Hide navigation sidebar

Hide table of contents sidebar

Toggle site navigation sidebar

Dissect 3.8.1-1-gde2d934 documentation

Toggle table of contents sidebar

Home
Overview
Projects
Toggle navigation of Projects
Usage
Toggle navigation of Usage
- Introduction
- First steps
  Toggle navigation of First steps
  - Next steps as an Incident Handler
  - Next steps as a Security Analyst
- Use-cases
- Disk encryption (FVE)
Tools
Toggle navigation of Tools
- acquire
- target-query
- target-shell
- target-fs
- target-reg
- target-dump
- target-dd
- target-mount
- rdump
Advanced
Toggle navigation of Advanced
- Python API
- Targets
- Loaders
- Containers
- Volumes
- Filesystems
- Plugins
API Reference
Toggle navigation of API Reference
- dissect.cim
  Toggle navigation of dissect.cim
- dissect.clfs
  Toggle navigation of dissect.clfs
- dissect.cstruct
  Toggle navigation of dissect.cstruct
- dissect.esedb
  Toggle navigation of dissect.esedb
  - dissect.esedb.tools
    Toggle navigation of dissect.esedb.tools
  - dissect.esedb.c_esedb
  - dissect.esedb.compression
  - dissect.esedb.cursor
  - dissect.esedb.esedb
  - dissect.esedb.exceptions
  - dissect.esedb.index
  - dissect.esedb.lcmapstring
  - dissect.esedb.page
  - dissect.esedb.record
  - dissect.esedb.sorting_table
  - dissect.esedb.table
- dissect.etl
  Toggle navigation of dissect.etl
  - dissect.etl.headers
    Toggle navigation of dissect.etl.headers
  - dissect.etl.manifests
  - dissect.etl.etl
  - dissect.etl.exceptions
  - dissect.etl.manifest
  - dissect.etl.utils
- dissect.eventlog
  Toggle navigation of dissect.eventlog
- dissect.evidence
  Toggle navigation of dissect.evidence
  - dissect.evidence.asdf
    Toggle navigation of dissect.evidence.asdf
    - dissect.evidence.asdf.asdf
    - dissect.evidence.asdf.streams
  - dissect.evidence.tools
    Toggle navigation of dissect.evidence.tools
    - dissect.evidence.tools.asdf
      Toggle navigation of dissect.evidence.tools.asdf
  - dissect.evidence.ad1
  - dissect.evidence.ewf
  - dissect.evidence.exceptions
- dissect.executable
  Toggle navigation of dissect.executable
  - dissect.executable.elf
    Toggle navigation of dissect.executable.elf
    - dissect.executable.elf.c_elf
    - dissect.executable.elf.elf
  - dissect.executable.macho
  - dissect.executable.pe
  - dissect.executable.exception
- dissect.extfs
  Toggle navigation of dissect.extfs
- dissect.fat
  Toggle navigation of dissect.fat
- dissect.ffs
  Toggle navigation of dissect.ffs
- dissect.hypervisor
  Toggle navigation of dissect.hypervisor
  - dissect.hypervisor.backup
    Toggle navigation of dissect.hypervisor.backup
  - dissect.hypervisor.descriptor
    Toggle navigation of dissect.hypervisor.descriptor
  - dissect.hypervisor.disk
    Toggle navigation of dissect.hypervisor.disk
  - dissect.hypervisor.tools
    Toggle navigation of dissect.hypervisor.tools
    - dissect.hypervisor.tools.envelope
    - dissect.hypervisor.tools.vma
  - dissect.hypervisor.util
    Toggle navigation of dissect.hypervisor.util
    - dissect.hypervisor.util.envelope
    - dissect.hypervisor.util.vmtar
  - dissect.hypervisor.exceptions
- dissect.ntfs
  Toggle navigation of dissect.ntfs
- dissect.ole
  Toggle navigation of dissect.ole
- dissect.regf
  Toggle navigation of dissect.regf
- dissect.shellitem
  Toggle navigation of dissect.shellitem
  - dissect.shellitem.lnk
    Toggle navigation of dissect.shellitem.lnk
    - dissect.shellitem.lnk.c_lnk
    - dissect.shellitem.lnk.lnk
  - dissect.shellitem.tools
    Toggle navigation of dissect.shellitem.tools
    - dissect.shellitem.tools.lnk
- dissect.sql
  Toggle navigation of dissect.sql
- dissect.squashfs
  Toggle navigation of dissect.squashfs
- dissect.target
  Toggle navigation of dissect.target
  - dissect.target.containers
    Toggle navigation of dissect.target.containers
  - dissect.target.filesystems
    Toggle navigation of dissect.target.filesystems
  - dissect.target.helpers
    Toggle navigation of dissect.target.helpers
  - dissect.target.loaders
    Toggle navigation of dissect.target.loaders
  - dissect.target.plugins
    Toggle navigation of dissect.target.plugins
    - dissect.target.plugins.apps
      Toggle navigation of dissect.target.plugins.apps
      - dissect.target.plugins.apps.av
        Toggle navigation of dissect.target.plugins.apps.av
        
