinlogonPlugin method) WINLOGON_KEY (dissect.target.plugins.os.windows.credential.winlogon.WinlogonPlugin attribute) WinlogonDefaultPasswordKeyProviderPlugin (class in dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.winlogon) WinlogonPlugin (class in dissect.target.plugins.os.windows.credential.winlogon) WinlogonRecord (in module dissect.target.plugins.os.windows.credential.winlogon) WinMemDump (class in acquire.acquire.acquire) WinMemFiles (class in acquire.acquire.acquire) WinProcEnv (class in acquire.acquire.acquire) WinProcesses (class in acquire.acquire.acquire) winrar() (dissect.target.plugins.apps.productivity.winrar.WinRarPlugin method) WinRarPlugin (class in dissect.target.plugins.apps.productivity.winrar) WinRarRecord (in module dissect.target.plugins.apps.productivity.winrar) WinRDPSessions (class in acquire.acquire.acquire) winreg (dissect.target.loaders.smb.SmbRegistryHive attribute) winsocknamespaceprovider() (dissect.target.plugins.os.windows.generic.GenericPlugin method) WinSockNamespaceProviderRecord (in module dissect.target.plugins.os.windows.generic) wintimestamp() (in module dissect.util.ts) WireGuardInterfaceRecord (in module dissect.target.plugins.apps.vpn.wireguard) WireGuardPeerRecord (in module dissect.target.plugins.apps.vpn.wireguard) WireGuardPlugin (class in dissect.target.plugins.apps.vpn.wireguard) with_ip() (dissect.target.plugins.os.default.network.NetworkPlugin method) with_mac() (dissect.target.plugins.os.default.network.NetworkPlugin method) with_name() (dissect.target.helpers.compat.path_310.PureDissectPath method) (dissect.target.helpers.compat.path_311.PureDissectPath method) with_segments() (dissect.target.helpers.compat.path_312.PureDissectPath method) (dissect.target.helpers.compat.path_313.PureDissectPath method) with_stem() (dissect.target.helpers.compat.path_310.PureDissectPath method) (dissect.target.helpers.compat.path_311.PureDissectPath method) with_suffix() (dissect.target.helpers.compat.path_310.PureDissectPath method) (dissect.target.helpers.compat.path_311.PureDissectPath method) WM_CLOSE (in module acquire.acquire.gui.win32) WM_COMMAND (in module acquire.acquire.gui.win32) WM_CTLCOLORSTATIC (in module acquire.acquire.gui.win32) WM_DESTROY (in module acquire.acquire.gui.win32) WM_ENABLE (in module acquire.acquire.gui.win32) WM_PAINT (in module acquire.acquire.gui.win32) WM_SETFONT (in module acquire.acquire.gui.win32) WM_USER (in module acquire.acquire.gui.win32) WNDCLASSW (class in acquire.acquire.gui.win32) WNDPROC (in module acquire.acquire.gui.win32) WnfGuid (in module dissect.etl.utils) WnfTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) worker() (in module acquire.acquire.tools.decrypter) WORKER_COUNT (in module acquire.acquire.tools.decrypter) WORKSTATION_TRUST_ACCOUNT (dissect.database.ese.ntds.util.UserAccountControl attribute) wpndatabase() (dissect.target.plugins.os.windows.notifications.NotificationsPlugin method) WpnDatabaseNotificationHandlerRecord (in module dissect.target.plugins.os.windows.notifications) WpnDatabaseNotificationRecord (in module dissect.target.plugins.os.windows.notifications) wpndb_files (dissect.target.plugins.os.windows.notifications.NotificationsPlugin attribute) wrap() (dissect.evidence.adcrypt.adcrypt.ADCrypt method) (in module dissect.target.helpers.cache) WRAP_PASSCODE (dissect.target.loaders.itunes.ClassKey attribute) wrap_square_colors_in_border() (in module dissect.target.plugins.os.windows.rdpcache) wrap_type (dissect.target.loaders.itunes.ClassKey attribute) wrapped_key (dissect.hypervisor.descriptor.vmx.Pair attribute) (dissect.target.loaders.itunes.ClassKey attribute) WrappedRecord (class in flow.record.selector) wrapper (dissect.target.helpers.cache.Cache attribute) Writable (dissect.database.ese.ntds.util.InstanceType attribute) writable() (dissect.util.stream.BitStream method) write (dissect.cstruct.types.base.BaseType attribute) write() (acquire.acquire.crypt.EncryptedStream method) (acquire.acquire.outputs.base.Output method) (acquire.acquire.outputs.dir.DirectoryOutput method) (acquire.acquire.outputs.tar.TarOutput method) (acquire.acquire.outputs.zip.ZipOutput method) (dissect.cstruct.bitbuffer.BitBuffer method) (dissect.cstruct.types.base.MetaType method) (dissect.evidence.asdf.stream.CompressedStream method) (dissect.evidence.asdf.stream.Crc32Stream