Index _ | A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z _ __add__() (dissect.cstruct.Pointer method) (dissect.cstruct.types.Pointer method) (dissect.cstruct.types.pointer.Pointer method) __align__ (dissect.cstruct.types.structure.StructureMetaType attribute) __and__() (dissect.cstruct.Pointer method) (dissect.cstruct.types.Pointer method) (dissect.cstruct.types.pointer.Pointer method) __anonymous__ (dissect.cstruct.types.structure.StructureMetaType attribute) __attr__ (dissect.cstruct.types.structure.UnionProxy attribute) __bool__() (dissect.cstruct.MetaType method) (dissect.cstruct.types.base.MetaType method) (dissect.cstruct.types.MetaType method) (dissect.cstruct.types.Void method) (dissect.cstruct.types.void.Void method) (dissect.cstruct.Void method) __bytes__() (dissect.cstruct.Structure method) (dissect.cstruct.types.Structure method) (dissect.cstruct.types.structure.Structure method) (dissect.cstruct.types.structure.UnionProxy method) __call__ (dissect.target.plugins.filesystem.ntfs.mft.MftPlugin attribute) __call__() (dissect.cstruct.MetaType method) (dissect.cstruct.types.base.MetaType method) (dissect.cstruct.types.enum.EnumMetaType method) (dissect.cstruct.types.MetaType method) (dissect.cstruct.types.structure.StructureMetaType method) (dissect.cstruct.types.structure.UnionMetaType method) (dissect.ntfs.Mft method) (dissect.ntfs.mft.Mft method) (dissect.target.helpers.lazy.FailedImport method) (dissect.target.helpers.lazy.LazyAttr method) (dissect.target.helpers.record.ExtendableRecordDescriptor method) (dissect.target.plugin.Plugin method) (dissect.target.plugins.general.config.ConfigurationTreePlugin method) (flow.record.base.DynamicFieldtypeModule method) (flow.record.base.RecordDescriptor method) (flow.record.RecordDescriptor method) (flow.record.utils.EventHandler method) __child__ (dissect.target.plugin.FunctionDescriptorLookup attribute) (dissect.target.plugin.PluginDescriptorLookup attribute) __compiled__ (dissect.cstruct.types.structure.StructureMetaType attribute) __complex__ (dissect.fve.bde.information.Datum attribute) (dissect.fve.bde.information.ExternalInfoDatum attribute) (dissect.fve.bde.information.StretchKeyDatum attribute) (dissect.fve.bde.information.UpdateDatum attribute) (dissect.fve.bde.information.UseKeyDatum attribute) (dissect.fve.bde.information.VmkInfoDatum attribute) __contains__() (dissect.cstruct.parser.TokenConsumer method) (dissect.cstruct.types.enum.EnumMetaType method) (dissect.cstruct.types.structure.StructureValuesProxy method) (dissect.database.bsd.tools.rpm.HeaderBlob method) (dissect.database.sqlite3.sqlite3.WALCheckpoint method) (dissect.executable.pe.directory.bound_import.BoundImportDirectory method) (dissect.executable.pe.directory.BoundImportDirectory method) (dissect.executable.pe.directory.delay_import.DelayImportDirectory method) (dissect.executable.pe.directory.delay_import.DelayImportModule method) (dissect.executable.pe.directory.DelayImportDirectory method) (dissect.executable.pe.directory.export.ExportDirectory method) (dissect.executable.pe.directory.ExportDirectory method) (dissect.executable.pe.directory.ImportDirectory method) (dissect.executable.pe.directory.ImportModule method) (dissect.executable.pe.directory.imports.ImportDirectory method) (dissect.executable.pe.directory.imports.ImportModule method) (dissect.executable.pe.directory.resource.Resource method) (dissect.executable.pe.directory.resource.ResourceDirectory method) (dissect.executable.pe.directory.ResourceDirectory method) (dissect.ntfs.util.AttributeMap method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.helpers.configutil.ConfigurationParser method) (dissect.target.helpers.regutil.VirtualKey method) (flow.record.fieldtypes.net.ip.ipnetwork method) (flow.record.fieldtypes.net.ipnetwork method) (flow.record.fieldtypes.net.ipv4.subnet method) (flow.record.fieldtypes.net.ipv4.SubnetList method) (flow.record.selector.CompiledSelector method) (flow.record.selector.NoneObject method) (flow.record.selector.Selector method) (flow.record.selector.TypeMatcherInstance method) __default__() (dissect.cstruct.Char class method) (dissect.cstruct.CharArray class method) (dissect.cstruct.MetaType method) (dissect.cstruct.Pointer class method) (dissect.cstruct.types.base.BaseArray class method) (dissect.cstruct.types.base.MetaType method) (dissect.cstruct.types.BaseArray class method) (dissect.cstruct.types.Char class method) (dissect.cstruct.types.char.Char class method) (dissect.cstruct.types.char.CharArray class method) (dissect.cstruct.types.CharArray class method) (dissect.cstruct.types.MetaType method) (dissect.cstruct.types.Pointer class method) (dissect.cstruct.types.pointer.Pointer class method) (dissect.cstruct.types.void.VoidArray class method) (dissect.cstruct.types.VoidArray class method) (dissect.cstruct.types.Wchar class method) (dissect.cstruct.types.wchar.Wchar class method) (dissect.cstruct.types.wchar.WcharArray class method) (dissect.cstruct.types.WcharArray class method) (dissect.cstruct.Wchar class method) (dissect.cstruct.WcharArray class method) __del__() (dissect.target.helpers.nfs.client.nfs.Client method) (dissect.target.helpers.sunrpc.client.Client method) (dissect.target.loaders.smb.SmbRegistry method) (flow.record.adapter.AbstractWriter method) (flow.record.stream.RecordStreamWriter method) __delitem__() (dissect.cstruct.types.structure.StructureValuesProxy method) __dir__() (dissect.target.Target method) (dissect.target.target.Target method) __doc__ (dissect.target.helpers.lazy.LazyAttr property) __dynamic_sizes__ (dissect.cstruct.Structure attribute) (dissect.cstruct.types.Structure attribute) (dissect.cstruct.types.structure.Structure attribute) __encoding_map__ (dissect.cstruct.types.Wchar attribute) (dissect.cstruct.types.wchar.Wchar attribute) (dissect.cstruct.Wchar attribute) __enter__() (acquire.acquire.collector.Collector method) (dissect.target.helpers.configutil.ScopeManager method) (dissect.target.helpers.nfs.client.mount.Client method) (dissect.target.helpers.nfs.client.nfs.Client method) (dissect.target.helpers.sunrpc.client.Client method) (flow.record.adapter.AbstractReader method) (flow.record.adapter.AbstractWriter method) __eq__() (dissect.cstruct.Enum method) (dissect.cstruct.Flag method) (dissect.cstruct.parser.Token method) (dissect.cstruct.types.Enum method) (dissect.cstruct.types.enum.Enum method) (dissect.cstruct.types.Flag method) (dissect.cstruct.types.flag.Flag method) (dissect.cstruct.types.structure.Union method) (dissect.cstruct.types.Union method) (dissect.cstruct.types.Void method) (dissect.cstruct.types.void.Void method) (dissect.cstruct.Union method) (dissect.cstruct.Void method) (dissect.database.ese.Record method) (dissect.database.ese.record.Record method) (dissect.database.sqlite3.Column method) (dissect.database.sqlite3.sqlite3.Column method) (dissect.eventlog.bxml.Token method) (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.MftRecord method) (dissect.target.helpers.fsutil.stat_result method) (dissect.vmfs.address.Address method) (dissect.volume.vss.BlockDescriptor method) (flow.record.base.Record method) (flow.record.base.RecordDescriptor method) (flow.record.fieldtypes.command method) (flow.record.fieldtypes.net.ip.ipaddress method) (flow.record.fieldtypes.net.ip.ipinterface method) (flow.record.fieldtypes.net.ip.ipnetwork method) (flow.record.fieldtypes.net.ipaddress method) (flow.record.fieldtypes.net.ipinterface method) (flow.record.fieldtypes.net.ipnetwork method) (flow.record.fieldtypes.net.ipv4.address method) (flow.record.fieldtypes.path method) (flow.record.fieldtypes.Record method) (flow.record.Record method) (flow.record.RecordDescriptor method) (flow.record.selector.NoneObject method) (flow.record.selector.TypeMatcherInstance method) __exit__() (acquire.acquire.collector.Collector method) (dissect.target.helpers.configutil.ScopeManager method) (dissect.target.helpers.nfs.client.mount.Client method) (dissect.target.helpers.nfs.client.nfs.Client method) (dissect.target.helpers.sunrpc.client.Client method) (flow.record.adapter.AbstractReader method) (flow.record.adapter.AbstractWriter method) __exports__ (dissect.target.plugin.Plugin attribute) __extra__ (dissect.target.exceptions.Error attribute) __failed__ (dissect.target.plugin.PluginRegistry attribute) __fields__ (dissect.cstruct.types.structure.StructureMetaType attribute) __findable__ (dissect.target.plugin.Plugin attribute) (dissect.target.plugins.general.example.ExampleNamespacePlugin attribute) (dissect.target.plugins.general.example.ExamplePlugin attribute) __floordiv__() (dissect.cstruct.Pointer method) (dissect.cstruct.types.Pointer method) (dissect.cstruct.types.pointer.Pointer method) __format__() (flow.record.fieldtypes.bytes method) (flow.record.fieldtypes.net.ip.ipaddress method) (flow.record.fieldtypes.net.ipaddress method) (flow.record.fieldtypes.string method) __functions__ (dissect.target.plugin.Plugin attribute) (dissect.target.plugin.PluginRegistry attribute) __ge__() (dissect.database.ese.Record method) (dissect.database.ese.record.Record method) __getattr__() (dissect.cim.cim.Class method) (dissect.cim.classes.InstanceKey method) (dissect.cstruct.cstruct method) (dissect.cstruct.cstruct.cstruct method) (dissect.cstruct.parser.TokenCollection method) (dissect.cstruct.Pointer method) (dissect.cstruct.types.Pointer method) (dissect.cstruct.types.pointer.Pointer method) (dissect.cstruct.types.structure.UnionProxy method) (dissect.database.ese.Record method) (dissect.database.ese.record.Record method) (dissect.database.ese.tools.sru.Entry method) (dissect.database.sqlite3.Row method) (dissect.database.sqlite3.sqlite3.Row method) (dissect.etl.etl.Event method) (dissect.etl.headers.event.EventHeaderExtendedDataItem method) (dissect.evidence.ad1.AD1 method) (dissect.evidence.ad1.FileEntry method) (dissect.evidence.ad1.FileMeta method) (dissect.evidence.ad1.LogicalImage method) (dissect.hypervisor.disk.vmdk.SparseExtentHeader method) (dissect.ntfs.attr.Attribute method) (dissect.ntfs.Attribute method) (dissect.ntfs.usnjrnl.UsnRecord method) (dissect.ntfs.UsnRecord method) (dissect.ntfs.util.AttributeCollection method) (dissect.ntfs.util.AttributeMap method) (dissect.shellitem.lnk.lnk.LnkExtraData method) (dissect.shellitem.lnk.lnk.LnkInfo method) (dissect.shellitem.lnk.lnk.LnkStringData method) (dissect.target.filesystem.EntryList method) (dissect.target.filesystem.LayerFilesystem method) (dissect.target.helpers.lazy.FailedImport method) (dissect.target.helpers.lazy.LazyAttr method) (dissect.target.helpers.lazy.LazyImport method) (dissect.target.plugin.Plugin method) (dissect.target.plugins.os.unix.linux.fortios._os.ConfigNode method) (dissect.target.Target method) (dissect.target.target.Target method) (dissect.target.tools.shell.ExtendedCmd method) (dissect.util.plist.NSObject method) (flow.record.base.DynamicFieldtypeModule method) (flow.record.base.GroupedRecord method) (flow.record.base.Record method) (flow.record.fieldtypes.Record method) (flow.record.GroupedRecord method) (flow.record.Record method) (flow.record.selector.TypeMatcher method) (flow.record.selector.TypeMatcherInstance method) (flow.record.selector.WrappedRecord method) __getattribute__() (dissect.eventlog.wevt_object.WevtObject method) (dissect.thumbcache.thumbcache_file.ThumbcacheFile method) (dissect.thumbcache.ThumbcacheFile method) __getitem__() (dissect.cim.classes.PropertyStates method) (dissect.cim.index.Key method) (dissect.cim.mappings.Mapping method) (dissect.cim.objects.TOC method) (dissect.cstruct.MetaType method) (dissect.cstruct.Structure method) (dissect.cstruct.types.base.MetaType method) (dissect.cstruct.types.enum.EnumMetaType method) (dissect.cstruct.types.MetaType method) (dissect.cstruct.types.Structure method) (dissect.cstruct.types.structure.Structure method) (dissect.cstruct.types.structure.StructureValuesProxy method) (dissect.cstruct.types.structure.UnionProxy method) (dissect.database.ese.Record method) (dissect.database.ese.record.Record method) (dissect.database.ese.tools.impacket.RecordWrapper method) (dissect.database.ese.tools.sru.Entry method) (dissect.database.sqlite3.Row method) (dissect.database.sqlite3.sqlite3.Row method) (dissect.database.sqlite3.sqlite3.WALCheckpoint method) (dissect.executable.elf.elf.StringTable method) (dissect.executable.elf.elf.Table method) (dissect.executable.elf.StringTable method) (dissect.executable.pe.directory.basereloc.BaseRelocationDirectory method) (dissect.executable.pe.directory.BaseRelocationDirectory method) (dissect.executable.pe.directory.bound_import.BoundImportDirectory method) (dissect.executable.pe.directory.BoundImportDirectory method) (dissect.executable.pe.directory.debug.DebugDirectory method) (dissect.executable.pe.directory.debug.PogoDebugEntry method) (dissect.executable.pe.directory.DebugDirectory method) (dissect.executable.pe.directory.delay_import.DelayImportDirectory method) (dissect.executable.pe.directory.delay_import.DelayImportModule method) (dissect.executable.pe.directory.DelayImportDirectory method) (dissect.executable.pe.directory.exception.ExceptionDirectory method) (dissect.executable.pe.directory.ExceptionDirectory method) (dissect.executable.pe.directory.export.ExportDirectory method) (dissect.executable.pe.directory.ExportDirectory method) (dissect.executable.pe.directory.iat.IatDirectory method) (dissect.executable.pe.directory.IatDirectory method) (dissect.executable.pe.directory.ImportDirectory method) (dissect.executable.pe.directory.ImportModule method) (dissect.executable.pe.directory.imports.ImportDirectory method) (dissect.executable.pe.directory.imports.ImportModule method) (dissect.executable.pe.directory.resource.Resource method) (dissect.executable.pe.directory.resource.ResourceDirectory method) (dissect.executable.pe.directory.ResourceDirectory method) (dissect.executable.pe.directory.security.SecurityDirectory method) (dissect.executable.pe.directory.SecurityDirectory method) (dissect.executable.pe.directory.tls.TlsDirectory method) (dissect.executable.pe.directory.TlsDirectory method) (dissect.hypervisor.descriptor.hyperv.HyperVFile method) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry method) (dissect.hypervisor.disk.vhd.BlockAllocationTable method) (dissect.ntfs.util.AttributeMap method) (dissect.ole.ole.Chain method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystems.config.ConfigurationEntry method) (dissect.target.helpers.configutil.ConfigurationParser method) (dissect.target.helpers.fsutil.stat_result method) (dissect.target.helpers.regutil.HiveCollection method) (dissect.target.helpers.regutil.KeyCollection method) (dissect.target.target.Collection method) (dissect.thumbcache.thumbcache_file.ThumbcacheFile method) (dissect.thumbcache.ThumbcacheFile method) (dissect.util.plist.NSDictionary method) (dissect.util.plist.NSKeyedArchiver method) (dissect.util.plist.NSObject method) (dissect.vmfs.resource.ResourceManager method) (dissect.volume.vss.BlockMap method) (dissect.volume.vss.StoreBitmap method) __gt__() (dissect.database.ese.Record method) (dissect.database.ese.record.Record method) (flow.record.selector.NoneObject method) (flow.record.selector.TypeMatcherInstance method) __gte__() (flow.record.selector.NoneObject method) (flow.record.selector.TypeMatcherInstance method) __hash__ (dissect.ntfs.mft.MftRecord attribute) (dissect.ntfs.MftRecord attribute) __hash__() (dissect.cstruct.Enum method) (dissect.cstruct.Flag method) (dissect.cstruct.types.Enum method) (dissect.cstruct.types.enum.Enum method) (dissect.cstruct.types.Flag method) (dissect.cstruct.types.flag.Flag method) (dissect.database.ese.Record method) (dissect.database.ese.record.Record method) (dissect.vmfs.address.Address method) (flow.record.base.Record method) (flow.record.base.RecordDescriptor method) (flow.record.fieldtypes.datetime method) (flow.record.fieldtypes.net.ip.ipaddress method) (flow.record.fieldtypes.net.ip.ipinterface method) (flow.record.fieldtypes.net.ip.ipnetwork method) (flow.record.fieldtypes.net.ipaddress method) (flow.record.fieldtypes.net.ipinterface method) (flow.record.fieldtypes.net.ipnetwork method) (flow.record.fieldtypes.Record method) (flow.record.Record method) (flow.record.RecordDescriptor method) __init_subclass__() (dissect.apfs.objects.base.Object class method) (dissect.apfs.objects.Object class method) (dissect.target.plugin.InternalPlugin class method) (dissect.target.plugin.NamespacePlugin class method) (dissect.target.plugin.OSPlugin class method) (dissect.target.plugin.Plugin class method) (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm class method) (dissect.target.plugins.os.windows.dpapi.crypto.HashAlgorithm class method) (dissect.vmfs.address.Address class method) __init_subclass_subplugin__() (dissect.target.plugin.NamespacePlugin method) __int__() (dissect.vmfs.address.Address method) __INTERNAL_PLUGIN_METHOD_NAMES__ (in module dissect.target.plugin) __iter__ (dissect.database.ese.tools.sru.SRU attribute) __iter__() (dissect.archive.vbk.MetaVector method) (dissect.cstruct.types.structure.StructureValuesProxy method) (dissect.database.bsd.tools.rpm.Package method) (dissect.database.bsd.tools.rpm.Packages method) (dissect.database.ese.cursor.Cursor method) (dissect.database.sqlite3.Row method) (dissect.database.sqlite3.sqlite3.Row method) (dissect.database.sqlite3.sqlite3.Table method) (dissect.database.sqlite3.Table method) (dissect.etl.Buffer method) (dissect.etl.ETL method) (dissect.etl.etl.Buffer method) (dissect.etl.etl.ETL method) (dissect.eventlog.Evt method) (dissect.eventlog.evt.Evt method) (dissect.eventlog.Evtx method) (dissect.eventlog.evtx.Evtx method) (dissect.eventlog.wevt.MAPS_WEVT_TYPE method) (dissect.eventlog.wevt.TTBL_WEVT_TYPE method) (dissect.eventlog.wevt.WEVT method) (dissect.eventlog.wevt.WEVT_TYPE method) (dissect.eventlog.wevtutil.WevtutilWrapper method) (dissect.executable.elf.elf.Table method) (dissect.executable.pe.directory.basereloc.BaseRelocationDirectory method) (dissect.executable.pe.directory.BaseRelocationDirectory method) (dissect.executable.pe.directory.debug.DebugDirectory method) (dissect.executable.pe.directory.debug.PogoDebugEntry method) (dissect.executable.pe.directory.DebugDirectory method) (dissect.executable.pe.directory.delay_import.DelayImportModule method) (dissect.executable.pe.directory.exception.ExceptionDirectory method) (dissect.executable.pe.directory.ExceptionDirectory method) (dissect.executable.pe.directory.export.ExportDirectory method) (dissect.executable.pe.directory.ExportDirectory method) (dissect.executable.pe.directory.iat.IatDirectory method) (dissect.executable.pe.directory.IatDirectory method) (dissect.executable.pe.directory.ImportModule method) (dissect.executable.pe.directory.imports.ImportModule method) (dissect.executable.pe.directory.resource.Resource method) (dissect.executable.pe.directory.resource.ResourceDirectory method) (dissect.executable.pe.directory.ResourceDirectory method) (dissect.executable.pe.directory.security.SecurityDirectory method) (dissect.executable.pe.directory.SecurityDirectory method) (dissect.executable.pe.directory.tls.TlsDirectory method) (dissect.executable.pe.directory.TlsDirectory method) (dissect.fve.bde.information.Dataset method) (dissect.ntfs.Index method) (dissect.ntfs.index.Index method) (dissect.ole.ole.Chain method) (dissect.regf.regf.FastLeaf method) (dissect.regf.regf.HashLeaf method) (dissect.regf.regf.IndexLeaf method) (dissect.regf.regf.IndexRoot method) (dissect.regf.regf.KeyIndex method) (dissect.regf.regf.ValueList method) (dissect.target.helpers.cache.CacheWriter method) (dissect.target.helpers.cache.LineReader method) (dissect.target.helpers.configutil.PeekableIterator method) (dissect.target.helpers.fsutil.stat_result method) (dissect.target.helpers.regutil.HiveCollection method) (dissect.target.helpers.regutil.KeyCollection method) (dissect.target.helpers.regutil.ValueCollection method) (dissect.target.plugins.os.unix.locate.gnulocate.GNULocateFile method) (dissect.target.plugins.os.unix.locate.mlocate.MLocateFile method) (dissect.target.plugins.os.unix.locate.plocate.PLocateFile method) (dissect.target.plugins.os.unix.log.atop.AtopFile method) (dissect.target.plugins.os.unix.log.journal.JournalFile method) (dissect.target.plugins.os.unix.log.lastlog.LastLogFile method) (dissect.target.plugins.os.unix.log.utmp.UtmpFile method) (dissect.target.plugins.os.windows.everything.parser.EverythingDB method) (dissect.target.plugins.os.windows.jumplist.AutomaticDestinationFile method) (dissect.target.plugins.os.windows.jumplist.CustomDestinationFile method) (dissect.target.plugins.os.windows.jumplist.JumpListFile method) (dissect.target.plugins.os.windows.regf.shimcache.ShimCache method) (dissect.target.target.Collection method) (flow.record.adapter.AbstractReader method) (flow.record.adapter.avro.AvroReader method) (flow.record.adapter.broker.BrokerReader method) (flow.record.adapter.csvfile.CsvfileReader method) (flow.record.adapter.elastic.ElasticReader method) (flow.record.adapter.jsonfile.JsonfileReader method) (flow.record.adapter.mongo.MongoReader method) (flow.record.adapter.sqlite.SqliteReader method) (flow.record.adapter.stream.StreamReader method) (flow.record.adapter.xlsx.XlsxReader method) (flow.record.selector.TypeMatcherInstance method) (flow.record.stream.RecordStreamReader method) __known_types__ (dissect.apfs.objects.base.Object attribute) (dissect.apfs.objects.Object attribute) (dissect.vmfs.address.Address attribute) __le__() (dissect.database.ese.Record method) (dissect.database.ese.record.Record method) __len__ (dissect.cstruct.types.enum.EnumMetaType attribute) __len__() (dissect.cstruct.BaseType method) (dissect.cstruct.MetaType method) (dissect.cstruct.parser.TokenConsumer method) (dissect.cstruct.Structure method) (dissect.cstruct.types.base.BaseType method) (dissect.cstruct.types.base.MetaType method) (dissect.cstruct.types.BaseType method) (dissect.cstruct.types.MetaType method) (dissect.cstruct.types.Structure method) (dissect.cstruct.types.structure.Structure method) (dissect.cstruct.types.structure.StructureValuesProxy method) (dissect.cstruct.types.structure.UnionProxy method) (dissect.executable.pe.directory.basereloc.BaseRelocationDirectory method) (dissect.executable.pe.directory.BaseRelocationDirectory method) (dissect.executable.pe.directory.bound_import.BoundImportDirectory method) (dissect.executable.pe.directory.BoundImportDirectory method) (dissect.executable.pe.directory.debug.DebugDirectory method) (dissect.executable.pe.directory.debug.PogoDebugEntry method) (dissect.executable.pe.directory.DebugDirectory method) (dissect.executable.pe.directory.delay_import.DelayImportDirectory method) (dissect.executable.pe.directory.DelayImportDirectory method) (dissect.executable.pe.directory.exception.ExceptionDirectory method) (dissect.executable.pe.directory.ExceptionDirectory method) (dissect.executable.pe.directory.iat.IatDirectory method) (dissect.executable.pe.directory.IatDirectory method) (dissect.executable.pe.directory.ImportDirectory method) (dissect.executable.pe.directory.imports.ImportDirectory method) (dissect.executable.pe.directory.resource.ResourceDirectory method) (dissect.executable.pe.directory.ResourceDirectory method) (dissect.executable.pe.directory.security.SecurityDirectory method) (dissect.executable.pe.directory.SecurityDirectory method) (dissect.executable.pe.directory.tls.TlsDirectory method) (dissect.executable.pe.directory.TlsDirectory method) (dissect.ole.ole.Chain method) (dissect.regf.regf.FastLeaf method) (dissect.regf.regf.HashLeaf method) (dissect.regf.regf.IndexLeaf method) (dissect.regf.regf.IndexRoot method) (dissect.regf.regf.KeyIndex method) (dissect.target.helpers.regutil.HiveCollection method) (dissect.target.helpers.regutil.KeyCollection method) (dissect.target.helpers.regutil.ValueCollection method) (dissect.target.target.Collection method) (flow.record.selector.NoneObject method) __lshift__() (dissect.cstruct.Pointer method) (dissect.cstruct.types.Pointer method) (dissect.cstruct.types.pointer.Pointer method) __lt__() (dissect.database.ese.Record method) (dissect.database.ese.record.Record method) (flow.record.selector.NoneObject method) (flow.record.selector.TypeMatcherInstance method) __lte__() (flow.record.selector.NoneObject method) (flow.record.selector.TypeMatcherInstance method) __MAPPING__ (dissect.target.plugins.os.unix.packagemanager.OperationTypes attribute) __missing__() (flow.record.adapter.text.DefaultMissing method) __mod__() (dissect.cstruct.Pointer method) (dissect.cstruct.types.Pointer method) (dissect.cstruct.types.pointer.Pointer method) __mul__() (dissect.cstruct.Pointer method) (dissect.cstruct.types.Pointer method) (dissect.cstruct.types.pointer.Pointer method) __multi_volume__ (dissect.target.filesystem.Filesystem attribute) (dissect.target.filesystems.btrfs.BtrfsFilesystem attribute) __namespace__ (dissect.target.plugin.Plugin attribute) (dissect.target.plugins.apps.av.mcafee.McAfeePlugin attribute) (dissect.target.plugins.apps.av.sophos.SophosPlugin attribute) (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) (dissect.target.plugins.apps.av.trendmicro.TrendMicroPlugin attribute) (dissect.target.plugins.apps.browser.brave.BravePlugin attribute) (dissect.target.plugins.apps.browser.browser.BrowserPlugin attribute) (dissect.target.plugins.apps.browser.chrome.ChromePlugin attribute) (dissect.target.plugins.apps.browser.chromium.ChromiumPlugin attribute) (dissect.target.plugins.apps.browser.edge.EdgePlugin attribute) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin attribute) (dissect.target.plugins.apps.browser.iexplore.InternetExplorerPlugin attribute) (dissect.target.plugins.apps.chat.chat.ChatPlugin attribute) (dissect.target.plugins.apps.chat.msn.MSNPlugin attribute) (dissect.target.plugins.apps.container.container.ContainerPlugin attribute) (dissect.target.plugins.apps.container.docker.DockerPlugin attribute) (dissect.target.plugins.apps.container.podman.PodmanPlugin attribute) (dissect.target.plugins.apps.editor.editor.EditorPlugin attribute) (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadPlugin attribute) (dissect.target.plugins.apps.edr.acquire.AcquirePlugin attribute) (dissect.target.plugins.apps.edr.velociraptor.VelociraptorPlugin attribute) (dissect.target.plugins.apps.productivity.msoffice.MSOffice attribute) (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin attribute) (dissect.target.plugins.apps.remoteaccess.remoteaccess.RemoteAccessPlugin attribute) (dissect.target.plugins.apps.remoteaccess.rustdesk.RustdeskPlugin attribute) (dissect.target.plugins.apps.remoteaccess.splashtop.SplashtopPlugin attribute) (dissect.target.plugins.apps.remoteaccess.teamviewer.TeamViewerPlugin attribute) (dissect.target.plugins.apps.shell.wget.WgetPlugin attribute) (dissect.target.plugins.apps.ssh.openssh.OpenSSHPlugin attribute) (dissect.target.plugins.apps.ssh.opensshd.SSHServerPlugin attribute) (dissect.target.plugins.apps.ssh.putty.PuTTYPlugin attribute) (dissect.target.plugins.apps.ssh.ssh.SSHPlugin attribute) (dissect.target.plugins.apps.virtualization.vmware_workstation.VmwareWorkstationPlugin attribute) (dissect.target.plugins.apps.vpn.openvpn.OpenVPNPlugin attribute) (dissect.target.plugins.apps.vpn.wireguard.WireGuardPlugin attribute) (dissect.target.plugins.apps.webhosting.cpanel.CPanelPlugin attribute) (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) (dissect.target.plugins.apps.webserver.caddy.CaddyPlugin attribute) (dissect.target.plugins.apps.webserver.citrix.CitrixWebserverPlugin attribute) (dissect.target.plugins.apps.webserver.iis.IISLogsPlugin attribute) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin attribute) (dissect.target.plugins.apps.webserver.webserver.WebserverPlugin attribute) (dissect.target.plugins.filesystem.ntfs.mft.MftPlugin attribute) (dissect.target.plugins.general.config.ConfigurationTreePlugin attribute) (dissect.target.plugins.general.example.ExampleNamespacePlugin attribute) (dissect.target.plugins.general.users.UsersPlugin attribute) (dissect.target.plugins.os.default.datetime.DateTimePlugin attribute) (dissect.target.plugins.os.default.network.NetworkPlugin attribute) (dissect.target.plugins.os.unix.datetime.UnixDateTimePlugin attribute) (dissect.target.plugins.os.unix.etc.etc.EtcTree attribute) (dissect.target.plugins.os.unix.linux.debian.apt.AptPlugin attribute) (dissect.target.plugins.os.unix.linux.debian.dpkg.DpkgPlugin attribute) (dissect.target.plugins.os.unix.linux.proc.ProcPlugin attribute) (dissect.target.plugins.os.unix.linux.redhat.yum.YumPlugin attribute) (dissect.target.plugins.os.unix.linux.sockets.NetSocketPlugin attribute) (dissect.target.plugins.os.unix.linux.suse.zypper.ZypperPlugin attribute) (dissect.target.plugins.os.unix.locate.gnulocate.GNULocatePlugin attribute) (dissect.target.plugins.os.unix.locate.locate.BaseLocatePlugin attribute) (dissect.target.plugins.os.unix.locate.mlocate.MLocatePlugin attribute) (dissect.target.plugins.os.unix.locate.plocate.PLocatePlugin attribute) (dissect.target.plugins.os.unix.packagemanager.PackageManagerPlugin attribute) (dissect.target.plugins.os.windows.amcache.AmcachePlugin attribute) (dissect.target.plugins.os.windows.amcache.AmcachePluginOldMixin attribute) (dissect.target.plugins.os.windows.cam.CamPlugin attribute) (dissect.target.plugins.os.windows.catroot.CatrootPlugin attribute) (dissect.target.plugins.os.windows.cim.CimPlugin attribute) (dissect.target.plugins.os.windows.credential.lsa.LSAPlugin attribute) (dissect.target.plugins.os.windows.datetime.WindowsDateTimePlugin attribute) (dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin attribute) (dissect.target.plugins.os.windows.dpapi.keyprovider.credhist.CredHistKeyProviderPlugin attribute) (dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.defaultpassword.DefaultPasswordKeyProvider attribute) (dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.lsa.LSADefaultPasswordKeyProviderPlugin attribute) (dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.winlogon.WinlogonDefaultPasswordKeyProviderPlugin attribute) (dissect.target.plugins.os.windows.dpapi.keyprovider.empty.EmptyKeyProviderPlugin attribute) (dissect.target.plugins.os.windows.dpapi.keyprovider.keychain.KeychainKeyProviderPlugin attribute) (dissect.target.plugins.os.windows.dpapi.keyprovider.keyprovider.KeyProviderPlugin attribute) (dissect.target.plugins.os.windows.exchange.exchange.ExchangePlugin attribute) (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin attribute) (dissect.target.plugins.os.windows.jumplist.JumpListPlugin attribute) (dissect.target.plugins.os.windows.log.etl.EtlPlugin attribute) (dissect.target.plugins.os.windows.log.mssql.MssqlPlugin attribute) (dissect.target.plugins.os.windows.notifications.NotificationsPlugin attribute) (dissect.target.plugins.os.windows.rdpcache.RdpCachePlugin attribute) (dissect.target.plugins.os.windows.regf.cit.CITPlugin attribute) (dissect.target.plugins.os.windows.regf.clsid.CLSIDPlugin attribute) (dissect.target.plugins.os.windows.regf.mru.MRUPlugin attribute) (dissect.target.plugins.os.windows.registry.RegistryPlugin attribute) (dissect.target.plugins.os.windows.sru.SRUPlugin attribute) (dissect.target.plugins.os.windows.thumbcache.ThumbcachePlugin attribute) (dissect.target.plugins.os.windows.ual.UalPlugin attribute) (dissect.target.plugins.scrape.scrape.ScrapePlugin attribute) __ne__() (dissect.cstruct.Enum method) (dissect.cstruct.Flag method) (dissect.cstruct.parser.Token method) (dissect.cstruct.types.Enum method) (dissect.cstruct.types.enum.Enum method) (dissect.cstruct.types.Flag method) (dissect.cstruct.types.flag.Flag method) (dissect.database.ese.Record method) (dissect.database.ese.record.Record method) (dissect.target.helpers.fsutil.stat_result method) (dissect.vmfs.address.Address method) (flow.record.selector.NoneObject method) (flow.record.selector.TypeMatcherInstance method) __next__() (dissect.target.helpers.configutil.PeekableIterator method) __noteq__() (flow.record.selector.NoneObject method) (flow.record.selector.TypeMatcherInstance method) __or__() (dissect.cstruct.Pointer method) (dissect.cstruct.types.Pointer method) (dissect.cstruct.types.pointer.Pointer method) __os__ (dissect.target.plugin.FunctionDescriptorLookup attribute) (dissect.target.plugin.PluginDescriptorLookup attribute) __ostree__ (dissect.target.plugin.PluginRegistry attribute) __path__ (in module flow.record.adapter) __plugins__ (dissect.target.plugin.PluginRegistry attribute) __post_init__() (dissect.hypervisor.disk.vmdk.ExtentDescriptor method) (dissect.target.helpers.nfs.nfs3.CookieVerf method) (dissect.target.helpers.nfs.nfs3.FileHandle method) (dissect.target.helpers.sunrpc.sunrpc.AuthUnix method) (dissect.target.plugins.os.windows.firewall.LogConfig method) (dissect.target.tools.dump.Sink method) __pow__() (dissect.cstruct.Pointer method) (dissect.cstruct.types.Pointer method) (dissect.cstruct.types.pointer.Pointer method) __record_descriptors__ (dissect.target.plugin.Plugin attribute) __reduce__() (dissect.target.helpers.compat.path_310.PureDissectPath method) (dissect.target.helpers.compat.path_311.PureDissectPath method) (dissect.target.helpers.compat.path_312.PureDissectPath method) (dissect.target.helpers.compat.path_313.PureDissectPath method) __register__ (dissect.target.loaders.cb.CbRegistry attribute) (dissect.target.loaders.smb.SmbRegistry attribute) (dissect.target.plugin.Plugin attribute) __regular__ (dissect.target.plugin.FunctionDescriptorLookup attribute) (dissect.target.plugin.PluginDescriptorLookup attribute) __repr__() (acquire.acquire.dynamic.windows.named_objects.NamedObject method) (dissect.apfs.objects.base.Object method) (dissect.apfs.objects.BTree method) (dissect.apfs.objects.btree.BTree method) (dissect.apfs.objects.btree_node.BTreeNode method) (dissect.apfs.objects.BTreeNode method) (dissect.apfs.objects.FS method) (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.FS method) (dissect.apfs.objects.fs.INode method) (dissect.apfs.objects.fs.Snapshot method) (dissect.apfs.objects.fs.XAttr method) (dissect.apfs.objects.keybag.KEK method) (dissect.apfs.objects.keybag.VEK method) (dissect.apfs.objects.Object method) (dissect.archive.vbk.Bank method) (dissect.archive.vbk.DirItem method) (dissect.archive.vbk.ExtFibItem method) (dissect.archive.vbk.FibBlockDescriptor method) (dissect.archive.vbk.FibBlockDescriptorV7 method) (dissect.archive.vbk.IncrementItem method) (dissect.archive.vbk.IntFibItem method) (dissect.archive.vbk.MetaBlob method) (dissect.archive.vbk.MetaTableDescriptor method) (dissect.archive.vbk.MetaVector method) (dissect.archive.vbk.PatchItem method) (dissect.archive.vbk.RootDirectory method) (dissect.archive.vbk.SnapshotSlot method) (dissect.archive.vbk.StgBlockDescriptor method) (dissect.archive.vbk.StgBlockDescriptorV7 method) (dissect.archive.vbk.SubFolderItem method) (dissect.archive.vma.Device method) (dissect.archive.vma.Extent method) (dissect.archive.wim.DirectoryEntry method) (dissect.archive.wim.Image method) (dissect.btrfs.btrfs.INode method) (dissect.btrfs.btrfs.Subvolume method) (dissect.btrfs.INode method) (dissect.btrfs.Subvolume method) (dissect.cim.cim.Namespace method) (dissect.cim.classes.PropertyReference method) (dissect.cim.classes.QualifierReference method) (dissect.cim.index.Key method) (dissect.cramfs.cramfs.INode method) (dissect.cramfs.INode method) (dissect.cstruct.Enum method) (dissect.cstruct.Expression method) (dissect.cstruct.expression.Expression method) (dissect.cstruct.Field method) (dissect.cstruct.Flag method) (dissect.cstruct.parser.Token method) (dissect.cstruct.parser.TokenConsumer method) (dissect.cstruct.Pointer method) (dissect.cstruct.Structure method) (dissect.cstruct.types.Enum method) (dissect.cstruct.types.enum.Enum method) (dissect.cstruct.types.Field method) (dissect.cstruct.types.Flag method) (dissect.cstruct.types.flag.Flag method) (dissect.cstruct.types.Pointer method) (dissect.cstruct.types.pointer.Pointer method) (dissect.cstruct.types.Structure method) (dissect.cstruct.types.structure.Field method) (dissect.cstruct.types.structure.Structure method) (dissect.cstruct.types.structure.StructureValuesProxy method) (dissect.cstruct.types.structure.UnionProxy method) (dissect.database.bsd.tools.rpm.Package method) (dissect.database.ese.Index method) (dissect.database.ese.index.Index method) (dissect.database.ese.Page method) (dissect.database.ese.page.BranchNode method) (dissect.database.ese.page.LeafNode method) (dissect.database.ese.page.Page method) (dissect.database.ese.page.Tag method) (dissect.database.ese.Record method) (dissect.database.ese.record.Record method) (dissect.database.ese.record.TagField method) (dissect.database.ese.Table method) (dissect.database.ese.table.Column method) (dissect.database.ese.table.Table method) (dissect.database.ese.tools.sru.Entry method) (dissect.database.sqlite3.Column method) (dissect.database.sqlite3.Row method) (dissect.database.sqlite3.sqlite3.Cell method) (dissect.database.sqlite3.sqlite3.Column method) (dissect.database.sqlite3.sqlite3.Index method) (dissect.database.sqlite3.sqlite3.Page method) (dissect.database.sqlite3.sqlite3.Row method) (dissect.database.sqlite3.sqlite3.Table method) (dissect.database.sqlite3.sqlite3.WALCheckpoint method) (dissect.database.sqlite3.sqlite3.WALFrame method) (dissect.database.sqlite3.Table method) (dissect.etl.etl.Event method) (dissect.etl.etl.EventRecord method) (dissect.etl.headers.event.EventHeaderExtendedDataItem method) (dissect.etl.headers.headers.Header method) (dissect.eventlog.bxml.BxmlSub method) (dissect.eventlog.wevt.WEVT method) (dissect.eventlog.wevt_object.WevtObject method) (dissect.evidence.ad1.FileEntry method) (dissect.evidence.ad1.FileMeta method) (dissect.evidence.ad1.LogicalImage method) (dissect.evidence.ewf.HeaderSection method) (dissect.evidence.ewf.SectionDescriptor method) (dissect.executable.ELF method) (dissect.executable.elf.ELF method) (dissect.executable.elf.elf.ELF method) (dissect.executable.elf.elf.Section method) (dissect.executable.elf.elf.SectionTable method) (dissect.executable.elf.elf.Segment method) (dissect.executable.elf.elf.SegmentTable method) (dissect.executable.elf.elf.Symbol method) (dissect.executable.elf.Section method) (dissect.executable.elf.SectionTable method) (dissect.executable.elf.Segment method) (dissect.executable.elf.SegmentTable method) (dissect.executable.elf.Symbol method) (dissect.executable.pe.directory.base.DataDirectory method) (dissect.executable.pe.directory.basereloc.BaseRelocation method) (dissect.executable.pe.directory.basereloc.BaseRelocationDirectory method) (dissect.executable.pe.directory.BaseRelocationDirectory method) (dissect.executable.pe.directory.bound_import.BoundImportDirectory method) (dissect.executable.pe.directory.BoundImportDirectory method) (dissect.executable.pe.directory.com_descriptor.ComStream method) (dissect.executable.pe.directory.DataDirectory method) (dissect.executable.pe.directory.debug.CodeViewDebugEntry method) (dissect.executable.pe.directory.debug.DebugDirectory method) (dissect.executable.pe.directory.debug.DebugEntry method) (dissect.executable.pe.directory.debug.PogoDebugEntry method) (dissect.executable.pe.directory.debug.ReproDebugEntry method) (dissect.executable.pe.directory.debug.VcFeatureDebugEntry method) (dissect.executable.pe.directory.DebugDirectory method) (dissect.executable.pe.directory.delay_import.DelayImportDirectory method) (dissect.executable.pe.directory.delay_import.DelayImportFunction method) (dissect.executable.pe.directory.delay_import.DelayImportModule method) (dissect.executable.pe.directory.DelayImportDirectory method) (dissect.executable.pe.directory.exception.ExceptionDirectory method) (dissect.executable.pe.directory.ExceptionDirectory method) (dissect.executable.pe.directory.export.ExportDirectory method) (dissect.executable.pe.directory.export.ExportFunction method) (dissect.executable.pe.directory.ExportDirectory method) (dissect.executable.pe.directory.iat.IatDirectory method) (dissect.executable.pe.directory.IatDirectory method) (dissect.executable.pe.directory.ImportDirectory method) (dissect.executable.pe.directory.ImportFunction method) (dissect.executable.pe.directory.ImportModule method) (dissect.executable.pe.directory.imports.ImportDirectory method) (dissect.executable.pe.directory.imports.ImportFunction method) (dissect.executable.pe.directory.imports.ImportModule method) (dissect.executable.pe.directory.resource.Resource method) (dissect.executable.pe.directory.resource.ResourceDataEntry method) (dissect.executable.pe.directory.resource.ResourceDirectory method) (dissect.executable.pe.directory.resource.ResourceDirectoryEntry method) (dissect.executable.pe.directory.ResourceDataEntry method) (dissect.executable.pe.directory.ResourceDirectory method) (dissect.executable.pe.directory.ResourceDirectoryEntry method) (dissect.executable.pe.directory.security.Certificate method) (dissect.executable.pe.directory.security.SecurityDirectory method) (dissect.executable.pe.directory.SecurityDirectory method) (dissect.executable.pe.directory.tls.TlsDirectory method) (dissect.executable.pe.directory.TlsDirectory method) (dissect.executable.pe.pe.Section method) (dissect.extfs.extfs.INode method) (dissect.extfs.extfs.XAttr method) (dissect.extfs.INode method) (dissect.extfs.journal.CommitBlock method) (dissect.extfs.journal.DescriptorBlock method) (dissect.extfs.journal.DescriptorBlockTag method) (dissect.fat.fat.DirectoryEntry method) (dissect.ffs.ffs.INode method) (dissect.fve.bde.eow.EowBitmap method) (dissect.fve.bde.eow.EowBitmapRecord method) (dissect.fve.bde.information.AesCbc256HmacSha512EncryptedDatum method) (dissect.fve.bde.information.AesCcmEncryptedDatum method) (dissect.fve.bde.information.AsymmetricEncryptedDatum method) (dissect.fve.bde.information.BackupInfoDatum method) (dissect.fve.bde.information.ConcatHashKeyDatum method) (dissect.fve.bde.information.Datum method) (dissect.fve.bde.information.ErrorLogDatum method) (dissect.fve.bde.information.ExportedPublicKeyDatum method) (dissect.fve.bde.information.ExternalInfoDatum method) (dissect.fve.bde.information.GuidDatum method) (dissect.fve.bde.information.Information method) (dissect.fve.bde.information.KeyDatum method) (dissect.fve.bde.information.PublicKeyInfoDatum method) (dissect.fve.bde.information.SimpleDatum method) (dissect.fve.bde.information.SimpleLargeDatum method) (dissect.fve.bde.information.StretchKeyDatum method) (dissect.fve.bde.information.TpmEncryptedBlobDatum method) (dissect.fve.bde.information.UnicodeDatum method) (dissect.fve.bde.information.UpdateDatum method) (dissect.fve.bde.information.UseKeyDatum method) (dissect.fve.bde.information.ValidationEntry method) (dissect.fve.bde.information.ValidationInfoDatum method) (dissect.fve.bde.information.VirtualizationInfoDatum method) (dissect.fve.bde.information.VmkInfoDatum method) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry method) (dissect.hypervisor.descriptor.vmx.Pair method) (dissect.hypervisor.descriptor.vmx.Phrase method) (dissect.hypervisor.disk.asif.Directory method) (dissect.hypervisor.disk.asif.Table method) (dissect.hypervisor.disk.vmdk.ExtentDescriptor method) (dissect.jffs.jffs2.INode method) (dissect.ntfs.ACE method) (dissect.ntfs.attr.Attribute method) (dissect.ntfs.attr.AttributeHeader method) (dissect.ntfs.attr.AttributeList method) (dissect.ntfs.attr.FileName method) (dissect.ntfs.attr.ReparsePoint method) (dissect.ntfs.attr.StandardInformation method) (dissect.ntfs.Attribute method) (dissect.ntfs.AttributeHeader method) (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.MftRecord method) (dissect.ntfs.secure.ACE method) (dissect.ntfs.usnjrnl.UsnRecord method) (dissect.ntfs.UsnRecord method) (dissect.ole.ole.DirectoryEntry method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.regf.regf.KeyNode method) (dissect.regf.regf.KeyValue method) (dissect.shellitem.lnk.Lnk method) (dissect.shellitem.lnk.lnk.Lnk method) (dissect.shellitem.lnk.lnk.LnkExtraData method) (dissect.shellitem.lnk.lnk.LnkInfo method) (dissect.shellitem.lnk.lnk.LnkStringData method) (dissect.shellitem.lnk.lnk.LnkTargetIdList method) (dissect.squashfs.INode method) (dissect.squashfs.squashfs.INode method) (dissect.target.container.Container method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystems.config.ConfigurationEntry method) (dissect.target.filesystems.dir.DirectoryFilesystem method) (dissect.target.filesystems.overlay.Overlay2Filesystem method) (dissect.target.filesystems.overlay.OverlayFilesystem method) (dissect.target.helpers.fsutil.stat_result method) (dissect.target.helpers.lazy.LazyAttr method) (dissect.target.helpers.lazy.LazyImport method) (dissect.target.helpers.regutil.RegistryKey method) (dissect.target.helpers.regutil.RegistryValue method) (dissect.target.helpers.regutil.VirtualHive method) (dissect.target.loader.Loader method) (dissect.target.loaders.cellebrite.CellebriteFilesystem method) (dissect.target.loaders.itunes.FileInfo method) (dissect.target.loaders.res.File method) (dissect.target.loaders.res.Folder method) (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadTab method) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager method) (dissect.target.plugins.os.windows.credential.credhist.CredHistFile method) (dissect.target.plugins.os.windows.datetime.WindowsTimezone method) (dissect.target.plugins.os.windows.dpapi.blob.Blob method) (dissect.target.plugins.os.windows.everything.parser.EverythingDB method) (dissect.target.plugins.os.windows.regf.cit.Entry method) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK method) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM method) (dissect.target.Target method) (dissect.target.target.Collection method) (dissect.target.target.Target method) (dissect.target.volume.Volume method) (dissect.target.volume.VolumeSystem method) (dissect.thumbcache.index.IndexEntry method) (dissect.thumbcache.IndexEntry method) (dissect.thumbcache.thumbcache_file.ThumbcacheEntry method) (dissect.thumbcache.ThumbcacheEntry method) (dissect.util.ldap.SearchFilter method) (dissect.util.plist.NSDictionary method) (dissect.util.plist.NSKeyedArchiver method) (dissect.util.plist.NSObject method) (dissect.vmfs.address.Address method) (dissect.vmfs.address.FileBlockAddr method) (dissect.vmfs.address.FileDescriptorAddr method) (dissect.vmfs.address.JournalBlockAddr method) (dissect.vmfs.address.LargeFileBlockAddr method) (dissect.vmfs.address.PointerBlock2Addr method) (dissect.vmfs.address.PointerBlock2Addr64 method) (dissect.vmfs.address.PointerBlockAddr method) (dissect.vmfs.address.PointerBlockAddr64 method) (dissect.vmfs.address.SmallFileBlockAddr method) (dissect.vmfs.address.SubBlockAddr method) (dissect.vmfs.address.SubBlockAddr64 method) (dissect.vmfs.descriptor.DirEntry method) (dissect.vmfs.descriptor.FileDescriptor method) (dissect.vmfs.Device method) (dissect.vmfs.DirEntry method) (dissect.vmfs.FileDescriptor method) (dissect.vmfs.LVM method) (dissect.vmfs.lvm.Device method) (dissect.vmfs.lvm.LVM method) (dissect.vmfs.lvm.Volume method) (dissect.vmfs.resource.ResourceManager method) (dissect.vmfs.Volume method) (dissect.volume.ddf.ddf.ControllerData method) (dissect.volume.ddf.ddf.DDFPhysicalDisk method) (dissect.volume.ddf.ddf.PhysicalDiskData method) (dissect.volume.ddf.ddf.PhysicalDiskRecord method) (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord method) (dissect.volume.ddf.ddf.VirtualDiskRecord method) (dissect.volume.disk.Partition method) (dissect.volume.disk.partition.Partition method) (dissect.volume.lvm.LVM2 method) (dissect.volume.lvm.lvm2.LVM2 method) (dissect.volume.lvm.LVM2Device method) (dissect.volume.lvm.metadata.HistoricalLogicalVolume method) (dissect.volume.lvm.metadata.LogicalVolume method) (dissect.volume.lvm.metadata.PhysicalVolume method) (dissect.volume.lvm.metadata.Segment method) (dissect.volume.lvm.metadata.VolumeGroup method) (dissect.volume.lvm.physical.LVM2Device method) (dissect.volume.vss.BlockDescriptor method) (dissect.volume.vss.Catalog method) (dissect.volume.vss.VSS method) (dissect.xfs.xfs.INode method) (flow.record.base.GroupedRecord method) (flow.record.base.Record method) (flow.record.base.RecordDescriptor method) (flow.record.base.RecordField method) (flow.record.fieldtypes.boolean method) (flow.record.fieldtypes.command method) (flow.record.fieldtypes.datetime method) (flow.record.fieldtypes.digest method) (flow.record.fieldtypes.filesize method) (flow.record.fieldtypes.net.ip.ipaddress method) (flow.record.fieldtypes.net.ip.ipinterface method) (flow.record.fieldtypes.net.ip.ipnetwork method) (flow.record.fieldtypes.net.ipaddress method) (flow.record.fieldtypes.net.ipinterface method) (flow.record.fieldtypes.net.ipnetwork method) (flow.record.fieldtypes.net.ipv4.address method) (flow.record.fieldtypes.net.ipv4.subnet method) (flow.record.fieldtypes.path method) (flow.record.fieldtypes.Record method) (flow.record.fieldtypes.uint16 method) (flow.record.fieldtypes.unix_file_mode method) (flow.record.fieldtypes.windows_path method) (flow.record.GroupedRecord method) (flow.record.Record method) (flow.record.RecordDescriptor method) (flow.record.RecordField method) (flow.record.selector.CompiledSelector method) (flow.record.selector.Selector method) (flow.record.selector.WrappedRecord method) __rshift__() (dissect.cstruct.Pointer method) (dissect.cstruct.types.Pointer method) (dissect.cstruct.types.pointer.Pointer method) __rtruediv__() (dissect.target.helpers.compat.path_310.PureDissectPath method) (dissect.target.helpers.compat.path_311.PureDissectPath method) __setattr__() (dissect.cim.classes.InstanceKey method) (dissect.cstruct.types.structure.Union method) (dissect.cstruct.types.structure.UnionProxy method) (dissect.cstruct.types.Union method) (dissect.cstruct.Union method) (flow.record.base.GroupedRecord method) (flow.record.base.Record method) (flow.record.fieldtypes.Record method) (flow.record.GroupedRecord method) (flow.record.Record method) __setitem__() (dissect.cstruct.types.structure.StructureValuesProxy method) (dissect.eventlog.utils.KeyValueCollection method) (dissect.target.plugins.apps.vpn.wireguard.MultiDict method) __signature__ (dissect.regf.regf.BigData attribute) (dissect.regf.regf.Cell attribute) (dissect.regf.regf.FastLeaf attribute) (dissect.regf.regf.HashLeaf attribute) (dissect.regf.regf.IndexLeaf attribute) (dissect.regf.regf.IndexRoot attribute) (dissect.regf.regf.KeyNode attribute) (dissect.regf.regf.KeySecurity attribute) (dissect.regf.regf.KeyValue attribute) __sizes__ (dissect.cstruct.Structure property) (dissect.cstruct.types.Structure property) (dissect.cstruct.types.structure.Structure property) __slots__ (acquire.acquire.dynamic.windows.named_objects.NamedObject attribute) (dissect.archive.wim.Resource attribute) (dissect.cstruct.parser.Token attribute) (dissect.cstruct.types.Wchar attribute) (dissect.cstruct.types.wchar.Wchar attribute) (dissect.cstruct.types.wchar.WcharArray attribute) (dissect.cstruct.types.WcharArray attribute) (dissect.cstruct.Wchar attribute) (dissect.cstruct.WcharArray attribute) (dissect.database.ese.page.BranchNode attribute) (dissect.database.ese.page.Node attribute) (dissect.database.ese.page.Tag attribute) (dissect.database.ese.record.TagField attribute) (dissect.etl.etl.Event attribute) (dissect.etl.etl.EventRecord attribute) (dissect.etl.headers.event.EventDescriptor attribute) (dissect.etl.headers.event.EventHeaderExtendedDataItem attribute) (dissect.eventlog.wevt_object.BMAP attribute) (dissect.eventlog.wevt_object.CHAN attribute) (dissect.eventlog.wevt_object.EVNT attribute) (dissect.eventlog.wevt_object.KEYW attribute) (dissect.eventlog.wevt_object.LEVL attribute) (dissect.eventlog.wevt_object.OPCO attribute) (dissect.eventlog.wevt_object.PRVA attribute) (dissect.eventlog.wevt_object.TASK attribute) (dissect.eventlog.wevt_object.TEMP attribute) (dissect.eventlog.wevt_object.TEMP_DESCRIPTOR attribute) (dissect.eventlog.wevt_object.VMAP attribute) (dissect.ntfs.attr.Attribute attribute) (dissect.ntfs.attr.AttributeHeader attribute) (dissect.ntfs.attr.AttributeList attribute) (dissect.ntfs.attr.AttributeRecord attribute) (dissect.ntfs.attr.FileName attribute) (dissect.ntfs.attr.ReparsePoint attribute) (dissect.ntfs.attr.StandardInformation attribute) (dissect.ntfs.Attribute attribute) (dissect.ntfs.AttributeHeader attribute) (dissect.ntfs.AttributeRecord attribute) (dissect.target.helpers.compat.path_310.TargetPath attribute) (dissect.target.helpers.compat.path_311.TargetPath attribute) (dissect.target.helpers.compat.path_312.TargetPath attribute) (dissect.target.helpers.compat.path_313.TargetPath attribute) (dissect.target.helpers.fsutil.stat_result attribute) (dissect.thumbcache.thumbcache_file.ThumbcacheFile attribute) (dissect.thumbcache.ThumbcacheFile attribute) (dissect.util.compression.lzxpress_huffman.Node attribute) (dissect.volume.vss.BlockDescriptor attribute) (flow.record.base.Record attribute) (flow.record.fieldtypes.Record attribute) (flow.record.fieldtypes.string attribute) (flow.record.Record attribute) (flow.record.selector.WrappedRecord attribute) __static_sizes__ (dissect.cstruct.types.structure.StructureMetaType attribute) __str__() (acquire.acquire.dynamic.windows.types.UNICODE_STRING method) (dissect.cim.classes.InstanceKey method) (dissect.cim.index.Key method) (dissect.cstruct.Flag method) (dissect.cstruct.Pointer method) (dissect.cstruct.types.Flag method) (dissect.cstruct.types.flag.Flag method) (dissect.cstruct.types.Pointer method) (dissect.cstruct.types.pointer.Pointer method) (dissect.database.ese.Record method) (dissect.database.ese.record.Record method) (dissect.eventlog.bxml.BxmlSub method) (dissect.eventlog.bxml.BxmlTag method) (dissect.eventlog.bxml.BxmlType method) (dissect.eventlog.bxml.Template method) (dissect.hypervisor.disk.vmdk.DiskDescriptor method) (dissect.hypervisor.disk.vmdk.ExtentDescriptor method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystems.nfs.AuthFlavorNotSupported method) (dissect.target.helpers.nfs.client.mount.MountError method) (dissect.target.helpers.nfs.client.nfs.NfsError method) (flow.record.fieldtypes.boolean method) (flow.record.fieldtypes.datetime method) (flow.record.fieldtypes.net.ip.ipaddress method) (flow.record.fieldtypes.net.ip.ipinterface method) (flow.record.fieldtypes.net.ip.ipnetwork method) (flow.record.fieldtypes.net.ipaddress method) (flow.record.fieldtypes.net.ipinterface method) (flow.record.fieldtypes.net.ipnetwork method) (flow.record.fieldtypes.net.ipv4.address method) (flow.record.fieldtypes.net.ipv4.subnet method) (flow.record.fieldtypes.path method) (flow.record.selector.CompiledSelector method) (flow.record.selector.Selector method) (flow.record.selector.WrappedRecord method) __struct__ (dissect.apfs.objects.base.Object attribute) (dissect.apfs.objects.btree_node.BTreeNode attribute) (dissect.apfs.objects.BTreeNode attribute) (dissect.apfs.objects.checkpoint_map.CheckpointMap attribute) (dissect.apfs.objects.CheckpointMap attribute) (dissect.apfs.objects.efi_jumpstart.EfiJumpstart attribute) (dissect.apfs.objects.EfiJumpstart attribute) (dissect.apfs.objects.EncryptionRollingRecoveryBlock attribute) (dissect.apfs.objects.EncryptionRollingState attribute) (dissect.apfs.objects.er_recovery_block.EncryptionRollingRecoveryBlock attribute) (dissect.apfs.objects.er_state.EncryptionRollingState attribute) (dissect.apfs.objects.FS attribute) (dissect.apfs.objects.fs.FS attribute) (dissect.apfs.objects.GBitmap attribute) (dissect.apfs.objects.gbitmap.GBitmap attribute) (dissect.apfs.objects.gbitmap_block.GBitmapBlock attribute) (dissect.apfs.objects.GBitmapBlock attribute) (dissect.apfs.objects.integrity_meta.IntegrityMeta attribute) (dissect.apfs.objects.IntegrityMeta attribute) (dissect.apfs.objects.keybag.Keybag attribute) (dissect.apfs.objects.nx_fusion_wbc.NxFusionWbc attribute) (dissect.apfs.objects.nx_fusion_wbc_list.NxFusionWbcList attribute) (dissect.apfs.objects.nx_reap_list.NxReapList attribute) (dissect.apfs.objects.nx_reaper.NxReaper attribute) (dissect.apfs.objects.nx_superblock.NxSuperblock attribute) (dissect.apfs.objects.NxFusionWbc attribute) (dissect.apfs.objects.NxFusionWbcList attribute) (dissect.apfs.objects.NxReaper attribute) (dissect.apfs.objects.NxReapList attribute) (dissect.apfs.objects.NxSuperblock attribute) (dissect.apfs.objects.Object attribute) (dissect.apfs.objects.ObjectMap attribute) (dissect.apfs.objects.omap.ObjectMap attribute) (dissect.apfs.objects.snap_meta_ext.SnapMetaExt attribute) (dissect.apfs.objects.SnapMetaExt attribute) (dissect.apfs.objects.Spaceman attribute) (dissect.apfs.objects.spaceman.Spaceman attribute) (dissect.apfs.objects.spaceman_cab.SpacemanChunkInfoAddressBlock attribute) (dissect.apfs.objects.spaceman_cib.SpacemanChunkInfoBlock attribute) (dissect.apfs.objects.SpacemanChunkInfoAddressBlock attribute) (dissect.apfs.objects.SpacemanChunkInfoBlock attribute) (dissect.archive.vbk.DirItem attribute) (dissect.archive.vbk.FibBlockDescriptor attribute) (dissect.archive.vbk.FibBlockDescriptorV7 attribute) (dissect.archive.vbk.MetaItem attribute) (dissect.archive.vbk.MetaTableDescriptor attribute) (dissect.archive.vbk.StgBlockDescriptor attribute) (dissect.archive.vbk.StgBlockDescriptorV7 attribute) (dissect.fve.bde.information.AesCbc256HmacSha512EncryptedDatum attribute) (dissect.fve.bde.information.AesCcmEncryptedDatum attribute) (dissect.fve.bde.information.BackupInfoDatum attribute) (dissect.fve.bde.information.ConcatHashKeyDatum attribute) (dissect.fve.bde.information.Datum attribute) (dissect.fve.bde.information.ErrorLogDatum attribute) (dissect.fve.bde.information.ExternalInfoDatum attribute) (dissect.fve.bde.information.GuidDatum attribute) (dissect.fve.bde.information.KeyDatum attribute) (dissect.fve.bde.information.SimpleDatum attribute) (dissect.fve.bde.information.SimpleLargeDatum attribute) (dissect.fve.bde.information.StretchKeyDatum attribute) (dissect.fve.bde.information.TpmEncryptedBlobDatum attribute) (dissect.fve.bde.information.UpdateDatum attribute) (dissect.fve.bde.information.UseKeyDatum attribute) (dissect.fve.bde.information.VirtualizationInfoDatum attribute) (dissect.fve.bde.information.VmkInfoDatum attribute) (dissect.regf.regf.BigData attribute) (dissect.regf.regf.Cell attribute) (dissect.regf.regf.FastLeaf attribute) (dissect.regf.regf.HashLeaf attribute) (dissect.regf.regf.IndexLeaf attribute) (dissect.regf.regf.IndexRoot attribute) (dissect.regf.regf.KeyNode attribute) (dissect.regf.regf.KeySecurity attribute) (dissect.regf.regf.KeyValue attribute) __struct_v1__ (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) __struct_v2__ (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) __sub__() (dissect.cstruct.Pointer method) (dissect.cstruct.types.Pointer method) (dissect.cstruct.types.pointer.Pointer method) __subloaders__ (dissect.target.loaders.tar.TarLoader attribute) (dissect.target.loaders.zip.ZipLoader attribute) __target__ (dissect.cstruct.types.structure.UnionProxy attribute) __type__ (dissect.apfs.objects.base.Object attribute) (dissect.apfs.objects.BTree attribute) (dissect.apfs.objects.btree.BTree attribute) (dissect.apfs.objects.btree_node.BTreeNode attribute) (dissect.apfs.objects.BTreeNode attribute) (dissect.apfs.objects.checkpoint_map.CheckpointMap attribute) (dissect.apfs.objects.CheckpointMap attribute) (dissect.apfs.objects.efi_jumpstart.EfiJumpstart attribute) (dissect.apfs.objects.EfiJumpstart attribute) (dissect.apfs.objects.EncryptionRollingRecoveryBlock attribute) (dissect.apfs.objects.EncryptionRollingState attribute) (dissect.apfs.objects.er_recovery_block.EncryptionRollingRecoveryBlock attribute) (dissect.apfs.objects.er_state.EncryptionRollingState attribute) (dissect.apfs.objects.FS attribute) (dissect.apfs.objects.fs.FS attribute) (dissect.apfs.objects.GBitmap attribute) (dissect.apfs.objects.gbitmap.GBitmap attribute) (dissect.apfs.objects.gbitmap_block.GBitmapBlock attribute) (dissect.apfs.objects.GBitmapBlock attribute) (dissect.apfs.objects.integrity_meta.IntegrityMeta attribute) (dissect.apfs.objects.IntegrityMeta attribute) (dissect.apfs.objects.keybag.ContainerKeybag attribute) (dissect.apfs.objects.keybag.MediaKeybag attribute) (dissect.apfs.objects.keybag.VolumeKeybag attribute) (dissect.apfs.objects.nx_fusion_wbc.NxFusionWbc attribute) (dissect.apfs.objects.nx_fusion_wbc_list.NxFusionWbcList attribute) (dissect.apfs.objects.nx_reap_list.NxReapList attribute) (dissect.apfs.objects.nx_reaper.NxReaper attribute) (dissect.apfs.objects.nx_superblock.NxSuperblock attribute) (dissect.apfs.objects.NxFusionWbc attribute) (dissect.apfs.objects.NxFusionWbcList attribute) (dissect.apfs.objects.NxReaper attribute) (dissect.apfs.objects.NxReapList attribute) (dissect.apfs.objects.NxSuperblock attribute) (dissect.apfs.objects.Object attribute) (dissect.apfs.objects.ObjectMap attribute) (dissect.apfs.objects.omap.ObjectMap attribute) (dissect.apfs.objects.snap_meta_ext.SnapMetaExt attribute) (dissect.apfs.objects.SnapMetaExt attribute) (dissect.apfs.objects.Spaceman attribute) (dissect.apfs.objects.spaceman.Spaceman attribute) (dissect.apfs.objects.spaceman_bitmap.SpacemanBitmap attribute) (dissect.apfs.objects.spaceman_cab.SpacemanChunkInfoAddressBlock attribute) (dissect.apfs.objects.spaceman_cib.SpacemanChunkInfoBlock attribute) (dissect.apfs.objects.SpacemanBitmap attribute) (dissect.apfs.objects.SpacemanChunkInfoAddressBlock attribute) (dissect.apfs.objects.SpacemanChunkInfoBlock attribute) (dissect.target.container.Container attribute) (dissect.target.containers.asdf.AsdfContainer attribute) (dissect.target.containers.asif.AsifContainer attribute) (dissect.target.containers.ewf.EwfContainer attribute) (dissect.target.containers.fortifw.FortiFirmwareContainer attribute) (dissect.target.containers.hdd.HddContainer attribute) (dissect.target.containers.hds.HdsContainer attribute) (dissect.target.containers.qcow2.QCow2Container attribute) (dissect.target.containers.raw.RawContainer attribute) (dissect.target.containers.split.SplitContainer attribute) (dissect.target.containers.vdi.VdiContainer attribute) (dissect.target.containers.vhd.VhdContainer attribute) (dissect.target.containers.vhdx.VhdxContainer attribute) (dissect.target.containers.vmdk.VmdkContainer attribute) (dissect.target.filesystem.Filesystem attribute) (dissect.target.filesystem.LayerFilesystem attribute) (dissect.target.filesystem.RootFilesystem attribute) (dissect.target.filesystem.VirtualFilesystem attribute) (dissect.target.filesystems.ad1.AD1Filesystem attribute) (dissect.target.filesystems.btrfs.BtrfsFilesystem attribute) (dissect.target.filesystems.btrfs.BtrfsSubvolumeFilesystem attribute) (dissect.target.filesystems.cb.CbFilesystem attribute) (dissect.target.filesystems.config.ConfigurationFilesystem attribute) (dissect.target.filesystems.cpio.CpioFilesystem attribute) (dissect.target.filesystems.cramfs.CramfsFilesystem attribute) (dissect.target.filesystems.dir.DirectoryFilesystem attribute) (dissect.target.filesystems.exfat.ExfatFilesystem attribute) (dissect.target.filesystems.extfs.ExtFilesystem attribute) (dissect.target.filesystems.fat.FatFilesystem attribute) (dissect.target.filesystems.ffs.FfsFilesystem attribute) (dissect.target.filesystems.itunes.ITunesFilesystem attribute) (dissect.target.filesystems.jffs.JffsFilesystem attribute) (dissect.target.filesystems.nfs.NfsFilesystem attribute) (dissect.target.filesystems.ntfs.NtfsFilesystem attribute) (dissect.target.filesystems.overlay.Overlay2Filesystem attribute) (dissect.target.filesystems.overlay.OverlayFilesystem attribute) (dissect.target.filesystems.qnxfs.QnxFilesystem attribute) (dissect.target.filesystems.smb.SmbFilesystem attribute) (dissect.target.filesystems.squashfs.SquashFSFilesystem attribute) (dissect.target.filesystems.tar.TarFilesystem attribute) (dissect.target.filesystems.vbk.VbkFilesystem attribute) (dissect.target.filesystems.vmfs.VmfsFilesystem attribute) (dissect.target.filesystems.vmtar.VmtarFilesystem attribute) (dissect.target.filesystems.xfs.XfsFilesystem attribute) (dissect.target.filesystems.zip.ZipFilesystem attribute) (dissect.target.loaders.cellebrite.CellebriteFilesystem attribute) (dissect.target.plugin.ChildTargetPlugin attribute) (dissect.target.plugins.child.colima.ColimaChildTargetPlugin attribute) (dissect.target.plugins.child.docker.DockerChildTargetPlugin attribute) (dissect.target.plugins.child.esxi.ESXiChildTargetPlugin attribute) (dissect.target.plugins.child.hyperv.HyperVChildTargetPlugin attribute) (dissect.target.plugins.child.lima.LimaChildTargetPlugin attribute) (dissect.target.plugins.child.parallels.ParallelsChildTargetPlugin attribute) (dissect.target.plugins.child.podman.PodmanChildTargetPlugin attribute) (dissect.target.plugins.child.proxmox.ProxmoxChildTargetPlugin attribute) (dissect.target.plugins.child.qemu.QemuChildTargetPlugin attribute) (dissect.target.plugins.child.virtualbox.VirtualBoxChildTargetPlugin attribute) (dissect.target.plugins.child.virtuozzo.VirtuozzoChildTargetPlugin attribute) (dissect.target.plugins.child.vmware_workstation.VmwareWorkstationChildTargetPlugin attribute) (dissect.target.plugins.child.wsl.WSLChildTargetPlugin attribute) (dissect.target.volume.VolumeSystem attribute) (dissect.target.volumes.bde.BitlockerVolumeSystem attribute) (dissect.target.volumes.ddf.DdfVolumeSystem attribute) (dissect.target.volumes.disk.DissectVolumeSystem attribute) (dissect.target.volumes.luks.LUKSVolumeSystem attribute) (dissect.target.volumes.lvm.LvmVolumeSystem attribute) (dissect.target.volumes.md.MdVolumeSystem attribute) (dissect.target.volumes.vmfs.VmfsVolumeSystem attribute) (dissect.vmfs.address.Address attribute) (dissect.vmfs.address.FileBlockAddr attribute) (dissect.vmfs.address.FileDescriptorAddr attribute) (dissect.vmfs.address.JournalBlockAddr attribute) (dissect.vmfs.address.LargeFileBlockAddr attribute) (dissect.vmfs.address.PointerBlock2Addr attribute) (dissect.vmfs.address.PointerBlock2Addr64 attribute) (dissect.vmfs.address.PointerBlockAddr attribute) (dissect.vmfs.address.PointerBlockAddr64 attribute) (dissect.vmfs.address.SmallFileBlockAddr attribute) (dissect.vmfs.address.SubBlockAddr attribute) (dissect.vmfs.address.SubBlockAddr64 attribute) (flow.record.fieldtypes.typedlist attribute) __union__ (dissect.cstruct.types.structure.UnionProxy attribute) __updating__ (dissect.cstruct.types.structure.StructureMetaType attribute) __usage__ (in module flow.record.adapter.archive) (in module flow.record.adapter.avro) (in module flow.record.adapter.broker) (in module flow.record.adapter.csvfile) (in module flow.record.adapter.duckdb) (in module flow.record.adapter.elastic) (in module flow.record.adapter.jsonfile) (in module flow.record.adapter.line) (in module flow.record.adapter.mongo) (in module flow.record.adapter.split) (in module flow.record.adapter.splunk) (in module flow.record.adapter.sqlite) (in module flow.record.adapter.stream) (in module flow.record.adapter.text) (in module flow.record.adapter.xlsx) __values__ (dissect.cstruct.Structure property) (dissect.cstruct.types.Structure property) (dissect.cstruct.types.structure.Structure property) __xor__() (dissect.cstruct.Pointer method) (dissect.cstruct.types.Pointer method) (dissect.cstruct.types.pointer.Pointer method) _current (dissect.target.helpers.configutil.ScopeManager attribute) _generate__bool__() (in module dissect.cstruct.types.structure) _generate__eq__() (in module dissect.cstruct.types.structure) _generate__hash__() (in module dissect.cstruct.types.structure) _generate_structure__init__() (in module dissect.cstruct.types.structure) _generate_union__init__() (in module dissect.cstruct.types.structure) _make__bool__() (in module dissect.cstruct.types.structure) _make__eq__() (in module dissect.cstruct.types.structure) _make__hash__() (in module dissect.cstruct.types.structure) _make_structure__init__() (in module dissect.cstruct.types.structure) _make_union__init__() (in module dissect.cstruct.types.structure) _parents (dissect.target.helpers.configutil.ScopeManager attribute) _previous (dissect.target.helpers.configutil.ScopeManager attribute) _public_member (in module codestyle) _read() (dissect.archive.vma.DeviceDataStream method) (dissect.archive.wim.CompressedStream method) (dissect.cramfs.BlockStream method) (dissect.cramfs.cramfs.BlockStream method) (dissect.evidence.ad1.FileObject method) (dissect.evidence.ewf.EWFStream method) (dissect.hypervisor.disk.vdi.VDI method) (dissect.hypervisor.disk.vhd.VHD method) (dissect.hypervisor.disk.vmdk.VMDK method) (dissect.ole.ole.ChainStream method) (dissect.target.filesystems.nfs.NfsStream method) (dissect.target.loaders.mqtt.MqttStream method) (dissect.target.loaders.remote.RemoteStream method) (dissect.util.stream.AlignedStream method) (dissect.volume.vss.StoreStream method) _root (dissect.target.helpers.configutil.ScopeManager attribute) _seek() (dissect.archive.vma.DeviceDataStream method) (dissect.archive.wim.CompressedStream method) (dissect.cramfs.BlockStream method) (dissect.cramfs.cramfs.BlockStream method) (dissect.evidence.ad1.FileObject method) (dissect.evidence.ewf.EWFStream method) (dissect.hypervisor.disk.vdi.VDI method) (dissect.hypervisor.disk.vhd.VHD method) (dissect.hypervisor.disk.vmdk.VMDK method) (dissect.ole.ole.ChainStream method) (dissect.target.filesystems.nfs.NfsStream method) (dissect.target.loaders.mqtt.MqttStream method) (dissect.target.loaders.remote.RemoteStream method) (dissect.util.stream.AlignedStream method) (dissect.volume.vss.StoreStream method) A A12MPPSWITCH (dissect.target.plugins.os.windows.network.IfTypes attribute) AAL2 (dissect.target.plugins.os.windows.network.IfTypes attribute) AAL5 (dissect.target.plugins.os.windows.network.IfTypes attribute) ab (dissect.target.loaders.ab.AndroidBackupLoader attribute) ABNORMAL_PROCESS_EXIT (dissect.target.plugins.os.windows.amcache.PcaGeneralDbType attribute) absolute (dissect.archive.wim.ReparsePoint property) (dissect.ntfs.attr.ReparsePoint property) absolute() (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) absolute_path (dissect.target.loader.Loader attribute) abspath() (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.polypath) AbstractClient (class in dissect.target.helpers.sunrpc.client) AbstractReader (class in flow.record.adapter) AbstractWriter (class in flow.record.adapter) accelerator (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) accelerator_table() (dissect.executable.pe.directory.resource.ResourceDirectory method) (dissect.executable.pe.directory.ResourceDirectory method) AcceptedReply (class in dissect.target.helpers.sunrpc.sunrpc) AcceptStat (class in dissect.target.helpers.sunrpc.sunrpc) access() (dissect.target.plugins.apps.webserver.apache.ApachePlugin method) (dissect.target.plugins.apps.webserver.caddy.CaddyPlugin method) (dissect.target.plugins.apps.webserver.iis.IISLogsPlugin method) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin method) access_id (acquire.acquire.uploaders.minio.MinIO attribute) access_key (acquire.acquire.uploaders.minio.MinIO attribute) ACCESS_LOG_NAMES (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) (dissect.target.plugins.apps.webserver.citrix.CitrixWebserverPlugin attribute) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin attribute) ACCESS_MASK (class in acquire.acquire.dynamic.windows.ntdll) (in module dissect.ntfs.c_ntfs) access_mode (dissect.hypervisor.disk.vmdk.ExtentDescriptor attribute) access_paths (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin attribute) access_time (dissect.target.plugins.os.windows.regf.shellbags.SHITEM property) AccessDeniedError account_policy() (dissect.target.plugins.os.unix.bsd.darwin.macos.user.UserPlugin method) AccountPolicyRecord (in module dissect.target.plugins.os.unix.bsd.darwin.macos.user) ACE (class in dissect.ntfs) (class in dissect.ntfs.secure) ace (dissect.ntfs.ACL attribute) (dissect.ntfs.secure.ACL attribute) ACE_OBJECT_FLAGS (in module dissect.ntfs.c_ntfs) ACE_TYPE (in module dissect.ntfs.c_ntfs) ack_pingpong (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) ack_threads (dissect.volume.lvm.metadata.VdoPoolSegment attribute) ACL (class in dissect.ntfs) (class in dissect.ntfs.secure) acmru() (dissect.target.plugins.os.windows.regf.mru.MRUPlugin method) ACMruRecord (in module dissect.target.plugins.os.windows.regf.mru) acquire.acquire module acquire.acquire.acquire module acquire.acquire.collector module acquire.acquire.crypt module acquire.acquire.dynamic module acquire.acquire.dynamic.windows module acquire.acquire.dynamic.windows.collect module acquire.acquire.dynamic.windows.exceptions module acquire.acquire.dynamic.windows.handles module acquire.acquire.dynamic.windows.named_objects module acquire.acquire.dynamic.windows.ntdll module acquire.acquire.dynamic.windows.types module acquire.acquire.esxi module acquire.acquire.gui module acquire.acquire.gui.base module acquire.acquire.gui.win32 module acquire.acquire.hashes module acquire.acquire.log module acquire.acquire.outputs module acquire.acquire.outputs.base module acquire.acquire.outputs.dir module acquire.acquire.outputs.tar module acquire.acquire.outputs.zip module acquire.acquire.tools module acquire.acquire.tools.decrypter module acquire.acquire.uploaders module acquire.acquire.uploaders.minio module acquire.acquire.uploaders.plugin module acquire.acquire.uploaders.plugin_registry module acquire.acquire.utils module acquire.acquire.volatilestream module ACQUIRE_BANNER (in module acquire.acquire.acquire) acquire_children_and_targets() (in module acquire.acquire.acquire) acquire_def (in module acquire.acquire.crypt) acquire_target() (in module acquire.acquire.acquire) AcquireHashRecord (in module dissect.target.plugins.apps.edr.acquire) AcquireOpenHandlesRecord (in module dissect.target.plugins.apps.edr.acquire) AcquirePlugin (class in dissect.target.plugins.apps.edr.acquire) AcquireTarSubLoader (class in dissect.target.loaders.acquire) AcquireZipSubLoader (class in dissect.target.loaders.acquire) ACTION (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) action (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) active_directory (dissect.hypervisor.disk.asif.ASIF attribute) active_header_offset (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) active_record (dissect.fve.bde.eow.EowBitmap property) active_slot (dissect.archive.vbk.VBK attribute) ActiveDirectory (class in acquire.acquire.acquire) ActiveScriptEventConsumerRecord (in module dissect.target.plugins.os.windows.cim) ActivitiesCache (class in acquire.acquire.acquire) activitiescache() (dissect.target.plugins.os.windows.activitiescache.ActivitiesCachePlugin