        dissect.target.plugins.apps.av.mcafee
        
        dissect.target.plugins.apps.av.sophos
        
        dissect.target.plugins.apps.av.symantec
        
        dissect.target.plugins.apps.av.trendmicro
      - dissect.target.plugins.apps.containers
        Toggle navigation of dissect.target.plugins.apps.containers
        
        dissect.target.plugins.apps.containers.docker
      - dissect.target.plugins.apps.remoteaccess
        Toggle navigation of dissect.target.plugins.apps.remoteaccess
        
        dissect.target.plugins.apps.remoteaccess.anydesk
        
        dissect.target.plugins.apps.remoteaccess.remoteaccess
        
        dissect.target.plugins.apps.remoteaccess.teamviewer
      - dissect.target.plugins.apps.shell
        Toggle navigation of dissect.target.plugins.apps.shell
        
        dissect.target.plugins.apps.shell.powershell
      - dissect.target.plugins.apps.ssh
        Toggle navigation of dissect.target.plugins.apps.ssh
        
        dissect.target.plugins.apps.ssh.openssh
      - dissect.target.plugins.apps.vpns
        Toggle navigation of dissect.target.plugins.apps.vpns
        
        dissect.target.plugins.apps.vpns.openvpn
        
        dissect.target.plugins.apps.vpns.wireguard
      - dissect.target.plugins.apps.webhosting
        Toggle navigation of dissect.target.plugins.apps.webhosting
        
        dissect.target.plugins.apps.webhosting.cpanel
      - dissect.target.plugins.apps.webservers
        Toggle navigation of dissect.target.plugins.apps.webservers
        
        dissect.target.plugins.apps.webservers.apache
        
        dissect.target.plugins.apps.webservers.caddy
        
        dissect.target.plugins.apps.webservers.iis
        
        dissect.target.plugins.apps.webservers.nginx
        
        dissect.target.plugins.apps.webservers.webservers
    - dissect.target.plugins.browsers
      Toggle navigation of dissect.target.plugins.browsers
    - dissect.target.plugins.child
      Toggle navigation of dissect.target.plugins.child
    - dissect.target.plugins.filesystem
      Toggle navigation of dissect.target.plugins.filesystem
      - dissect.target.plugins.filesystem.ntfs
        Toggle navigation of dissect.target.plugins.filesystem.ntfs
        
        dissect.target.plugins.filesystem.ntfs.mft
        
        dissect.target.plugins.filesystem.ntfs.mft_timeline
        
        dissect.target.plugins.filesystem.ntfs.usnjrnl
        
        dissect.target.plugins.filesystem.ntfs.utils
      - dissect.target.plugins.filesystem.unix
        Toggle navigation of dissect.target.plugins.filesystem.unix
        