method) (dissect.evidence.asdf.stream.HashedStream method) (dissect.evidence.asdf.stream.SubStreamBase method) (dissect.target.helpers.cache.LineWriter method) (dissect.target.helpers.cyber.CyberIO method) (flow.record.adapter.AbstractWriter method) (flow.record.adapter.archive.ArchiveWriter method) (flow.record.adapter.avro.AvroWriter method) (flow.record.adapter.broker.BrokerWriter method) (flow.record.adapter.csvfile.CsvfileWriter method) (flow.record.adapter.elastic.ElasticWriter method) (flow.record.adapter.jsonfile.JsonfileWriter method) (flow.record.adapter.line.LineWriter method) (flow.record.adapter.mongo.MongoWriter method) (flow.record.adapter.split.SplitWriter method) (flow.record.adapter.splunk.SplunkWriter method) (flow.record.adapter.sqlite.SqliteWriter method) (flow.record.adapter.stream.StreamWriter method) (flow.record.adapter.text.TextWriter method) (flow.record.adapter.xlsx.XlsxWriter method) (flow.record.stream.PathTemplateWriter method) (flow.record.stream.RecordPrinter method) (flow.record.stream.RecordStreamWriter method) write_bytes() (acquire.acquire.collector.Collector method) (acquire.acquire.outputs.base.Output method) (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) write_entry() (acquire.acquire.outputs.base.Output method) (in module dissect.thumbcache.tools.utils) write_header() (acquire.acquire.crypt.EncryptedStream method) write_policy (dissect.volume.lvm.metadata.VdoPoolSegment attribute) write_sid() (in module dissect.util.sid) write_text() (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) write_varint() (in module dissect.target.plugins.os.windows.everything.parser) write_volatile() (acquire.acquire.outputs.base.Output method) writeback_jobs (dissect.volume.lvm.metadata.WriteCacheSegment attribute) writebehind (dissect.volume.lvm.metadata.RAIDSegment attribute) writecache (dissect.volume.lvm.metadata.WriteCacheSegment attribute) writecache_block_size (dissect.volume.lvm.metadata.WriteCacheSegment attribute) writecache_setting_key (dissect.volume.lvm.metadata.WriteCacheSegment attribute) writecache_setting_val (dissect.volume.lvm.metadata.WriteCacheSegment attribute) WriteCacheSegment (class in dissect.volume.lvm.metadata) writeheader() (flow.record.stream.RecordStreamWriter method) writer (dissect.target.helpers.cache.CacheWriter attribute) (flow.record.adapter.archive.ArchiveWriter attribute) (flow.record.adapter.avro.AvroWriter attribute) (flow.record.adapter.csvfile.CsvfileWriter attribute) (flow.record.adapter.split.SplitWriter attribute) (flow.record.stream.PathTemplateWriter attribute) written (flow.record.adapter.split.SplitWriter attribute) ws (flow.record.adapter.xlsx.XlsxReader attribute) (flow.record.adapter.xlsx.XlsxWriter attribute) WS_BORDER (in module acquire.acquire.gui.win32) WS_CHILD (in module acquire.acquire.gui.win32) WS_DISABLED (in module acquire.acquire.gui.win32) WS_OVERLAPPEDWINDOW (in module acquire.acquire.gui.win32) WS_VISIBLE (in module acquire.acquire.gui.win32) WSLChildTargetPlugin (class in dissect.target.plugins.child.wsl) WSN (dissect.target.helpers.network.IANAProtocol attribute) wstring (in module flow.record.fieldtypes) wtmp() (dissect.target.plugins.os.unix.log.utmp.UtmpPlugin method) wtmp_paths (dissect.target.plugins.os.unix.log.utmp.UtmpPlugin attribute) WtmpRecord (in module dissect.target.plugins.os.unix.log.utmp) WUA_CODE_MAP (in module dissect.target.plugins.os.windows.wua_history) wua_history() (dissect.target.plugins.os.windows.wua_history.WuaHistoryPlugin method) WuaHistoryPlugin (class in dissect.target.plugins.os.windows.wua_history) WuaHistoryRecord (in module dissect.target.plugins.os.windows.wua_history) WWANPP (dissect.target.plugins.os.windows.network.IfTypes attribute) WWANPP2 (dissect.target.plugins.os.windows.network.IfTypes attribute) X X (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) x (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) X213 (dissect.target.plugins.os.windows.network.IfTypes attribute) X25_HUNTGROUP (dissect.target.plugins.os.windows.network.IfTypes attribute) X25_MLP (dissect.target.plugins.os.windows.network.IfTypes attribute) X25_PLE (dissect.target.plugins.os.windows.network.IfTypes attribute) XAttr (class in dissect.apfs.objects.fs) (class in dissect.extfs.extfs) xattr (dissect.apfs.objects.fs.INode