dissect.target.loaders.kape

Module Contents

Classes

KapeLoader

Load KAPE forensic image format files.

Functions

open_kape_file
is_valid_kape_dir
is_valid_kape_file

Attributes

USNJRNL_PATHS

dissect.target.loaders.kape.USNJRNL_PATHS = ['$Extend/$J', '$Extend/$UsnJrnl$J']

dissect.target.loaders.kape.open_kape_file(path: pathlib.Path) → collections.abc.Iterator[dissect.target.filesystem.Filesystem]

dissect.target.loaders.kape.is_valid_kape_dir(path: pathlib.Path) → bool

dissect.target.loaders.kape.is_valid_kape_file(path: pathlib.Path) → bool

class dissect.target.loaders.kape.KapeLoader(path: pathlib.Path, *, parsed_path: urllib.parse.ParseResult | None = None, resolve: bool = True, **kwargs)

Bases: dissect.target.loader.Loader

Load KAPE forensic image format files.

References

• https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape

• https://ericzimmerman.github.io/KapeDocs/#!Pages.-Using-KAPE.md#container-switches

static detect(path: pathlib.Path) → bool

Detects wether this Loader class can load this specific path.

Parameters:

path – The target path to check.

Returns:

True if the path can be loaded by a Loader instance. False otherwise.

map(target: dissect.target.target.Target) → None

Maps the loaded path into a Target.

Parameters:

target – The target that we’re mapping into.