        dissect.target.plugins.filesystem.unix.capability
        
        dissect.target.plugins.filesystem.unix.suid
      - dissect.target.plugins.filesystem.acquire_handles
      - dissect.target.plugins.filesystem.acquire_hash
      - dissect.target.plugins.filesystem.icat
      - dissect.target.plugins.filesystem.resolver
      - dissect.target.plugins.filesystem.walkfs
      - dissect.target.plugins.filesystem.yara
    - dissect.target.plugins.general
      Toggle navigation of dissect.target.plugins.general
    - dissect.target.plugins.os
      Toggle navigation of dissect.target.plugins.os
      - dissect.target.plugins.os.unix
        Toggle navigation of dissect.target.plugins.os.unix
        
        dissect.target.plugins.os.unix.linux
        Toggle navigation of dissect.target.plugins.os.unix.linux
        
        dissect.target.plugins.os.unix.linux.android
        
        dissect.target.plugins.os.unix.linux.debian
        Toggle navigation of dissect.target.plugins.os.unix.linux.debian
        
        dissect.target.plugins.os.unix.linux.debian.vyos
        
        dissect.target.plugins.os.unix.linux.debian.apt
        
        dissect.target.plugins.os.unix.linux.debian.dpkg
        
        dissect.target.plugins.os.unix.linux.esxi
        
        dissect.target.plugins.os.unix.linux.fortigate
        
        dissect.target.plugins.os.unix.linux.redhat
        Toggle navigation of dissect.target.plugins.os.unix.linux.redhat
        
        dissect.target.plugins.os.unix.linux.redhat.yum
        
        dissect.target.plugins.os.unix.linux.suse
        Toggle navigation of dissect.target.plugins.os.unix.linux.suse
        
        dissect.target.plugins.os.unix.linux.suse.zypper
        
        dissect.target.plugins.os.unix.linux.cmdline
        
        dissect.target.plugins.os.unix.linux.environ
        
        dissect.target.plugins.os.unix.linux.iptables
        
        dissect.target.plugins.os.unix.linux.modules
        
        dissect.target.plugins.os.unix.linux.netstat
        
        dissect.target.plugins.os.unix.linux.proc
        
        dissect.target.plugins.os.unix.linux.processes
        
        dissect.target.plugins.os.unix.linux.sockets
        
        dissect.target.plugins.os.unix.log
        Toggle navigation of dissect.target.plugins.os.unix.log
        
        dissect.target.plugins.os.unix.log.atop
        
        dissect.target.plugins.os.unix.log.audit
        
        dissect.target.plugins.os.unix.log.auth
        
        dissect.target.plugins.os.unix.log.journal
        
        dissect.target.plugins.os.unix.log.lastlog
        
        dissect.target.plugins.os.unix.log.messages
        
        dissect.target.plugins.os.unix.log.utmp
        
        dissect.target.plugins.os.unix.config
        
        dissect.target.plugins.os.unix.cronjobs
        
        dissect.target.plugins.os.unix.datetime
        
        dissect.target.plugins.os.unix.generic
        
        dissect.target.plugins.os.unix.history
        
        dissect.target.plugins.os.unix.locale
        
        dissect.target.plugins.os.unix.packagemanager
        
        dissect.target.plugins.os.unix.services
        
        dissect.target.plugins.os.unix.shadow
      - dissect.target.plugins.os.windows
        Toggle navigation of dissect.target.plugins.os.windows
        
        dissect.target.plugins.os.windows.dpapi
        Toggle navigation of dissect.target.plugins.os.windows.dpapi
        
        dissect.target.plugins.os.windows.dpapi.blob
        
        dissect.target.plugins.os.windows.dpapi.crypto
        
        dissect.target.plugins.os.windows.dpapi.dpapi
        
        dissect.target.plugins.os.windows.dpapi.master_key
        
        dissect.target.plugins.os.windows.exchange
        Toggle navigation of dissect.target.plugins.os.windows.exchange
        
        dissect.target.plugins.os.windows.exchange.exchange
        
        dissect.target.plugins.os.windows.log
        Toggle navigation of dissect.target.plugins.os.windows.log
        