method) ActivitiesCachePlugin (class in dissect.target.plugins.os.windows.activitiescache) ActivitiesCacheRecord (in module dissect.target.plugins.os.windows.activitiescache) activity() (dissect.target.plugins.os.unix.bsd.darwin.ios.generic.GenericPlugin method) (dissect.target.plugins.os.unix.generic.GenericPlugin method) (dissect.target.plugins.os.unix.linux.fortios.generic.GenericPlugin method) (dissect.target.plugins.os.windows.generic.GenericPlugin method) activity_id (dissect.etl.headers.event.EventHeader property) AD1 (class in dissect.evidence.ad1) ad1 (dissect.target.filesystems.ad1.AD1Filesystem attribute) ad1_def (in module dissect.evidence.ad1) AD1Filesystem (class in dissect.target.filesystems.ad1) AD1FilesystemEntry (class in dissect.target.filesystems.ad1) add() (dissect.btrfs.stream.ChunkStream method) (dissect.cstruct.parser.TokenCollection method) (dissect.ntfs.util.AttributeMap method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.helpers.regutil.HiveCollection method) (dissect.target.helpers.regutil.KeyCollection method) (dissect.target.helpers.regutil.ValueCollection method) (dissect.target.target.Collection method) (dissect.util.stream.MappingStream method) (dissect.util.stream.OverlayStream method) (dissect.volume.vss.BlockMap method) (flow.record.fieldtypes.net.ipv4.SubnetList method) add_attributes() (dissect.eventlog.bxml.BxmlTag method) add_bytes() (dissect.evidence.asdf.asdf.AsdfWriter method) (dissect.evidence.asdf.AsdfWriter method) add_child_template() (dissect.eventlog.bxml.Template method) add_children() (dissect.eventlog.bxml.BxmlTag method) add_command_collected() (acquire.acquire.collector.CollectionReport method) add_command_failed() (acquire.acquire.collector.CollectionReport method) add_custom_type() (dissect.cstruct.cstruct method) (dissect.cstruct.cstruct.cstruct method) add_dir_collected() (acquire.acquire.collector.CollectionReport method) add_dir_failed() (acquire.acquire.collector.CollectionReport method) add_dir_missing() (acquire.acquire.collector.CollectionReport method) add_field() (dissect.cstruct.types.structure.StructureMetaType method) add_file_collected() (acquire.acquire.collector.CollectionReport method) add_file_failed() (acquire.acquire.collector.CollectionReport method) add_file_missing() (acquire.acquire.collector.CollectionReport method) add_func_error() (dissect.target.tools.utils.report.TargetExecutionReport method) add_glob_empty() (acquire.acquire.collector.CollectionReport method) add_glob_failed() (acquire.acquire.collector.CollectionReport method) add_handler() (flow.record.utils.EventHandler method) add_hive() (dissect.target.plugins.os.windows.registry.RegistryPlugin method) ADD_IN_KEY (dissect.target.plugins.apps.productivity.msoffice.MSOffice attribute) add_incompatible_plugin() (dissect.target.tools.utils.report.TargetExecutionReport method) add_layer (dissect.target.filesystem.LayerFilesystem attribute) add_metadata_file() (dissect.evidence.asdf.asdf.AsdfWriter method) (dissect.evidence.asdf.AsdfWriter method) add_mounts() (dissect.target.plugins.os.windows._os.WindowsPlugin method) add_path_collected() (acquire.acquire.collector.CollectionReport method) add_path_failed() (acquire.acquire.collector.CollectionReport method) add_path_missing() (acquire.acquire.collector.CollectionReport method) add_plugin() (dissect.target.Target method) (dissect.target.target.Target method) add_registered_plugin() (dissect.target.tools.utils.report.TargetExecutionReport method) add_sub() (dissect.eventlog.bxml.Template method) add_subkey() (dissect.target.helpers.regutil.VirtualKey method) add_symlink_collected() (acquire.acquire.collector.CollectionReport method) add_symlink_failed() (acquire.acquire.collector.CollectionReport method) add_target_report() (dissect.target.tools.utils.report.ExecutionReport method) add_type() (dissect.cstruct.cstruct method) (dissect.cstruct.cstruct.cstruct method) add_value() (dissect.target.helpers.regutil.VirtualKey method) add_virtual_ntfs_filesystem() (in module dissect.target.helpers.loaderutil) additional_header_fields() (dissect.etl.headers.event.EventHeader method) (dissect.etl.headers.headers.ErrorHeader method) (dissect.etl.headers.headers.EventInstanceGUIDHeader method) (dissect.etl.headers.headers.EventInstanceHeader method) (dissect.etl.headers.headers.EventTraceHeader method) (dissect.etl.headers.headers.Header method) (dissect.etl.headers.headers.MessageTraceHeader method) (dissect.etl.headers.system.CompactSystemHeader method) (dissect.etl.headers.system.PerfinfoTraceHeader method) (dissect.etl.headers.system.SystemHeader method) Address (class in dissect.vmfs.address) address (class in flow.record.fieldtypes.net.ipv4) (dissect.apfs.objects.base.Object attribute) (dissect.apfs.objects.BTree attribute) (dissect.apfs.objects.btree.BTree attribute) (dissect.apfs.objects.Object attribute) (dissect.executable.pe.directory.base.DataDirectory attribute) (dissect.executable.pe.directory.DataDirectory attribute) (dissect.executable.pe.directory.delay_import.DelayImportFunction attribute) (dissect.executable.pe.directory.export.ExportFunction attribute) (dissect.executable.pe.directory.ImportFunction attribute) (dissect.executable.pe.directory.imports.ImportFunction attribute) (dissect.executable.pe.directory.resource.ResourceEntry attribute) (dissect.executable.pe.directory.ResourceEntry attribute) (dissect.vmfs.descriptor.DirEntry attribute) (dissect.vmfs.descriptor.FileDescriptor attribute) (dissect.vmfs.DirEntry attribute) (dissect.vmfs.FileDescriptor attribute) (dissect.vmfs.resource.ResourceFile attribute) Address (in module flow.record.fieldtypes.net.ipv4) address_fmt() (in module dissect.vmfs.address) address_thunk (dissect.executable.pe.directory.delay_import.DelayImportFunction attribute) (dissect.executable.pe.directory.ImportFunction attribute) (dissect.executable.pe.directory.imports.ImportFunction attribute) address_type() (in module dissect.vmfs.address) addtype (dissect.cstruct.cstruct attribute) (dissect.cstruct.cstruct.cstruct attribute) adpolicy() (dissect.target.plugins.os.windows.adpolicy.ADPolicyPlugin method) ADPolicyPlugin (class in dissect.target.plugins.os.windows.adpolicy) ADPolicyRecord (in module dissect.target.plugins.os.windows.adpolicy) ads (dissect.target.filesystems.ntfs.NtfsFilesystemEntry attribute) ADSL (dissect.target.plugins.os.windows.network.IfTypes attribute) adtev_def (in module dissect.target.plugins.os.windows.regf.auditpol) aes_ccm_encrypted_key() (dissect.fve.bde.information.VmkInfoDatum method) aes_decrypt() (in module dissect.target.loaders.itunes) (in module dissect.target.plugins.os.unix.linux.fortios._os) aes_unwrap() (in module dissect.apfs.objects.keybag) aes_unwrap_key() (in module dissect.target.loaders.itunes) AesCbc256HmacSha512EncryptedDatum (class in dissect.fve.bde.information) AesCcmEncryptedDatum (class in dissect.fve.bde.information) af (dissect.fve.luks.metadata.Keyslot attribute) AFLANE_8023 (dissect.target.plugins.os.windows.network.IfTypes attribute) AFLANE_8025 (dissect.target.plugins.os.windows.network.IfTypes attribute) ag (dissect.xfs.XFS attribute) (dissect.xfs.xfs.INode attribute) (dissect.xfs.xfs.XFS attribute) age (dissect.executable.pe.directory.debug.CodeViewDebugEntry property) AGGFRAG (dissect.target.helpers.network.IANAProtocol attribute) agi (dissect.xfs.xfs.AllocationGroup attribute) AH (dissect.target.helpers.network.IANAProtocol attribute) ALERT (dissect.target.plugins.os.unix.log.journal.JournalMessagePriority attribute) algorithm (dissect.volume.raid.stream.RAID456Stream attribute) alias (dissect.target.plugin.FunctionDescriptor attribute) alias() (in module dissect.target.plugin) align (dissect.cstruct.parser.TokenParser attribute) (dissect.util.stream.AlignedStream attribute) aligned_size (dissect.etl.etl.EventRecord property) AlignedStream (class in dissect.util.stream) alignment (dissect.cstruct.Field attribute) (dissect.cstruct.MetaType attribute) (dissect.cstruct.types.base.MetaType attribute) (dissect.cstruct.types.Field attribute) (dissect.cstruct.types.MetaType attribute) (dissect.cstruct.types.structure.Field attribute) (dissect.executable.elf.elf.Section attribute) (dissect.executable.elf.elf.Segment attribute) (dissect.executable.elf.Section attribute) (dissect.executable.elf.Segment attribute) ALIGNMENT (in module dissect.hypervisor.disk.c_vhdx) (in module dissect.target.helpers.sunrpc.serializer) all() (dissect.target.plugins.general.users.UsersPlugin method) all_home_paths (dissect.target.plugins.general.users.UsersPlugin property) all_with_home() (dissect.target.plugins.general.users.UsersPlugin method) alloc_bitmap (dissect.fat.ExFAT attribute) (dissect.fat.exfat.ExFAT attribute) allocated_size (dissect.archive.vbk.StgBlockDescriptor property) (dissect.ntfs.attr.AttributeHeader property) (dissect.ntfs.AttributeHeader property) allocation_policy (dissect.volume.lvm.metadata.LogicalVolume attribute) (dissect.volume.lvm.metadata.VolumeGroup attribute) AllocationGroup (class in dissect.xfs.xfs) allow_hard_terminate (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) allow_list (dissect.fve.bde.information.ValidationInfoDatum property) allow_start_on_demand (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) alnum() (dissect.cstruct.expression.ExpressionTokenizer method) ALPC_PORT (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) ALPCGuid (in module dissect.etl.utils) alpha() (dissect.cstruct.expression.ExpressionTokenizer method) alt_separator (dissect.target.filesystem.Filesystem attribute) (dissect.target.filesystem.LayerFilesystem property) (dissect.target.tools.diff.DifferentialCli attribute) ALTERNATE_DATA_STREAM (dissect.target.plugins.filesystem.ntfs.utils.InformationType attribute) alternateshell() (dissect.target.plugins.os.windows.generic.GenericPlugin method) AlternateShellRecord (in module dissect.target.plugins.os.windows.generic) amcache (dissect.target.plugins.os.windows.amcache.AmcachePlugin attribute) amcache_applaunch (dissect.target.plugins.os.windows.amcache.AmcachePlugin attribute) AMCACHE_FILE_KEYS (in module dissect.target.plugins.os.windows.amcache) amcache_install() (dissect.target.plugins.os.windows.log.amcache.AmcacheInstallPlugin method) AMCACHE_PROGRAM_KEYS (in module dissect.target.plugins.os.windows.amcache) AmcacheArpCreateRecord (in module dissect.target.plugins.os.windows.log.amcache) AmcacheFileCreateRecord (in module dissect.target.plugins.os.windows.log.amcache) AmcacheInstallPlugin (class in dissect.target.plugins.os.windows.log.amcache) AmcachePlugin (class in dissect.target.plugins.os.windows.amcache) AmcachePluginOldMixin (class in dissect.target.plugins.os.windows.amcache) AN (dissect.target.helpers.network.IANAProtocol attribute) anchor (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) AND (dissect.util.ldap.LogicalOperator attribute) ANDROID (dissect.target.plugin.OperatingSystem attribute) AndroidBackup (class in dissect.target.loaders.ab) AndroidBackupLoader (class in dissect.target.loaders.ab) AndroidPlugin (class in dissect.target.plugins.os.unix.linux.android._os) animated_cursor (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) animated_icon (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) ANON_FS_RE (in module dissect.target.loaders.acquire) ANSI_COLORS (in module dissect.target.tools.shell) AnsiColors (class in dissect.target.tools.shell) ANSITRING (dissect.eventlog.bxml.BxmlType attribute) ANY (dissect.target.helpers.sunrpc.client.LocalPortPolicy attribute) ANY_0_HOP_PROTOCOL (dissect.target.helpers.network.IANAProtocol attribute) ANY_DISTRIBUTED_FILE_SYSTEM (dissect.target.helpers.network.IANAProtocol attribute) ANY_HOST_INTERNAL_PROTOCOL (dissect.target.helpers.network.IANAProtocol attribute) ANY_LOCAL_NETWORK (dissect.target.helpers.network.IANAProtocol attribute) ANY_PRIVATE_ENCRYPTION_SCHEME (dissect.target.helpers.network.IANAProtocol attribute) AnydeskPlugin (class in dissect.target.plugins.apps.remoteaccess.anydesk) apache_response_time_to_ms() (in module dissect.target.plugins.apps.webserver.apache) ApachePlugin (class in dissect.target.plugins.apps.webserver.apache) APFS (class in dissect.apfs) (class in dissect.apfs.apfs) apfs_def (in module dissect.apfs.c_apfs) APM (class in dissect.volume.disk.schemes) (class in dissect.volume.disk.schemes.apm) apm (dissect.volume.disk.schemes.APM attribute) (dissect.volume.disk.schemes.apm.APM attribute) apm_def (in module dissect.volume.disk.schemes.apm) app_bound_key (dissect.target.plugins.apps.browser.chromium.ChromiumKeys attribute) APP_CONTEXT (in module flow.record.context) app_name (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) app_regf_keys (dissect.target.plugins.os.windows.cam.CamPlugin attribute) Appcompat (class in acquire.acquire.acquire) AppContext (class in flow.record.context) appdb() (dissect.target.plugins.os.windows.notifications.NotificationsPlugin method) appdb_def (in module dissect.target.plugins.os.windows.notifications) appdb_files (dissect.target.plugins.os.windows.notifications.NotificationsPlugin attribute) APPDB_MAGIC (in module dissect.target.plugins.os.windows.notifications) AppDBBadgeRecord (in module dissect.target.plugins.os.windows.notifications) AppDBPushRecord (in module dissect.target.plugins.os.windows.notifications) AppDBRecord (in module dissect.target.plugins.os.windows.notifications) AppDBTileRecord (in module dissect.target.plugins.os.windows.notifications) AppDBToastRecord (in module dissect.target.plugins.os.windows.notifications) append_fs_layer() (dissect.target.filesystem.LayerFilesystem method) append_layer() (dissect.target.filesystem.LayerFilesystem method) appinit() (dissect.target.plugins.os.windows.generic.GenericPlugin method) AppInitRecord (in module dissect.target.plugins.os.windows.generic) applaunches() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) application() (dissect.target.plugins.os.windows.sru.SRUPlugin method) application_data (dissect.ntfs.ACE attribute) (dissect.ntfs.secure.ACE attribute) application_files() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) APPLICATION_HOST_CONFIG (dissect.target.plugins.apps.webserver.iis.IISLogsPlugin attribute) APPLICATION_IDENTIFIERS (in module dissect.target.helpers.shell_application_ids) application_name (dissect.target.plugins.os.windows.jumplist.JumpListFile attribute) application_timeline() (dissect.target.plugins.os.windows.sru.SRUPlugin method) application_type (dissect.target.plugins.os.windows.jumplist.JumpListFile attribute) ApplicationAppcompatRecord (in module dissect.target.plugins.os.windows.amcache) ApplicationFileAppcompatRecord (in module dissect.target.plugins.os.windows.amcache) ApplicationRecord (in module dissect.target.plugins.os.windows.sru) Applications (class in acquire.acquire.acquire) applications() (dissect.target.plugins.os.unix.applications.UnixApplicationsPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios.applications.IOSApplicationsPlugin method) (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) (dissect.target.plugins.os.windows.regf.applications.WindowsApplicationsPlugin method) ApplicationTimelineRecord (in module dissect.target.plugins.os.windows.sru) apply() (dissect.target.Target method) (dissect.target.target.DiskCollection method) (dissect.target.target.FilesystemCollection method) (dissect.target.target.Target method) (dissect.target.target.VolumeCollection method) apply_fixup() (in module dissect.ntfs.util) APPROX (dissect.util.ldap.ComparisonOperator attribute) AppxDebugKeyRecord (in module dissect.target.plugins.os.windows.regf.appxdebugkeys) appxdebugkeys() (dissect.target.plugins.os.windows.regf.appxdebugkeys.AppxDebugKeysPlugin method) AppxDebugKeysPlugin (class in dissect.target.plugins.os.windows.regf.appxdebugkeys) APT_LOG_OPERATIONS (in module dissect.target.plugins.os.unix.linux.debian.apt) AptPlugin (class in dissect.target.plugins.os.unix.linux.debian.apt) ARABIC (dissect.database.ese.lcmapstring.SCRIPT attribute) ARAP (dissect.target.plugins.os.windows.network.IfTypes attribute) ARCH_MAP (in module dissect.target.plugins.os.unix._os) (in module dissect.target.plugins.os.unix.bsd.darwin._os) (in module dissect.target.plugins.os.windows._os) ArcHistoryRecord (in module dissect.target.plugins.apps.productivity.sevenzip) architecture() (dissect.target.plugin.OSPlugin method) (dissect.target.plugins.os.default._os.DefaultOSPlugin method) (dissect.target.plugins.os.unix._os.UnixPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSPlugin method) (dissect.target.plugins.os.windows._os.WindowsPlugin method) ArchiveReader (class in flow.record.adapter.archive) ArchiveWriter (class in flow.record.adapter.archive) ARCNET (dissect.target.plugins.os.windows.network.IfTypes attribute) ARCNET_PLUS (dissect.target.plugins.os.windows.network.IfTypes attribute) area (dissect.fve.luks.metadata.Keyslot attribute) aRepr (in module flow.record.stream) arg() (in module dissect.target.plugin) arg_str_to_arg_list() (in module dissect.target.tools.shell) args (dissect.target.plugin.FunctionDescriptor property) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) (flow.record.fieldtypes.command attribute) (flow.record.fieldtypes.uri property) args_to_uri() (in module dissect.target.tools.utils.cli) ARGUS (dissect.target.helpers.network.IANAProtocol attribute) ARIS (dissect.target.helpers.network.IANAProtocol attribute) Array (class in dissect.cstruct) (class in dissect.cstruct.types) (class in dissect.cstruct.types.base) ARRAY_MASK (dissect.eventlog.bxml.BxmlTemplateDescriptor attribute) ARRAY_STATES (in module dissect.cim.c_cim) ARRAY_TYPES (in module dissect.database.bsd.tools.rpm) ArraySizeError ArrayType (dissect.cstruct.Char attribute) (dissect.cstruct.MetaType attribute) (dissect.cstruct.types.base.MetaType attribute) (dissect.cstruct.types.Char attribute) (dissect.cstruct.types.char.Char attribute) (dissect.cstruct.types.MetaType attribute) (dissect.cstruct.types.Void attribute) (dissect.cstruct.types.void.Void attribute) (dissect.cstruct.types.Wchar attribute) (dissect.cstruct.types.wchar.Wchar attribute) (dissect.cstruct.Void attribute) (dissect.cstruct.Wchar attribute) artifact_type (acquire.acquire.collector.Record attribute) artifact_value (acquire.acquire.collector.Record attribute) artifacts (dissect.target.plugins.apps.shell.wget.WgetPlugin attribute) ArtifactType (class in acquire.acquire.collector) as_dict() (dissect.database.ese.Record method) (dissect.database.ese.record.Record method) (dissect.database.ese.record.RecordData method) (dissect.hypervisor.descriptor.hyperv.HyperVFile method) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry method) (dissect.target.filesystems.config.ConfigurationEntry method) (dissect.target.tools.shell.AnsiColors class method) (dissect.target.tools.utils.report.ExecutionReport method) (dissect.target.tools.utils.report.TargetExecutionReport method) as_full_map() (dissect.eventlog.bxml.Template method) as_hashlib_method() (acquire.acquire.hashes.HashFunc method) as_map() (dissect.eventlog.bxml.Template method) ASCII_MAP (in module dissect.target.plugins.apps.container.docker) asdf (dissect.evidence.asdf.asdf.AsdfStream attribute) (dissect.evidence.asdf.AsdfStream attribute) (dissect.evidence.AsdfStream attribute) (dissect.target.containers.asdf.AsdfContainer attribute) (dissect.target.loaders.asdf.AsdfLoader attribute) asdf_def (in module dissect.evidence.asdf.asdf) AsdfContainer (class in dissect.target.containers.asdf) AsdfLoader (class in dissect.target.loaders.asdf) AsdfSnapshot (class in dissect.evidence) (class in dissect.evidence.asdf) (class in dissect.evidence.asdf.asdf) AsdfStream (class in dissect.evidence) (class in dissect.evidence.asdf) (class in dissect.evidence.asdf.asdf) AsdfWriter (class in dissect.evidence.asdf) (class in dissect.evidence.asdf.asdf) ASIF (class in dissect.hypervisor.disk.asif) asif (dissect.hypervisor.disk.asif.DataStream attribute) (dissect.hypervisor.disk.asif.Directory attribute) (dissect.hypervisor.disk.asif.Table attribute) (dissect.target.containers.asif.AsifContainer attribute) asif_def (in module dissect.hypervisor.disk.c_asif) AsifContainer (class in dissect.target.containers.asif) AsnRecord (in module flow.record.tools.geoip) asnrecord_for_ip() (in module flow.record.tools.geoip) assemble_tiles_into_collage() (in module dissect.target.plugins.os.windows.rdpcache) AST_COMPARATORS (in module flow.record.selector) AST_OPERATORS (in module flow.record.selector) asymmetric_encrypted_key() (dissect.fve.bde.information.VmkInfoDatum method) AsymmetricEncryptedDatum (class in dissect.fve.bde.information) ASYNC (dissect.target.plugins.os.windows.network.IfTypes attribute) atime (dissect.apfs.objects.fs.INode property) (dissect.btrfs.btrfs.INode property) (dissect.btrfs.INode property) (dissect.extfs.extfs.INode property) (dissect.extfs.INode property) (dissect.fat.fat.DirectoryEntry property) (dissect.fat.fat.RootDirectory property) (dissect.ffs.ffs.INode property) (dissect.jffs.jffs2.INode property) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.QNX6 attribute) (dissect.qnxfs.qnx6.INode6 property) (dissect.qnxfs.qnx6.QNX6 attribute) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.vmfs.FileDescriptor property) (dissect.xfs.xfs.INode property) atime_ns (dissect.btrfs.btrfs.INode property) (dissect.btrfs.INode property) (dissect.extfs.extfs.INode property) (dissect.extfs.INode property) (dissect.ffs.ffs.INode property) (dissect.xfs.xfs.INode property) atjob_def (in module dissect.target.plugins.os.windows.tasks.job) ATM (dissect.target.plugins.os.windows.network.IfTypes attribute) ATM_DXI (dissect.target.plugins.os.windows.network.IfTypes attribute) ATM_FUNI (dissect.target.plugins.os.windows.network.IfTypes attribute) ATM_IMA (dissect.target.plugins.os.windows.network.IfTypes attribute) ATM_LOGICAL (dissect.target.plugins.os.windows.network.IfTypes attribute) ATM_RADIO (dissect.target.plugins.os.windows.network.IfTypes attribute) ATM_SUBINTERFACE (dissect.target.plugins.os.windows.network.IfTypes attribute) ATM_VCI_ENDPT (dissect.target.plugins.os.windows.network.IfTypes attribute) ATM_VIRTUAL (dissect.target.plugins.os.windows.network.IfTypes attribute) atop() (dissect.target.plugins.os.unix.log.atop.AtopPlugin method) atop_def (in module dissect.target.plugins.os.unix.log.atop) ATOP_GLOB (dissect.target.plugins.os.unix.log.atop.AtopPlugin attribute) ATOP_MAGIC (dissect.target.plugins.os.unix.log.atop.AtopPlugin attribute) ATOP_PATH (dissect.target.plugins.os.unix.log.atop.AtopPlugin attribute) atop_tstat_def (in module dissect.target.plugins.os.unix.log.atop) ATOP_VERSIONS (dissect.target.plugins.os.unix.log.atop.AtopPlugin attribute) AtopFile (class in dissect.target.plugins.os.unix.log.atop) AtopPlugin (class in dissect.target.plugins.os.unix.log.atop) AtopRecord (in module dissect.target.plugins.os.unix.log.atop) attach() (dissect.volume.lvm.metadata.VolumeGroup method) AtTask (class in dissect.target.plugins.os.windows.tasks.job) attr (dissect.hypervisor.descriptor.vmx.VMX attribute) (dissect.hypervisor.disk.vmdk.DiskDescriptor attribute) (dissect.ntfs.attr.FileName attribute) (dissect.ntfs.attr.ReparsePoint attribute) (dissect.ntfs.attr.StandardInformation attribute) attr() (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.MappedFile method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) attr_extents (dissect.xfs.xfs.INode property) attrfork() (dissect.xfs.xfs.INode method) Attribute (class in dissect.ntfs) (class in dissect.ntfs.attr) attribute (dissect.ntfs.attr.Attribute attribute) (dissect.ntfs.Attribute attribute) (dissect.ntfs.index.IndexEntry property) (dissect.ntfs.IndexEntry property) (dissect.util.ldap.SearchFilter attribute) ATTRIBUTE_CLASS_MAP (in module dissect.ntfs.attr) ATTRIBUTE_FLAG_COMPRESSION_MASK (in module dissect.ntfs.c_ntfs) ATTRIBUTE_FLAG_ENCRYPTED (in module dissect.ntfs.c_ntfs) ATTRIBUTE_FLAG_SPARSE (in module dissect.ntfs.c_ntfs) attribute_type (dissect.ntfs.index.IndexRoot property) ATTRIBUTE_TYPE_CODE (in module dissect.ntfs) (in module dissect.ntfs.c_ntfs) AttributeCollection (class in dissect.ntfs.util) AttributeHeader (class in dissect.ntfs) (class in dissect.ntfs.attr) AttributeList (class in dissect.ntfs.attr) AttributeMap (class in dissect.ntfs.util) AttributeRecord (class in dissect.ntfs) (class in dissect.ntfs.attr) attributes (dissect.eventlog.bxml.BxmlTag attribute) (dissect.hypervisor.util.envelope.Envelope attribute) (dissect.ntfs.mft.MftRecord property) (dissect.ntfs.MftRecord property) (dissect.target.helpers.nfs.nfs3.EntryPlus attribute) (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj attribute) (dissect.target.plugins.os.windows.everything.parser.Record attribute) attributes() (dissect.ntfs.attr.AttributeList method) attrsetter() (in module dissect.cstruct.types.structure) audit() (dissect.target.plugins.os.unix.log.audit.AuditPlugin method) AUDIT_REGEX (in module dissect.target.plugins.os.unix.log.audit) AuditPlugin (class in dissect.target.plugins.os.unix.log.audit) auditpol() (dissect.target.plugins.os.windows.regf.auditpol.AuditpolPlugin method) AuditPolicyRecord (in module dissect.target.plugins.os.windows.regf.auditpol) AuditpolPlugin (class in dissect.target.plugins.os.windows.regf.auditpol) AuditRecord (in module dissect.target.plugins.os.unix.log.audit) AUTH_BADCRED (dissect.target.helpers.sunrpc.sunrpc.AuthStat attribute) AUTH_BADVERF (dissect.target.helpers.sunrpc.sunrpc.AuthStat attribute) AUTH_DES (dissect.target.helpers.sunrpc.serializer.AuthFlavor attribute) AUTH_ERROR (dissect.target.helpers.sunrpc.sunrpc.RejectStat attribute) auth_flavors (dissect.target.helpers.nfs.nfs3.MountOK attribute) AUTH_NULL (dissect.target.helpers.sunrpc.serializer.AuthFlavor attribute) auth_null() (in module dissect.target.helpers.sunrpc.client) AUTH_REJECTEDCRED (dissect.target.helpers.sunrpc.sunrpc.AuthStat attribute) AUTH_REJECTEDVERF (dissect.target.helpers.sunrpc.sunrpc.AuthStat attribute) AUTH_SHORT (dissect.target.helpers.sunrpc.serializer.AuthFlavor attribute) AUTH_TOOWEAK (dissect.target.helpers.sunrpc.sunrpc.AuthStat attribute) AUTH_UNIX (dissect.target.helpers.sunrpc.serializer.AuthFlavor attribute) auth_unix() (in module dissect.target.helpers.sunrpc.client) AuthFlavor (class in dissect.target.helpers.sunrpc.serializer) AuthFlavorNotSupported authlog() (dissect.target.plugins.os.unix.log.auth.AuthPlugin method) AuthLogRecordBuilder (class in dissect.target.plugins.os.unix.log.auth) AuthNull (class in dissect.target.helpers.sunrpc.sunrpc) AuthNullSerializer (class in dissect.target.helpers.sunrpc.serializer) author (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) authorized_keys() (dissect.target.plugins.apps.ssh.openssh.OpenSSHPlugin method) AuthorizedKeysRecord (in module dissect.target.plugins.apps.ssh.ssh) AuthPlugin (class in dissect.target.plugins.os.unix.log.auth) AuthProtocol (in module dissect.target.helpers.sunrpc.serializer) AuthScheme (class in dissect.target.helpers.sunrpc.client) AuthSerializer (class in dissect.target.helpers.sunrpc.serializer) AuthSetter (in module dissect.target.filesystems.nfs) AuthStat (class in dissect.target.helpers.sunrpc.sunrpc) AuthUnix (class in dissect.target.helpers.sunrpc.sunrpc) AuthUnixSerializer (class in dissect.target.helpers.sunrpc.serializer) auto_backing_file (dissect.hypervisor.disk.qcow2.QCow2 attribute) auto_flush (flow.record.adapter.text.TextWriter attribute) (flow.record.stream.RecordPrinter attribute) auto_upload (acquire.acquire.gui.base.GUI attribute) autocommit_blocks (dissect.volume.lvm.metadata.WriteCacheSegment attribute) autocommit_time (dissect.volume.lvm.metadata.WriteCacheSegment attribute) automatic_destination() (dissect.target.plugins.os.windows.jumplist.JumpListPlugin method) automatic_destinations (dissect.target.plugins.os.windows.jumplist.JumpListPlugin attribute) AutomaticDestinationFile (class in dissect.target.plugins.os.windows.jumplist) Autostart (dissect.target.plugins.apps.productivity.msoffice.LoadBehavior attribute) AV (class in acquire.acquire.acquire) AV_ACTION_TAKEN (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_CLEANABLE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_COMPRESSED (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_CONFIDENCE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_DELETABLE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_DEPTH (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_DOWNLOADED_FROM (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_EVENT (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_EVENT_DATA (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_FILE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_PREVALENCE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_QUARANTINE_ID (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_QUARANTINE_STATUS (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_RISK (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_SCAN_ID (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_STILL_INFECTED (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_TIMESTAMP (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_USER (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_VIRUS (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_VIRUS_ID (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AV_VIRUS_TYPE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) AvailableLZ4 (class in dissect.squashfs.compression) AvailableLZO (class in dissect.squashfs.compression) AVRO_MAGIC (in module flow.record.base) AVRO_TYPE_MAP (in module flow.record.adapter.avro) avro_type_to_flow_type() (in module flow.record.adapter.avro) AvroReader (class in flow.record.adapter.avro) AvroWriter (class in flow.record.adapter.avro) AX_25 (dissect.target.helpers.network.IANAProtocol attribute) B ba_size (dissect.volume.lvm.metadata.PhysicalVolume attribute) ba_start (dissect.volume.lvm.metadata.PhysicalVolume attribute) backing_file (dissect.hypervisor.disk.qcow2.QCow2 attribute) backing_format (dissect.hypervisor.disk.qcow2.QCow2 attribute) backtrace() (flow.record.selector.SelectorResult method) backtrace_info (flow.record.selector.SelectorResult attribute) backup (dissect.target.filesystems.itunes.ITunesFilesystem attribute) (dissect.target.loaders.itunes.FileInfo attribute) (dissect.target.loaders.itunes.ITunesLoader attribute) BackupInfoDatum (class in dissect.fve.bde.information) BAD_CLUSTER (in module dissect.fat.c_fat) BadClusterError, [1] bag_def (in module dissect.target.plugins.os.windows.regf.shellbags) bagkeys (dissect.target.plugins.os.windows.regf.shellbags.ShellBagsPlugin attribute) bam() (dissect.target.plugins.os.windows.regf.bam.BamDamPlugin method) bam_def (in module dissect.target.plugins.os.windows.regf.bam) BamDamPlugin (class in dissect.target.plugins.os.windows.regf.bam) BamDamRecord (in module dissect.target.plugins.os.windows.regf.bam) Bank (class in dissect.archive.vbk) banks (dissect.archive.vbk.SnapshotSlot attribute) base (acquire.acquire.collector.Collector attribute) (dissect.executable.pe.directory.export.ExportDirectory property) (dissect.executable.pe.directory.ExportDirectory property) (dissect.target.filesystems.tar.TarFilesystem attribute) (dissect.target.filesystems.zip.ZipFilesystem attribute) base() (flow.record.base.RecordDescriptor method) (flow.record.RecordDescriptor method) BASE_KEY (dissect.target.plugins.apps.productivity.winrar.WinRarPlugin attribute) base_offset (dissect.evidence.ewf.TableSection attribute) base_path (dissect.target.filesystems.dir.DirectoryFilesystem attribute) (dissect.target.filesystems.overlay.Overlay2Filesystem attribute) (dissect.target.filesystems.overlay.OverlayFilesystem attribute) base_records() (dissect.clfs.blf.BLF method) base_relocations (dissect.executable.PE property) (dissect.executable.pe.PE property) (dissect.executable.pe.pe.PE property) base_use_data (dissect.target.plugins.os.windows.regf.cit.CIT attribute) BaseArray (class in dissect.cstruct.types) (class in dissect.cstruct.types.base) BaseLocatePlugin (class in dissect.target.plugins.os.unix.locate.locate) basename() (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.polypath) BaseRecord (class in dissect.clfs.blf) BaseRelocation (class in dissect.executable.pe.directory.basereloc) BaseRelocationDirectory (class in dissect.executable.pe.directory) (class in dissect.executable.pe.directory.basereloc) BaseService (class in dissect.target.plugins.os.unix.log.auth) BaseTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) BaseType (class in dissect.cstruct) (class in dissect.cstruct.types) (class in dissect.cstruct.types.base) BaseUseData (class in dissect.target.plugins.os.windows.regf.cit) BaseUseDataBitmaps (class in dissect.target.plugins.os.windows.regf.cit) BASIC_ISDN (dissect.target.plugins.os.windows.network.IfTypes attribute) BASIC_RECORD_FIELDS (in module dissect.target.plugins.apps.webserver.iis) BasicRecordDescriptor (in module dissect.target.plugins.apps.webserver.iis) bat (dissect.hypervisor.disk.hdd.HDS property) (dissect.hypervisor.disk.vhd.DynamicDisk attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) BAT_REGION_GUID (in module dissect.hypervisor.disk.c_vhdx) batch_size (flow.record.adapter.duckdb.DuckdbReader attribute) (flow.record.adapter.duckdb.DuckdbWriter attribute) (flow.record.adapter.sqlite.SqliteReader attribute) (flow.record.adapter.sqlite.SqliteWriter attribute) BBN_RCC_MON (dissect.target.helpers.network.IANAProtocol attribute) BDE (class in dissect.fve.bde) (class in dissect.fve.bde.bde) bde (dissect.fve.bde.bde.BitlockerStream attribute) (dissect.target.volumes.bde.BitlockerVolumeSystem attribute) (in module dissect.target.volume) bde_def (in module dissect.fve.bde.c_bde) be_hex_to_int() (in module dissect.target.plugins.os.unix.linux.network) BestEffortBlockStream (class in dissect.vmfs.descriptor) BFFCALLBACK (in module acquire.acquire.gui.win32) BGP_POLICY_ACCOUNTING (dissect.target.plugins.os.windows.network.IfTypes attribute) bias (dissect.target.plugins.os.windows.datetime.TimezoneInformation attribute) (dissect.target.plugins.os.windows.datetime.WindowsTimezone attribute) BigData (class in dissect.regf.regf) Bin (class in dissect.target.helpers.configutil) BIN_MAGIC (in module dissect.target.plugins.os.windows.rdpcache) BINARY (dissect.eventlog.bxml.BxmlType attribute) (dissect.target.helpers.regutil.RegistryValueType attribute) binary_operators (dissect.cstruct.Expression attribute) (dissect.cstruct.expression.Expression attribute) BinaryAppcompatRecord (in module dissect.target.plugins.os.windows.amcache) bind (dissect.executable.elf.elf.Symbol attribute) (dissect.executable.elf.Symbol attribute) bind() (acquire.acquire.collector.Collector method) bind_module() (acquire.acquire.collector.Collector method) BINXML (dissect.eventlog.bxml.BxmlType attribute) bio_rotation (dissect.volume.lvm.metadata.VdoPoolSegment attribute) bio_threads (dissect.volume.lvm.metadata.VdoPoolSegment attribute) BIT (dissect.util.ldap.ComparisonOperator attribute) BIT64_HEADERS (in module dissect.etl.headers.headers) BIT_EMU (dissect.target.helpers.network.IANAProtocol attribute) BitBuffer (class in dissect.cstruct) (class in dissect.cstruct.bitbuffer) BITLOCKER_SIGNATURE (in module dissect.fve.bde.c_bde) BITLOCKER_TO_GO_SIGNATURE (in module dissect.fve.bde.c_bde) BitlockerStream (class in dissect.fve.bde.bde) BitlockerVolumeSystem (class in dissect.target.volumes.bde) BitlockerVolumeSystemError bitmap (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) (dissect.fve.bde.eow.EowBitmapRecord property) (dissect.volume.vss.BlockDescriptor attribute) (dissect.volume.vss.Store property) bitmap() (dissect.hypervisor.disk.qcow2.L2Table method) bitmap_cache_def (in module dissect.target.plugins.os.windows.rdpcache) bitmap_def (in module dissect.target.plugins.os.windows.rdpcache) BITMAP_ENTRY (in module dissect.fat.c_exfat) BITMAP_FIELDS (in module dissect.target.plugins.os.windows.regf.cit) bitmap_flush_interval (dissect.volume.lvm.metadata.IntegritySegment attribute) bitmap_header (dissect.hypervisor.disk.qcow2.QCow2 attribute) bitmap_size (dissect.fve.bde.eow.EowBitmapRecord property) bitmaps (dissect.fve.bde.eow.EowInformation property) (dissect.target.plugins.os.windows.regf.cit.BaseUseData attribute) BitmapTile (class in dissect.target.plugins.os.windows.rdpcache) BITS (class in acquire.acquire.acquire) bits (dissect.cstruct.Field attribute) (dissect.cstruct.types.Field attribute) (dissect.cstruct.types.structure.Field attribute) (dissect.util.compression.lzxpress_huffman.BitString attribute) BitString (class in dissect.util.compression.lzxpress_huffman) BLACK (dissect.target.helpers.cyber.Color attribute) BLF (class in dissect.clfs.blf) BLF_PATH (dissect.target.plugins.os.windows.clfs.ClfsPlugin attribute) BLK (dissect.target.helpers.nfs.nfs3.FileType attribute) blkstofrags() (in module dissect.ffs.ffs) Blob (class in dissect.target.plugins.os.windows.dpapi.blob) blob (dissect.database.bsd.tools.rpm.Package attribute) (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) blob_data() (dissect.archive.vma.VMA method) blob_def (in module dissect.target.plugins.os.windows.dpapi.blob) blob_string() (dissect.archive.vma.VMA method) block (dissect.apfs.objects.base.Object attribute) (dissect.apfs.objects.BTree attribute) (dissect.apfs.objects.btree.BTree attribute) (dissect.apfs.objects.Object attribute) (dissect.extfs.journal.DescriptorBlockTag attribute) (dissect.ffs.ffs.CylinderGroup attribute) (dissect.squashfs.INode attribute) (dissect.squashfs.squashfs.INode attribute) (dissect.vmfs.address.FileBlockAddr property) (dissect.vmfs.address.LargeFileBlockAddr property) block_compress (dissect.evidence.asdf.asdf.AsdfWriter attribute) (dissect.evidence.asdf.AsdfWriter attribute) block_count (dissect.apfs.APFS property) (dissect.apfs.apfs.APFS property) (dissect.apfs.objects.nx_superblock.NxSuperblock property) (dissect.apfs.objects.NxSuperblock property) (dissect.extfs.ExtFS attribute) (dissect.extfs.extfs.ExtFS attribute) block_crc (dissect.evidence.asdf.asdf.AsdfWriter attribute) (dissect.evidence.asdf.AsdfWriter attribute) BLOCK_FLAG (in module dissect.volume.vss) block_id (dissect.archive.vbk.FibBlockDescriptor property) BLOCK_INDENT (in module dissect.target.tools.utils.report) block_length (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm attribute) (dissect.target.plugins.os.windows.dpapi.crypto.HashAlgorithm attribute) block_list (dissect.squashfs.INode property) (dissect.squashfs.squashfs.INode property) (dissect.volume.vss.Store property) block_log (dissect.squashfs.SquashFS attribute) (dissect.squashfs.squashfs.SquashFS attribute) BLOCK_MAGIC (in module dissect.evidence.asdf.asdf) block_map_cache_size_mb (dissect.volume.lvm.metadata.VdoPoolSegment attribute) block_map_era_length (dissect.volume.lvm.metadata.VdoPoolSegment attribute) block_size (dissect.apfs.APFS property) (dissect.apfs.apfs.APFS property) (dissect.apfs.objects.nx_superblock.NxSuperblock property) (dissect.apfs.objects.NxSuperblock property) (dissect.archive.vbk.FibBlockDescriptor property) (dissect.archive.vbk.MetaTableDescriptor property) (dissect.archive.vbk.VBK attribute) (dissect.extfs.ExtFS attribute) (dissect.extfs.extfs.ExtFS attribute) (dissect.extfs.JDB2 attribute) (dissect.extfs.journal.JDB2 attribute) (dissect.ffs.FFS attribute) (dissect.ffs.ffs.FFS attribute) (dissect.fve.crypto.base.Cipher attribute) (dissect.fve.crypto.Cipher attribute) (dissect.hypervisor.disk.asif.ASIF attribute) (dissect.hypervisor.disk.vdi.VDI attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) (dissect.ntfs.stream.CompressedRunlistStream attribute) (dissect.qnxfs.QNX4 attribute) (dissect.qnxfs.qnx4.QNX4 attribute) (dissect.qnxfs.QNX6 attribute) (dissect.qnxfs.qnx6.QNX6 attribute) (dissect.squashfs.SquashFS attribute) (dissect.squashfs.squashfs.SquashFS attribute) (dissect.util.stream.RunlistStream attribute) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.vmfs.FileDescriptor property) (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) (dissect.volume.ddf.ddf.PhysicalDiskRecord attribute) (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) (dissect.volume.dm.btree.BTree attribute) (dissect.volume.dm.thin.ThinDevice attribute) (dissect.volume.lvm.metadata.IntegritySegment attribute) (dissect.xfs.XFS attribute) (dissect.xfs.xfs.AllocationGroup attribute) (dissect.xfs.xfs.XFS attribute) BLOCK_SIZE (in module dissect.archive.xva) (in module dissect.eventlog.evt) (in module dissect.target.loaders.phobos) (in module dissect.target.tools.diff) (in module dissect.volume.vss) block_store (dissect.archive.vbk.VBK attribute) block_type (dissect.clfs.blf.BaseRecord attribute) BlockAllocationTable (class in dissect.hypervisor.disk.vhd) (class in dissect.hypervisor.disk.vhdx) BlockDescriptor (class in dissect.volume.vss) BLOCKED (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) BlockHeader (class in dissect.clfs.c_clfs) BlockList (class in dissect.volume.vss) BlockMap (class in dissect.volume.vss) blocks (dissect.archive.vma.Extent attribute) (dissect.cramfs.BlockStream attribute) (dissect.cramfs.cramfs.BlockStream attribute) (dissect.cramfs.cramfs.INode property) (dissect.cramfs.INode property) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.vmfs.FileDescriptor property) BlockStream (class in dissect.cramfs) (class in dissect.cramfs.cramfs) (class in dissect.vmfs.descriptor) BLUE (dissect.target.helpers.cyber.Color attribute) (dissect.target.tools.shell.AnsiColors attribute) BM_SETCHECK (in module acquire.acquire.gui.win32) BMAP (class in dissect.eventlog.wevt_object) BMP_DATA_OFFSET (in module dissect.target.plugins.os.windows.rdpcache) BMP_MAGIC (in module dissect.target.plugins.os.windows.rdpcache) BN_CLICKED (in module acquire.acquire.gui.win32) BNA (dissect.target.helpers.network.IANAProtocol attribute) body (dissect.target.helpers.sunrpc.sunrpc.Message attribute) body() (dissect.target.plugins.filesystem.ntfs.mft.MftPlugin method) BOLD_BLUE (dissect.target.tools.shell.AnsiColors attribute) BOLD_CYAN (dissect.target.tools.shell.AnsiColors attribute) BOLD_GREEN (dissect.target.tools.shell.AnsiColors attribute) BOLD_MAGENTA (dissect.target.tools.shell.AnsiColors attribute) BOLD_RED (dissect.target.tools.shell.AnsiColors attribute) BOLD_WHITE (dissect.target.tools.shell.AnsiColors attribute) BOLD_YELLOW (dissect.target.tools.shell.AnsiColors attribute) Bool (class in dissect.target.helpers.sunrpc.sunrpc) BOOL (dissect.eventlog.bxml.BxmlType attribute) boolean (class in flow.record.fieldtypes) boolean_argument() (in module flow.record.utils) boolean_field_names (dissect.target.plugins.apps.vpn.openvpn.OpenVPNParser attribute) BOOLEAN_STATES (in module dissect.cim.c_cim) Boot (class in acquire.acquire.acquire) boot() (dissect.target.plugins.os.windows.log.etl.EtlPlugin method) boot_sector (dissect.fve.bde.BDE attribute) (dissect.fve.bde.bde.BDE attribute) (dissect.fve.bde.bde.BootSector attribute) Bootbanks (class in acquire.acquire.acquire) BootSector (class in dissect.fve.bde.bde) bootshell() (dissect.target.plugins.os.windows.generic.GenericPlugin method) BootShellRecord (in module dissect.target.plugins.os.windows.generic) BootTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) BORDER_PIXEL (in module dissect.target.plugins.os.windows.rdpcache) BOTTOM (acquire.acquire.acquire.ExecutionOrder attribute) bound_address (dissect.executable.pe.directory.delay_import.DelayImportFunction attribute) bound_import (dissect.executable.PE property) (dissect.executable.pe.PE property) (dissect.executable.pe.pe.PE property) bound_module_name (acquire.acquire.collector.Collector attribute) BoundImportDirectory (class in dissect.executable.pe.directory) (class in dissect.executable.pe.directory.bound_import) BoundImportForwardReference (class in dissect.executable.pe.directory.bound_import) BoundImportModule (class in dissect.executable.pe.directory.bound_import) bpb (dissect.fat.fat.FATFS attribute) (dissect.fat.FATFS attribute) bPrefixData (in module dissect.database.ese.index) bPrefixNull (in module dissect.database.ese.index) bPrefixNullHigh (in module dissect.database.ese.index) bPrefixZeroLength (in module dissect.database.ese.index) BR_SAT_MON (dissect.target.helpers.network.IANAProtocol attribute) BranchNode (class in dissect.database.ese.page) BravePlugin (class in dissect.target.plugins.apps.browser.brave) BrokenIndexError BrokenMftError Broker (class in dissect.target.loaders.mqtt) broker (dissect.target.loaders.mqtt.MqttConnection attribute) (dissect.target.loaders.mqtt.MqttLoader attribute) broker_host (dissect.target.loaders.mqtt.Broker attribute) broker_port (dissect.target.loaders.mqtt.Broker attribute) BrokerReader (class in flow.record.adapter.broker) BrokerWriter (class in flow.record.adapter.broker) BROWSEINFOA (class in acquire.acquire.gui.win32) BROWSER_RECORD_MAP (in module dissect.target.plugins.os.windows.search) BrowserCookieRecord (dissect.target.plugins.apps.browser.brave.BravePlugin attribute) (dissect.target.plugins.apps.browser.chrome.ChromePlugin attribute) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin attribute) (dissect.target.plugins.apps.browser.edge.EdgePlugin attribute) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin attribute) (in module dissect.target.plugins.apps.browser.browser) BrowserDownloadRecord (dissect.target.plugins.apps.browser.brave.BravePlugin attribute) (dissect.target.plugins.apps.browser.chrome.ChromePlugin attribute) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin attribute) (dissect.target.plugins.apps.browser.edge.EdgePlugin attribute) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin attribute) (dissect.target.plugins.apps.browser.iexplore.InternetExplorerPlugin attribute) (in module dissect.target.plugins.apps.browser.browser) BrowserExtensionRecord (dissect.target.plugins.apps.browser.brave.BravePlugin attribute) (dissect.target.plugins.apps.browser.chrome.ChromePlugin attribute) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin attribute) (dissect.target.plugins.apps.browser.edge.EdgePlugin attribute) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin attribute) (in module dissect.target.plugins.apps.browser.browser) BrowserHistoryRecord (dissect.target.plugins.apps.browser.brave.BravePlugin attribute) (dissect.target.plugins.apps.browser.chrome.ChromePlugin attribute) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin attribute) (dissect.target.plugins.apps.browser.edge.EdgePlugin attribute) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin attribute) (dissect.target.plugins.apps.browser.iexplore.InternetExplorerPlugin attribute) (in module dissect.target.plugins.apps.browser.browser) BrowserPasswordRecord (dissect.target.plugins.apps.browser.brave.BravePlugin attribute) (dissect.target.plugins.apps.browser.chrome.ChromePlugin attribute) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin attribute) (dissect.target.plugins.apps.browser.edge.EdgePlugin attribute) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin attribute) (in module dissect.target.plugins.apps.browser.browser) BrowserPlugin (class in dissect.target.plugins.apps.browser.browser) BS_AUTOCHECKBOX (in module acquire.acquire.gui.win32) BS_CENTER (in module acquire.acquire.gui.win32) BS_CHECKBOX (in module acquire.acquire.gui.win32) BS_FLAT (in module acquire.acquire.gui.win32) BS_PUSHBUTTON (in module acquire.acquire.gui.win32) BS_TO_PAGE() (in module dissect.database.bsd.db) BSC (dissect.target.plugins.os.windows.network.IfTypes attribute) BSD (class in acquire.acquire.acquire) (class in dissect.volume.disk.schemes) (class in dissect.volume.disk.schemes.bsd) (dissect.target.plugin.OperatingSystem attribute) bsd_def (in module dissect.volume.disk.schemes.bsd) bsd_flags (dissect.apfs.objects.fs.INode property) BsdPlugin (class in dissect.target.plugins.os.unix.bsd._os) BsdProfile (class in acquire.acquire.acquire) bSentinel (in module dissect.database.ese.index) bsf() (in module dissect.ntfs.util) (in module dissect.vmfs.util) btime (dissect.apfs.objects.fs.INode property) (dissect.ffs.ffs.INode property) btime_ns (dissect.ffs.ffs.INode property) btmp() (dissect.target.plugins.os.unix.log.utmp.UtmpPlugin method) btmp_paths (dissect.target.plugins.os.unix.log.utmp.UtmpPlugin attribute) BtmpRecord (in module dissect.target.plugins.os.unix.log.utmp) BTree (class in dissect.apfs.objects) (class in dissect.apfs.objects.btree) (class in dissect.btrfs.tree) (class in dissect.database.ese.btree) (class in dissect.volume.dm.btree) btree (dissect.apfs.cursor.Cursor attribute) (dissect.apfs.objects.ObjectMap property) (dissect.apfs.objects.omap.ObjectMap property) (dissect.btrfs.tree.Cursor attribute) BTreeNode (class in dissect.apfs.objects) (class in dissect.apfs.objects.btree_node) Btrfs (class in dissect.btrfs) (class in dissect.btrfs.btrfs) btrfs (dissect.btrfs.btrfs.INode attribute) (dissect.btrfs.btrfs.Subvolume attribute) (dissect.btrfs.INode attribute) (dissect.btrfs.stream.ChunkStream attribute) (dissect.btrfs.Subvolume attribute) (dissect.btrfs.tree.BTree attribute) (dissect.target.filesystems.btrfs.BtrfsFilesystem attribute) (dissect.target.filesystems.btrfs.BtrfsSubvolumeFilesystem attribute) BTRFS_BLOCK_GROUP (in module dissect.btrfs.c_btrfs) BTRFS_BLOCK_GROUP_PROFILE_MASK (in module dissect.btrfs.c_btrfs) BTRFS_BLOCK_GROUP_RAID1_MASK (in module dissect.btrfs.c_btrfs) BTRFS_BLOCK_GROUP_RAID56_MASK (in module dissect.btrfs.c_btrfs) BTRFS_BLOCK_GROUP_STRIPE_MASK (in module dissect.btrfs.c_btrfs) BTRFS_BLOCK_GROUP_TYPE_MASK (in module dissect.btrfs.c_btrfs) btrfs_def (in module dissect.btrfs.c_btrfs) BTRFS_RAID_ATTRIBUTES (in module dissect.btrfs.c_btrfs) BtrfsFilesystem (class in dissect.target.filesystems.btrfs) BtrfsFilesystemEntry (class in dissect.target.filesystems.btrfs) BtrfsSubvolumeFilesystem (class in dissect.target.filesystems.btrfs) bucket_name (acquire.acquire.uploaders.minio.MinIO attribute) BUCKET_TO_PAGE() (in module dissect.database.bsd.db) buf (dissect.archive.vbk.MetaItem attribute) (dissect.database.bsd.tools.rpm.HeaderBlob attribute) (dissect.database.ese.Page attribute) (dissect.database.ese.page.Page attribute) (dissect.ntfs.index.IndexEntry attribute) (dissect.ntfs.IndexEntry attribute) (dissect.target.loaders.res.UPR attribute) (dissect.target.plugins.os.unix.locate.plocate.PLocateFile attribute) (dissect.target.plugins.os.windows.regf.cit.CIT attribute) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK attribute) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM attribute) (dissect.volume.dm.btree.Node attribute) Buffer (class in dissect.etl) (class in dissect.etl.etl) buffer (dissect.ntfs.attr.ReparsePoint attribute) buffer() (dissect.etl.ETL method) (dissect.etl.etl.ETL method) buffer_header (dissect.etl.ETL attribute) (dissect.etl.etl.ETL attribute) buffer_sectors (dissect.volume.lvm.metadata.IntegritySegment attribute) buffer_size (dissect.etl.ETL attribute) (dissect.etl.etl.ETL attribute) BUFFER_SIZE (in module acquire.acquire.dynamic.windows.ntdll) (in module dissect.target.helpers.hashutil) BufferedStream (class in dissect.util.stream) BufferFlag (in module dissect.etl.c_etl) buffers (acquire.acquire.tools.decrypter.EncryptedFile attribute) buffers() (dissect.etl.ETL method) (dissect.etl.etl.ETL method) buffers_written (dissect.etl.headers.logfile.LogfileHeader property) BufferType (in module dissect.etl.c_etl) build() (dissect.target.plugins.apps.edr.velociraptor.VelociraptorRecordBuilder method) build_pipe() (in module dissect.target.tools.shell) build_pipe_stdout() (in module dissect.target.tools.shell) build_prop_paths (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin attribute) build_record() (dissect.target.plugins.os.unix.log.auth.AuthLogRecordBuilder method) (dissect.target.plugins.os.windows.search.SearchIndexPlugin method) BUILTIN_PROPERTIES (in module dissect.cim.c_cim) builtin_property_name (dissect.cim.classes.PropertyReference property) BUILTIN_QUALIFIERS (in module dissect.cim.c_cim) Bxml (class in dissect.eventlog.bxml) bxml (dissect.eventlog.bxml.BxmlNameReader attribute) BXML_ATTRIBUTE (dissect.eventlog.bxml.BxmlToken attribute) BXML_CLOSE_EMPTY_ELEMENT_TAG (dissect.eventlog.bxml.BxmlToken attribute) BXML_CLOSE_START_ELEMENT_TAG (dissect.eventlog.bxml.BxmlToken attribute) bxml_datastream (dissect.eventlog.bxml.BxmlNameReader attribute) bxml_def (in module dissect.eventlog.bxml) BXML_END (dissect.eventlog.bxml.BxmlToken attribute) BXML_END_ELEMENT (dissect.eventlog.bxml.BxmlToken attribute) BXML_FRAGMENT_HEADER (dissect.eventlog.bxml.BxmlToken attribute) BXML_START_ELEMENT (dissect.eventlog.bxml.BxmlToken attribute) bxml_stream (dissect.eventlog.bxml.Bxml attribute) bxml_struct (in module dissect.eventlog.bxml) BXML_TEMPLATE_INSTANCE (dissect.eventlog.bxml.BxmlToken attribute) BXML_TOKEN_CHAR_REFERENCE (dissect.eventlog.bxml.BxmlToken attribute) BXML_TOKEN_ENTITY_REFERENCE (dissect.eventlog.bxml.BxmlToken attribute) BXML_TOKEN_NORMAL_SUBSTITUTION (dissect.eventlog.bxml.BxmlToken attribute) BXML_TOKEN_OPTIONAL_SUBSTITUTION (dissect.eventlog.bxml.BxmlToken attribute) BXML_VALUE (dissect.eventlog.bxml.BxmlToken attribute) BxmlException, [1] BxmlNameReader (class in dissect.eventlog.bxml) BxmlSub (class in dissect.eventlog.bxml) BxmlTag (class in dissect.eventlog.bxml) BxmlTemplateDescriptor (class in dissect.eventlog.bxml) BxmlToken (class in dissect.eventlog.bxml) BxmlType (class in dissect.eventlog.bxml) by_name() (dissect.executable.elf.elf.SectionTable method) (dissect.executable.elf.SectionTable method) by_type() (dissect.executable.elf.elf.SectionTable method) (dissect.executable.elf.elf.SegmentTable method) (dissect.executable.elf.SectionTable method) (dissect.executable.elf.SegmentTable method) ByName (in module dissect.volume.vinum.vinum) bytes (class in flow.record.fieldtypes) (dissect.target.loaders.mqtt.MqttTransferRatePerSecond attribute) BYTES_IN_NUMBER (in module dissect.thumbcache.index) bytes_left() (in module dissect.etl.utils) bytes_per_index_buffer (dissect.ntfs.index.IndexRoot property) bytes_received (dissect.target.loaders.mqtt.Broker attribute) BytesDefaultEnum (class in dissect.volume.vinum.config) BZ2_MAGIC (in module flow.record.base) BZIP2 (dissect.target.tools.dump.Compression attribute) BZIP_HEADER (in module dissect.target.plugins.os.windows.everything.parser) C c_acquire (in module acquire.acquire.crypt) c_ad1 (in module dissect.evidence.ad1) c_adpolicy (in module dissect.target.plugins.os.windows.adpolicy) c_adtev (in module dissect.target.plugins.os.windows.regf.auditpol) c_apfs (in module dissect.apfs.c_apfs) c_apm (in module dissect.volume.disk.schemes.apm) c_appdb (in module dissect.target.plugins.os.windows.notifications) c_asdf (in module dissect.evidence.asdf.asdf) c_asif (in module dissect.hypervisor.disk.c_asif) c_atjob (in module dissect.target.plugins.os.windows.tasks.job) c_atop (in module dissect.target.plugins.os.unix.log.atop) c_bag (in module dissect.target.plugins.os.windows.regf.shellbags) c_bam (in module dissect.target.plugins.os.windows.regf.bam) c_bde (in module dissect.fve.bde.c_bde) c_bitmap_cache (in module dissect.target.plugins.os.windows.rdpcache) c_blob (in module dissect.target.plugins.os.windows.dpapi.blob) c_bmp (in module dissect.target.plugins.os.windows.rdpcache) c_bsd (in module dissect.volume.disk.schemes.bsd) c_btrfs (in module dissect.btrfs.c_btrfs) c_cim (in module dissect.cim.c_cim) c_cit (in module dissect.target.plugins.os.windows.regf.cit) c_clfs (in module dissect.clfs.c_clfs) c_common_elf (in module dissect.executable.elf.c_elf) c_cramfs (in module dissect.cramfs.c_cramfs) c_credhist (in module dissect.target.plugins.os.windows.credential.credhist) c_custom_destination (in module dissect.target.plugins.os.windows.jumplist) c_db (in module dissect.database.bsd.c_db) c_ddf (in module dissect.volume.ddf.c_ddf) c_def (in module dissect.hypervisor.util.envelope) c_defaultpassword (in module dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.lsa) c_defender (in module dissect.target.plugins.os.windows.defender.quarantine) c_dm (in module dissect.volume.dm.c_dm) c_elevation (in module dissect.target.plugins.apps.browser.chromium) c_elf (dissect.executable.ELF attribute) (dissect.executable.elf.ELF attribute) (dissect.executable.elf.elf.ELF attribute) (dissect.executable.elf.elf.Section attribute) (dissect.executable.elf.elf.SectionTable attribute) (dissect.executable.elf.elf.Segment attribute) (dissect.executable.elf.elf.SegmentTable attribute) (dissect.executable.elf.elf.Symbol attribute) (dissect.executable.elf.Section attribute) (dissect.executable.elf.SectionTable attribute) (dissect.executable.elf.Segment attribute) (dissect.executable.elf.SegmentTable attribute) (dissect.executable.elf.Symbol attribute) c_elf_32 (in module dissect.executable.elf.c_elf) c_elf_64 (in module dissect.executable.elf.c_elf) c_envelope (in module dissect.hypervisor.util.envelope) c_ese (in module dissect.database.ese.c_ese) c_etl (in module dissect.etl.c_etl) c_etl_global (in module dissect.etl.c_etl) c_evt (in module dissect.eventlog.evt) c_evtx (in module dissect.eventlog.evtx) c_ewf (in module dissect.evidence.ewf) c_exfat (in module dissect.fat.c_exfat) c_ext (in module dissect.extfs.c_ext) c_fat (in module dissect.fat.c_fat) c_ffs (in module dissect.ffs.c_ffs) c_filesystems (dissect.target.plugins.os.windows.everything.parser.EverythingDB attribute) c_gnulocate (in module dissect.target.plugins.os.unix.locate.gnulocate) c_gpt (in module dissect.volume.disk.schemes.gpt) c_hdd (in module dissect.hypervisor.disk.c_hdd) c_header (in module dissect.target.plugins.os.windows.everything.parser) c_header_def (in module dissect.target.plugins.os.windows.everything.parser) c_hyperv (in module dissect.hypervisor.descriptor.c_hyperv) c_jdb2 (in module dissect.extfs.c_jdb2) c_jffs2 (in module dissect.jffs.c_jffs2) c_journal (in module dissect.target.plugins.os.unix.log.journal) c_lastlog (in module dissect.target.plugins.os.unix.log.lastlog) c_ldm (in module dissect.volume.ldm) c_lnk (in module dissect.shellitem.lnk) (in module dissect.shellitem.lnk.c_lnk) c_local (in module dissect.target.plugins.apps.container.docker) c_logfile (dissect.etl.headers.logfile.LogfileHeader attribute) c_luks (in module dissect.fve.luks.c_luks) c_lvm (in module dissect.vmfs.c_lvm) (in module dissect.volume.lvm.c_lvm2) c_master_key (in module dissect.target.plugins.os.windows.dpapi.master_key) c_mbr (in module dissect.volume.disk.schemes.mbr) c_md (in module dissect.volume.md.c_md) c_mlocate (in module dissect.target.plugins.os.unix.locate.mlocate) c_ntfs (in module dissect.ntfs.c_ntfs) c_ole (in module dissect.ole.c_ole) c_parser (in module dissect.etl.manifest) c_pe (in module dissect.executable.pe.c_pe) c_pe_def (in module dissect.executable.pe.c_pe) c_pfwlog (in module dissect.target.plugins.apps.av.trendmicro) c_pid (in module dissect.target.plugins.os.windows.productkey) c_plocate (in module dissect.target.plugins.os.unix.locate.plocate) c_prefetch (in module dissect.target.plugins.os.windows.prefetch) c_qcow2 (in module dissect.hypervisor.disk.c_qcow2) c_qnx4 (in module dissect.qnxfs) (in module dissect.qnxfs.c_qnx4) c_qnx6 (in module dissect.qnxfs) (in module dissect.qnxfs.c_qnx6) c_qnx6_be (in module dissect.qnxfs) (in module dissect.qnxfs.c_qnx6) c_qnx6_le (in module dissect.qnxfs) (in module dissect.qnxfs.c_qnx6) c_recent_files (in module dissect.target.plugins.os.windows.regf.recentfilecache) c_record (dissect.clfs.blf.BLF attribute) c_recyclebin (in module dissect.target.plugins.os.windows.recyclebin) c_regf (in module dissect.regf.c_regf) c_rfc4716 (in module dissect.target.plugins.apps.ssh.ssh) c_rpm (in module dissect.database.bsd.tools.c_rpm) c_sam (in module dissect.target.plugins.os.windows.credential.sam) c_shim (in module dissect.target.plugins.os.windows.regf.shimcache) c_sqlite3 (in module dissect.database.sqlite3.c_sqlite3) c_squashfs (in module dissect.squashfs.c_squashfs) c_thumbcache (in module dissect.thumbcache.c_thumbcache) c_trustrecord (in module dissect.target.plugins.os.windows.regf.trusteddocs) c_tz (in module dissect.target.plugins.os.windows.datetime) c_userassist (in module dissect.target.plugins.os.windows.regf.userassist) c_utmp (in module dissect.target.plugins.os.unix.log.utmp) c_vbk (in module dissect.archive.c_vbk) c_vdi (in module dissect.hypervisor.disk.c_vdi) c_vhd (in module dissect.hypervisor.disk.c_vhd) c_vhdx (in module dissect.hypervisor.disk.c_vhdx) c_vinum (in module dissect.volume.vinum.c_vinum) c_vma (in module dissect.archive.c_vma) c_vmdk (in module dissect.hypervisor.disk.c_vmdk) c_vmfs (in module dissect.vmfs.c_vmfs) c_vss (in module dissect.volume.vss) c_wevt_headers (in module dissect.eventlog.wevt) c_wevt_objects (in module dissect.eventlog.wevt_object) c_wim (in module dissect.archive.c_wim) c_windowstab (in module dissect.target.plugins.apps.editor.windowsnotepad) c_xfs (in module dissect.xfs.c_xfs) cacert_file (dissect.target.loaders.mqtt.Broker attribute) Cache (class in dissect.target.helpers.cache) CACHE (in module dissect.etl.manifest) CACHE_FILENAME (dissect.target.plugins.apps.browser.iexplore.InternetExplorerPlugin attribute) cache_mode (dissect.volume.lvm.metadata.CachePoolSegment attribute) (dissect.volume.lvm.metadata.CacheSegment attribute) cache_offsets (dissect.thumbcache.index.IndexEntry property) (dissect.thumbcache.IndexEntry property) CACHE_PATH (dissect.target.plugins.os.windows.rdpcache.RdpCachePlugin attribute) cache_path() (dissect.target.helpers.cache.Cache method) cache_pool (dissect.volume.lvm.metadata.CacheSegment attribute) CACHE_SIZE (in module dissect.target.helpers.mount) cached_sink_writers() (in module dissect.target.tools.dump) cachefiles (dissect.target.plugins.os.windows.activitiescache.ActivitiesCachePlugin attribute) CachePoolSegment (class in dissect.volume.lvm.metadata) CacheSegment (class in dissect.volume.lvm.metadata) CacheWriter (class in dissect.target.helpers.cache) CaddyPlugin (class in dissect.target.plugins.apps.webserver.caddy) calc_descriptor_hash() (flow.record.base.RecordDescriptor static method) (flow.record.RecordDescriptor static method) calculate_counter_increment() (in module dissect.target.plugins.os.unix.linux.fortios._os) calculate_fingerprints() (in module dissect.target.plugins.apps.ssh.ssh) calculate_last_activity() (in module dissect.target.plugins.os.unix.generic) calculate_samkey() (dissect.target.plugins.os.windows.credential.sam.SamPlugin method) calculate_timestamp() (dissect.etl.ETL method) (dissect.etl.etl.ETL method) CalendarTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) CALL (dissect.target.helpers.sunrpc.serializer.MessageType attribute) call() (dissect.target.helpers.cache.Cache method) (dissect.target.helpers.sunrpc.client.AbstractClient method) (dissect.target.helpers.sunrpc.client.Client method) CALLBACK (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) callbacks (dissect.executable.pe.directory.tls.TlsDirectory property) (dissect.executable.pe.directory.TlsDirectory property) CallBody (class in dissect.target.helpers.sunrpc.sunrpc) camdb (dissect.target.plugins.os.windows.cam.CamPlugin attribute) camdb_path (dissect.target.plugins.os.windows.cam.CamPlugin attribute) CAMEL_CASE_PATTERNS (in module dissect.target.plugins.os.windows.wer) CamGlobalPromptHistoryRecord (in module dissect.target.plugins.os.windows.cam) CamHistory (class in acquire.acquire.acquire) CamIdentityRelationshipHistoryRecord (in module dissect.target.plugins.os.windows.cam) CamPlugin (class in dissect.target.plugins.os.windows.cam) CamRegistryRecord (in module dissect.target.plugins.os.windows.cam) CamUsageHistoryRecord (in module dissect.target.plugins.os.windows.cam) CAN_CYBER (in module dissect.target.helpers.cyber) CAP_AUDIT_CONTROL (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_AUDIT_READ (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_AUDIT_WRITE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_BLOCK_SUSPEND (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_BPF (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_CHECKPOINT_RESTORE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_CHOWN (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_DAC_OVERRIDE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_DAC_READ_SEARCH (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_DB_REG_PATH (dissect.target.plugins.os.windows.cam.CamPlugin attribute) CAP_FOWNER (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_FSETID (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_IPC_LOCK (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_IPC_OWNER (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_KILL (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_LEASE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_LINUX_IMMUTABLE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_MAC_ADMIN (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_MAC_OVERRIDE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_MKNOD (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_NET_ADMIN (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_NET_BIND_SERVICE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_NET_BROADCAST (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_NET_RAW (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_PERFMON (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SETFCAP (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SETGID (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SETPCAP (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SETUID (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_ADMIN (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_BOOT (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_CHROOT (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_MODULE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_NICE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_PACCT (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_PTRACE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_RAWIO (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_RESOURCE (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_TIME (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYS_TTY_CONFIG (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_SYSLOG (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) CAP_WAKE_ALARM (dissect.target.plugins.filesystem.unix.capability.Capabilities attribute) Capabilities (class in dissect.target.plugins.filesystem.unix.capability) capability_binaries() (dissect.target.plugins.filesystem.unix.capability.CapabilityPlugin method) CapabilityPlugin (class in dissect.target.plugins.filesystem.unix.capability) CapabilityRecord (in module dissect.target.plugins.filesystem.unix.capability) CASE (class in dissect.database.ese.lcmapstring) case (dissect.target.loaders.mqtt.Broker attribute) case() (in module dissect.target.loaders.mqtt) case_sensitive (dissect.target.filesystem.Filesystem attribute) (dissect.target.filesystem.LayerFilesystem property) cat() (in module dissect.target.tools.fs) Catalog (class in dissect.database.ese.table) (class in dissect.volume.vss) catalog (dissect.database.ESE attribute) (dissect.database.ese.ESE attribute) (dissect.database.ese.ese.ESE attribute) (dissect.volume.vss.Store attribute) (dissect.volume.vss.VSS attribute) CATALOG_BLOCK_SIZE (in module dissect.volume.vss) CATALOG_COLUMNS (dissect.database.ese.table.Catalog attribute) CATALOG_ENTRY_SIZE (in module dissect.volume.vss) catch_sigpipe() (in module dissect.target.tools.utils.cli) (in module flow.record.utils) catdb() (dissect.target.plugins.os.windows.catroot.CatrootPlugin method) CATEGORIES (dissect.target.plugins.os.windows.regf.shellbags.CONTROL_PANEL_CATEGORY attribute) catroot2_dir (dissect.target.plugins.os.windows.catroot.CatrootPlugin attribute) catroot_dir (dissect.target.plugins.os.windows.catroot.CatrootPlugin attribute) CatrootPlugin (class in dissect.target.plugins.os.windows.catroot) CatrootRecord (in module dissect.target.plugins.os.windows.catroot) CB_TIMEFORMAT (in module dissect.target.filesystems.cb) CbFilesystem (class in dissect.target.filesystems.cb) CbFilesystemEntry (class in dissect.target.filesystems.cb) CbLoader (class in dissect.target.loaders.cb) cbpath (dissect.target.filesystems.cb.CbFilesystemEntry attribute) CbRegistry (class in dissect.target.loaders.cb) CbRegistryHive (class in dissect.target.loaders.cb) CbRegistryKey (class in dissect.target.loaders.cb) CbRegistryValue (class in dissect.target.loaders.cb) CBT (dissect.target.helpers.network.IANAProtocol attribute) CcGuid (in module dissect.etl.utils) ccpp (dissect.executable.pe.directory.debug.VcFeatureDebugEntry property) CCTEMUL (dissect.target.plugins.os.windows.network.IfTypes attribute) cd (dissect.cim.cim.Class property) (dissect.cim.cim.Instance property) CD() (dissect.cim.index.Key method) CDBURN (class in dissect.target.plugins.os.windows.regf.shellbags) Cell (class in dissect.database.sqlite3.sqlite3) (class in dissect.regf.regf) cell (dissect.database.sqlite3.sqlite3.Page attribute) (dissect.regf.regf.Cell attribute) (dissect.regf.regf.RegistryHive attribute) (dissect.regf.RegistryHive attribute) cell_data() (dissect.regf.regf.RegistryHive method) (dissect.regf.RegistryHive method) cell_pointers (dissect.database.sqlite3.sqlite3.Page attribute) CellebriteFilesystem (class in dissect.target.loaders.cellebrite) CellebriteLoader (class in dissect.target.loaders.cellebrite) cells() (dissect.database.SQLite3 method) (dissect.database.sqlite3.SQLite3 method) (dissect.database.sqlite3.sqlite3.Page method) (dissect.database.sqlite3.sqlite3.SQLite3 method) CellType (in module dissect.regf.regf) Certificate (class in dissect.executable.pe.directory.security) certificate (dissect.executable.pe.directory.security.Certificate attribute) certificate_file (dissect.target.loaders.mqtt.Broker attribute) CertLog (class in dissect.database.ese.tools.certlog) CertLogValue (in module dissect.database.ese.tools.certlog) CES (dissect.target.plugins.os.windows.network.IfTypes attribute) CFTP (dissect.target.helpers.network.IANAProtocol attribute) cg (dissect.ffs.ffs.CylinderGroup attribute) (dissect.ffs.ffs.INode property) cgbase() (in module dissect.ffs.ffs) cgdata() (in module dissect.ffs.ffs) cgdmin() (in module dissect.ffs.ffs) cgimin() (in module dissect.ffs.ffs) cgmeta() (in module dissect.ffs.ffs) cgsblock() (in module dissect.ffs.ffs) cgstart() (in module dissect.ffs.ffs) cgtod() (in module dissect.ffs.ffs) chacha20_decrypt() (in module dissect.target.plugins.os.unix.linux.fortios._os) Chain (class in dissect.ole.ole) chain (dissect.ole.ole.Chain attribute) (dissect.ole.ole.ChainStream attribute) chain() (dissect.fat.fat.FAT method) (dissect.ole.OLE method) (dissect.ole.ole.OLE method) ChainStream (class in dissect.ole.ole) CHAN (class in dissect.eventlog.wevt_object) change_time (dissect.apfs.objects.fs.Snapshot property) channel (dissect.etl.headers.event.EventDescriptor attribute) CHANNEL (dissect.target.plugins.os.windows.network.IfTypes attribute) CHAOS (dissect.target.helpers.network.IANAProtocol attribute) Char (class in dissect.cstruct) (class in dissect.cstruct.types) (class in dissect.cstruct.types.char) CHAR_TRANSLATION (in module dissect.eventlog.wevtutil) CharArray (class in dissect.cstruct) (class in dissect.cstruct.types) (class in dissect.cstruct.types.char) ChatAttachmentRecord (in module dissect.target.plugins.apps.chat.chat) ChatMessageRecord (in module dissect.target.plugins.apps.chat.chat) ChatPlugin (class in dissect.target.plugins.apps.chat.chat) ChatRecord (in module dissect.target.plugins.apps.chat.chat) ChatUserRecord (in module dissect.target.plugins.apps.chat.chat) chdir() (dissect.target.tools.shell.RegistryCli method) (dissect.target.tools.shell.TargetCli method) check() (dissect.apfs.objects.nx_superblock.NxSuperblock method) (dissect.apfs.objects.NxSuperblock method) check_and_set_acquire_args() (in module acquire.acquire.utils) check_and_set_log_args() (in module acquire.acquire.utils) check_compatible() (dissect.target.loaders.cb.CbRegistry method) (dissect.target.loaders.smb.SmbRegistry method) (dissect.target.plugin.NamespacePlugin method) (dissect.target.plugin.OSPlugin method) (dissect.target.plugin.Plugin method) (dissect.target.plugins.apps.av.mcafee.McAfeePlugin method) (dissect.target.plugins.apps.av.sophos.SophosPlugin method) (dissect.target.plugins.apps.av.symantec.SymantecPlugin method) (dissect.target.plugins.apps.av.trendmicro.TrendMicroPlugin method) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin method) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin method) (dissect.target.plugins.apps.browser.iexplore.InternetExplorerPlugin method) (dissect.target.plugins.apps.chat.msn.MSNPlugin method) (dissect.target.plugins.apps.container.docker.DockerPlugin method) (dissect.target.plugins.apps.container.podman.PodmanPlugin method) (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadPlugin method) (dissect.target.plugins.apps.edr.acquire.AcquirePlugin method) (dissect.target.plugins.apps.edr.velociraptor.VelociraptorPlugin method) (dissect.target.plugins.apps.other.env.EnvironmentFilePlugin method) (dissect.target.plugins.apps.productivity.msoffice.MSOffice method) (dissect.target.plugins.apps.productivity.sevenzip.SevenZipPlugin method) (dissect.target.plugins.apps.productivity.winrar.WinRarPlugin method) (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin method) (dissect.target.plugins.apps.remoteaccess.rustdesk.RustdeskPlugin method) (dissect.target.plugins.apps.remoteaccess.splashtop.SplashtopPlugin method) (dissect.target.plugins.apps.remoteaccess.teamviewer.TeamViewerPlugin method) (dissect.target.plugins.apps.shell.powershell.PowerShellHistoryPlugin method) (dissect.target.plugins.apps.shell.wget.WgetPlugin method) (dissect.target.plugins.apps.ssh.openssh.OpenSSHPlugin method) (dissect.target.plugins.apps.ssh.opensshd.SSHServerPlugin method) (dissect.target.plugins.apps.ssh.putty.PuTTYPlugin method) (dissect.target.plugins.apps.virtualization.vmware_workstation.VmwareWorkstationPlugin method) (dissect.target.plugins.apps.vpn.openvpn.OpenVPNPlugin method) (dissect.target.plugins.apps.vpn.wireguard.WireGuardPlugin method) (dissect.target.plugins.apps.webhosting.cpanel.CPanelPlugin method) (dissect.target.plugins.apps.webserver.apache.ApachePlugin method) (dissect.target.plugins.apps.webserver.caddy.CaddyPlugin method) (dissect.target.plugins.apps.webserver.citrix.CitrixWebserverPlugin method) (dissect.target.plugins.apps.webserver.iis.IISLogsPlugin method) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin method) (dissect.target.plugins.child.colima.ColimaChildTargetPlugin method) (dissect.target.plugins.child.docker.DockerChildTargetPlugin method) (dissect.target.plugins.child.esxi.ESXiChildTargetPlugin method) (dissect.target.plugins.child.hyperv.HyperVChildTargetPlugin method) (dissect.target.plugins.child.lima.LimaChildTargetPlugin method) (dissect.target.plugins.child.parallels.ParallelsChildTargetPlugin method) (dissect.target.plugins.child.podman.PodmanChildTargetPlugin method) (dissect.target.plugins.child.proxmox.ProxmoxChildTargetPlugin method) (dissect.target.plugins.child.qemu.QemuChildTargetPlugin method) (dissect.target.plugins.child.virtualbox.VirtualBoxChildTargetPlugin method) (dissect.target.plugins.child.virtuozzo.VirtuozzoChildTargetPlugin method) (dissect.target.plugins.child.vmware_workstation.VmwareWorkstationChildTargetPlugin method) (dissect.target.plugins.child.wsl.WSLChildTargetPlugin method) (dissect.target.plugins.filesystem.icat.ICatPlugin method) (dissect.target.plugins.filesystem.ntfs.mft.MftPlugin method) (dissect.target.plugins.filesystem.ntfs.mft_timeline.MftTimelinePlugin method) (dissect.target.plugins.filesystem.ntfs.usnjrnl.UsnjrnlPlugin method) (dissect.target.plugins.filesystem.resolver.ResolverPlugin method) (dissect.target.plugins.filesystem.unix.capability.CapabilityPlugin method) (dissect.target.plugins.filesystem.unix.suid.SuidPlugin method) (dissect.target.plugins.filesystem.walkfs.WalkFsPlugin method) (dissect.target.plugins.filesystem.yara.YaraPlugin method) (dissect.target.plugins.general.config.ConfigurationTreePlugin method) (dissect.target.plugins.general.example.ExampleNamespacePlugin method) (dissect.target.plugins.general.example.ExamplePlugin method) (dissect.target.plugins.general.loaders.LoaderListPlugin method) (dissect.target.plugins.general.osinfo.OSInfoPlugin method) (dissect.target.plugins.general.plugins.PluginListPlugin method) (dissect.target.plugins.general.users.UsersPlugin method) (dissect.target.plugins.os.default.datetime.DateTimePlugin method) (dissect.target.plugins.os.default.locale.LocalePlugin method) (dissect.target.plugins.os.default.network.NetworkPlugin method) (dissect.target.plugins.os.unix.applications.UnixApplicationsPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios.applications.IOSApplicationsPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios.generic.GenericPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios.locale.LocalePlugin method) (dissect.target.plugins.os.unix.bsd.darwin.macos.user.UserPlugin method) (dissect.target.plugins.os.unix.cronjobs.CronjobPlugin method) (dissect.target.plugins.os.unix.datetime.UnixDateTimePlugin method) (dissect.target.plugins.os.unix.generic.GenericPlugin method) (dissect.target.plugins.os.unix.history.CommandHistoryPlugin method) (dissect.target.plugins.os.unix.linux.cmdline.CmdlinePlugin method) (dissect.target.plugins.os.unix.linux.debian.apt.AptPlugin method) (dissect.target.plugins.os.unix.linux.debian.dpkg.DpkgPlugin method) (dissect.target.plugins.os.unix.linux.debian.proxmox.vm.VirtualMachinePlugin method) (dissect.target.plugins.os.unix.linux.debian.snap.SnapPlugin method) (dissect.target.plugins.os.unix.linux.environ.EnvironPlugin method) (dissect.target.plugins.os.unix.linux.fortios.generic.GenericPlugin method) (dissect.target.plugins.os.unix.linux.fortios.locale.FortiOSLocalePlugin method) (dissect.target.plugins.os.unix.linux.iptables.IptablesSavePlugin method) (dissect.target.plugins.os.unix.linux.modules.ModulePlugin method) (dissect.target.plugins.os.unix.linux.netstat.NetstatPlugin method) (dissect.target.plugins.os.unix.linux.proc.ProcPlugin method) (dissect.target.plugins.os.unix.linux.processes.ProcProcesses method) (dissect.target.plugins.os.unix.linux.recentlyused.RecentlyUsedPlugin method) (dissect.target.plugins.os.unix.linux.redhat.yum.YumPlugin method) (dissect.target.plugins.os.unix.linux.services.ServicesPlugin method) (dissect.target.plugins.os.unix.linux.sockets.NetSocketPlugin method) (dissect.target.plugins.os.unix.linux.suse.zypper.ZypperPlugin method) (dissect.target.plugins.os.unix.locale.UnixLocalePlugin method) (dissect.target.plugins.os.unix.locate.gnulocate.GNULocatePlugin method) (dissect.target.plugins.os.unix.locate.mlocate.MLocatePlugin method) (dissect.target.plugins.os.unix.locate.plocate.PLocatePlugin method) (dissect.target.plugins.os.unix.log.atop.AtopPlugin method) (dissect.target.plugins.os.unix.log.audit.AuditPlugin method) (dissect.target.plugins.os.unix.log.auth.AuthPlugin method) (dissect.target.plugins.os.unix.log.journal.JournalPlugin method) (dissect.target.plugins.os.unix.log.lastlog.LastLogPlugin method) (dissect.target.plugins.os.unix.log.messages.MessagesPlugin method) (dissect.target.plugins.os.unix.log.utmp.UtmpPlugin method) (dissect.target.plugins.os.unix.shadow.ShadowPlugin method) (dissect.target.plugins.os.unix.trash.GnomeTrashPlugin method) (dissect.target.plugins.os.windows.activitiescache.ActivitiesCachePlugin method) (dissect.target.plugins.os.windows.adpolicy.ADPolicyPlugin method) (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) (dissect.target.plugins.os.windows.cam.CamPlugin method) (dissect.target.plugins.os.windows.catroot.CatrootPlugin method) (dissect.target.plugins.os.windows.cim.CimPlugin method) (dissect.target.plugins.os.windows.clfs.ClfsPlugin method) (dissect.target.plugins.os.windows.credential.credhist.CredHistPlugin method) (dissect.target.plugins.os.windows.credential.lsa.LSAPlugin method) (dissect.target.plugins.os.windows.credential.sam.SamPlugin method) (dissect.target.plugins.os.windows.datetime.WindowsDateTimePlugin method) (dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.credhist.CredHistKeyProviderPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.defaultpassword.DefaultPasswordKeyProvider method) (dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.lsa.LSADefaultPasswordKeyProviderPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.winlogon.WinlogonDefaultPasswordKeyProviderPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.empty.EmptyKeyProviderPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.keychain.KeychainKeyProviderPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.keyprovider.KeyProviderPlugin method) (dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin method) (dissect.target.plugins.os.windows.exchange.exchange.ExchangePlugin method) (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin method) (dissect.target.plugins.os.windows.generic.GenericPlugin method) (dissect.target.plugins.os.windows.jumplist.JumpListPlugin method) (dissect.target.plugins.os.windows.lnk.LnkPlugin method) (dissect.target.plugins.os.windows.locale.WindowsLocalePlugin method) (dissect.target.plugins.os.windows.log.amcache.AmcacheInstallPlugin method) (dissect.target.plugins.os.windows.log.etl.EtlPlugin method) (dissect.target.plugins.os.windows.log.evt.WindowsEventlogsMixin method) (dissect.target.plugins.os.windows.log.mssql.MssqlPlugin method) (dissect.target.plugins.os.windows.log.pfro.PfroPlugin method) (dissect.target.plugins.os.windows.log.schedlgu.SchedLgUPlugin method) (dissect.target.plugins.os.windows.notifications.NotificationsPlugin method) (dissect.target.plugins.os.windows.prefetch.PrefetchPlugin method) (dissect.target.plugins.os.windows.productkey.WindowsProductKeyPlugin method) (dissect.target.plugins.os.windows.rdpcache.RdpCachePlugin method) (dissect.target.plugins.os.windows.recyclebin.RecyclebinPlugin method) (dissect.target.plugins.os.windows.regf.applications.WindowsApplicationsPlugin method) (dissect.target.plugins.os.windows.regf.appxdebugkeys.AppxDebugKeysPlugin method) (dissect.target.plugins.os.windows.regf.auditpol.AuditpolPlugin method) (dissect.target.plugins.os.windows.regf.bam.BamDamPlugin method) (dissect.target.plugins.os.windows.regf.cit.CITPlugin method) (dissect.target.plugins.os.windows.regf.clsid.CLSIDPlugin method) (dissect.target.plugins.os.windows.regf.mru.MRUPlugin method) (dissect.target.plugins.os.windows.regf.muicache.MuiCachePlugin method) (dissect.target.plugins.os.windows.regf.nethist.NethistPlugin method) (dissect.target.plugins.os.windows.regf.recentfilecache.RecentFileCachePlugin method) (dissect.target.plugins.os.windows.regf.regf.RegfPlugin method) (dissect.target.plugins.os.windows.regf.runkeys.RunKeysPlugin method) (dissect.target.plugins.os.windows.regf.shellbags.ShellBagsPlugin method) (dissect.target.plugins.os.windows.regf.shimcache.ShimcachePlugin method) (dissect.target.plugins.os.windows.regf.trusteddocs.TrustedDocumentsPlugin method) (dissect.target.plugins.os.windows.regf.usb.UsbPlugin method) (dissect.target.plugins.os.windows.regf.userassist.UserAssistPlugin method) (dissect.target.plugins.os.windows.registry.RegistryPlugin method) (dissect.target.plugins.os.windows.search.SearchIndexPlugin method) (dissect.target.plugins.os.windows.services.ServicesPlugin method) (dissect.target.plugins.os.windows.sru.SRUPlugin method) (dissect.target.plugins.os.windows.startupinfo.StartupInfoPlugin method) (dissect.target.plugins.os.windows.syscache.SyscachePlugin method) (dissect.target.plugins.os.windows.thumbcache.ThumbcachePlugin method) (dissect.target.plugins.os.windows.ual.UalPlugin method) (dissect.target.plugins.os.windows.wer.WindowsErrorReportingPlugin method) (dissect.target.plugins.os.windows.wua_history.WuaHistoryPlugin method) (dissect.target.plugins.scrape.qfind.QFindPlugin method) (dissect.target.plugins.scrape.scrape.ScrapePlugin method) (dissect.target.tools.shell.ExtendedCmd static method) (dissect.target.tools.shell.RegistryCli static method) (dissect.target.tools.shell.UnixConfigTreeCli method) check_dir() (dissect.target.tools.shell.TargetCli method) check_existing() (in module acquire.acquire.tools.decrypter) check_file() (dissect.target.tools.shell.TargetCli method) check_integrity() (dissect.fve.bde.information.Information method) check_key() (dissect.target.tools.shell.RegistryCli method) check_path() (dissect.target.tools.shell.TargetCli method) check_recovery_password() (in module dissect.fve.bde.key) check_value() (dissect.target.tools.shell.RegistryCli method) checkbox (acquire.acquire.gui.win32.Win32 attribute) checkpoint_objects (dissect.apfs.objects.nx_superblock.NxSuperblock property) (dissect.apfs.objects.NxSuperblock property) CheckpointMap (class in dissect.apfs.objects) (class in dissect.apfs.objects.checkpoint_map) checkpoints() (dissect.database.sqlite3.sqlite3.WAL method) (dissect.database.sqlite3.WAL method) checksum (dissect.apfs.objects.base.Object property) (dissect.apfs.objects.Object property) (dissect.evidence.ewf.SectionDescriptor attribute) checksum_algorithm (dissect.fve.luks.LUKS attribute) (dissect.fve.luks.luks.LUKS attribute) checksum_endian (dissect.database.sqlite3.sqlite3.WAL attribute) (dissect.database.sqlite3.WAL attribute) checksum_xor() (in module dissect.database.ese.util) child (dissect.database.ese.page.BranchNode attribute) (dissect.ole.ole.DirectoryEntry property) child() (dissect.cim.index.IndexPage method) child_plugins() (in module dissect.target.plugin) child_templates (dissect.eventlog.bxml.Template attribute) children (dissect.eventlog.bxml.BxmlTag attribute) (dissect.evidence.ad1.FileEntry attribute) (dissect.evidence.ad1.LogicalImage attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry attribute) (dissect.util.compression.lzxpress_huffman.Node attribute) (dissect.util.ldap.SearchFilter attribute) children() (dissect.cim.index.IndexPage method) ChildTargetPlugin (class in dissect.target.plugin) ChildTargetRecord (in module dissect.target.helpers.record) chmod() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) choose_folder() (acquire.acquire.gui.win32.Win32 method) choose_folder_button (acquire.acquire.gui.win32.Win32 attribute) chpe (dissect.executable.pe.directory.load_config.LoadConfigDirectory property) (dissect.executable.pe.directory.LoadConfigDirectory property) CHR (dissect.target.helpers.nfs.nfs3.FileType attribute) ChromePlugin (class in dissect.target.plugins.apps.browser.chrome) CHROMIUM_DOWNLOAD_RECORD_FIELDS (in module dissect.target.plugins.apps.browser.chromium) ChromiumKeys (class in dissect.target.plugins.apps.browser.chromium) ChromiumMixin (class in dissect.target.plugins.apps.browser.chromium) ChromiumPlugin (class in dissect.target.plugins.apps.browser.chromium) Chunk (class in dissect.btrfs.stream) chunk_count (dissect.evidence.ewf.Segment attribute) (dissect.evidence.ewf.VolumeSection attribute) chunk_ratio (dissect.hypervisor.disk.vhdx.BlockAllocationTable attribute) chunk_size (dissect.archive.wim.CompressedStream attribute) (dissect.evidence.EWF attribute) (dissect.evidence.ewf.EWF attribute) (dissect.fve.bde.eow.EowInformation property) (dissect.hypervisor.disk.asif.ASIF attribute) CHUNK_SIZE (dissect.target.plugins.os.windows.log.evt.EvtPlugin attribute) (dissect.target.plugins.os.windows.log.evtx.EvtxPlugin attribute) chunk_size (dissect.volume.lvm.metadata.CachePoolSegment attribute) (dissect.volume.lvm.metadata.CacheSegment attribute) (dissect.volume.lvm.metadata.SnapshotSegment attribute) (dissect.volume.lvm.metadata.ThinPoolSegment attribute) CHUNK_SIZE (in module acquire.acquire.tools.decrypter) chunks (dissect.btrfs.stream.ChunkStream attribute) chunks() (acquire.acquire.tools.decrypter.EncryptedFile method) ChunkStream (class in dissect.btrfs.stream) ci (dissect.cim.cim.Instance property) (dissect.cim.cim.Namespace property) CI() (dissect.cim.index.Key method) CIM (class in dissect.cim) (class in dissect.cim.cim) cim (dissect.cim.cim.Class attribute) (dissect.cim.cim.Instance attribute) (dissect.cim.cim.Namespace attribute) (dissect.cim.classes.ClassDefinition attribute) (dissect.cim.classes.ClassInstance attribute) (dissect.cim.index.Key attribute) (dissect.cim.index.Store attribute) (dissect.cim.mappings.Mapping attribute) (dissect.cim.objects.Store attribute) cim_def (in module dissect.cim.c_cim) CIM_TYPES (in module dissect.cim.c_cim) CIM_TYPES_MAP (in module dissect.cim.c_cim) CimPlugin (class in dissect.target.plugins.os.windows.cim) CimType (in module dissect.cim.c_cim) cipher (acquire.acquire.tools.decrypter.EncryptedFile attribute) Cipher (class in dissect.fve.crypto) (class in dissect.fve.crypto.base) cipher (dissect.apfs.objects.base.Object attribute) (dissect.apfs.objects.BTree attribute) (dissect.apfs.objects.btree.BTree attribute) (dissect.apfs.objects.Object attribute) (dissect.fve.crypto.base.IV attribute) (dissect.fve.crypto.dmcrypt.CryptStream attribute) (dissect.hypervisor.descriptor.vmx.Phrase attribute) (dissect.target.filesystems.itunes.EncryptedFileStream attribute) cipher_alg (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry attribute) cipher_algorithm (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) CIPHER_ALGORITHMS (in module dissect.target.plugins.os.windows.dpapi.crypto) CIPHER_KEY_SIZES (in module dissect.hypervisor.descriptor.vmx) CIPHER_MAP (in module dissect.fve.bde.c_bde) cipher_mode (dissect.fve.luks.LUKS attribute) (dissect.fve.luks.luks.LUKS attribute) cipher_name (dissect.fve.luks.LUKS attribute) (dissect.fve.luks.luks.LUKS attribute) (dissect.hypervisor.util.envelope.Envelope attribute) cipher_offset (dissect.target.filesystems.itunes.EncryptedFileStream attribute) cipher_text (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) CipherAlgorithm (class in dissect.target.plugins.os.windows.dpapi.crypto) CipherStream (class in dissect.target.loaders.ab) CIT (class in dissect.target.plugins.os.windows.regf.cit) cit (dissect.target.plugins.os.windows.regf.cit.BaseUseData attribute) (dissect.target.plugins.os.windows.regf.cit.BaseUseDataBitmaps attribute) (dissect.target.plugins.os.windows.regf.cit.Entry attribute) cit() (dissect.target.plugins.os.windows.regf.cit.CITPlugin method) cit_def (in module dissect.target.plugins.os.windows.regf.cit) CITDPDurationRecord (in module dissect.target.plugins.os.windows.regf.cit) CITDPRecord (in module dissect.target.plugins.os.windows.regf.cit) CITModuleRecord (in module dissect.target.plugins.os.windows.regf.cit) CITPlugin (class in dissect.target.plugins.os.windows.regf.cit) CITPostUpdateUseInfoRecord (in module dissect.target.plugins.os.windows.regf.cit) CITProgramBitmapForegroundRecord (in module dissect.target.plugins.os.windows.regf.cit) CITProgramRecord (in module dissect.target.plugins.os.windows.regf.cit) CITRecords (in module dissect.target.plugins.os.windows.regf.cit) CITRIX (dissect.target.plugin.OperatingSystem attribute) CITRIX_NETSCALER_BASH_HISTORY_RE (in module dissect.target.plugins.os.unix.bsd.citrix.history) CitrixCommandHistoryPlugin (class in dissect.target.plugins.os.unix.bsd.citrix.history) CitrixPlugin (class in dissect.target.plugins.os.unix.bsd.citrix._os) CitrixWebserverPlugin (class in dissect.target.plugins.apps.webserver.citrix) CITSystemBitmapDisplayPowerRecord (in module dissect.target.plugins.os.windows.regf.cit) CITSystemBitmapDisplayRequestChangeRecord (in module dissect.target.plugins.os.windows.regf.cit) CITSystemBitmapForegroundRecord (in module dissect.target.plugins.os.windows.regf.cit) CITSystemBitmapInputRecord (in module dissect.target.plugins.os.windows.regf.cit) CITSystemBitmapInputTouchRecord (in module dissect.target.plugins.os.windows.regf.cit) CITSystemBitmapUnknownRecord (in module dissect.target.plugins.os.windows.regf.cit) CITSystemRecord (in module dissect.target.plugins.os.windows.regf.cit) CITTelemetryRecord (in module dissect.target.plugins.os.windows.regf.cit) CJK_FIRST (dissect.database.ese.lcmapstring.SCRIPT attribute) CJK_LAST (dissect.database.ese.lcmapstring.SCRIPT attribute) CKA_ID (in module dissect.target.plugins.apps.browser.firefox) Class (class in dissect.cim.cim) class_ (dissect.cim.cim.Instance attribute) (dissect.cim.cim.Property attribute) (dissect.cim.classes.ClassInstance attribute) (dissect.cim.utils.ObjectPath attribute) class_() (dissect.cim.cim.Namespace method) class_definition (dissect.cim.cim.Class attribute) (dissect.cim.cim.Instance attribute) CLASS_FMT (in module dissect.etl.manifest) class_instance (dissect.cim.cim.Instance attribute) (dissect.cim.cim.Namespace attribute) (dissect.cim.classes.ClassInstanceProperty attribute) class_name (dissect.cim.classes.ClassDefinition property) (dissect.cim.classes.ClassInstance property) (dissect.regf.regf.KeyNode attribute) (dissect.target.helpers.regutil.KeyCollection property) (dissect.target.helpers.regutil.RegfKey property) (dissect.target.helpers.regutil.RegistryKey property) (dissect.target.helpers.regutil.VirtualKey property) ClassDefinition (class in dissect.cim.classes) ClassDefinitionProperty (class in dissect.cim.classes) ClassDefinitionPropertyState (class in dissect.cim.c_cim) classes (dissect.cim.cim.Namespace property) CLASSES (in module dissect.util.plist) CLASSES_ROOTS (dissect.target.plugins.apps.productivity.msoffice.MSOffice attribute) classification (flow.record.adapter.broker.BrokerWriter attribute) CLASSIFICATION_MAP (in module dissect.target.plugins.os.windows.wua_history) ClassInstance (class in dissect.cim.classes) ClassInstanceProperty (class in dissect.cim.classes) ClassInstancePropertyState (class in dissect.cim.c_cim) ClassKey (class in dissect.target.loaders.itunes) clean() (dissect.target.helpers.configutil.ScopeManager method) clean_ips() (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager static method) clean_value() (in module dissect.target.plugins.apps.webserver.apache) CLEANABLE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) cleaner (dissect.volume.lvm.metadata.CacheSegment attribute) (dissect.volume.lvm.metadata.WriteCacheSegment attribute) clear_cache() (dissect.target.loaders.mqtt.Broker method) clear_key() (dissect.fve.bde.information.VmkInfoDatum method) clear_text (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) clfs() (dissect.target.plugins.os.windows.clfs.ClfsPlugin method) CLFS_CONTROL_RECORD_MAGIC_VALUE (in module dissect.clfs.c_clfs) clfs_def (in module dissect.clfs.c_clfs) ClfsPlugin (class in dissect.target.plugins.os.windows.clfs) ClfsRecord (in module dissect.target.plugins.os.windows.clfs) cli_args (dissect.target.tools.utils.report.ExecutionReport attribute) CLI_ARGS_MODULE (in module acquire.acquire.acquire) ClickOnceDeploymentManifestParser (class in dissect.target.plugins.apps.productivity.msoffice) ClickOnceDeploymentManifestParser.Assembly (class in dissect.target.plugins.apps.productivity.msoffice) Client (class in dissect.target.helpers.nfs.client.mount) (class in dissect.target.helpers.nfs.client.nfs) (class in dissect.target.helpers.sunrpc.client) client (flow.record.adapter.mongo.MongoReader attribute) (flow.record.adapter.mongo.MongoWriter attribute) client_access() (dissect.target.plugins.os.windows.ual.UalPlugin method) ClientAccessRecord (in module dissect.target.plugins.os.windows.ual) ClientFactory (in module dissect.target.filesystems.nfs) clipboard() (dissect.target.plugins.apps.virtualization.vmware_workstation.VmwareWorkstationPlugin method) clone_alias() (in module dissect.target.plugin) close (dissect.target.containers.raw.RawContainer attribute) CLOSE (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) close() (acquire.acquire.collector.Collector method) (acquire.acquire.crypt.EncryptedStream method) (acquire.acquire.log.DelayedFileHandler method) (acquire.acquire.outputs.base.Output method) (acquire.acquire.outputs.dir.DirectoryOutput method) (acquire.acquire.outputs.tar.TarOutput method) (acquire.acquire.outputs.zip.ZipOutput method) (dissect.database.ese.tools.impacket.ESENT_DB method) (dissect.evidence.asdf.asdf.AsdfWriter method) (dissect.evidence.asdf.AsdfWriter method) (dissect.evidence.asdf.streams.HashedStream method) (dissect.evidence.asdf.streams.SubStreamBase method) (dissect.evidence.tools.asdf.dd.Progress method) (dissect.target.container.Container method) (dissect.target.containers.asdf.AsdfContainer method) (dissect.target.containers.asif.AsifContainer method) (dissect.target.containers.ewf.EwfContainer method) (dissect.target.containers.fortifw.FortiFirmwareContainer method) (dissect.target.containers.hdd.HddContainer method) (dissect.target.containers.hds.HdsContainer method) (dissect.target.containers.qcow2.QCow2Container method) (dissect.target.containers.split.SplitContainer method) (dissect.target.containers.vdi.VdiContainer method) (dissect.target.containers.vhd.VhdContainer method) (dissect.target.containers.vhdx.VhdxContainer method) (dissect.target.containers.vmdk.VmdkContainer method) (dissect.target.filesystems.smb.SmbStream method) (dissect.target.helpers.cache.CacheWriter method) (dissect.target.helpers.cache.LineWriter method) (dissect.target.helpers.nfs.client.mount.Client method) (dissect.target.helpers.nfs.client.nfs.Client method) (dissect.target.helpers.sunrpc.client.AbstractClient method) (dissect.target.helpers.sunrpc.client.Client method) (dissect.target.loaders.remote.RemoteStreamConnection method) (dissect.target.tools.dump.JsonLinesWriter method) (dissect.util.stream.AlignedStream method) (dissect.vmfs.resource.ResourceManager method) (flow.record.adapter.AbstractReader method) (flow.record.adapter.AbstractWriter method) (flow.record.adapter.archive.ArchiveWriter method) (flow.record.adapter.avro.AvroReader method) (flow.record.adapter.avro.AvroWriter method) (flow.record.adapter.broker.BrokerReader method) (flow.record.adapter.broker.BrokerWriter method) (flow.record.adapter.csvfile.CsvfileReader method) (flow.record.adapter.csvfile.CsvfileWriter method) (flow.record.adapter.elastic.ElasticReader method) (flow.record.adapter.elastic.ElasticWriter method) (flow.record.adapter.jsonfile.JsonfileReader method) (flow.record.adapter.jsonfile.JsonfileWriter method) (flow.record.adapter.line.LineWriter method) (flow.record.adapter.mongo.MongoReader method) (flow.record.adapter.mongo.MongoWriter method) (flow.record.adapter.split.SplitWriter method) (flow.record.adapter.splunk.SplunkWriter method) (flow.record.adapter.sqlite.SqliteWriter method) (flow.record.adapter.stream.StreamReader method) (flow.record.adapter.stream.StreamWriter method) (flow.record.adapter.text.TextWriter method) (flow.record.adapter.xlsx.XlsxReader method) (flow.record.adapter.xlsx.XlsxWriter method) (flow.record.stream.PathTemplateWriter method) (flow.record.stream.RecordPrinter method) (flow.record.stream.RecordStreamReader method) (flow.record.stream.RecordStreamWriter method) close_handle() (in module acquire.acquire.dynamic.windows.ntdll) CLOSE_WAIT (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) closed (flow.record.stream.RecordStreamReader attribute) CloseHandle (in module acquire.acquire.dynamic.windows.ntdll) CLOSING (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) cls (dissect.target.plugin.FunctionDescriptor property) (dissect.target.plugin.PluginDescriptor property) clsid (dissect.shellitem.lnk.Lnk property) (dissect.shellitem.lnk.lnk.Lnk property) CLSIDPlugin (class in dissect.target.plugins.os.windows.regf.clsid) CLSIDRecord (in module dissect.target.plugins.os.windows.regf.clsid) CLSIDRecordDescriptor (in module dissect.target.plugins.os.windows.regf.clsid) cluster (dissect.fat.fat.DirectoryEntry property) (dissect.fat.fat.RootDirectory property) (dissect.target.filesystems.exfat.ExfatFilesystemEntry attribute) (dissect.vmfs.address.FileDescriptorAddr property) (dissect.vmfs.address.JournalBlockAddr property) (dissect.vmfs.address.PointerBlockAddr property) (dissect.vmfs.address.PointerBlockAddr64 property) (dissect.vmfs.address.SmallFileBlockAddr property) (dissect.vmfs.address.SubBlockAddr property) (dissect.vmfs.address.SubBlockAddr64 property) cluster_bits (dissect.hypervisor.disk.qcow2.QCow2 attribute) cluster_count (dissect.fat.ExFAT attribute) (dissect.fat.exfat.ExFAT attribute) cluster_heap_sector (dissect.fat.ExFAT attribute) (dissect.fat.exfat.ExFAT attribute) cluster_offset_mask (dissect.hypervisor.disk.qcow2.QCow2 attribute) cluster_size (dissect.fat.ExFAT attribute) (dissect.fat.exfat.ExFAT attribute) (dissect.fat.fat.FATFS attribute) (dissect.fat.FATFS attribute) (dissect.fve.bde.bde.BootSector attribute) (dissect.hypervisor.disk.hdd.HDS attribute) (dissect.hypervisor.disk.qcow2.QCow2 attribute) (dissect.ntfs.stream.CompressedRunlistStream attribute) (dissect.target.filesystems.exfat.ExfatFilesystem attribute) cluster_size_shift (dissect.ntfs.NTFS attribute) (dissect.ntfs.ntfs.NTFS attribute) cluster_to_sector() (dissect.fat.ExFAT method) (dissect.fat.exfat.ExFAT method) clusters_per_index_buffer (dissect.ntfs.index.IndexRoot property) cmd_attr() (dissect.target.tools.shell.TargetCli method) cmd_cat() (dissect.target.tools.diff.DifferentialCli method) (dissect.target.tools.shell.RegistryCli method) (dissect.target.tools.shell.TargetCli method) cmd_diff() (dissect.target.tools.diff.DifferentialCli method) cmd_enter() (dissect.target.tools.diff.DifferentialCli method) (dissect.target.tools.shell.TargetCli method) cmd_file() (dissect.target.tools.shell.TargetCli method) cmd_find() (dissect.target.tools.diff.DifferentialCli method) (dissect.target.tools.shell.TargetCli method) cmd_hash() (dissect.target.tools.shell.TargetCli method) cmd_hexdump() (dissect.target.tools.diff.DifferentialCli method) (dissect.target.tools.shell.RegistryCli method) (dissect.target.tools.shell.TargetCli method) cmd_less() (dissect.target.tools.shell.TargetCli method) cmd_ll() (dissect.target.tools.shell.TargetCli method) cmd_ls() (dissect.target.tools.diff.DifferentialCli method) (dissect.target.tools.shell.RegistryCli method) (dissect.target.tools.shell.TargetCli method) cmd_next() (dissect.target.tools.diff.DifferentialCli method) CMD_PREFIX (dissect.target.tools.shell.ExtendedCmd attribute) cmd_previous() (dissect.target.tools.diff.DifferentialCli method) cmd_readlink() (dissect.target.tools.shell.TargetCli method) cmd_registry() (dissect.target.tools.shell.TargetCli method) cmd_save() (dissect.target.tools.shell.TargetCli method) cmd_set() (dissect.target.tools.diff.DifferentialCli method) cmd_stat() (dissect.target.tools.shell.TargetCli method) cmd_tree() (dissect.target.tools.shell.TargetCli method) cmd_zcat() (dissect.target.tools.shell.TargetCli method) cmd_zless() (dissect.target.tools.shell.TargetCli method) cmdline (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) cmdline() (dissect.target.plugins.os.unix.linux.cmdline.CmdlinePlugin method) CmdlinePlugin (class in dissect.target.plugins.os.unix.linux.cmdline) CmdlineRecord (in module dissect.target.plugins.os.unix.linux.cmdline) cmp_default() (in module dissect.apfs.util) cmp_fext() (in module dissect.apfs.util) cmp_fs() (in module dissect.apfs.util) cmp_fs_dir() (in module dissect.apfs.util) cmp_fs_dir_hash() (in module dissect.apfs.util) cmp_fs_extent() (in module dissect.apfs.util) cmp_omap() (in module dissect.apfs.util) CNR (dissect.target.plugins.os.windows.network.IfTypes attribute) cobj (dissect.evidence.asdf.streams.CompressedStream attribute) cocoatimestamp() (in module dissect.util.ts) code (flow.record.selector.CompiledSelector attribute) code_page (dissect.executable.pe.directory.resource.ResourceDataEntry property) (dissect.executable.pe.directory.ResourceDataEntry property) codebase (dissect.target.plugins.apps.productivity.msoffice.ClickOnceDeploymentManifestParser.Assembly attribute) codec (flow.record.adapter.avro.AvroWriter attribute) codepage (dissect.target.plugins.apps.av.sophos.SophosPlugin attribute) (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) (dissect.target.plugins.apps.av.trendmicro.TrendMicroPlugin attribute) CODEPAGE (in module dissect.database.ese.c_ese) codepage() (dissect.target.plugins.os.windows.generic.GenericPlugin method) CODEPAGE_MAP (in module dissect.database.ese.util) codestyle module CodestyleException CodeViewDebugEntry (class in dissect.executable.pe.directory.debug) COFFEE (dissect.target.plugins.os.windows.network.IfTypes attribute) ColimaChildTargetPlugin (class in dissect.target.plugins.child.colima) coll_descriptors (flow.record.adapter.mongo.MongoReader attribute) (flow.record.adapter.mongo.MongoWriter attribute) collapsable_items (dissect.target.plugins.os.unix.linux.network.SystemdNetworkConfigParser attribute) collapse (dissect.target.helpers.configutil.ConfigurationParser attribute) (dissect.target.helpers.configutil.ParserConfig attribute) (dissect.target.helpers.configutil.ParserOptions attribute) collapse_all (dissect.target.helpers.configutil.ConfigurationParser attribute) collapse_inverse (dissect.target.helpers.configutil.ParserConfig attribute) (dissect.target.helpers.configutil.ParserOptions attribute) COLLATION (in module dissect.ntfs.c_ntfs) collation_rule (dissect.ntfs.index.IndexRoot property) collect() (acquire.acquire.collector.Collector method) collect_command_output() (acquire.acquire.collector.Collector method) collect_file_raw() (acquire.acquire.collector.Collector method) collect_glob() (acquire.acquire.collector.Collector method) collect_hashes() (in module acquire.acquire.hashes) collect_named_objects() (in module acquire.acquire.dynamic.windows.collect) collect_open_handles() (in module acquire.acquire.dynamic.windows.collect) collect_path() (acquire.acquire.collector.Collector method) collect_rmmetadata() (acquire.acquire.acquire.NTFS class method) collect_usnjrnl() (acquire.acquire.acquire.NTFS class method) Collection (class in dissect.target.target) collection (flow.record.adapter.mongo.MongoReader attribute) (flow.record.adapter.mongo.MongoWriter attribute) CollectionReport (class in acquire.acquire.collector) Collector (class in acquire.acquire.collector) Color (class in dissect.target.helpers.cyber) COLOR_BG_BLUE (in module dissect.cstruct.utils) COLOR_BG_CYAN (in module dissect.cstruct.utils) COLOR_BG_GREEN (in module dissect.cstruct.utils) COLOR_BG_PURPLE (in module dissect.cstruct.utils) COLOR_BG_RED (in module dissect.cstruct.utils) COLOR_BG_WHITE (in module dissect.cstruct.utils) COLOR_BG_YELLOW (in module dissect.cstruct.utils) COLOR_BLUE (in module dissect.cstruct.utils) COLOR_CYAN (in module dissect.cstruct.utils) COLOR_GREEN (in module dissect.cstruct.utils) COLOR_GREY (in module dissect.target.tools.qfind) COLOR_NORMAL (in module dissect.cstruct.utils) COLOR_PURPLE (in module dissect.cstruct.utils) COLOR_RED (in module dissect.cstruct.utils) COLOR_WHITE (in module dissect.cstruct.utils) COLOR_YELLOW (in module dissect.cstruct.utils) colors (dissect.target.plugins.os.windows.rdpcache.BitmapTile attribute) Column (class in dissect.database.ese.table) (class in dissect.database.sqlite3) (class in dissect.database.sqlite3.sqlite3) column() (dissect.database.ese.Table method) (dissect.database.ese.table.Table method) column_ids (dissect.database.ese.Index property) (dissect.database.ese.index.Index property) column_names (dissect.database.ese.Table property) (dissect.database.ese.table.Table property) COLUMN_TYPE_MAP (in module dissect.database.ese.util) COLUMN_TYPES (in module dissect.database.ese.util) columns (dissect.database.ese.Index property) (dissect.database.ese.index.Index property) (dissect.database.ese.Table attribute) (dissect.database.ese.table.Table attribute) (dissect.database.sqlite3.sqlite3.Table attribute) (dissect.database.sqlite3.Table attribute) (dissect.target.plugins.os.windows.search.TableRecord attribute) ColumnType (class in dissect.database.ese.util) com_descriptor (dissect.executable.PE property) (dissect.executable.pe.PE property) (dissect.executable.pe.pe.PE property) comctl32 (in module acquire.acquire.gui.win32) ComDescriptorDirectory (class in dissect.executable.pe.directory) (class in dissect.executable.pe.directory.com_descriptor) ComHandlerRecord (in module dissect.target.plugins.os.windows.tasks.records) COMMAND (acquire.acquire.collector.ArtifactType attribute) command (class in flow.record.fieldtypes) (dissect.target.loaders.mqtt.Broker attribute) (dissect.target.plugins.os.windows.log.schedlgu.SchedLgU attribute) COMMAND_HISTORY_ABSOLUTE_PATHS (dissect.target.plugins.os.unix.bsd.citrix.history.CitrixCommandHistoryPlugin attribute) COMMAND_HISTORY_RELATIVE_PATHS (dissect.target.plugins.os.unix.bsd.citrix.history.CitrixCommandHistoryPlugin attribute) (dissect.target.plugins.os.unix.history.CommandHistoryPlugin attribute) COMMAND_INFO (dissect.target.loaders.remote.RemoteStreamConnection attribute) command_line (dissect.target.plugins.os.windows.regf.cit.Entry attribute) COMMAND_OUTPUT_BASE (acquire.acquire.collector.Collector attribute) COMMAND_QUIT (dissect.target.loaders.remote.RemoteStreamConnection attribute) COMMAND_READ (dissect.target.loaders.remote.RemoteStreamConnection attribute) commandhistory() (dissect.target.plugins.os.unix.bsd.citrix.history.CitrixCommandHistoryPlugin method) (dissect.target.plugins.os.unix.history.CommandHistoryPlugin method) CommandHistoryPlugin (class in dissect.target.plugins.os.unix.history) CommandHistoryRecord (in module dissect.target.plugins.os.unix.history) CommandLineEventConsumerRecord (in module dissect.target.plugins.os.windows.cim) commandprocautorun() (dissect.target.plugins.os.windows.generic.GenericPlugin method) CommandProcAutoRunRecord (in module dissect.target.plugins.os.windows.generic) comment (dissect.target.plugins.apps.ssh.ssh.SSHPrivateKey attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) comment_example() (in module codestyle) comment_prefixes (dissect.target.helpers.configutil.ConfigurationParser attribute) (dissect.target.helpers.configutil.ParserConfig attribute) (dissect.target.helpers.configutil.ParserOptions attribute) COMMENTS (dissect.target.helpers.configutil.Default attribute) comments (dissect.target.helpers.configutil.Env attribute) (dissect.target.plugins.os.windows.regf.shellbags.NETWORK attribute) ComMetadata (class in dissect.executable.pe.directory.com_descriptor) commit() (dissect.cstruct.types.structure.StructureMetaType method) commit_time (dissect.volume.lvm.metadata.IntegritySegment attribute) CommitBlock (class in dissect.extfs.journal) commits() (dissect.extfs.JDB2 method) (dissect.extfs.journal.JDB2 method) commits_all() (dissect.extfs.JDB2 method) (dissect.extfs.journal.JDB2 method) common() (in module dissect.target.helpers.hashutil) COMMON_APPLICATION_FIELDS (in module dissect.target.helpers.record) COMMON_CONTAINER_FIELDS (in module dissect.target.plugins.apps.container.container) COMMON_DIR_COMBINATIONS (acquire.acquire.acquire.History attribute) COMMON_EDITOR_FIELDS (in module dissect.target.plugins.apps.editor.editor) COMMON_ELEMENTS (in module dissect.target.plugins.apps.vpn.openvpn) (in module dissect.target.plugins.os.windows.cim) (in module dissect.target.plugins.os.windows.log.amcache) COMMON_ELLEMENTS (in module dissect.target.plugins.apps.ssh.ssh) COMMON_FIELDS (in module dissect.target.plugins.apps.chat.chat) COMMON_IMAGE_FIELDS (in module dissect.target.plugins.apps.container.container) COMMON_INTERFACE_ELEMENTS (in module dissect.target.helpers.record) COMMON_LOG_FIELDS (in module dissect.target.plugins.apps.container.container) COMMON_SAVE_PATHS (dissect.target.plugins.os.unix.linux.iptables.IptablesSavePlugin attribute) COMMON_UNIX_FIELDS (in module dissect.target.helpers.record) commonpath() (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.polypath) compact_formatter() (in module dissect.target.plugins.filesystem.ntfs.mft) COMPACT_RECORD_TYPES (in module dissect.target.plugins.filesystem.ntfs.mft) CompactPrefetchRecord (in module dissect.target.plugins.os.windows.prefetch) CompactSystemHeader (class in dissect.etl.headers.system) COMPAQ_PEER (dissect.target.helpers.network.IANAProtocol attribute) compare() (dissect.apfs.objects.nx_superblock.NxSuperblock method) (dissect.apfs.objects.NxSuperblock method) comparison (dissect.target.tools.diff.DifferentialCli attribute) ComparisonOperator (class in dissect.util.ldap) COMPAT_1 (in module dissect.target.plugins.os.windows.everything.parser) compile() (dissect.cstruct.compiler.Compiler method) (in module dissect.cstruct.compiler) compile_file() (in module dissect.etl.manifest) compile_read() (dissect.cstruct.compiler.Compiler method) compile_xml() (in module dissect.etl.manifest) compile_yara() (in module dissect.target.plugins.filesystem.yara) compiled (dissect.cstruct.parser.CStyleParser attribute) (dissect.cstruct.parser.TokenParser attribute) CompiledSelector (class in flow.record.selector) Compiler (class in dissect.cstruct.compiler) complete_enter() (dissect.target.tools.shell.TargetHubCli method) complete_man() (dissect.target.tools.shell.ExtendedCmd method) completedefault() (dissect.target.tools.diff.DifferentialCli method) (dissect.target.tools.shell.RegistryCli method) (dissect.target.tools.shell.TargetCli method) COMPONENT_ID (dissect.etl.headers.headers.EventProperty attribute) COMPOSITELINK (dissect.target.plugins.os.windows.network.IfTypes attribute) compound_type (dissect.ntfs.ACE attribute) (dissect.ntfs.secure.ACE attribute) COMPR_2 (dissect.database.ese.lcmapstring.CASE attribute) COMPR_4 (dissect.database.ese.lcmapstring.CASE attribute) COMPR_6 (dissect.database.ese.lcmapstring.CASE attribute) compress() (dissect.squashfs.compression.Compression method) (in module dissect.util.compression.sevenbit) compressed (dissect.target.loaders.ab.AndroidBackup attribute) (dissect.target.loaders.res.File attribute) COMPRESSED (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) COMPRESSED_FOLDER (class in dissect.target.plugins.os.windows.regf.shellbags) compressed_length_bytes (dissect.target.plugins.os.unix.locate.plocate.PLocateFile attribute) COMPRESSED_MASK (in module dissect.util.compression.lznt1) compressed_size (dissect.archive.vbk.StgBlockDescriptor property) (dissect.archive.wim.CompressedStream attribute) CompressedRunlistStream (class in dissect.ntfs.stream) CompressedStream (class in dissect.archive.wim) (class in dissect.evidence.asdf.streams) compression (acquire.acquire.outputs.tar.TarOutput attribute) Compression (class in dissect.squashfs.compression) (class in dissect.target.tools.dump) compression (dissect.btrfs.stream.Extent attribute) (dissect.target.tools.dump.DumpState attribute) COMPRESSION_FORMAT_DEFAULT (in module dissect.ntfs.c_ntfs) COMPRESSION_FORMAT_LZNT1 (in module dissect.ntfs.c_ntfs) COMPRESSION_FORMAT_NONE (in module dissect.ntfs.c_ntfs) COMPRESSION_SCHEME (in module dissect.database.ese.c_ese) COMPRESSION_TO_EXT (in module dissect.target.tools.dump) compression_type (dissect.archive.vbk.StgBlockDescriptor property) compression_unit (dissect.ntfs.attr.AttributeHeader property) (dissect.ntfs.AttributeHeader property) (dissect.ntfs.stream.CompressedRunlistStream attribute) compression_unit_size (dissect.ntfs.stream.CompressedRunlistStream attribute) Computername (dissect.eventlog.evt.Record attribute) ComputerSidRecord (in module dissect.target.plugins.os.windows.generic) ComStream (class in dissect.executable.pe.directory.com_descriptor) con (flow.record.adapter.duckdb.DuckdbReader attribute) (flow.record.adapter.duckdb.DuckdbWriter attribute) (flow.record.adapter.sqlite.SqliteReader attribute) (flow.record.adapter.sqlite.SqliteWriter attribute) CONCAT (dissect.volume.vinum.config.PlexOrg attribute) ConcatHashKeyDatum (class in dissect.fve.bde.information) ConCredentials (in module dissect.target.filesystems.nfs) (in module dissect.target.helpers.sunrpc.client) Config (class in dissect.fve.luks.metadata) (class in dissect.target.plugins.os.unix.bsd.darwin.ios._os) (class in dissect.volume.vinum.vinum) config (dissect.executable.pe.directory.load_config.LoadConfigDirectory property) (dissect.executable.pe.directory.LoadConfigDirectory property) (dissect.fve.luks.metadata.Metadata attribute) (dissect.target.loaders.containerimage.ContainerImageTarSubLoader attribute) (dissect.target.loaders.utm.UtmLoader attribute) (dissect.target.plugins.apps.webserver.iis.IISLogsPlugin attribute) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager attribute) (dissect.volume.vinum.vinum.VinumPhysicalDisk property) CONFIG (in module acquire.acquire.acquire) config() (dissect.archive.vma.VMA method) (dissect.target.plugins.apps.ssh.opensshd.SSHServerPlugin method) (dissect.target.plugins.apps.virtualization.vmware_workstation.VmwareWorkstationPlugin method) (dissect.target.plugins.apps.vpn.openvpn.OpenVPNPlugin method) (dissect.target.plugins.apps.vpn.wireguard.WireGuardPlugin method) config2 (dissect.volume.vinum.vinum.VinumPhysicalDisk property) CONFIG_CRT (dissect.target.loaders.remote.RemoteStreamConnection attribute) config_fs (dissect.target.plugins.general.config.ConfigurationTreePlugin attribute) config_globs (dissect.target.plugins.apps.vpn.openvpn.OpenVPNPlugin attribute) CONFIG_GLOBS (dissect.target.plugins.apps.vpn.wireguard.WireGuardPlugin attribute) config_globs (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager attribute) (dissect.target.plugins.os.unix.linux.network_managers.Parser attribute) CONFIG_KEY (dissect.target.loaders.remote.RemoteStreamConnection attribute) CONFIG_KEY_RUNCOMMANDS_FILE (dissect.target.tools.shell.RegistryCli attribute) (dissect.target.tools.shell.TargetCmd attribute) CONFIG_MAP (in module dissect.target.helpers.configutil) CONFIG_NAME (in module dissect.target.helpers.config) CONFIG_PATH (dissect.target.plugins.child.virtuozzo.VirtuozzoChildTargetPlugin attribute) config_paths (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser attribute) (dissect.target.plugins.os.unix.linux.network.SystemdNetworkConfigParser attribute) config_time (dissect.volume.vinum.vinum.VinumPhysicalDisk attribute) config_tree (dissect.target.tools.shell.UnixConfigTreeCli attribute) ConfigNode (class in dissect.target.plugins.os.unix.linux.fortios._os) configs (dissect.target.plugins.apps.vpn.openvpn.OpenVPNPlugin attribute) (dissect.target.plugins.apps.vpn.wireguard.WireGuardPlugin attribute) configs() (dissect.archive.vma.VMA method) configstore() (dissect.target.plugins.os.unix.esxi._os.ESXiPlugin method) Configuration (class in dissect.volume.raid.raid) ConfigurationEntry (class in dissect.target.filesystems.config) ConfigurationFilesystem (class in dissect.target.filesystems.config) ConfigurationParser (class in dissect.target.helpers.configutil) ConfigurationParsingError configurations (dissect.volume.raid.raid.RAID attribute) ConfigurationTreePlugin (class in dissect.target.plugins.general.config) configure() (dissect.target.loaders.remote.RemoteStreamConnection static method) configure_generic_arguments() (in module dissect.target.tools.utils.cli) configure_logging() (in module dissect.target.tools.utils.logging) configure_plugin_arguments() (in module dissect.target.tools.utils.cli) configure_state() (in module dissect.target.tools.dump) CONFIGURED (dissect.target.plugins.apps.container.podman.ContainerState attribute) congestion_window (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) conn (dissect.target.filesystems.smb.SmbFilesystem attribute) (dissect.target.filesystems.smb.SmbStream attribute) (dissect.target.loaders.smb.SmbRegistry attribute) connect() (dissect.target.filesystems.nfs.NfsFilesystem class method) (dissect.target.helpers.nfs.client.mount.Client class method) (dissect.target.helpers.nfs.client.nfs.Client class method) (dissect.target.helpers.sunrpc.client.Client class method) (dissect.target.loaders.mqtt.Broker method) (dissect.target.loaders.remote.RemoteStreamConnection method) connect_port_mapper() (dissect.target.helpers.sunrpc.client.Client class method) connected (dissect.target.loaders.mqtt.Broker attribute) CONNECTED (dissect.target.plugins.os.unix.linux.proc.Sockets.SocketStateType attribute) connection (dissect.target.loaders.mqtt.MqttDiagnosticLine attribute) (dissect.target.loaders.mqtt.MqttLoader attribute) CONSENT_STORES (dissect.target.plugins.os.windows.cam.CamPlugin attribute) CONSOLE_FE_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) CONSOLE_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) ConsoleHostHistoryRecord (in module dissect.target.plugins.apps.shell.powershell) construct_public_key() (in module dissect.target.plugins.apps.ssh.putty) consts (dissect.cstruct.cstruct attribute) (dissect.cstruct.cstruct.cstruct attribute) consume() (dissect.cstruct.expression.ExpressionTokenizer method) (dissect.cstruct.parser.TokenConsumer method) consumerbindings() (dissect.target.plugins.os.windows.cim.CimPlugin method) Container (class in dissect.clfs.blf) (class in dissect.clfs.container) (class in dissect.target.container) container (dissect.apfs.objects.base.Object attribute) (dissect.apfs.objects.BTree attribute) (dissect.apfs.objects.btree.BTree attribute) (dissect.apfs.objects.Object attribute) ContainerAppcompatRecord (in module dissect.target.plugins.os.windows.amcache) ContainerError ContainerImageTarSubLoader (class in dissect.target.loaders.containerimage) ContainerKeybag (class in dissect.apfs.objects.keybag) ContainerPlugin (class in dissect.target.plugins.apps.container.container) containers (dissect.clfs.blf.BaseRecord attribute) CONTAINERS (in module dissect.target.container) containers() (dissect.target.plugins.apps.container.docker.DockerPlugin method) (dissect.target.plugins.apps.container.podman.PodmanPlugin method) ContainerState (class in dissect.target.plugins.apps.container.podman) contains() (dissect.evidence.asdf.asdf.AsdfSnapshot method) (dissect.evidence.asdf.AsdfSnapshot method) (dissect.evidence.AsdfSnapshot method) content (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadTab attribute) CONTENT_TABLES (dissect.target.plugins.os.windows.cam.CamPlugin attribute) contents (dissect.target.plugins.os.unix.linux.proc.Environ attribute) (dissect.volume.lvm.LVM2 attribute) (dissect.volume.lvm.lvm2.LVM2 attribute) Context (class in dissect.clfs.blf) CONTEXT_TABLES (dissect.target.plugins.os.windows.cam.CamPlugin attribute) CONTROL_PANEL (class in dissect.target.plugins.os.windows.regf.shellbags) CONTROL_PANEL_CATEGORY (class in dissect.target.plugins.os.windows.regf.shellbags) CONTROL_PANEL_CPL_FILE (class in dissect.target.plugins.os.windows.regf.shellbags) control_records() (dissect.clfs.blf.BLF method) controller_data (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) ControllerData (class in dissect.volume.ddf.ddf) ControlRecord (class in dissect.clfs.blf) CONTROLSET_REGEX (in module dissect.target.plugins.os.windows.registry) controlsets (dissect.target.plugins.os.windows.registry.RegistryPlugin property) conv_log_offset (dissect.fve.bde.eow.EowBitmap property) conv_log_size (dissect.fve.bde.eow.EowInformation property) CONV_MAGIC (in module dissect.fve.bde.c_bde) ConVerifier (in module dissect.target.filesystems.nfs) (in module dissect.target.helpers.sunrpc.client) convert_day_num_to_date() (in module dissect.database.ese.tools.ual) convert_email() (in module dissect.target.plugins.apps.chat.msn) convert_ports() (in module dissect.target.plugins.apps.container.docker) (in module dissect.target.plugins.apps.container.podman) convert_time() (in module dissect.target.plugins.os.windows.regf.trusteddocs) convert_timestamp() (in module dissect.target.plugins.apps.container.docker) cookie (dissect.target.helpers.nfs.nfs3.EntryPlus attribute) (dissect.target.helpers.nfs.nfs3.ReadDirPlusParams attribute) cookies() (dissect.target.plugins.apps.browser.brave.BravePlugin method) (dissect.target.plugins.apps.browser.chrome.ChromePlugin method) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin method) (dissect.target.plugins.apps.browser.chromium.ChromiumPlugin method) (dissect.target.plugins.apps.browser.edge.EdgePlugin method) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin method) (dissect.target.plugins.apps.browser.iexplore.WebCache method) CookieVerf (class in dissect.target.helpers.nfs.nfs3) cookieverf (dissect.target.helpers.nfs.nfs3.ReadDirPlusParams attribute) (dissect.target.helpers.nfs.nfs3.ReadDirPlusResult attribute) copy() (dissect.target.helpers.fsutil.stat_result class method) copy_block() (dissect.evidence.asdf.asdf.AsdfWriter method) (dissect.evidence.asdf.AsdfWriter method) copy_bytes() (dissect.evidence.asdf.asdf.AsdfWriter method) (dissect.evidence.asdf.AsdfWriter method) copy_cstruct() (in module dissect.executable.elf.c_elf) copy_identifier (dissect.volume.vss.Store attribute) copy_runlist() (dissect.evidence.asdf.asdf.AsdfWriter method) (dissect.evidence.asdf.AsdfWriter method) copy_set_identifier (dissect.volume.vss.Store attribute) copy_stream() (in module dissect.evidence.tools.asdf.dd) CopyHistoryRecord (in module dissect.target.plugins.apps.productivity.sevenzip) CorruptDataError count (dissect.archive.vbk.FibMetaSparseTable attribute) (dissect.archive.vbk.FibStream attribute) (dissect.archive.vbk.MetaTableDescriptor property) (dissect.archive.vbk.MetaVector attribute) (dissect.archive.vbk.RootDirectory attribute) (dissect.archive.vbk.SubFolderItem attribute) (dissect.cim.index.IndexPage attribute) (dissect.cim.objects.TOC attribute) (dissect.eventlog.Evtx attribute) (dissect.eventlog.evtx.Evtx attribute) (dissect.eventlog.wevtutil.WevtutilWrapper attribute) (dissect.regf.regf.FastLeaf property) (dissect.regf.regf.HashLeaf property) (dissect.regf.regf.IndexLeaf property) (dissect.regf.regf.IndexRoot property) (dissect.regf.regf.KeyIndex property) (dissect.target.helpers.nfs.nfs3.ReadParams attribute) (dissect.target.helpers.nfs.nfs3.ReadResult attribute) (dissect.target.plugins.os.unix.locate.gnulocate.GNULocateFile attribute) (flow.record.adapter.duckdb.DuckdbReader attribute) (flow.record.adapter.duckdb.DuckdbWriter attribute) (flow.record.adapter.line.LineWriter attribute) (flow.record.adapter.split.SplitWriter attribute) (flow.record.adapter.sqlite.SqliteReader attribute) (flow.record.adapter.sqlite.SqliteWriter attribute) count_contiguous_subclusters() (in module dissect.hypervisor.disk.qcow2) cow (dissect.vmfs.address.FileBlockAddr property) (dissect.vmfs.address.LargeFileBlockAddr property) (dissect.vmfs.address.PointerBlockAddr property) (dissect.vmfs.address.PointerBlockAddr64 property) (dissect.vmfs.address.SmallFileBlockAddr property) (dissect.vmfs.address.SubBlockAddr property) (dissect.vmfs.address.SubBlockAddr64 property) cow_store (dissect.volume.lvm.metadata.SnapshotSegment attribute) COWD_MAGIC (in module dissect.hypervisor.disk.c_vmdk) cp() (in module dissect.target.tools.fs) CP_TO_NAME (in module dissect.executable.pe.locale_id) CPANEL_LASTLOGIN (in module dissect.target.plugins.apps.webhosting.cpanel) CPANEL_LASTLOGIN_PATTERN (in module dissect.target.plugins.apps.webhosting.cpanel) CPANEL_LOGS_PATH (in module dissect.target.plugins.apps.webhosting.cpanel) CPanelLastloginRecord (in module dissect.target.plugins.apps.webhosting.cpanel) CPanelPlugin (class in dissect.target.plugins.apps.webhosting.cpanel) cpassword (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) CPHB (dissect.target.helpers.network.IANAProtocol attribute) CPIO_MAGIC_CRC (in module dissect.util.cpio) CPIO_MAGIC_NEW (in module dissect.util.cpio) CPIO_MAGIC_OLD (in module dissect.util.cpio) CpioFile() (in module dissect.util.cpio) CpioFilesystem (class in dissect.target.filesystems.cpio) CpioInfo (class in dissect.util.cpio) CPNX (dissect.target.helpers.network.IANAProtocol attribute) CPU_FREQ (dissect.etl.headers.logfile.ReservedFlags attribute) cpu_speed_in_MHz (dissect.etl.headers.logfile.LogfileHeader property) cpu_threads (dissect.volume.lvm.metadata.VdoPoolSegment attribute) cpus (dissect.fve.luks.metadata.KeyslotKdf attribute) CramFS (class in dissect.cramfs) (class in dissect.cramfs.cramfs) cramfs (dissect.target.filesystems.cramfs.CramfsFilesystem attribute) cramfs_def (in module dissect.cramfs.c_cramfs) CramfsFilesystem (class in dissect.target.filesystems.cramfs) CramfsFilesystemEntry (class in dissect.target.filesystems.cramfs) crc (dissect.evidence.asdf.streams.Crc32Stream attribute) crc32 (dissect.fve.bde.information.Validation property) crc32() (in module dissect.util.hash.crc32) crc32_filobj() (in module dissect.evidence.tools.asdf.verify) crc32c() (in module dissect.util.hash.crc32c) crc32c_native (in module dissect.util.hash) crc32c_python (in module dissect.util.hash) Crc32Stream (class in dissect.evidence.asdf.streams) CRC_SIZE (in module dissect.util.compression.xz) CRCMismatchException create() (dissect.target.loaders.profile.ProfileOSPlugin class method) (dissect.target.loaders.res.ResOSPlugin class method) (dissect.target.plugin.OSPlugin class method) (dissect.target.plugins.os.default._os.DefaultOSPlugin class method) (dissect.target.plugins.os.unix._os.UnixPlugin class method) (dissect.target.plugins.os.unix.bsd.citrix._os.CitrixPlugin class method) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin class method) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin class method) (dissect.target.plugins.os.unix.esxi._os.ESXiPlugin class method) (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin class method) (dissect.target.plugins.os.unix.linux.debian.proxmox._os.ProxmoxPlugin class method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSPlugin class method) (dissect.target.plugins.os.windows._os.WindowsPlugin class method) create_argument_parser() (in module acquire.acquire.utils) (in module dissect.thumbcache.tools.utils) create_cipher() (dissect.target.loaders.itunes.FileInfo method) (in module dissect.fve.crypto) create_cli() (in module dissect.target.tools.shell) create_config() (dissect.target.plugins.os.unix.linux.network_managers.Template method) create_descriptor_table() (in module flow.record.adapter.sqlite) create_extended_descriptor() (in module dissect.target.helpers.record) create_map() (dissect.eventlog.bxml.Template method) create_parser() (dissect.target.helpers.configutil.ParserConfig method) create_record() (in module dissect.target.plugins.os.windows.log.amcache) create_records() (dissect.target.plugins.os.windows.regf.clsid.CLSIDPlugin method) create_sink() (dissect.target.tools.dump.DumpState method) create_state() (in module dissect.target.tools.dump) create_streams() (dissect.target.plugins.scrape.scrape.ScrapePlugin method) create_tar_filesystem() (in module dissect.target.plugins.os.unix.linux.fortios._os) create_time (dissect.apfs.objects.fs.Snapshot property) CREATED (dissect.target.plugins.apps.container.podman.ContainerState attribute) created (dissect.target.tools.diff.DirectoryDifferential attribute) creation_host (dissect.volume.lvm.LVM2 attribute) (dissect.volume.lvm.lvm2.LVM2 attribute) (dissect.volume.lvm.metadata.LogicalVolume attribute) creation_time (dissect.archive.vma.VMA property) (dissect.archive.wim.DirectoryEntry property) (dissect.ntfs.attr.FileName property) (dissect.ntfs.attr.StandardInformation property) (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntryResource attribute) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK_BEEF0004 attribute) (dissect.target.plugins.os.windows.regf.shellbags.MTP_FILE_ENTRY property) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM property) (dissect.volume.lvm.LVM2 attribute) (dissect.volume.lvm.lvm2.LVM2 attribute) (dissect.volume.lvm.metadata.HistoricalLogicalVolume attribute) (dissect.volume.lvm.metadata.LogicalVolume attribute) (dissect.volume.md.md.MDPhysicalDisk attribute) (dissect.volume.md.MDPhysicalDisk attribute) (dissect.volume.vss.Store attribute) creation_time_ns (dissect.archive.wim.DirectoryEntry property) (dissect.ntfs.attr.FileName property) (dissect.ntfs.attr.StandardInformation property) creation_ts (dissect.vmfs.lvm.Volume attribute) (dissect.vmfs.Volume attribute) creator_back_trace_index (acquire.acquire.dynamic.windows.types.Handle attribute) (acquire.acquire.dynamic.windows.types.SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX property) cred (dissect.target.helpers.sunrpc.sunrpc.CallBody attribute) credentials (dissect.target.helpers.sunrpc.client.AuthScheme attribute) Credentials (in module dissect.target.helpers.nfs.client.nfs) (in module dissect.target.helpers.sunrpc.client) (in module dissect.target.helpers.sunrpc.serializer) (in module dissect.target.helpers.sunrpc.sunrpc) credentials_serializer (dissect.target.helpers.sunrpc.client.AuthScheme attribute) credhist() (dissect.target.plugins.os.windows.credential.credhist.CredHistPlugin method) credhist_def (in module dissect.target.plugins.os.windows.credential.credhist) CredHistEntry (class in dissect.target.plugins.os.windows.credential.credhist) CredHistFile (class in dissect.target.plugins.os.windows.credential.credhist) CredHistKeyProviderPlugin (class in dissect.target.plugins.os.windows.dpapi.keyprovider.credhist) CredHistPlugin (class in dissect.target.plugins.os.windows.credential.credhist) CredHistRecord (in module dissect.target.plugins.os.windows.credential.credhist) CredSystem (class in dissect.target.plugins.os.windows.dpapi.master_key) CRIM (class in dissect.eventlog) (class in dissect.eventlog.wevt) CRIT (dissect.target.plugins.os.unix.log.journal.JournalMessagePriority attribute) CritSecGuid (in module dissect.etl.utils) CronjobPlugin (class in dissect.target.plugins.os.unix.cronjobs) CronjobRecord (in module dissect.target.plugins.os.unix.cronjobs) cronjobs() (dissect.target.plugins.os.unix.cronjobs.CronjobPlugin method) CRONTAB_DIRS (dissect.target.plugins.os.unix.cronjobs.CronjobPlugin attribute) CRONTAB_FILES (dissect.target.plugins.os.unix.cronjobs.CronjobPlugin attribute) crontabs (dissect.target.plugins.os.unix.cronjobs.CronjobPlugin attribute) crop_metadata (dissect.volume.lvm.metadata.ThinPoolSegment attribute) crtime (dissect.extfs.extfs.INode property) (dissect.extfs.INode property) (dissect.xfs.xfs.INode property) crtime_ns (dissect.extfs.extfs.INode property) (dissect.extfs.INode property) (dissect.xfs.xfs.INode property) CRTP (dissect.target.helpers.network.IANAProtocol attribute) CRUDP (dissect.target.helpers.network.IANAProtocol attribute) crypt_session_key_type1() (in module dissect.target.plugins.os.windows.dpapi.crypto) crypt_session_key_type2() (in module dissect.target.plugins.os.windows.dpapi.crypto) crypto_header (dissect.hypervisor.disk.qcow2.QCow2 attribute) CryptStream (class in dissect.fve.crypto.dmcrypt) cs (dissect.cstruct.compiler.Compiler attribute) (dissect.cstruct.MetaType attribute) (dissect.cstruct.types.base.MetaType attribute) (dissect.cstruct.types.MetaType attribute) CS_HREDRAW (in module acquire.acquire.gui.win32) CS_VREDRAW (in module acquire.acquire.gui.win32) csize_mask (dissect.hypervisor.disk.qcow2.QCow2 attribute) csize_shift (dissect.hypervisor.disk.qcow2.QCow2 attribute) cstruct (class in dissect.cstruct) (class in dissect.cstruct.cstruct) (dissect.cstruct.parser.Parser attribute) CStyleParser (class in dissect.cstruct.parser) CSV_COLUMNS (in module acquire.acquire.hashes) CsvfileReader (class in flow.record.adapter.csvfile) CsvfileWriter (class in flow.record.adapter.csvfile) CSVish (class in dissect.target.helpers.configutil) ctime (dissect.apfs.objects.fs.INode property) (dissect.btrfs.btrfs.INode property) (dissect.btrfs.INode property) (dissect.extfs.extfs.INode property) (dissect.extfs.INode property) (dissect.fat.fat.DirectoryEntry property) (dissect.fat.fat.RootDirectory property) (dissect.ffs.ffs.INode property) (dissect.jffs.jffs2.INode property) (dissect.ole.ole.DirectoryEntry attribute) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.QNX6 attribute) (dissect.qnxfs.qnx6.INode6 property) (dissect.qnxfs.qnx6.QNX6 attribute) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.vmfs.FileDescriptor property) (dissect.xfs.xfs.INode property) ctime_ns (dissect.btrfs.btrfs.INode property) (dissect.btrfs.INode property) (dissect.extfs.extfs.INode property) (dissect.extfs.INode property) (dissect.ffs.ffs.INode property) (dissect.xfs.xfs.INode property) ctx (dissect.evidence.asdf.streams.HashedStream attribute) (dissect.target.plugins.os.unix.locate.plocate.PLocateFile attribute) (flow.record.tools.rdump.ProgressMonitor attribute) ctype (dissect.cim.cim.Property property) (dissect.database.ese.table.Column property) ctypes() (in module dissect.cstruct) (in module dissect.cstruct.cstruct) ctypes_type() (in module dissect.cstruct) (in module dissect.cstruct.cstruct) ctz() (in module dissect.hypervisor.disk.c_qcow2) current_offset (dissect.eventlog.bxml.Bxml property) current_path (flow.record.stream.PathTemplateWriter attribute) current_record_number (dissect.eventlog.Evt attribute) (dissect.eventlog.evt.Evt attribute) current_state (dissect.fve.bde.information.Information property) CURRENT_VERSION_KEY (dissect.target.plugins.os.windows._os.WindowsPlugin attribute) Cursor (class in dissect.apfs.cursor) (class in dissect.btrfs.tree) (class in dissect.database.ese.cursor) cursor (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) cursor() (dissect.apfs.objects.FS method) (dissect.apfs.objects.fs.FS method) (dissect.btrfs.tree.BTree method) (dissect.database.ese.Index method) (dissect.database.ese.index.Index method) (dissect.database.ese.Table method) (dissect.database.ese.table.Table method) custom() (in module dissect.target.helpers.hashutil) custom_destination() (dissect.target.plugins.os.windows.jumplist.JumpListPlugin method) custom_destination_def (in module dissect.target.plugins.os.windows.jumplist) custom_destinations (dissect.target.plugins.os.windows.jumplist.JumpListPlugin attribute) custom_obj_renderer() (in module dissect.target.tools.utils.logging) CustomDestinationFile (class in dissect.target.plugins.os.windows.jumplist) CW_USEDEFAULT (in module acquire.acquire.gui.win32) cwd (dissect.target.tools.diff.DifferentialCli attribute) (dissect.target.tools.shell.RegistryCli attribute) (dissect.target.tools.shell.TargetCli attribute) (dissect.target.tools.shell.UnixConfigTreeCli attribute) cwd() (dissect.target.helpers.compat.path_310.TargetPath class method) (dissect.target.helpers.compat.path_311.TargetPath class method) (dissect.target.helpers.compat.path_312.TargetPath class method) (dissect.target.helpers.compat.path_313.TargetPath class method) CYAN (dissect.target.helpers.cyber.Color attribute) (dissect.target.tools.shell.AnsiColors attribute) cyber (dissect.target.tools.shell.ExtendedCmd attribute) cyber() (in module dissect.target.helpers.cyber) cyber_print() (in module dissect.target.helpers.cyber) CyberIO (class in dissect.target.helpers.cyber) CyberLoader (class in dissect.target.loaders.cyber) cylinder_group (dissect.ffs.FFS attribute) (dissect.ffs.ffs.FFS attribute) cylinder_groups() (dissect.ffs.FFS method) (dissect.ffs.ffs.FFS method) CylinderGroup (class in dissect.ffs.ffs) CYRILLIC (dissect.database.ese.lcmapstring.SCRIPT attribute) D D (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) d_freq (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) d_state (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) dacl (dissect.ntfs.secure.SecurityDescriptor attribute) (dissect.ntfs.SecurityDescriptor attribute) DailyTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) DARWIN_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) DarwinPlugin (class in dissect.target.plugins.os.unix.bsd.darwin._os) data (dissect.cim.classes.ClassInstance attribute) (dissect.cim.classes.DataRegion attribute) (dissect.cim.classes.QualifierReference attribute) (dissect.cim.index.IndexPage attribute) (dissect.clfs.c_clfs.BlockHeader attribute) (dissect.database.bsd.db.Page property) (dissect.database.ese.Page attribute) (dissect.database.ese.page.Node attribute) (dissect.database.ese.page.Page attribute) (dissect.database.ese.page.Tag attribute) (dissect.database.ese.record.RecordData attribute) (dissect.database.sqlite3.sqlite3.Cell property) (dissect.database.sqlite3.sqlite3.Page attribute) (dissect.database.sqlite3.sqlite3.WALFrame property) (dissect.etl.Buffer property) (dissect.etl.etl.Buffer property) (dissect.etl.headers.event.EventHeaderExtendedDataItem attribute) (dissect.etl.headers.headers.Header attribute) (dissect.etl.headers.logfile.LogfileHeader attribute) Data (dissect.eventlog.evt.Record attribute) data (dissect.eventlog.wevt.WEVT attribute) (dissect.eventlog.wevt.WEVT_TYPE attribute) (dissect.eventlog.wevt_object.WevtObject attribute) (dissect.evidence.ewf.HeaderSection attribute) (dissect.executable.elf.elf.Section property) (dissect.executable.elf.elf.Segment property) (dissect.executable.elf.Section property) (dissect.executable.elf.Segment property) (dissect.executable.pe.directory.com_descriptor.ComStream property) (dissect.executable.pe.directory.debug.DebugEntry property) (dissect.executable.pe.directory.resource.ResourceDataEntry property) (dissect.executable.pe.directory.ResourceDataEntry property) (dissect.executable.pe.directory.security.Certificate property) (dissect.fve.bde.information.AesCbc256HmacSha512EncryptedDatum property) (dissect.fve.bde.information.AesCcmEncryptedDatum property) (dissect.fve.bde.information.AsymmetricEncryptedDatum property) (dissect.fve.bde.information.Dataset property) (dissect.fve.bde.information.ExportedPublicKeyDatum property) (dissect.fve.bde.information.KeyDatum property) (dissect.fve.bde.information.PublicKeyInfoDatum property) (dissect.fve.bde.information.SimpleDatum property) (dissect.fve.bde.information.SimpleLargeDatum property) (dissect.fve.bde.information.TpmEncryptedBlobDatum property) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.hypervisor.descriptor.vmx.Pair attribute) (dissect.hypervisor.util.envelope.Envelope attribute) (dissect.ntfs.ACE attribute) (dissect.ntfs.index.IndexBuffer attribute) (dissect.ntfs.index.IndexEntry property) (dissect.ntfs.IndexEntry property) (dissect.ntfs.mft.MftRecord attribute) (dissect.ntfs.MftRecord attribute) (dissect.ntfs.secure.ACE attribute) (dissect.regf.regf.BigData property) (dissect.regf.regf.KeyValue property) (dissect.target.helpers.nfs.nfs3.ReadResult attribute) (dissect.target.loaders.cb.CbRegistryKey property) (dissect.target.loaders.mqtt.SeekMessage attribute) (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) (dissect.thumbcache.thumbcache_file.ThumbcacheEntry property) (dissect.thumbcache.ThumbcacheEntry property) (dissect.util.plist.NSDictionary attribute) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.vmfs.FileDescriptor property) (dissect.volume.lvm.metadata.CachePoolSegment attribute) (dissect.volume.lvm.metadata.VdoPoolSegment attribute) (flow.record.selector.RecordContextMatcher attribute) data() (dissect.archive.vbk.MetaBlob method) (dissect.archive.vbk.MetaVector method) (dissect.archive.vbk.MetaVector2 method) (dissect.btrfs.tree.Cursor method) (dissect.cim.objects.DataPage method) (dissect.executable.pe.directory.resource.Resource method) (dissect.ntfs.attr.Attribute method) (dissect.ntfs.attr.AttributeHeader method) (dissect.ntfs.Attribute method) (dissect.ntfs.AttributeHeader method) (dissect.target.plugins.os.windows.regf.cit.CIT method) data_block (dissect.squashfs.INode property) (dissect.squashfs.squashfs.INode property) data_block_size (dissect.volume.dm.thin.Metadata attribute) data_checksum (dissect.thumbcache.thumbcache_file.ThumbcacheEntry attribute) (dissect.thumbcache.ThumbcacheEntry attribute) DATA_CLUSTER_MAX (in module dissect.fat.c_fat) DATA_CLUSTER_MIN (in module dissect.fat.c_fat) data_copies (dissect.volume.lvm.metadata.RAIDSegment attribute) (dissect.volume.lvm.metadata.Segment attribute) data_directories() (dissect.executable.PE method) (dissect.executable.pe.PE method) (dissect.executable.pe.pe.PE method) data_end (dissect.database.bsd.tools.rpm.HeaderBlob attribute) data_extents (dissect.xfs.xfs.INode property) data_fh (dissect.volume.dm.thin.ThinPool attribute) data_id (dissect.cim.index.Key property) (dissect.volume.lvm.metadata.CacheSegment attribute) data_len (dissect.volume.lvm.metadata.CacheSegment attribute) data_length (dissect.cim.index.Key property) data_mapping (dissect.volume.dm.thin.Metadata attribute) data_offset (dissect.archive.vma.Extent attribute) (dissect.cramfs.cramfs.INode property) (dissect.cramfs.INode property) (dissect.etl.Buffer property) (dissect.etl.etl.Buffer property) (dissect.eventlog.bxml.Bxml attribute) (dissect.eventlog.evtx.ElfChnk attribute) (dissect.eventlog.wevt_object.WevtObject attribute) (dissect.evidence.ewf.SectionDescriptor attribute) (dissect.hypervisor.disk.hdd.HDS attribute) (dissect.hypervisor.disk.vdi.VDI attribute) (dissect.squashfs.INode property) (dissect.squashfs.squashfs.INode property) (dissect.volume.lvm.metadata.RAIDSegment attribute) data_page (dissect.cim.index.Key property) DATA_PAGE_SIZE (in module dissect.cim.c_cim) DATA_PATH (dissect.target.plugins.apps.chat.msn.MSNPlugin attribute) data_sectors (dissect.volume.lvm.metadata.IntegritySegment attribute) data_segment (dissect.fve.bde.information.Datum attribute) data_size (dissect.etl.headers.event.EventHeaderExtendedDataItem attribute) (dissect.etl.headers.headers.Header property) (dissect.fve.bde.information.Datum property) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK property) data_start (dissect.database.bsd.tools.rpm.HeaderBlob attribute) (dissect.eventlog.wevt_object.WevtObject attribute) (dissect.volume.lvm.metadata.CacheSegment attribute) data_stream (dissect.fat.fat.FATFS attribute) (dissect.fat.FATFS attribute) data_stripes (dissect.btrfs.stream.Chunk attribute) data_vmcx (dissect.target.plugins.child.hyperv.HyperVChildTargetPlugin attribute) databases (dissect.target.plugins.os.windows.search.SearchIndexPlugin attribute) DataDirectory (class in dissect.executable.pe.directory) (class in dissect.executable.pe.directory.base) datafork() (dissect.xfs.xfs.INode method) DataPage (class in dissect.cim.objects) DataRegion (class in dissect.cim.classes) dataruns (dissect.vmfs.lvm.Volume attribute) (dissect.vmfs.Volume attribute) (dissect.xfs.xfs.INode property) dataruns() (dissect.extfs.extfs.INode method) (dissect.extfs.INode method) (dissect.fat.fat.DirectoryEntry method) (dissect.fat.fat.RootDirectory method) (dissect.ffs.ffs.INode method) (dissect.ntfs.attr.Attribute method) (dissect.ntfs.attr.AttributeHeader method) (dissect.ntfs.Attribute method) (dissect.ntfs.AttributeHeader method) (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.MftRecord method) (dissect.ntfs.util.AttributeCollection method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) Dataset (class in dissect.fve.bde.information) dataset (dissect.fve.bde.information.Information attribute) DATASTORE_PATH (dissect.target.plugins.os.windows.wua_history.WuaHistoryPlugin attribute) DATASTORE_UPDATE_TABLE (dissect.target.plugins.os.windows.wua_history.WuaHistoryPlugin attribute) DataStream (class in dissect.hypervisor.disk.asif) (class in dissect.jffs.jffs2) date (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) date_accessed (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj attribute) (dissect.target.plugins.os.windows.everything.parser.Record attribute) date_added (dissect.apfs.objects.fs.DirectoryEntry property) date_created (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj attribute) (dissect.target.plugins.os.windows.everything.parser.Record attribute) date_modified (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj attribute) (dissect.target.plugins.os.windows.everything.parser.Record attribute) datetime (class in flow.record.fieldtypes) (dissect.fve.bde.information.ExternalInfoDatum property) (dissect.fve.bde.information.VmkInfoDatum property) datetime_fields (flow.record.adapter.avro.AvroReader attribute) DateTimePlugin (class in dissect.target.plugins.os.default.datetime) Datum (class in dissect.fve.bde.information) DATUM_TYPE_MAP (in module dissect.fve.bde.information) daylight_bias (dissect.target.plugins.os.windows.datetime.TimezoneInformation attribute) daylight_date (dissect.target.plugins.os.windows.datetime.TimezoneInformation attribute) DB (class in dissect.database) (class in dissect.database.bsd) (class in dissect.database.bsd.db) db (dissect.database.bsd.db.Page attribute) (dissect.database.bsd.tools.rpm.Packages attribute) (dissect.database.ese.btree.BTree attribute) (dissect.database.ese.cursor.Cursor attribute) (dissect.database.ese.Index attribute) (dissect.database.ese.index.Index attribute) (dissect.database.ese.Page attribute) (dissect.database.ese.page.Page attribute) (dissect.database.ese.record.RecordData attribute) (dissect.database.ese.Table attribute) (dissect.database.ese.table.Catalog attribute) (dissect.database.ese.table.Table attribute) (dissect.database.ese.tools.certlog.CertLog attribute) (dissect.database.ese.tools.impacket.ESENT_DB attribute) (dissect.database.ese.tools.sru.SRU attribute) (dissect.database.ese.tools.ual.UAL attribute) (dissect.target.plugins.apps.browser.iexplore.WebCache attribute) (flow.record.adapter.mongo.MongoReader attribute) (flow.record.adapter.mongo.MongoWriter attribute) db_def (in module