property) (dissect.extfs.extfs.INode property) XATTR_NAME_MAP (in module dissect.extfs.c_ext) XATTR_PREFIX_MAP (in module dissect.extfs.c_ext) XdrDeserializer (class in dissect.target.helpers.sunrpc.serializer) XdrSerializer (class in dissect.target.helpers.sunrpc.serializer) XF_MAP (in module dissect.apfs.c_apfs) xfields (dissect.apfs.objects.fs.DirectoryEntry attribute) (dissect.apfs.objects.fs.INode property) XFS (class in dissect.xfs.xfs) xfs (dissect.target.filesystems.xfs.XfsFilesystem attribute) (dissect.xfs.xfs.AllocationGroup attribute) (dissect.xfs.xfs.INode attribute) xfs_def (in module dissect.xfs.c_xfs) XFS_NULL (in module dissect.xfs.c_xfs) XfsDirEntry (class in dissect.target.filesystems.xfs) XfsFilesystem (class in dissect.target.filesystems.xfs) XfsFilesystemEntry (class in dissect.target.filesystems.xfs) xfstimestamp() (in module dissect.util.ts) xid (dissect.apfs.cursor.Cursor attribute) (dissect.apfs.objects.base.Object property) (dissect.apfs.objects.fs.Snapshot attribute) (dissect.target.helpers.sunrpc.sunrpc.Message attribute) XlsxReader (class in flow.record.adapter.xlsx) XlsxWriter (class in flow.record.adapter.xlsx) xmemoryview() (in module dissect.util.xmemoryview) Xml (class in dissect.target.helpers.configutil) xml (dissect.hypervisor.descriptor.ovf.OVF attribute) (dissect.hypervisor.disk.hdd.Descriptor attribute) (dissect.target.loaders.hyperv.HyperVLoader attribute) xml_as_dict() (in module dissect.target.loaders.hyperv) XML_NAMESPACE (dissect.target.plugins.apps.productivity.msoffice.ClickOnceDeploymentManifestParser attribute) XMLEntry (class in dissect.hypervisor.disk.hdd) XmlTask (class in dissect.target.plugins.os.windows.tasks.xml) XNET (dissect.target.helpers.network.IANAProtocol attribute) XNS_IDP (dissect.target.helpers.network.IANAProtocol attribute) xor (in module dissect.fve.crypto.util) xor32_crc() (in module dissect.regf.regf) xor_key (dissect.target.containers.fortifw.FortiFirmwareFile attribute) xor_naive() (in module dissect.fve.crypto.util) xor_pseudo_simd() (in module dissect.fve.crypto.util) XTP (dissect.target.helpers.network.IANAProtocol attribute) XVA (class in dissect.archive.xva) xva (dissect.archive.xva.XVAStream attribute) (dissect.target.loaders.xva.XvaLoader attribute) XvaLoader (class in dissect.target.loaders.xva) XVAStream (class in dissect.archive.xva) Y Yaml (class in dissect.target.helpers.configutil) yara() (dissect.target.plugins.filesystem.yara.YaraPlugin method) YaraMatchRecord (in module dissect.target.plugins.filesystem.yara) YaraPlugin (class in dissect.target.plugins.filesystem.yara) year_rollover_helper() (in module dissect.target.helpers.utils) YELLOW (dissect.target.helpers.cyber.Color attribute) (dissect.target.tools.shell.AnsiColors attribute) yield_apps() (dissect.target.plugins.os.windows.cam.CamPlugin method) YUM_LOG_KEYWORDS (in module dissect.target.plugins.os.unix.linux.redhat.yum) YumPlugin (class in dissect.target.plugins.os.unix.linux.redhat.yum) Z Z (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) ZERO (in module dissect.target.plugins.os.windows.datetime) zero_new_blocks (dissect.volume.lvm.metadata.ThinPoolSegment attribute) ZERO_SUBCLUSTER_TYPES (in module dissect.hypervisor.disk.c_qcow2) ZeroSegment (class in dissect.volume.lvm.metadata) zip (dissect.target.filesystems.zip.ZipFilesystem attribute) (dissect.target.loaders.zip.ZipLoader attribute) (dissect.target.loaders.zip.ZipSubLoader attribute) ZIP_COMPRESSION_METHODS (in module acquire.acquire.outputs.zip) ZIP_EXT (in module dissect.target.loaders.zip) ZipFilesystem (class in dissect.target.filesystems.zip) ZipFilesystemEntry (class in dissect.target.filesystems.zip) ZipLoader (class in dissect.target.loaders.zip) ZipOutput (class in acquire.acquire.outputs.zip) ZipSubLoader (class in dissect.target.loaders.zip) zla (dissect.vmfs.descriptor.FileDescriptor property) ZlibStream (class in dissect.util.stream) Zone (class in dissect.volume.raid.stream) zone_end (dissect.volume.raid.stream.Zone attribute) zones (dissect.volume.raid.stream.RAID0Stream attribute) ZSTD (dissect.target.tools.dump.Compression attribute) zstd_dict (dissect.target.plugins.os.unix.locate.plocate.PLocateFile attribute) ZSTD_MAGIC (in module flow.record.base) ZypperPlugin (class in dissect.target.plugins.os.unix.linux.suse.zypper)