        dissect.target.plugins.os.windows.log.amcache
        
        dissect.target.plugins.os.windows.log.etl
        
        dissect.target.plugins.os.windows.log.evt
        
        dissect.target.plugins.os.windows.log.evtx
        
        dissect.target.plugins.os.windows.log.pfro
        
        dissect.target.plugins.os.windows.regf
        Toggle navigation of dissect.target.plugins.os.windows.regf
        
        dissect.target.plugins.os.windows.regf.7zip
        
        dissect.target.plugins.os.windows.regf.appxdebugkeys
        
        dissect.target.plugins.os.windows.regf.auditpol
        
        dissect.target.plugins.os.windows.regf.bam
        
        dissect.target.plugins.os.windows.regf.cit
        
        dissect.target.plugins.os.windows.regf.clsid
        
        dissect.target.plugins.os.windows.regf.firewall
        
        dissect.target.plugins.os.windows.regf.mru
        
        dissect.target.plugins.os.windows.regf.muicache
        
        dissect.target.plugins.os.windows.regf.nethist
        
        dissect.target.plugins.os.windows.regf.recentfilecache
        
        dissect.target.plugins.os.windows.regf.regf
        
        dissect.target.plugins.os.windows.regf.runkeys
        
        dissect.target.plugins.os.windows.regf.shellbags
        
        dissect.target.plugins.os.windows.regf.shimcache
        
        dissect.target.plugins.os.windows.regf.trusteddocs
        
        dissect.target.plugins.os.windows.regf.usb
        
        dissect.target.plugins.os.windows.regf.userassist
        
        dissect.target.plugins.os.windows.task_helpers
        Toggle navigation of dissect.target.plugins.os.windows.task_helpers
        