dissect.database.bsd.c_db) db_insert_record() (in module flow.record.adapter.sqlite) dbe_type (dissect.target.plugins.os.unix.locate.mlocate.MLocate attribute) DbgPrintGuid (in module dissect.etl.utils) DBT (in module dissect.database.bsd.db) dbtofsb() (in module dissect.ffs.ffs) DCCP (dissect.target.helpers.network.IANAProtocol attribute) DCN (dissect.target.plugins.os.windows.network.IfTypes attribute) DCN_MEAS (dissect.target.helpers.network.IANAProtocol attribute) ddb (dissect.hypervisor.disk.vmdk.DiskDescriptor attribute) DDF (class in dissect.volume.ddf.ddf) ddf (dissect.target.volumes.ddf.DdfVolumeSystem attribute) (in module dissect.target.volume) ddf_def (in module dissect.volume.ddf.c_ddf) DDFConfiguration (class in dissect.volume.ddf.ddf) DDFError DDFPhysicalDisk (class in dissect.volume.ddf.ddf) DDFVirtualDisk (class in dissect.volume.ddf.ddf) DdfVolumeSystem (class in dissect.target.volumes.ddf) DDN_X25 (dissect.target.plugins.os.windows.network.IfTypes attribute) DDP (dissect.target.helpers.network.IANAProtocol attribute) DDX (dissect.target.helpers.network.IANAProtocol attribute) DebianPlugin (class in dissect.target.plugins.os.unix.linux.debian._os) debug (dissect.executable.PE property) (dissect.executable.pe.PE property) (dissect.executable.pe.pe.PE property) DEBUG (dissect.target.plugins.os.unix.log.journal.JournalMessagePriority attribute) debug (dissect.target.tools.shell.ExtendedCmd attribute) DEBUG (in module dissect.volume.vss) debug() (dissect.vmfs.descriptor.FileDescriptor method) (dissect.vmfs.FileDescriptor method) (dissect.vmfs.resource.ResourceFile method) DebugDirectory (class in dissect.executable.pe.directory) (class in dissect.executable.pe.directory.debug) DebugEntry (class in dissect.executable.pe.directory.debug) DECADE (in module dissect.volume.ddf.ddf) DecmpfsStream (class in dissect.apfs.stream) decode() (dissect.util.compression.lzxpress_huffman.BitString method) decode_bit() (in module dissect.database.ese.util) decode_cd_key() (in module dissect.target.plugins.os.windows.productkey) decode_extent() (in module dissect.btrfs.stream) decode_guid() (in module dissect.database.ese.util) decode_name() (in module dissect.regf.regf) (in module dissect.target.plugins.os.windows.regf.cit) decode_rfc4716() (in module dissect.target.plugins.apps.ssh.ssh) decode_text() (in module dissect.database.ese.util) decode_value() (dissect.target.plugins.os.unix.log.journal.JournalFile method) decode_varint() (in module dissect.target.helpers.protobuf) DecoderEntry (class in dissect.util.compression.lzfse) DECOLOR (in module dissect.ole.c_ole) decompress() (dissect.squashfs.compression.AvailableLZ4 method) (dissect.squashfs.compression.AvailableLZO method) (dissect.squashfs.compression.Compression method) (dissect.squashfs.compression.NativeLZMA method) (dissect.squashfs.compression.NativeXZ method) (dissect.squashfs.compression.NativeZlib method) (dissect.squashfs.compression.NativeZSTD method) (dissect.target.plugins.os.unix.log.atop.AtopFile method) (in module dissect.database.ese.compression) (in module dissect.util.compression.lz4) (in module dissect.util.compression.lzbitmap) (in module dissect.util.compression.lzfse) (in module dissect.util.compression.lznt1) (in module dissect.util.compression.lzo) (in module dissect.util.compression.lzvn) (in module dissect.util.compression.lzxpress) (in module dissect.util.compression.lzxpress_huffman) (in module dissect.util.compression.sevenbit) decompress_size() (in module dissect.database.ese.compression) decompressor (dissect.archive.wim.CompressedStream attribute) DECOMPRESSOR_MAP (in module dissect.archive.c_wim) DECRYPT (in module dissect.fve.crypto.base) decrypt() (dissect.fve.bde.information.VmkInfoDatum method) (dissect.fve.crypto.base.Cipher method) (dissect.fve.crypto.Cipher method) (dissect.hypervisor.util.envelope.Envelope method) (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry method) (dissect.target.plugins.os.windows.credential.credhist.CredHistFile method) (dissect.target.plugins.os.windows.dpapi.blob.Blob method) (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm method) decrypt_blob() (dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin method) DECRYPT_CHUNK_SIZE (in module dissect.hypervisor.util.envelope) decrypt_dpapi() (in module dissect.target.plugins.apps.browser.chromium) decrypt_header() (in module acquire.acquire.tools.decrypter) decrypt_master_key() (in module dissect.target.plugins.apps.browser.firefox) decrypt_password() (in module dissect.target.plugins.os.unix.linux.fortios._os) decrypt_rootfs() (in module dissect.target.plugins.os.unix.linux.fortios._os) decrypt_single_hash() (in module dissect.target.plugins.os.windows.credential.sam) decrypt_system_blob() (dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin method) decrypt_unsupported() (in module dissect.target.plugins.apps.browser.chromium) decrypt_user_blob() (dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin method) decrypt_v10_linux() (in module dissect.target.plugins.apps.browser.chromium) decrypt_v10_windows() (in module dissect.target.plugins.apps.browser.chromium) decrypt_v11_linux() (in module dissect.target.plugins.apps.browser.chromium) decrypt_v20_windows() (in module dissect.target.plugins.apps.browser.chromium) decrypt_value() (dissect.target.plugins.apps.browser.chromium.ChromiumMixin method) (in module dissect.target.plugins.apps.browser.firefox) decrypt_with_hash() (dissect.target.plugins.os.windows.dpapi.master_key.MasterKey method) (dissect.target.plugins.os.windows.dpapi.master_key.MasterKeyFile method) decrypt_with_hash_10() (dissect.target.plugins.os.windows.dpapi.master_key.MasterKey method) decrypt_with_hmac() (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm method) decrypt_with_key() (dissect.target.plugins.os.windows.dpapi.master_key.MasterKey method) (dissect.target.plugins.os.windows.dpapi.master_key.MasterKeyFile method) decrypt_with_password() (dissect.target.plugins.os.windows.dpapi.master_key.MasterKey method) (dissect.target.plugins.os.windows.dpapi.master_key.MasterKeyFile method) decrypted (dissect.fve.bde.BDE property) (dissect.fve.bde.bde.BDE property) (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry attribute) (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) (dissect.target.plugins.os.windows.dpapi.master_key.MasterKey attribute) (dissect.target.plugins.os.windows.dpapi.master_key.MasterKeyFile property) decryption_keys() (dissect.target.plugins.apps.browser.chromium.ChromiumMixin method) deduplication (dissect.archive.vbk.StgBlockDescriptor property) deep (dissect.target.tools.diff.DifferentialCli attribute) (dissect.target.tools.diff.TargetComparison attribute) DEF_CSTYLE (dissect.cstruct.cstruct attribute) (dissect.cstruct.cstruct.cstruct attribute) DEF_LEGACY (dissect.cstruct.cstruct attribute) (dissect.cstruct.cstruct.cstruct attribute) defang() (in module flow.record.fieldtypes) DEFAULT (acquire.acquire.acquire.BsdProfile attribute) (acquire.acquire.acquire.ESXiProfile attribute) (acquire.acquire.acquire.ExecutionOrder attribute) (acquire.acquire.acquire.LinuxProfile attribute) (acquire.acquire.acquire.MacOSProfile attribute) (acquire.acquire.acquire.ProxmoxProfile attribute) (acquire.acquire.acquire.VolatileProfile attribute) (acquire.acquire.acquire.WindowsProfile attribute) Default (class in dissect.target.helpers.configutil) default (dissect.database.ese.table.Column property) (dissect.target.plugins.os.windows.env.EnvVarDetails attribute) default() (dissect.target.tools.shell.ExtendedCmd method) (dissect.target.tools.shell.TargetHubCli method) (flow.record.base.FieldType class method) (flow.record.FieldType class method) (flow.record.fieldtypes.digest class method) (flow.record.fieldtypes.FieldType class method) (flow.record.fieldtypes.typedlist class method) DEFAULT_ASN_DB (in module flow.record.tools.geoip) DEFAULT_BLOCK_SIZE (in module dissect.evidence.asdf.asdf) DEFAULT_CHUNK_SIZE (in module dissect.archive.wim) DEFAULT_CITY_DB (in module flow.record.tools.geoip) DEFAULT_CLUSTER_SIZE (in module dissect.ntfs.c_ntfs) DEFAULT_CONFIG_PATHS (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin attribute) DEFAULT_ELEMENTS (in module dissect.target.plugins.os.unix.linux.services) DEFAULT_ENVVAR_PATHS (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) DEFAULT_EXTENSIONS (acquire.acquire.acquire.FileHashes attribute) DEFAULT_FILE_FILTERS (acquire.acquire.acquire.FileHashes attribute) default_formatter() (in module dissect.target.plugins.filesystem.ntfs.mft) DEFAULT_HASH_FUNCS (acquire.acquire.acquire.FileHashes attribute) DEFAULT_HISTDIR (dissect.target.tools.shell.TargetCmd attribute) DEFAULT_HISTDIRFMT (dissect.target.tools.shell.TargetCmd attribute) DEFAULT_HISTFILE (dissect.target.tools.shell.TargetCmd attribute) DEFAULT_HISTFILESIZE (dissect.target.tools.shell.TargetCmd attribute) DEFAULT_INDEX_SIZE (in module dissect.ntfs.c_ntfs) DEFAULT_LOG_DIRS (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin attribute) DEFAULT_LOG_PATHS (dissect.target.plugins.apps.webserver.iis.IISLogsPlugin attribute) DEFAULT_MAX_SCAN_SIZE (in module dissect.target.plugins.filesystem.yara) DEFAULT_PATHS (acquire.acquire.acquire.FileHashes attribute) (dissect.target.plugins.child.virtualbox.VirtualBoxChildTargetPlugin attribute) DEFAULT_RECORD_COUNT (in module flow.record.adapter.split) DEFAULT_RECORD_SIZE (in module dissect.ntfs.c_ntfs) DEFAULT_RUNCOMMANDS_FILE (dissect.target.tools.shell.ExtendedCmd attribute) (dissect.target.tools.shell.RegistryCli attribute) (dissect.target.tools.shell.TargetCmd attribute) DEFAULT_SECTOR_SIZE (in module dissect.ntfs.c_ntfs) (in module dissect.volume.ddf.ddf) DEFAULT_SERVER_ROOTS (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) default_subvolume (dissect.btrfs.Btrfs attribute) (dissect.btrfs.btrfs.Btrfs attribute) DEFAULT_SUFFIX_LENGTH (in module flow.record.adapter.split) DEFAULT_TEMPLATE (flow.record.stream.PathTemplateWriter attribute) DEFAULT_TOP_GUID (in module dissect.hypervisor.disk.hdd) DEFAULT_TS_LOG_FORMAT (in module dissect.target.plugins.os.unix.log.messages) default_value (dissect.cim.cim.Property property) (dissect.cim.classes.ClassInstanceProperty property) (dissect.database.sqlite3.Column attribute) (dissect.database.sqlite3.sqlite3.Column attribute) default_values (dissect.cim.classes.PropertyDefaultValues attribute) default_values_data (dissect.cim.classes.ClassDefinition attribute) DefaultByName (in module dissect.volume.vinum.vinum) DefaultMissing (class in flow.record.adapter.text) DefaultOSPlugin (class in dissect.target.plugins.os.default._os) defaultpassword_def (in module dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.lsa) DefaultPasswordKeyProvider (class in dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.defaultpassword) defender_def (in module dissect.target.plugins.os.windows.defender.quarantine) DEFENDER_MPLOG_BLOCK_PATTERNS (in module dissect.target.plugins.os.windows.defender.mplog) DEFENDER_MPLOG_LINE (in module dissect.target.plugins.os.windows.defender.mplog) DEFENDER_MPLOG_PATTERNS (in module dissect.target.plugins.os.windows.defender.mplog) DEFENDER_MPLOG_TS_PATTERN (in module dissect.target.plugins.os.windows.defender.mplog) DEFENDER_QUARANTINE_RC4_KEY (in module dissect.target.plugins.os.windows.defender.quarantine) DefenderFileQuarantineRecord (in module dissect.target.plugins.os.windows.defender.quarantine) DefenderMPLogBMTelemetryRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogDetectionAddRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogDetectionEventRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogEMSRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogExclusionRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogLowfiRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogMinFilBlockedFileRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogMinFilUSSRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogOriginalFileNameRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogProcessImageRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogResourceScanRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogRTPRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogThreatActionRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderMPLogThreatRecord (in module dissect.target.plugins.os.windows.defender.mplog) DefenderQuarantineRecord (in module dissect.target.plugins.os.windows.defender.quarantine) definition (dissect.target.loaders.target.TargetLoader attribute) definition() (flow.record.base.RecordDescriptor method) (flow.record.RecordDescriptor method) DEGRADED (dissect.volume.vinum.config.PlexState attribute) (dissect.volume.vinum.config.SDState attribute) delay_import (dissect.executable.PE property) (dissect.executable.pe.PE property) (dissect.executable.pe.pe.PE property) DelayedFileHandler (class in acquire.acquire.log) DelayImportDirectory (class in dissect.executable.pe.directory) (class in dissect.executable.pe.directory.delay_import) DelayImportFunction (class in dissect.executable.pe.directory.delay_import) DelayImportModule (class in dissect.executable.pe.directory.delay_import) DELEGATE (class in dissect.target.plugins.os.windows.regf.shellbags) delegate_identifier (dissect.target.plugins.os.windows.regf.shellbags.DELEGATE attribute) DELEGATE_ITEM_IDENTIFIER (in module dissect.target.plugins.os.windows.regf.shellbags) DELETABLE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) delete_expired_task_after (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) deleted (dissect.target.tools.diff.DirectoryDifferential attribute) deleted_content (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadTab attribute) delta (dissect.util.compression.lzfse.DecoderEntry attribute) (dissect.util.compression.lzfse.ValueDecoderEntry attribute) dereference() (dissect.cstruct.Pointer method) (dissect.cstruct.types.Pointer method) (dissect.cstruct.types.pointer.Pointer method) (dissect.ntfs.index.IndexEntry method) (dissect.ntfs.IndexEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) derivation (dissect.cim.cim.Class property) derive_key() (dissect.target.loaders.itunes.ITunesBackup method) (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm method) derive_passphrase_key() (in module dissect.fve.luks.luks) derive_password_hash() (in module dissect.target.plugins.os.windows.dpapi.crypto) derive_recovery_key() (in module dissect.fve.bde.key) derive_user_key() (in module dissect.fve.bde.key) DESC (acquire.acquire.acquire.ActiveDirectory attribute) (acquire.acquire.acquire.ActivitiesCache attribute) (acquire.acquire.acquire.Appcompat attribute) (acquire.acquire.acquire.AV attribute) (acquire.acquire.acquire.BITS attribute) (acquire.acquire.acquire.Bootbanks attribute) (acquire.acquire.acquire.CamHistory attribute) (acquire.acquire.acquire.Devices attribute) (acquire.acquire.acquire.DHCP attribute) (acquire.acquire.acquire.DNS attribute) (acquire.acquire.acquire.Docker attribute) (acquire.acquire.acquire.Drivers attribute) (acquire.acquire.acquire.EDR attribute) (acquire.acquire.acquire.ESXi attribute) (acquire.acquire.acquire.ETL attribute) (acquire.acquire.acquire.EventLogs attribute) (acquire.acquire.acquire.Exchange attribute) (acquire.acquire.acquire.FileHashes attribute) (acquire.acquire.acquire.History attribute) (acquire.acquire.acquire.IIS attribute) (acquire.acquire.acquire.MacOS attribute) (acquire.acquire.acquire.MacOSApplicationsInfo attribute) (acquire.acquire.acquire.Misc attribute) (acquire.acquire.acquire.Module attribute) (acquire.acquire.acquire.MSSQL attribute) (acquire.acquire.acquire.Netstat attribute) (acquire.acquire.acquire.NTFS attribute) (acquire.acquire.acquire.OpenHandles attribute) (acquire.acquire.acquire.PCA attribute) (acquire.acquire.acquire.PowerShell attribute) (acquire.acquire.acquire.Prefetch attribute) (acquire.acquire.acquire.Proc attribute) (acquire.acquire.acquire.ProcNet attribute) (acquire.acquire.acquire.QuarantinedFiles attribute) (acquire.acquire.acquire.Recents attribute) (acquire.acquire.acquire.RecycleBin attribute) (acquire.acquire.acquire.Registry attribute) (acquire.acquire.acquire.RemoteAccess attribute) (acquire.acquire.acquire.SharePoint attribute) (acquire.acquire.acquire.Startup attribute) (acquire.acquire.acquire.Sys attribute) (acquire.acquire.acquire.Syscache attribute) (acquire.acquire.acquire.TextEditor attribute) (acquire.acquire.acquire.ThumbnailCache attribute) (acquire.acquire.acquire.VMFS attribute) (acquire.acquire.acquire.WBEM attribute) (acquire.acquire.acquire.WebHosting attribute) (acquire.acquire.acquire.WER attribute) (acquire.acquire.acquire.WinArpCache attribute) (acquire.acquire.acquire.WinDnsClientCache attribute) (acquire.acquire.acquire.WindowsNotifications attribute) (acquire.acquire.acquire.WinMemDump attribute) (acquire.acquire.acquire.WinMemFiles attribute) (acquire.acquire.acquire.WinProcEnv attribute) (acquire.acquire.acquire.WinProcesses attribute) (acquire.acquire.acquire.WinRDPSessions attribute) desc (flow.record.adapter.avro.AvroReader attribute) (flow.record.adapter.avro.AvroWriter attribute) (flow.record.adapter.csvfile.CsvfileReader attribute) (flow.record.adapter.csvfile.CsvfileWriter attribute) (flow.record.adapter.xlsx.XlsxReader attribute) descendants (dissect.volume.lvm.metadata.HistoricalLogicalVolume attribute) description (dissect.database.bsd.tools.rpm.Package property) (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) (dissect.target.plugins.os.windows.regf.shellbags.NETWORK attribute) (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) (dissect.volume.lvm.LVM2 attribute) (dissect.volume.lvm.lvm2.LVM2 attribute) description() (dissect.fve.bde.BDE method) (dissect.fve.bde.bde.BDE method) DESCRIPTIONS (in module dissect.target.helpers.shell_folder_ids) Descriptor (class in dissect.hypervisor.disk.hdd) descriptor (dissect.archive.vbk.SnapshotSlot attribute) (dissect.etl.headers.event.EventHeader property) (dissect.executable.pe.directory.bound_import.BoundImportForwardReference attribute) (dissect.executable.pe.directory.bound_import.BoundImportModule attribute) (dissect.executable.pe.directory.com_descriptor.ComDescriptorDirectory property) (dissect.executable.pe.directory.ComDescriptorDirectory property) (dissect.executable.pe.directory.delay_import.DelayImportModule attribute) (dissect.executable.pe.directory.ImportModule attribute) (dissect.executable.pe.directory.imports.ImportModule attribute) (dissect.extfs.journal.DescriptorBlockTag attribute) (dissect.hypervisor.disk.hdd.HDD attribute) (dissect.hypervisor.disk.vmdk.SparseDisk attribute) (dissect.hypervisor.disk.vmdk.VMDK attribute) (dissect.vmfs.descriptor.BestEffortBlockStream attribute) (dissect.vmfs.descriptor.BlockStream attribute) (dissect.vmfs.VMFS attribute) (dissect.vmfs.vmfs.VMFS attribute) descriptor_hash (flow.record.base.RecordDescriptor property) (flow.record.RecordDescriptor property) DESCRIPTOR_MASK (dissect.eventlog.bxml.BxmlTemplateDescriptor attribute) descriptor_struct (dissect.eventlog.bxml.BxmlTemplateDescriptor attribute) descriptor_to_schema() (in module flow.record.adapter.avro) DescriptorBlock (class in dissect.extfs.journal) DescriptorBlockTag (class in dissect.extfs.journal) descriptors (dissect.archive.wim.SecurityBlock attribute) (dissect.extfs.journal.CommitBlock attribute) (dissect.volume.vss.Store attribute) (flow.record.adapter.jsonfile.JsonfileWriter attribute) (flow.record.adapter.mongo.MongoReader attribute) (flow.record.adapter.mongo.MongoWriter attribute) (flow.record.base.GroupedRecord attribute) (flow.record.GroupedRecord attribute) (flow.record.jsonpacker.JsonRecordPacker attribute) (flow.record.JsonRecordPacker attribute) (flow.record.packer.RecordPacker attribute) descriptors() (dissect.ntfs.Secure method) (dissect.ntfs.secure.Secure method) descriptors_seen (flow.record.adapter.duckdb.DuckdbReader attribute) (flow.record.adapter.duckdb.DuckdbWriter attribute) (flow.record.adapter.sqlite.SqliteReader attribute) (flow.record.adapter.sqlite.SqliteWriter attribute) descs (flow.record.adapter.xlsx.XlsxWriter attribute) (flow.record.stream.RecordStreamReader attribute) deserialize() (dissect.target.helpers.nfs.serializer.EntryPlusSerializer method) (dissect.target.helpers.nfs.serializer.FileAttributesSerializer method) (dissect.target.helpers.nfs.serializer.Lookup3ResultDeserializer method) (dissect.target.helpers.nfs.serializer.MountResultDeserializer method) (dissect.target.helpers.nfs.serializer.NfsTimeSerializer method) (dissect.target.helpers.nfs.serializer.Read3ResultDeserializer method) (dissect.target.helpers.nfs.serializer.ReadDirPlusResultDeserializer method) (dissect.target.helpers.nfs.serializer.ReadLink3ResultDeserializer method) (dissect.target.helpers.nfs.serializer.ResultDeserializer method) (dissect.target.helpers.nfs.serializer.SpecDataSerializer method) (dissect.target.helpers.sunrpc.serializer.AuthSerializer method) (dissect.target.helpers.sunrpc.serializer.Deserializer method) (dissect.target.helpers.sunrpc.serializer.Int32Serializer method) (dissect.target.helpers.sunrpc.serializer.MessageSerializer method) (dissect.target.helpers.sunrpc.serializer.OpaqueVarLengthSerializer method) (dissect.target.helpers.sunrpc.serializer.StringSerializer method) deserialize_from_bytes() (dissect.target.helpers.sunrpc.serializer.Deserializer method) Deserializer (class in dissect.target.helpers.sunrpc.serializer) DESKTOP (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) desktop_files (dissect.target.plugins.os.unix.applications.UnixApplicationsPlugin attribute) DEST_DIR_CACHE_SIZE (in module dissect.target.tools.dump) DEST_FILENAME_CACHE_SIZE (in module dissect.target.tools.dump) details (acquire.acquire.collector.Record attribute) (dissect.volume.dm.thin.ThinDevice attribute) detect() (dissect.target.container.Container class method) (dissect.target.filesystem.Filesystem class method) (dissect.target.filesystem.LayerFilesystem static method) (dissect.target.filesystem.RootFilesystem static method) (dissect.target.filesystem.VirtualFilesystem static method) (dissect.target.filesystems.cb.CbFilesystem static method) (dissect.target.filesystems.nfs.NfsFilesystem static method) (dissect.target.filesystems.smb.SmbFilesystem static method) (dissect.target.loader.Loader static method) (dissect.target.loaders.ab.AndroidBackupLoader static method) (dissect.target.loaders.acquire.AcquireTarSubLoader static method) (dissect.target.loaders.acquire.AcquireZipSubLoader static method) (dissect.target.loaders.asdf.AsdfLoader static method) (dissect.target.loaders.cb.CbLoader static method) (dissect.target.loaders.cellebrite.CellebriteLoader static method) (dissect.target.loaders.containerimage.ContainerImageTarSubLoader static method) (dissect.target.loaders.cyber.CyberLoader static method) (dissect.target.loaders.dir.DirLoader static method) (dissect.target.loaders.direct.DirectLoader static method) (dissect.target.loaders.hyperv.HyperVLoader static method) (dissect.target.loaders.itunes.ITunesLoader static method) (dissect.target.loaders.kape.KapeLoader static method) (dissect.target.loaders.libvirt.LibvirtLoader static method) (dissect.target.loaders.local.LocalLoader static method) (dissect.target.loaders.log.LogLoader static method) (dissect.target.loaders.mqtt.MqttLoader static method) (dissect.target.loaders.multiraw.MultiRawLoader static method) (dissect.target.loaders.ova.OvaLoader static method) (dissect.target.loaders.overlay.OverlayLoader static method) (dissect.target.loaders.overlay2.Overlay2Loader static method) (dissect.target.loaders.ovf.OvfLoader static method) (dissect.target.loaders.phobos.PhobosLoader static method) (dissect.target.loaders.profile.ProfileLoader static method) (dissect.target.loaders.profile.ProfileOSPlugin class method) (dissect.target.loaders.proxmox.ProxmoxLoader static method) (dissect.target.loaders.pvm.PvmLoader static method) (dissect.target.loaders.pvs.PvsLoader static method) (dissect.target.loaders.raw.RawLoader static method) (dissect.target.loaders.remote.RemoteLoader static method) (dissect.target.loaders.res.ResLoader static method) (dissect.target.loaders.res.ResOSPlugin class method) (dissect.target.loaders.smb.SmbLoader static method) (dissect.target.loaders.tanium.TaniumLoader static method) (dissect.target.loaders.tar.GenericTarSubLoader static method) (dissect.target.loaders.tar.TarLoader static method) (dissect.target.loaders.tar.TarSubLoader static method) (dissect.target.loaders.target.TargetLoader static method) (dissect.target.loaders.uac.UacLoader static method) (dissect.target.loaders.uac.UacTarSubloader static method) (dissect.target.loaders.uac.UacZipSubLoader static method) (dissect.target.loaders.utm.UtmLoader static method) (dissect.target.loaders.vb.VBLoader static method) (dissect.target.loaders.vbk.VbkLoader static method) (dissect.target.loaders.vbox.VBoxLoader static method) (dissect.target.loaders.velociraptor.VelociraptorLoader static method) (dissect.target.loaders.vma.VmaLoader static method) (dissect.target.loaders.vmwarevm.VmwarevmLoader static method) (dissect.target.loaders.vmx.VmxLoader static method) (dissect.target.loaders.xva.XvaLoader static method) (dissect.target.loaders.zip.GenericZipSubLoader static method) (dissect.target.loaders.zip.ZipLoader static method) (dissect.target.loaders.zip.ZipSubLoader static method) (dissect.target.plugin.OSPlugin class method) (dissect.target.plugins.os.default._os.DefaultOSPlugin class method) (dissect.target.plugins.os.unix._os.UnixPlugin class method) (dissect.target.plugins.os.unix.bsd._os.BsdPlugin class method) (dissect.target.plugins.os.unix.bsd.citrix._os.CitrixPlugin class method) (dissect.target.plugins.os.unix.bsd.darwin._os.DarwinPlugin class method) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin class method) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin class method) (dissect.target.plugins.os.unix.bsd.freebsd._os.FreeBsdPlugin class method) (dissect.target.plugins.os.unix.bsd.openbsd._os.OpenBsdPlugin class method) (dissect.target.plugins.os.unix.esxi._os.ESXiPlugin class method) (dissect.target.plugins.os.unix.linux._os.LinuxPlugin class method) (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin class method) (dissect.target.plugins.os.unix.linux.debian._os.DebianPlugin class method) (dissect.target.plugins.os.unix.linux.debian.proxmox._os.ProxmoxPlugin class method) (dissect.target.plugins.os.unix.linux.debian.vyos._os.VyosPlugin class method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSPlugin class method) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager method) (dissect.target.plugins.os.unix.linux.redhat._os.RedHatPlugin class method) (dissect.target.plugins.os.unix.linux.suse._os.SuSEPlugin class method) (dissect.target.plugins.os.windows._os.WindowsPlugin class method) (dissect.target.volume.VolumeSystem class method) detect_fh() (dissect.target.container.Container class method) (dissect.target.containers.fortifw.FortiFirmwareContainer static method) detect_header() (in module dissect.util.cpio) detect_id() (dissect.target.filesystem.Filesystem class method) detect_macho_arch() (in module dissect.target.plugins.os.unix.bsd.darwin._os) detect_path() (dissect.target.container.Container static method) (dissect.target.containers.asdf.AsdfContainer static method) (dissect.target.containers.asif.AsifContainer static method) (dissect.target.containers.ewf.EwfContainer static method) (dissect.target.containers.fortifw.FortiFirmwareContainer static method) (dissect.target.containers.hdd.HddContainer static method) (dissect.target.containers.hds.HdsContainer static method) (dissect.target.containers.qcow2.QCow2Container static method) (dissect.target.containers.raw.RawContainer static method) (dissect.target.containers.split.SplitContainer static method) (dissect.target.containers.vdi.VdiContainer static method) (dissect.target.containers.vhd.VhdContainer static method) (dissect.target.containers.vhdx.VhdxContainer static method) (dissect.target.containers.vmdk.VmdkContainer static method) detect_volume() (dissect.target.volume.LogicalVolumeSystem class method) detection_globs (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager attribute) detection_name (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntry attribute) detection_path (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntryResource attribute) detection_type (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntryResource attribute) dev (dissect.volume.lvm.metadata.PhysicalVolume property) DEV_BSIZE (in module dissect.ffs.ffs) dev_size (dissect.volume.lvm.metadata.PhysicalVolume attribute) dev_start (dissect.volume.raid.stream.Zone attribute) dev_uuid (dissect.btrfs.stream.Stripe attribute) DEVICE (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) Device (class in dissect.archive.vma) (class in dissect.vmfs) (class in dissect.vmfs.lvm) device (dissect.archive.vma.DeviceDataStream attribute) (dissect.target.loaders.cellebrite.Ufd attribute) (dissect.target.loaders.cellebrite.Ufdx attribute) (dissect.volume.lvm.metadata.PhysicalVolume attribute) device() (dissect.archive.vma.VMA method) device_containers() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) device_count (dissect.volume.lvm.metadata.RAIDSegment attribute) device_details (dissect.volume.dm.thin.Metadata attribute) device_id (dissect.volume.dm.thin.ThinDevice attribute) (dissect.volume.lvm.metadata.PhysicalVolume attribute) (dissect.volume.lvm.metadata.ThinSegment attribute) device_id_type (dissect.volume.lvm.metadata.PhysicalVolume attribute) device_identifier (dissect.hypervisor.disk.vmdk.ExtentDescriptor attribute) DEVICE_SUBST (in module acquire.acquire.utils) DeviceDataStream (class in dissect.archive.vma) DeviceInfo (class in dissect.target.loaders.cellebrite) Devices (class in acquire.acquire.acquire) devices (dissect.btrfs.Btrfs attribute) (dissect.btrfs.btrfs.Btrfs attribute) (dissect.vmfs.LVM attribute) (dissect.vmfs.lvm.LVM attribute) (dissect.vmfs.lvm.Volume attribute) (dissect.vmfs.Volume attribute) (dissect.volume.lvm.LVM2 attribute) (dissect.volume.lvm.lvm2.LVM2 attribute) (dissect.volume.raid.stream.Zone attribute) devices() (dissect.archive.vma.VMA method) devid (dissect.btrfs.stream.Stripe attribute) DGP (dissect.target.helpers.network.IANAProtocol attribute) DGRAM (dissect.target.plugins.os.unix.linux.proc.Sockets.SocketStreamType attribute) DhclientLeaseParser (class in dissect.target.plugins.os.unix.linux.network) DHCP (class in acquire.acquire.acquire) dhcp (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager property) dhcp() (dissect.target.plugins.os.unix.linux._os.LinuxPlugin method) (dissect.target.plugins.os.unix.linux.network.LinuxNetworkPlugin method) dhcp_ipv4 (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) dhcp_ipv6 (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) DhcpLease (class in dissect.target.plugins.os.unix.linux.network) dialect (flow.record.adapter.csvfile.CsvfileReader attribute) dialog (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) dialog_include (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) dict_data (dissect.target.plugins.os.unix.locate.plocate.PLocateFile attribute) dictionary (acquire.acquire.dynamic.windows.types.Handle property) dictlist (class in flow.record.fieldtypes) diff (dissect.target.tools.diff.DifferentialEntry attribute) DifferentialCli (class in dissect.target.tools.diff) DifferentialEntry (class in dissect.target.tools.diff) differentiate_plugin_outputs() (dissect.target.tools.diff.TargetComparison method) differentiate_target_filesystems() (in module dissect.target.tools.diff) differentiate_target_plugin_outputs() (in module dissect.target.tools.diff) diffuse() (in module dissect.fve.luks.af) diffuser_a_decrypt() (in module dissect.fve.crypto.elephant) diffuser_a_encrypt() (in module dissect.fve.crypto.elephant) diffuser_b_decrypt() (in module dissect.fve.crypto.elephant) diffuser_b_encrypt() (in module dissect.fve.crypto.elephant) digest (acquire.acquire.tools.decrypter.EncryptedFile attribute) Digest (class in dissect.fve.luks.metadata) digest (class in flow.record.fieldtypes) (dissect.archive.vbk.FibBlockDescriptor property) (dissect.archive.vbk.StgBlockDescriptor property) (dissect.database.bsd.tools.rpm.PackageEntry attribute) (dissect.fve.luks.metadata.Digest attribute) (dissect.hypervisor.util.envelope.Envelope attribute) digest() (dissect.evidence.asdf.streams.Crc32Stream method) (dissect.evidence.asdf.streams.HashedStream method) digest_length (dissect.target.plugins.os.windows.dpapi.crypto.HashAlgorithm attribute) DIGEST_NEEDLES (in module dissect.target.plugins.os.windows.catroot) DIGEST_SIZE (in module dissect.fve.luks.af) digests (dissect.fve.luks.metadata.Metadata attribute) DIGIT (dissect.database.ese.lcmapstring.SCRIPT attribute) digit() (dissect.cstruct.expression.ExpressionTokenizer method) DIGITAL_WRAPPER_OVERHEAD_CHANNEL (dissect.target.plugins.os.windows.network.IfTypes attribute) DIGITALPOWERLINE (dissect.target.plugins.os.windows.network.IfTypes attribute) DIR (acquire.acquire.collector.ArtifactType attribute) (dissect.target.helpers.nfs.nfs3.FileType attribute) dir (dissect.target.helpers.nfs.nfs3.ReadDirPlusParams attribute) dir_attributes (dissect.target.helpers.nfs.client.nfs.ReadDirResult attribute) (dissect.target.helpers.nfs.nfs3.LookupResult attribute) (dissect.target.helpers.nfs.nfs3.ReadDirPlusResult attribute) DIR_COUNT (dissect.target.helpers.nfs.client.mount.Client attribute) (dissect.target.helpers.nfs.client.nfs.Client attribute) dir_count (dissect.target.helpers.nfs.nfs3.ReadDirPlusParams attribute) DIR_ENTRY_SIZE (in module dissect.fat.c_exfat) dir_extensions (acquire.acquire.acquire.History.DirCombinations attribute) dir_handles (dissect.target.helpers.mount.DissectMount attribute) dir_path (dissect.target.plugins.general.config.ConfigurationTreePlugin attribute) direction (dissect.fve.luks.metadata.Keyslot attribute) DirectLoader (class in dissect.target.loaders.direct) directories (dissect.hypervisor.disk.asif.ASIF attribute) DIRECTORY (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) Directory (class in dissect.database.bsd.tools.rpm) (class in dissect.hypervisor.disk.asif) directory (dissect.executable.pe.directory.bound_import.BoundImportForwardReference attribute) (dissect.executable.pe.directory.bound_import.BoundImportModule attribute) (dissect.executable.pe.directory.export.ExportFunction attribute) (dissect.hypervisor.disk.asif.DataStream attribute) (dissect.hypervisor.disk.asif.Table attribute) (dissect.target.tools.diff.DirectoryDifferential attribute) directory() (dissect.ole.OLE method) (dissect.ole.ole.OLE method) DIRECTORY_ALL_ACCESS (acquire.acquire.dynamic.windows.ntdll.ACCESS_MASK attribute) DIRECTORY_CREATE_OBJECT (acquire.acquire.dynamic.windows.ntdll.ACCESS_MASK attribute) DIRECTORY_CREATE_SUBDIRECTORY (acquire.acquire.dynamic.windows.ntdll.ACCESS_MASK attribute) DIRECTORY_MAPPING (in module dissect.target.loaders.ab) DIRECTORY_QUERY (acquire.acquire.dynamic.windows.ntdll.ACCESS_MASK attribute) DIRECTORY_TRAVERSE (acquire.acquire.dynamic.windows.ntdll.ACCESS_MASK attribute) DirectoryDifferential (class in dissect.target.tools.diff) DirectoryEntry (class in dissect.apfs.objects.fs) (class in dissect.archive.wim) (class in dissect.fat.fat) (class in dissect.ole.ole) DirectoryFilesystem (class in dissect.target.filesystems.dir) DirectoryFilesystemEntry (class in dissect.target.filesystems.dir) DirectoryOutput (class in acquire.acquire.outputs.dir) dirent (dissect.fat.fat.DirectoryEntry attribute) DirEntry (class in dissect.jffs.jffs2) (class in dissect.vmfs) (class in dissect.vmfs.descriptor) DirItem (class in dissect.archive.vbk) dirlist (dissect.cramfs.cramfs.INode attribute) (dissect.cramfs.INode attribute) (dissect.extfs.extfs.INode attribute) (dissect.extfs.INode attribute) (dissect.xfs.xfs.INode attribute) DirLoader (class in dissect.target.loaders.dir) dirname (flow.record.fieldtypes.uri property) dirname() (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.polypath) DirOpArgs (class in dissect.target.helpers.nfs.nfs3) DirOpArgs3Serializer (class in dissect.target.helpers.nfs.serializer) DIRS (dissect.target.plugins.apps.av.mcafee.McAfeePlugin attribute) (dissect.target.plugins.apps.browser.brave.BravePlugin attribute) (dissect.target.plugins.apps.browser.chrome.ChromePlugin attribute) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin attribute) (dissect.target.plugins.apps.browser.chromium.ChromiumPlugin attribute) (dissect.target.plugins.apps.browser.edge.EdgePlugin attribute) (dissect.target.plugins.apps.browser.iexplore.InternetExplorerPlugin attribute) dirs (dissect.target.plugins.os.windows.adpolicy.ADPolicyPlugin attribute) dirty (dissect.regf.regf.RegistryHive attribute) (dissect.regf.RegistryHive attribute) DIRTY_NEEDLE (in module dissect.eventlog.evt) disallow_start_on_batteries (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) disallow_start_on_remote_app_session (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) discards (dissect.volume.lvm.metadata.ThinPoolSegment attribute) discover() (dissect.target.plugins.os.unix.linux.network_managers.LinuxNetworkManager method) Disk (class in dissect.hypervisor.disk.vhd) (class in dissect.volume.disk) (class in dissect.volume.disk.disk) disk (dissect.target.volume.Volume attribute) (dissect.target.volume.VolumeSystem attribute) (dissect.volume.disk.Partition attribute) (dissect.volume.disk.partition.Partition attribute) (in module dissect.target.volume) disk() (dissect.target.loaders.mqtt.Broker method) DISK_DRIVE_XPATH (dissect.hypervisor.descriptor.ovf.OVF attribute) disk_id (dissect.target.loaders.mqtt.MqttStream attribute) (dissect.target.loaders.remote.RemoteStream attribute) DISK_INDEX_OFFSET (in module dissect.target.loaders.mqtt) disk_length (dissect.btrfs.stream.Extent attribute) disk_map (dissect.volume.raid.raid.VirtualDisk attribute) (dissect.volume.raid.stream.LinearStream attribute) (dissect.volume.raid.stream.RAID0Stream attribute) (dissect.volume.raid.stream.RAID10Stream attribute) (dissect.volume.raid.stream.RAID456Stream attribute) disk_offset (dissect.btrfs.stream.Extent attribute) DISK_XPATH (dissect.hypervisor.descriptor.ovf.OVF attribute) DiskCollection (class in dissect.target.target) DiskDescriptor (class in dissect.hypervisor.disk.vmdk) DiskError, [1] diskinfo (dissect.target.loaders.mqtt.Broker attribute) DiskIoGuid (in module dissect.etl.utils) DiskMap (in module dissect.volume.raid.raid) DiskMessage (class in dissect.target.loaders.mqtt) disks (dissect.hypervisor.disk.vmdk.VMDK attribute) (dissect.target.loaders.mqtt.InfoMessage attribute) (dissect.target.Target attribute) (dissect.target.target.Target attribute) (dissect.volume.ddf.ddf.DDFVirtualDisk attribute) disks() (dissect.archive.xva.XVA method) (dissect.evidence.asdf.asdf.AsdfSnapshot method) (dissect.evidence.asdf.AsdfSnapshot method) (dissect.evidence.AsdfSnapshot method) (dissect.hypervisor.descriptor.ovf.OVF method) (dissect.hypervisor.descriptor.pvs.PVS method) (dissect.hypervisor.descriptor.vbox.VBox method) (dissect.hypervisor.descriptor.vmx.VMX method) DISORG (dissect.volume.vinum.config.PlexOrg attribute) DISPLACEMENT_TABLE (in module dissect.util.compression.lznt1) display (dissect.target.plugins.os.windows.datetime.WindowsTimezone attribute) display() (dissect.target.loaders.mqtt.MqttDiagnosticLine method) display_name (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) display_power (dissect.target.plugins.os.windows.regf.cit.SystemDataBitmaps attribute) display_request_change (dissect.target.plugins.os.windows.regf.cit.SystemDataBitmaps attribute) DISPLAY_TZINFO (in module flow.record.fieldtypes) dissect.apfs module dissect.apfs.apfs module dissect.apfs.c_apfs module dissect.apfs.cursor module dissect.apfs.exception module dissect.apfs.objects module dissect.apfs.objects.base module dissect.apfs.objects.btree module dissect.apfs.objects.btree_node module dissect.apfs.objects.checkpoint_map module dissect.apfs.objects.efi_jumpstart module dissect.apfs.objects.er_recovery_block module dissect.apfs.objects.er_state module dissect.apfs.objects.fs module dissect.apfs.objects.gbitmap module dissect.apfs.objects.gbitmap_block module dissect.apfs.objects.integrity_meta module dissect.apfs.objects.keybag module dissect.apfs.objects.nx_fusion_wbc module dissect.apfs.objects.nx_fusion_wbc_list module dissect.apfs.objects.nx_reap_list module dissect.apfs.objects.nx_reaper module dissect.apfs.objects.nx_superblock module dissect.apfs.objects.omap module dissect.apfs.objects.snap_meta_ext module dissect.apfs.objects.spaceman module dissect.apfs.objects.spaceman_bitmap module dissect.apfs.objects.spaceman_cab module dissect.apfs.objects.spaceman_cib module dissect.apfs.stream module dissect.apfs.util module dissect.archive module dissect.archive.c_vbk module dissect.archive.c_vma module dissect.archive.c_wim module dissect.archive.exceptions module dissect.archive.tools module dissect.archive.tools.backup module dissect.archive.vbk module dissect.archive.vma module dissect.archive.wim module dissect.archive.xva module dissect.btrfs module dissect.btrfs.btrfs module dissect.btrfs.c_btrfs module dissect.btrfs.exceptions module dissect.btrfs.stream module dissect.btrfs.tree module dissect.cim module dissect.cim.c_cim module dissect.cim.cim module dissect.cim.classes module dissect.cim.exceptions module dissect.cim.index module dissect.cim.mappings module dissect.cim.objects module dissect.cim.utils module dissect.clfs module dissect.clfs.blf module dissect.clfs.c_clfs module dissect.clfs.container module dissect.clfs.exceptions module dissect.cramfs module dissect.cramfs.c_cramfs module dissect.cramfs.cramfs module dissect.cramfs.exception module dissect.cstruct module dissect.cstruct.bitbuffer module dissect.cstruct.compiler module dissect.cstruct.cstruct module dissect.cstruct.exceptions module dissect.cstruct.expression module dissect.cstruct.parser module dissect.cstruct.tools module dissect.cstruct.tools.stubgen module dissect.cstruct.types module dissect.cstruct.types.base module dissect.cstruct.types.char module dissect.cstruct.types.enum module dissect.cstruct.types.flag module dissect.cstruct.types.int module dissect.cstruct.types.leb128 module dissect.cstruct.types.packed module dissect.cstruct.types.pointer module dissect.cstruct.types.structure module dissect.cstruct.types.void module dissect.cstruct.types.wchar module dissect.cstruct.utils module dissect.database module dissect.database.bsd module dissect.database.bsd.c_db module dissect.database.bsd.db module dissect.database.bsd.tools module dissect.database.bsd.tools.c_rpm module dissect.database.bsd.tools.rpm module dissect.database.ese module dissect.database.ese.btree module dissect.database.ese.c_ese module dissect.database.ese.compression module dissect.database.ese.cursor module dissect.database.ese.ese module dissect.database.ese.exception module dissect.database.ese.index module dissect.database.ese.lcmapstring module dissect.database.ese.page module dissect.database.ese.record module dissect.database.ese.sorting_table module dissect.database.ese.table module dissect.database.ese.tools module dissect.database.ese.tools.certlog module dissect.database.ese.tools.impacket module dissect.database.ese.tools.sru module dissect.database.ese.tools.ual module dissect.database.ese.util module dissect.database.exception module dissect.database.sqlite3 module dissect.database.sqlite3.c_sqlite3 module dissect.database.sqlite3.exception module dissect.database.sqlite3.sqlite3 module dissect.database.sqlite3.util module dissect.etl module dissect.etl.c_etl module dissect.etl.etl module dissect.etl.exceptions module dissect.etl.headers module dissect.etl.headers.event module dissect.etl.headers.headers module dissect.etl.headers.logfile module dissect.etl.headers.system module dissect.etl.headers.utils module dissect.etl.manifest module dissect.etl.manifests module dissect.etl.utils module dissect.eventlog module dissect.eventlog.bxml module dissect.eventlog.evt module dissect.eventlog.evtx module dissect.eventlog.exceptions module dissect.eventlog.utils module dissect.eventlog.wevt module dissect.eventlog.wevt_object module dissect.eventlog.wevtutil module dissect.evidence module dissect.evidence.ad1 module dissect.evidence.aff4 module dissect.evidence.asdf module dissect.evidence.asdf.asdf module dissect.evidence.asdf.streams module dissect.evidence.ewf module dissect.evidence.exceptions module dissect.evidence.tools module dissect.evidence.tools.asdf module dissect.evidence.tools.asdf.dd module dissect.evidence.tools.asdf.meta module dissect.evidence.tools.asdf.repair module dissect.evidence.tools.asdf.verify module dissect.executable module dissect.executable.elf module dissect.executable.elf.c_elf module dissect.executable.elf.elf module dissect.executable.exception module dissect.executable.macho module dissect.executable.pe module dissect.executable.pe.c_pe module dissect.executable.pe.directory module dissect.executable.pe.directory.base module dissect.executable.pe.directory.basereloc module dissect.executable.pe.directory.bound_import module dissect.executable.pe.directory.com_descriptor module dissect.executable.pe.directory.debug module dissect.executable.pe.directory.delay_import module dissect.executable.pe.directory.exception module dissect.executable.pe.directory.export module dissect.executable.pe.directory.iat module dissect.executable.pe.directory.imports module dissect.executable.pe.directory.load_config module dissect.executable.pe.directory.resource module dissect.executable.pe.directory.security module dissect.executable.pe.directory.tls module dissect.executable.pe.locale_id module dissect.executable.pe.pe module dissect.extfs module dissect.extfs.c_ext module dissect.extfs.c_jdb2 module dissect.extfs.exceptions module dissect.extfs.extfs module dissect.extfs.journal module dissect.fat module dissect.fat.c_exfat module dissect.fat.c_fat module dissect.fat.exceptions module dissect.fat.exfat module dissect.fat.fat module dissect.ffs module dissect.ffs.c_ffs module dissect.ffs.exceptions module dissect.ffs.ffs module dissect.fve module dissect.fve.bde module dissect.fve.bde.bde module dissect.fve.bde.c_bde module dissect.fve.bde.eow module dissect.fve.bde.information module dissect.fve.bde.key module dissect.fve.crypto module dissect.fve.crypto.argon2 module dissect.fve.crypto.base module dissect.fve.crypto.dmcrypt module dissect.fve.crypto.elephant module dissect.fve.crypto.util module dissect.fve.exception module dissect.fve.luks module dissect.fve.luks.af module dissect.fve.luks.c_luks module dissect.fve.luks.luks module dissect.fve.luks.metadata module dissect.fve.tools module dissect.fve.tools.dd module dissect.hypervisor module dissect.hypervisor.descriptor module dissect.hypervisor.descriptor.c_hyperv module dissect.hypervisor.descriptor.hyperv module dissect.hypervisor.descriptor.ovf module dissect.hypervisor.descriptor.pvs module dissect.hypervisor.descriptor.vbox module dissect.hypervisor.descriptor.vmx module dissect.hypervisor.disk module dissect.hypervisor.disk.asif module dissect.hypervisor.disk.c_asif module dissect.hypervisor.disk.c_hdd module dissect.hypervisor.disk.c_qcow2 module dissect.hypervisor.disk.c_vdi module dissect.hypervisor.disk.c_vhd module dissect.hypervisor.disk.c_vhdx module dissect.hypervisor.disk.c_vmdk module dissect.hypervisor.disk.hdd module dissect.hypervisor.disk.qcow2 module dissect.hypervisor.disk.vdi module dissect.hypervisor.disk.vhd module dissect.hypervisor.disk.vhdx module dissect.hypervisor.disk.vmdk module dissect.hypervisor.exceptions module dissect.hypervisor.tools module dissect.hypervisor.tools.envelope module dissect.hypervisor.tools.vmtar module dissect.hypervisor.util module dissect.hypervisor.util.envelope module dissect.hypervisor.util.vmtar module dissect.jffs module dissect.jffs.c_jffs2 module dissect.jffs.exceptions module dissect.jffs.jffs2 module dissect.ntfs module dissect.ntfs.attr module dissect.ntfs.c_ntfs module dissect.ntfs.exceptions module dissect.ntfs.index module dissect.ntfs.mft module dissect.ntfs.ntfs module dissect.ntfs.secure module dissect.ntfs.stream module dissect.ntfs.usnjrnl module dissect.ntfs.util module dissect.ole module dissect.ole.c_ole module dissect.ole.exceptions module dissect.ole.ole module dissect.qnxfs module dissect.qnxfs.c_qnx4 module dissect.qnxfs.c_qnx6 module dissect.qnxfs.exceptions module dissect.qnxfs.qnx4 module dissect.qnxfs.qnx6 module dissect.qnxfs.qnxfs module dissect.regf module dissect.regf.c_regf module dissect.regf.exceptions module dissect.regf.regf module dissect.shellitem module dissect.shellitem.lnk module dissect.shellitem.lnk.c_lnk module dissect.shellitem.lnk.lnk module dissect.shellitem.tools module dissect.shellitem.tools.lnk module dissect.squashfs module dissect.squashfs.c_squashfs module dissect.squashfs.compression module dissect.squashfs.exceptions module dissect.squashfs.squashfs module dissect.target module dissect.target.container module dissect.target.containers module dissect.target.containers.asdf module dissect.target.containers.asif module dissect.target.containers.ewf module dissect.target.containers.fortifw module dissect.target.containers.hdd module dissect.target.containers.hds module dissect.target.containers.qcow2 module dissect.target.containers.raw module dissect.target.containers.split module dissect.target.containers.vdi module dissect.target.containers.vhd module dissect.target.containers.vhdx module dissect.target.containers.vmdk module dissect.target.exceptions module dissect.target.filesystem module dissect.target.filesystems module dissect.target.filesystems.ad1 module dissect.target.filesystems.btrfs module dissect.target.filesystems.cb module dissect.target.filesystems.config module dissect.target.filesystems.cpio module dissect.target.filesystems.cramfs module dissect.target.filesystems.dir module dissect.target.filesystems.exfat module dissect.target.filesystems.extfs module dissect.target.filesystems.fat module dissect.target.filesystems.ffs module dissect.target.filesystems.itunes module dissect.target.filesystems.jffs module dissect.target.filesystems.nfs module dissect.target.filesystems.ntfs module dissect.target.filesystems.overlay module dissect.target.filesystems.qnxfs module dissect.target.filesystems.smb module dissect.target.filesystems.squashfs module dissect.target.filesystems.tar module dissect.target.filesystems.vbk module dissect.target.filesystems.vmfs module dissect.target.filesystems.vmtar module dissect.target.filesystems.xfs module dissect.target.filesystems.zip module dissect.target.helpers module dissect.target.helpers.cache module dissect.target.helpers.compat module dissect.target.helpers.compat.path_310 module dissect.target.helpers.compat.path_311 module dissect.target.helpers.compat.path_312 module dissect.target.helpers.compat.path_313 module dissect.target.helpers.compat.path_common module dissect.target.helpers.config module dissect.target.helpers.configutil module dissect.target.helpers.cyber module dissect.target.helpers.descriptor_extensions module dissect.target.helpers.docs module dissect.target.helpers.fsutil module dissect.target.helpers.hashutil module dissect.target.helpers.keychain module dissect.target.helpers.lazy module dissect.target.helpers.loaderutil module dissect.target.helpers.localeutil module dissect.target.helpers.logging module dissect.target.helpers.mount module dissect.target.helpers.mui module dissect.target.helpers.network module dissect.target.helpers.nfs module dissect.target.helpers.nfs.client module dissect.target.helpers.nfs.client.mount module dissect.target.helpers.nfs.client.nfs module dissect.target.helpers.nfs.nfs3 module dissect.target.helpers.nfs.serializer module dissect.target.helpers.polypath module dissect.target.helpers.protobuf module dissect.target.helpers.record module dissect.target.helpers.record_modifier module dissect.target.helpers.regex module dissect.target.helpers.regex.ipaddress module dissect.target.helpers.regutil module dissect.target.helpers.scrape module dissect.target.helpers.shell_application_ids module dissect.target.helpers.shell_folder_ids module dissect.target.helpers.sunrpc module dissect.target.helpers.sunrpc.client module dissect.target.helpers.sunrpc.serializer module dissect.target.helpers.sunrpc.sunrpc module dissect.target.helpers.utils module dissect.target.loader module dissect.target.loaders module dissect.target.loaders.ab module dissect.target.loaders.acquire module dissect.target.loaders.asdf module dissect.target.loaders.cb module dissect.target.loaders.cellebrite module dissect.target.loaders.containerimage module dissect.target.loaders.cyber module dissect.target.loaders.dir module dissect.target.loaders.direct module dissect.target.loaders.hyperv module dissect.target.loaders.itunes module dissect.target.loaders.kape module dissect.target.loaders.libvirt module dissect.target.loaders.local module dissect.target.loaders.log module dissect.target.loaders.mqtt module dissect.target.loaders.multiraw module dissect.target.loaders.ova module dissect.target.loaders.overlay module dissect.target.loaders.overlay2 module dissect.target.loaders.ovf module dissect.target.loaders.phobos module dissect.target.loaders.profile module dissect.target.loaders.proxmox module dissect.target.loaders.pvm module dissect.target.loaders.pvs module dissect.target.loaders.raw module dissect.target.loaders.remote module dissect.target.loaders.res module dissect.target.loaders.smb module dissect.target.loaders.tanium module dissect.target.loaders.tar module dissect.target.loaders.target module dissect.target.loaders.uac module dissect.target.loaders.utm module dissect.target.loaders.vb module dissect.target.loaders.vbk module dissect.target.loaders.vbox module dissect.target.loaders.velociraptor module dissect.target.loaders.vma module dissect.target.loaders.vmwarevm module dissect.target.loaders.vmx module dissect.target.loaders.xva module dissect.target.loaders.zip module dissect.target.plugin module dissect.target.plugins module dissect.target.plugins.apps module dissect.target.plugins.apps.av module dissect.target.plugins.apps.av.mcafee module dissect.target.plugins.apps.av.sophos module dissect.target.plugins.apps.av.symantec module dissect.target.plugins.apps.av.trendmicro module dissect.target.plugins.apps.browser module dissect.target.plugins.apps.browser.brave module dissect.target.plugins.apps.browser.browser module dissect.target.plugins.apps.browser.chrome module dissect.target.plugins.apps.browser.chromium module dissect.target.plugins.apps.browser.edge module dissect.target.plugins.apps.browser.firefox module dissect.target.plugins.apps.browser.iexplore module dissect.target.plugins.apps.chat module dissect.target.plugins.apps.chat.chat module dissect.target.plugins.apps.chat.msn module dissect.target.plugins.apps.container module dissect.target.plugins.apps.container.container module dissect.target.plugins.apps.container.docker module dissect.target.plugins.apps.container.podman module dissect.target.plugins.apps.editor module dissect.target.plugins.apps.editor.editor module dissect.target.plugins.apps.editor.windowsnotepad module dissect.target.plugins.apps.edr module dissect.target.plugins.apps.edr.acquire module dissect.target.plugins.apps.edr.velociraptor module dissect.target.plugins.apps.other module dissect.target.plugins.apps.other.env module dissect.target.plugins.apps.productivity module dissect.target.plugins.apps.productivity.msoffice module dissect.target.plugins.apps.productivity.sevenzip module dissect.target.plugins.apps.productivity.winrar module dissect.target.plugins.apps.remoteaccess module dissect.target.plugins.apps.remoteaccess.anydesk module dissect.target.plugins.apps.remoteaccess.remoteaccess module dissect.target.plugins.apps.remoteaccess.rustdesk module dissect.target.plugins.apps.remoteaccess.splashtop module dissect.target.plugins.apps.remoteaccess.teamviewer module dissect.target.plugins.apps.shell module dissect.target.plugins.apps.shell.powershell module dissect.target.plugins.apps.shell.wget module dissect.target.plugins.apps.ssh module dissect.target.plugins.apps.ssh.openssh module dissect.target.plugins.apps.ssh.opensshd module dissect.target.plugins.apps.ssh.putty module dissect.target.plugins.apps.ssh.ssh module dissect.target.plugins.apps.virtualization module dissect.target.plugins.apps.virtualization.vmware_workstation module dissect.target.plugins.apps.vpn module dissect.target.plugins.apps.vpn.openvpn module dissect.target.plugins.apps.vpn.wireguard module dissect.target.plugins.apps.webhosting module dissect.target.plugins.apps.webhosting.cpanel module dissect.target.plugins.apps.webserver module dissect.target.plugins.apps.webserver.apache module dissect.target.plugins.apps.webserver.caddy module dissect.target.plugins.apps.webserver.citrix module dissect.target.plugins.apps.webserver.iis module dissect.target.plugins.apps.webserver.nginx module dissect.target.plugins.apps.webserver.webserver module dissect.target.plugins.child module dissect.target.plugins.child.colima module dissect.target.plugins.child.docker module dissect.target.plugins.child.esxi module dissect.target.plugins.child.hyperv module dissect.target.plugins.child.lima module dissect.target.plugins.child.parallels module dissect.target.plugins.child.podman module dissect.target.plugins.child.proxmox module dissect.target.plugins.child.qemu module dissect.target.plugins.child.virtualbox module dissect.target.plugins.child.virtuozzo module dissect.target.plugins.child.vmware_workstation module dissect.target.plugins.child.wsl module dissect.target.plugins.filesystem module dissect.target.plugins.filesystem.icat module dissect.target.plugins.filesystem.ntfs module dissect.target.plugins.filesystem.ntfs.mft module dissect.target.plugins.filesystem.ntfs.mft_timeline module dissect.target.plugins.filesystem.ntfs.usnjrnl module dissect.target.plugins.filesystem.ntfs.utils module dissect.target.plugins.filesystem.resolver module dissect.target.plugins.filesystem.unix module dissect.target.plugins.filesystem.unix.capability module dissect.target.plugins.filesystem.unix.suid module dissect.target.plugins.filesystem.walkfs module dissect.target.plugins.filesystem.yara module dissect.target.plugins.general module dissect.target.plugins.general.config module dissect.target.plugins.general.example module dissect.target.plugins.general.loaders module dissect.target.plugins.general.osinfo module dissect.target.plugins.general.plugins module dissect.target.plugins.general.users module dissect.target.plugins.os module dissect.target.plugins.os.default module dissect.target.plugins.os.default._os module dissect.target.plugins.os.default.datetime module dissect.target.plugins.os.default.locale module dissect.target.plugins.os.default.network module dissect.target.plugins.os.unix module dissect.target.plugins.os.unix._os module dissect.target.plugins.os.unix.applications module dissect.target.plugins.os.unix.bsd module dissect.target.plugins.os.unix.bsd._os module dissect.target.plugins.os.unix.bsd.citrix module dissect.target.plugins.os.unix.bsd.citrix._os module dissect.target.plugins.os.unix.bsd.citrix.history module dissect.target.plugins.os.unix.bsd.darwin module dissect.target.plugins.os.unix.bsd.darwin._os module dissect.target.plugins.os.unix.bsd.darwin.ios module dissect.target.plugins.os.unix.bsd.darwin.ios._os module dissect.target.plugins.os.unix.bsd.darwin.ios.applications module dissect.target.plugins.os.unix.bsd.darwin.ios.generic module dissect.target.plugins.os.unix.bsd.darwin.ios.locale module dissect.target.plugins.os.unix.bsd.darwin.macos module dissect.target.plugins.os.unix.bsd.darwin.macos._os module dissect.target.plugins.os.unix.bsd.darwin.macos.network module dissect.target.plugins.os.unix.bsd.darwin.macos.user module dissect.target.plugins.os.unix.bsd.freebsd module dissect.target.plugins.os.unix.bsd.freebsd._os module dissect.target.plugins.os.unix.bsd.openbsd module dissect.target.plugins.os.unix.bsd.openbsd._os module dissect.target.plugins.os.unix.cronjobs module dissect.target.plugins.os.unix.datetime module dissect.target.plugins.os.unix.esxi module dissect.target.plugins.os.unix.esxi._os module dissect.target.plugins.os.unix.etc module dissect.target.plugins.os.unix.etc.etc module dissect.target.plugins.os.unix.generic module dissect.target.plugins.os.unix.history module dissect.target.plugins.os.unix.linux module dissect.target.plugins.os.unix.linux._os module dissect.target.plugins.os.unix.linux.android module dissect.target.plugins.os.unix.linux.android._os module dissect.target.plugins.os.unix.linux.cmdline module dissect.target.plugins.os.unix.linux.debian module dissect.target.plugins.os.unix.linux.debian._os module dissect.target.plugins.os.unix.linux.debian.apt module dissect.target.plugins.os.unix.linux.debian.dpkg module dissect.target.plugins.os.unix.linux.debian.proxmox module dissect.target.plugins.os.unix.linux.debian.proxmox._os module dissect.target.plugins.os.unix.linux.debian.proxmox.vm module dissect.target.plugins.os.unix.linux.debian.snap module dissect.target.plugins.os.unix.linux.debian.vyos module dissect.target.plugins.os.unix.linux.debian.vyos._os module dissect.target.plugins.os.unix.linux.environ module dissect.target.plugins.os.unix.linux.fortios module dissect.target.plugins.os.unix.linux.fortios._os module dissect.target.plugins.os.unix.linux.fortios.generic module dissect.target.plugins.os.unix.linux.fortios.locale module dissect.target.plugins.os.unix.linux.iptables module dissect.target.plugins.os.unix.linux.modules module dissect.target.plugins.os.unix.linux.netstat module dissect.target.plugins.os.unix.linux.network module dissect.target.plugins.os.unix.linux.network_managers module dissect.target.plugins.os.unix.linux.proc module dissect.target.plugins.os.unix.linux.processes module dissect.target.plugins.os.unix.linux.recentlyused module dissect.target.plugins.os.unix.linux.redhat module dissect.target.plugins.os.unix.linux.redhat._os module dissect.target.plugins.os.unix.linux.redhat.yum module dissect.target.plugins.os.unix.linux.services module dissect.target.plugins.os.unix.linux.sockets module dissect.target.plugins.os.unix.linux.suse module dissect.target.plugins.os.unix.linux.suse._os module dissect.target.plugins.os.unix.linux.suse.zypper module dissect.target.plugins.os.unix.locale module dissect.target.plugins.os.unix.locate module dissect.target.plugins.os.unix.locate.gnulocate module dissect.target.plugins.os.unix.locate.locate module dissect.target.plugins.os.unix.locate.mlocate module dissect.target.plugins.os.unix.locate.plocate module dissect.target.plugins.os.unix.log module dissect.target.plugins.os.unix.log.atop module dissect.target.plugins.os.unix.log.audit module dissect.target.plugins.os.unix.log.auth module dissect.target.plugins.os.unix.log.helpers module dissect.target.plugins.os.unix.log.journal module dissect.target.plugins.os.unix.log.lastlog module dissect.target.plugins.os.unix.log.messages module dissect.target.plugins.os.unix.log.utmp module dissect.target.plugins.os.unix.packagemanager module dissect.target.plugins.os.unix.shadow module dissect.target.plugins.os.unix.trash module dissect.target.plugins.os.windows module dissect.target.plugins.os.windows._os module dissect.target.plugins.os.windows.activitiescache module dissect.target.plugins.os.windows.adpolicy module dissect.target.plugins.os.windows.amcache module dissect.target.plugins.os.windows.cam module dissect.target.plugins.os.windows.catroot module dissect.target.plugins.os.windows.cim module dissect.target.plugins.os.windows.clfs module dissect.target.plugins.os.windows.credential module dissect.target.plugins.os.windows.credential.credhist module dissect.target.plugins.os.windows.credential.lsa module dissect.target.plugins.os.windows.credential.sam module dissect.target.plugins.os.windows.datetime module dissect.target.plugins.os.windows.defender module dissect.target.plugins.os.windows.defender.mplog module dissect.target.plugins.os.windows.defender.quarantine module dissect.target.plugins.os.windows.dpapi module dissect.target.plugins.os.windows.dpapi.blob module dissect.target.plugins.os.windows.dpapi.crypto module dissect.target.plugins.os.windows.dpapi.dpapi module dissect.target.plugins.os.windows.dpapi.keyprovider module dissect.target.plugins.os.windows.dpapi.keyprovider.credhist module dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword module dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.defaultpassword module dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.lsa module dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.winlogon module dissect.target.plugins.os.windows.dpapi.keyprovider.empty module dissect.target.plugins.os.windows.dpapi.keyprovider.keychain module dissect.target.plugins.os.windows.dpapi.keyprovider.keyprovider module dissect.target.plugins.os.windows.dpapi.master_key module dissect.target.plugins.os.windows.env module dissect.target.plugins.os.windows.everything module dissect.target.plugins.os.windows.everything.parser module dissect.target.plugins.os.windows.exchange module dissect.target.plugins.os.windows.exchange.exchange module dissect.target.plugins.os.windows.firewall module dissect.target.plugins.os.windows.generic module dissect.target.plugins.os.windows.jumplist module dissect.target.plugins.os.windows.lnk module dissect.target.plugins.os.windows.locale module dissect.target.plugins.os.windows.log module dissect.target.plugins.os.windows.log.amcache module dissect.target.plugins.os.windows.log.etl module dissect.target.plugins.os.windows.log.evt module dissect.target.plugins.os.windows.log.evtx module dissect.target.plugins.os.windows.log.mssql module dissect.target.plugins.os.windows.log.pfro module dissect.target.plugins.os.windows.log.schedlgu module dissect.target.plugins.os.windows.network module dissect.target.plugins.os.windows.notifications module dissect.target.plugins.os.windows.prefetch module dissect.target.plugins.os.windows.productkey module dissect.target.plugins.os.windows.rdpcache module dissect.target.plugins.os.windows.recyclebin module dissect.target.plugins.os.windows.regf module dissect.target.plugins.os.windows.regf.applications module dissect.target.plugins.os.windows.regf.appxdebugkeys module dissect.target.plugins.os.windows.regf.auditpol module dissect.target.plugins.os.windows.regf.bam module dissect.target.plugins.os.windows.regf.cit module dissect.target.plugins.os.windows.regf.clsid module dissect.target.plugins.os.windows.regf.mru module dissect.target.plugins.os.windows.regf.muicache module dissect.target.plugins.os.windows.regf.nethist module dissect.target.plugins.os.windows.regf.recentfilecache module dissect.target.plugins.os.windows.regf.regf module dissect.target.plugins.os.windows.regf.runkeys module dissect.target.plugins.os.windows.regf.shellbags module dissect.target.plugins.os.windows.regf.shimcache module dissect.target.plugins.os.windows.regf.trusteddocs module dissect.target.plugins.os.windows.regf.usb module dissect.target.plugins.os.windows.regf.userassist module dissect.target.plugins.os.windows.registry module dissect.target.plugins.os.windows.search module dissect.target.plugins.os.windows.services module dissect.target.plugins.os.windows.sru module dissect.target.plugins.os.windows.startupinfo module dissect.target.plugins.os.windows.syscache module dissect.target.plugins.os.windows.tasks module dissect.target.plugins.os.windows.tasks.job module dissect.target.plugins.os.windows.tasks.records module dissect.target.plugins.os.windows.tasks.xml module dissect.target.plugins.os.windows.thumbcache module dissect.target.plugins.os.windows.ual module dissect.target.plugins.os.windows.wer module dissect.target.plugins.os.windows.wua_history module dissect.target.plugins.scrape module dissect.target.plugins.scrape.qfind module dissect.target.plugins.scrape.scrape module dissect.target.target module dissect.target.tools module dissect.target.tools.build_pluginlist module dissect.target.tools.dd module dissect.target.tools.diff module dissect.target.tools.dump module dissect.target.tools.fs module dissect.target.tools.info module dissect.target.tools.mount module dissect.target.tools.qfind module dissect.target.tools.query module dissect.target.tools.reg module dissect.target.tools.shell module dissect.target.tools.utils module dissect.target.tools.utils.cli module dissect.target.tools.utils.fs module dissect.target.tools.utils.logging module dissect.target.tools.utils.report module dissect.target.tools.yara module dissect.target.volume module dissect.target.volumes module dissect.target.volumes.bde module dissect.target.volumes.ddf module dissect.target.volumes.disk module dissect.target.volumes.luks module dissect.target.volumes.lvm module dissect.target.volumes.md module dissect.target.volumes.vmfs module dissect.thumbcache module dissect.thumbcache.c_thumbcache module dissect.thumbcache.exceptions module dissect.thumbcache.index module dissect.thumbcache.thumbcache module dissect.thumbcache.thumbcache_file module dissect.thumbcache.tools module dissect.thumbcache.tools.extract_images module dissect.thumbcache.tools.extract_with_index module dissect.thumbcache.tools.utils module dissect.thumbcache.util module dissect.util module dissect.util.compression module dissect.util.compression.lz4 module dissect.util.compression.lzbitmap module dissect.util.compression.lzfse module dissect.util.compression.lznt1 module dissect.util.compression.lzo module dissect.util.compression.lzvn module dissect.util.compression.lzxpress module dissect.util.compression.lzxpress_huffman module dissect.util.compression.sevenbit module dissect.util.compression.xz module dissect.util.cpio module dissect.util.encoding module dissect.util.encoding.surrogateescape module dissect.util.exceptions module dissect.util.hash module dissect.util.hash.crc32 module dissect.util.hash.crc32c module dissect.util.hash.jenkins module dissect.util.ldap module dissect.util.plist module dissect.util.sid module dissect.util.stream module dissect.util.tools module dissect.util.tools.dump_nskeyedarchiver module dissect.util.ts module dissect.util.xmemoryview module dissect.vmfs module dissect.vmfs.address module dissect.vmfs.c_lvm module dissect.vmfs.c_vmfs module dissect.vmfs.descriptor module dissect.vmfs.exception module dissect.vmfs.lvm module dissect.vmfs.resource module dissect.vmfs.util module dissect.vmfs.vmfs module dissect.volume module dissect.volume.ddf module dissect.volume.ddf.c_ddf module dissect.volume.ddf.ddf module dissect.volume.disk module dissect.volume.disk.disk module dissect.volume.disk.partition module dissect.volume.disk.schemes module dissect.volume.disk.schemes.apm module dissect.volume.disk.schemes.bsd module dissect.volume.disk.schemes.gpt module dissect.volume.disk.schemes.mbr module dissect.volume.dm module dissect.volume.dm.btree module dissect.volume.dm.c_dm module dissect.volume.dm.thin module dissect.volume.exceptions module dissect.volume.ldm module dissect.volume.lvm module dissect.volume.lvm.c_lvm2 module dissect.volume.lvm.lvm2 module dissect.volume.lvm.metadata module dissect.volume.lvm.physical module dissect.volume.md module dissect.volume.md.c_md module dissect.volume.md.md module dissect.volume.raid module dissect.volume.raid.raid module dissect.volume.raid.stream module dissect.volume.vinum module dissect.volume.vinum.c_vinum module dissect.volume.vinum.config module dissect.volume.vinum.vinum module dissect.volume.vss module dissect.xfs module dissect.xfs.c_xfs module dissect.xfs.exceptions module dissect.xfs.xfs module DissectMount (class in dissect.target.helpers.mount) DissectVolumeSystem (class in dissect.target.volumes.disk) DLSW (dissect.target.plugins.os.windows.network.IfTypes attribute) dlt_name (dissect.target.plugins.os.windows.datetime.WindowsTimezone attribute) dm_def (in module dissect.volume.dm.c_dm) DMError dnd_dirs (dissect.target.plugins.apps.virtualization.vmware_workstation.VmwareWorkstationPlugin attribute) DND_PATHS (in module dissect.target.plugins.apps.virtualization.vmware_workstation) DNS (class in acquire.acquire.acquire) dns (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager property) dns() (dissect.target.plugins.os.default.network.NetworkPlugin method) (dissect.target.plugins.os.unix.linux._os.LinuxPlugin method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSPlugin method) dns_ip_patttern (dissect.target.plugins.os.unix.linux.network.SystemdNetworkConfigParser attribute) do_alias() (dissect.target.tools.shell.ExtendedCmd method) do_cd() (dissect.target.tools.diff.DifferentialCli method) (dissect.target.tools.shell.RegistryCli method) (dissect.target.tools.shell.TargetCli method) do_clear() (dissect.target.tools.shell.ExtendedCmd method) do_cls() (dissect.target.tools.shell.ExtendedCmd method) do_cyber() (dissect.target.tools.shell.ExtendedCmd method) do_debug() (dissect.target.tools.shell.ExtendedCmd method) do_disks() (dissect.target.tools.shell.TargetCli method) do_enter() (dissect.target.tools.shell.TargetHubCli method) do_exit() (dissect.target.tools.shell.ExtendedCmd method) (dissect.target.tools.shell.TargetHubCli method) do_filesystems() (dissect.target.tools.shell.TargetCli method) do_info() (dissect.target.tools.shell.TargetCli method) do_list() (dissect.target.tools.diff.DifferentialCli method) (dissect.target.tools.shell.TargetHubCli method) do_man() (dissect.target.tools.shell.ExtendedCmd method) do_mounts() (dissect.target.tools.shell.TargetCli method) do_plugin() (dissect.target.tools.diff.DifferentialCli method) do_pwd() (dissect.target.tools.shell.RegistryCli method) (dissect.target.tools.shell.TargetCli method) do_python() (dissect.target.tools.diff.DifferentialCli method) (dissect.target.tools.shell.TargetCmd method) (dissect.target.tools.shell.TargetHubCli method) do_recommend() (dissect.target.tools.shell.RegistryCli method) do_reload() (dissect.target.tools.shell.TargetCli method) do_unalias() (dissect.target.tools.shell.ExtendedCmd method) do_up() (dissect.target.tools.shell.RegistryCli method) do_volumes() (dissect.target.tools.shell.TargetCli method) doc_header (dissect.target.tools.diff.DifferentialCli attribute) (dissect.target.tools.shell.TargetHubCli attribute) doc_header_multiple_targets (dissect.target.tools.diff.DifferentialCli attribute) doc_header_prefix (dissect.target.tools.diff.DifferentialCli attribute) doc_header_suffix (dissect.target.tools.diff.DifferentialCli attribute) DOCID_SIZE_BYTES (dissect.target.plugins.os.unix.locate.plocate.PLocateFile attribute) Docker (class in acquire.acquire.acquire) DOCKER_ARCHIVE_IMAGE (in module dissect.target.loaders.containerimage) DockerChildTargetPlugin (class in dissect.target.plugins.child.docker) DockerContainerRecord (in module dissect.target.plugins.apps.container.docker) DockerImageRecord (in module dissect.target.plugins.apps.container.docker) DockerLogRecord (in module dissect.target.plugins.apps.container.docker) DockerPlugin (class in dissect.target.plugins.apps.container.docker) DOCSCABLE_DOWNSTREAM (dissect.target.plugins.os.windows.network.IfTypes attribute) DOCSCABLE_MACLAYER (dissect.target.plugins.os.windows.network.IfTypes attribute) DOCSCABLE_UPSTREAM (dissect.target.plugins.os.windows.network.IfTypes attribute) document_stream() (flow.record.adapter.elastic.ElasticWriter method) documentation (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) domain (dissect.target.loaders.itunes.FileInfo attribute) domain() (dissect.target.plugins.os.unix._os.UnixPlugin method) (dissect.target.plugins.os.unix.bsd.openbsd._os.OpenBsdPlugin method) (dissect.target.plugins.os.unix.esxi._os.ESXiPlugin method) (dissect.target.plugins.os.windows.generic.GenericPlugin method) domain_sid() (dissect.target.plugins.os.windows.generic.GenericPlugin method) DOMAIN_TRANSLATION (in module dissect.target.loaders.itunes) domains_seen() (dissect.target.plugins.os.windows.ual.UalPlugin method) DomainSeenRecord (in module dissect.target.plugins.os.windows.ual) DOS_EPOCH_YEAR (in module dissect.util.ts) dos_stub (dissect.executable.PE attribute) (dissect.executable.pe.PE attribute) (dissect.executable.pe.pe.PE attribute) dostimestamp() (in module dissect.util.ts) DOUBLE (dissect.eventlog.bxml.BxmlType attribute) DOWN (dissect.volume.vinum.config.PlexState attribute) (dissect.volume.vinum.config.SDState attribute) (dissect.volume.vinum.config.VolumeState attribute) Downgrade (dissect.target.plugins.os.unix.packagemanager.OperationTypes attribute) DOWNLOAD_STATES (in module dissect.target.plugins.apps.browser.chromium) downloads() (dissect.target.plugins.apps.browser.brave.BravePlugin method) (dissect.target.plugins.apps.browser.chrome.ChromePlugin method) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin method) (dissect.target.plugins.apps.browser.chromium.ChromiumPlugin method) (dissect.target.plugins.apps.browser.edge.EdgePlugin method) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin method) (dissect.target.plugins.apps.browser.iexplore.InternetExplorerPlugin method) (dissect.target.plugins.apps.browser.iexplore.WebCache method) dp() (dissect.target.plugins.os.windows.regf.cit.CITPlugin method) DPAPI (class in acquire.acquire.acquire) dpapi_hmac() (in module dissect.target.plugins.os.windows.dpapi.crypto) DPAPIPlugin (class in dissect.target.plugins.os.windows.dpapi.dpapi) DpcGuid (in module dissect.etl.utils) DpkgPackageLogRecord (in module dissect.target.plugins.os.unix.linux.debian.dpkg) DpkgPackageStatusRecord (in module dissect.target.plugins.os.unix.linux.debian.dpkg) DpkgPlugin (class in dissect.target.plugins.os.unix.linux.debian.dpkg) drive (dissect.volume.vinum.config.SD attribute) DRIVE_CONTROLLER_GUIDS (in module dissect.target.loaders.hyperv) drive_letter (dissect.target.volume.Volume attribute) DRIVE_LETTER_RE (in module dissect.target.plugins.filesystem.ntfs.utils) DRIVE_LOWER_SUBST (in module acquire.acquire.utils) driveoffset (dissect.volume.vinum.config.SD attribute) DRIVER (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) DRIVER_BLOCKED (dissect.target.plugins.os.windows.amcache.PcaGeneralDbType attribute) Drivers (class in acquire.acquire.acquire) drivers() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) drop_dirty_sinks() (dissect.target.tools.dump.DumpState method) drop_invalid_sinks() (dissect.target.tools.dump.DumpState method) drops (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) DS0 (dissect.target.plugins.os.windows.network.IfTypes attribute) DS0_BUNDLE (dissect.target.plugins.os.windows.network.IfTypes attribute) DS1 (dissect.target.plugins.os.windows.network.IfTypes attribute) DS1_FDL (dissect.target.plugins.os.windows.network.IfTypes attribute) DS3 (dissect.target.plugins.os.windows.network.IfTypes attribute) DSR (dissect.target.helpers.network.IANAProtocol attribute) dst() (dissect.target.plugins.os.windows.datetime.WindowsTimezone method) dst_index (dissect.target.tools.diff.DifferentialCli attribute) dst_target (dissect.target.tools.diff.DifferentialCli property) (dissect.target.tools.diff.TargetComparison attribute) dst_target_entry (dissect.target.tools.diff.DifferentialEntry attribute) dt (dissect.apfs.objects.fs.DirectoryEntry property) DT_CENTER (in module acquire.acquire.gui.win32) DT_DIR (in module dissect.target.plugins.os.unix.linux.debian.proxmox._os) DT_MAP (in module dissect.jffs.c_jffs2) DT_REG (in module dissect.target.plugins.os.unix.linux.debian.proxmox._os) DT_SINGLELINE (in module acquire.acquire.gui.win32) DT_VCENTER (in module acquire.acquire.gui.win32) dtime (dissect.extfs.extfs.INode property) (dissect.extfs.INode property) DTM (dissect.target.plugins.os.windows.network.IfTypes attribute) DTYPE_NAMES (in module dissect.volume.disk.schemes.bsd) DuckdbReader (class in flow.record.adapter.duckdb) DuckdbWriter (class in flow.record.adapter.duckdb) DUMMY (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) (dissect.target.plugins.os.unix.linux.proc.Sockets.UDPStates attribute) Dump (class in dissect.target.loaders.cellebrite) dump() (dissect.executable.ELF method) (dissect.executable.elf.ELF method) (dissect.executable.elf.elf.ELF method) dump_data() (dissect.executable.elf.elf.SectionTable method) (dissect.executable.elf.elf.SegmentTable method) (dissect.executable.elf.SectionTable method) (dissect.executable.elf.SegmentTable method) dump_entry_data() (in module dissect.thumbcache.tools.extract_images) dump_entry_data_through_index() (in module dissect.thumbcache.tools.extract_with_index) dump_table() (dissect.executable.elf.elf.SectionTable method) (dissect.executable.elf.elf.SegmentTable method) (dissect.executable.elf.SectionTable method) (dissect.executable.elf.SegmentTable method) dumps (dissect.cstruct.BaseType attribute) (dissect.cstruct.types.base.BaseType attribute) (dissect.cstruct.types.BaseType attribute) (dissect.target.loaders.cellebrite.Ufd attribute) dumps() (dissect.cstruct.MetaType method) (dissect.cstruct.types.base.MetaType method) (dissect.cstruct.types.MetaType method) DumpState (class in dissect.target.tools.dump) dumpstruct() (in module dissect.cstruct) (in module dissect.cstruct.utils) DUPLICATE_CLOSE_SOURCE (acquire.acquire.dynamic.windows.types.DuplicateHandleFlags attribute) duplicate_handle() (in module acquire.acquire.dynamic.windows.handles) DUPLICATE_SAME_ACCESS (acquire.acquire.dynamic.windows.types.DuplicateHandleFlags attribute) DUPLICATE_SAME_ATTRIBUTES (acquire.acquire.dynamic.windows.types.DuplicateHandleFlags attribute) DuplicateFilter (class in acquire.acquire.dynamic.windows.handles) DuplicateHandle (in module acquire.acquire.dynamic.windows.handles) DuplicateHandleFlags (class in acquire.acquire.dynamic.windows.types) DVB_ASI_IN (dissect.target.plugins.os.windows.network.IfTypes attribute) DVB_ASI_OUT (dissect.target.plugins.os.windows.network.IfTypes attribute) DVBRCC_DOWNSTREAM (dissect.target.plugins.os.windows.network.IfTypes attribute) DVBRCC_MACLAYER (dissect.target.plugins.os.windows.network.IfTypes attribute) DVBRCC_UPSTREAM (dissect.target.plugins.os.windows.network.IfTypes attribute) DWORD (dissect.target.helpers.regutil.RegistryValueType attribute) DWORD_BIG_ENDIAN (dissect.target.helpers.regutil.RegistryValueType attribute) dynamic (class in flow.record.fieldtypes) (dissect.cstruct.MetaType attribute) (dissect.cstruct.types.base.MetaType attribute) (dissect.cstruct.types.MetaType attribute) (dissect.executable.ELF property) (dissect.executable.elf.ELF property) (dissect.executable.elf.elf.ELF property) dynamic_dst (dissect.target.plugins.os.windows.datetime.WindowsTimezone attribute) dynamic_fieldtype (in module flow.record) (in module flow.record.base) DynamicDescriptor() (in module dissect.target.helpers.record) (in module flow.record) (in module flow.record.base) DynamicDisk (class in dissect.hypervisor.disk.vhd) DynamicFieldtypeModule (class in flow.record.base) DynpropQualifier (class in dissect.cim.classes) Dynprops (class in dissect.cim.classes) dynprops (dissect.cim.classes.ClassInstance attribute) (dissect.cim.classes.Dynprops attribute) dynprops_state (dissect.cim.classes.Dynprops attribute) DYNPROPS_STATES (in module dissect.cim.c_cim) E E1 (dissect.target.plugins.os.windows.network.IfTypes attribute) e_ident (dissect.executable.ELF attribute) (dissect.executable.elf.ELF attribute) (dissect.executable.elf.elf.ELF attribute) EASTASIA_SPECIAL (dissect.database.ese.lcmapstring.SCRIPT attribute) EBOIV (class in dissect.fve.crypto.base) EdgePlugin (class in dissect.target.plugins.apps.browser.edge) EditorPlugin (class in dissect.target.plugins.apps.editor.editor) EDR (class in acquire.acquire.acquire) EfiJumpstart (class in dissect.apfs.objects) (class in dissect.apfs.objects.efi_jumpstart) EFU (dissect.target.plugins.os.windows.everything.parser.EverythingFSType attribute) EGP (dissect.target.helpers.network.IANAProtocol attribute) EIGRP (dissect.target.helpers.network.IANAProtocol attribute) ElasticReader (class in flow.record.adapter.elastic) ElasticWriter (class in flow.record.adapter.elastic) element (dissect.eventlog.bxml.Template attribute) ElementType (in module dissect.target.helpers.sunrpc.serializer) Elephant (class in dissect.fve.crypto.base) elevation_def (in module dissect.target.plugins.apps.browser.chromium) ELF (class in dissect.executable) (class in dissect.executable.elf) (class in dissect.executable.elf.elf) elf_32_def (in module dissect.executable.elf.c_elf) elf_64_def (in module dissect.executable.elf.c_elf) elf_chunk_stream (dissect.eventlog.bxml.Bxml attribute) (dissect.eventlog.bxml.BxmlNameReader attribute) elf_def (in module dissect.executable.elf.c_elf) Elf_Type (in module dissect.executable.elf.c_elf) ElfChnk (class in dissect.eventlog.evtx) EM_SETPASSWORDCHAR (in module acquire.acquire.gui.win32) EMCON (dissect.target.helpers.network.IANAProtocol attribute) EMERG (dissect.target.plugins.os.unix.log.journal.JournalMessagePriority attribute) emit() (acquire.acquire.log.DelayedFileHandler method) emit_last_message() (dissect.target.exceptions.FatalError method) EMPTY (acquire.acquire.collector.Outcome attribute) Empty (class in dissect.database.sqlite3.sqlite3) empty (dissect.eventlog.evtx.ElfChnk attribute) EMPTY_LM (dissect.target.loaders.smb.SmbLoader attribute) EMPTY_LOGICAL_COLOR_SPACE (in module dissect.target.plugins.os.windows.rdpcache) EMPTY_NT (dissect.target.loaders.smb.SmbLoader attribute) EMPTY_PIXEL (in module dissect.target.plugins.os.windows.rdpcache) EmptyDirectoryError, [1] EmptyKeyProviderPlugin (class in dissect.target.plugins.os.windows.dpapi.keyprovider.empty) emptyline() (dissect.target.tools.shell.ExtendedCmd method) (dissect.target.tools.shell.TargetHubCli method) EmptyRecord (in module dissect.target.helpers.record) enabled (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) ENCAP (dissect.target.helpers.network.IANAProtocol attribute) encode_key() (in module dissect.database.ese.index) encode_varint() (in module dissect.target.helpers.protobuf) encoding (dissect.database.ese.table.Column property) (dissect.database.SQLite3 attribute) (dissect.database.sqlite3.SQLite3 attribute) (dissect.database.sqlite3.sqlite3.SQLite3 attribute) (dissect.fat.fat.FATFS attribute) (dissect.fat.FATFS attribute) ENCODING (in module dissect.database.sqlite3.sqlite3) ENCRYPT (in module dissect.fve.crypto.base) encrypt() (dissect.fve.crypto.base.Cipher method) (dissect.fve.crypto.Cipher method) encrypted (dissect.fve.bde.BDE property) (dissect.fve.bde.bde.BDE property) (dissect.hypervisor.descriptor.vmx.VMX property) (dissect.target.loaders.ab.AndroidBackup attribute) (dissect.target.loaders.itunes.ITunesBackup attribute) ENCRYPTED_VOLUME_MANAGERS (in module dissect.target.volume) EncryptedFile (class in acquire.acquire.tools.decrypter) EncryptedFileStream (class in dissect.target.filesystems.itunes) EncryptedStream (class in acquire.acquire.crypt) EncryptedVolumeSystem (class in dissect.target.volume) encryption (dissect.btrfs.stream.Extent attribute) (dissect.fve.luks.metadata.KeyslotArea attribute) (dissect.fve.luks.metadata.Segment attribute) (dissect.target.loaders.ab.AndroidBackup attribute) encryption_key (dissect.target.loaders.itunes.FileInfo property) EncryptionRollingRecoveryBlock (class in dissect.apfs.objects) (class in dissect.apfs.objects.er_recovery_block) EncryptionRollingState (class in dissect.apfs.objects) (class in dissect.apfs.objects.er_state) end (dissect.etl.ETL attribute) (dissect.etl.etl.ETL attribute) (dissect.executable.elf.elf.Segment property) (dissect.executable.elf.Segment property) (dissect.hypervisor.disk.hdd.Storage attribute) END_OF_CLUSTER_MAX (in module dissect.fat.c_fat) END_OF_CLUSTER_MIN (in module dissect.fat.c_fat) end_offset (dissect.eventlog.Evt attribute) (dissect.eventlog.evt.Evt attribute) end_pos (dissect.target.tools.dump.RecordStreamElement attribute) end_time (dissect.etl.headers.logfile.LogfileHeader property) ended (dissect.ole.ole.Chain attribute) endian (dissect.cstruct.BitBuffer attribute) (dissect.cstruct.bitbuffer.BitBuffer attribute) (dissect.cstruct.cstruct attribute) (dissect.cstruct.cstruct.cstruct attribute) ENDIANNESS_MAP (in module dissect.cstruct.utils) endpoint (acquire.acquire.uploaders.minio.MinIO attribute) energy_estimator() (dissect.target.plugins.os.windows.sru.SRUPlugin method) energy_usage() (dissect.target.plugins.os.windows.sru.SRUPlugin method) energy_usage_lt() (dissect.target.plugins.os.windows.sru.SRUPlugin method) EnergyEstimatorRecord (in module dissect.target.plugins.os.windows.sru) EnergyUsageLTRecord (in module dissect.target.plugins.os.windows.sru) EnergyUsageRecord (in module dissect.target.plugins.os.windows.sru) enrich_elastic_exception() (in module flow.record.adapter.elastic) ensure_volume() (in module dissect.ntfs.util) entries (dissect.apfs.objects.keybag.Keybag attribute) (dissect.cim.classes.PropertyStates attribute) (dissect.cim.objects.TOC attribute) (dissect.evidence.ewf.TableSection attribute) (dissect.executable.pe.directory.basereloc.BaseRelocationDirectory property) (dissect.executable.pe.directory.BaseRelocationDirectory property) (dissect.executable.pe.directory.debug.DebugDirectory property) (dissect.executable.pe.directory.debug.PogoDebugEntry property) (dissect.executable.pe.directory.DebugDirectory property) (dissect.executable.pe.directory.exception.ExceptionDirectory property) (dissect.executable.pe.directory.ExceptionDirectory property) (dissect.executable.pe.directory.iat.IatDirectory property) (dissect.executable.pe.directory.IatDirectory property) (dissect.executable.pe.directory.security.SecurityDirectory property) (dissect.executable.pe.directory.SecurityDirectory property) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageObjectTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageReplayLog attribute) (dissect.hypervisor.disk.asif.Directory property) (dissect.hypervisor.disk.asif.Table property) (dissect.hypervisor.disk.vhdx.MetadataTable attribute) (dissect.hypervisor.disk.vhdx.ParentLocator attribute) (dissect.hypervisor.disk.vhdx.RegionTable attribute) (dissect.ntfs.attr.AttributeList attribute) (dissect.target.filesystem.LayerFilesystemEntry attribute) (dissect.target.filesystem.VirtualDirectory attribute) (dissect.target.helpers.nfs.client.nfs.ReadDirResult attribute) (dissect.target.helpers.nfs.nfs3.ReadDirPlusResult attribute) (dissect.target.plugins.os.windows.credential.credhist.CredHistFile attribute) (dissect.target.plugins.os.windows.regf.cit.CIT attribute) (dissect.target.target.Collection attribute) (dissect.volume.vss.Catalog attribute) (dissect.volume.vss.RangeList attribute) entries() (dissect.database.bsd.db.Page method) (dissect.database.bsd.tools.rpm.HeaderBlob method) (dissect.database.bsd.tools.rpm.Package method) (dissect.database.bsd.tools.rpm.Packages method) (dissect.database.ese.tools.certlog.CertLog method) (dissect.database.ese.tools.sru.SRU method) (dissect.ntfs.Index method) (dissect.ntfs.index.Index method) (dissect.ntfs.index.IndexBuffer method) (dissect.ntfs.index.IndexRoot method) (dissect.thumbcache.index.ThumbnailIndex method) (dissect.thumbcache.Thumbcache method) (dissect.thumbcache.thumbcache.Thumbcache method) (dissect.thumbcache.thumbcache_file.ThumbcacheFile method) (dissect.thumbcache.ThumbcacheFile method) (dissect.thumbcache.ThumbnailIndex method) Entry (class in dissect.database.ese.tools.sru) (class in dissect.target.plugins.os.windows.regf.cit) entry (dissect.archive.vbk.MetaItem attribute) (dissect.archive.wim.DirectoryEntry attribute) (dissect.cim.mappings.MappingEntry attribute) (dissect.evidence.ad1.FileEntry attribute) (dissect.evidence.ad1.FileMeta attribute) (dissect.evidence.ad1.FileObject attribute) (dissect.executable.pe.directory.debug.DebugEntry attribute) (dissect.executable.pe.directory.resource.Resource attribute) (dissect.executable.pe.directory.resource.ResourceDataEntry property) (dissect.executable.pe.directory.resource.ResourceDirectoryEntry property) (dissect.executable.pe.directory.resource.ResourceEntry property) (dissect.executable.pe.directory.ResourceDataEntry property) (dissect.executable.pe.directory.ResourceDirectoryEntry property) (dissect.executable.pe.directory.ResourceEntry property) (dissect.extfs.extfs.XAttr attribute) ENTRY (dissect.hypervisor.disk.vhd.BlockAllocationTable attribute) entry (dissect.jffs.jffs2.DirEntry attribute) (dissect.ole.ole.DirectoryEntry attribute) (dissect.target.filesystem.FilesystemEntry attribute) (dissect.target.filesystem.MappedCompressedFile attribute) (dissect.target.filesystem.MappedFile attribute) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry attribute) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry attribute) (dissect.target.filesystems.dir.DirectoryFilesystemEntry attribute) (dissect.target.filesystems.itunes.ITunesFilesystemDirectoryEntry attribute) (dissect.target.filesystems.jffs.JffsFilesystemEntry attribute) (dissect.target.filesystems.nfs.NfsFilesystemEntry attribute) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry attribute) (dissect.target.filesystems.smb.SmbFilesystemEntry attribute) (dissect.target.filesystems.tar.TarFilesystemDirectoryEntry attribute) (dissect.target.filesystems.vbk.VbkFilesystemEntry attribute) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry attribute) (dissect.target.filesystems.zip.ZipFilesystemEntry attribute) (dissect.target.loaders.res.ResFile attribute) (dissect.target.plugins.os.unix.linux.debian.proxmox._os.ProxmoxConfigDirectoryEntry attribute) (dissect.target.plugins.os.windows.regf.cit.BaseUseData attribute) (dissect.target.plugins.os.windows.regf.cit.Entry attribute) entry() (dissect.database.bsd.db.Page method) (dissect.database.bsd.tools.rpm.HeaderBlob method) (dissect.evidence.ad1.AD1 method) (dissect.hypervisor.disk.qcow2.L2Table method) entry_count (dissect.fat.fat.FAT attribute) entry_size (dissect.executable.elf.elf.Section attribute) (dissect.executable.elf.Section attribute) (dissect.hypervisor.disk.qcow2.QCow2Snapshot attribute) EntryList (class in dissect.target.filesystem) EntryPlus (class in dissect.target.helpers.nfs.nfs3) EntryPlusSerializer (class in dissect.target.helpers.nfs.serializer) EntryType (in module dissect.evidence.ad1) Enum (class in dissect.cstruct) (class in dissect.cstruct.types) (class in dissect.cstruct.types.enum) EnumMetaType (class in dissect.cstruct.types.enum) EnumType (in module dissect.target.helpers.sunrpc.serializer) Env (class in dissect.target.helpers.configutil) env (dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin property) env_vars (dissect.target.plugins.apps.webserver.apache.ApachePlugin property) Envelope (class in dissect.hypervisor.util.envelope) ENVELOPE_ATTRIBUTE_TYPE_MAP (in module dissect.hypervisor.util.envelope) ENVELOPE_BLOCK_SIZE (in module dissect.hypervisor.util.envelope) EnvelopeAttribute (class in dissect.hypervisor.util.envelope) envfile() (dissect.target.plugins.apps.other.env.EnvironmentFilePlugin method) Environ (class in dissect.target.plugins.os.unix.linux.proc) environ() (dissect.target.plugins.os.unix.linux.environ.EnvironPlugin method) (dissect.target.plugins.os.unix.linux.proc.ProcProcess method) ENVIRONMENT_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) environment_variable_paths() (in module dissect.target.plugin) environment_variables() (dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin method) EnvironmentFilePlugin (class in dissect.target.plugins.apps.other.env) EnvironmentFileRecord (in module dissect.target.plugins.apps.other.env) EnvironmentRecord (in module dissect.target.plugins.os.windows.env) EnvironmentVariablePlugin (class in dissect.target.plugins.os.windows.env) EnvironmentVariableRecord (in module dissect.target.plugins.os.unix.cronjobs) (in module dissect.target.plugins.os.unix.linux.environ) EnvironPlugin (class in dissect.target.plugins.os.unix.linux.environ) EnvVarDetails (class in dissect.target.plugins.os.windows.env) EOC (in module dissect.fat.c_exfat) eof (dissect.target.helpers.nfs.nfs3.ReadDirPlusResult attribute) (dissect.target.helpers.nfs.nfs3.ReadResult attribute) EOF (in module dissect.cstruct.types.base) eol() (dissect.cstruct.expression.ExpressionTokenizer method) (dissect.cstruct.parser.TokenConsumer method) EON (dissect.target.plugins.os.windows.network.IfTypes attribute) EOW_BM_SIGNATURE (in module dissect.fve.bde.c_bde) EOW_BR_SIGNATURE (in module dissect.fve.bde.c_bde) eow_information (dissect.fve.bde.BDE attribute) (dissect.fve.bde.bde.BDE attribute) EOW_INFORMATION_OFFSET_GUID (in module dissect.fve.bde.c_bde) eow_offsets (dissect.fve.bde.bde.BootSector attribute) EOW_SIGNATURE (in module dissect.fve.bde.c_bde) EowBitmap (class in dissect.fve.bde.eow) EowBitmapRecord (class in dissect.fve.bde.eow) EowInformation (class in dissect.fve.bde.eow) ephemeral_objects (dissect.apfs.objects.nx_superblock.NxSuperblock property) (dissect.apfs.objects.NxSuperblock property) EPLRS (dissect.target.plugins.os.windows.network.IfTypes attribute) EPOCH (in module flow.record.adapter.avro) epoch_days_to_datetime() (in module dissect.target.plugins.os.unix.shadow) EQ (dissect.util.ldap.ComparisonOperator attribute) Equal (dissect.ntfs.index.Match attribute) equal() (dissect.cstruct.expression.ExpressionTokenizer method) ERR (dissect.target.plugins.os.unix.log.journal.JournalMessagePriority attribute) ERR_ACCES (dissect.target.helpers.nfs.nfs3.MountStat attribute) (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_BADHANDLE (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_DQUOT (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_EXIST (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_FBIG (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_INVAL (dissect.target.helpers.nfs.nfs3.MountStat attribute) (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_IO (dissect.target.helpers.nfs.nfs3.MountStat attribute) (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_ISDIR (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_MLINK (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_NAMETOOLONG (dissect.target.helpers.nfs.nfs3.MountStat attribute) (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_NODEV (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_NOENT (dissect.target.helpers.nfs.nfs3.MountStat attribute) (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_NOSPC (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_NOTDIR (dissect.target.helpers.nfs.nfs3.MountStat attribute) (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_NOTEMPTY (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_NOTSUPP (dissect.target.helpers.nfs.nfs3.MountStat attribute) ERR_NXIO (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_PERM (dissect.target.helpers.nfs.nfs3.MountStat attribute) (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_REMOTE (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_ROFS (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_SERVERFAULT (dissect.target.helpers.nfs.nfs3.MountStat attribute) ERR_STALE (dissect.target.helpers.nfs.nfs3.NfsStat attribute) ERR_XDEV (dissect.target.helpers.nfs.nfs3.NfsStat attribute) errno (dissect.target.exceptions.FileNotFoundError attribute) (dissect.target.exceptions.IsADirectoryError attribute) (dissect.target.exceptions.NotADirectoryError attribute) (dissect.target.exceptions.NotASymlinkError attribute) (dissect.target.exceptions.SymlinkRecursionError attribute) Error, [1], [2], [3], [4], [5], [6], [7], [8], [9], [10], [11], [12], [13], [14], [15], [16], [17], [18], [19], [20], [21], [22], [23], [24], [25], [26], [27], [28], [29], [30], [31], [32], [33], [34], [35], [36], [37], [38], [39], [40], [41], [42], [43], [44], [45], [46], [47], [48] error() (dissect.target.plugins.apps.webserver.apache.ApachePlugin method) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin method) ERROR_ACCESS_DENIED (acquire.acquire.dynamic.windows.types.ErrorCode attribute) error_handler() (in module dissect.util.encoding.surrogateescape) ERROR_INVALID_PARAMETER (acquire.acquire.dynamic.windows.types.ErrorCode attribute) ERROR_LOG_NAMES (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) (dissect.target.plugins.apps.webserver.citrix.CitrixWebserverPlugin attribute) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin attribute) ERROR_NOT_ALL_ASSIGNED (acquire.acquire.dynamic.windows.types.ErrorCode attribute) ERROR_PARTIAL_COPY (acquire.acquire.dynamic.windows.types.ErrorCode attribute) error_paths (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin attribute) ERROR_SUCCESS (acquire.acquire.dynamic.windows.types.ErrorCode attribute) ErrorCode (class in acquire.acquire.dynamic.windows.types) ErrorHeader (class in dissect.etl.headers.headers) errorlog() (dissect.target.plugins.os.windows.log.mssql.MssqlPlugin method) ErrorLogDatum (class in dissect.fve.bde.information) ErrorSegment (class in dissect.volume.lvm.metadata) es (flow.record.adapter.elastic.ElasticReader attribute) (flow.record.adapter.elastic.ElasticWriter attribute) ES_PASSWORD (in module acquire.acquire.gui.win32) ES_WANTRETURN (in module acquire.acquire.gui.win32) ESCAPE (in module flow.record.adapter.splunk) escape_field_name() (in module flow.record.adapter.splunk) escape_str() (in module dissect.target.tools.utils.cli) ESCON (dissect.target.plugins.os.windows.network.IfTypes attribute) ESE (class in dissect.database) (class in dissect.database.ese) (class in dissect.database.ese.ese) ese_def (in module dissect.database.ese.c_ese) ESENT_DB (class in dissect.database.ese.tools.impacket) ESP (dissect.target.helpers.network.IANAProtocol attribute) ESSIV (class in dissect.fve.crypto.base) ESTABLISHED (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) (dissect.target.plugins.os.unix.linux.proc.Sockets.UDPStates attribute) esxconf() (dissect.target.plugins.os.unix.esxi._os.ESXiPlugin method) ESXi (class in acquire.acquire.acquire) ESXI (dissect.target.plugin.OperatingSystem attribute) ESXI_DEV_DIR (in module dissect.target.loaders.local) esxi_hash() (in module dissect.target.plugins.os.unix.esxi._os) esxi_memory_context_manager() (in module acquire.acquire.esxi) ESXiChildTargetPlugin (class in dissect.target.plugins.child.esxi) EsxiMemoryManager (class in acquire.acquire.esxi) ESXiPlugin (class in dissect.target.plugins.os.unix.esxi._os) ESXiProfile (class in acquire.acquire.acquire) Etc (class in acquire.acquire.acquire) etc() (dissect.target.plugins.os.unix.etc.etc.EtcTree method) EtcTree (class in dissect.target.plugins.os.unix.etc.etc) ETH_P_802_2 (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_802_3 (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_ALL (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_ARCNET (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_AX25 (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_CAN (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_CONTROL (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_DDCMP (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_DSA (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_ECONET (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_HDLC (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_IEEE802154 (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_IRDA (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_LOCALTALK (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_MOBITEX (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_PHONET (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_PPP_MP (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_PPPTALK (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_SNAP (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_TR_802_2 (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_TRAILER (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETH_P_WAN_PPP (dissect.target.plugins.os.unix.linux.proc.Sockets.PacketProtocolTypes attribute) ETHERIP (dissect.target.helpers.network.IANAProtocol attribute) ETHERNET (dissect.target.helpers.network.IANAProtocol attribute) ETHERNET_3MBIT (dissect.target.plugins.os.windows.network.IfTypes attribute) ETHERNET_CSMACD (dissect.target.plugins.os.windows.network.IfTypes attribute) ETL (class in acquire.acquire.acquire) (class in dissect.etl) (class in dissect.etl.etl) etl (dissect.etl.Buffer attribute) (dissect.etl.etl.Buffer attribute) etl() (dissect.target.plugins.os.windows.log.etl.EtlPlugin method) etl_def (in module dissect.etl.c_etl) EtlPlugin (class in dissect.target.plugins.os.windows.log.etl) EtlRecordBuilder (class in dissect.target.plugins.os.windows.log.etl) ETW_REGISTRATION (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) eval() (flow.record.selector.RecordContextMatcher method) evaluate() (dissect.cstruct.Expression method) (dissect.cstruct.expression.Expression method) evaluate_exp() (dissect.cstruct.Expression method) (dissect.cstruct.expression.Expression method) EVENT (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) Event (class in dissect.etl.etl) (class in dissect.target.target) event (dissect.etl.etl.EventRecord property) (flow.record.adapter.elastic.ElasticWriter attribute) EVENT_KEY (dissect.etl.headers.event.ExtType attribute) event_property (dissect.etl.headers.headers.MessageTraceHeader property) event_provider (dissect.eventlog.wevt.WEVT attribute) EVENT_SCHEMA_TL (dissect.etl.headers.event.ExtType attribute) event_values() (dissect.etl.etl.Event method) EventCategory (dissect.eventlog.evt.Record attribute) EventCode (dissect.eventlog.evt.Record attribute) EventCustomerFlag (dissect.eventlog.evt.Record attribute) EventDescriptor (class in dissect.etl.headers.event) EventFacility (dissect.eventlog.evt.Record attribute) EventFilter (class in dissect.target.plugins.os.windows.cim) EventHandler (class in flow.record.utils) EventHeader (class in dissect.etl.headers.event) EventHeaderExtendedDataItem (class in dissect.etl.headers.event) EventID (dissect.eventlog.evt.Record attribute) EventInstanceGUIDHeader (class in dissect.etl.headers.headers) EventInstanceHeader (class in dissect.etl.headers.headers) EVENTLOG_REGISTRY_KEY (dissect.target.plugins.os.windows.log.evt.WindowsEventlogsMixin attribute) EVENTLOGRECORD_SIZE (in module dissect.eventlog.evt) EventLogs (class in acquire.acquire.acquire) EventProperty (class in dissect.etl.headers.headers) EventRecord (class in dissect.etl.etl) EventSeverity (dissect.eventlog.evt.Record attribute) EventTraceConfigGuid (in module dissect.etl.utils) EventTraceGuid (in module dissect.etl.utils) EventTraceHeader (class in dissect.etl.headers.headers) EventTraceSpare1 (in module dissect.etl.utils) EventTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) EventType (dissect.eventlog.evt.Record attribute) EverythingDB (class in dissect.target.plugins.os.windows.everything.parser) EverythingFSType (class in dissect.target.plugins.os.windows.everything.parser) EverythingIndexObj (class in dissect.target.plugins.os.windows.everything.parser) EverythingVarInt (class in dissect.target.plugins.os.windows.everything.parser) evidence (dissect.target.loaders.cellebrite.Ufdx attribute) EVNT (class in dissect.eventlog.wevt_object) Evt (class in dissect.eventlog) (class in dissect.eventlog.evt) evt() (dissect.target.plugins.os.windows.log.evt.EvtPlugin method) evt_def (in module dissect.eventlog.evt) EVT_GLOB (in module dissect.target.plugins.os.windows.log.evt) EVTHANDLE (dissect.eventlog.bxml.BxmlType attribute) EvtPlugin (class in dissect.target.plugins.os.windows.log.evt) EvtRecordDescriptor (in module dissect.target.plugins.os.windows.log.evt) Evtx (class in dissect.eventlog) (class in dissect.eventlog.evtx) evtx() (dissect.target.plugins.os.windows.log.evtx.EvtxPlugin method) evtx_def (in module dissect.eventlog.evtx) EVTX_GLOB (in module dissect.target.plugins.os.windows.log.evtx) EVTXML (dissect.eventlog.bxml.BxmlType attribute) EvtxNameReader (class in dissect.eventlog.bxml) EvtxPlugin (class in dissect.target.plugins.os.windows.log.evtx) EWF (class in dissect.evidence) (class in dissect.evidence.ewf) ewf (dissect.evidence.ewf.EWFStream attribute) (dissect.evidence.ewf.Segment attribute) ewf_def (in module dissect.evidence.ewf) EwfContainer (class in dissect.target.containers.ewf) EWFError ewfheader (dissect.evidence.ewf.Segment attribute) EWFStream (class in dissect.evidence.ewf) example() (dissect.target.plugins.general.example.ExamplePlugin method) example_internal() (dissect.target.plugins.general.example.ExamplePlugin method) example_none() (dissect.target.plugins.general.example.ExamplePlugin method) example_record() (dissect.target.plugins.general.example.ExampleNamespacePlugin method) (dissect.target.plugins.general.example.ExamplePlugin method) example_user_registry_record() (dissect.target.plugins.general.example.ExamplePlugin method) example_yield() (dissect.target.plugins.general.example.ExamplePlugin method) ExampleNamespacePlugin (class in dissect.target.plugins.general.example) ExamplePlugin (class in dissect.target.plugins.general.example) ExampleRecordRecord (in module dissect.target.plugins.general.example) ExampleUserRegistryRecord (in module dissect.target.plugins.general.example) excepthook() (flow.record.adapter.elastic.ElasticWriter method) exception (flow.record.adapter.elastic.ElasticWriter attribute) ExceptionDirectory (class in dissect.executable.pe.directory) (class in dissect.executable.pe.directory.exception) exceptions (dissect.executable.PE property) (dissect.executable.pe.PE property) (dissect.executable.pe.pe.PE property) Exchange (class in acquire.acquire.acquire) ExchangePlugin (class in dissect.target.plugins.os.windows.exchange.exchange) exclude (flow.record.adapter.csvfile.CsvfileWriter attribute) (flow.record.adapter.line.LineWriter attribute) (flow.record.stream.RecordFieldRewriter attribute) excluded_functions (dissect.target.tools.dump.DumpState attribute) EXEC_ORDER (acquire.acquire.acquire.Devices attribute) (acquire.acquire.acquire.Module attribute) (acquire.acquire.acquire.Netstat attribute) (acquire.acquire.acquire.Proc attribute) (acquire.acquire.acquire.ProcNet attribute) (acquire.acquire.acquire.Sys attribute) (acquire.acquire.acquire.WinArpCache attribute) (acquire.acquire.acquire.WinDnsClientCache attribute) (acquire.acquire.acquire.WinMemDump attribute) (acquire.acquire.acquire.WinProcEnv attribute) (acquire.acquire.acquire.WinProcesses attribute) (acquire.acquire.acquire.WinRDPSessions attribute) ExecRecord (in module dissect.target.plugins.os.windows.tasks.records) executable (flow.record.fieldtypes.command attribute) execute_function() (in module dissect.target.tools.dump) execute_function_on_target() (in module dissect.target.tools.utils.cli) execute_functions() (in module dissect.target.tools.dump) execute_pipeline() (in module dissect.target.tools.dump) execution_time_limit (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) ExecutionOrder (class in acquire.acquire.acquire) ExecutionReport (class in dissect.target.tools.utils.report) ExFAT (class in dissect.fat) (class in dissect.fat.exfat) exfat (dissect.target.filesystems.exfat.ExfatFilesystem attribute) exfat_def (in module dissect.fat.c_exfat) ExfatFilesystem (class in dissect.target.filesystems.exfat) ExfatFilesystemEntry (class in dissect.target.filesystems.exfat) ExfatFileTree (in module dissect.target.filesystems.exfat) exists() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystems.config.ConfigurationEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.helpers.compat.path_313.TargetPath method) exit_code (dissect.target.plugins.os.windows.log.schedlgu.SchedLgU attribute) exit_failure() (in module acquire.acquire.acquire) exit_success() (in module acquire.acquire.acquire) EXITED (dissect.target.plugins.apps.container.podman.ContainerState attribute) expand_config_file_paths() (dissect.target.plugins.os.unix.linux.network_managers.Parser method) expand_des_key() (in module dissect.target.plugins.os.windows.credential.sam) expand_env() (dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin method) EXPAND_SZ (dissect.target.helpers.regutil.RegistryValueType attribute) expanduser() (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) EXPANSION (dissect.database.ese.lcmapstring.SCRIPT attribute) explain_selector() (flow.record.selector.Selector method) export() (in module dissect.target.plugin) ExportDirectory (class in dissect.executable.pe.directory) (class in dissect.executable.pe.directory.export) exported (dissect.target.plugin.FunctionDescriptor attribute) exported_key() (dissect.fve.bde.information.VmkInfoDatum method) ExportedPublicKeyDatum (class in dissect.fve.bde.information) ExportFunction (class in dissect.executable.pe.directory.export) exports (dissect.executable.PE property) (dissect.executable.pe.PE property) (dissect.executable.pe.pe.PE property) (dissect.target.plugin.PluginDescriptor attribute) Expression (class in dissect.cstruct) (class in dissect.cstruct.expression) expression (dissect.cstruct.Expression attribute) (dissect.cstruct.expression.Expression attribute) (dissect.cstruct.expression.ExpressionTokenizer attribute) EXPRESSION (dissect.database.sqlite3.Column attribute) (dissect.database.sqlite3.sqlite3.Column attribute) expression (flow.record.selector.CompiledSelector attribute) (flow.record.selector.RecordContextMatcher attribute) (flow.record.selector.Selector attribute) (flow.record.stream.RecordFieldRewriter attribute) expression_str (flow.record.selector.RecordContextMatcher attribute) (flow.record.selector.Selector attribute) ExpressionParserError ExpressionTokenizer (class in dissect.cstruct.expression) ExpressionTokenizerError expresssion_str (flow.record.selector.SelectorResult attribute) EXT2 (in module dissect.extfs.c_ext) EXT3 (in module dissect.extfs.c_ext) EXT4 (in module dissect.extfs.c_ext) ext_def (in module dissect.extfs.c_ext) ext_metadata (dissect.vmfs.Device attribute) (dissect.vmfs.lvm.Device attribute) ext_type (dissect.etl.headers.event.EventHeaderExtendedDataItem attribute) EXT_TYPE (flow.record.packer.RecordPacker attribute) extend() (flow.record.base.RecordDescriptor method) (flow.record.RecordDescriptor method) extend_args() (in module dissect.target.tools.shell) extend_record() (in module flow.record) (in module flow.record.base) ExtendableRecordDescriptor (class in dissect.target.helpers.record) EXTENDED (dissect.util.ldap.ComparisonOperator attribute) EXTENDED_DATA_READERS (in module dissect.etl.headers.event) ExtendedCmd (class in dissect.target.tools.shell) ExtendedDataItemException, [1] extension (dissect.target.plugins.os.windows.regf.shellbags.ROOT_FOLDER attribute) (dissect.thumbcache.thumbcache_file.ThumbcacheEntry property) (dissect.thumbcache.ThumbcacheEntry property) extension() (dissect.target.plugins.os.windows.regf.shellbags.SHITEM method) EXTENSION_A (dissect.database.ese.lcmapstring.SCRIPT attribute) EXTENSION_BLOCK (class in dissect.target.plugins.os.windows.regf.shellbags) EXTENSION_BLOCK_BEEF0004 (class in dissect.target.plugins.os.windows.regf.shellbags) EXTENSION_BLOCK_BEEF0005 (class in dissect.target.plugins.os.windows.regf.shellbags) extensions (dissect.target.plugins.os.windows.regf.shellbags.SHITEM attribute) EXTENSIONS (in module dissect.target.loaders.res) extensions() (dissect.target.plugins.apps.browser.brave.BravePlugin method) (dissect.target.plugins.apps.browser.chrome.ChromePlugin method) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin method) (dissect.target.plugins.apps.browser.chromium.ChromiumPlugin method) (dissect.target.plugins.apps.browser.edge.EdgePlugin method) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin method) (dissect.target.plugins.apps.editor.editor.EditorPlugin method) Extent (class in dissect.archive.vma) (class in dissect.btrfs.stream) extent_count (dissect.volume.lvm.metadata.Segment attribute) extent_size (dissect.volume.lvm.metadata.VolumeGroup attribute) ExtentDescriptor (class in dissect.hypervisor.disk.vmdk) extents (dissect.btrfs.btrfs.INode attribute) (dissect.btrfs.INode attribute) (dissect.btrfs.stream.ExtentStream attribute) (dissect.hypervisor.disk.vmdk.DiskDescriptor attribute) (dissect.ntfs.usnjrnl.UsnRecord attribute) (dissect.ntfs.UsnRecord attribute) extents() (dissect.archive.vma.VMA method) extents_moved (dissect.volume.lvm.metadata.MirrorSegment attribute) ExtentStream (class in dissect.btrfs.stream) external_key() (dissect.fve.bde.information.ExternalInfoDatum method) external_origin (dissect.volume.lvm.metadata.ThinSegment attribute) ExternalInfoDatum (class in dissect.fve.bde.information) ExtFibItem (class in dissect.archive.vbk) ExtFilesystem (class in dissect.target.filesystems.extfs) ExtFilesystemEntry (class in dissect.target.filesystems.extfs) ExtFS (class in dissect.extfs) (class in dissect.extfs.extfs) extfs (dissect.extfs.extfs.INode attribute) (dissect.extfs.extfs.XAttr attribute) (dissect.extfs.INode attribute) (dissect.target.filesystems.extfs.ExtFilesystem attribute) EXTFS_NEEDLE (in module dissect.target.loaders.phobos) EXTFS_NEEDLE_OFFSET (in module dissect.target.loaders.phobos) extra (dissect.archive.wim.DirectoryEntry attribute) (dissect.hypervisor.disk.qcow2.QCow2Snapshot attribute) EXTRA_DATA_BLOCK_SIGNATURES (class in dissect.shellitem.lnk.c_lnk) extract_bin() (in module dissect.target.plugins.os.windows.rdpcache) extract_bmc() (in module dissect.target.plugins.os.windows.rdpcache) extract_crypt_details() (in module dissect.target.plugins.os.unix.shadow) extract_drive_letter() (in module dissect.target.loaders.velociraptor) extract_ips() (in module dissect.target.helpers.regex.ipaddress) extract_name() (dissect.eventlog.wevt_object.WevtObject method) extract_vbk() (in module dissect.archive.tools.backup) extract_vma() (in module dissect.archive.tools.backup) Extraction (class in dissect.target.loaders.cellebrite) extractions (dissect.target.loaders.cellebrite.Ufdx attribute) extradata (dissect.shellitem.lnk.Lnk attribute) (dissect.shellitem.lnk.lnk.Lnk attribute) (dissect.shellitem.lnk.lnk.LnkExtraData attribute) ExtType (class in dissect.etl.headers.event) F factor (dissect.target.loaders.mqtt.Broker attribute) (dissect.target.loaders.mqtt.MqttConnection attribute) failed() (in module dissect.target.plugin) FailedImport (class in dissect.target.helpers.lazy) FAILURE (acquire.acquire.collector.Outcome attribute) FailureDescriptor (class in dissect.target.plugin) FALLBACK_LS_COLORS (in module dissect.target.tools.utils.fs) FALLBACK_SEARCH_PATHS (in module dissect.target.plugins.filesystem.resolver) FALSE (dissect.target.helpers.sunrpc.sunrpc.Bool attribute) far_copies (dissect.volume.raid.stream.RAID10Stream attribute) far_offset (dissect.volume.raid.stream.RAID10Stream attribute) FAST (dissect.target.plugins.os.windows.network.IfTypes attribute) FASTETHER (dissect.target.plugins.os.windows.network.IfTypes attribute) FASTETHER_FX (dissect.target.plugins.os.windows.network.IfTypes attribute) FastLeaf (class in dissect.regf.regf) FAT (class in dissect.fat.fat) fat (dissect.fat.ExFAT attribute) (dissect.fat.exfat.ExFAT attribute) (dissect.fat.fat.FATFS attribute) (dissect.fat.FATFS attribute) fat() (dissect.ole.OLE method) (dissect.ole.ole.OLE method) FAT12_EOC (in module dissect.fat.c_fat) fat_def (in module dissect.fat.c_fat) FAT_ENTRY_SIZE (in module dissect.fat.c_exfat) fat_sector (dissect.fat.ExFAT attribute) (dissect.fat.exfat.ExFAT attribute) fat_sector_count (dissect.fat.ExFAT attribute) (dissect.fat.exfat.ExFAT attribute) fat_size (dissect.fat.ExFAT attribute) (dissect.fat.exfat.ExFAT attribute) (dissect.fat.fat.FATFS attribute) (dissect.fat.FATFS attribute) FatalError FatFilesystem (class in dissect.target.filesystems.fat) FatFilesystemEntry (class in dissect.target.filesystems.fat) FATFS (class in dissect.fat) (class in dissect.fat.fat) fatfs (dissect.target.filesystems.fat.FatFilesystem attribute) Fattype (in module dissect.fat.c_fat) FB (dissect.vmfs.resource.ResourceManager property) FC (dissect.target.helpers.network.IANAProtocol attribute) fd (acquire.acquire.volatilestream.VolatileStream attribute) (dissect.vmfs.descriptor.DirEntry attribute) (dissect.vmfs.DirEntry attribute) (dissect.vmfs.resource.ResourceFile attribute) FD (dissect.vmfs.resource.ResourceManager property) FDDI (dissect.target.plugins.os.windows.network.IfTypes attribute) fDerived (dissect.database.ese.record.TagField attribute) feature_table (dissect.hypervisor.disk.qcow2.QCow2 attribute) features (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) (dissect.apfs.objects.nx_superblock.NxSuperblock property) (dissect.apfs.objects.NxSuperblock property) fext_tree (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) ff (dissect.target.containers.fortifw.FortiFirmwareContainer attribute) FFS (class in dissect.ffs) (class in dissect.ffs.ffs) ffs (dissect.target.filesystems.ffs.FfsFilesystem attribute) (dissect.target.loaders.cellebrite.CellebriteLoader attribute) ffs_def (in module dissect.ffs.c_ffs) FfsFilesystem (class in dissect.target.filesystems.ffs) FfsFilesystemEntry (class in dissect.target.filesystems.ffs) fguid (dissect.target.loaders.cellebrite.DeviceInfo attribute) fh (acquire.acquire.crypt.EncryptedStream attribute) (acquire.acquire.tools.decrypter.EncryptedFile attribute) (acquire.acquire.volatilestream.VolatileStream attribute) (dissect.apfs.APFS attribute) (dissect.apfs.apfs.APFS attribute) (dissect.archive.vbk.VBK attribute) (dissect.archive.vma.Extent attribute) (dissect.archive.vma.VMA attribute) (dissect.archive.wim.CompressedStream attribute) (dissect.archive.wim.DirectoryEntry attribute) (dissect.archive.wim.WIM attribute) (dissect.btrfs.stream.Stripe attribute) (dissect.cim.classes.ClassDefinition attribute) (dissect.cim.classes.ClassInstance attribute) (dissect.cim.classes.DataRegion attribute) (dissect.cim.classes.DynpropQualifier attribute) (dissect.cim.classes.Dynprops attribute) (dissect.cim.classes.PropertyDefaultValues attribute) (dissect.cim.classes.PropertyReference attribute) (dissect.cim.classes.PropertyStates attribute) (dissect.cim.classes.QualifierReference attribute) (dissect.cim.index.IndexPage attribute) (dissect.cim.index.Store attribute) (dissect.cim.objects.DataPage attribute) (dissect.cim.objects.Store attribute) (dissect.cim.objects.TOC attribute) (dissect.clfs.blf.BLF attribute) (dissect.clfs.container.Container attribute) (dissect.cramfs.CramFS attribute) (dissect.cramfs.cramfs.CramFS attribute) (dissect.database.bsd.DB attribute) (dissect.database.bsd.db.DB attribute) (dissect.database.DB attribute) (dissect.database.ESE attribute) (dissect.database.ese.ESE attribute) (dissect.database.ese.ese.ESE attribute) (dissect.database.SQLite3 attribute) (dissect.database.sqlite3.SQLite3 attribute) (dissect.database.sqlite3.sqlite3.SQLite3 attribute) (dissect.database.sqlite3.sqlite3.WAL attribute) (dissect.database.sqlite3.sqlite3.WALFrame attribute) (dissect.database.sqlite3.WAL attribute) (dissect.etl.Buffer attribute) (dissect.etl.ETL attribute) (dissect.etl.etl.Buffer attribute) (dissect.etl.etl.ETL attribute) (dissect.eventlog.CRIM attribute) (dissect.eventlog.Evt attribute) (dissect.eventlog.evt.Evt attribute) (dissect.eventlog.Evtx attribute) (dissect.eventlog.evtx.Evtx attribute) (dissect.eventlog.wevt.CRIM attribute) (dissect.evidence.ad1.AD1 attribute) (dissect.evidence.ad1.LogicalImage attribute) (dissect.evidence.asdf.asdf.AsdfSnapshot attribute) (dissect.evidence.asdf.asdf.AsdfStream attribute) (dissect.evidence.asdf.asdf.AsdfWriter attribute) (dissect.evidence.asdf.AsdfSnapshot attribute) (dissect.evidence.asdf.AsdfStream attribute) (dissect.evidence.asdf.AsdfWriter attribute) (dissect.evidence.asdf.streams.SubStreamBase attribute) (dissect.evidence.AsdfSnapshot attribute) (dissect.evidence.AsdfStream attribute) (dissect.evidence.EWF attribute) (dissect.evidence.ewf.EWF attribute) (dissect.evidence.ewf.SectionDescriptor attribute) (dissect.evidence.ewf.Segment attribute) (dissect.executable.ELF attribute) (dissect.executable.elf.ELF attribute) (dissect.executable.elf.elf.ELF attribute) (dissect.executable.elf.elf.Section attribute) (dissect.executable.elf.elf.SectionTable attribute) (dissect.executable.elf.elf.Segment attribute) (dissect.executable.elf.elf.SegmentTable attribute) (dissect.executable.elf.Section attribute) (dissect.executable.elf.SectionTable attribute) (dissect.executable.elf.Segment attribute) (dissect.executable.elf.SegmentTable attribute) (dissect.executable.PE attribute) (dissect.executable.pe.PE attribute) (dissect.executable.pe.pe.PE attribute) (dissect.extfs.ExtFS attribute) (dissect.extfs.extfs.ExtFS attribute) (dissect.extfs.JDB2 attribute) (dissect.extfs.journal.JDB2 attribute) (dissect.fat.fat.FAT attribute) (dissect.fat.fat.FATFS attribute) (dissect.fat.FATFS attribute) (dissect.ffs.FFS attribute) (dissect.ffs.ffs.FFS attribute) (dissect.fve.bde.BDE attribute) (dissect.fve.bde.bde.BDE attribute) (dissect.fve.bde.eow.EowBitmap attribute) (dissect.fve.bde.eow.EowBitmapRecord attribute) (dissect.fve.bde.eow.EowInformation attribute) (dissect.fve.crypto.dmcrypt.CryptStream attribute) (dissect.fve.luks.LUKS attribute) (dissect.fve.luks.luks.LUKS attribute) (dissect.hypervisor.descriptor.hyperv.HyperVFile attribute) (dissect.hypervisor.descriptor.ovf.OVF attribute) (dissect.hypervisor.disk.asif.ASIF attribute) (dissect.hypervisor.disk.hdd.HDS attribute) (dissect.hypervisor.disk.vdi.VDI attribute) (dissect.hypervisor.disk.vhd.BlockAllocationTable attribute) (dissect.hypervisor.disk.vhd.Disk attribute) (dissect.hypervisor.disk.vhd.VHD attribute) (dissect.hypervisor.disk.vhdx.MetadataTable attribute) (dissect.hypervisor.disk.vhdx.ParentLocator attribute) (dissect.hypervisor.disk.vhdx.RegionTable attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) (dissect.hypervisor.disk.vmdk.RawDisk attribute) (dissect.hypervisor.disk.vmdk.SparseDisk attribute) (dissect.hypervisor.util.envelope.Envelope attribute) (dissect.jffs.JFFS2 attribute) (dissect.jffs.jffs2.JFFS2 attribute) (dissect.ntfs.attr.AttributeHeader attribute) (dissect.ntfs.AttributeHeader attribute) (dissect.ntfs.index.IndexEntry attribute) (dissect.ntfs.index.IndexRoot attribute) (dissect.ntfs.IndexEntry attribute) (dissect.ntfs.Mft attribute) (dissect.ntfs.mft.Mft attribute) (dissect.ntfs.NTFS attribute) (dissect.ntfs.ntfs.NTFS attribute) (dissect.ntfs.UsnJrnl attribute) (dissect.ntfs.usnjrnl.UsnJrnl attribute) (dissect.ole.OLE attribute) (dissect.ole.ole.OLE attribute) (dissect.qnxfs.QNX4 attribute) (dissect.qnxfs.qnx4.QNX4 attribute) (dissect.qnxfs.QNX6 attribute) (dissect.qnxfs.qnx6.QNX6 attribute) (dissect.regf.regf.RegistryHive attribute) (dissect.regf.RegistryHive attribute) (dissect.shellitem.lnk.Lnk attribute) (dissect.shellitem.lnk.lnk.Lnk attribute) (dissect.shellitem.lnk.lnk.LnkInfo attribute) (dissect.squashfs.SquashFS attribute) (dissect.squashfs.squashfs.SquashFS attribute) (dissect.target.container.Container attribute) (dissect.target.containers.fortifw.FortiFirmwareFile attribute) (dissect.target.filesystem.VirtualFileHandle attribute) (dissect.target.filesystems.itunes.EncryptedFileStream attribute) (dissect.target.helpers.cache.LineWriter attribute) (dissect.target.loaders.ab.AndroidBackup attribute) (dissect.target.loaders.res.UPF attribute) (dissect.target.loaders.res.UPR attribute) (dissect.target.loaders.tar.TarLoader attribute) (dissect.target.loaders.zip.ZipLoader attribute) (dissect.target.plugins.os.unix.locate.gnulocate.GNULocateFile attribute) (dissect.target.plugins.os.unix.locate.mlocate.MLocateFile attribute) (dissect.target.plugins.os.unix.locate.plocate.PLocateFile attribute) (dissect.target.plugins.os.unix.log.atop.AtopFile attribute) (dissect.target.plugins.os.unix.log.journal.JournalFile attribute) (dissect.target.plugins.os.unix.log.lastlog.LastLogFile attribute) (dissect.target.plugins.os.unix.log.utmp.UtmpFile attribute) (dissect.target.plugins.os.windows.credential.credhist.CredHistFile attribute) (dissect.target.plugins.os.windows.everything.parser.EverythingDB attribute) (dissect.target.plugins.os.windows.jumplist.JumpListFile attribute) (dissect.target.plugins.os.windows.prefetch.Prefetch attribute) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK attribute) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM attribute) (dissect.target.plugins.os.windows.regf.shimcache.ShimCache attribute) (dissect.target.volume.Volume attribute) (dissect.target.volume.VolumeSystem attribute) (dissect.thumbcache.index.IndexEntry attribute) (dissect.thumbcache.index.ThumbnailIndex attribute) (dissect.thumbcache.IndexEntry attribute) (dissect.thumbcache.thumbcache_file.ThumbcacheFile attribute) (dissect.thumbcache.ThumbcacheFile attribute) (dissect.thumbcache.ThumbnailIndex attribute) (dissect.vmfs.Device attribute) (dissect.vmfs.lvm.Device attribute) (dissect.vmfs.resource.ResourceFile attribute) (dissect.vmfs.VMFS attribute) (dissect.vmfs.vmfs.VMFS attribute) (dissect.volume.disk.Disk attribute) (dissect.volume.disk.disk.Disk attribute) (dissect.volume.disk.schemes.APM attribute) (dissect.volume.disk.schemes.apm.APM attribute) (dissect.volume.disk.schemes.BSD attribute) (dissect.volume.disk.schemes.bsd.BSD attribute) (dissect.volume.disk.schemes.GPT attribute) (dissect.volume.disk.schemes.gpt.GPT attribute) (dissect.volume.disk.schemes.MBR attribute) (dissect.volume.disk.schemes.mbr.MBR attribute) (dissect.volume.dm.btree.BTree attribute) (dissect.volume.dm.thin.Metadata attribute) (dissect.volume.lvm.LVM2 attribute) (dissect.volume.lvm.lvm2.LVM2 attribute) (dissect.volume.lvm.LVM2Device attribute) (dissect.volume.lvm.physical.LVM2Device attribute) (dissect.volume.raid.raid.PhysicalDisk attribute) (dissect.volume.vinum.vinum.VinumPhysicalDisk attribute) (dissect.volume.vss.Catalog attribute) (dissect.volume.vss.Store attribute) (dissect.volume.vss.VSS attribute) (dissect.xfs.XFS attribute) (dissect.xfs.xfs.AllocationGroup attribute) (dissect.xfs.xfs.XFS attribute) fhs (dissect.btrfs.Btrfs attribute) (dissect.btrfs.btrfs.Btrfs attribute) FibBlockDescriptor (class in dissect.archive.vbk) FibBlockDescriptorV7 (class in dissect.archive.vbk) FibMetaSparseTable (class in dissect.archive.vbk) FIBRECHANNEL (dissect.target.plugins.os.windows.network.IfTypes attribute) FibStream (class in dissect.archive.vbk) FID (in module dissect.fat.c_exfat) Field (class in dissect.cstruct) (class in dissect.cstruct.types) (class in dissect.cstruct.types.structure) field_contains() (in module flow.record.selector) field_count (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntryResource attribute) field_equals() (in module flow.record.selector) field_fillers (dissect.target.helpers.record.ExtendableRecordDescriptor attribute) FIELD_IDENTIFIER (in module dissect.target.plugins.os.windows.defender.quarantine) FIELD_MAP (in module dissect.etl.manifest) (in module flow.record.adapter.sqlite) FIELD_MAPPINGS (in module dissect.target.plugins.os.windows.sru) FIELD_NAME_INVALID_CHARS_RE (in module dissect.target.plugins.apps.webserver.iis) FIELD_NAME_MAP (in module dissect.target.plugins.os.windows.ual) FIELD_NAMES (dissect.target.plugins.os.windows.regf.muicache.MuiCachePlugin attribute) field_regex() (in module flow.record.selector) field_types_for_record_descriptor() (in module flow.record.adapter.line) fields (dissect.cstruct.types.structure.StructureMetaType attribute) (dissect.target.helpers.configutil.CSVish attribute) (dissect.target.helpers.configutil.ParserConfig attribute) (dissect.target.plugins.os.windows.firewall.LogConfig attribute) (flow.record.adapter.csvfile.CsvfileReader attribute) (flow.record.adapter.csvfile.CsvfileWriter attribute) (flow.record.adapter.line.LineWriter attribute) (flow.record.base.RecordDescriptor property) (flow.record.RecordDescriptor property) (flow.record.stream.RecordFieldRewriter attribute) FieldType (class in flow.record) (class in flow.record.base) (class in flow.record.fieldtypes) fieldtype() (in module flow.record.base) fieldtype_for_value() (in module flow.record.fieldtypes) FIFO (dissect.target.helpers.nfs.nfs3.FileType attribute) FILE (acquire.acquire.collector.ArtifactType attribute) (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) File (class in dissect.database.bsd.tools.rpm) (class in dissect.target.loaders.res) file (dissect.hypervisor.descriptor.hyperv.HyperVStorageFileObject attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageObjectTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageReplayLog attribute) (dissect.hypervisor.disk.hdd.Image attribute) (dissect.ntfs.usnjrnl.UsnRecord property) (dissect.ntfs.UsnRecord property) FILE (dissect.target.helpers.keychain.KeyType attribute) file (dissect.target.helpers.nfs.nfs3.ReadParams attribute) (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadTab attribute) FILE_ATTRIBUTE (in module dissect.archive.c_wim) file_attributes (dissect.clfs.blf.Stream attribute) (dissect.ntfs.attr.FileName property) (dissect.ntfs.attr.StandardInformation property) (dissect.target.helpers.nfs.nfs3.ReadResult attribute) file_block_size (dissect.vmfs.VMFS attribute) (dissect.vmfs.vmfs.VMFS attribute) file_count (flow.record.adapter.split.SplitWriter attribute) file_descriptor (dissect.vmfs.descriptor.DirEntry property) (dissect.vmfs.DirEntry property) (dissect.vmfs.VMFS attribute) (dissect.vmfs.vmfs.VMFS attribute) FILE_DIFF_RECORD_FIELDS (in module dissect.target.tools.diff) FILE_ENTRY (class in dissect.target.plugins.os.windows.regf.shellbags) (in module dissect.fat.c_exfat) FILE_FILE_NAME_INDEX_PRESENT (in module dissect.ntfs.c_ntfs) file_filter() (acquire.acquire.collector.Collector method) FILE_FORMATTER (in module acquire.acquire.log) FILE_GLOB (dissect.target.plugins.os.windows.log.mssql.MssqlPlugin attribute) file_handles (dissect.target.helpers.mount.DissectMount attribute) file_header (acquire.acquire.tools.decrypter.EncryptedFile property) (dissect.executable.PE attribute) (dissect.executable.pe.PE attribute) (dissect.executable.pe.pe.PE attribute) FILE_HEADER_MAGIC (in module dissect.hypervisor.util.envelope) file_id (dissect.apfs.objects.fs.DirectoryEntry property) (dissect.target.filesystems.smb.SmbStream attribute) (dissect.target.loaders.itunes.FileInfo attribute) file_identifier (dissect.hypervisor.disk.vhdx.VHDX attribute) file_info (dissect.target.filesystems.itunes.EncryptedFileStream attribute) FILE_INFORMATION (dissect.target.plugins.filesystem.ntfs.utils.InformationType attribute) FILE_INFORMATION_CLASS (class in acquire.acquire.dynamic.windows.types) file_limit (dissect.target.tools.diff.TargetComparison attribute) FILE_LIMIT (in module dissect.target.tools.diff) FILE_MAGIC (in module acquire.acquire.crypt) (in module dissect.evidence.asdf) (in module dissect.evidence.asdf.asdf) (in module dissect.target.plugins.os.windows.everything.parser) file_name (dissect.ntfs.attr.FileName property) (dissect.target.plugins.os.windows.jumplist.JumpListFile attribute) FILE_NAME_DOS (in module dissect.ntfs.c_ntfs) FILE_NAME_NTFS (in module dissect.ntfs.c_ntfs) FILE_NUMBER_ATTRDEF (in module dissect.ntfs.c_ntfs) FILE_NUMBER_BADCLUS (in module dissect.ntfs.c_ntfs) FILE_NUMBER_BITMAP (in module dissect.ntfs.c_ntfs) FILE_NUMBER_BOOT (in module dissect.ntfs.c_ntfs) FILE_NUMBER_EXTEND (in module dissect.ntfs.c_ntfs) FILE_NUMBER_LOGFILE (in module dissect.ntfs.c_ntfs) FILE_NUMBER_MFT (in module dissect.ntfs.c_ntfs) FILE_NUMBER_MFTMIRR (in module dissect.ntfs.c_ntfs) FILE_NUMBER_ROOT (in module dissect.ntfs.c_ntfs) FILE_NUMBER_SECURE (in module dissect.ntfs.c_ntfs) FILE_NUMBER_UPCASE (in module dissect.ntfs.c_ntfs) FILE_NUMBER_VOLUME (in module dissect.ntfs.c_ntfs) file_object_pointer (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) file_objects (dissect.hypervisor.descriptor.hyperv.HyperVFile attribute) FILE_PARAMETERS_GUID (in module dissect.hypervisor.disk.c_vhdx) file_path (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj attribute) (dissect.target.plugins.os.windows.everything.parser.Record attribute) (dissect.target.plugins.os.windows.regf.cit.Entry attribute) FILE_RECORD_SEGMENT_IN_USE (in module dissect.ntfs.c_ntfs) file_reference (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK_BEEF0004 attribute) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM property) file_size (dissect.eventlog.CRIM property) (dissect.eventlog.wevt.CRIM property) (dissect.hypervisor.disk.vdi.VDI attribute) (dissect.ntfs.attr.FileName property) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM property) file_type (dissect.target.plugins.os.windows.everything.parser.Record attribute) FILE_VERSION (in module acquire.acquire.crypt) FILE_XPATH (dissect.hypervisor.descriptor.ovf.OVF attribute) FileAppcompatRecord (in module dissect.target.plugins.os.windows.amcache) FileAttributes (class in dissect.target.helpers.nfs.nfs3) FileAttributesSerializer (class in dissect.target.helpers.nfs.serializer) FileBlockAddr (class in dissect.vmfs.address) FileBlockResourceVMFS5 (class in dissect.vmfs.resource) FileCreatedRecord (in module dissect.target.tools.diff) FileDeletedRecord (in module dissect.target.tools.diff) FileDescriptor (class in dissect.vmfs) (class in dissect.vmfs.descriptor) FileDescriptor5 (class in dissect.vmfs.descriptor) FileDescriptor6 (class in dissect.vmfs.descriptor) FileDescriptorAddr (class in dissect.vmfs.address) FileDescriptorResourceVMFS5 (class in dissect.vmfs.resource) FileDescriptorResourceVMFS6 (class in dissect.vmfs.resource) FileEntry (class in dissect.evidence.ad1) FileHandle (class in dissect.target.helpers.nfs.nfs3) filehandle (dissect.target.helpers.nfs.nfs3.MountOK attribute) FileHashes (class in acquire.acquire.acquire) fileid (dissect.target.helpers.nfs.nfs3.EntryPlus attribute) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) FileInfo (class in dissect.target.loaders.itunes) FileIoGuid (in module dissect.etl.utils) FileMeta (class in dissect.evidence.ad1) FileModifiedRecord (in module dissect.target.tools.diff) FileName (class in dissect.ntfs.attr) filename (dissect.extfs.extfs.INode attribute) (dissect.extfs.INode attribute) (dissect.hypervisor.disk.vmdk.ExtentDescriptor attribute) (dissect.ntfs.mft.MftRecord property) (dissect.ntfs.MftRecord property) (dissect.regf.regf.RegistryHive attribute) (dissect.regf.RegistryHive attribute) (dissect.target.helpers.nfs.nfs3.DirOpArgs attribute) (dissect.xfs.xfs.INode attribute) (flow.record.fieldtypes.uri property) FILENAME_ENTRY (in module dissect.fat.c_exfat) filename_index() (dissect.target.plugins.os.unix.locate.plocate.PLocateFile method) FileNameInformation (acquire.acquire.dynamic.windows.types.FILE_INFORMATION_CLASS attribute) FilenameNotAvailableError filenames() (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.MftRecord method) FileNotFoundError, [1], [2], [3], [4], [5], [6], [7], [8], [9], [10], [11], [12], [13], [14], [15], [16], [17], [18], [19], [20], [21], [22], [23], [24] FileObject (class in dissect.evidence.ad1) filepath (dissect.target.helpers.regutil.RegfHive attribute) FILEPATH (dissect.target.plugins.os.unix.linux.recentlyused.RecentlyUsedPlugin attribute) filerenameop() (dissect.target.plugins.os.windows.generic.GenericPlugin method) FileRenameOperationRecord (in module dissect.target.plugins.os.windows.generic) files (dissect.fat.ExFAT attribute) (dissect.fat.exfat.ExFAT attribute) (dissect.target.plugins.os.windows.credential.credhist.CredHistPlugin attribute) files() (dissect.target.loaders.itunes.ITunesBackup method) (dissect.target.loaders.res.UPF method) (dissect.target.plugins.os.windows.amcache.AmcachePluginOldMixin method) (dissect.target.plugins.os.windows.catroot.CatrootPlugin method) filesize (class in flow.record.fieldtypes) (dissect.hypervisor.disk.vmdk.SparseDisk attribute) FileStream (class in dissect.apfs.stream) (class in dissect.squashfs) (class in dissect.squashfs.squashfs) Filesystem (class in dissect.target.filesystem) filesystem (dissect.fat.ExFAT attribute) (dissect.fat.exfat.ExFAT attribute) FILESYSTEM_OBJECT_TYPE_MAP (in module dissect.apfs.c_apfs) FilesystemCollection (class in dissect.target.target) FilesystemEntry (class in dissect.target.filesystem) FilesystemError FilesystemFilenameCompactRecord (in module dissect.target.plugins.filesystem.ntfs.mft) FilesystemFilenameRecord (in module dissect.target.plugins.filesystem.ntfs.mft) FilesystemMACBRecord (in module dissect.target.plugins.filesystem.ntfs.mft) FilesystemRecord (in module dissect.target.plugins.filesystem.walkfs) filesystems (dissect.apfs.objects.nx_superblock.NxSuperblock property) (dissect.apfs.objects.NxSuperblock property) (dissect.target.plugins.os.windows.everything.parser.EverythingDB attribute) (dissect.target.Target attribute) (dissect.target.target.Target attribute) FILESYSTEMS (in module dissect.target.filesystem) filesystems_cstruct() (in module dissect.target.plugins.os.windows.everything.parser) FILESYSTEMS_LEGACY_ROOT (in module dissect.target.loaders.acquire) FILESYSTEMS_ROOT (in module dissect.target.loaders.acquire) (in module dissect.target.loaders.uac) (in module dissect.target.loaders.velociraptor) FilesystemStdCompactRecord (in module dissect.target.plugins.filesystem.ntfs.mft) FilesystemStdRecord (in module dissect.target.plugins.filesystem.ntfs.mft) FILETIME (dissect.etl.headers.logfile.ReservedFlags attribute) (dissect.eventlog.bxml.BxmlType attribute) filetransfer() (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin method) (dissect.target.plugins.apps.remoteaccess.splashtop.SplashtopPlugin method) filetransfer_files (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin attribute) FILETRANSFER_SERVICE_LOGS (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin attribute) FILETRANSFER_USER_LOGS (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin attribute) FileType (class in dissect.target.helpers.nfs.nfs3) filetype (dissect.extfs.extfs.INode property) (dissect.extfs.INode property) (dissect.xfs.xfs.INode property) FILETYPES (in module dissect.extfs.c_ext) (in module dissect.xfs.c_xfs) fill() (dissect.ole.ole.Chain method) fill_zero() (in module dissect.evidence.tools.asdf.dd) filled_bytes (dissect.etl.Buffer property) (dissect.etl.etl.Buffer property) filter (acquire.acquire.collector.Collector attribute) filter() (acquire.acquire.dynamic.windows.handles.DuplicateFilter method) FILTER_CONNECTION_PORT (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) filter_creator_sid (dissect.target.plugins.os.windows.cim.EventFilter attribute) filter_name (dissect.target.plugins.os.windows.cim.EventFilter attribute) filter_out_by_path_match() (in module acquire.acquire.hashes) filter_out_by_value_match() (in module acquire.acquire.hashes) filter_out_huge_files() (in module acquire.acquire.hashes) filter_out_nonfiles() (in module acquire.acquire.hashes) filter_query (dissect.target.plugins.os.windows.cim.EventFilter attribute) filter_query_language (dissect.target.plugins.os.windows.cim.EventFilter attribute) FIN_WAIT1 (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) FIN_WAIT2 (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) finalize() (acquire.acquire.crypt.EncryptedStream method) (dissect.evidence.asdf.streams.CompressedStream method) (dissect.evidence.asdf.streams.Crc32Stream method) (dissect.evidence.asdf.streams.SubStreamBase method) find (dissect.target.plugins.general.users.UsersPlugin attribute) find() (dissect.btrfs.tree.BTree method) (dissect.database.ese.cursor.Cursor method) (dissect.executable.elf.elf.Table method) (dissect.executable.pe.directory.resource.ResourceDirectory method) (dissect.executable.pe.directory.ResourceDirectory method) (dissect.ntfs.util.AttributeMap method) (dissect.target.plugins.scrape.scrape.ScrapePlugin method) find_adapter_for_stream() (in module flow.record.base) find_all() (dissect.database.ese.cursor.Cursor method) (dissect.target.loader.Loader static method) (dissect.target.loaders.mqtt.MqttLoader static method) find_and_filter_plugins() (in module dissect.target.tools.utils.cli) find_and_map_dirs() (in module dissect.target.loaders.dir) find_build_props() (in module dissect.target.plugins.os.unix.linux.android._os) find_clear_vmk() (dissect.fve.bde.information.Dataset method) find_codebases() (dissect.target.plugins.apps.productivity.msoffice.ClickOnceDeploymentManifestParser method) find_containers() (dissect.target.plugins.apps.browser.iexplore.WebCache method) find_crontabs() (dissect.target.plugins.os.unix.cronjobs.CronjobPlugin method) find_current_mapping() (in module dissect.cim.utils) find_databases() (dissect.target.plugins.os.windows.search.SearchIndexPlugin method) find_datum() (dissect.fve.bde.information.Dataset method) find_description() (dissect.fve.bde.information.Dataset method) find_digest() (dissect.fve.luks.LUKS method) (dissect.fve.luks.luks.LUKS method) find_dirs() (in module dissect.target.loaders.dir) find_dnd_dirs() (dissect.target.plugins.apps.virtualization.vmware_workstation.VmwareWorkstationPlugin method) find_enc_files() (in module acquire.acquire.tools.decrypter) find_entry_path() (in module dissect.target.loaders.dir) find_external_vmk() (dissect.fve.bde.information.Dataset method) find_files() (in module dissect.evidence.ewf) (in module dissect.target.containers.split) find_fs_directories() (in module dissect.target.loaders.velociraptor) find_functions() (in module dissect.target.plugin) find_functions_by_record_field_type() (in module dissect.target.plugin) find_fvek() (dissect.fve.bde.information.Dataset method) find_image() (dissect.hypervisor.disk.hdd.Storage method) find_index() (dissect.database.ese.Table method) (dissect.database.ese.table.Table method) find_installs() (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin method) (dissect.target.plugins.apps.chat.msn.MSNPlugin method) (dissect.target.plugins.apps.container.podman.PodmanPlugin method) (in module dissect.target.plugins.apps.container.docker) find_log_paths() (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin method) find_logs() (dissect.target.plugins.apps.webserver.apache.ApachePlugin method) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin method) find_luks_headers() (in module dissect.fve.luks.luks) find_mdb_files() (dissect.target.plugins.os.windows.ual.UalPlugin method) find_mounts() (dissect.target.plugins.os.windows.regf.usb.UsbPlugin method) find_needle() (in module dissect.eventlog.evt) find_needle_chunks() (in module dissect.target.helpers.scrape) find_needles() (in module dissect.target.helpers.scrape) find_node() (in module dissect.database.ese.btree) find_package_name() (in module dissect.target.plugins.os.windows.catroot) find_passphrase_vmk() (dissect.fve.bde.information.Dataset method) find_profile() (dissect.target.plugins.os.windows.regf.nethist.NethistPlugin method) find_property() (dissect.fve.bde.information.Datum method) find_pvms() (in module dissect.target.plugins.child.parallels) find_pwr_dir() (in module dissect.target.loaders.res) find_recovery_vmk() (dissect.fve.bde.information.Dataset method) find_rule_keys() (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin method) find_segment() (dissect.fve.luks.LUKS method) (dissect.fve.luks.luks.LUKS method) find_shot() (dissect.hypervisor.disk.hdd.Snapshots method) find_sid() (dissect.target.plugins.os.windows.recyclebin.RecyclebinPlugin method) find_sshd_directory() (in module dissect.target.plugins.apps.ssh.openssh) find_startup_key() (dissect.fve.bde.information.Dataset method) find_subvolume() (dissect.btrfs.Btrfs method) (dissect.btrfs.btrfs.Btrfs method) find_super_block() (in module dissect.volume.md.md) find_users() (dissect.target.plugins.os.windows.regf.usb.UsbPlugin method) find_virtualization_info() (dissect.fve.bde.information.Dataset method) find_vm_inventory() (in module dissect.target.plugins.apps.virtualization.vmware_workstation) find_vmk() (dissect.fve.bde.information.Dataset method) find_vms() (dissect.target.plugins.child.virtualbox.VirtualBoxChildTargetPlugin method) (in module dissect.target.plugins.child.colima) find_volumes() (dissect.target.plugins.os.windows.regf.usb.UsbPlugin method) find_wsl_installs() (in module dissect.target.plugins.child.wsl) find_xor_key() (in module dissect.target.containers.fortifw) findable (dissect.target.plugin.FunctionDescriptor attribute) (dissect.target.plugin.PluginDescriptor attribute) findall() (in module dissect.target.helpers.utils) finish() (acquire.acquire.gui.base.GUI method) (acquire.acquire.gui.base.Stub method) (acquire.acquire.gui.win32.Win32 method) (acquire.acquire.uploaders.minio.MinIO method) (acquire.acquire.uploaders.plugin.UploaderPlugin method) finished_sinks (dissect.target.tools.dump.DumpState property) FIRE (dissect.target.helpers.network.IANAProtocol attribute) FIREFOX_EXTENSION_RECORD_FIELDS (in module dissect.target.plugins.apps.browser.firefox) FirefoxPlugin (class in dissect.target.plugins.apps.browser.firefox) firewall() (dissect.target.plugins.apps.av.symantec.SymantecPlugin method) first() (dissect.apfs.cursor.Cursor method) (dissect.btrfs.tree.Cursor method) first_data_sector (dissect.fat.fat.FATFS attribute) (dissect.fat.FATFS attribute) FistTime (dissect.target.plugins.apps.productivity.msoffice.LoadBehavior attribute) FixedDisk (class in