`dissect.target.loaders.kape`¶

Module Contents¶

Classes¶

Load KAPE forensic image format files.

Functions¶

`open_vhdx`
`is_valid_kape_dir`
`is_valid_kape_vhdx`

Attributes¶

USNJRNL_PATHS

dissect.target.loaders.kape.USNJRNL_PATHS = ['$Extend/$J', '$Extend/$UsnJrnl$J']¶

dissect.target.loaders.kape.open_vhdx(path: pathlib.Path) → Iterator[dissect.target.filesystem.Filesystem]¶

dissect.target.loaders.kape.is_valid_kape_dir(path: pathlib.Path) → bool¶

dissect.target.loaders.kape.is_valid_kape_vhdx(path: pathlib.Path) → bool¶

class dissect.target.loaders.kape.KapeLoader(path: pathlib.Path, **kwargs)¶

Bases: dissect.target.loaders.dir.DirLoader

Load KAPE forensic image format files.

References

https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape

static detect(path: pathlib.Path) → bool¶

Detects wether this Loader class can load this specific path.

Parameters:: path – The target path to check.
Returns:: True if the path can be loaded by a Loader instance. False otherwise.

map(target: dissect.target.Target) → None¶

Maps the loaded path into a Target.

Parameters:: target – The target that we’re mapping into.