        dissect.target.plugins.os.windows.task_helpers.tasks_job
        
        dissect.target.plugins.os.windows.task_helpers.tasks_records
        
        dissect.target.plugins.os.windows.task_helpers.tasks_xml
        
        dissect.target.plugins.os.windows.activitiescache
        
        dissect.target.plugins.os.windows.adpolicy
        
        dissect.target.plugins.os.windows.amcache
        
        dissect.target.plugins.os.windows.catroot
        
        dissect.target.plugins.os.windows.cim
        
        dissect.target.plugins.os.windows.clfs
        
        dissect.target.plugins.os.windows.datetime
        
        dissect.target.plugins.os.windows.defender
        
        dissect.target.plugins.os.windows.env
        
        dissect.target.plugins.os.windows.generic
        
        dissect.target.plugins.os.windows.lnk
        
        dissect.target.plugins.os.windows.locale
        
        dissect.target.plugins.os.windows.notifications
        
        dissect.target.plugins.os.windows.prefetch
        
        dissect.target.plugins.os.windows.recyclebin
        
        dissect.target.plugins.os.windows.registry
        
        dissect.target.plugins.os.windows.sam
        
        dissect.target.plugins.os.windows.services
        
        dissect.target.plugins.os.windows.sru
        
        dissect.target.plugins.os.windows.startupinfo
        
        dissect.target.plugins.os.windows.syscache
        
        dissect.target.plugins.os.windows.tasks
        
        dissect.target.plugins.os.windows.thumbcache
        
        dissect.target.plugins.os.windows.ual
        
        dissect.target.plugins.os.windows.wer
  - dissect.target.tools
    Toggle navigation of dissect.target.tools
    - dissect.target.tools.dump
      Toggle navigation of dissect.target.tools.dump
    - dissect.target.tools.build_pluginlist
    - dissect.target.tools.dd
    - dissect.target.tools.fs
    - dissect.target.tools.info
    - dissect.target.tools.logging
    - dissect.target.tools.mount
    - dissect.target.tools.query
    - dissect.target.tools.reg
    - dissect.target.tools.shell
    - dissect.target.tools.utils
  - dissect.target.volumes
    Toggle navigation of dissect.target.volumes
  - dissect.target.container
  - dissect.target.exceptions
  - dissect.target.filesystem
  - dissect.target.loader
  - dissect.target.plugin
  - dissect.target.report
  - dissect.target.target
  - dissect.target.volume
- dissect.thumbcache
  Toggle navigation of dissect.thumbcache
  - dissect.thumbcache.tools
    Toggle navigation of dissect.thumbcache.tools
  - dissect.thumbcache.c_thumbcache
  - dissect.thumbcache.exceptions
  - dissect.thumbcache.index
  - dissect.thumbcache.thumbcache
  - dissect.thumbcache.thumbcache_file
  - dissect.thumbcache.util
- dissect.util
  Toggle navigation of dissect.util
  - dissect.util.compression
    Toggle navigation of dissect.util.compression
  - dissect.util.encoding
    Toggle navigation of dissect.util.encoding
    - dissect.util.encoding.surrogateescape
  - dissect.util.tools
    Toggle navigation of dissect.util.tools
    - dissect.util.tools.dump_nskeyedarchiver
  - dissect.util.cpio
  - dissect.util.exceptions
  - dissect.util.plist
  - dissect.util.sid
  - dissect.util.stream
  - dissect.util.ts
  - dissect.util.xmemoryview
- dissect.vmfs
  Toggle navigation of dissect.vmfs
- dissect.volume
  Toggle navigation of dissect.volume
  - dissect.volume.ddf
    Toggle navigation of dissect.volume.ddf
    - dissect.volume.ddf.c_ddf
    - dissect.volume.ddf.ddf
  - dissect.volume.disk
    Toggle navigation of dissect.volume.disk
    - dissect.volume.disk.schemes
      Toggle navigation of dissect.volume.disk.schemes
    - dissect.volume.disk.disk
    - dissect.volume.disk.partition
  - dissect.volume.dm
    Toggle navigation of dissect.volume.dm
  - dissect.volume.lvm
    Toggle navigation of dissect.volume.lvm
  - dissect.volume.md
    Toggle navigation of dissect.volume.md
    - dissect.volume.md.c_md
    - dissect.volume.md.md
  - dissect.volume.raid
    Toggle navigation of dissect.volume.raid
    - dissect.volume.raid.raid
    - dissect.volume.raid.stream
  - dissect.volume.exceptions
  - dissect.volume.ldm
  - dissect.volume.vss
- dissect.xfs
  Toggle navigation of dissect.xfs
- flow.record
  Toggle navigation of flow.record
  - flow.record.adapter
    Toggle navigation of flow.record.adapter
  - flow.record.fieldtypes
    Toggle navigation of flow.record.fieldtypes
    - flow.record.fieldtypes.net
      Toggle navigation of flow.record.fieldtypes.net
    - flow.record.fieldtypes.credential
  - flow.record.tools
    Toggle navigation of flow.record.tools
    - flow.record.tools.geoip
    - flow.record.tools.rdump
  - flow.record.base
  - flow.record.exceptions
  - flow.record.jsonpacker
  - flow.record.packer
  - flow.record.selector
  - flow.record.stream
  - flow.record.utils
  - flow.record.whitelist

Contributing

Developing for Dissect
Style guide
Tooling
License

Resources

Dissect in Action
Talks and Conferences

Links

Try in your browser
GitHub
PyPI

v: latest

Versions: latest; stable

Downloads

On Read the Docs: Project Home; Builds

Toggle table of contents sidebar

Projects#

acquire
dissect.cim
dissect.clfs
dissect.cstruct
dissect.esedb
dissect.etl
dissect.eventlog
dissect.evidence
dissect.executable
dissect.extfs
dissect.fat
dissect.ffs
dissect.hypervisor
dissect.ntfs
dissect.ole
dissect.regf
dissect.shellitem
dissect.sql
dissect.squashfs
dissect.target
dissect.thumbcache
dissect.util
dissect.vmfs
dissect.volume
dissect.xfs
flow.record

Copyright © 2023, Fox-IT part of NCC Group

Made with Sphinx and @pradyunsg's Furo