dissect.hypervisor.disk.vhd) fixup_key() (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm method) fixUpPgs (dissect.hypervisor.util.vmtar.VisorTarInfo attribute) Flag (class in dissect.cstruct) (class in dissect.cstruct.types) (class in dissect.cstruct.types.flag) flag (dissect.hypervisor.util.envelope.EnvelopeAttribute attribute) flag() (dissect.shellitem.lnk.Lnk method) (dissect.shellitem.lnk.lnk.Lnk method) (dissect.shellitem.lnk.lnk.LnkInfo method) flags (dissect.apfs.objects.BTree property) (dissect.apfs.objects.btree.BTree property) (dissect.apfs.objects.btree_node.BTreeNode property) (dissect.apfs.objects.BTreeNode property) (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) (dissect.apfs.objects.fs.XAttr property) (dissect.apfs.objects.keybag.KEK property) (dissect.apfs.objects.keybag.VEK property) (dissect.archive.vbk.FibBlockDescriptor property) (dissect.archive.wim.Resource attribute) (dissect.cstruct.parser.TokenConsumer attribute) (dissect.database.ese.Page attribute) (dissect.database.ese.page.Page attribute) (dissect.database.ese.page.Tag attribute) (dissect.etl.headers.headers.Marker property) (dissect.eventlog.bxml.Token attribute) (dissect.eventlog.Evt attribute) (dissect.eventlog.evt.Evt attribute) (dissect.executable.elf.elf.Segment attribute) (dissect.executable.elf.Segment attribute) (dissect.fve.luks.metadata.Config attribute) (dissect.fve.luks.metadata.Segment attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.ntfs.ACE attribute) (dissect.ntfs.attr.AttributeHeader property) (dissect.ntfs.attr.FileName property) (dissect.ntfs.AttributeHeader property) (dissect.ntfs.secure.ACE attribute) (dissect.ole.ole.DirectoryEntry attribute) (dissect.shellitem.lnk.Lnk attribute) (dissect.shellitem.lnk.lnk.Lnk attribute) (dissect.shellitem.lnk.lnk.LnkInfo attribute) (dissect.shellitem.lnk.lnk.LnkStringData attribute) (dissect.squashfs.SquashFS attribute) (dissect.squashfs.squashfs.SquashFS attribute) (dissect.target.loaders.itunes.FileInfo attribute) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) (dissect.thumbcache.index.IndexEntry property) (dissect.thumbcache.IndexEntry property) (dissect.volume.disk.Partition attribute) (dissect.volume.disk.partition.Partition attribute) (dissect.volume.lvm.metadata.LogicalVolume attribute) (dissect.volume.lvm.metadata.Segment property) (dissect.volume.lvm.metadata.VolumeGroup attribute) (dissect.volume.vss.BlockDescriptor attribute) flat_fields (flow.record.base.GroupedRecord attribute) (flow.record.GroupedRecord attribute) flavor (dissect.target.helpers.sunrpc.client.AuthScheme attribute) fletcher64() (in module dissect.apfs.util) float (class in flow.record.fieldtypes) FLOAT (dissect.eventlog.bxml.BxmlType attribute) flow.record module flow.record.adapter module flow.record.adapter.archive module flow.record.adapter.avro module flow.record.adapter.broker module flow.record.adapter.csvfile module flow.record.adapter.duckdb module flow.record.adapter.elastic module flow.record.adapter.jsonfile module flow.record.adapter.line module flow.record.adapter.mongo module flow.record.adapter.split module flow.record.adapter.splunk module flow.record.adapter.sqlite module flow.record.adapter.stream module flow.record.adapter.text module flow.record.adapter.xlsx module flow.record.base module flow.record.context module flow.record.exceptions module flow.record.fieldtypes module flow.record.fieldtypes.credential module flow.record.fieldtypes.net module flow.record.fieldtypes.net.ip module flow.record.fieldtypes.net.ipv4 module flow.record.fieldtypes.net.tcp module flow.record.fieldtypes.net.udp module flow.record.jsonpacker module flow.record.packer module flow.record.selector module flow.record.stream module flow.record.tools module flow.record.tools.geoip module flow.record.tools.rdump module flow.record.utils module flow.record.whitelist module flow_record_tz() (in module flow.record.fieldtypes) flush() (dissect.cstruct.BitBuffer method) (dissect.cstruct.bitbuffer.BitBuffer method) (dissect.target.tools.dump.JsonLinesWriter method) (flow.record.adapter.AbstractWriter method) (flow.record.adapter.archive.ArchiveWriter method) (flow.record.adapter.avro.AvroWriter method) (flow.record.adapter.broker.BrokerWriter method) (flow.record.adapter.csvfile.CsvfileWriter method) (flow.record.adapter.elastic.ElasticWriter method) (flow.record.adapter.jsonfile.JsonfileWriter method) (flow.record.adapter.line.LineWriter method) (flow.record.adapter.mongo.MongoWriter method) (flow.record.adapter.split.SplitWriter method) (flow.record.adapter.splunk.SplunkWriter method) (flow.record.adapter.sqlite.SqliteWriter method) (flow.record.adapter.stream.StreamWriter method) (flow.record.adapter.text.TextWriter method) (flow.record.adapter.xlsx.XlsxWriter method) (flow.record.stream.RecordPrinter method) (flow.record.stream.RecordStreamWriter method) flush_cache() (acquire.acquire.log.DelayedFileHandler method) fmt() (in module dissect.util.tools.dump_nskeyedarchiver) fmt_ls_colors() (in module dissect.target.tools.utils.fs) fn (dissect.target.plugins.os.windows.prefetch.Prefetch attribute) fname (dissect.target.helpers.cache.Cache attribute) fNullSmallPage (dissect.database.ese.record.TagField attribute) folder (acquire.acquire.gui.base.GUI attribute) (acquire.acquire.uploaders.minio.MinIO attribute) Folder (class in dissect.target.loaders.res) folder (dissect.target.loaders.res.File attribute) FOLDER (dissect.target.plugins.os.windows.everything.parser.EverythingFSType attribute) FolderHistoryRecord (in module dissect.target.plugins.apps.productivity.sevenzip) folders (dissect.target.plugins.os.windows.lnk.LnkPlugin attribute) folders() (dissect.target.loaders.res.UPF method) font (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) fontdir (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) footer (acquire.acquire.tools.decrypter.EncryptedFile property) (dissect.evidence.asdf.asdf.AsdfSnapshot attribute) (dissect.evidence.asdf.AsdfSnapshot attribute) (dissect.evidence.AsdfSnapshot attribute) (dissect.hypervisor.disk.vhd.Disk attribute) (dissect.target.plugins.os.windows.jumplist.CustomDestinationFile attribute) FOOTER_AEAD_MAGIC (in module dissect.hypervisor.util.envelope) FOOTER_CRYPTO_MAGIC (in module dissect.hypervisor.util.envelope) FOOTER_MAGIC (in module acquire.acquire.crypt) (in module dissect.evidence.asdf.asdf) foreground (dissect.target.plugins.os.windows.regf.cit.ProgramDataBitmaps attribute) (dissect.target.plugins.os.windows.regf.cit.SystemDataBitmaps attribute) format (dissect.archive.vbk.StgBlockDescriptor property) (dissect.volume.lvm.metadata.VolumeGroup attribute) format() (dissect.util.ldap.SearchFilter method) format_body_info() (in module dissect.target.plugins.filesystem.ntfs.mft) FORMAT_CPIO_BIN (in module dissect.util.cpio) FORMAT_CPIO_CRC (in module dissect.util.cpio) FORMAT_CPIO_HPBIN (in module dissect.util.cpio) FORMAT_CPIO_HPODC (in module dissect.util.cpio) FORMAT_CPIO_NEWC (in module dissect.util.cpio) FORMAT_CPIO_ODC (in module dissect.util.cpio) FORMAT_CPIO_UNKNOWN (in module dissect.util.cpio) FORMAT_INFO (in module dissect.target.plugins.filesystem.ntfs.mft) format_major (dissect.database.ESE attribute) (dissect.database.ese.ESE attribute) (dissect.database.ese.ese.ESE attribute) format_minor (dissect.database.ESE attribute) (dissect.database.ese.ESE attribute) (dissect.database.ese.ese.ESE attribute) format_none_value() (in module dissect.target.plugins.filesystem.ntfs.mft) format_output_name() (in module acquire.acquire.utils) format_spec (flow.record.adapter.text.TextWriter attribute) format_target_report() (in module dissect.target.tools.utils.report) format_timeline_info() (in module dissect.target.plugins.filesystem.ntfs.mft) format_value() (in module dissect.target.plugins.os.windows.log.evtx) format_version (dissect.archive.vbk.VBK attribute) formatted_by (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) FortiFirmwareContainer (class in dissect.target.containers.fortifw) FortiFirmwareFile (class in dissect.target.containers.fortifw) FORTIOS (dissect.target.plugin.OperatingSystem attribute) FortiOSConfig (class in dissect.target.plugins.os.unix.linux.fortios._os) FortiOSLocalePlugin (class in dissect.target.plugins.os.unix.linux.fortios.locale) FortiOSPlugin (class in dissect.target.plugins.os.unix.linux.fortios._os) FortiOSUserRecord (in module dissect.target.plugins.os.unix.linux.fortios._os) forwarder (dissect.executable.pe.directory.export.ExportFunction attribute) forwarders (dissect.executable.pe.directory.bound_import.BoundImportModule attribute) fp (dissect.target.tools.dump.JsonLinesWriter attribute) (flow.record.adapter.avro.AvroReader attribute) (flow.record.adapter.avro.AvroWriter attribute) (flow.record.adapter.csvfile.CsvfileReader attribute) (flow.record.adapter.csvfile.CsvfileWriter attribute) (flow.record.adapter.jsonfile.JsonfileReader attribute) (flow.record.adapter.jsonfile.JsonfileWriter attribute) (flow.record.adapter.line.LineWriter attribute) (flow.record.adapter.stream.StreamReader attribute) (flow.record.adapter.stream.StreamWriter attribute) (flow.record.adapter.text.TextWriter attribute) (flow.record.adapter.xlsx.XlsxReader attribute) (flow.record.adapter.xlsx.XlsxWriter attribute) (flow.record.stream.RecordPrinter attribute) (flow.record.stream.RecordStreamReader attribute) (flow.record.stream.RecordStreamWriter attribute) FR_DLCI_ENDPT (dissect.target.plugins.os.windows.network.IfTypes attribute) FR_FORWARD (dissect.target.plugins.os.windows.network.IfTypes attribute) fragment (dissect.squashfs.FileStream attribute) (dissect.squashfs.squashfs.FileStream attribute) (flow.record.fieldtypes.uri property) fragment_offset (dissect.squashfs.FileStream attribute) (dissect.squashfs.squashfs.FileStream attribute) fragment_size (dissect.ffs.FFS attribute) (dissect.ffs.ffs.FFS attribute) fragment_table (dissect.squashfs.SquashFS attribute) (dissect.squashfs.squashfs.SquashFS attribute) frame (dissect.database.sqlite3.sqlite3.WAL attribute) (dissect.database.sqlite3.WAL attribute) FRAMERELAY (dissect.target.plugins.os.windows.network.IfTypes attribute) FRAMERELAY_INTERCONNECT (dissect.target.plugins.os.windows.network.IfTypes attribute) FRAMERELAY_MPI (dissect.target.plugins.os.windows.network.IfTypes attribute) FRAMERELAY_SERVICE (dissect.target.plugins.os.windows.network.IfTypes attribute) frames (dissect.database.sqlite3.sqlite3.WALCheckpoint attribute) frames() (dissect.database.sqlite3.sqlite3.WAL method) (dissect.database.sqlite3.WAL method) FREE_CLUSTER (in module dissect.fat.c_fat) FreeBsdPlugin (class in dissect.target.plugins.os.unix.bsd.freebsd._os) FreeClusterError, [1] FreeSegment (class in dissect.volume.lvm.metadata) fresh_app_context() (in module flow.record.context) FRF16_MFR_BUNDLE (dissect.target.plugins.os.windows.network.IfTypes attribute) from_address() (dissect.apfs.objects.base.Object class method) (dissect.apfs.objects.Object class method) from_bag_dict() (dissect.target.loaders.itunes.ClassKey class method) from_block() (dissect.apfs.objects.base.Object class method) (dissect.apfs.objects.Object class method) from_bytes() (dissect.archive.vbk.DirItem class method) (dissect.archive.vbk.MetaItem class method) (dissect.fve.bde.information.Datum class method) (dissect.ntfs.attr.Attribute class method) (dissect.ntfs.attr.AttributeHeader class method) (dissect.ntfs.Attribute class method) (dissect.ntfs.AttributeHeader class method) (dissect.ntfs.mft.MftRecord class method) (dissect.ntfs.MftRecord class method) (dissect.vmfs.descriptor.FileDescriptor static method) (dissect.vmfs.FileDescriptor static method) from_dict() (dissect.fve.luks.metadata.JsonItem class method) (dissect.target.tools.dump.DumpState class method) (dissect.volume.lvm.metadata.MetaBase class method) (dissect.volume.lvm.metadata.Segment class method) from_directory() (dissect.cim.CIM class method) (dissect.cim.cim.CIM class method) from_directory_information() (acquire.acquire.dynamic.windows.named_objects.NamedObject class method) from_elf() (dissect.executable.elf.elf.SectionTable class method) (dissect.executable.elf.elf.SegmentTable class method) (dissect.executable.elf.SectionTable class method) (dissect.executable.elf.SegmentTable class method) from_fh() (dissect.executable.pe.pe.Section class method) (dissect.fve.bde.information.Datum class method) (dissect.ntfs.attr.Attribute class method) (dissect.ntfs.attr.AttributeRecord class method) (dissect.ntfs.Attribute class method) (dissect.ntfs.AttributeRecord class method) (dissect.ntfs.mft.MftRecord class method) (dissect.ntfs.MftRecord class method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSConfig class method) from_header() (dissect.archive.wim.Resource class method) from_id() (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm class method) (dissect.target.plugins.os.windows.dpapi.crypto.HashAlgorithm class method) from_json() (dissect.fve.luks.metadata.JsonItem class method) from_line() (dissect.target.plugins.os.unix.linux.proc.NetSocket class method) (dissect.target.plugins.os.unix.linux.proc.PacketSocket class method) (dissect.target.plugins.os.unix.linux.proc.UnixSocket class method) (dissect.target.plugins.os.windows.log.schedlgu.SchedLgU class method) from_luks1_header() (dissect.fve.luks.metadata.Metadata class method) from_name() (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm class method) (dissect.target.plugins.os.windows.dpapi.crypto.HashAlgorithm class method) from_path() (dissect.target.tools.dump.DumpState class method) from_posix() (flow.record.fieldtypes.command class method) (flow.record.fieldtypes.path class method) from_section_table() (dissect.executable.elf.elf.Section class method) (dissect.executable.elf.Section class method) from_segment_table() (dissect.executable.elf.elf.Segment class method) (dissect.executable.elf.Segment class method) from_short_header() (dissect.archive.wim.Resource class method) from_str() (acquire.acquire.dynamic.windows.types.UNICODE_STRING class method) from_stream() (dissect.eventlog.bxml.BxmlTemplateDescriptor class method) from_symbol_table() (dissect.executable.elf.elf.Symbol class method) (dissect.executable.elf.Symbol class method) from_text() (dissect.hypervisor.descriptor.vmx.KeySafe class method) (dissect.hypervisor.util.envelope.KeyStore class method) from_unix() (in module dissect.util.ts) from_unix_ms() (in module dissect.util.ts) from_unix_ns() (in module dissect.util.ts) from_unix_us() (in module dissect.util.ts) from_user_home() (in module acquire.acquire.acquire) from_windows() (flow.record.fieldtypes.command class method) (flow.record.fieldtypes.path class method) (flow.record.fieldtypes.uri class method) from_xml() (dissect.hypervisor.disk.hdd.XMLEntry class method) frombuf() (dissect.hypervisor.util.vmtar.VisorTarInfo class method) (dissect.util.cpio.CpioInfo class method) fromtarfile() (dissect.util.cpio.CpioInfo class method) FS (class in dissect.apfs.objects) (class in dissect.apfs.objects.fs) fs (dissect.apfs.objects.fs.Snapshot attribute) (dissect.cramfs.cramfs.INode attribute) (dissect.cramfs.INode attribute) (dissect.fat.fat.DirectoryEntry attribute) (dissect.fat.fat.RootDirectory attribute) (dissect.ffs.ffs.CylinderGroup attribute) (dissect.ffs.ffs.INode attribute) (dissect.jffs.jffs2.DataStream attribute) (dissect.jffs.jffs2.DirEntry attribute) (dissect.jffs.jffs2.INode attribute) (dissect.qnxfs.qnx4.INode4 attribute) (dissect.qnxfs.qnx6.INode6 attribute) (dissect.squashfs.FileStream attribute) (dissect.squashfs.INode attribute) (dissect.squashfs.squashfs.FileStream attribute) (dissect.squashfs.squashfs.INode attribute) (dissect.target.filesystem.FilesystemEntry attribute) (dissect.target.filesystem.RootFilesystemEntry attribute) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry attribute) (dissect.target.filesystems.btrfs.BtrfsSubvolumeFilesystem attribute) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry attribute) (dissect.target.filesystems.jffs.JffsFilesystemEntry attribute) (dissect.target.filesystems.nfs.NfsFilesystemEntry attribute) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry attribute) (dissect.target.filesystems.smb.SmbFilesystemEntry attribute) (dissect.target.filesystems.vbk.VbkFilesystemEntry attribute) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry attribute) (dissect.target.filesystems.zip.ZipFilesystemEntry attribute) (dissect.target.helpers.mount.DissectMount attribute) (dissect.target.Target attribute) (dissect.target.target.Target attribute) (dissect.target.volume.Volume attribute) FS3_AddrType (in module dissect.vmfs.c_vmfs) FS3_Config (in module dissect.vmfs.c_vmfs) FS3_DescriptorType (in module dissect.vmfs.c_vmfs) FS3_ResourceTypeID (in module dissect.vmfs.c_vmfs) FS3_ZeroLevelAddrType (in module dissect.vmfs.c_vmfs) FS6_DirBlockType (in module dissect.vmfs.c_vmfs) fs_attrs() (in module dissect.target.helpers.fsutil) fs_index (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj attribute) fs_name (dissect.fat.ExFAT attribute) (dissect.fat.exfat.ExFAT attribute) FS_NAMES (in module dissect.volume.disk.schemes.bsd) FS_NEEDLES (in module dissect.target.loaders.phobos) FS_ROOT_TUPLE (dissect.target.loaders.uac.UacTarSubloader attribute) FS_SUPPORTED (dissect.target.plugins.filesystem.icat.ICatPlugin attribute) fs_tree (dissect.btrfs.Btrfs attribute) (dissect.btrfs.btrfs.Btrfs attribute) fsb_to_bb() (in module dissect.xfs.xfs) fsbtodb() (in module dissect.ffs.ffs) fsid (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) FT_MAP (in module dissect.btrfs.c_btrfs) ftime (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx6.INode6 property) fua (dissect.volume.lvm.metadata.WriteCacheSegment attribute) FULL (acquire.acquire.acquire.BsdProfile attribute) (acquire.acquire.acquire.ESXiProfile attribute) (acquire.acquire.acquire.LinuxProfile attribute) (acquire.acquire.acquire.MacOSProfile attribute) (acquire.acquire.acquire.ProxmoxProfile attribute) (acquire.acquire.acquire.WindowsProfile attribute) full_path (dissect.btrfs.btrfs.INode property) (dissect.btrfs.INode property) (dissect.ntfs.usnjrnl.UsnRecord property) (dissect.ntfs.UsnRecord property) full_path() (dissect.ntfs.attr.FileName method) (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.MftRecord method) full_paths() (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.MftRecord method) FULL_RESOURCE_DESCRIPTOR (dissect.target.helpers.regutil.RegistryValueType attribute) fullmap() (dissect.eventlog.wevtutil.WevtutilWrapper method) FULLSIZE (dissect.database.ese.lcmapstring.CASE attribute) FULLWIDTH (dissect.database.ese.lcmapstring.CASE attribute) func (dissect.target.helpers.cache.Cache attribute) (dissect.target.plugin.FunctionDescriptor property) (dissect.target.tools.dump.RecordStreamElement attribute) (dissect.target.tools.dump.Sink attribute) FUNC_DOC_TEMPLATE (in module dissect.target.helpers.docs) func_errors (dissect.target.tools.utils.report.TargetExecutionReport attribute) FUNC_EXEC (dissect.target.target.Event attribute) FUNC_EXEC_ERROR (dissect.target.target.Event attribute) func_execs (dissect.target.tools.utils.report.TargetExecutionReport attribute) FUNCTION_OUTPUT_DESCRIPTION (in module dissect.target.helpers.docs) FUNCTION_WHITELIST (in module flow.record.selector) function_with_an_exception() (in module codestyle) FunctionDescriptor (class in dissect.target.plugin) FunctionDescriptorLookup (class in dissect.target.plugin) functions (dissect.executable.pe.directory.delay_import.DelayImportModule property) (dissect.executable.pe.directory.export.ExportDirectory property) (dissect.executable.pe.directory.ExportDirectory property) (dissect.executable.pe.directory.ImportModule property) (dissect.executable.pe.directory.imports.ImportModule property) (dissect.target.plugin.PluginDescriptor attribute) (dissect.target.tools.dump.DumpState attribute) functions() (in module dissect.target.plugin) FunctionTuple (in module dissect.target.target) fuse_config_p (in module dissect.target.helpers.mount) fuse_conn_info_p (in module dissect.target.helpers.mount) fusion_uuid (dissect.apfs.objects.nx_superblock.NxSuperblock property) (dissect.apfs.objects.NxSuperblock property) FVE_DATUM_ROLE (in module dissect.fve.bde.c_bde) FVE_DATUM_TYPE (in module dissect.fve.bde.c_bde) FVE_KEY_FLAG (in module dissect.fve.bde.c_bde) FVE_KEY_PROTECTOR (in module dissect.fve.bde.c_bde) FVE_KEY_TYPE (in module dissect.fve.bde.c_bde) FVE_STATE (in module dissect.fve.bde.c_bde) fvek_type (dissect.fve.bde.information.Dataset property) fw (dissect.target.containers.fortifw.FortiFirmwareContainer attribute) FW_ACTION (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_APPLICATION (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_BEGIN_TIME (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_DIRECTION (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_END_TIME (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_LOCAL_IP (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_LOCAL_IP6 (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_LOCAL_PORT (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_LOCATION (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_PROTOCOL (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_REMOTE_HOST_NAME (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_REMOTE_IP (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_REMOTE_IP6 (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_REMOTE_PORT (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_REPETITION (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_RULE_ID (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_RULE_NAME (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_SEVERITY (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_TIMESTAMP (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) FW_USER (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) G G703_2MB (dissect.target.plugins.os.windows.network.IfTypes attribute) G703_64K (dissect.target.plugins.os.windows.network.IfTypes attribute) GAME_FOLDER (class in dissect.target.plugins.os.windows.regf.shellbags) GARBAGE_ARGS (dissect.target.helpers.sunrpc.sunrpc.AcceptStat attribute) gateway (dissect.target.plugins.os.unix.linux.network.DhcpLease attribute) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager property) gateway() (dissect.target.plugins.os.unix.linux._os.LinuxPlugin method) gateways (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) (dissect.target.plugins.os.unix.linux.network.ProcConfigParser.ParserContext attribute) gateways() (dissect.target.plugins.os.default.network.NetworkPlugin method) GBitmap (class in dissect.apfs.objects) (class in dissect.apfs.objects.gbitmap) GBitmapBlock (class in dissect.apfs.objects) (class in dissect.apfs.objects.gbitmap_block) gdi32 (in module acquire.acquire.gui.win32) GE (dissect.util.ldap.ComparisonOperator attribute) general() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) generate() (dissect.fve.crypto.base.IV method) (dissect.fve.crypto.base.Plain method) (dissect.fve.crypto.base.Plain64 method) (dissect.fve.crypto.base.Plain64BE method) (dissect.fve.crypto.Plain method) (dissect.fve.crypto.Plain64 method) (dissect.fve.crypto.Plain64BE method) (in module dissect.target.plugin) generate_addr() (in module dissect.target.helpers.fsutil) generate_argparse_for_method() (in module dissect.target.tools.utils.cli) generate_argparse_for_plugin() (in module dissect.target.tools.utils.cli) generate_argparse_for_plugin_class() (in module dissect.target.tools.utils.cli) generate_cstruct_stub() (in module dissect.cstruct.tools.stubgen) generate_enum_stub() (in module dissect.cstruct.tools.stubgen) generate_file_stub() (in module dissect.cstruct.tools.stubgen) generate_from_file() (in module dissect.etl.manifest) generate_from_xml() (in module dissect.etl.manifest) generate_functions_json() (in module dissect.target.plugins.general.plugins) generate_functions_overview() (in module dissect.target.plugins.general.plugins) generate_generic_stub() (in module dissect.cstruct.tools.stubgen) generate_record() (in module dissect.target.plugins.filesystem.walkfs) generate_structure_stub() (in module dissect.cstruct.tools.stubgen) generate_typehint() (in module dissect.cstruct.tools.stubgen) GENERATED (in module dissect.target.plugin) generation (dissect.vmfs.lvm.Volume attribute) (dissect.vmfs.Volume attribute) GENERIC_ATTACHMENT_FIELDS (in module dissect.target.plugins.apps.chat.chat) GENERIC_COOKIE_FIELDS (in module dissect.target.plugins.apps.browser.browser) GENERIC_DOWNLOAD_RECORD_FIELDS (in module dissect.target.plugins.apps.browser.browser) GENERIC_EXTENSION_RECORD_FIELDS (in module dissect.target.plugins.apps.browser.browser) GENERIC_FILE_TRANSFER_RECORD_FIELDS (in module dissect.target.plugins.apps.remoteaccess.remoteaccess) GENERIC_HISTORY_RECORD_FIELDS (in module dissect.target.plugins.apps.browser.browser) GENERIC_LOG_RECORD_FIELDS (in module dissect.target.plugins.apps.remoteaccess.remoteaccess) GENERIC_MESSAGE_FIELDS (in module dissect.target.plugins.apps.chat.chat) GENERIC_PASSWORD_RECORD_FIELDS (in module dissect.target.plugins.apps.browser.browser) GENERIC_TAB_CONTENTS_RECORD_FIELDS (in module dissect.target.plugins.apps.editor.windowsnotepad) GENERIC_THUMBCACHE_FIELDS (in module dissect.target.plugins.os.windows.thumbcache) GENERIC_USER_FIELDS (in module dissect.target.plugins.apps.chat.chat) GenericPlugin (class in dissect.target.plugins.os.unix.bsd.darwin.ios.generic) (class in dissect.target.plugins.os.unix.generic) (class in dissect.target.plugins.os.unix.linux.fortios.generic) (class in dissect.target.plugins.os.windows.generic) GenericTarSubLoader (class in dissect.target.loaders.tar) GenericZipSubLoader (class in dissect.target.loaders.zip) GeoRecord (in module flow.record.tools.geoip) georecord_for_ip() (in module flow.record.tools.geoip) get (dissect.archive.vbk.MetaVector attribute) (dissect.fat.fat.FAT attribute) (dissect.hypervisor.disk.vhd.BlockAllocationTable attribute) (dissect.hypervisor.disk.vhdx.BlockAllocationTable attribute) (dissect.ntfs.Mft attribute) (dissect.ntfs.mft.Mft attribute) get() (acquire.acquire.uploaders.plugin_registry.PluginRegistry method) (dissect.apfs.objects.FS method) (dissect.apfs.objects.fs.FS method) (dissect.apfs.objects.fs.INode method) (dissect.archive.vbk.FibMetaSparseTable method) (dissect.archive.vbk.VBK method) (dissect.archive.wim.Image method) (dissect.btrfs.Btrfs method) (dissect.btrfs.btrfs.Btrfs method) (dissect.btrfs.btrfs.INode method) (dissect.btrfs.btrfs.Subvolume method) (dissect.btrfs.INode method) (dissect.btrfs.Subvolume method) (dissect.btrfs.tree.Cursor method) (dissect.cim.objects.Objects method) (dissect.cramfs.CramFS method) (dissect.cramfs.cramfs.CramFS method) (dissect.database.ese.Record method) (dissect.database.ese.record.Record method) (dissect.database.ese.record.RecordData method) (dissect.database.sqlite3.Row method) (dissect.database.sqlite3.sqlite3.Row method) (dissect.database.sqlite3.sqlite3.WALCheckpoint method) (dissect.eventlog.bxml.BxmlSub method) (dissect.evidence.ad1.AD1 method) (dissect.executable.pe.directory.resource.ResourceDirectory method) (dissect.executable.pe.directory.resource.ResourceDirectoryEntry method) (dissect.executable.pe.directory.ResourceDirectory method) (dissect.executable.pe.directory.ResourceDirectoryEntry method) (dissect.extfs.ExtFS method) (dissect.extfs.extfs.ExtFS method) (dissect.fat.fat.FATFS method) (dissect.fat.FATFS method) (dissect.ffs.FFS method) (dissect.ffs.ffs.FFS method) (dissect.hypervisor.disk.vhdx.MetadataTable method) (dissect.hypervisor.disk.vhdx.RegionTable method) (dissect.jffs.JFFS2 method) (dissect.jffs.jffs2.JFFS2 method) (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.MftRecord method) (dissect.ole.OLE method) (dissect.ole.ole.OLE method) (dissect.qnxfs.QNX4 method) (dissect.qnxfs.qnx4.QNX4 method) (dissect.qnxfs.QNX6 method) (dissect.qnxfs.qnx6.QNX6 method) (dissect.squashfs.SquashFS method) (dissect.squashfs.squashfs.SquashFS method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystem method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.RootFilesystem method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualFilesystem method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.ad1.AD1Filesystem method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsFilesystem method) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsSubvolumeFilesystem method) (dissect.target.filesystems.cb.CbFilesystem method) (dissect.target.filesystems.cb.CbFilesystemEntry method) (dissect.target.filesystems.config.ConfigurationEntry method) (dissect.target.filesystems.config.ConfigurationFilesystem method) (dissect.target.filesystems.cramfs.CramfsFilesystem method) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry method) (dissect.target.filesystems.dir.DirectoryFilesystem method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.exfat.ExfatFilesystem method) (dissect.target.filesystems.exfat.ExfatFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystem method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.fat.FatFilesystem method) (dissect.target.filesystems.fat.FatFilesystemEntry method) (dissect.target.filesystems.ffs.FfsFilesystem method) (dissect.target.filesystems.ffs.FfsFilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystem method) (dissect.target.filesystems.jffs.JffsFilesystem method) (dissect.target.filesystems.jffs.JffsFilesystemEntry method) (dissect.target.filesystems.nfs.NfsFilesystem method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystem method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.qnxfs.QnxFilesystem method) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry method) (dissect.target.filesystems.smb.SmbFilesystem method) (dissect.target.filesystems.smb.SmbFilesystemEntry method) (dissect.target.filesystems.squashfs.SquashFSFilesystem method) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystem method) (dissect.target.filesystems.vbk.VbkFilesystem method) (dissect.target.filesystems.vbk.VbkFilesystemEntry method) (dissect.target.filesystems.vmfs.VmfsFilesystem method) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystem method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystem method) (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) (dissect.target.helpers.configutil.ConfigurationParser method) (dissect.target.helpers.regutil.KeyCollection method) (dissect.target.helpers.regutil.RegistryKey method) (dissect.target.loaders.itunes.FileInfo method) (dissect.target.plugins.general.config.ConfigurationTreePlugin method) (dissect.target.plugins.general.users.UsersPlugin method) (dissect.target.plugins.os.unix.linux.proc.ProcProcess method) (dissect.target.plugins.os.windows.search.TableRecord method) (dissect.util.plist.NSKeyedArchiver method) (dissect.util.plist.NSObject method) (dissect.vmfs.descriptor.FileDescriptor method) (dissect.vmfs.FileDescriptor method) (dissect.vmfs.resource.ResourceManager method) (dissect.vmfs.VMFS method) (dissect.vmfs.vmfs.VMFS method) (dissect.xfs.XFS method) (dissect.xfs.xfs.XFS method) get_actions() (dissect.target.plugins.os.windows.tasks.job.AtTask method) (dissect.target.plugins.os.windows.tasks.xml.XmlTask method) get_all_fields() (flow.record.base.RecordDescriptor method) (flow.record.RecordDescriptor method) get_all_keys() (in module dissect.target.helpers.keychain) get_allocation_group() (dissect.xfs.XFS method) (dissect.xfs.xfs.XFS method) get_app_context() (in module flow.record.context) get_array() (dissect.cim.classes.DataRegion method) get_cache_paths() (dissect.target.plugins.os.windows.thumbcache.ThumbcachePlugin method) get_char() (in module dissect.volume.vinum.config) get_children_info() (in module dissect.target.tools.info) get_class_definition() (dissect.cim.CIM method) (dissect.cim.cim.CIM method) get_class_instance() (dissect.cim.CIM method) (dissect.cim.cim.CIM method) get_cluster_chain() (dissect.fat.ExFAT method) (dissect.fat.exfat.ExFAT method) get_cluster_type() (in module dissect.hypervisor.disk.qcow2) get_config_value() (dissect.target.plugins.os.unix.linux.network_managers.LinuxNetworkManager method) get_counts_per_module_per_outcome() (acquire.acquire.collector.CollectionReport method) get_creator_sid() (in module dissect.target.plugins.os.windows.cim) get_current_utc_time() (in module dissect.target.tools.dump) get_data_path() (in module dissect.target.plugins.apps.container.docker) get_days_of_week() (dissect.target.plugins.os.windows.tasks.job.AtTask method) get_descriptor() (dissect.volume.vss.BlockMap method) get_device() (dissect.target.loaders.cb.CbLoader method) get_disks_info() (in module dissect.target.tools.info) get_docstring() (in module dissect.target.helpers.docs) get_drive_letter() (in module dissect.target.plugins.filesystem.ntfs.utils) get_dst_range() (in module dissect.target.plugins.os.windows.datetime) get_element() (dissect.target.plugins.os.windows.tasks.xml.XmlTask method) get_entry (dissect.cim.mappings.Mapping attribute) get_external_module_paths() (in module dissect.target.plugin) get_field_tuples() (flow.record.base.RecordDescriptor method) (flow.record.RecordDescriptor method) get_file_handler() (in module acquire.acquire.log) get_file_object() (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry method) get_filetime_for_event() (dissect.etl.ETL method) (dissect.etl.etl.ETL method) get_filter_name() (in module dissect.target.plugins.os.windows.cim) get_flags_data() (dissect.target.plugins.os.windows.tasks.job.AtTask method) get_formatted_exception() (in module acquire.acquire.utils) get_formatted_report() (dissect.target.tools.utils.report.ExecutionReport method) get_full_formatted_report() (in module acquire.acquire.collector) get_full_path() (in module dissect.ntfs.util) get_full_sink_path() (dissect.target.tools.dump.DumpState method) get_func_description() (in module dissect.target.helpers.docs) get_function() (dissect.target.Target method) (dissect.target.target.Target method) get_handle_name() (in module acquire.acquire.dynamic.windows.handles) get_handle_type_info() (in module acquire.acquire.dynamic.windows.handles) get_handles() (in module acquire.acquire.dynamic.windows.handles) get_inode (dissect.extfs.ExtFS attribute) (dissect.extfs.extfs.ExtFS attribute) get_inode() (dissect.xfs.XFS method) (dissect.xfs.xfs.AllocationGroup method) (dissect.xfs.xfs.XFS method) get_invalid_sinks() (dissect.target.tools.dump.DumpState method) get_kernel_hash() (in module dissect.target.plugins.os.unix.linux.fortios._os) get_keys_for_identifier() (dissect.target.volume.EncryptedVolumeSystem method) get_keys_for_identifiers() (dissect.target.volume.EncryptedVolumeSystem method) get_keys_for_provider() (in module dissect.target.helpers.keychain) get_keys_without_identifier() (dissect.target.volume.EncryptedVolumeSystem method) get_keys_without_provider() (in module dissect.target.helpers.keychain) get_log_files() (dissect.target.plugins.apps.av.mcafee.McAfeePlugin method) get_log_paths() (dissect.target.plugins.apps.webserver.caddy.CaddyPlugin method) (dissect.target.plugins.os.unix.log.audit.AuditPlugin method) get_logger() (in module dissect.target.helpers.logging) get_logs() (dissect.target.plugins.os.windows.log.evt.WindowsEventlogsMixin method) get_logs_from_dir() (dissect.target.plugins.os.windows.log.evt.WindowsEventlogsMixin method) get_logs_from_registry() (dissect.target.plugins.os.windows.log.evt.WindowsEventlogsMixin method) get_long_value() (dissect.database.ese.Table method) (dissect.database.ese.table.Table method) get_meta_blob() (dissect.archive.vbk.VBK method) get_modifier_function() (in module dissect.target.helpers.record_modifier) get_months_of_year() (dissect.target.plugins.os.windows.tasks.job.AtTask method) get_mounts_info() (in module dissect.target.tools.info) get_name() (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES class method) get_names() (dissect.target.tools.shell.ExtendedCmd method) get_nested_attr() (in module dissect.target.tools.dump) get_optional() (in module dissect.target.plugins.os.unix.log.journal) get_optional_func() (in module dissect.target.tools.info) get_owner_and_group() (in module dissect.target.plugins.filesystem.ntfs.utils) get_path_details() (in module acquire.acquire.hashes) get_paths() (dissect.target.plugin.Plugin method) get_paths_from_dir() (in module acquire.acquire.hashes) get_plugin_description() (in module dissect.target.helpers.docs) get_plugin_functions_desc() (in module dissect.target.helpers.docs) get_plugin_output_records() (in module dissect.target.tools.diff) get_plugin_overview() (in module dissect.target.helpers.docs) get_primary_key_from_constraint() (in module dissect.database.sqlite3.util) get_property_value_safe() (in module dissect.target.plugins.os.windows.cim) get_raw() (dissect.target.plugins.os.windows.tasks.xml.XmlTask method) get_record_by_type() (flow.record.base.GroupedRecord method) (flow.record.GroupedRecord method) get_record_size() (in module dissect.target.plugins.filesystem.ntfs.utils) get_records_per_module_per_outcome() (acquire.acquire.collector.CollectionReport method) get_relative_inode() (dissect.xfs.XFS method) (dissect.xfs.xfs.XFS method) get_relative_sink_path() (in module dissect.target.tools.dump) get_report_summary() (in module acquire.acquire.collector) get_required_fields() (flow.record.base.RecordDescriptor static method) (flow.record.RecordDescriptor static method) get_resource_stream() (in module dissect.etl.manifest) get_resource_string() (in module dissect.etl.manifest) (in module dissect.target.helpers.localeutil) get_runs() (dissect.hypervisor.disk.vmdk.SparseDisk method) get_sink() (dissect.target.tools.dump.DumpState method) get_sink_dir_by_func() (in module dissect.target.tools.dump) get_sink_dir_by_target() (in module dissect.target.tools.dump) get_sink_filename() (in module dissect.target.tools.dump) get_sink_writer() (in module dissect.target.tools.dump) get_snapshot_chain() (dissect.hypervisor.disk.hdd.Descriptor method) get_spec_additions() (acquire.acquire.acquire.ActiveDirectory class method) (acquire.acquire.acquire.CamHistory class method) (acquire.acquire.acquire.DHCP class method) (acquire.acquire.acquire.EventLogs class method) (acquire.acquire.acquire.Exchange class method) (acquire.acquire.acquire.History class method) (acquire.acquire.acquire.IIS class method) (acquire.acquire.acquire.Module class method) (acquire.acquire.acquire.MSSQL class method) (acquire.acquire.acquire.NTDS class method) (acquire.acquire.acquire.Registry class method) (acquire.acquire.acquire.SharePoint class method) (acquire.acquire.acquire.WER class method) (acquire.acquire.acquire.WinArpCache class method) (acquire.acquire.acquire.WinMemFiles class method) (acquire.acquire.acquire.WinRDPSessions class method) get_specs() (acquire.acquire.acquire.FileHashes class method) get_state_path() (dissect.target.tools.dump.DumpState class method) get_stdin() (in module flow.record.utils) get_stdout() (in module flow.record.utils) get_string() (dissect.cim.classes.DataRegion method) get_subcluster_range_type() (in module dissect.hypervisor.disk.qcow2) get_subcluster_type() (in module dissect.hypervisor.disk.qcow2) get_table() (dissect.database.ese.tools.sru.SRU method) get_table_entries() (dissect.database.ese.tools.sru.SRU method) get_table_records() (dissect.database.ese.tools.ual.UAL method) (dissect.target.plugins.os.windows.wua_history.WuaHistoryPlugin method) get_tables() (dissect.database.ese.tools.ual.UAL method) get_target_info() (in module dissect.target.tools.info) get_target_logger() (in module dissect.target.target) get_target_report() (dissect.target.tools.utils.report.ExecutionReport method) get_targets() (in module dissect.target.tools.dump) get_tasks() (dissect.target.plugins.os.windows.tasks.xml.ScheduledTasks method) get_token() (dissect.cstruct.expression.ExpressionTokenizer method) get_triggers() (dissect.target.plugins.os.windows.tasks.job.AtTask method) (dissect.target.plugins.os.windows.tasks.xml.XmlTask method) get_type() (in module flow.record.selector) get_user() (dissect.target.plugins.os.windows.registry.RegistryPlugin method) get_user_details() (dissect.target.plugins.os.windows.registry.RegistryPlugin method) get_user_name() (in module acquire.acquire.utils) get_utc_now() (in module acquire.acquire.utils) get_utc_now_str() (in module acquire.acquire.utils) get_value() (dissect.cim.classes.DataRegion method) get_volume_identifier() (in module dissect.target.plugins.filesystem.ntfs.utils) get_volumes_info() (in module dissect.target.tools.info) getattr (dissect.target.helpers.mount.DissectMount attribute) getattr() (dissect.target.helpers.nfs.client.nfs.Client method) GetAttrProc (in module dissect.target.helpers.nfs.nfs3) GetCurrentProcessId (in module acquire.acquire.dynamic.windows.handles) getfields() (flow.record.base.RecordDescriptor method) (flow.record.RecordDescriptor method) GetLastError (in module acquire.acquire.dynamic.windows.handles) getNextRow() (dissect.database.ese.tools.impacket.ESENT_DB method) GetPortProc (in module dissect.target.helpers.sunrpc.sunrpc) gettypename() (flow.record.base.DynamicFieldtypeModule method) getxattr (dissect.target.helpers.mount.DissectMount attribute) GGP (dissect.target.helpers.network.IANAProtocol attribute) gid (dissect.apfs.objects.fs.INode property) (dissect.btrfs.btrfs.INode property) (dissect.btrfs.INode property) (dissect.cramfs.cramfs.INode property) (dissect.cramfs.INode property) (dissect.jffs.jffs2.INode property) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx6.INode6 property) (dissect.squashfs.INode property) (dissect.squashfs.squashfs.INode property) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) (dissect.target.helpers.sunrpc.sunrpc.AuthUnix attribute) gids (dissect.target.helpers.sunrpc.sunrpc.AuthUnix attribute) GIGABITETHERNET (dissect.target.plugins.os.windows.network.IfTypes attribute) GLOB (acquire.acquire.collector.ArtifactType attribute) (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadPlugin attribute) glob() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.helpers.compat.path_313.TargetPath method) glob_ext() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.plugins.os.windows.registry.RegistryPlugin method) (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.regutil) glob_ext0() (in module dissect.target.helpers.regutil) glob_ext1() (in module dissect.target.helpers.regutil) GLOB_INDEX_REGEX (in module dissect.target.helpers.regutil) GLOB_MAGIC_REGEX (in module dissect.target.helpers.regutil) glob_split() (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.regutil) GLOBAL (dissect.target.plugins.os.unix.bsd.darwin.ios._os.Config attribute) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin attribute) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin attribute) global_def (in module dissect.etl.c_etl) global_pointer (dissect.executable.PE property) (dissect.executable.pe.PE property) (dissect.executable.pe.pe.PE property) GLOBS (dissect.target.plugins.os.windows.rdpcache.RdpCachePlugin attribute) GMTP (dissect.target.helpers.network.IANAProtocol attribute) GnomeTrashPlugin (class in dissect.target.plugins.os.unix.trash) gnulocate_def (in module dissect.target.plugins.os.unix.locate.gnulocate) GNULocateFile (class in dissect.target.plugins.os.unix.locate.gnulocate) GNULocatePlugin (class in dissect.target.plugins.os.unix.locate.gnulocate) GNULocateRecord (in module dissect.target.plugins.os.unix.locate.gnulocate) GPT (class in dissect.volume.disk.schemes) (class in dissect.volume.disk.schemes.gpt) gpt (dissect.volume.disk.schemes.GPT attribute) (dissect.volume.disk.schemes.gpt.GPT attribute) gpt_def (in module dissect.volume.disk.schemes.gpt) GR303_IDT (dissect.target.plugins.os.windows.network.IfTypes attribute) GR303_RDT (dissect.target.plugins.os.windows.network.IfTypes attribute) grain (dissect.archive.vbk.SnapshotSlot attribute) granted_access (acquire.acquire.dynamic.windows.types.Handle attribute) (acquire.acquire.dynamic.windows.types.SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX property) GRE (dissect.target.helpers.network.IANAProtocol attribute) Greater (dissect.ntfs.index.Match attribute) GREEK (dissect.database.ese.lcmapstring.SCRIPT attribute) GREEN (dissect.target.helpers.cyber.Color attribute) (dissect.target.tools.shell.AnsiColors attribute) group (dissect.database.bsd.tools.rpm.PackageEntry attribute) (dissect.etl.headers.system.SystemSpecificHeader property) (dissect.ntfs.secure.SecurityDescriptor attribute) (dissect.ntfs.SecurityDescriptor attribute) group() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) group_cursor (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) GROUP_GUID_MAP (in module dissect.etl.utils) group_icon (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) group_id (acquire.acquire.esxi.EsxiMemoryManager attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) GroupedRecord (class in flow.record) (class in flow.record.base) groups_count (dissect.extfs.ExtFS attribute) (dissect.extfs.extfs.ExtFS attribute) groups_offset (dissect.extfs.ExtFS attribute) (dissect.extfs.extfs.ExtFS attribute) GROWABLE (dissect.volume.vinum.config.PlexState attribute) (dissect.volume.vinum.config.SDState attribute) gs (dissect.executable.pe.directory.debug.VcFeatureDebugEntry property) GT (dissect.util.ldap.ComparisonOperator attribute) guard_flags (dissect.executable.pe.directory.load_config.LoadConfigDirectory property) (dissect.executable.pe.directory.LoadConfigDirectory property) guards (dissect.executable.pe.directory.debug.VcFeatureDebugEntry property) GUI (class in acquire.acquire.gui.base) gui() (acquire.acquire.gui.base.GUI class method) gui_display_text (acquire.acquire.gui.win32.Win32 attribute) GUID (dissect.etl.headers.headers.EventProperty attribute) (dissect.eventlog.bxml.BxmlType attribute) guid (dissect.evidence.asdf.asdf.AsdfSnapshot attribute) (dissect.evidence.asdf.asdf.AsdfWriter attribute) (dissect.evidence.asdf.AsdfSnapshot attribute) (dissect.evidence.asdf.AsdfWriter attribute) (dissect.evidence.AsdfSnapshot attribute) (dissect.fve.bde.bde.BootSector attribute) (dissect.fve.bde.information.GuidDatum property) (dissect.hypervisor.disk.asif.ASIF attribute) (dissect.hypervisor.disk.hdd.Image attribute) (dissect.hypervisor.disk.hdd.Shot attribute) (dissect.squashfs.INode property) (dissect.squashfs.squashfs.INode property) (dissect.target.loaders.cellebrite.DeviceInfo attribute) (dissect.target.loaders.res.File attribute) (dissect.target.loaders.res.Folder attribute) (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry attribute) (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) (dissect.target.plugins.os.windows.regf.shellbags.CONTROL_PANEL attribute) (dissect.target.plugins.os.windows.regf.shellbags.GAME_FOLDER attribute) (dissect.target.plugins.os.windows.regf.shellbags.ROOT_FOLDER attribute) (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN0 attribute) (dissect.target.plugins.os.windows.regf.shellbags.USERS_PROPERTY_VIEW attribute) (dissect.target.volume.Volume attribute) (dissect.volume.ddf.ddf.ControllerData attribute) (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) (dissect.volume.ddf.ddf.PhysicalDiskData attribute) (dissect.volume.ddf.ddf.PhysicalDiskRecord attribute) (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) (dissect.volume.ddf.ddf.VirtualDiskRecord attribute) (dissect.volume.disk.Partition attribute) (dissect.volume.disk.partition.Partition attribute) guid_timestamp (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) GuidDatum (class in dissect.fve.bde.information) GUIError GZIP (dissect.target.tools.dump.Compression attribute) GZIP_MAGIC (in module flow.record.base) H H323_GATEKEEPER (dissect.target.plugins.os.windows.network.IfTypes attribute) H323_PROXY (dissect.target.plugins.os.windows.network.IfTypes attribute) Handle (class in acquire.acquire.dynamic.windows.types) handle (dissect.target.helpers.nfs.nfs3.DirOpArgs attribute) (dissect.target.helpers.nfs.nfs3.EntryPlus attribute) (dissect.target.loaders.smb.SmbRegistryHive attribute) (dissect.target.loaders.smb.SmbRegistryKey property) handle_attributes (acquire.acquire.dynamic.windows.types.Handle attribute) (acquire.acquire.dynamic.windows.types.SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX property) handle_cat() (in module dissect.evidence.tools.asdf.meta) handle_hash() (in module dissect.evidence.tools.asdf.meta) handle_ls() (in module dissect.evidence.tools.asdf.meta) handle_type (acquire.acquire.dynamic.windows.types.Handle attribute) handle_value (acquire.acquire.dynamic.windows.types.Handle attribute) (acquire.acquire.dynamic.windows.types.SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX property) HandleNotClosedSuccessfullyError handlers (flow.record.utils.EventHandler attribute) handles() (dissect.target.plugins.apps.edr.acquire.AcquirePlugin method) hardlink_to() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) has() (dissect.vmfs.resource.ResourceManager method) HAS_ARGON2 (in module dissect.fve.crypto.argon2) HAS_ASN1 (in module dissect.target.plugins.apps.browser.firefox) (in module dissect.target.plugins.os.windows.catroot) HAS_AVRO (in module flow.record.base) has_backing_file (dissect.hypervisor.disk.qcow2.QCow2 property) has_bek() (dissect.fve.bde.BDE method) (dissect.fve.bde.bde.BDE method) HAS_BZ2 (in module flow.record.base) HAS_CARBON_BLACK (in module dissect.target.filesystems.cb) (in module dissect.target.loaders.cb) has_child (dissect.ole.ole.DirectoryEntry property) has_clear_key() (dissect.fve.bde.BDE method) (dissect.fve.bde.bde.BDE method) HAS_CRYPTO (in module dissect.apfs.objects.keybag) (in module dissect.target.loaders.itunes) (in module dissect.target.plugins.apps.browser.chromium) (in module dissect.target.plugins.apps.browser.firefox) (in module dissect.target.plugins.apps.ssh.putty) (in module dissect.target.plugins.os.unix.linux.fortios._os) (in module dissect.target.plugins.os.windows.credential.lsa) (in module dissect.target.plugins.os.windows.credential.sam) (in module dissect.target.plugins.os.windows.dpapi.crypto) (in module dissect.target.plugins.os.windows.dpapi.master_key) has_data_file (dissect.hypervisor.disk.qcow2.QCow2 property) has_default_value (dissect.cim.c_cim.ClassDefinitionPropertyState attribute) (dissect.cim.cim.Property property) (dissect.cim.classes.ClassInstanceProperty property) has_dynprops (dissect.cim.classes.Dynprops property) HAS_ELASTIC (in module flow.record.adapter.elastic) HAS_ENVELOPE (in module dissect.target.plugins.os.unix.esxi._os) HAS_FCNTL (in module acquire.acquire.volatilestream) has_field() (in module flow.record.selector) has_function() (dissect.target.Target method) (dissect.target.target.Target method) HAS_FUSE (in module dissect.target.tools.mount) has_glob_magic() (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.regutil) HAS_HTTPX (in module flow.record.adapter.splunk) HAS_IMPACKET (in module dissect.target.filesystems.smb) (in module dissect.target.loaders.smb) has_left_sibling (dissect.ole.ole.DirectoryEntry property) HAS_LZ4 (in module dissect.target.tools.dump) (in module flow.record.base) has_more (dissect.eventlog.bxml.Token attribute) has_offset() (dissect.volume.vss.StoreBitmap method) HAS_PAHO (in module dissect.target.loaders.mqtt) has_parent (dissect.hypervisor.disk.vhdx.VHDX attribute) has_passphrase() (dissect.fve.bde.BDE method) (dissect.fve.bde.bde.BDE method) has_phrase() (dissect.hypervisor.descriptor.vmx.Pair method) HAS_PYCRYPTODOME (in module acquire.acquire.crypt) (in module dissect.hypervisor.descriptor.vmx) (in module dissect.hypervisor.util.envelope) (in module dissect.target.loaders.ab) HAS_PYSTANDALONE (in module acquire.acquire.crypt) (in module dissect.apfs.objects.keybag) (in module dissect.hypervisor.descriptor.vmx) (in module dissect.hypervisor.util.envelope) (in module dissect.target.loaders.itunes) has_recovery_password() (dissect.fve.bde.BDE method) (dissect.fve.bde.bde.BDE method) has_right_sibling (dissect.ole.ole.DirectoryEntry property) has_small_pages (dissect.database.ESE property) (dissect.database.ese.ESE property) (dissect.database.ese.ese.ESE property) has_store_data (dissect.volume.vss.Store attribute) has_stream() (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.MftRecord method) HAS_STRUCTLOG (in module flow.record.tools.rdump) has_subclusters (dissect.hypervisor.disk.qcow2.QCow2 property) HAS_TOML (in module dissect.target.helpers.configutil) HAS_TQDM (in module dissect.evidence.tools.asdf.dd) (in module flow.record.tools.rdump) has_type_reader (dissect.eventlog.bxml.BxmlTemplateDescriptor attribute) HAS_YAML (in module dissect.target.helpers.configutil) (in module dissect.target.plugins.os.unix.linux.network_managers) HAS_YARA (in module dissect.target.plugins.filesystem.yara) HAS_ZONE_INFO (in module flow.record.fieldtypes) HAS_ZSTD (in module dissect.btrfs.stream) (in module dissect.hypervisor.disk.qcow2) (in module dissect.target.plugins.os.unix.locate.plocate) (in module dissect.target.tools.dump) (in module flow.record.base) hash (dissect.apfs.objects.fs.DirectoryEntry property) (dissect.archive.wim.Resource attribute) (dissect.executable.pe.directory.debug.ReproDebugEntry property) (dissect.fve.bde.information.ValidationEntry property) (dissect.fve.luks.metadata.Digest attribute) (dissect.fve.luks.metadata.KeyslotAf attribute) (dissect.fve.luks.metadata.KeyslotArea attribute) (dissect.fve.luks.metadata.KeyslotKdf attribute) HASH (dissect.target.helpers.record_modifier.Modifier attribute) hash (dissect.thumbcache.thumbcache_file.ThumbcacheEntry property) (dissect.thumbcache.ThumbcacheEntry property) hash() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) hash_alg (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry attribute) hash_algorithm (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) HASH_ALGORITHMS (in module dissect.target.plugins.os.windows.dpapi.crypto) hash_file (dissect.target.plugins.apps.edr.acquire.AcquirePlugin attribute) hash_fileobj() (in module dissect.evidence.tools.asdf.verify) hash_len (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) hash_record (flow.record.adapter.elastic.ElasticWriter attribute) hash_spec (dissect.fve.luks.LUKS attribute) (dissect.fve.luks.luks.LUKS attribute) hash_to_image_id() (in module dissect.target.plugins.apps.container.docker) hash_zone_threads (dissect.volume.lvm.metadata.VdoPoolSegment attribute) HashAlgorithm (class in dissect.target.plugins.os.windows.dpapi.crypto) HashedStream (class in dissect.evidence.asdf.streams) hashes() (dissect.target.plugins.apps.edr.acquire.AcquirePlugin method) hashfileobj() (in module dissect.evidence.tools.asdf.meta) HashFunc (class in acquire.acquire.hashes) HashLeaf (class in dissect.regf.regf) hashname() (in module dissect.regf.regf) hashtable() (dissect.target.plugins.os.unix.locate.plocate.PLocateFile method) HAVE_ASTOR (in module flow.record.selector) HCURSOR (in module acquire.acquire.gui.win32) HDD (class in dissect.hypervisor.disk.hdd) hdd (dissect.target.containers.hdd.HddContainer attribute) hdd_def (in module dissect.hypervisor.disk.c_hdd) HddContainer (class in dissect.target.containers.hdd) HDH_1822 (dissect.target.plugins.os.windows.network.IfTypes attribute) HDLC (dissect.target.plugins.os.windows.network.IfTypes attribute) HDS (class in dissect.hypervisor.disk.hdd) hds (dissect.target.containers.hds.HdsContainer attribute) HdsContainer (class in dissect.target.containers.hds) HDSL2 (dissect.target.plugins.os.windows.network.IfTypes attribute) header (acquire.acquire.tools.decrypter.EncryptedFile property) Header (class in dissect.etl.headers.headers) header (dissect.apfs.objects.BTree attribute) (dissect.apfs.objects.btree.BTree attribute) (dissect.archive.vbk.Bank attribute) (dissect.archive.vbk.SnapshotSlot attribute) (dissect.archive.vbk.VBK attribute) (dissect.archive.vma.Extent attribute) (dissect.archive.vma.VMA attribute) (dissect.archive.wim.SecurityBlock attribute) (dissect.archive.wim.WIM attribute) (dissect.cim.classes.ClassDefinition attribute) (dissect.cim.classes.ClassInstance attribute) (dissect.clfs.c_clfs.BlockHeader attribute) (dissect.database.bsd.db.Page property) (dissect.database.bsd.tools.rpm.HeaderBlob attribute) (dissect.database.ESE attribute) (dissect.database.ese.ESE attribute) (dissect.database.ese.ese.ESE attribute) (dissect.database.ese.Page attribute) (dissect.database.ese.page.Page attribute) (dissect.database.ese.record.RecordData attribute) (dissect.database.SQLite3 attribute) (dissect.database.sqlite3.SQLite3 attribute) (dissect.database.sqlite3.sqlite3.Page attribute) (dissect.database.sqlite3.sqlite3.SQLite3 attribute) (dissect.database.sqlite3.sqlite3.WAL attribute) (dissect.database.sqlite3.sqlite3.WALFrame attribute) (dissect.database.sqlite3.WAL attribute) (dissect.etl.Buffer property) (dissect.etl.etl.Buffer property) (dissect.etl.etl.EventRecord property) (dissect.etl.headers.headers.Header property) (dissect.etl.headers.logfile.LogfileHeader property) (dissect.eventlog.CRIM attribute) (dissect.eventlog.Evt attribute) (dissect.eventlog.evt.Evt attribute) (dissect.eventlog.Evtx attribute) (dissect.eventlog.evtx.ElfChnk attribute) (dissect.eventlog.evtx.Evtx attribute) (dissect.eventlog.wevt.CRIM attribute) (dissect.eventlog.wevt.WEVT attribute) (dissect.eventlog.wevt.WEVT_TYPE attribute) (dissect.eventlog.wevt_object.WevtObject attribute) (dissect.evidence.ad1.AD1 attribute) (dissect.evidence.ad1.LogicalImage attribute) (dissect.evidence.asdf.asdf.AsdfSnapshot attribute) (dissect.evidence.asdf.AsdfSnapshot attribute) (dissect.evidence.AsdfSnapshot attribute) (dissect.evidence.EWF attribute) (dissect.evidence.ewf.EWF attribute) (dissect.evidence.ewf.Segment attribute) (dissect.evidence.ewf.TableSection attribute) (dissect.executable.ELF attribute) (dissect.executable.elf.ELF attribute) (dissect.executable.elf.elf.ELF attribute) (dissect.executable.elf.elf.Section attribute) (dissect.executable.elf.elf.Segment attribute) (dissect.executable.elf.Section attribute) (dissect.executable.elf.Segment attribute) (dissect.executable.pe.directory.export.ExportDirectory property) (dissect.executable.pe.directory.ExportDirectory property) (dissect.executable.pe.directory.tls.TlsDirectory property) (dissect.executable.pe.directory.TlsDirectory property) (dissect.executable.pe.pe.Section attribute) (dissect.extfs.journal.CommitBlock attribute) (dissect.extfs.journal.DescriptorBlock attribute) (dissect.fve.bde.eow.EowBitmap attribute) (dissect.fve.bde.eow.EowBitmapRecord attribute) (dissect.fve.bde.eow.EowInformation attribute) (dissect.fve.bde.information.Dataset attribute) (dissect.fve.bde.information.Datum attribute) (dissect.fve.bde.information.Information attribute) (dissect.fve.luks.LUKS attribute) (dissect.fve.luks.luks.LUKS attribute) (dissect.hypervisor.descriptor.hyperv.HyperVFile attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageObjectTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageReplayLog attribute) (dissect.hypervisor.disk.asif.ASIF attribute) (dissect.hypervisor.disk.hdd.HDS attribute) (dissect.hypervisor.disk.qcow2.QCow2 attribute) (dissect.hypervisor.disk.qcow2.QCow2Snapshot attribute) (dissect.hypervisor.disk.vdi.VDI attribute) (dissect.hypervisor.disk.vhd.DynamicDisk attribute) (dissect.hypervisor.disk.vhdx.MetadataTable attribute) (dissect.hypervisor.disk.vhdx.ParentLocator attribute) (dissect.hypervisor.disk.vhdx.RegionTable attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) (dissect.hypervisor.disk.vmdk.SparseDisk attribute) (dissect.hypervisor.util.envelope.Envelope attribute) (dissect.ntfs.ACE attribute) (dissect.ntfs.ACL attribute) (dissect.ntfs.attr.Attribute attribute) (dissect.ntfs.attr.AttributeHeader attribute) (dissect.ntfs.Attribute attribute) (dissect.ntfs.AttributeHeader attribute) (dissect.ntfs.index.IndexBuffer attribute) (dissect.ntfs.index.IndexEntry attribute) (dissect.ntfs.index.IndexRoot attribute) (dissect.ntfs.IndexEntry attribute) (dissect.ntfs.mft.MftRecord attribute) (dissect.ntfs.MftRecord attribute) (dissect.ntfs.secure.ACE attribute) (dissect.ntfs.secure.ACL attribute) (dissect.ntfs.secure.SecurityDescriptor attribute) (dissect.ntfs.SecurityDescriptor attribute) (dissect.ntfs.usnjrnl.UsnRecord attribute) (dissect.ntfs.UsnRecord attribute) (dissect.ole.OLE attribute) (dissect.ole.ole.OLE attribute) (dissect.regf.regf.RegistryHive attribute) (dissect.regf.RegistryHive attribute) (dissect.squashfs.INode property) (dissect.squashfs.squashfs.INode property) (dissect.target.plugins.os.unix.locate.mlocate.MLocateFile attribute) (dissect.target.plugins.os.unix.locate.plocate.PLocateFile attribute) (dissect.target.plugins.os.unix.log.atop.AtopFile attribute) (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntry attribute) (dissect.target.plugins.os.windows.everything.parser.EverythingDB attribute) (dissect.target.plugins.os.windows.jumplist.CustomDestinationFile attribute) (dissect.target.plugins.os.windows.prefetch.Prefetch attribute) (dissect.target.plugins.os.windows.regf.cit.CIT attribute) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK attribute) (dissect.thumbcache.index.IndexEntry property) (dissect.thumbcache.index.ThumbnailIndex property) (dissect.thumbcache.IndexEntry property) (dissect.thumbcache.thumbcache_file.ThumbcacheFile property) (dissect.thumbcache.ThumbcacheFile property) (dissect.thumbcache.ThumbnailIndex property) (dissect.volume.ddf.ddf.ControllerData attribute) (dissect.volume.ddf.ddf.PhysicalDiskData attribute) (dissect.volume.ddf.ddf.PhysicalDiskRecord attribute) (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) (dissect.volume.ddf.ddf.VirtualDiskRecord attribute) (dissect.volume.dm.btree.Node attribute) (dissect.volume.lvm.LVM2Device attribute) (dissect.volume.lvm.physical.LVM2Device attribute) (dissect.volume.vinum.vinum.VinumPhysicalDisk attribute) (dissect.volume.vss.Store attribute) (dissect.volume.vss.VSS attribute) (flow.record.adapter.csvfile.CsvfileWriter attribute) HEADER (in module dissect.target.loaders.cyber) header1 (dissect.fve.luks.LUKS attribute) (dissect.fve.luks.luks.LUKS attribute) header2 (dissect.database.ese.Page attribute) (dissect.database.ese.page.Page attribute) (dissect.fve.luks.LUKS attribute) (dissect.fve.luks.luks.LUKS attribute) header_checksum (dissect.thumbcache.thumbcache_file.ThumbcacheEntry attribute) (dissect.thumbcache.ThumbcacheEntry attribute) header_def (in module dissect.eventlog.wevt) header_extensions (dissect.etl.headers.event.EventHeader property) HEADER_FLAG (in module dissect.archive.c_wim) HEADER_FLAGS (dissect.etl.headers.headers.Marker attribute) HEADER_FOOTER_SIZE (in module dissect.util.compression.xz) HEADER_MAGIC (in module acquire.acquire.crypt) HEADER_MASK (dissect.etl.headers.headers.Marker attribute) HEADER_SIZE (dissect.target.plugins.os.unix.locate.plocate.PLocateFile attribute) header_size (dissect.volume.lvm.metadata.VdoPoolSegment attribute) header_type (dissect.etl.headers.headers.Marker property) header_written (flow.record.stream.RecordStreamWriter attribute) HeaderBlob (class in dissect.database.bsd.tools.rpm) headers (dissect.hypervisor.descriptor.hyperv.HyperVFile attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) HEADERS (in module dissect.etl.headers.utils) HeaderSection (class in dissect.evidence.ewf) HeapGuid (in module dissect.etl.utils) HEBREW (dissect.database.ese.lcmapstring.SCRIPT attribute) height (dissect.target.plugins.os.windows.rdpcache.BitmapTile attribute) HEXBIN_SUFFIX (in module dissect.cstruct.expression) hexdigest() (dissect.evidence.asdf.streams.HashedStream method) hexdigit() (dissect.cstruct.expression.ExpressionTokenizer method) hexdump() (in module dissect.cstruct) (in module dissect.cstruct.utils) HEXINT32 (dissect.eventlog.bxml.BxmlType attribute) HEXINT64 (dissect.eventlog.bxml.BxmlType attribute) hidden (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) high (dissect.target.helpers.sunrpc.sunrpc.Mismatch attribute) high_watermark (dissect.volume.lvm.metadata.WriteCacheSegment attribute) highest_vcn (dissect.ntfs.attr.AttributeHeader property) (dissect.ntfs.AttributeHeader property) HINT_NEEDLE (in module dissect.target.plugins.os.windows.catroot) HIP (dissect.target.helpers.network.IANAProtocol attribute) HIPERLAN2 (dissect.target.plugins.os.windows.network.IfTypes attribute) HIPPI (dissect.target.plugins.os.windows.network.IfTypes attribute) HIPPIINTERFACE (dissect.target.plugins.os.windows.network.IfTypes attribute) HIST_PATH (dissect.target.plugins.apps.chat.msn.MSNPlugin attribute) histdir (dissect.target.tools.shell.TargetCmd attribute) histfilesize (dissect.target.tools.shell.TargetCmd attribute) historical_logical_volumes (dissect.volume.lvm.metadata.VolumeGroup attribute) HistoricalLogicalVolume (class in dissect.volume.lvm.metadata) History (class in acquire.acquire.acquire) history() (dissect.target.plugins.apps.browser.brave.BravePlugin method) (dissect.target.plugins.apps.browser.chrome.ChromePlugin method) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin method) (dissect.target.plugins.apps.browser.chromium.ChromiumPlugin method) (dissect.target.plugins.apps.browser.edge.EdgePlugin method) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin method) (dissect.target.plugins.apps.browser.iexplore.InternetExplorerPlugin method) (dissect.target.plugins.apps.browser.iexplore.WebCache method) (dissect.target.plugins.apps.chat.msn.MSNPlugin method) (dissect.target.plugins.apps.editor.editor.EditorPlugin method) (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadPlugin method) (dissect.target.plugins.os.windows.cam.CamPlugin method) History.DirCombinations (class in acquire.acquire.acquire) history_files (acquire.acquire.acquire.History.DirCombinations attribute) HitmanAlertRecord (in module dissect.target.plugins.apps.av.sophos) hitmanlogs() (dissect.target.plugins.apps.av.sophos.SophosPlugin method) hive (dissect.regf.regf.Cell attribute) (dissect.regf.regf.ValueList attribute) (dissect.target.helpers.regutil.RegfHive attribute) (dissect.target.helpers.regutil.RegistryKey attribute) (dissect.target.helpers.regutil.RegistryValue attribute) (dissect.target.loaders.smb.SmbRegistryKey attribute) (dissect.target.plugins.os.windows.syscache.SyscachePlugin attribute) HiveCollection (class in dissect.target.helpers.regutil) HIVES (acquire.acquire.acquire.Registry attribute) hives (dissect.target.helpers.regutil.HiveCollection attribute) (dissect.target.helpers.regutil.RegFlex attribute) HIVES (dissect.target.plugins.apps.productivity.msoffice.MSOffice attribute) HiveUnavailableError HIWORD() (in module acquire.acquire.gui.win32) hmac (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) HMAC_MAP (in module dissect.hypervisor.descriptor.vmx) HMP (dissect.target.helpers.network.IANAProtocol attribute) HOMA (dissect.target.helpers.network.IANAProtocol attribute) Home (class in acquire.acquire.acquire) home() (dissect.target.helpers.compat.path_310.TargetPath class method) (dissect.target.helpers.compat.path_311.TargetPath class method) (dissect.target.helpers.compat.path_312.TargetPath class method) (dissect.target.helpers.compat.path_313.TargetPath class method) home_path (dissect.target.plugins.general.users.UserDetails attribute) hook_id (dissect.etl.headers.system.SystemSpecificHeader property) HOPOPT (dissect.target.helpers.network.IANAProtocol attribute) host (dissect.target.loaders.cb.CbLoader attribute) (dissect.target.loaders.mqtt.MqttConnection attribute) (flow.record.adapter.splunk.SplunkWriter attribute) host_paths (dissect.target.plugins.apps.webserver.nginx.NginxPlugin attribute) hostname (dissect.cim.utils.ObjectPath attribute) (dissect.target.loaders.remote.RemoteStreamConnection attribute) (flow.record.fieldtypes.uri property) hostname() (dissect.target.loaders.profile.ProfileOSPlugin method) (dissect.target.loaders.res.ResOSPlugin method) (dissect.target.plugin.OSPlugin method) (dissect.target.plugins.os.default._os.DefaultOSPlugin method) (dissect.target.plugins.os.unix._os.UnixPlugin method) (dissect.target.plugins.os.unix.bsd._os.BsdPlugin method) (dissect.target.plugins.os.unix.bsd.citrix._os.CitrixPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin method) (dissect.target.plugins.os.unix.bsd.openbsd._os.OpenBsdPlugin method) (dissect.target.plugins.os.unix.esxi._os.ESXiPlugin method) (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSPlugin method) (dissect.target.plugins.os.windows._os.WindowsPlugin method) HOSTPAD (dissect.target.plugins.os.windows.network.IfTypes attribute) hosts() (dissect.target.plugins.apps.webserver.apache.ApachePlugin method) (dissect.target.plugins.apps.webserver.nginx.NginxPlugin method) HOUR (in module dissect.target.plugins.os.windows.datetime) HSSI (dissect.target.plugins.os.windows.network.IfTypes attribute) hsts() (dissect.target.plugins.apps.shell.wget.WgetPlugin method) html (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) HTTP (flow.record.adapter.splunk.Protocol attribute) HTTPS (flow.record.adapter.splunk.Protocol attribute) human_readable_size() (in module flow.record.fieldtypes) human_size() (in module dissect.target.tools.utils.fs) hwnd (acquire.acquire.gui.win32.Win32 attribute) HYPERCHANNEL (dissect.target.plugins.os.windows.network.IfTypes attribute) hyperv_def (in module dissect.hypervisor.descriptor.c_hyperv) HyperVChildTargetPlugin (class in dissect.target.plugins.child.hyperv) HyperVFile (class in dissect.hypervisor.descriptor.hyperv) HypervisorTraceGuid (in module dissect.etl.utils) HypervisorXTraceGuid (in module dissect.etl.utils) HyperVLoader (class in dissect.target.loaders.hyperv) HyperVStorageFileObject (class in dissect.hypervisor.descriptor.hyperv) HyperVStorageKeyTable (class in dissect.hypervisor.descriptor.hyperv) HyperVStorageKeyTableEntry (class in dissect.hypervisor.descriptor.hyperv) HyperVStorageObjectTable (class in dissect.hypervisor.descriptor.hyperv) HyperVStorageReplayLog (class in dissect.hypervisor.descriptor.hyperv) I I (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) I_NLSP (dissect.target.helpers.network.IANAProtocol attribute) IANAProtocol (class in dissect.target.helpers.network) iat (dissect.executable.PE property) (dissect.executable.pe.PE property) (dissect.executable.pe.pe.PE property) IatDirectory (class in dissect.executable.pe.directory) (class in dissect.executable.pe.directory.iat) IATP (dissect.target.helpers.network.IANAProtocol attribute) IBM370PARCHAN (dissect.target.plugins.os.windows.network.IfTypes attribute) icat() (dissect.target.plugins.filesystem.icat.ICatPlugin method) ICatPlugin (class in dissect.target.plugins.filesystem.icat) ICMP (dissect.target.helpers.network.IANAProtocol attribute) icon (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) ICON_ENVIRONMENT_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) iconcache() (dissect.target.plugins.os.windows.thumbcache.ThumbcachePlugin method) IconcacheRecord (in module dissect.target.plugins.os.windows.thumbcache) id (dissect.archive.vma.Device attribute) (dissect.clfs.blf.Container attribute) (dissect.clfs.blf.Stream attribute) (dissect.etl.headers.event.EventDescriptor attribute) (dissect.etl.headers.headers.MessageTraceHeader property) (dissect.hypervisor.descriptor.vmx.Phrase attribute) (dissect.hypervisor.disk.qcow2.QCow2Snapshot attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) (dissect.hypervisor.util.envelope.KeyStore property) (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm attribute) (dissect.target.plugins.os.windows.dpapi.crypto.HashAlgorithm attribute) (dissect.target.plugins.os.windows.jumplist.JumpListFile property) (dissect.volume.lvm.LVM2Device attribute) (dissect.volume.lvm.metadata.HistoricalLogicalVolume attribute) (dissect.volume.lvm.metadata.LogicalVolume attribute) (dissect.volume.lvm.metadata.PhysicalVolume attribute) (dissect.volume.lvm.metadata.VolumeGroup attribute) (dissect.volume.lvm.physical.LVM2Device attribute) (dissect.volume.vinum.vinum.VinumPhysicalDisk attribute) id_map (dissect.database.ese.tools.sru.SRU attribute) id_table (dissect.squashfs.SquashFS attribute) (dissect.squashfs.squashfs.SquashFS attribute) idb_flags (dissect.database.ese.Index attribute) (dissect.database.ese.index.Index attribute) IDBFLAG (in module dissect.database.ese.c_ese) IDC_ARROW (in module acquire.acquire.gui.win32) identifier (dissect.database.ese.record.TagField attribute) (dissect.database.ese.table.Column attribute) (dissect.eventlog.wevt_object.TEMP attribute) (dissect.fve.bde.information.Dataset attribute) (dissect.fve.bde.information.ExternalInfoDatum property) (dissect.fve.bde.information.VmkInfoDatum property) (dissect.target.helpers.keychain.Key attribute) (dissect.target.loaders.itunes.ITunesBackup property) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK_BEEF0004 attribute) (dissect.target.plugins.os.windows.regf.shellbags.USERS_PROPERTY_VIEW attribute) (dissect.target.plugins.os.windows.regf.shellbags.VOLUME attribute) (dissect.thumbcache.index.IndexEntry property) (dissect.thumbcache.IndexEntry property) (dissect.thumbcache.thumbcache_file.ThumbcacheEntry attribute) (dissect.thumbcache.ThumbcacheEntry attribute) (flow.record.base.RecordDescriptor property) (flow.record.RecordDescriptor property) IDENTIFIER_BYTES (in module dissect.thumbcache.index) identifier_to_str() (in module flow.record.packer) identifiers (dissect.fve.bde.BDE property) (dissect.fve.bde.bde.BDE property) identify() (dissect.target.plugins.os.windows.prefetch.Prefetch method) (dissect.target.plugins.os.windows.regf.shimcache.ShimCache method) IDENTITY_DB_FILENAME (dissect.target.plugins.os.windows.ual.UalPlugin attribute) identity_db_parser (dissect.target.plugins.os.windows.ual.UalPlugin attribute) IDENTITY_DB_PATH (dissect.target.plugins.os.windows.ual.UalPlugin attribute) IDI_APPLICATION (in module acquire.acquire.gui.win32) idle_duration (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) idle_restart_on_idle (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) idle_stop_on_idle_end (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) idle_wait_timeout (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) IdleTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) idlist (dissect.shellitem.lnk.lnk.LnkTargetIdList attribute) IDPR (dissect.target.helpers.network.IANAProtocol attribute) IDPR_CMTP (dissect.target.helpers.network.IANAProtocol attribute) IDRP (dissect.target.helpers.network.IANAProtocol attribute) IDSL (dissect.target.plugins.os.windows.network.IfTypes attribute) idx (dissect.eventlog.utils.KeyValueCollection