dissect.target.loaders.cellebrite

Module Contents

Classes

Extraction

DeviceInfo

Ufdx

Dump

Keychain

Ufd

CellebriteLoader

Load Cellebrite UFED exports (.ufdx and .ufd).

CellebriteFilesystem

Cellebrite FileDump filesystem implementation.

Attributes

log

dissect.target.loaders.cellebrite.log
class dissect.target.loaders.cellebrite.Extraction
type: str | None
path: pathlib.Path
class dissect.target.loaders.cellebrite.DeviceInfo
vendor: str
model: str
fguid: uuid.UUID | None = None
guid: uuid.UUID | None = None
os: str | None = None
class dissect.target.loaders.cellebrite.Ufdx
path: pathlib.Path | None = None
evidence: uuid.UUID | None = None
device: DeviceInfo | None = None
extractions: list[Extraction] | None = None
class dissect.target.loaders.cellebrite.Dump
type: str
path: pathlib.Path
class dissect.target.loaders.cellebrite.Keychain
type: str
path: pathlib.Path
class dissect.target.loaders.cellebrite.Ufd
path: pathlib.Path
device: DeviceInfo
dumps: list[Dump] | None = None
class dissect.target.loaders.cellebrite.CellebriteLoader(path: pathlib.Path, **kwargs)

Bases: dissect.target.loader.Loader

Load Cellebrite UFED exports (.ufdx and .ufd).

References

ufdx = None
ufd = []
ffs = None
static detect(path: pathlib.Path) → bool

Detects wether this Loader class can load this specific path.

Parameters:

path – The target path to check.

Returns:

True if the path can be loaded by a Loader instance. False otherwise.

map(target: dissect.target.target.Target) → None

Maps the loaded path into a Target.

Parameters:

target – The target that we’re mapping into.

class dissect.target.loaders.cellebrite.CellebriteFilesystem(path: pathlib.Path, base: str | None = None, **kwargs)

Bases: dissect.target.filesystem.LayerFilesystem

Cellebrite FileDump filesystem implementation.

__type__ = 'cellebrite'

A short string identifying the type of filesystem.

source
__repr__() → str