dissect.target

Subpackages

Submodules

Package Contents

Classes

Target

The class that represents the target that you are talking to.
class dissect.target.Target(path: str | pathlib.Path | None = None)

The class that represents the target that you are talking to.

Usually you do not want to instantiate this class directly, but rather use the Target.open() or Target.open_all() methods to open a target from a path or URI. The target will then be loaded using the appropriate Loader.

Targets are the glue that connects the different Containers, Loaders, Volumes and Filesystems together. Loaders are used to map the Containers, Volumes and Filesystems of the target onto the Target object.

The plugins of dissect.target get mapped onto the Target too. They become available as attributes on a Target object. For example, t.hostname, t.evtx(). By executing the plugin function with a target, it will perform the function on itself.

Parameters:

path – The path of a target.

path_scheme = None
path_query
props: dict[Any, Any]
log
disks
volumes
filesystems
fs
__repr__() → str
__getattr__(attr: str) → dissect.target.plugin.Plugin | Any

Override of the default __getattr__ so plugins and functions can be called from a Target object.

__dir__() → list[str]

Override the default __dir__ to provide autocomplete for things like IPython.

classmethod set_event_callback(*, event_type: Event | None = None, event_callback: collections.abc.Callable) → None

Sets event_callbacks on a Target class.

event_callbacks get used to handle specific events denoted by Event. This records events related to the target, such as:

  • a plugin gets registered to the target

  • a plugin is incompatible with the target

  • a function succeededs in its execution

  • a function fails in execution

send_event(event_type: Event, **kwargs) → None

Notify event callbacks for the given event_type.

Each event can have multiple callback methods, it calls all the callbacks that fit the corresponding event type. None is a catch-all method for event callbacks that always get called.

Parameters:

event_type – The type of event

apply() → None

Resolve all disks, volumes and filesystems and load an operating system on the current Target.

property name: str

Return a name for this target.

The function is guaranteed to give back some name. The name will be guaranteed to not have slashes, backslashes and spaces. The name won’t be guaranteed to be unique.

Returns:

The name of a target.

classmethod open(path: str | pathlib.Path) → typing_extensions.Self

Try to find a suitable loader for the given path and load a Target from it.

Parameters:

path – Path to load the Target from. If the path is a os.PathLike object, it will be used as-is. If the path is a string and looks like a URI, it will be parsed as such. If the path is a string and does not like like a URI, it will be treated as a local path.

Returns:

A Target with a linked Loader object.

classmethod open_raw(path: str | pathlib.Path) → typing_extensions.Self

Open a Target with the given path using the RawLoader.

Parameters:

path – Path to load the Target from.

classmethod open_all(paths: str | pathlib.Path | list[str | pathlib.Path], include_children: bool = False) → collections.abc.Iterator[typing_extensions.Self]

Yield all targets from one or more paths or directories.

If the path is a directory, iterate files one directory deep.

Parameters:

  • paths – A list of paths to load Targets from. If the path is a os.PathLike object, it will be used as-is. If the path is a string and looks like a URI, it will be parsed as such. If the path is a string and does not look like a URI, it will be treated as a local path.

  • include_children – Whether to recursively open child targets.

Raises:

TargetError – Raised when not a single Target can be loaded.

classmethod open_direct(paths: list[str | pathlib.Path]) → typing_extensions.Self

Create a minimal target with a virtual root filesystem with all paths mapped into it.

This is useful when running plugins on individual files.

property is_direct: bool

Check if the target is a direct target.

open_child(child: int | str | pathlib.Path) → Target

Open a child target.

Allows opening a nested child target by path, index or child pattern. Paths will simply attempt to open the path as a child target. Indexes are zero-based, so the first child is 0, the second is 1, etc. If the child is a pattern, such as 4.2, it will open the 2nd child of the 4th child target of this target.

Parameters:

child – The location of a target within the current Target, or a child pattern.

Returns:

An opened Target object of the child target.

open_children(recursive: bool = False) → collections.abc.Iterator[Target]

Open all the child targets on a Target.

Will open all discovered child targets if the current Target has them, such as VMs on a hypervisor.

Parameters:

recursive – Whether to check the child Target for more Targets.

Returns:

An iterator of Targets.

list_children(recursive: bool = False) → collections.abc.Iterator[tuple[str, dissect.target.helpers.record.ChildTargetRecord]]

Lists all discovered child targets.

reload() → Target

Reload the current target.

Using the loader with which the target was originally loaded, reload the path of the current target. This is useful when the target is live.

Raises:

TargetError – If the target has no path or loader.

Returns:

A fresh Target object

add_plugin(plugin_cls: dissect.target.plugin.Plugin | type[dissect.target.plugin.Plugin], check_compatible: bool = True) → dissect.target.plugin.Plugin

Add and register a plugin by class.

Parameters:

  • plugin_cls – The plugin to add and register, this can either be a class or instance. When this is a class, it will be instantiated.

  • check_compatible – Check whether the plugin is compatible with the Target.

Returns:

The plugin_cls instance.

Raises:

  • UnsupportedPluginError – Raised when plugins were found, but they were incompatible

  • PluginError – Raised when any other exception occurs while trying to load the plugin.

load_plugin(descriptor: dissect.target.plugin.PluginDescriptor | dissect.target.plugin.FunctionDescriptor) → dissect.target.plugin.Plugin

Load a plugin by descriptor.

Parameters:

plugin_desc – The descriptor of the plugin to load.

Returns:

The loaded plugin instance.

Raises:

PluginError – Raised when any exception occurs while trying to load the plugin.

get_function(function: str | dissect.target.plugin.FunctionDescriptor) → FunctionTuple

Attempt to get a given function.

If the function is not already registered, look for plugins that export the function and register them.

Parameters:

function – Function name to look for.

Returns:

A tuple of the plugin and the corresponding function.

Raises:

  • UnsupportedPluginError – Raised when plugins were found, but they were incompatible

  • PluginError – Raised when any other exception occurs while trying to load the plugin.

has_function(function: str) → bool

Return whether this Target supports a given function.

Parameters:

function – The function name to look for.

Returns:

True if the function can be found, False otherwise.