attribute) (dissect.evidence.asdf.asdf.AsdfStream attribute) (dissect.evidence.asdf.AsdfStream attribute) (dissect.evidence.AsdfStream attribute) (dissect.executable.elf.elf.Section attribute) (dissect.executable.elf.elf.Segment attribute) (dissect.executable.elf.elf.Symbol attribute) (dissect.executable.elf.Section attribute) (dissect.executable.elf.Segment attribute) (dissect.executable.elf.Symbol attribute) idx_flags (dissect.database.ese.Index attribute) (dissect.database.ese.index.Index attribute) IDX_MEMORY (in module dissect.evidence.asdf.asdf) IDX_METADATA (in module dissect.evidence.asdf.asdf) IDXFLAG (in module dissect.database.ese.c_ese) IEEE1394 (dissect.target.plugins.os.windows.network.IfTypes attribute) IEEE80211 (dissect.target.plugins.os.windows.network.IfTypes attribute) IEEE80212 (dissect.target.plugins.os.windows.network.IfTypes attribute) IEEE8023AD_LAG (dissect.target.plugins.os.windows.network.IfTypes attribute) IF_GSN (dissect.target.plugins.os.windows.network.IfTypes attribute) iface (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) IFMP (dissect.target.helpers.network.IANAProtocol attribute) IfTypes (class in dissect.target.plugins.os.windows.network) IGMP (dissect.target.helpers.network.IANAProtocol attribute) IGNORE_CACHE (in module dissect.target.helpers.cache) IGNORE_FIELDS_FOR_COMPARISON (in module flow.record) (in module flow.record.base) ignore_fields_for_comparison() (in module flow.record) (in module flow.record.base) IGNORED_IPS (in module dissect.target.plugins.os.unix.linux.network_managers) IGP (dissect.target.helpers.network.IANAProtocol attribute) IIS (class in acquire.acquire.acquire) IISLogsPlugin (class in dissect.target.plugins.apps.webserver.iis) IL (dissect.target.helpers.network.IANAProtocol attribute) IL() (dissect.cim.index.Key method) image (acquire.acquire.gui.win32.Win32 attribute) Image (class in dissect.archive.wim) (class in dissect.hypervisor.disk.hdd) image (dissect.archive.wim.DirectoryEntry attribute) (dissect.evidence.ad1.FileEntry attribute) (dissect.evidence.ad1.FileMeta attribute) image_backing_file (dissect.hypervisor.disk.qcow2.QCow2 attribute) image_base (dissect.executable.PE property) (dissect.executable.pe.PE property) (dissect.executable.pe.pe.PE property) image_data_file (dissect.hypervisor.disk.qcow2.QCow2 attribute) ImageLoadGuid (in module dissect.etl.utils) images (dissect.hypervisor.disk.hdd.Storage attribute) images() (dissect.archive.wim.WIM method) (dissect.target.plugins.apps.container.docker.DockerPlugin method) (dissect.target.plugins.apps.container.podman.PodmanPlugin method) impacket_compat (dissect.database.ESE attribute) (dissect.database.ese.ESE attribute) (dissect.database.ese.ese.ESE attribute) import_lazy() (in module dissect.target.helpers.lazy) ImportDirectory (class in dissect.executable.pe.directory) (class in dissect.executable.pe.directory.imports) ImportFunction (class in dissect.executable.pe.directory) (class in dissect.executable.pe.directory.imports) ImportModule (class in dissect.executable.pe.directory) (class in dissect.executable.pe.directory.imports) imports (dissect.executable.PE property) (dissect.executable.pe.PE property) (dissect.executable.pe.pe.PE property) IMT (dissect.target.plugins.os.windows.network.IfTypes attribute) in_cidr() (dissect.target.plugins.os.default.network.NetworkPlugin method) in_transaction (dissect.regf.regf.RegistryHive attribute) (dissect.regf.RegistryHive attribute) in_use (dissect.hypervisor.disk.hdd.HDS attribute) in_use() (dissect.thumbcache.index.IndexEntry method) (dissect.thumbcache.IndexEntry method) (dissect.volume.vss.StoreBitmap method) includes (dissect.cstruct.cstruct attribute) (dissect.cstruct.cstruct.cstruct attribute) incompatible_features (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) (dissect.apfs.objects.nx_superblock.NxSuperblock property) (dissect.apfs.objects.NxSuperblock property) INCOMPATIBLE_PLUGIN (dissect.target.target.Event attribute) incompatible_plugins (dissect.target.tools.utils.report.TargetExecutionReport attribute) IncompleteMessage IncrementItem (class in dissect.archive.vbk) indent (flow.record.jsonpacker.JsonRecordPacker attribute) (flow.record.JsonRecordPacker attribute) INDENT_STEP (in module dissect.target.helpers.docs) Indentation (class in dissect.target.helpers.configutil) Index (class in dissect.cim.index) (class in dissect.database.ese) (class in dissect.database.ese.index) (class in dissect.database.sqlite3.sqlite3) (class in dissect.ntfs) (class in dissect.ntfs.index) index (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) (dissect.cim.cim.Property property) (dissect.cim.classes.ClassDefinitionProperty attribute) (dissect.cim.classes.ClassInstanceProperty property) (dissect.database.ese.cursor.Cursor attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTable property) (dissect.hypervisor.disk.asif.Table attribute) (dissect.ntfs.index.IndexBuffer attribute) (dissect.ntfs.index.IndexEntry attribute) (dissect.ntfs.index.IndexRoot attribute) (dissect.ntfs.IndexEntry attribute) (dissect.target.loaders.mqtt.Broker attribute) (dissect.target.loaders.mqtt.DiskMessage attribute) (dissect.util.compression.lzxpress_huffman.BitString property) (dissect.volume.vss.Store attribute) (flow.record.adapter.elastic.ElasticReader attribute) (flow.record.adapter.elastic.ElasticWriter attribute) index() (dissect.database.ese.Table method) (dissect.database.ese.table.Table method) (dissect.database.SQLite3 method) (dissect.database.sqlite3.SQLite3 method) (dissect.database.sqlite3.sqlite3.SQLite3 method) (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.MftRecord method) index_buffer (dissect.ntfs.Index attribute) (dissect.ntfs.index.Index attribute) INDEX_ENTRIES (in module dissect.thumbcache.index) index_entries() (dissect.thumbcache.Thumbcache method) (dissect.thumbcache.thumbcache.Thumbcache method) index_entry (dissect.target.filesystems.ntfs.NtfsFilesystemEntry attribute) INDEX_ENTRY_END (in module dissect.ntfs.c_ntfs) INDEX_ENTRY_NODE (in module dissect.ntfs.c_ntfs) index_memory_size_mb (dissect.volume.lvm.metadata.VdoPoolSegment attribute) INDEX_NODE (in module dissect.ntfs.c_ntfs) INDEX_PAGE_INVALID (in module dissect.cim.c_cim) INDEX_PAGE_INVALID2 (in module dissect.cim.c_cim) INDEX_PAGE_SIZE (in module dissect.cim.c_cim) IndexBuffer (class in dissect.ntfs.index) IndexEntry (class in dissect.ntfs) (class in dissect.ntfs.index) (class in dissect.thumbcache) (class in dissect.thumbcache.index) indexes (dissect.database.ese.Table attribute) (dissect.database.ese.table.Table attribute) IndexLeaf (class in dissect.regf.regf) IndexPage (class in dissect.cim.index) IndexRecord (in module dissect.target.plugins.os.windows.thumbcache) IndexRoot (class in dissect.ntfs.index) (class in dissect.regf.regf) indices() (dissect.database.SQLite3 method) (dissect.database.sqlite3.SQLite3 method) (dissect.database.sqlite3.sqlite3.SQLite3 method) infer() (dissect.target.plugins.os.unix.packagemanager.OperationTypes class method) infer_access_log_format() (dissect.target.plugins.apps.webserver.apache.ApachePlugin static method) (dissect.target.plugins.apps.webserver.citrix.CitrixWebserverPlugin static method) info (acquire.acquire.gui.win32.Win32 attribute) (dissect.apfs.objects.BTree attribute) (dissect.apfs.objects.btree.BTree attribute) (dissect.archive.wim.ReparsePoint attribute) (dissect.executable.pe.directory.debug.CodeViewDebugEntry property) (dissect.executable.pe.directory.debug.VcFeatureDebugEntry property) (dissect.target.loaders.itunes.ITunesBackup attribute) (dissect.target.loaders.mqtt.MqttConnection attribute) INFO (dissect.target.plugins.os.unix.log.journal.JournalMessagePriority attribute) info() (dissect.target.loaders.mqtt.Broker method) (dissect.target.loaders.remote.RemoteStreamConnection method) InfoMessage (class in dissect.target.loaders.mqtt) InfoRecord (in module dissect.target.tools.info) Information (class in dissect.fve.bde.information) information (dissect.fve.bde.BDE attribute) (dissect.fve.bde.bde.BDE attribute) (dissect.volume.vss.Store attribute) information_offset (dissect.fve.bde.information.Information property) INFORMATION_OFFSET_GUID (in module dissect.fve.bde.c_bde) information_offsets (dissect.fve.bde.bde.BootSector attribute) InformationType (class in dissect.target.plugins.filesystem.ntfs.utils) inherited_object_type (dissect.ntfs.ACE attribute) (dissect.ntfs.secure.ACE attribute) Ini (class in dissect.target.helpers.configutil) init() (acquire.acquire.outputs.base.Output method) (dissect.target.helpers.mount.DissectMount method) (dissect.util.compression.lzxpress_huffman.BitString method) init_from_dict() (flow.record.base.RecordDescriptor method) (flow.record.RecordDescriptor method) init_from_record() (flow.record.base.RecordDescriptor method) (flow.record.RecordDescriptor method) init_state (dissect.volume.ddf.ddf.VirtualDiskRecord attribute) INITCOMMONCONTROLSEX (class in acquire.acquire.gui.win32) initd() (dissect.target.plugins.os.unix.linux.services.ServicesPlugin method) INITD_PATHS (dissect.target.plugins.os.unix.linux.services.ServicesPlugin attribute) initialize() (in module dissect.squashfs.compression) initialize_object_attributes() (in module acquire.acquire.dynamic.windows.ntdll) INITIALIZING (dissect.volume.vinum.config.PlexState attribute) (dissect.volume.vinum.config.SDState attribute) ino_to_cg() (in module dissect.ffs.ffs) ino_to_fsba() (in module dissect.ffs.ffs) ino_to_fsbo() (in module dissect.ffs.ffs) INode (class in dissect.apfs.objects.fs) (class in dissect.btrfs) (class in dissect.btrfs.btrfs) (class in dissect.cramfs) (class in dissect.cramfs.cramfs) (class in dissect.extfs) (class in dissect.extfs.extfs) (class in dissect.ffs.ffs) (class in dissect.jffs.jffs2) (class in dissect.squashfs) (class in dissect.squashfs.squashfs) (class in dissect.xfs.xfs) inode (dissect.apfs.objects.FS attribute) (dissect.apfs.objects.fs.DirectoryEntry property) (dissect.apfs.objects.fs.FS attribute) (dissect.apfs.objects.fs.INode property) (dissect.apfs.objects.fs.XAttr attribute) (dissect.apfs.stream.DecmpfsStream attribute) (dissect.btrfs.btrfs.INode property) (dissect.btrfs.btrfs.Subvolume attribute) (dissect.btrfs.INode property) (dissect.btrfs.Subvolume attribute) (dissect.cramfs.BlockStream attribute) (dissect.cramfs.cramfs.BlockStream attribute) (dissect.cramfs.cramfs.INode property) (dissect.cramfs.INode property) (dissect.extfs.extfs.INode property) (dissect.extfs.extfs.XAttr attribute) (dissect.extfs.INode property) (dissect.ffs.FFS attribute) (dissect.ffs.ffs.FFS attribute) (dissect.ffs.ffs.INode property) (dissect.jffs.JFFS2 attribute) (dissect.jffs.jffs2.INode property) (dissect.jffs.jffs2.JFFS2 attribute) (dissect.qnxfs.QNX4 attribute) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx4.QNX4 attribute) (dissect.qnxfs.QNX6 attribute) (dissect.qnxfs.qnx6.INode6 property) (dissect.qnxfs.qnx6.QNX6 attribute) (dissect.squashfs.FileStream attribute) (dissect.squashfs.squashfs.FileStream attribute) (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) (dissect.xfs.xfs.INode property) INode (in module dissect.target.filesystems.qnxfs) inode() (dissect.cramfs.CramFS method) (dissect.cramfs.cramfs.CramFS method) (dissect.squashfs.SquashFS method) (dissect.squashfs.squashfs.SquashFS method) INode4 (class in dissect.qnxfs.qnx4) INode6 (class in dissect.qnxfs.qnx6) inode_allocated() (dissect.ffs.ffs.CylinderGroup method) inode_map (dissect.target.plugins.os.unix.linux.proc.ProcPlugin property) inode_number (dissect.squashfs.INode property) (dissect.squashfs.squashfs.INode property) inode_size (dissect.ffs.FFS attribute) (dissect.ffs.ffs.FFS attribute) INODE_STRUCT_MAP (in module dissect.squashfs.c_squashfs) inode_to_pids() (dissect.target.plugins.os.unix.linux.proc.ProcPlugin method) inodes (dissect.jffs.jffs2.INode property) inodes() (dissect.apfs.objects.FS method) (dissect.apfs.objects.fs.FS method) input (dissect.target.plugins.os.windows.regf.cit.SystemDataBitmaps attribute) input_field (acquire.acquire.gui.win32.Win32 attribute) input_fields (dissect.target.helpers.record.ExtendableRecordDescriptor attribute) input_touch (dissect.target.plugins.os.windows.regf.cit.SystemDataBitmaps attribute) Install (dissect.target.plugins.os.unix.packagemanager.OperationTypes attribute) install_date() (dissect.target.plugins.os.unix.bsd.darwin.ios.generic.GenericPlugin method) (dissect.target.plugins.os.unix.generic.GenericPlugin method) (dissect.target.plugins.os.unix.linux.fortios.generic.GenericPlugin method) (dissect.target.plugins.os.windows.generic.GenericPlugin method) install_paths() (dissect.target.plugins.os.windows.exchange.exchange.ExchangePlugin method) installed (dissect.target.plugins.apps.productivity.msoffice.ClickOnceDeploymentManifestParser.Assembly attribute) INSTALLER_FAILED (dissect.target.plugins.os.windows.amcache.PcaGeneralDbType attribute) installs (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin attribute) (dissect.target.plugins.apps.chat.msn.MSNPlugin attribute) (dissect.target.plugins.apps.container.docker.DockerPlugin attribute) (dissect.target.plugins.apps.container.podman.PodmanPlugin attribute) (dissect.target.plugins.child.wsl.WSLChildTargetPlugin attribute) (dissect.target.plugins.os.unix.linux.debian.snap.SnapPlugin attribute) Instance (class in dissect.cim.cim) instance (dissect.cim.utils.ObjectPath attribute) instance() (dissect.cim.cim.Class method) INSTANCE_INFO (dissect.etl.headers.event.ExtType attribute) InstanceKey (class in dissect.cim.classes) instances (dissect.cim.cim.Class property) (dissect.target.plugins.os.windows.log.mssql.MssqlPlugin attribute) Int (class in dissect.cstruct) (class in dissect.cstruct.types) (class in dissect.cstruct.types.int) INT16 (dissect.eventlog.bxml.BxmlType attribute) INT32 (dissect.eventlog.bxml.BxmlType attribute) Int32Serializer (class in dissect.target.helpers.sunrpc.serializer) INT64 (dissect.eventlog.bxml.BxmlType attribute) INT8 (dissect.eventlog.bxml.BxmlType attribute) int_or_none() (in module dissect.target.plugins.os.unix.log.journal) integrity (dissect.fve.luks.metadata.Segment attribute) integrity_check (dissect.fve.bde.information.Validation attribute) IntegrityMeta (class in dissect.apfs.objects) (class in dissect.apfs.objects.integrity_meta) IntegritySegment (class in dissect.volume.lvm.metadata) IntEnumMissing (class in dissect.target.helpers.utils) interface (dissect.target.plugins.os.unix.linux.network.DhcpLease attribute) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager property) interface() (dissect.target.plugins.os.unix.linux._os.LinuxPlugin method) InterfaceRecord (in module dissect.target.plugins.os.default.network) interfaces() (dissect.target.plugins.os.default.network.NetworkPlugin method) (dissect.target.plugins.os.unix.linux.network.DhclientLeaseParser method) (dissect.target.plugins.os.unix.linux.network.LinuxNetworkConfigParser method) (dissect.target.plugins.os.unix.linux.network.LinuxNetworkPlugin method) (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser method) (dissect.target.plugins.os.unix.linux.network.NetworkManagerLeaseParser method) (dissect.target.plugins.os.unix.linux.network.ProcConfigParser method) (dissect.target.plugins.os.unix.linux.network.SyslogConfigParser method) (dissect.target.plugins.os.unix.linux.network.SystemdNetworkConfigParser method) INTERLEAVE (dissect.target.plugins.os.windows.network.IfTypes attribute) interleave_sectors (dissect.volume.lvm.metadata.IntegritySegment attribute) internal (dissect.target.plugin.FunctionDescriptor attribute) internal() (in module dissect.target.plugin) internal_flags (dissect.apfs.objects.fs.INode property) internal_hash (dissect.volume.lvm.metadata.IntegritySegment attribute) internal_metadata (dissect.hypervisor.disk.asif.ASIF property) InternalNamespacePlugin (class in dissect.target.plugin) InternalPlugin (class in dissect.target.plugin) InternetExplorerPlugin (class in dissect.target.plugins.apps.browser.iexplore) IntFibItem (class in dissect.archive.vbk) inType (dissect.eventlog.wevt_object.TEMP_DESCRIPTOR attribute) inum (dissect.btrfs.btrfs.INode attribute) (dissect.btrfs.INode attribute) (dissect.extfs.extfs.INode attribute) (dissect.extfs.INode attribute) (dissect.ffs.ffs.INode attribute) (dissect.jffs.jffs2.DataStream attribute) (dissect.jffs.jffs2.DirEntry attribute) (dissect.jffs.jffs2.INode attribute) (dissect.qnxfs.qnx4.INode4 attribute) (dissect.qnxfs.qnx6.INode6 attribute) (dissect.xfs.xfs.INode attribute) InvalidBLFError InvalidBlock InvalidBPB, [1] InvalidBufferError, [1] InvalidContextError InvalidDatabase, [1], [2], [3] InvalidDatabaseError, [1] InvalidDirectoryError, [1] InvalidFileError, [1] InvalidFilesystemError InvalidHeader, [1] (class in dissect.etl.headers.headers) InvalidHeaderError, [1], [2], [3], [4] InvalidHeaderMagic, [1] InvalidHookIdException, [1] InvalidMarkerError, [1] InvalidOperation InvalidPageNumber, [1] InvalidPageType, [1] InvalidPortMapping InvalidQueryError InvalidRecordBlockError InvalidRecordError, [1] InvalidSelectorError InvalidSignature InvalidSignatureError, [1] InvalidSnapshot InvalidSQL, [1] InvalidSymbolTableError InvalidTaskError InvalidVirtualDisk inventories (dissect.target.plugins.apps.virtualization.vmware_workstation.VmwareWorkstationPlugin attribute) (dissect.target.plugins.child.vmware_workstation.VmwareWorkstationChildTargetPlugin attribute) INVENTORY_PATHS (in module dissect.target.plugins.apps.virtualization.vmware_workstation) IO_COMPLETION (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) io_open() (in module dissect.target.helpers.compat.path_common) IO_REPARSE_TAG (in module dissect.archive.c_wim) (in module dissect.ntfs.c_ntfs) IO_STATUS_BLOCK (class in acquire.acquire.dynamic.windows.types) IO_STATUS_BLOCK_DUMMYUNIONNAME (class in acquire.acquire.dynamic.windows.types) IOS (dissect.target.plugin.OperatingSystem attribute) IOSApplicationRecord (in module dissect.target.plugins.os.unix.bsd.darwin.ios.applications) IOSApplicationsPlugin (class in dissect.target.plugins.os.unix.bsd.darwin.ios.applications) IOSPlugin (class in dissect.target.plugins.os.unix.bsd.darwin.ios._os) IOSUserRecord (in module dissect.target.helpers.record) IP (dissect.target.plugins.os.windows.network.IfTypes attribute) ip (flow.record.fieldtypes.net.ip.ipinterface property) (flow.record.fieldtypes.net.ipinterface property) ip_interfaces (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) (dissect.target.plugins.os.unix.linux.network.ProcConfigParser.ParserContext attribute) ip_records_from_text_files() (in module flow.record.tools.geoip) IP_REGEX (in module dissect.target.helpers.regex.ipaddress) ipaddress (class in flow.record.fieldtypes.net) (class in flow.record.fieldtypes.net.ip) IPAddress (in module flow.record.fieldtypes.net) (in module flow.record.fieldtypes.net.ip) IPCOMP (dissect.target.helpers.network.IANAProtocol attribute) IPCV (dissect.target.helpers.network.IANAProtocol attribute) IPFORWARD (dissect.target.plugins.os.windows.network.IfTypes attribute) ipinterface (class in flow.record.fieldtypes.net) (class in flow.record.fieldtypes.net.ip) IPIP (dissect.target.helpers.network.IANAProtocol attribute) IPLT (dissect.target.helpers.network.IANAProtocol attribute) ipnetwork (class in flow.record.fieldtypes.net) (class in flow.record.fieldtypes.net.ip) IPNetwork (in module flow.record.fieldtypes.net) (in module flow.record.fieldtypes.net.ip) IPOVER_ATM (dissect.target.plugins.os.windows.network.IfTypes attribute) IPOVER_CDLC (dissect.target.plugins.os.windows.network.IfTypes attribute) IPOVER_CLAW (dissect.target.plugins.os.windows.network.IfTypes attribute) IPPC (dissect.target.helpers.network.IANAProtocol attribute) ips (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager property) ips() (dissect.target.loaders.profile.ProfileOSPlugin method) (dissect.target.loaders.res.ResOSPlugin method) (dissect.target.plugin.OSPlugin method) (dissect.target.plugins.os.default._os.DefaultOSPlugin method) (dissect.target.plugins.os.default.network.NetworkPlugin method) (dissect.target.plugins.os.unix.bsd._os.BsdPlugin method) (dissect.target.plugins.os.unix.bsd.citrix._os.CitrixPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin method) (dissect.target.plugins.os.unix.esxi._os.ESXiPlugin method) (dissect.target.plugins.os.unix.linux._os.LinuxPlugin method) (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin method) (dissect.target.plugins.os.unix.linux.debian.vyos._os.VyosPlugin method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSPlugin method) (dissect.target.plugins.os.windows._os.WindowsPlugin method) IPSWITCH (dissect.target.plugins.os.windows.network.IfTypes attribute) iptables() (dissect.target.plugins.os.unix.linux.iptables.IptablesSavePlugin method) IptablesSavePlugin (class in dissect.target.plugins.os.unix.linux.iptables) IptablesSaveRecord (in module dissect.target.plugins.os.unix.linux.iptables) IPTM (dissect.target.helpers.network.IANAProtocol attribute) IPV4 (dissect.target.helpers.network.IANAProtocol attribute) ipv4 (dissect.target.plugins.os.unix.linux.network.SystemdNetworkConfigParser.DhcpConfig attribute) IPV4_ADDR (in module dissect.target.helpers.regex.ipaddress) IPV4_SEG (in module dissect.target.helpers.regex.ipaddress) IPv4Record (in module flow.record.tools.geoip) IPV6 (dissect.target.helpers.network.IANAProtocol attribute) ipv6 (dissect.target.plugins.os.unix.linux.network.SystemdNetworkConfigParser.DhcpConfig attribute) IPV6_ADDR (in module dissect.target.helpers.regex.ipaddress) IPV6_FRAG (dissect.target.helpers.network.IANAProtocol attribute) IPV6_GROUPS (in module dissect.target.helpers.regex.ipaddress) IPV6_ICMP (dissect.target.helpers.network.IANAProtocol attribute) IPV6_NONXT (dissect.target.helpers.network.IANAProtocol attribute) IPV6_OPTS (dissect.target.helpers.network.IANAProtocol attribute) IPV6_ROUTE (dissect.target.helpers.network.IANAProtocol attribute) IPV6_SEG (in module dissect.target.helpers.regex.ipaddress) IPX_IN_IP (dissect.target.helpers.network.IANAProtocol attribute) IR_TIMER (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) IRTP (dissect.target.helpers.network.IANAProtocol attribute) IS088023_CSMACD (dissect.target.plugins.os.windows.network.IfTypes attribute) is_64bit (dissect.etl.ETL attribute) (dissect.etl.etl.ETL attribute) (dissect.etl.headers.headers.Header property) (dissect.etl.headers.logfile.LogfileHeader property) is_64bit() (dissect.executable.PE method) (dissect.executable.pe.PE method) (dissect.executable.pe.pe.PE method) is_archive() (dissect.fat.fat.DirectoryEntry method) (dissect.fat.fat.RootDirectory method) is_archived() (dissect.archive.vbk.FibBlockDescriptor method) is_array (dissect.eventlog.bxml.BxmlTemplateDescriptor attribute) is_bde_volume() (in module dissect.fve.bde) (in module dissect.fve.bde.bde) is_big_value (dissect.regf.regf.KeyValue property) is_binary (dissect.database.ese.table.Column property) is_black (dissect.ole.ole.DirectoryEntry property) is_block_device() (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.INode method) (dissect.btrfs.btrfs.INode method) (dissect.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.cramfs.INode method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.INode method) (dissect.squashfs.squashfs.INode method) is_block_in_blob() (dissect.archive.vbk.FibBlockDescriptor method) is_block_in_blob_reserved() (dissect.archive.vbk.FibBlockDescriptor method) is_branch (dissect.database.ese.Page property) (dissect.database.ese.page.Page property) is_btree (dissect.database.bsd.DB property) (dissect.database.bsd.db.DB property) (dissect.database.DB property) is_builtin_key (dissect.cim.classes.QualifierReference property) is_builtin_property (dissect.cim.classes.PropertyReference property) is_case_insensitive (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) is_character_device() (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.INode method) (dissect.btrfs.btrfs.INode method) (dissect.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.cramfs.INode method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.INode method) (dissect.squashfs.squashfs.INode method) is_cloud_file() (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.MftRecord method) is_compatible() (dissect.target.plugin.Plugin method) is_compound_ace (dissect.ntfs.ACE property) (dissect.ntfs.secure.ACE property) is_compressed (dissect.archive.wim.Resource property) is_compressed() (dissect.apfs.objects.fs.INode method) (dissect.archive.vbk.StgBlockDescriptor method) (in module dissect.target.loaders.tar) is_connected() (dissect.target.loaders.remote.RemoteStreamConnection method) is_data_block() (dissect.archive.vbk.StgBlockDescriptor method) is_data_reference (dissect.cim.index.Key property) is_dedup_block() (dissect.archive.vbk.StgBlockDescriptor method) is_default_value (dissect.cim.classes.ClassInstanceProperty property) is_derived (dissect.database.ese.record.TagField property) is_device() (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.INode method) (dissect.btrfs.btrfs.INode method) (dissect.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.cramfs.INode method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.INode method) (dissect.squashfs.squashfs.INode method) is_dir() (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.INode method) (dissect.archive.vbk.DirItem method) (dissect.archive.vbk.RootDirectory method) (dissect.archive.vbk.SubFolderItem method) (dissect.archive.wim.DirectoryEntry method) (dissect.btrfs.btrfs.INode method) (dissect.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.cramfs.INode method) (dissect.evidence.ad1.FileEntry method) (dissect.ffs.ffs.INode method) (dissect.jffs.jffs2.INode method) (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.MftRecord method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.INode method) (dissect.squashfs.squashfs.INode method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry method) (dissect.target.filesystems.cb.CbFilesystemEntry method) (dissect.target.filesystems.config.ConfigurationEntry method) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.exfat.ExfatFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.fat.FatFilesystemEntry method) (dissect.target.filesystems.ffs.FfsFilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemEntry method) (dissect.target.filesystems.jffs.JffsFilesystemEntry method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry method) (dissect.target.filesystems.smb.SmbFilesystemEntry method) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystemEntry method) (dissect.target.filesystems.vbk.VbkFilesystemEntry method) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystemEntry method) (dissect.vmfs.descriptor.FileDescriptor method) (dissect.vmfs.FileDescriptor method) is_direct (dissect.target.Target property) (dissect.target.target.Target property) is_directory() (dissect.fat.fat.DirectoryEntry method) (dissect.fat.fat.RootDirectory method) is_dirty (dissect.target.tools.dump.Sink attribute) is_drive_letter_path() (in module dissect.target.loaders.dir) is_dst() (dissect.target.plugins.os.windows.datetime.WindowsTimezone method) is_empty (dissect.database.ese.Page property) (dissect.database.ese.page.Page property) is_encrypted (dissect.apfs.objects.base.Object property) (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) (dissect.apfs.objects.Object property) is_encrypted() (in module dissect.target.volume) is_end (dissect.ntfs.index.IndexEntry property) (dissect.ntfs.IndexEntry property) is_enhanced_crypto() (dissect.fve.bde.information.VmkInfoDatum method) is_enhanced_pin() (dissect.fve.bde.information.VmkInfoDatum method) is_eof_record() (in module dissect.eventlog.evt) is_eow (dissect.fve.bde.bde.BitlockerStream attribute) is_ephemeral (dissect.apfs.objects.base.Object property) (dissect.apfs.objects.Object property) is_external_file() (dissect.archive.vbk.DirItem method) (dissect.archive.vbk.ExtFibItem method) is_fifo() (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.INode method) (dissect.btrfs.btrfs.INode method) (dissect.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.cramfs.INode method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.INode method) (dissect.squashfs.squashfs.INode method) is_file() (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.INode method) (dissect.archive.vbk.DirItem method) (dissect.archive.wim.DirectoryEntry method) (dissect.btrfs.btrfs.INode method) (dissect.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.cramfs.INode method) (dissect.evidence.ad1.FileEntry method) (dissect.ffs.ffs.INode method) (dissect.jffs.jffs2.INode method) (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.MftRecord method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.INode method) (dissect.squashfs.squashfs.INode method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry method) (dissect.target.filesystems.cb.CbFilesystemEntry method) (dissect.target.filesystems.config.ConfigurationEntry method) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.exfat.ExfatFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.fat.FatFilesystemEntry method) (dissect.target.filesystems.ffs.FfsFilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemEntry method) (dissect.target.filesystems.jffs.JffsFilesystemEntry method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry method) (dissect.target.filesystems.smb.SmbFilesystemEntry method) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystemEntry method) (dissect.target.filesystems.vbk.VbkFilesystemEntry method) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystemEntry method) (dissect.vmfs.descriptor.FileDescriptor method) (dissect.vmfs.FileDescriptor method) is_file_object_pointer (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) is_fixed (dissect.database.ese.table.Column property) is_forwarder (dissect.volume.vss.BlockDescriptor attribute) is_gzipped (dissect.target.containers.fortifw.FortiFirmwareFile attribute) is_hash (dissect.database.bsd.DB property) (dissect.database.bsd.db.DB property) (dissect.database.DB property) is_header_record() (in module dissect.eventlog.evt) is_hidden() (dissect.fat.fat.DirectoryEntry method) (dissect.fat.fat.RootDirectory method) is_hyperv_xml() (in module dissect.target.loaders.hyperv) is_index (dissect.database.ese.Page property) (dissect.database.ese.page.Page property) is_inherited (dissect.cim.c_cim.ClassDefinitionPropertyState attribute) (dissect.cim.cim.Property property) (dissect.cim.classes.ClassInstanceProperty property) is_initialized (dissect.cim.c_cim.ClassInstancePropertyState attribute) (dissect.cim.classes.ClassInstanceProperty property) is_internal (dissect.volume.dm.btree.Node property) is_internal_file() (dissect.archive.vbk.DirItem method) (dissect.archive.vbk.IntFibItem method) is_ipc() (dissect.btrfs.btrfs.INode method) (dissect.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.cramfs.INode method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.INode method) (dissect.squashfs.squashfs.INode method) is_iso_fmt() (in module dissect.target.plugins.os.unix.log.helpers) is_junction() (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) is_leaf (dissect.apfs.objects.btree_node.BTreeNode property) (dissect.apfs.objects.BTreeNode property) (dissect.database.ese.Page property) (dissect.database.ese.page.Page property) (dissect.util.compression.lzxpress_huffman.Node attribute) (dissect.volume.dm.btree.Node property) is_legacy() (dissect.archive.vbk.StgBlockDescriptor method) is_local (dissect.vmfs.VMFS property) (dissect.vmfs.vmfs.VMFS property) is_long_value (dissect.database.ese.Page property) (dissect.database.ese.page.Page property) is_luks_volume() (in module dissect.fve.luks) (in module dissect.fve.luks.luks) is_lvm_volume() (in module dissect.target.volume) is_mapped (dissect.cim.mappings.MappingEntry property) is_metadata (dissect.archive.wim.Resource property) is_minifat (dissect.ole.ole.DirectoryEntry property) is_mount (dissect.target.helpers.compat.path_313.TargetPath attribute) is_mount() (dissect.target.helpers.compat.path_311.TargetPath method) is_mount_point() (dissect.archive.wim.DirectoryEntry method) (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.MftRecord method) is_multi_volume_filesystem() (in module dissect.target.filesystem) is_nested() (dissect.util.ldap.SearchFilter method) is_node (dissect.ntfs.index.IndexEntry property) (dissect.ntfs.IndexEntry property) is_nonleaf (dissect.apfs.objects.btree_node.BTreeNode property) (dissect.apfs.objects.BTreeNode property) is_normal() (dissect.archive.vbk.FibBlockDescriptor method) is_normalization_insensitive (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) is_nt() (dissect.executable.PE method) (dissect.executable.pe.PE method) (dissect.executable.pe.pe.PE method) is_null (dissect.database.ese.record.TagField property) is_number() (dissect.cstruct.Expression method) (dissect.cstruct.expression.Expression method) is_object_ace (dissect.ntfs.ACE property) (dissect.ntfs.secure.ACE property) is_onekey (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) is_os2() (dissect.executable.PE method) (dissect.executable.pe.PE method) (dissect.executable.pe.pe.PE method) is_overlay (dissect.volume.vss.BlockDescriptor attribute) is_parent (dissect.database.ese.Page property) (dissect.database.ese.page.Page property) is_pe() (dissect.executable.PE method) (dissect.executable.pe.PE method) (dissect.executable.pe.pe.PE method) is_pem() (in module dissect.target.plugins.apps.ssh.ssh) is_physical (dissect.apfs.objects.base.Object property) (dissect.apfs.objects.Object property) is_pkcs8() (in module dissect.target.plugins.apps.ssh.ssh) is_pre_xp (dissect.target.plugins.os.windows.regf.shellbags.FILE_ENTRY attribute) is_primary (dissect.database.ese.Index property) (dissect.database.ese.index.Index property) is_qnxfs() (in module dissect.qnxfs) (in module dissect.qnxfs.qnxfs) is_rdm() (dissect.vmfs.descriptor.FileDescriptor method) (dissect.vmfs.FileDescriptor method) is_readonly() (dissect.fat.fat.DirectoryEntry method) (dissect.fat.fat.RootDirectory method) is_recno (dissect.database.bsd.DB property) (dissect.database.bsd.db.DB property) (dissect.database.DB property) is_red (dissect.ole.ole.DirectoryEntry property) is_related() (dissect.executable.elf.elf.Section method) (dissect.executable.elf.elf.Segment method) (dissect.executable.elf.Section method) (dissect.executable.elf.Segment method) is_remnant (dissect.target.plugins.os.windows.rdpcache.BitmapTile attribute) is_reparse_point() (dissect.archive.wim.DirectoryEntry method) (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.MftRecord method) is_reproducible() (dissect.executable.PE method) (dissect.executable.pe.PE method) (dissect.executable.pe.pe.PE method) is_reserved() (dissect.archive.vbk.FibBlockDescriptor method) (dissect.target.helpers.compat.path_312.PureDissectPath method) is_rfc4716() (in module dissect.target.plugins.apps.ssh.ssh) is_root (dissect.apfs.objects.btree_node.BTreeNode property) (dissect.apfs.objects.BTreeNode property) (dissect.database.ese.Page property) (dissect.database.ese.page.Page property) is_root() (dissect.target.helpers.configutil.ScopeManager method) is_saved (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadTab attribute) is_sealed (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) is_set() (dissect.volume.vss.StoreBitmap method) is_small_page (dissect.database.ese.Page property) (dissect.database.ese.page.Page property) is_socket() (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.INode method) (dissect.btrfs.btrfs.INode method) (dissect.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.cramfs.INode method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.INode method) (dissect.squashfs.squashfs.INode method) is_space_tree (dissect.database.ese.Page property) (dissect.database.ese.page.Page property) is_spanned (dissect.archive.wim.Resource property) is_sparse() (dissect.archive.vbk.FibBlockDescriptor method) is_standard_ace (dissect.ntfs.ACE property) (dissect.ntfs.secure.ACE property) is_stdout (flow.record.adapter.split.SplitWriter attribute) is_stdout() (in module flow.record.utils) is_storage (dissect.ole.ole.DirectoryEntry property) is_stream (dissect.ole.ole.DirectoryEntry property) is_symlink() (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.INode method) (dissect.archive.wim.DirectoryEntry method) (dissect.btrfs.btrfs.INode method) (dissect.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.cramfs.INode method) (dissect.ffs.ffs.INode method) (dissect.jffs.jffs2.INode method) (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.MftRecord method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.INode method) (dissect.squashfs.squashfs.INode method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry method) (dissect.target.filesystems.cb.CbFilesystemEntry method) (dissect.target.filesystems.config.ConfigurationEntry method) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.exfat.ExfatFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.fat.FatFilesystemEntry method) (dissect.target.filesystems.ffs.FfsFilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemEntry method) (dissect.target.filesystems.jffs.JffsFilesystemEntry method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry method) (dissect.target.filesystems.smb.SmbFilesystemEntry method) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystemEntry method) (dissect.target.filesystems.vbk.VbkFilesystemEntry method) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystemEntry method) (dissect.vmfs.descriptor.FileDescriptor method) (dissect.vmfs.FileDescriptor method) is_system() (dissect.fat.fat.DirectoryEntry method) (dissect.fat.fat.RootDirectory method) (dissect.vmfs.descriptor.FileDescriptor method) (dissect.vmfs.FileDescriptor method) is_tagged (dissect.database.ese.table.Column property) is_tar_magic() (in module dissect.target.loaders.tar) is_tarfile (in module dissect.hypervisor.util.vmtar) is_text (dissect.database.ese.table.Column property) is_unencrypted (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) is_used (dissect.volume.vss.BlockDescriptor attribute) is_user_admin() (in module acquire.acquire.utils) is_v7() (dissect.archive.vbk.VBK method) is_valid (dissect.ole.ole.DirectoryEntry property) is_valid() (dissect.apfs.objects.base.Object method) (dissect.apfs.objects.Object method) (dissect.apfs.objects.ObjectMap method) (dissect.apfs.objects.omap.ObjectMap method) (dissect.fve.bde.eow.EowBitmap method) (dissect.fve.bde.eow.EowBitmapRecord method) (dissect.fve.bde.eow.EowInformation method) (dissect.fve.bde.information.Information method) (dissect.vmfs.lvm.Volume method) (dissect.vmfs.Volume method) is_valid_field_name() (in module flow.record.base) is_valid_kape_dir() (in module dissect.target.loaders.kape) is_valid_kape_file() (in module dissect.target.loaders.kape) is_valid_yara() (in module dissect.target.plugins.filesystem.yara) is_variable (dissect.database.ese.table.Column property) is_virtual (dissect.apfs.objects.base.Object property) (dissect.apfs.objects.Object property) is_visible (dissect.volume.lvm.metadata.LogicalVolume property) is_visor (dissect.hypervisor.util.vmtar.VisorTarInfo attribute) is_vmfs5 (dissect.vmfs.VMFS property) (dissect.vmfs.vmfs.VMFS property) is_vmfs6 (dissect.vmfs.VMFS property) (dissect.vmfs.vmfs.VMFS property) is_volume_id() (dissect.fat.fat.DirectoryEntry method) (dissect.fat.fat.RootDirectory method) is_whiteout() (dissect.apfs.objects.fs.DirectoryEntry method) (dissect.apfs.objects.fs.INode method) is_wildcard (dissect.target.helpers.keychain.Key attribute) is_xp_mapping() (in module dissect.cim.utils) isabs() (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.polypath) IsADirectoryError, [1], [2], [3], [4], [5], [6], [7], [8], [9], [10], [11], [12], [13] ISDN (dissect.target.plugins.os.windows.network.IfTypes attribute) ISDN_S (dissect.target.plugins.os.windows.network.IfTypes attribute) ISDN_U (dissect.target.plugins.os.windows.network.IfTypes attribute) ISIS_OVER_IPV4 (dissect.target.helpers.network.IANAProtocol attribute) isjunction() (in module dissect.target.helpers.compat.path_common) ISO88022_LLC (dissect.target.plugins.os.windows.network.IfTypes attribute) ISO88024_TOKENBUS (dissect.target.plugins.os.windows.network.IfTypes attribute) ISO88025_CRFPRINT (dissect.target.plugins.os.windows.network.IfTypes attribute) ISO88025_FIBER (dissect.target.plugins.os.windows.network.IfTypes attribute) ISO88025_TOKENRING (dissect.target.plugins.os.windows.network.IfTypes attribute) ISO88025R_DTR (dissect.target.plugins.os.windows.network.IfTypes attribute) ISO88026_MAN (dissect.target.plugins.os.windows.network.IfTypes attribute) ISO_8601_PATTERN (in module dissect.target.plugins.apps.edr.velociraptor) ISO_IP (dissect.target.helpers.network.IANAProtocol attribute) iso_readlines() (in module dissect.target.plugins.os.unix.log.helpers) ISO_TP4 (dissect.target.helpers.network.IANAProtocol attribute) isreserved() (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.polypath) issocket() (dissect.util.cpio.CpioInfo method) ISUP (dissect.target.plugins.os.windows.network.IfTypes attribute) item (dissect.target.plugins.os.windows.regf.shellbags.SHITEM attribute) item() (dissect.apfs.cursor.Cursor method) (dissect.btrfs.tree.Cursor method) ITEMIDLIST (class in acquire.acquire.gui.win32) items (dissect.executable.elf.elf.Table attribute) items() (acquire.acquire.uploaders.plugin_registry.PluginRegistry method) (dissect.btrfs.tree.Cursor method) (dissect.hypervisor.descriptor.hyperv.HyperVFile method) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry method) (dissect.target.helpers.configutil.ConfigurationParser method) iter() (dissect.btrfs.tree.Cursor method) iter_bitmap() (dissect.target.plugins.os.windows.regf.cit.CIT method) iter_esxi_filesystems() (in module acquire.acquire.acquire) iter_fileobj() (in module dissect.evidence.tools.asdf.verify) iter_inodes() (dissect.ffs.FFS method) (dissect.ffs.ffs.FFS method) (dissect.squashfs.SquashFS method) (dissect.squashfs.squashfs.SquashFS method) iter_leaf_nodes() (dissect.database.ese.Page method) (dissect.database.ese.page.Page method) iter_nt() (dissect.target.plugins.os.windows.regf.shimcache.ShimCache method) iter_ntfs_filesystems() (in module acquire.acquire.acquire) iter_proc() (dissect.target.plugins.os.unix.linux.proc.ProcPlugin method) iter_records() (in module dissect.target.plugins.filesystem.ntfs.mft) iter_subfs() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystems.btrfs.BtrfsFilesystem method) iter_timestamped_records() (in module flow.record) (in module flow.record.base) iter_vms() (in module dissect.target.plugins.child.parallels) iter_win_8_plus() (dissect.target.plugins.os.windows.regf.shimcache.ShimCache method) iterations (dissect.fve.luks.metadata.Digest attribute) (dissect.fve.luks.metadata.KeyslotKdf attribute) iterdir() (dissect.apfs.objects.fs.INode method) (dissect.archive.vbk.DirItem method) (dissect.archive.vbk.RootDirectory method) (dissect.archive.vbk.SubFolderItem method) (dissect.archive.wim.DirectoryEntry method) (dissect.btrfs.btrfs.INode method) (dissect.btrfs.INode method) (dissect.cramfs.cramfs.INode method) (dissect.cramfs.INode method) (dissect.executable.pe.directory.resource.ResourceDirectoryEntry method) (dissect.executable.pe.directory.ResourceDirectoryEntry method) (dissect.extfs.extfs.INode method) (dissect.extfs.INode method) (dissect.fat.fat.DirectoryEntry method) (dissect.fat.fat.RootDirectory method) (dissect.ffs.ffs.INode method) (dissect.jffs.jffs2.INode method) (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.MftRecord method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.squashfs.INode method) (dissect.squashfs.squashfs.INode method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry method) (dissect.target.filesystems.cb.CbFilesystemEntry method) (dissect.target.filesystems.config.ConfigurationEntry method) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.exfat.ExfatFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.fat.FatFilesystemEntry method) (dissect.target.filesystems.ffs.FfsFilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemEntry method) (dissect.target.filesystems.jffs.JffsFilesystemEntry method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry method) (dissect.target.filesystems.smb.SmbFilesystemEntry method) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystemEntry method) (dissect.target.filesystems.vbk.VbkFilesystemEntry method) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystemEntry method) (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) (dissect.vmfs.descriptor.FileDescriptor method) (dissect.vmfs.FileDescriptor method) (dissect.xfs.xfs.INode method) iterfileobj() (in module dissect.evidence.tools.asdf.meta) iterhives() (dissect.target.helpers.regutil.HiveCollection method) (dissect.target.plugins.os.windows.registry.RegistryPlugin method) ITunesBackup (class in dissect.target.loaders.itunes) ITunesFilesystem (class in dissect.target.filesystems.itunes) ITunesFilesystemDirectoryEntry (class in dissect.target.filesystems.itunes) ITunesFilesystemEntry (class in dissect.target.filesystems.itunes) ITunesLoader (class in dissect.target.loaders.itunes) IV (class in dissect.fve.crypto.base) iv (dissect.fve.bde.information.AesCbc256HmacSha512EncryptedDatum property) (dissect.hypervisor.util.envelope.Envelope attribute) iv_length (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm attribute) iv_mode (dissect.fve.crypto.base.Cipher attribute) (dissect.fve.crypto.Cipher attribute) IV_MODE_MAP (in module dissect.fve.crypto) iv_sector_size (dissect.fve.crypto.base.Cipher attribute) (dissect.fve.crypto.Cipher attribute) iv_size (dissect.fve.crypto.base.IV attribute) iv_tweak (dissect.fve.crypto.dmcrypt.CryptStream attribute) (dissect.fve.luks.metadata.Segment attribute) J JAMO_SPECIAL (dissect.database.ese.lcmapstring.SCRIPT attribute) JB (dissect.vmfs.resource.ResourceManager property) JDB2 (class in dissect.extfs) (class in dissect.extfs.journal) jdb2 (dissect.extfs.journal.CommitBlock attribute) (dissect.extfs.journal.DescriptorBlock attribute) jdb2_def (in module dissect.extfs.c_jdb2) JET_bitIndex (in module dissect.database.ese.c_ese) JET_cbKeyMost_OLD (in module dissect.database.ese.index) JET_coltyp (in module dissect.database.ese.c_ese) JFFS2 (class in dissect.jffs) (class in dissect.jffs.jffs2) jffs2 (dissect.target.filesystems.jffs.JffsFilesystem attribute) jffs2_def (in module dissect.jffs.c_jffs2) JFFS2_MAGIC_NUMBERS (in module dissect.jffs.c_jffs2) JffsFilesystem (class in dissect.target.filesystems.jffs) JffsFilesystemEntry (class in dissect.target.filesystems.jffs) JOB (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) job (dissect.target.plugins.os.windows.log.schedlgu.SchedLgU attribute) JOB_REGEX_PATTERN (in module dissect.target.plugins.os.windows.log.schedlgu) JobGuid (in module dissect.etl.utils) join() (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.polypath) journal (dissect.extfs.ExtFS property) (dissect.extfs.extfs.ExtFS property) journal() (dissect.target.plugins.os.unix.log.journal.JournalPlugin method) journal_block (dissect.extfs.journal.CommitBlock attribute) (dissect.extfs.journal.DescriptorBlock attribute) (dissect.extfs.journal.DescriptorBlockTag attribute) journal_def (in module dissect.target.plugins.os.unix.log.journal) journal_encryption (dissect.fve.luks.metadata.SegmentIntegrity attribute) journal_files (dissect.target.plugins.os.unix.log.journal.JournalPlugin attribute) JOURNAL_GLOB (dissect.target.plugins.os.unix.log.journal.JournalPlugin attribute) journal_integrity (dissect.fve.luks.metadata.SegmentIntegrity attribute) JOURNAL_PATHS (dissect.target.plugins.os.unix.log.journal.JournalPlugin attribute) journal_sectors (dissect.volume.lvm.metadata.IntegritySegment attribute) journal_watermark (dissect.volume.lvm.metadata.IntegritySegment attribute) JournalBlockAddr (class in dissect.vmfs.address) JournalBlockResourceVMFS6 (class in dissect.vmfs.resource) JournalFile (class in dissect.target.plugins.os.unix.log.journal) JournalMessagePriority (class in dissect.target.plugins.os.unix.log.journal) JournalPlugin (class in dissect.target.plugins.os.unix.log.journal) JournalRecord (in module dissect.target.plugins.os.unix.log.journal) Json (class in dissect.target.helpers.configutil) JSON (flow.record.adapter.splunk.SourceType attribute) json_converter (flow.record.adapter.splunk.SplunkWriter attribute) json_packer (flow.record.adapter.elastic.ElasticWriter attribute) json_size (dissect.fve.luks.metadata.Config attribute) JsonfileReader (class in flow.record.adapter.jsonfile) JsonfileWriter (class in flow.record.adapter.jsonfile) JsonItem (class in dissect.fve.luks.metadata) JSONLINES (dissect.target.tools.dump.Serialization attribute) JsonLinesWriter (class in dissect.target.tools.dump) JsonRecordPacker (class in flow.record) (class in flow.record.jsonpacker) JUMPLIST_FOOTER (in module dissect.shellitem.lnk.c_lnk) JUMPLIST_HEADER_SIZE (in module dissect.shellitem.lnk.c_lnk) JumpListFile (class in dissect.target.plugins.os.windows.jumplist) JumpListPlugin (class in dissect.target.plugins.os.windows.jumplist) JumpListRecord (in module dissect.target.plugins.os.windows.jumplist) K K (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) k (dissect.util.compression.lzfse.DecoderEntry attribute) KANA (dissect.database.ese.lcmapstring.SCRIPT attribute) KapeLoader (class in dissect.target.loaders.kape) KATAKANA (dissect.database.ese.lcmapstring.CASE attribute) kdf (dissect.fve.luks.metadata.Keyslot attribute) KEK (class in dissect.apfs.objects.keybag) kek (dissect.target.loaders.itunes.ITunesBackup attribute) KEKBlob (class in dissect.apfs.objects.keybag) keks() (dissect.apfs.objects.keybag.VolumeKeybag method) kernel32 (in module acquire.acquire.dynamic.windows.handles) (in module acquire.acquire.gui.win32) KEY (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) Key (class in dissect.cim.index) (class in dissect.target.helpers.keychain) key (dissect.apfs.objects.fs.XAttr attribute) (dissect.cim.cim.Instance property) (dissect.cim.classes.ClassInstance property) (dissect.cim.classes.QualifierReference property) (dissect.cim.index.IndexPage attribute) (dissect.cim.index.Key attribute) (dissect.database.ese.page.Node attribute) (dissect.database.sqlite3.sqlite3.Cell attribute) (dissect.fve.crypto.base.Cipher attribute) (dissect.fve.crypto.Cipher attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.hypervisor.util.envelope.KeyStore property) (dissect.ntfs.index.IndexEntry property) (dissect.ntfs.IndexEntry property) (dissect.target.helpers.regutil.RegfKey attribute) (dissect.target.loaders.itunes.ClassKey attribute) KEY (dissect.target.plugins.apps.productivity.sevenzip.SevenZipPlugin attribute) key (dissect.target.plugins.os.windows.dpapi.master_key.MasterKey attribute) (dissect.target.plugins.os.windows.dpapi.master_key.MasterKeyFile property) KEY (dissect.target.plugins.os.windows.productkey.WindowsProductKeyPlugin attribute) (dissect.target.plugins.os.windows.regf.auditpol.AuditpolPlugin attribute) (dissect.target.plugins.os.windows.regf.cit.CITPlugin attribute) (dissect.target.plugins.os.windows.regf.nethist.NethistPlugin attribute) (dissect.target.plugins.os.windows.regf.trusteddocs.TrustedDocumentsPlugin attribute) (dissect.target.plugins.os.windows.regf.userassist.UserAssistPlugin attribute) key (dissect.target.plugins.os.windows.registry.RegistryPlugin attribute) KEY (dissect.target.plugins.os.windows.services.ServicesPlugin attribute) key (dissect.volume.dm.btree.Node attribute) (flow.record.adapter.mongo.MongoWriter attribute) KEY (in module dissect.regf.c_regf) key() (dissect.apfs.cursor.Cursor method) (dissect.cim.CIM method) (dissect.cim.cim.CIM method) (dissect.target.helpers.regutil.HiveCollection method) (dissect.target.helpers.regutil.RegfHive method) (dissect.target.helpers.regutil.RegistryHive method) (dissect.target.helpers.regutil.VirtualHive method) (dissect.target.loaders.cb.CbRegistryHive method) (dissect.target.loaders.smb.SmbRegistryHive method) key_bag (dissect.target.loaders.itunes.ITunesBackup attribute) key_file (acquire.acquire.tools.decrypter.EncryptedFile attribute) key_fingerprint() (in module acquire.acquire.crypt) key_flags (dissect.fve.bde.information.KeyDatum property) (dissect.fve.bde.information.StretchKeyDatum property) (dissect.fve.bde.information.UseKeyDatum property) key_from_record() (dissect.database.ese.Index method) (dissect.database.ese.index.Index method) key_hash (dissect.hypervisor.util.envelope.Envelope attribute) (dissect.target.plugins.os.windows.dpapi.master_key.MasterKey attribute) key_info (dissect.hypervisor.util.envelope.Envelope attribute) key_iv_for_kernel_hash() (in module dissect.target.plugins.os.unix.linux.fortios._os) key_len (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) key_length (dissect.ntfs.index.IndexEntry property) (dissect.ntfs.IndexEntry property) (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm attribute) key_prefix (dissect.database.ese.Page property) (dissect.database.ese.page.Node attribute) (dissect.database.ese.page.Page property) key_reference (dissect.cim.classes.QualifierReference attribute) key_server (acquire.acquire.tools.decrypter.EncryptedFile attribute) key_size (dissect.fve.crypto.base.Cipher attribute) (dissect.fve.crypto.Cipher attribute) (dissect.fve.luks.metadata.Keyslot attribute) (dissect.fve.luks.metadata.KeyslotArea attribute) key_size_bytes (dissect.fve.crypto.base.Cipher attribute) (dissect.fve.crypto.Cipher attribute) key_suffix (dissect.database.ese.page.Node attribute) key_tables (dissect.hypervisor.descriptor.hyperv.HyperVFile attribute) key_type (dissect.fve.bde.information.KeyDatum property) (dissect.fve.bde.information.StretchKeyDatum property) (dissect.fve.bde.information.UseKeyDatum property) (dissect.target.helpers.keychain.Key attribute) (dissect.target.loaders.itunes.ClassKey attribute) (dissect.target.plugins.apps.ssh.ssh.SSHPrivateKey attribute) Keybag (class in dissect.apfs.objects.keybag) KeyBag (class in dissect.target.loaders.itunes) keybag (dissect.apfs.APFS property) (dissect.apfs.apfs.APFS property) (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) keyboard() (dissect.target.plugins.os.default.locale.LocalePlugin method) (dissect.target.plugins.os.unix.locale.UnixLocalePlugin method) (dissect.target.plugins.os.windows.locale.WindowsLocalePlugin method) Keychain (class in dissect.target.loaders.cellebrite) keychain (dissect.target.plugins.apps.browser.browser.BrowserPlugin attribute) (dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin attribute) KEYCHAIN (in module dissect.target.helpers.keychain) keychain_passwords() (in module dissect.target.plugins.os.windows.credential.credhist) KeychainKeyProviderPlugin (class in dissect.target.plugins.os.windows.dpapi.keyprovider.keychain) KeyCollection (class in dissect.target.helpers.regutil) KeyDataFlag (in module dissect.hypervisor.descriptor.c_hyperv) KeyDataType (in module dissect.hypervisor.descriptor.c_hyperv) KeyDatum (class in dissect.fve.bde.information) KEYED_EVENT (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) KeyIndex (class in dissect.regf.regf) keylocker (dissect.apfs.objects.nx_superblock.NxSuperblock property) (dissect.apfs.objects.NxSuperblock property) KeyNode (class in dissect.regf.regf) KeyNotFoundError, [1] KeyProviderPlugin (class in dissect.target.plugins.os.windows.dpapi.keyprovider.keyprovider) keys (dissect.cim.classes.ClassDefinition property) (dissect.target.helpers.regutil.KeyCollection attribute) (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin attribute) (dissect.target.plugins.os.windows.regf.applications.WindowsApplicationsPlugin attribute) KEYS (dissect.target.plugins.os.windows.regf.bam.BamDamPlugin attribute) (dissect.target.plugins.os.windows.regf.clsid.CLSIDPlugin attribute) (dissect.target.plugins.os.windows.regf.muicache.MuiCachePlugin attribute) (dissect.target.plugins.os.windows.regf.runkeys.RunKeysPlugin attribute) (dissect.target.plugins.os.windows.regf.shellbags.ShellBagsPlugin attribute) (dissect.target.plugins.os.windows.regf.shimcache.ShimcachePlugin attribute) keys (dissect.target.volume.EncryptedVolumeSystem attribute) keys() (dissect.cim.index.IndexPage method) (dissect.hypervisor.descriptor.hyperv.HyperVFile method) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry method) (dissect.target.helpers.configutil.ConfigurationParser method) (dissect.target.helpers.regutil.HiveCollection method) (dissect.target.helpers.regutil.RegistryHive method) (dissect.target.plugins.os.windows.dpapi.keyprovider.credhist.CredHistKeyProviderPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.lsa.LSADefaultPasswordKeyProviderPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.winlogon.WinlogonDefaultPasswordKeyProviderPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.empty.EmptyKeyProviderPlugin method) (dissect.target.plugins.os.windows.dpapi.keyprovider.keychain.KeychainKeyProviderPlugin method) (dissect.target.plugins.os.windows.registry.RegistryPlugin method) (dissect.util.plist.NSObject method) KeySafe (class in dissect.hypervisor.descriptor.vmx) KeySecurity (class in dissect.regf.regf) keyset_id (dissect.archive.vbk.FibBlockDescriptorV7 property) (dissect.archive.vbk.StgBlockDescriptorV7 property) Keyslot (class in dissect.fve.luks.metadata) KeyslotAf (class in dissect.fve.luks.metadata) KeyslotArea (class in dissect.fve.luks.metadata) KeyslotKdf (class in dissect.fve.luks.metadata) keyslots (dissect.fve.luks.LUKS property) (dissect.fve.luks.luks.LUKS property) (dissect.fve.luks.metadata.Digest attribute) (dissect.fve.luks.metadata.Metadata attribute) (dissect.fve.luks.metadata.Token attribute) keyslots_size (dissect.fve.luks.metadata.Config attribute) KeyStore (class in dissect.hypervisor.util.envelope) KeyType (class in dissect.target.helpers.keychain) (in module dissect.target.helpers.regutil) KeyValue (class in dissect.regf.regf) KeyValueCollection (class in dissect.eventlog.utils) KEYW (class in dissect.eventlog.wevt_object) keywords (dissect.etl.headers.event.EventDescriptor attribute) KNOWN_FILES (in module dissect.target.helpers.configutil) KNOWN_FOLDER_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) known_hosts() (dissect.target.plugins.apps.ssh.openssh.OpenSSHPlugin method) (dissect.target.plugins.apps.ssh.putty.PuTTYPlugin method) KNOWN_SKIP_TYPES (in module dissect.target.volumes.lvm) KnownDllRecord (in module dissect.target.plugins.os.windows.generic) knowndlls() (dissect.target.plugins.os.windows.generic.GenericPlugin method) KnownHostRecord (in module dissect.target.plugins.apps.ssh.ssh) KRYPTOLAN (dissect.target.helpers.network.IANAProtocol attribute) kv (dissect.target.helpers.regutil.RegfValue attribute) kwargs (flow.record.adapter.split.SplitWriter attribute) L l1_table (dissect.hypervisor.disk.qcow2.QCow2 property) (dissect.hypervisor.disk.qcow2.QCow2Snapshot property) (dissect.hypervisor.disk.qcow2.QCow2Stream attribute) l2_bits (dissect.hypervisor.disk.qcow2.QCow2 attribute) l2_size (dissect.hypervisor.disk.qcow2.QCow2 attribute) l2_table (dissect.hypervisor.disk.qcow2.QCow2 attribute) L2_VLAN (dissect.target.plugins.os.windows.network.IfTypes attribute) L2Table (class in dissect.hypervisor.disk.qcow2) L2TP (dissect.target.helpers.network.IANAProtocol attribute) L3_IPVLAN (dissect.target.plugins.os.windows.network.IfTypes attribute) L3_IPXVLAN (dissect.target.plugins.os.windows.network.IfTypes attribute) l_freq (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) l_state (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) label (acquire.acquire.gui.win32.Win32 attribute) (dissect.btrfs.Btrfs attribute) (dissect.btrfs.btrfs.Btrfs attribute) (dissect.fve.luks.LUKS attribute) (dissect.fve.luks.luks.LUKS attribute) (dissect.vmfs.VMFS attribute) (dissect.vmfs.vmfs.VMFS attribute) label() (dissect.fve.bde.information.ExternalInfoDatum method) (dissect.fve.bde.information.VmkInfoDatum method) LABEL_SCAN_SECTORS (in module dissect.volume.lvm.c_lvm2) LANG_DICT (dissect.target.plugins.os.windows.locale.WindowsLocalePlugin attribute) language() (dissect.target.plugins.os.default.locale.LocalePlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios.locale.LocalePlugin method) (dissect.target.plugins.os.unix.linux.fortios.locale.FortiOSLocalePlugin method) (dissect.target.plugins.os.unix.locale.UnixLocalePlugin method) (dissect.target.plugins.os.windows.locale.WindowsLocalePlugin method) languages() (dissect.executable.pe.directory.resource.Resource method) LAP_B (dissect.target.plugins.os.windows.network.IfTypes attribute) LAP_D (dissect.target.plugins.os.windows.network.IfTypes attribute) LAP_F (dissect.target.plugins.os.windows.network.IfTypes attribute) LargeFileBlockAddr (class in dissect.vmfs.address) LargeFileBlockResourceVMFS6 (class in dissect.vmfs.resource) LARP (dissect.target.helpers.network.IANAProtocol attribute) last() (dissect.apfs.cursor.Cursor method) (dissect.btrfs.tree.Cursor method) last_access_time (dissect.archive.wim.DirectoryEntry property) (dissect.ntfs.attr.FileName property) (dissect.ntfs.attr.StandardInformation property) (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntryResource attribute) last_access_time_ns (dissect.archive.wim.DirectoryEntry property) (dissect.ntfs.attr.FileName property) (dissect.ntfs.attr.StandardInformation property) last_accessed (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK_BEEF0004 attribute) LAST_ACK (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) last_block (dissect.extfs.ExtFS attribute) (dissect.extfs.extfs.ExtFS attribute) last_change_time (dissect.ntfs.attr.FileName property) (dissect.ntfs.attr.StandardInformation property) last_change_time_ns (dissect.ntfs.attr.FileName property) (dissect.ntfs.attr.StandardInformation property) last_connected (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) last_far_set_size (dissect.volume.raid.stream.RAID10Stream attribute) last_far_set_start (dissect.volume.raid.stream.RAID10Stream attribute) last_modification_time (dissect.ntfs.attr.FileName property) (dissect.ntfs.attr.StandardInformation property) last_modification_time_ns (dissect.ntfs.attr.FileName property) (dissect.ntfs.attr.StandardInformation property) last_modified (dissect.thumbcache.index.IndexEntry property) (dissect.thumbcache.IndexEntry property) last_mount (dissect.extfs.ExtFS attribute) (dissect.extfs.extfs.ExtFS attribute) last_update_time (dissect.target.tools.dump.DumpState attribute) last_write_time (dissect.archive.wim.DirectoryEntry property) (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntryResource attribute) last_write_time_ns (dissect.archive.wim.DirectoryEntry property) LastEmptyDirectoryError, [1] lastlog() (dissect.target.plugins.os.unix.log.lastlog.LastLogPlugin method) lastlog_def (in module dissect.target.plugins.os.unix.log.lastlog) LastLogFile (class in dissect.target.plugins.os.unix.log.lastlog) lastlogin() (dissect.target.plugins.apps.webhosting.cpanel.CPanelPlugin method) LastLogPlugin (class in dissect.target.plugins.os.unix.log.lastlog) LastLogRecord (in module dissect.target.plugins.os.unix.log.lastlog) lastvisited() (dissect.target.plugins.os.windows.regf.mru.MRUPlugin method) LastVisitedMRURecord (in module dissect.target.plugins.os.windows.regf.mru) latest_timestamp (dissect.target.plugins.os.windows.prefetch.Prefetch property) LATIN (dissect.database.ese.lcmapstring.SCRIPT attribute) lattr() (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.MappedFile method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) LayerFilesystem (class in dissect.target.filesystem) LayerFilesystemEntry (class in dissect.target.filesystem) layers (dissect.target.filesystem.LayerFilesystem attribute) (dissect.target.loaders.containerimage.ContainerImageTarSubLoader attribute) Layout (class in dissect.volume.raid.stream) layout (dissect.volume.md.md.MDPhysicalDisk attribute) (dissect.volume.md.MDPhysicalDisk attribute) (dissect.volume.raid.raid.VirtualDisk attribute) LazyAttr (class in dissect.target.helpers.lazy) LazyImport (class in dissect.target.helpers.lazy) lchmod() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) LCID_TO_TAG (in module dissect.executable.pe.locale_id) LCMAP_BYTEREV (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_FULLWIDTH (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_HALFWIDTH (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_HASH (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_HIRAGANA (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_KATAKANA (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_LINGUISTIC_CASING (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_LOWERCASE (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_SIMPLIFIED_CHINESE (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_SORTHANDLE (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_SORTKEY (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_TITLECASE (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_TRADITIONAL_CHINESE (dissect.database.ese.lcmapstring.MapFlags attribute) LCMAP_UPPERCASE (dissect.database.ese.lcmapstring.MapFlags attribute) LCS_WINDOWS_COLOR_SPACE (in module dissect.target.plugins.os.windows.rdpcache) ldirents (dissect.fat.fat.DirectoryEntry attribute) ldm_def (in module dissect.volume.ldm) LE (dissect.util.ldap.ComparisonOperator attribute) LEAF_1 (dissect.target.helpers.network.IANAProtocol attribute) LEAF_2 (dissect.target.helpers.network.IANAProtocol attribute) LeafNode (class in dissect.database.ese.page) LEASERS (in module dissect.target.plugins.os.unix.linux.network) Leases (class in dissect.target.helpers.configutil) LEB128 (class in dissect.cstruct) (class in dissect.cstruct.types) (class in dissect.cstruct.types.leb128) LEFT_ASYMMETRIC (dissect.volume.raid.stream.Layout attribute) LEFT_ASYMMETRIC_6 (dissect.volume.raid.stream.Layout attribute) left_page (dissect.database.sqlite3.sqlite3.Cell attribute) left_sibling (dissect.ole.ole.DirectoryEntry property) LEFT_SYMMETRIC (dissect.volume.raid.stream.Layout attribute) LEFT_SYMMETRIC_6 (dissect.volume.raid.stream.Layout attribute) len_types (dissect.eventlog.wevt.WEVT property) length (dissect.btrfs.stream.Chunk attribute) (dissect.btrfs.stream.Extent attribute) (dissect.hypervisor.disk.vhdx.MetadataTable attribute) (dissect.ntfs.index.IndexEntry property) (dissect.ntfs.IndexEntry property) (dissect.util.compression.lzxpress_huffman.Symbol attribute) (dissect.volume.vinum.config.SD attribute) Less (dissect.ntfs.index.Match attribute) Level (class in dissect.volume.raid.stream) level (dissect.apfs.objects.btree_node.BTreeNode property) (dissect.apfs.objects.BTreeNode property) (dissect.cim.cim.Property property) (dissect.cim.classes.ClassDefinitionProperty attribute) (dissect.cim.classes.ClassInstanceProperty property) (dissect.etl.headers.event.EventDescriptor attribute) (dissect.volume.md.md.MDPhysicalDisk attribute) (dissect.volume.md.MDPhysicalDisk attribute) (dissect.volume.raid.raid.VirtualDisk attribute) (dissect.volume.raid.stream.RAID456Stream attribute) LEVL (class in dissect.eventlog.wevt_object) lexists() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) LFB (dissect.vmfs.resource.ResourceManager property) LibvirtLoader (class in dissect.target.loaders.libvirt) likely_unchanged() (in module dissect.target.tools.diff) LimaChildTargetPlugin (class in dissect.target.plugins.child.lima) limit (dissect.target.tools.diff.DifferentialCli attribute) line_reader() (dissect.target.helpers.configutil.Default method) LINEAR (dissect.volume.raid.stream.Level attribute) LinearStream (class in dissect.volume.raid.stream) LineReader (class in dissect.target.helpers.cache) lineterminator (flow.record.adapter.csvfile.CsvfileWriter attribute) LineWriter (class in dissect.target.helpers.cache) (class in flow.record.adapter.line) LINGUISTIC_IGNORECASE (dissect.database.ese.lcmapstring.MapFlags attribute) LINGUISTIC_IGNOREDIACRITIC (dissect.database.ese.lcmapstring.MapFlags attribute) link (dissect.btrfs.btrfs.INode property) (dissect.btrfs.INode property) (dissect.cramfs.cramfs.INode property) (dissect.cramfs.INode property) (dissect.executable.elf.elf.Section property) (dissect.executable.elf.Section property) (dissect.extfs.extfs.INode property) (dissect.extfs.INode property) (dissect.ffs.ffs.INode property) (dissect.jffs.jffs2.INode property) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx6.INode6 property) (dissect.squashfs.INode property) (dissect.squashfs.squashfs.INode property) LINK (dissect.target.helpers.regutil.RegistryValueType attribute) link (dissect.vmfs.descriptor.FileDescriptor property) (dissect.vmfs.FileDescriptor property) (dissect.xfs.xfs.INode property) link() (dissect.target.filesystem.LayerFilesystem method) (dissect.target.filesystem.VirtualFilesystem method) LINK_EXTRA_DATA_HEADER_SIZE (in module dissect.shellitem.lnk.c_lnk) link_header (dissect.shellitem.lnk.Lnk attribute) (dissect.shellitem.lnk.lnk.Lnk attribute) LINK_HEADER_SIZE (in module dissect.shellitem.lnk.c_lnk) link_info (dissect.shellitem.lnk.lnk.LnkInfo attribute) LINK_INFO_BODY_SIZE (in module dissect.shellitem.lnk.c_lnk) LINK_INFO_HEADER_SIZE (in module dissect.shellitem.lnk.c_lnk) link_inode (dissect.btrfs.btrfs.INode property) (dissect.btrfs.INode property) (dissect.ffs.ffs.INode property) (dissect.jffs.jffs2.INode property) (dissect.squashfs.INode property) (dissect.squashfs.squashfs.INode property) link_to() (dissect.target.helpers.compat.path_311.TargetPath method) linkage (dissect.etl.headers.event.EventHeaderExtendedDataItem attribute) linkinfo (dissect.shellitem.lnk.Lnk attribute) (dissect.shellitem.lnk.lnk.Lnk attribute) linkinfo_body (dissect.shellitem.lnk.lnk.LnkInfo attribute) linkinfo_header (dissect.shellitem.lnk.lnk.LnkInfo attribute) LINUX (dissect.target.filesystems.cb.OS attribute) (dissect.target.plugin.OperatingSystem attribute) LINUX_DEV_DIR (in module dissect.target.loaders.local) LINUX_DRIVE_REGEX (in module dissect.target.loaders.local) LinuxNetworkConfigParser (class in dissect.target.plugins.os.unix.linux.network) LinuxNetworkManager (class in dissect.target.plugins.os.unix.linux.network_managers) LinuxNetworkPlugin (class in dissect.target.plugins.os.unix.linux.network) LinuxPlugin (class in dissect.target.plugins.os.unix.linux._os) LinuxProfile (class in acquire.acquire.acquire) LinuxServiceRecord (in module dissect.target.plugins.os.unix.linux.services) list_adapters() (in module flow.record.tools.rdump) list_children() (dissect.target.plugin.ChildTargetPlugin method) (dissect.target.plugins.child.colima.ColimaChildTargetPlugin method) (dissect.target.plugins.child.docker.DockerChildTargetPlugin method) (dissect.target.plugins.child.esxi.ESXiChildTargetPlugin method) (dissect.target.plugins.child.hyperv.HyperVChildTargetPlugin method) (dissect.target.plugins.child.lima.LimaChildTargetPlugin method) (dissect.target.plugins.child.parallels.ParallelsChildTargetPlugin method) (dissect.target.plugins.child.podman.PodmanChildTargetPlugin method) (dissect.target.plugins.child.proxmox.ProxmoxChildTargetPlugin method) (dissect.target.plugins.child.qemu.QemuChildTargetPlugin method) (dissect.target.plugins.child.virtualbox.VirtualBoxChildTargetPlugin method) (dissect.target.plugins.child.virtuozzo.VirtuozzoChildTargetPlugin method) (dissect.target.plugins.child.vmware_workstation.VmwareWorkstationChildTargetPlugin method) (dissect.target.plugins.child.wsl.WSLChildTargetPlugin method) (dissect.target.Target method) (dissect.target.target.Target method) (in module dissect.target.tools.utils.cli) list_plugins() (in module dissect.target.tools.utils.cli) listdir (dissect.btrfs.btrfs.INode attribute) (dissect.btrfs.INode attribute) (dissect.jffs.jffs2.INode attribute) (dissect.squashfs.INode attribute) (dissect.squashfs.squashfs.INode attribute) listdir() (dissect.apfs.objects.fs.INode method) (dissect.archive.vbk.DirItem method) (dissect.archive.wim.DirectoryEntry method) (dissect.cramfs.cramfs.INode method) (dissect.cramfs.INode method) (dissect.evidence.ad1.AD1 method) (dissect.executable.pe.directory.resource.ResourceDirectoryEntry method) (dissect.executable.pe.directory.ResourceDirectoryEntry method) (dissect.extfs.extfs.INode method) (dissect.extfs.INode method) (dissect.ffs.ffs.INode method) (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.MftRecord method) (dissect.ole.ole.DirectoryEntry method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.vmfs.descriptor.FileDescriptor method) (dissect.vmfs.FileDescriptor method) (dissect.xfs.xfs.INode method) listdir_ext() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) LISTEN (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) (dissect.target.plugins.os.unix.linux.proc.Sockets.UDPStates attribute) LISTENING (dissect.target.plugins.os.unix.linux.proc.Sockets.SocketStateType attribute) ListUnwrapper (class in dissect.target.helpers.configutil) listxattr (dissect.target.helpers.mount.DissectMount attribute) literal_bits (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) literal_freq (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) literal_state (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) lmd_bits (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) Lnk (class in dissect.shellitem.lnk) (class in dissect.shellitem.lnk.lnk) LNK (dissect.target.helpers.nfs.nfs3.FileType attribute) lnk() (dissect.target.plugins.os.windows.lnk.LnkPlugin method) lnk_def (in module dissect.shellitem.lnk.c_lnk) lnk_entries() (dissect.target.plugins.os.windows.lnk.LnkPlugin method) LNK_GUID (in module dissect.target.plugins.os.windows.jumplist) LnkExtraData (class in dissect.shellitem.lnk.lnk) LnkInfo (class in dissect.shellitem.lnk.lnk) LnkPlugin (class in dissect.target.plugins.os.windows.lnk) LnkRecord (in module dissect.target.plugins.os.windows.lnk) LnkStringData (class in dissect.shellitem.lnk.lnk) LnkTargetIdList (class in dissect.shellitem.lnk.lnk) load() (dissect.cstruct.cstruct method) (dissect.cstruct.cstruct.cstruct method) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.Config class method) (flow.record.fieldtypes.net.ipv4.SubnetList method) (in module dissect.target.helpers.config) (in module dissect.target.plugin) load_behavior (dissect.target.plugins.apps.productivity.msoffice.NativePluginStatus attribute) load_child() (in module acquire.acquire.acquire) load_config (dissect.executable.PE property) (dissect.executable.pe.PE property) (dissect.executable.pe.pe.PE