dissect.target.plugins.child.hyperv

Module Contents

Classes

HyperVChildTargetPlugin

Child target plugin that yields from Hyper-V VM inventory.

class dissect.target.plugins.child.hyperv.HyperVChildTargetPlugin(target: dissect.target.target.Target)

Bases: dissect.target.plugin.ChildTargetPlugin

Child target plugin that yields from Hyper-V VM inventory.

Since Windows Server 2016, Hyper-V VMs are registered in a data.vmcx file in the Hyper-V ProgramData directory. Before that, VMs were registered by having a .xml file in the Hyper-V ProgramData “Virtual Machines” directory.

It is possible to put your “VM descriptor” files elsewhere. In the .vmcx format, the full path to the alternative location is stored. In the .xml format, a NTFS symlink reparse point is created that points to the full alternative path.

__type__ = 'hyper-v'

PATH = 'sysvol/ProgramData/Microsoft/Windows/Hyper-V'

data_vmcx

vm_xml

check_compatible() → None

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

list_children() → collections.abc.Iterator[dissect.target.helpers.record.ChildTargetRecord]

Yield ChildTargetRecord records of all possible child targets on this target.