property) load_entrypoint_plugins() (acquire.acquire.uploaders.plugin_registry.PluginRegistry method) load_module() (in module dissect.cstruct.tools.stubgen) load_module_from_file() (in module dissect.target.plugin) load_module_from_name() (in module dissect.target.plugin) load_modules_from_paths() (in module dissect.target.plugin) load_plugin() (dissect.target.Target method) (dissect.target.target.Target method) load_state() (in module dissect.target.tools.dump) load_user_hives() (dissect.target.plugins.os.windows.registry.RegistryPlugin method) LoadBehavior (class in dissect.target.plugins.apps.productivity.msoffice) LoadConfigDirectory (class in dissect.executable.pe.directory) (class in dissect.executable.pe.directory.load_config) loaded (dissect.target.plugins.apps.productivity.msoffice.NativePluginStatus attribute) Loader (class in dissect.target.loader) loader (dissect.target.loaders.vbk.VbkLoader attribute) LoaderError LoaderListPlugin (class in dissect.target.plugins.general.loaders) loaders() (dissect.target.plugins.general.loaders.LoaderListPlugin method) loadfile() (dissect.cstruct.cstruct method) (dissect.cstruct.cstruct.cstruct method) local() (dissect.target.plugins.os.default.datetime.DateTimePlugin method) local_address (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) local_def (in module dissect.target.plugins.apps.container.docker) local_groups_to_users() (in module dissect.target.plugins.os.unix.linux.fortios._os) local_ip (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) local_module() (in module acquire.acquire.acquire) local_port (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) local_wintimestamp() (in module dissect.target.plugins.os.windows.regf.cit) LocalePlugin (class in dissect.target.plugins.os.default.locale) (class in dissect.target.plugins.os.unix.bsd.darwin.ios.locale) localized_name (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK_BEEF0004 attribute) LocalLoader (class in dissect.target.loaders.local) LocalPortPolicy (class in dissect.target.helpers.sunrpc.client) LOCALTALK (dissect.target.plugins.os.windows.network.IfTypes attribute) locate() (dissect.target.plugins.os.unix.locate.gnulocate.GNULocatePlugin method) (dissect.target.plugins.os.unix.locate.mlocate.MLocatePlugin method) (dissect.target.plugins.os.unix.locate.plocate.PLocatePlugin method) locators (dissect.hypervisor.descriptor.vmx.KeySafe attribute) lock_args (dissect.volume.lvm.metadata.LogicalVolume attribute) (dissect.volume.lvm.metadata.VolumeGroup attribute) lock_info (dissect.vmfs.descriptor.FileDescriptor property) (dissect.vmfs.FileDescriptor property) lock_type (dissect.volume.lvm.metadata.VolumeGroup attribute) log (dissect.target.loaders.remote.RemoteStreamConnection attribute) (dissect.target.Target attribute) (dissect.target.target.Target attribute) (in module acquire.acquire.acquire) (in module acquire.acquire.collector) (in module acquire.acquire.dynamic.windows.collect) (in module acquire.acquire.dynamic.windows.handles) (in module acquire.acquire.hashes) (in module acquire.acquire.log) (in module acquire.acquire.tools.decrypter) (in module acquire.acquire.uploaders.plugin_registry) (in module dissect.apfs.apfs) (in module dissect.archive.tools.backup) (in module dissect.cstruct.compiler) (in module dissect.cstruct.tools.stubgen) (in module dissect.eventlog.evtx) (in module dissect.evidence.ewf) (in module dissect.extfs.extfs) (in module dissect.ffs.ffs) (in module dissect.fve.bde.bde) (in module dissect.hypervisor.disk.vhdx) (in module dissect.hypervisor.disk.vmdk) (in module dissect.jffs.jffs2) (in module dissect.regf.regf) (in module dissect.shellitem.lnk.lnk) (in module dissect.shellitem.tools.lnk) (in module dissect.target.container) (in module dissect.target.containers.fortifw) (in module dissect.target.filesystem) (in module dissect.target.filesystems.config) (in module dissect.target.filesystems.overlay) (in module dissect.target.filesystems.smb) (in module dissect.target.filesystems.tar) (in module dissect.target.filesystems.xfs) (in module dissect.target.filesystems.zip) (in module dissect.target.helpers.config) (in module dissect.target.helpers.configutil) (in module dissect.target.helpers.keychain) (in module dissect.target.helpers.loaderutil) (in module dissect.target.helpers.mount) (in module dissect.target.helpers.utils) (in module dissect.target.loaders.acquire) (in module dissect.target.loaders.cellebrite) (in module dissect.target.loaders.containerimage) (in module dissect.target.loaders.hyperv) (in module dissect.target.loaders.mqtt) (in module dissect.target.loaders.remote) (in module dissect.target.loaders.tar) (in module dissect.target.loaders.uac) (in module dissect.target.loaders.velociraptor) (in module dissect.target.plugin) (in module dissect.target.plugins.apps.browser.firefox) (in module dissect.target.plugins.apps.container.docker) (in module dissect.target.plugins.apps.ssh.putty) (in module dissect.target.plugins.filesystem.yara) (in module dissect.target.plugins.os.unix._os) (in module dissect.target.plugins.os.unix.linux.network_managers) (in module dissect.target.plugins.os.unix.log.helpers) (in module dissect.target.plugins.os.unix.log.journal) (in module dissect.target.plugins.os.windows.credential.credhist) (in module dissect.target.plugins.os.windows.dpapi.master_key) (in module dissect.target.plugins.os.windows.everything.parser) (in module dissect.target.plugins.os.windows.jumplist) (in module dissect.target.plugins.os.windows.log.schedlgu) (in module dissect.target.plugins.os.windows.regf.shellbags) (in module dissect.target.target) (in module dissect.target.tools.dd) (in module dissect.target.tools.diff) (in module dissect.target.tools.dump) (in module dissect.target.tools.fs) (in module dissect.target.tools.info) (in module dissect.target.tools.mount) (in module dissect.target.tools.qfind) (in module dissect.target.tools.query) (in module dissect.target.tools.reg) (in module dissect.target.tools.shell) (in module dissect.target.tools.yara) (in module dissect.target.volume) (in module dissect.target.volumes.bde) (in module dissect.target.volumes.luks) (in module dissect.target.volumes.lvm) (in module dissect.volume.ldm) (in module dissect.volume.lvm.lvm2) (in module dissect.volume.vinum.config) (in module dissect.volume.vinum.vinum) (in module dissect.volume.vss) (in module dissect.xfs.xfs) (in module flow.record.adapter.elastic) (in module flow.record.adapter.splunk) (in module flow.record.base) (in module flow.record.jsonpacker) (in module flow.record.stream) (in module flow.record.tools.rdump) log() (dissect.target.plugins.os.unix.linux.debian.dpkg.DpkgPlugin method) LOG_DB_GLOB (dissect.target.plugins.os.windows.ual.UalPlugin attribute) LOG_DIR_PATH (dissect.target.plugins.os.unix.linux.debian.apt.AptPlugin attribute) (dissect.target.plugins.os.unix.linux.redhat.yum.YumPlugin attribute) (dissect.target.plugins.os.unix.linux.suse.zypper.ZypperPlugin attribute) log_dirs (dissect.target.plugins.apps.webserver.iis.IISLogsPlugin property) LOG_FILE_FIREWALL (dissect.target.plugins.apps.av.trendmicro.TrendMicroPlugin attribute) log_file_handler (in module acquire.acquire.acquire) LOG_FILE_INFECTIONS (dissect.target.plugins.apps.av.trendmicro.TrendMicroPlugin attribute) LOG_FILE_PATTERN (dissect.target.plugins.apps.av.mcafee.McAfeePlugin attribute) LOG_FILE_REGEX (in module dissect.target.plugins.apps.webserver.caddy) log_filename (dissect.etl.headers.logfile.LogfileHeader attribute) log_files (dissect.target.plugins.apps.remoteaccess.rustdesk.RustdeskPlugin attribute) (dissect.target.plugins.apps.remoteaccess.splashtop.SplashtopPlugin attribute) (dissect.target.plugins.os.unix.log.messages.MessagesPlugin attribute) LOG_FILES_GLOB (dissect.target.plugins.os.unix.linux.debian.apt.AptPlugin attribute) (dissect.target.plugins.os.unix.linux.redhat.yum.YumPlugin attribute) (dissect.target.plugins.os.unix.linux.suse.zypper.ZypperPlugin attribute) (in module dissect.target.plugins.os.unix.linux.debian.dpkg) LOG_FOLDER (dissect.target.plugins.apps.av.trendmicro.TrendMicroPlugin attribute) LOG_FORMAT_ACCESS_COMBINED (in module dissect.target.plugins.apps.webserver.apache) LOG_FORMAT_ACCESS_COMMON (in module dissect.target.plugins.apps.webserver.apache) LOG_FORMAT_ACCESS_VHOST_COMBINED (in module dissect.target.plugins.apps.webserver.apache) LOG_FORMAT_CITRIX_NETSCALER_ACCESS_COMBINED_RESPONSE_TIME (in module dissect.target.plugins.apps.webserver.citrix) LOG_FORMAT_CITRIX_NETSCALER_ACCESS_COMBINED_RESPONSE_TIME_WITH_HEADERS (in module dissect.target.plugins.apps.webserver.citrix) LOG_FORMAT_ERROR_COMMON (in module dissect.target.plugins.apps.webserver.apache) log_func_error() (dissect.target.tools.utils.report.ExecutionReport method) log_func_execution() (dissect.target.tools.utils.report.ExecutionReport method) log_incompatible_plugin() (dissect.target.tools.utils.report.ExecutionReport method) LOG_PATHS (dissect.target.plugins.apps.remoteaccess.splashtop.SplashtopPlugin attribute) log_paths (dissect.target.plugins.apps.webserver.caddy.CaddyPlugin attribute) (dissect.target.plugins.os.unix.log.audit.AuditPlugin attribute) (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin attribute) log_progress() (in module dissect.target.tools.dump) LOG_RECORD_NAME (in module dissect.target.plugins.apps.webserver.iis) LOG_REGEX (in module dissect.target.plugins.apps.webserver.caddy) log_registered_plugin() (dissect.target.tools.utils.report.ExecutionReport method) LOG_SEP_AV (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) LOG_SEP_NET (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) LOG_SOPHOS_HITMAN (dissect.target.plugins.apps.av.sophos.SophosPlugin attribute) LOG_SOPHOS_HOME (dissect.target.plugins.apps.av.sophos.SophosPlugin attribute) LOG_TIME_FORMAT (dissect.target.plugins.os.unix.linux.iptables.IptablesSavePlugin attribute) LogConfig (class in dissect.target.plugins.os.windows.firewall) logfile (dissect.target.plugins.os.windows.log.pfro.PfroPlugin attribute) logfile_def (in module dissect.etl.headers.logfile) logfile_header (dissect.etl.ETL attribute) (dissect.etl.etl.ETL attribute) LogfileHeader (class in dissect.etl.headers.logfile) logfiles (dissect.target.plugins.apps.remoteaccess.teamviewer.TeamViewerPlugin attribute) LogFormat (class in dissect.target.plugins.apps.webserver.apache) logger (flow.record.adapter.duckdb.DuckdbReader attribute) (flow.record.adapter.duckdb.DuckdbWriter attribute) (flow.record.adapter.sqlite.SqliteReader attribute) (flow.record.adapter.sqlite.SqliteWriter attribute) (in module flow.record.adapter.duckdb) (in module flow.record.adapter.sqlite) (in module flow.record.tools.geoip) logger_name (dissect.etl.headers.logfile.LogfileHeader attribute) LOGGING_KEYS (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin attribute) LOGGING_TRACE_LEVEL (in module flow.record.utils) logical_image (dissect.evidence.ad1.AD1 attribute) logical_num (dissect.cim.index.IndexPage attribute) (dissect.cim.objects.DataPage attribute) logical_page() (dissect.cim.objects.Store method) LOGICAL_SECTOR_SIZE_GUID (in module dissect.hypervisor.disk.c_vhdx) logical_threads (dissect.volume.lvm.metadata.VdoPoolSegment attribute) logical_volume (dissect.volume.lvm.metadata.Segment property) LOGICAL_VOLUME_MANAGERS (in module dissect.target.volume) logical_volumes (dissect.volume.lvm.metadata.VolumeGroup attribute) LogicalImage (class in dissect.evidence.ad1) LogicalOperator (class in dissect.util.ldap) LogicalVolume (class in dissect.volume.lvm.metadata) LogicalVolumeSystem (class in dissect.target.volume) LogLoader (class in dissect.target.loaders.log) logon_type (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) LogonTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) LOGS (dissect.target.plugins.apps.av.sophos.SophosPlugin attribute) (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) logs (dissect.target.plugins.os.windows.log.amcache.AmcacheInstallPlugin attribute) logs() (dissect.target.plugins.apps.av.symantec.SymantecPlugin method) (dissect.target.plugins.apps.container.docker.DockerPlugin method) (dissect.target.plugins.apps.container.podman.PodmanPlugin method) (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin method) (dissect.target.plugins.apps.remoteaccess.rustdesk.RustdeskPlugin method) (dissect.target.plugins.apps.remoteaccess.splashtop.SplashtopPlugin method) (dissect.target.plugins.apps.remoteaccess.teamviewer.TeamViewerPlugin method) (dissect.target.plugins.apps.webserver.iis.IISLogsPlugin method) (dissect.target.plugins.apps.webserver.webserver.WebserverPlugin method) (dissect.target.plugins.os.unix.linux.debian.apt.AptPlugin method) (dissect.target.plugins.os.unix.linux.redhat.yum.YumPlugin method) (dissect.target.plugins.os.unix.linux.suse.zypper.ZypperPlugin method) (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin method) LOGS_DIR_PATH (dissect.target.plugins.os.windows.log.evt.EvtPlugin attribute) (dissect.target.plugins.os.windows.log.evt.WindowsEventlogsMixin attribute) (dissect.target.plugins.os.windows.log.evtx.EvtxPlugin attribute) LOGS_DIRS (dissect.target.loaders.log.LogLoader attribute) long_name (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK_BEEF0004 attribute) lookup (dissect.apfs.objects.ObjectMap attribute) (dissect.apfs.objects.omap.ObjectMap attribute) (dissect.cstruct.parser.TokenCollection attribute) (dissect.cstruct.types.structure.StructureMetaType attribute) (dissect.database.bsd.db.Page property) (dissect.hypervisor.disk.vhdx.MetadataTable attribute) (dissect.hypervisor.disk.vhdx.RegionTable attribute) (dissect.ntfs.Secure attribute) (dissect.ntfs.secure.Secure attribute) lookup() (dissect.cim.index.Index method) (dissect.target.helpers.nfs.client.nfs.Client method) (dissect.util.compression.lzxpress_huffman.BitString method) (dissect.volume.dm.btree.BTree method) (in module dissect.etl.manifest) (in module dissect.target.plugin) Lookup3ResultDeserializer (class in dissect.target.helpers.nfs.serializer) lookup8() (in module dissect.util.hash.jenkins) lookup8_quads() (in module dissect.util.hash.jenkins) lookup_guid() (in module dissect.etl.utils) lookup_table (dissect.squashfs.SquashFS attribute) (dissect.squashfs.squashfs.SquashFS attribute) lookup_thunk (dissect.executable.pe.directory.ImportFunction attribute) (dissect.executable.pe.directory.imports.ImportFunction attribute) LookupProc (in module dissect.target.helpers.nfs.nfs3) LookupResult (class in dissect.target.helpers.nfs.nfs3) lookups (dissect.cstruct.cstruct attribute) (dissect.cstruct.cstruct.cstruct attribute) low (dissect.target.helpers.sunrpc.sunrpc.Mismatch attribute) low_watermark (dissect.volume.lvm.metadata.WriteCacheSegment attribute) lower() (in module flow.record.selector) lowest_vcn (dissect.ntfs.attr.AttributeHeader property) (dissect.ntfs.AttributeHeader property) LOWORD() (in module acquire.acquire.gui.win32) LRESULT (in module acquire.acquire.gui.win32) ls() (in module dissect.target.tools.fs) LS_COLORS (in module dissect.target.tools.utils.fs) ls_scandir() (in module dissect.target.tools.utils.fs) LSADefaultPasswordKeyProviderPlugin (class in dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.lsa) lsakey (dissect.target.plugins.os.windows.credential.lsa.LSAPlugin property) LSAPlugin (class in dissect.target.plugins.os.windows.credential.lsa) LSASecretRecord (in module dissect.target.plugins.os.windows.credential.lsa) lsmod() (dissect.target.plugins.os.unix.linux.modules.ModulePlugin method) lsn_archive_tail (dissect.clfs.blf.Stream attribute) lsn_base (dissect.clfs.blf.Stream attribute) lsn_flush (dissect.clfs.blf.Stream attribute) lsn_last (dissect.clfs.blf.Stream attribute) lsn_physical_base (dissect.clfs.blf.Stream attribute) lstat() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.MappedFile method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry method) (dissect.target.filesystems.cb.CbFilesystemEntry method) (dissect.target.filesystems.config.ConfigurationEntry method) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.exfat.ExfatFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.fat.FatFilesystemEntry method) (dissect.target.filesystems.ffs.FfsFilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemDirectoryEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemEntry method) (dissect.target.filesystems.jffs.JffsFilesystemEntry method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry method) (dissect.target.filesystems.smb.SmbFilesystemEntry method) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystemDirectoryEntry method) (dissect.target.filesystems.tar.TarFilesystemEntry method) (dissect.target.filesystems.vbk.VbkFilesystemEntry method) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystemEntry method) (dissect.target.loaders.res.ResFile method) (dissect.target.plugins.os.unix.linux.debian.proxmox._os.ProxmoxConfigDirectoryEntry method) (dissect.target.plugins.os.unix.linux.debian.proxmox._os.ProxmoxConfigFileEntry method) LT (dissect.util.ldap.ComparisonOperator attribute) LUID (class in acquire.acquire.dynamic.windows.types) LUID_AND_ATTRIBUTES (class in acquire.acquire.dynamic.windows.types) LUKS (class in dissect.fve.luks) (class in dissect.fve.luks.luks) luks (dissect.target.volumes.luks.LUKSVolumeSystem attribute) (in module dissect.target.volume) LUKS2_MAGIC_1ST (in module dissect.fve.luks.c_luks) LUKS2_MAGIC_2ND (in module dissect.fve.luks.c_luks) luks_def (in module dissect.fve.luks.c_luks) LUKS_MAGIC (in module dissect.fve.luks.c_luks) LUKSVolumeSystem (class in dissect.target.volumes.luks) LUKSVolumeSystemError lv (dissect.volume.lvm.metadata.Segment property) (dissect.volume.lvm.metadata.VolumeGroup property) lv_page (dissect.database.ese.Table property) (dissect.database.ese.table.Table property) LVM (class in dissect.vmfs) (class in dissect.vmfs.lvm) lvm (dissect.target.volumes.lvm.LvmVolumeSystem attribute) (dissect.target.volumes.vmfs.VmfsVolumeSystem attribute) (in module dissect.target.volume) LVM2 (class in dissect.volume.lvm) (class in dissect.volume.lvm.lvm2) LVM2Device (class in dissect.volume.lvm) (class in dissect.volume.lvm.physical) LVM2Error lvm_def (in module dissect.vmfs.c_lvm) (in module dissect.volume.lvm.c_lvm2) LvmVolumeSystem (class in dissect.target.volumes.lvm) LZ4 (dissect.target.tools.dump.Compression attribute) LZ4_MAGIC (in module flow.record.base) lz4_python (in module dissect.util.compression) LZFSE_COMPRESSEDLZVN_BLOCK_MAGIC (in module dissect.util.compression.lzfse) LZFSE_COMPRESSEDV1_BLOCK_MAGIC (in module dissect.util.compression.lzfse) LZFSE_COMPRESSEDV2_BLOCK_MAGIC (in module dissect.util.compression.lzfse) LZFSE_ENCODE_D_STATES (in module dissect.util.compression.lzfse) LZFSE_ENCODE_D_SYMBOLS (in module dissect.util.compression.lzfse) LZFSE_ENCODE_L_STATES (in module dissect.util.compression.lzfse) LZFSE_ENCODE_L_SYMBOLS (in module dissect.util.compression.lzfse) LZFSE_ENCODE_LITERAL_STATES (in module dissect.util.compression.lzfse) LZFSE_ENCODE_LITERAL_SYMBOLS (in module dissect.util.compression.lzfse) LZFSE_ENCODE_M_STATES (in module dissect.util.compression.lzfse) LZFSE_ENCODE_M_SYMBOLS (in module dissect.util.compression.lzfse) LZFSE_ENDOFSTREAM_BLOCK_MAGIC (in module dissect.util.compression.lzfse) LZFSE_LITERALS_PER_BLOCK (in module dissect.util.compression.lzfse) LZFSE_MATCHES_PER_BLOCK (in module dissect.util.compression.lzfse) LZFSE_UNCOMPRESSED_BLOCK_MAGIC (in module dissect.util.compression.lzfse) LZFSECompressedBlockHeader (class in dissect.util.compression.lzfse) lzo_python (in module dissect.util.compression) M m_freq (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) m_state (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) mac (dissect.fve.bde.information.AesCbc256HmacSha512EncryptedDatum property) (dissect.fve.bde.information.AesCcmEncryptedDatum property) (dissect.hypervisor.descriptor.vmx.Pair attribute) MAC (dissect.target.filesystems.cb.OS attribute) mac_address (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) macb_aggregator() (in module dissect.target.plugins.filesystem.ntfs.mft) machine (dissect.executable.PE property) (dissect.executable.pe.PE property) (dissect.executable.pe.pe.PE property) machine() (dissect.target.plugins.os.windows.regf.clsid.CLSIDPlugin method) machine_key (dissect.target.plugins.os.windows.dpapi.master_key.CredSystem attribute) MACHINE_NAME (dissect.target.loaders.smb.SmbLoader attribute) machine_sid() (dissect.target.plugins.os.windows.generic.GenericPlugin method) machinename (dissect.target.helpers.sunrpc.sunrpc.AuthUnix attribute) MacOS (class in acquire.acquire.acquire) MACOS (dissect.target.plugin.OperatingSystem attribute) MacOSApplicationsInfo (class in acquire.acquire.acquire) MacOSInterfaceRecord (in module dissect.target.helpers.record) MacOSNetworkPlugin (class in dissect.target.plugins.os.unix.bsd.darwin.macos.network) MacOSPlugin (class in dissect.target.plugins.os.unix.bsd.darwin.macos._os) MacOSProfile (class in acquire.acquire.acquire) MacOSUserRecord (in module dissect.target.helpers.record) macs() (dissect.target.plugins.os.default.network.NetworkPlugin method) MAGENTA (dissect.target.helpers.cyber.Color attribute) (dissect.target.tools.shell.AnsiColors attribute) magic (dissect.target.plugins.os.windows.jumplist.CustomDestinationFile attribute) MAGIC_ACTIVE (in module dissect.volume.vinum.c_vinum) MAGIC_FOOTER (dissect.target.plugins.os.windows.jumplist.CustomDestinationFile attribute) MAGIC_INACTIVE (in module dissect.volume.vinum.c_vinum) MAGIC_NT52 (in module dissect.target.plugins.os.windows.regf.shimcache) MAGIC_NT61 (in module dissect.target.plugins.os.windows.regf.shimcache) MAGIC_WIN10 (in module dissect.target.plugins.os.windows.regf.shimcache) MAGIC_WIN81 (in module dissect.target.plugins.os.windows.regf.shimcache) main() (in module acquire.acquire.acquire) (in module acquire.acquire.tools.decrypter) (in module dissect.archive.tools.backup) (in module dissect.cstruct.tools.stubgen) (in module dissect.database.bsd.tools.rpm) (in module dissect.database.ese.tools.certlog) (in module dissect.database.ese.tools.sru) (in module dissect.database.ese.tools.ual) (in module dissect.evidence.tools.asdf.dd) (in module dissect.evidence.tools.asdf.meta) (in module dissect.evidence.tools.asdf.repair) (in module dissect.evidence.tools.asdf.verify) (in module dissect.fve.tools.dd) (in module dissect.hypervisor.tools.envelope) (in module dissect.hypervisor.tools.vmtar) (in module dissect.shellitem.tools.lnk) (in module dissect.target.containers.fortifw) (in module dissect.target.loaders.ab) (in module dissect.target.tools.build_pluginlist) (in module dissect.target.tools.dd) (in module dissect.target.tools.diff) (in module dissect.target.tools.dump) (in module dissect.target.tools.fs) (in module dissect.target.tools.info) (in module dissect.target.tools.mount) (in module dissect.target.tools.qfind) (in module dissect.target.tools.query) (in module dissect.target.tools.reg) (in module dissect.target.tools.shell) (in module dissect.target.tools.yara) (in module dissect.thumbcache.tools.extract_images) (in module dissect.thumbcache.tools.extract_with_index) (in module dissect.util.tools.dump_nskeyedarchiver) (in module flow.record.tools.geoip) (in module flow.record.tools.rdump) main_globals (in module dissect.database.ese.tools.impacket) major (dissect.cramfs.cramfs.INode property) (dissect.cramfs.INode property) (dissect.squashfs.SquashFS attribute) (dissect.squashfs.squashfs.SquashFS attribute) major_version (dissect.vmfs.Device attribute) (dissect.vmfs.lvm.Device attribute) (dissect.vmfs.VMFS attribute) (dissect.vmfs.vmfs.VMFS attribute) make() (dissect.vmfs.address.Address class method) (dissect.vmfs.address.FileBlockAddr class method) (dissect.vmfs.address.FileDescriptorAddr class method) (dissect.vmfs.address.JournalBlockAddr class method) (dissect.vmfs.address.LargeFileBlockAddr class method) (dissect.vmfs.address.PointerBlockAddr class method) (dissect.vmfs.address.PointerBlockAddr64 class method) (dissect.vmfs.address.SmallFileBlockAddr class method) (dissect.vmfs.address.SubBlockAddr class method) (dissect.vmfs.address.SubBlockAddr64 class method) make_cli_args_overview() (in module dissect.target.tools.utils.report) make_fs_object_key() (in module dissect.apfs.util) make_key() (dissect.database.ese.Index method) (dissect.database.ese.index.Index method) make_keys() (dissect.target.helpers.regutil.VirtualHive method) make_plugin_import_errors_overview() (in module dissect.target.tools.utils.report) make_selector() (in module flow.record.selector) make_target_pairs() (in module dissect.target.tools.diff) make_type() (dissect.vmfs.address.Address class method) makedirs() (dissect.target.filesystem.VirtualFilesystem method) MalformedElfChnkException, [1] managers (dissect.target.plugins.os.unix.linux.network_managers.LinuxNetworkManager attribute) MANAGERS (in module dissect.target.plugins.os.unix.linux.network) (in module dissect.target.plugins.os.unix.linux.network_managers) MANET (dissect.target.helpers.network.IANAProtocol attribute) manifest (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) (dissect.target.loaders.containerimage.ContainerImageTarSubLoader attribute) (dissect.target.loaders.itunes.ITunesBackup attribute) manifest_db (dissect.target.loaders.itunes.ITunesBackup attribute) ManifestNotFoundError, [1] Manual (dissect.target.plugins.apps.productivity.msoffice.LoadBehavior attribute) map (dissect.cim.index.Store attribute) (dissect.cim.objects.Store attribute) (dissect.hypervisor.disk.vdi.VDI attribute) (dissect.volume.vss.BlockList attribute) (dissect.volume.vss.BlockMap attribute) map() (dissect.target.loader.Loader method) (dissect.target.loaders.ab.AndroidBackupLoader method) (dissect.target.loaders.acquire.AcquireTarSubLoader method) (dissect.target.loaders.acquire.AcquireZipSubLoader method) (dissect.target.loaders.asdf.AsdfLoader method) (dissect.target.loaders.cb.CbLoader method) (dissect.target.loaders.cellebrite.CellebriteLoader method) (dissect.target.loaders.containerimage.ContainerImageTarSubLoader method) (dissect.target.loaders.cyber.CyberLoader method) (dissect.target.loaders.dir.DirLoader method) (dissect.target.loaders.direct.DirectLoader method) (dissect.target.loaders.hyperv.HyperVLoader method) (dissect.target.loaders.itunes.ITunesLoader method) (dissect.target.loaders.kape.KapeLoader method) (dissect.target.loaders.libvirt.LibvirtLoader method) (dissect.target.loaders.local.LocalLoader method) (dissect.target.loaders.log.LogLoader method) (dissect.target.loaders.mqtt.MqttLoader method) (dissect.target.loaders.multiraw.MultiRawLoader method) (dissect.target.loaders.overlay.OverlayLoader method) (dissect.target.loaders.overlay2.Overlay2Loader method) (dissect.target.loaders.ovf.OvfLoader method) (dissect.target.loaders.phobos.PhobosLoader method) (dissect.target.loaders.profile.ProfileLoader method) (dissect.target.loaders.proxmox.ProxmoxLoader method) (dissect.target.loaders.pvs.PvsLoader method) (dissect.target.loaders.raw.RawLoader method) (dissect.target.loaders.remote.RemoteLoader method) (dissect.target.loaders.res.ResLoader method) (dissect.target.loaders.smb.SmbLoader method) (dissect.target.loaders.tanium.TaniumLoader method) (dissect.target.loaders.tar.GenericTarSubLoader method) (dissect.target.loaders.tar.TarLoader method) (dissect.target.loaders.tar.TarSubLoader method) (dissect.target.loaders.target.TargetLoader method) (dissect.target.loaders.uac.UacLoader method) (dissect.target.loaders.uac.UacTarSubloader method) (dissect.target.loaders.uac.UacZipSubLoader method) (dissect.target.loaders.utm.UtmLoader method) (dissect.target.loaders.vb.VBLoader method) (dissect.target.loaders.vbk.VbkLoader method) (dissect.target.loaders.vbox.VBoxLoader method) (dissect.target.loaders.velociraptor.VelociraptorLoader method) (dissect.target.loaders.vma.VmaLoader method) (dissect.target.loaders.vmx.VmxLoader method) (dissect.target.loaders.xva.XvaLoader method) (dissect.target.loaders.zip.GenericZipSubLoader method) (dissect.target.loaders.zip.ZipLoader method) (dissect.target.loaders.zip.ZipSubLoader method) map_definition() (dissect.target.helpers.regutil.RegFlex method) map_dir() (dissect.target.filesystem.VirtualFilesystem method) map_dir_from_tar() (dissect.target.filesystem.VirtualFilesystem method) map_dirs() (in module dissect.target.loaders.dir) map_esxi_drives() (in module dissect.target.loaders.local) map_file() (dissect.target.filesystem.VirtualFilesystem method) map_file_entry() (dissect.target.filesystem.VirtualFilesystem method) map_file_fh() (dissect.target.filesystem.VirtualFilesystem method) map_file_from_tar() (dissect.target.filesystem.VirtualFilesystem method) map_fs() (dissect.target.filesystem.VirtualFilesystem method) map_hive() (dissect.target.helpers.regutil.VirtualHive method) map_key() (dissect.target.helpers.regutil.VirtualHive method) map_linux_drives() (in module dissect.target.loaders.local) map_solaris_drives() (in module dissect.target.loaders.local) map_string() (in module dissect.database.ese.lcmapstring) map_type (dissect.cim.CIM attribute) (dissect.cim.cim.CIM attribute) map_value() (dissect.target.helpers.regutil.VirtualHive method) map_windows_drives() (in module dissect.target.loaders.local) map_windows_mounted_drives() (in module dissect.target.loaders.local) MapFlags (class in dissect.database.ese.lcmapstring) MapNetworkDriveMRURecord (in module dissect.target.plugins.os.windows.regf.mru) MappedCompressedFile (class in dissect.target.filesystem) MappedFile (class in dissect.target.filesystem) Mapping (class in dissect.cim.mappings) mapping (dissect.cim.mappings.Mapping attribute) (dissect.eventlog.bxml.Template attribute) (dissect.thumbcache.Thumbcache property) (dissect.thumbcache.thumbcache.Thumbcache property) MAPPING_FILE_CLEAN (in module dissect.cim.c_cim) MAPPING_PAGE_ID_MASK (in module dissect.cim.c_cim) MAPPING_PAGE_UNAVAIL (in module dissect.cim.c_cim) MappingEntry (class in dissect.cim.mappings) MAPPINGS (dissect.target.plugins.os.windows.registry.RegistryPlugin attribute) mappings() (dissect.target.plugins.os.windows.registry.RegistryPlugin method) MappingStream (class in dissect.util.stream) MAPS_WEVT_TYPE (class in dissect.eventlog.wevt) mark_as_finished() (dissect.target.tools.dump.DumpState method) Marker (class in dissect.etl.headers.headers) marker (dissect.etl.headers.headers.Header property) (dissect.etl.headers.headers.Marker attribute) Marker (dissect.target.helpers.regutil.RegistryKey attribute) MARKER_INFECTION (dissect.target.plugins.apps.av.mcafee.McAfeePlugin attribute) (dissect.target.plugins.apps.av.sophos.SophosPlugin attribute) (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) MARKER_MASK (dissect.etl.headers.headers.Marker attribute) MARKER_SUSPICIOUS_TCP_CONNECTION (dissect.target.plugins.apps.av.mcafee.McAfeePlugin attribute) MARKER_SUSPICIOUS_UDP_CONNECTION (dissect.target.plugins.apps.av.mcafee.McAfeePlugin attribute) mask (dissect.ntfs.ACE attribute) (dissect.ntfs.secure.ACE attribute) (dissect.util.compression.lzxpress_huffman.BitString attribute) (flow.record.fieldtypes.net.ipv4.subnet attribute) mask() (in module dissect.fat.fat) master_key_def (in module dissect.target.plugins.os.windows.dpapi.master_key) master_keys (dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin property) MasterKey (class in dissect.target.plugins.os.windows.dpapi.master_key) MasterKeyFile (class in dissect.target.plugins.os.windows.dpapi.master_key) Match (class in dissect.ntfs.index) match (dissect.cstruct.parser.Token attribute) match() (dissect.cstruct.expression.ExpressionTokenizer method) (flow.record.selector.CompiledSelector method) (flow.record.selector.Selector method) MATCH_MAP (in module dissect.target.helpers.configutil) match_record_with_context() (in module flow.record.context) matched (flow.record.context.AppContext attribute) matcher (flow.record.selector.Selector attribute) matches() (flow.record.selector.RecordContextMatcher method) matrix() (in module dissect.target.helpers.cyber) MATRIX_CHARS (in module dissect.target.helpers.cyber) MATRIX_FRAME_DELAY (in module dissect.target.helpers.cyber) MATRIX_MAX_CASCADES (in module dissect.target.helpers.cyber) MATRIX_MAX_COLS (in module dissect.target.helpers.cyber) MATRIX_MAX_SPEED (in module dissect.target.helpers.cyber) MATRIX_REVEAL_SECONDS (in module dissect.target.helpers.cyber) max_age (dissect.volume.lvm.metadata.WriteCacheSegment attribute) MAX_BLOCK_TABLE_SIZE (in module dissect.evidence.asdf.asdf) MAX_COUNT (dissect.target.helpers.nfs.client.mount.Client attribute) (dissect.target.helpers.nfs.client.nfs.Client attribute) max_count (dissect.target.helpers.nfs.nfs3.ReadDirPlusParams attribute) max_degraded (dissect.volume.raid.stream.RAID456Stream attribute) max_discard (dissect.volume.lvm.metadata.VdoPoolSegment attribute) max_entries (dissect.hypervisor.disk.vhd.BlockAllocationTable attribute) (dissect.volume.dm.btree.Node attribute) MAX_ENTRIES_PER_TABLE (dissect.archive.vbk.FibMetaSparseTable attribute) MAX_FILE_SIZE_BYTES (acquire.acquire.acquire.FileHashes attribute) MAX_IDX (in module dissect.evidence.asdf.asdf) MAX_IMM_OFFSET (in module dissect.thumbcache.index) max_lv (dissect.volume.lvm.metadata.VolumeGroup attribute) MAX_OPEN_SEGMENTS (in module dissect.evidence.ewf) max_payload_size (dissect.database.sqlite3.sqlite3.Cell attribute) max_pv (dissect.volume.lvm.metadata.VolumeGroup attribute) MAX_READ_LENGTH (in module dissect.util.compression.lzo) MAX_RECONNECTS (dissect.target.loaders.remote.RemoteStreamConnection attribute) max_recovery_rate (dissect.volume.lvm.metadata.RAIDSegment attribute) max_retries (flow.record.adapter.elastic.ElasticWriter attribute) MAX_SHORT_READS (dissect.target.loaders.remote.RemoteStreamConnection attribute) max_size (dissect.hypervisor.disk.asif.ASIF attribute) MAX_STATES (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) MAXSIZE (dissect.target.helpers.nfs.nfs3.CookieVerf attribute) (dissect.target.helpers.nfs.nfs3.FileHandle attribute) maxsplit (dissect.target.helpers.configutil.CSVish attribute) MB (in module dissect.hypervisor.disk.c_vhdx) MBR (class in dissect.volume.disk.schemes) (class in dissect.volume.disk.schemes.mbr) mbr (dissect.volume.disk.schemes.GPT attribute) (dissect.volume.disk.schemes.gpt.GPT attribute) (dissect.volume.disk.schemes.MBR attribute) (dissect.volume.disk.schemes.mbr.MBR attribute) mbr_def (in module dissect.volume.disk.schemes.mbr) McAfeeMscFirewallRecord (in module dissect.target.plugins.apps.av.mcafee) McAfeeMscLogRecord (in module dissect.target.plugins.apps.av.mcafee) McAfeePlugin (class in dissect.target.plugins.apps.av.mcafee) MD (class in dissect.volume.md) (class in dissect.volume.md.md) md (dissect.target.volumes.md.MdVolumeSystem attribute) (in module dissect.target.volume) MD5 (acquire.acquire.hashes.HashFunc attribute) md5 (flow.record.fieldtypes.digest property) md5() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (in module dissect.target.helpers.hashutil) md_alignment (dissect.vmfs.VMFS attribute) (dissect.vmfs.vmfs.VMFS attribute) md_def (in module dissect.volume.md.c_md) mdb_paths (dissect.target.plugins.os.windows.ual.UalPlugin attribute) MDConfiguration (class in dissect.volume.md.md) MDError MDPhysicalDisk (class in dissect.volume.md) (class in dissect.volume.md.md) MDVirtualDisk (class in dissect.volume.md.md) MdVolumeSystem (class in dissect.target.volumes.md) MediaKeybag (class in dissect.apfs.objects.keybag) MEDIAMAILOVERIP (dissect.target.plugins.os.windows.network.IfTypes attribute) mem_scheme (acquire.acquire.esxi.EsxiMemoryManager attribute) members() (dissect.evidence.asdf.asdf.Metadata method) memory (dissect.fve.luks.metadata.KeyslotKdf attribute) memory_size (dissect.executable.elf.elf.Segment attribute) (dissect.executable.elf.Segment attribute) menu (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) merge (dissect.volume.lvm.metadata.ThinSegment attribute) merge() (dissect.target.helpers.configutil.ConfigurationParser method) (in module dissect.fve.luks.af) merge_record_descriptors() (in module flow.record.base) merging_store (dissect.volume.lvm.metadata.SnapshotSegment attribute) MERIT_INP (dissect.target.helpers.network.IANAProtocol attribute) Message (class in dissect.target.helpers.sunrpc.sunrpc) message (dissect.target.helpers.nfs.client.mount.MountError attribute) (dissect.target.helpers.nfs.client.nfs.NfsError attribute) message() (acquire.acquire.gui.base.GUI method) (acquire.acquire.gui.base.Stub method) (acquire.acquire.gui.win32.Win32 method) MESSAGE_FLAGS (dissect.etl.headers.headers.Marker attribute) message_table (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) messages() (dissect.target.plugins.os.unix.log.messages.MessagesPlugin method) MessageSerializer (class in dissect.target.helpers.sunrpc.serializer) MessagesPlugin (class in dissect.target.plugins.os.unix.log.messages) MessagesRecord (in module dissect.target.plugins.os.unix.log.messages) MessageTraceHeader (class in dissect.etl.headers.headers) MessageType (class in dissect.target.helpers.sunrpc.serializer) meta (dissect.evidence.ad1.FileEntry attribute) meta_dev (dissect.volume.lvm.metadata.IntegritySegment attribute) meta_uuid (dissect.xfs.XFS attribute) (dissect.xfs.xfs.XFS attribute) MetaBase (class in dissect.volume.lvm.metadata) MetaBlob (class in dissect.archive.vbk) metablocks (dissect.clfs.blf.BLF attribute) Metadata (class in dissect.evidence.asdf.asdf) (class in dissect.fve.luks.metadata) (class in dissect.volume.dm.thin) metadata (dissect.evidence.asdf.asdf.AsdfSnapshot attribute) (dissect.evidence.asdf.AsdfSnapshot attribute) (dissect.evidence.AsdfSnapshot attribute) (dissect.executable.pe.directory.com_descriptor.ComDescriptorDirectory property) (dissect.executable.pe.directory.com_descriptor.ComMetadata property) (dissect.executable.pe.directory.com_descriptor.ComStream attribute) (dissect.executable.pe.directory.ComDescriptorDirectory property) (dissect.hypervisor.disk.asif.ASIF attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) (dissect.target.loaders.itunes.FileInfo attribute) (dissect.target.loaders.res.UPF attribute) (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntry attribute) (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntryResource attribute) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.vmfs.Device attribute) (dissect.vmfs.FileDescriptor property) (dissect.vmfs.lvm.Device attribute) (dissect.vmfs.resource.ResourceFile attribute) (dissect.volume.dm.thin.ThinPool attribute) (dissect.volume.lvm.LVM2 attribute) (dissect.volume.lvm.lvm2.LVM2 attribute) (dissect.volume.lvm.LVM2Device property) (dissect.volume.lvm.metadata.CachePoolSegment attribute) (dissect.volume.lvm.metadata.ThinPoolSegment attribute) (dissect.volume.lvm.physical.LVM2Device property) METADATA_BASE (acquire.acquire.collector.Collector attribute) metadata_block_size (dissect.volume.dm.thin.Metadata attribute) metadata_copies (dissect.volume.lvm.metadata.VolumeGroup attribute) metadata_fh (dissect.volume.dm.thin.ThinPool attribute) metadata_fields (flow.record.adapter.elastic.ElasticWriter attribute) metadata_format (dissect.volume.lvm.metadata.CachePoolSegment attribute) (dissect.volume.lvm.metadata.CacheSegment attribute) metadata_header (dissect.hypervisor.disk.asif.ASIF attribute) metadata_id (dissect.volume.lvm.metadata.CacheSegment attribute) metadata_len (dissect.volume.lvm.metadata.CacheSegment attribute) METADATA_MAP (dissect.hypervisor.disk.vhdx.MetadataTable attribute) metadata_only (dissect.volume.lvm.metadata.WriteCacheSegment attribute) METADATA_PREFIX (dissect.target.loaders.asdf.AsdfLoader attribute) METADATA_REGION_GUID (in module dissect.hypervisor.disk.c_vhdx) metadata_start (dissect.volume.lvm.metadata.CacheSegment attribute) metadata_uuid (dissect.btrfs.Btrfs attribute) (dissect.btrfs.btrfs.Btrfs attribute) MetadataTable (class in dissect.hypervisor.disk.vhdx) MetaItem (class in dissect.archive.vbk) MetaTableDescriptor (class in dissect.archive.vbk) MetaType (class in dissect.cstruct) (class in dissect.cstruct.types) (class in dissect.cstruct.types.base) (in module dissect.evidence.ad1) MetaVector (class in dissect.archive.vbk) MetaVector2 (class in dissect.archive.vbk) method_data (dissect.cim.classes.ClassDefinition attribute) method_name (dissect.target.plugin.FunctionDescriptor attribute) metrics (dissect.target.plugins.os.windows.prefetch.Prefetch attribute) MF_SIGLINK (dissect.target.plugins.os.windows.network.IfTypes attribute) MFE_NSP (dissect.target.helpers.network.IANAProtocol attribute) Mft (class in dissect.ntfs) (class in dissect.ntfs.mft) mft (dissect.ntfs.NTFS attribute) (dissect.ntfs.ntfs.NTFS attribute) mft_timeline() (dissect.target.plugins.filesystem.ntfs.mft_timeline.MftTimelinePlugin method) MftNotAvailableError MftPlugin (class in dissect.target.plugins.filesystem.ntfs.mft) MftRecord (class in dissect.ntfs) (class in dissect.ntfs.mft) MftTimelinePlugin (class in dissect.target.plugins.filesystem.ntfs.mft_timeline) MICP (dissect.target.helpers.network.IANAProtocol attribute) MIN_BITMAPS_SIZE (dissect.target.plugins.os.windows.regf.cit.BaseUseData attribute) (dissect.target.plugins.os.windows.regf.cit.SystemData attribute) MIN_IPV4 (dissect.target.helpers.network.IANAProtocol attribute) min_payload_size (dissect.database.sqlite3.sqlite3.Cell attribute) min_recovery_rate (dissect.volume.lvm.metadata.RAIDSegment attribute) MIN_SPAN_STATS_SIZE (dissect.target.plugins.os.windows.regf.cit.BaseUseData attribute) (dissect.target.plugins.os.windows.regf.cit.SystemData attribute) MIN_STATS_SIZE (dissect.target.plugins.os.windows.regf.cit.BaseUseData attribute) (dissect.target.plugins.os.windows.regf.cit.SystemData attribute) mini_cutoff (dissect.ole.OLE attribute) (dissect.ole.ole.OLE attribute) mini_sector_size (dissect.ole.OLE attribute) (dissect.ole.ole.OLE attribute) MiniChain (class in dissect.ole.ole) minichain() (dissect.ole.OLE method) (dissect.ole.ole.OLE method) minifat() (dissect.ole.OLE method) (dissect.ole.ole.OLE method) MINIMAL (acquire.acquire.acquire.BsdProfile attribute) (acquire.acquire.acquire.ESXiProfile attribute) (acquire.acquire.acquire.LinuxProfile attribute) (acquire.acquire.acquire.MacOSProfile attribute) (acquire.acquire.acquire.ProxmoxProfile attribute) (acquire.acquire.acquire.WindowsProfile attribute) minimal_size (dissect.etl.headers.event.EventHeader property) (dissect.etl.headers.headers.ErrorHeader property) (dissect.etl.headers.headers.EventInstanceGUIDHeader property) (dissect.etl.headers.headers.EventInstanceHeader property) (dissect.etl.headers.headers.EventTraceHeader property) (dissect.etl.headers.headers.Header property) (dissect.etl.headers.headers.MessageTraceHeader property) (dissect.etl.headers.logfile.LogfileHeader property) (dissect.etl.headers.system.SystemSpecificHeader property) MINIMAL_SIZE (dissect.fve.bde.information.Datum attribute) minimum_io_size (dissect.volume.lvm.metadata.VdoPoolSegment attribute) MinIO (class in acquire.acquire.uploaders.minio) ministream (dissect.ole.OLE attribute) (dissect.ole.ole.OLE attribute) minor (dissect.cramfs.cramfs.INode property) (dissect.cramfs.INode property) (dissect.squashfs.SquashFS attribute) (dissect.squashfs.squashfs.SquashFS attribute) minor_version (dissect.vmfs.Device attribute) (dissect.vmfs.lvm.Device attribute) (dissect.vmfs.VMFS attribute) (dissect.vmfs.vmfs.VMFS attribute) minutes_duration_to_iso() (dissect.target.plugins.os.windows.tasks.job.AtTask method) MIO_X25 (dissect.target.plugins.os.windows.network.IfTypes attribute) mirror_count (dissect.volume.lvm.metadata.MirrorSegment attribute) mirror_log (dissect.volume.lvm.metadata.MirrorSegment attribute) mirrors (dissect.volume.lvm.metadata.MirrorSegment attribute) MirrorSegment (class in dissect.volume.lvm.metadata) Misc (class in acquire.acquire.acquire) misc_macos_user_homes() (in module acquire.acquire.acquire) MISC_MAPPING (in module acquire.acquire.acquire) misc_unix_user_homes() (in module acquire.acquire.acquire) misc_user_paths() (dissect.target.plugin.OSPlugin method) (dissect.target.plugins.os.default._os.DefaultOSPlugin method) (dissect.target.plugins.os.unix._os.UnixPlugin method) (dissect.target.plugins.os.unix.bsd.darwin._os.DarwinPlugin method) (dissect.target.plugins.os.windows._os.WindowsPlugin method) misc_windows_user_homes() (in module acquire.acquire.acquire) Mismatch (class in dissect.target.helpers.sunrpc.sunrpc) MismatchXidError MISSING (acquire.acquire.collector.Outcome attribute) mix64() (in module dissect.target.plugins.os.unix.esxi._os) mkdir() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) mkfs_time (dissect.squashfs.SquashFS attribute) (dissect.squashfs.squashfs.SquashFS attribute) mkts() (in module dissect.target.plugins.os.windows.activitiescache) mkversion (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) MLocate (class in dissect.target.plugins.os.unix.locate.mlocate) mlocate_def (in module dissect.target.plugins.os.unix.locate.mlocate) MLocateFile (class in dissect.target.plugins.os.unix.locate.mlocate) MLocatePlugin (class in dissect.target.plugins.os.unix.locate.mlocate) MLocateRecord (in module dissect.target.plugins.os.unix.locate.mlocate) MOBILITY_HEADER (dissect.target.helpers.network.IANAProtocol attribute) ModBoundGuid (in module dissect.etl.utils) mode (dissect.apfs.objects.fs.INode property) (dissect.btrfs.btrfs.INode property) (dissect.btrfs.INode property) (dissect.cramfs.cramfs.INode property) (dissect.cramfs.INode property) (dissect.database.bsd.tools.rpm.PackageEntry attribute) (dissect.ffs.ffs.INode property) (dissect.fve.luks.metadata.Keyslot attribute) (dissect.hypervisor.util.envelope.KeyStore attribute) (dissect.jffs.jffs2.INode property) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx6.INode6 property) (dissect.squashfs.INode property) (dissect.squashfs.squashfs.INode property) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) (dissect.target.loaders.itunes.FileInfo property) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.vmfs.FileDescriptor property) (dissect.volume.lvm.metadata.IntegritySegment attribute) model (dissect.target.loaders.cellebrite.DeviceInfo attribute) MODEM (dissect.target.plugins.os.windows.network.IfTypes attribute) modification_time (dissect.target.plugins.os.windows.regf.shellbags.FILE_ENTRY property) (dissect.target.plugins.os.windows.regf.shellbags.MTP_FILE_ENTRY property) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM property) (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN_0x74 property) modified (dissect.target.tools.diff.DirectoryDifferential attribute) modified_by (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) Modifier (class in dissect.target.helpers.record_modifier) ModifierFunc (in module dissect.target.helpers.record_modifier) MODPATH (in module dissect.etl.manifest) module acquire.acquire acquire.acquire.acquire acquire.acquire.collector acquire.acquire.crypt acquire.acquire.dynamic acquire.acquire.dynamic.windows acquire.acquire.dynamic.windows.collect acquire.acquire.dynamic.windows.exceptions acquire.acquire.dynamic.windows.handles acquire.acquire.dynamic.windows.named_objects acquire.acquire.dynamic.windows.ntdll acquire.acquire.dynamic.windows.types acquire.acquire.esxi acquire.acquire.gui acquire.acquire.gui.base acquire.acquire.gui.win32 acquire.acquire.hashes acquire.acquire.log acquire.acquire.outputs acquire.acquire.outputs.base acquire.acquire.outputs.dir acquire.acquire.outputs.tar acquire.acquire.outputs.zip acquire.acquire.tools acquire.acquire.tools.decrypter acquire.acquire.uploaders acquire.acquire.uploaders.minio acquire.acquire.uploaders.plugin acquire.acquire.uploaders.plugin_registry acquire.acquire.utils acquire.acquire.volatilestream codestyle dissect.apfs dissect.apfs.apfs dissect.apfs.c_apfs dissect.apfs.cursor dissect.apfs.exception dissect.apfs.objects dissect.apfs.objects.base dissect.apfs.objects.btree dissect.apfs.objects.btree_node dissect.apfs.objects.checkpoint_map dissect.apfs.objects.efi_jumpstart dissect.apfs.objects.er_recovery_block dissect.apfs.objects.er_state dissect.apfs.objects.fs dissect.apfs.objects.gbitmap dissect.apfs.objects.gbitmap_block dissect.apfs.objects.integrity_meta dissect.apfs.objects.keybag dissect.apfs.objects.nx_fusion_wbc dissect.apfs.objects.nx_fusion_wbc_list dissect.apfs.objects.nx_reap_list dissect.apfs.objects.nx_reaper dissect.apfs.objects.nx_superblock dissect.apfs.objects.omap dissect.apfs.objects.snap_meta_ext dissect.apfs.objects.spaceman dissect.apfs.objects.spaceman_bitmap dissect.apfs.objects.spaceman_cab dissect.apfs.objects.spaceman_cib dissect.apfs.stream dissect.apfs.util dissect.archive dissect.archive.c_vbk dissect.archive.c_vma dissect.archive.c_wim dissect.archive.exceptions dissect.archive.tools dissect.archive.tools.backup dissect.archive.vbk dissect.archive.vma dissect.archive.wim dissect.archive.xva dissect.btrfs dissect.btrfs.btrfs dissect.btrfs.c_btrfs dissect.btrfs.exceptions dissect.btrfs.stream dissect.btrfs.tree dissect.cim dissect.cim.c_cim dissect.cim.cim dissect.cim.classes dissect.cim.exceptions dissect.cim.index dissect.cim.mappings dissect.cim.objects dissect.cim.utils dissect.clfs dissect.clfs.blf dissect.clfs.c_clfs dissect.clfs.container dissect.clfs.exceptions dissect.cramfs dissect.cramfs.c_cramfs dissect.cramfs.cramfs dissect.cramfs.exception dissect.cstruct dissect.cstruct.bitbuffer dissect.cstruct.compiler dissect.cstruct.cstruct dissect.cstruct.exceptions dissect.cstruct.expression dissect.cstruct.parser dissect.cstruct.tools dissect.cstruct.tools.stubgen dissect.cstruct.types dissect.cstruct.types.base dissect.cstruct.types.char dissect.cstruct.types.enum dissect.cstruct.types.flag dissect.cstruct.types.int dissect.cstruct.types.leb128 dissect.cstruct.types.packed dissect.cstruct.types.pointer dissect.cstruct.types.structure dissect.cstruct.types.void dissect.cstruct.types.wchar dissect.cstruct.utils dissect.database dissect.database.bsd dissect.database.bsd.c_db dissect.database.bsd.db dissect.database.bsd.tools dissect.database.bsd.tools.c_rpm dissect.database.bsd.tools.rpm dissect.database.ese dissect.database.ese.btree dissect.database.ese.c_ese dissect.database.ese.compression dissect.database.ese.cursor dissect.database.ese.ese dissect.database.ese.exception dissect.database.ese.index dissect.database.ese.lcmapstring dissect.database.ese.page dissect.database.ese.record dissect.database.ese.sorting_table dissect.database.ese.table dissect.database.ese.tools dissect.database.ese.tools.certlog dissect.database.ese.tools.impacket dissect.database.ese.tools.sru dissect.database.ese.tools.ual dissect.database.ese.util dissect.database.exception dissect.database.sqlite3 dissect.database.sqlite3.c_sqlite3 dissect.database.sqlite3.exception dissect.database.sqlite3.sqlite3 dissect.database.sqlite3.util dissect.etl dissect.etl.c_etl dissect.etl.etl dissect.etl.exceptions dissect.etl.headers dissect.etl.headers.event dissect.etl.headers.headers dissect.etl.headers.logfile dissect.etl.headers.system dissect.etl.headers.utils dissect.etl.manifest dissect.etl.manifests dissect.etl.utils dissect.eventlog dissect.eventlog.bxml dissect.eventlog.evt dissect.eventlog.evtx dissect.eventlog.exceptions dissect.eventlog.utils dissect.eventlog.wevt dissect.eventlog.wevt_object dissect.eventlog.wevtutil dissect.evidence dissect.evidence.ad1 dissect.evidence.aff4 dissect.evidence.asdf dissect.evidence.asdf.asdf dissect.evidence.asdf.streams dissect.evidence.ewf dissect.evidence.exceptions dissect.evidence.tools dissect.evidence.tools.asdf dissect.evidence.tools.asdf.dd dissect.evidence.tools.asdf.meta dissect.evidence.tools.asdf.repair dissect.evidence.tools.asdf.verify dissect.executable dissect.executable.elf dissect.executable.elf.c_elf dissect.executable.elf.elf dissect.executable.exception dissect.executable.macho dissect.executable.pe dissect.executable.pe.c_pe dissect.executable.pe.directory dissect.executable.pe.directory.base dissect.executable.pe.directory.basereloc dissect.executable.pe.directory.bound_import dissect.executable.pe.directory.com_descriptor dissect.executable.pe.directory.debug dissect.executable.pe.directory.delay_import dissect.executable.pe.directory.exception dissect.executable.pe.directory.export dissect.executable.pe.directory.iat dissect.executable.pe.directory.imports dissect.executable.pe.directory.load_config dissect.executable.pe.directory.resource dissect.executable.pe.directory.security dissect.executable.pe.directory.tls dissect.executable.pe.locale_id dissect.executable.pe.pe dissect.extfs dissect.extfs.c_ext dissect.extfs.c_jdb2 dissect.extfs.exceptions dissect.extfs.extfs dissect.extfs.journal dissect.fat dissect.fat.c_exfat dissect.fat.c_fat dissect.fat.exceptions dissect.fat.exfat dissect.fat.fat dissect.ffs dissect.ffs.c_ffs dissect.ffs.exceptions dissect.ffs.ffs dissect.fve dissect.fve.bde dissect.fve.bde.bde dissect.fve.bde.c_bde dissect.fve.bde.eow dissect.fve.bde.information dissect.fve.bde.key dissect.fve.crypto dissect.fve.crypto.argon2 dissect.fve.crypto.base dissect.fve.crypto.dmcrypt dissect.fve.crypto.elephant dissect.fve.crypto.util dissect.fve.exception dissect.fve.luks dissect.fve.luks.af dissect.fve.luks.c_luks dissect.fve.luks.luks dissect.fve.luks.metadata dissect.fve.tools dissect.fve.tools.dd dissect.hypervisor dissect.hypervisor.descriptor dissect.hypervisor.descriptor.c_hyperv dissect.hypervisor.descriptor.hyperv dissect.hypervisor.descriptor.ovf dissect.hypervisor.descriptor.pvs dissect.hypervisor.descriptor.vbox dissect.hypervisor.descriptor.vmx dissect.hypervisor.disk dissect.hypervisor.disk.asif dissect.hypervisor.disk.c_asif dissect.hypervisor.disk.c_hdd dissect.hypervisor.disk.c_qcow2 dissect.hypervisor.disk.c_vdi dissect.hypervisor.disk.c_vhd dissect.hypervisor.disk.c_vhdx dissect.hypervisor.disk.c_vmdk dissect.hypervisor.disk.hdd dissect.hypervisor.disk.qcow2 dissect.hypervisor.disk.vdi dissect.hypervisor.disk.vhd dissect.hypervisor.disk.vhdx dissect.hypervisor.disk.vmdk dissect.hypervisor.exceptions dissect.hypervisor.tools dissect.hypervisor.tools.envelope dissect.hypervisor.tools.vmtar dissect.hypervisor.util dissect.hypervisor.util.envelope dissect.hypervisor.util.vmtar dissect.jffs dissect.jffs.c_jffs2 dissect.jffs.exceptions dissect.jffs.jffs2 dissect.ntfs dissect.ntfs.attr dissect.ntfs.c_ntfs dissect.ntfs.exceptions dissect.ntfs.index dissect.ntfs.mft dissect.ntfs.ntfs dissect.ntfs.secure dissect.ntfs.stream dissect.ntfs.usnjrnl dissect.ntfs.util dissect.ole dissect.ole.c_ole dissect.ole.exceptions dissect.ole.ole dissect.qnxfs dissect.qnxfs.c_qnx4 dissect.qnxfs.c_qnx6 dissect.qnxfs.exceptions dissect.qnxfs.qnx4 dissect.qnxfs.qnx6 dissect.qnxfs.qnxfs dissect.regf dissect.regf.c_regf dissect.regf.exceptions dissect.regf.regf dissect.shellitem dissect.shellitem.lnk dissect.shellitem.lnk.c_lnk dissect.shellitem.lnk.lnk dissect.shellitem.tools dissect.shellitem.tools.lnk dissect.squashfs dissect.squashfs.c_squashfs dissect.squashfs.compression dissect.squashfs.exceptions dissect.squashfs.squashfs dissect.target dissect.target.container dissect.target.containers dissect.target.containers.asdf dissect.target.containers.asif dissect.target.containers.ewf dissect.target.containers.fortifw dissect.target.containers.hdd dissect.target.containers.hds dissect.target.containers.qcow2 dissect.target.containers.raw dissect.target.containers.split dissect.target.containers.vdi dissect.target.containers.vhd dissect.target.containers.vhdx dissect.target.containers.vmdk dissect.target.exceptions dissect.target.filesystem dissect.target.filesystems dissect.target.filesystems.ad1 dissect.target.filesystems.btrfs dissect.target.filesystems.cb dissect.target.filesystems.config dissect.target.filesystems.cpio dissect.target.filesystems.cramfs dissect.target.filesystems.dir dissect.target.filesystems.exfat dissect.target.filesystems.extfs dissect.target.filesystems.fat dissect.target.filesystems.ffs dissect.target.filesystems.itunes dissect.target.filesystems.jffs dissect.target.filesystems.nfs dissect.target.filesystems.ntfs dissect.target.filesystems.overlay dissect.target.filesystems.qnxfs dissect.target.filesystems.smb dissect.target.filesystems.squashfs dissect.target.filesystems.tar dissect.target.filesystems.vbk dissect.target.filesystems.vmfs dissect.target.filesystems.vmtar dissect.target.filesystems.xfs dissect.target.filesystems.zip dissect.target.helpers dissect.target.helpers.cache dissect.target.helpers.compat dissect.target.helpers.compat.path_310 dissect.target.helpers.compat.path_311 dissect.target.helpers.compat.path_312 dissect.target.helpers.compat.path_313 dissect.target.helpers.compat.path_common dissect.target.helpers.config dissect.target.helpers.configutil dissect.target.helpers.cyber dissect.target.helpers.descriptor_extensions dissect.target.helpers.docs dissect.target.helpers.fsutil dissect.target.helpers.hashutil dissect.target.helpers.keychain dissect.target.helpers.lazy dissect.target.helpers.loaderutil dissect.target.helpers.localeutil dissect.target.helpers.logging dissect.target.helpers.mount dissect.target.helpers.mui dissect.target.helpers.network dissect.target.helpers.nfs dissect.target.helpers.nfs.client dissect.target.helpers.nfs.client.mount dissect.target.helpers.nfs.client.nfs dissect.target.helpers.nfs.nfs3 dissect.target.helpers.nfs.serializer dissect.target.helpers.polypath dissect.target.helpers.protobuf dissect.target.helpers.record dissect.target.helpers.record_modifier dissect.target.helpers.regex dissect.target.helpers.regex.ipaddress dissect.target.helpers.regutil dissect.target.helpers.scrape dissect.target.helpers.shell_application_ids dissect.target.helpers.shell_folder_ids dissect.target.helpers.sunrpc dissect.target.helpers.sunrpc.client dissect.target.helpers.sunrpc.serializer dissect.target.helpers.sunrpc.sunrpc dissect.target.helpers.utils dissect.target.loader dissect.target.loaders dissect.target.loaders.ab dissect.target.loaders.acquire dissect.target.loaders.asdf dissect.target.loaders.cb dissect.target.loaders.cellebrite dissect.target.loaders.containerimage dissect.target.loaders.cyber dissect.target.loaders.dir dissect.target.loaders.direct dissect.target.loaders.hyperv dissect.target.loaders.itunes dissect.target.loaders.kape dissect.target.loaders.libvirt dissect.target.loaders.local dissect.target.loaders.log dissect.target.loaders.mqtt dissect.target.loaders.multiraw dissect.target.loaders.ova dissect.target.loaders.overlay dissect.target.loaders.overlay2 dissect.target.loaders.ovf dissect.target.loaders.phobos dissect.target.loaders.profile dissect.target.loaders.proxmox dissect.target.loaders.pvm dissect.target.loaders.pvs dissect.target.loaders.raw dissect.target.loaders.remote dissect.target.loaders.res dissect.target.loaders.smb dissect.target.loaders.tanium dissect.target.loaders.tar dissect.target.loaders.target dissect.target.loaders.uac dissect.target.loaders.utm dissect.target.loaders.vb dissect.target.loaders.vbk dissect.target.loaders.vbox dissect.target.loaders.velociraptor dissect.target.loaders.vma dissect.target.loaders.vmwarevm dissect.target.loaders.vmx dissect.target.loaders.xva dissect.target.loaders.zip dissect.target.plugin dissect.target.plugins dissect.target.plugins.apps dissect.target.plugins.apps.av dissect.target.plugins.apps.av.mcafee dissect.target.plugins.apps.av.sophos dissect.target.plugins.apps.av.symantec dissect.target.plugins.apps.av.trendmicro dissect.target.plugins.apps.browser dissect.target.plugins.apps.browser.brave dissect.target.plugins.apps.browser.browser dissect.target.plugins.apps.browser.chrome dissect.target.plugins.apps.browser.chromium dissect.target.plugins.apps.browser.edge dissect.target.plugins.apps.browser.firefox dissect.target.plugins.apps.browser.iexplore dissect.target.plugins.apps.chat dissect.target.plugins.apps.chat.chat dissect.target.plugins.apps.chat.msn dissect.target.plugins.apps.container dissect.target.plugins.apps.container.container dissect.target.plugins.apps.container.docker dissect.target.plugins.apps.container.podman dissect.target.plugins.apps.editor dissect.target.plugins.apps.editor.editor dissect.target.plugins.apps.editor.windowsnotepad dissect.target.plugins.apps.edr dissect.target.plugins.apps.edr.acquire dissect.target.plugins.apps.edr.velociraptor dissect.target.plugins.apps.other dissect.target.plugins.apps.other.env dissect.target.plugins.apps.productivity dissect.target.plugins.apps.productivity.msoffice dissect.target.plugins.apps.productivity.sevenzip dissect.target.plugins.apps.productivity.winrar dissect.target.plugins.apps.remoteaccess dissect.target.plugins.apps.remoteaccess.anydesk dissect.target.plugins.apps.remoteaccess.remoteaccess dissect.target.plugins.apps.remoteaccess.rustdesk dissect.target.plugins.apps.remoteaccess.splashtop dissect.target.plugins.apps.remoteaccess.teamviewer dissect.target.plugins.apps.shell dissect.target.plugins.apps.shell.powershell dissect.target.plugins.apps.shell.wget dissect.target.plugins.apps.ssh dissect.target.plugins.apps.ssh.openssh dissect.target.plugins.apps.ssh.opensshd dissect.target.plugins.apps.ssh.putty dissect.target.plugins.apps.ssh.ssh dissect.target.plugins.apps.virtualization dissect.target.plugins.apps.virtualization.vmware_workstation dissect.target.plugins.apps.vpn dissect.target.plugins.apps.vpn.openvpn dissect.target.plugins.apps.vpn.wireguard dissect.target.plugins.apps.webhosting dissect.target.plugins.apps.webhosting.cpanel dissect.target.plugins.apps.webserver dissect.target.plugins.apps.webserver.apache dissect.target.plugins.apps.webserver.caddy dissect.target.plugins.apps.webserver.citrix dissect.target.plugins.apps.webserver.iis dissect.target.plugins.apps.webserver.nginx dissect.target.plugins.apps.webserver.webserver dissect.target.plugins.child dissect.target.plugins.child.colima dissect.target.plugins.child.docker dissect.target.plugins.child.esxi dissect.target.plugins.child.hyperv dissect.target.plugins.child.lima dissect.target.plugins.child.parallels dissect.target.plugins.child.podman dissect.target.plugins.child.proxmox dissect.target.plugins.child.qemu dissect.target.plugins.child.virtualbox dissect.target.plugins.child.virtuozzo dissect.target.plugins.child.vmware_workstation dissect.target.plugins.child.wsl dissect.target.plugins.filesystem dissect.target.plugins.filesystem.icat dissect.target.plugins.filesystem.ntfs dissect.target.plugins.filesystem.ntfs.mft dissect.target.plugins.filesystem.ntfs.mft_timeline dissect.target.plugins.filesystem.ntfs.usnjrnl dissect.target.plugins.filesystem.ntfs.utils dissect.target.plugins.filesystem.resolver dissect.target.plugins.filesystem.unix dissect.target.plugins.filesystem.unix.capability dissect.target.plugins.filesystem.unix.suid dissect.target.plugins.filesystem.walkfs dissect.target.plugins.filesystem.yara dissect.target.plugins.general dissect.target.plugins.general.config dissect.target.plugins.general.example dissect.target.plugins.general.loaders dissect.target.plugins.general.osinfo dissect.target.plugins.general.plugins dissect.target.plugins.general.users dissect.target.plugins.os dissect.target.plugins.os.default dissect.target.plugins.os.default._os dissect.target.plugins.os.default.datetime dissect.target.plugins.os.default.locale dissect.target.plugins.os.default.network dissect.target.plugins.os.unix dissect.target.plugins.os.unix._os dissect.target.plugins.os.unix.applications dissect.target.plugins.os.unix.bsd dissect.target.plugins.os.unix.bsd._os dissect.target.plugins.os.unix.bsd.citrix dissect.target.plugins.os.unix.bsd.citrix._os dissect.target.plugins.os.unix.bsd.citrix.history dissect.target.plugins.os.unix.bsd.darwin dissect.target.plugins.os.unix.bsd.darwin._os dissect.target.plugins.os.unix.bsd.darwin.ios dissect.target.plugins.os.unix.bsd.darwin.ios._os dissect.target.plugins.os.unix.bsd.darwin.ios.applications dissect.target.plugins.os.unix.bsd.darwin.ios.generic dissect.target.plugins.os.unix.bsd.darwin.ios.locale dissect.target.plugins.os.unix.bsd.darwin.macos dissect.target.plugins.os.unix.bsd.darwin.macos._os dissect.target.plugins.os.unix.bsd.darwin.macos.network dissect.target.plugins.os.unix.bsd.darwin.macos.user dissect.target.plugins.os.unix.bsd.freebsd dissect.target.plugins.os.unix.bsd.freebsd._os dissect.target.plugins.os.unix.bsd.openbsd dissect.target.plugins.os.unix.bsd.openbsd._os dissect.target.plugins.os.unix.cronjobs dissect.target.plugins.os.unix.datetime dissect.target.plugins.os.unix.esxi dissect.target.plugins.os.unix.esxi._os dissect.target.plugins.os.unix.etc dissect.target.plugins.os.unix.etc.etc dissect.target.plugins.os.unix.generic dissect.target.plugins.os.unix.history dissect.target.plugins.os.unix.linux dissect.target.plugins.os.unix.linux._os dissect.target.plugins.os.unix.linux.android dissect.target.plugins.os.unix.linux.android._os dissect.target.plugins.os.unix.linux.cmdline dissect.target.plugins.os.unix.linux.debian dissect.target.plugins.os.unix.linux.debian._os dissect.target.plugins.os.unix.linux.debian.apt dissect.target.plugins.os.unix.linux.debian.dpkg dissect.target.plugins.os.unix.linux.debian.proxmox dissect.target.plugins.os.unix.linux.debian.proxmox._os dissect.target.plugins.os.unix.linux.debian.proxmox.vm dissect.target.plugins.os.unix.linux.debian.snap dissect.target.plugins.os.unix.linux.debian.vyos dissect.target.plugins.os.unix.linux.debian.vyos._os dissect.target.plugins.os.unix.linux.environ dissect.target.plugins.os.unix.linux.fortios dissect.target.plugins.os.unix.linux.fortios._os dissect.target.plugins.os.unix.linux.fortios.generic dissect.target.plugins.os.unix.linux.fortios.locale dissect.target.plugins.os.unix.linux.iptables dissect.target.plugins.os.unix.linux.modules dissect.target.plugins.os.unix.linux.netstat dissect.target.plugins.os.unix.linux.network dissect.target.plugins.os.unix.linux.network_managers dissect.target.plugins.os.unix.linux.proc dissect.target.plugins.os.unix.linux.processes dissect.target.plugins.os.unix.linux.recentlyused dissect.target.plugins.os.unix.linux.redhat dissect.target.plugins.os.unix.linux.redhat._os dissect.target.plugins.os.unix.linux.redhat.yum dissect.target.plugins.os.unix.linux.services dissect.target.plugins.os.unix.linux.sockets dissect.target.plugins.os.unix.linux.suse dissect.target.plugins.os.unix.linux.suse._os dissect.target.plugins.os.unix.linux.suse.zypper dissect.target.plugins.os.unix.locale dissect.target.plugins.os.unix.locate dissect.target.plugins.os.unix.locate.gnulocate dissect.target.plugins.os.unix.locate.locate dissect.target.plugins.os.unix.locate.mlocate dissect.target.plugins.os.unix.locate.plocate dissect.target.plugins.os.unix.log dissect.target.plugins.os.unix.log.atop dissect.target.plugins.os.unix.log.audit dissect.target.plugins.os.unix.log.auth dissect.target.plugins.os.unix.log.helpers dissect.target.plugins.os.unix.log.journal dissect.target.plugins.os.unix.log.lastlog dissect.target.plugins.os.unix.log.messages dissect.target.plugins.os.unix.log.utmp dissect.target.plugins.os.unix.packagemanager dissect.target.plugins.os.unix.shadow dissect.target.plugins.os.unix.trash dissect.target.plugins.os.windows dissect.target.plugins.os.windows._os dissect.target.plugins.os.windows.activitiescache dissect.target.plugins.os.windows.adpolicy dissect.target.plugins.os.windows.amcache dissect.target.plugins.os.windows.cam dissect.target.plugins.os.windows.catroot dissect.target.plugins.os.windows.cim dissect.target.plugins.os.windows.clfs dissect.target.plugins.os.windows.credential dissect.target.plugins.os.windows.credential.credhist dissect.target.plugins.os.windows.credential.lsa dissect.target.plugins.os.windows.credential.sam dissect.target.plugins.os.windows.datetime dissect.target.plugins.os.windows.defender dissect.target.plugins.os.windows.defender.mplog dissect.target.plugins.os.windows.defender.quarantine dissect.target.plugins.os.windows.dpapi dissect.target.plugins.os.windows.dpapi.blob dissect.target.plugins.os.windows.dpapi.crypto dissect.target.plugins.os.windows.dpapi.dpapi dissect.target.plugins.os.windows.dpapi.keyprovider dissect.target.plugins.os.windows.dpapi.keyprovider.credhist dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.defaultpassword dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.lsa dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.winlogon dissect.target.plugins.os.windows.dpapi.keyprovider.empty dissect.target.plugins.os.windows.dpapi.keyprovider.keychain dissect.target.plugins.os.windows.dpapi.keyprovider.keyprovider dissect.target.plugins.os.windows.dpapi.master_key dissect.target.plugins.os.windows.env dissect.target.plugins.os.windows.everything dissect.target.plugins.os.windows.everything.parser dissect.target.plugins.os.windows.exchange dissect.target.plugins.os.windows.exchange.exchange dissect.target.plugins.os.windows.firewall dissect.target.plugins.os.windows.generic dissect.target.plugins.os.windows.jumplist dissect.target.plugins.os.windows.lnk dissect.target.plugins.os.windows.locale dissect.target.plugins.os.windows.log dissect.target.plugins.os.windows.log.amcache dissect.target.plugins.os.windows.log.etl dissect.target.plugins.os.windows.log.evt dissect.target.plugins.os.windows.log.evtx dissect.target.plugins.os.windows.log.mssql dissect.target.plugins.os.windows.log.pfro dissect.target.plugins.os.windows.log.schedlgu dissect.target.plugins.os.windows.network dissect.target.plugins.os.windows.notifications dissect.target.plugins.os.windows.prefetch dissect.target.plugins.os.windows.productkey dissect.target.plugins.os.windows.rdpcache dissect.target.plugins.os.windows.recyclebin dissect.target.plugins.os.windows.regf dissect.target.plugins.os.windows.regf.applications dissect.target.plugins.os.windows.regf.appxdebugkeys dissect.target.plugins.os.windows.regf.auditpol dissect.target.plugins.os.windows.regf.bam dissect.target.plugins.os.windows.regf.cit dissect.target.plugins.os.windows.regf.clsid dissect.target.plugins.os.windows.regf.mru dissect.target.plugins.os.windows.regf.muicache dissect.target.plugins.os.windows.regf.nethist dissect.target.plugins.os.windows.regf.recentfilecache dissect.target.plugins.os.windows.regf.regf dissect.target.plugins.os.windows.regf.runkeys dissect.target.plugins.os.windows.regf.shellbags dissect.target.plugins.os.windows.regf.shimcache dissect.target.plugins.os.windows.regf.trusteddocs dissect.target.plugins.os.windows.regf.usb dissect.target.plugins.os.windows.regf.userassist dissect.target.plugins.os.windows.registry dissect.target.plugins.os.windows.search dissect.target.plugins.os.windows.services dissect.target.plugins.os.windows.sru dissect.target.plugins.os.windows.startupinfo dissect.target.plugins.os.windows.syscache dissect.target.plugins.os.windows.tasks dissect.target.plugins.os.windows.tasks.job dissect.target.plugins.os.windows.tasks.records dissect.target.plugins.os.windows.tasks.xml dissect.target.plugins.os.windows.thumbcache dissect.target.plugins.os.windows.ual dissect.target.plugins.os.windows.wer dissect.target.plugins.os.windows.wua_history dissect.target.plugins.scrape dissect.target.plugins.scrape.qfind dissect.target.plugins.scrape.scrape dissect.target.target dissect.target.tools dissect.target.tools.build_pluginlist dissect.target.tools.dd dissect.target.tools.diff dissect.target.tools.dump dissect.target.tools.fs dissect.target.tools.info dissect.target.tools.mount dissect.target.tools.qfind dissect.target.tools.query dissect.target.tools.reg dissect.target.tools.shell dissect.target.tools.utils dissect.target.tools.utils.cli dissect.target.tools.utils.fs dissect.target.tools.utils.logging dissect.target.tools.utils.report dissect.target.tools.yara dissect.target.volume dissect.target.volumes dissect.target.volumes.bde dissect.target.volumes.ddf dissect.target.volumes.disk dissect.target.volumes.luks dissect.target.volumes.lvm dissect.target.volumes.md dissect.target.volumes.vmfs dissect.thumbcache dissect.thumbcache.c_thumbcache dissect.thumbcache.exceptions dissect.thumbcache.index dissect.thumbcache.thumbcache dissect.thumbcache.thumbcache_file dissect.thumbcache.tools dissect.thumbcache.tools.extract_images dissect.thumbcache.tools.extract_with_index dissect.thumbcache.tools.utils dissect.thumbcache.util dissect.util dissect.util.compression dissect.util.compression.lz4 dissect.util.compression.lzbitmap dissect.util.compression.lzfse dissect.util.compression.lznt1 dissect.util.compression.lzo dissect.util.compression.lzvn dissect.util.compression.lzxpress dissect.util.compression.lzxpress_huffman dissect.util.compression.sevenbit dissect.util.compression.xz dissect.util.cpio dissect.util.encoding dissect.util.encoding.surrogateescape dissect.util.exceptions dissect.util.hash dissect.util.hash.crc32 dissect.util.hash.crc32c dissect.util.hash.jenkins dissect.util.ldap dissect.util.plist dissect.util.sid dissect.util.stream dissect.util.tools dissect.util.tools.dump_nskeyedarchiver dissect.util.ts dissect.util.xmemoryview dissect.vmfs dissect.vmfs.address dissect.vmfs.c_lvm dissect.vmfs.c_vmfs dissect.vmfs.descriptor dissect.vmfs.exception dissect.vmfs.lvm dissect.vmfs.resource dissect.vmfs.util dissect.vmfs.vmfs dissect.volume dissect.volume.ddf dissect.volume.ddf.c_ddf dissect.volume.ddf.ddf dissect.volume.disk dissect.volume.disk.disk dissect.volume.disk.partition dissect.volume.disk.schemes dissect.volume.disk.schemes.apm dissect.volume.disk.schemes.bsd dissect.volume.disk.schemes.gpt dissect.volume.disk.schemes.mbr dissect.volume.dm dissect.volume.dm.btree dissect.volume.dm.c_dm dissect.volume.dm.thin dissect.volume.exceptions dissect.volume.ldm dissect.volume.lvm dissect.volume.lvm.c_lvm2 dissect.volume.lvm.lvm2 dissect.volume.lvm.metadata dissect.volume.lvm.physical dissect.volume.md dissect.volume.md.c_md dissect.volume.md.md dissect.volume.raid dissect.volume.raid.raid dissect.volume.raid.stream dissect.volume.vinum dissect.volume.vinum.c_vinum dissect.volume.vinum.config dissect.volume.vinum.vinum dissect.volume.vss dissect.xfs dissect.xfs.c_xfs dissect.xfs.exceptions dissect.xfs.xfs flow.record flow.record.adapter flow.record.adapter.archive flow.record.adapter.avro flow.record.adapter.broker flow.record.adapter.csvfile flow.record.adapter.duckdb flow.record.adapter.elastic flow.record.adapter.jsonfile flow.record.adapter.line flow.record.adapter.mongo flow.record.adapter.split flow.record.adapter.splunk flow.record.adapter.sqlite flow.record.adapter.stream flow.record.adapter.text flow.record.adapter.xlsx flow.record.base flow.record.context flow.record.exceptions flow.record.fieldtypes flow.record.fieldtypes.credential flow.record.fieldtypes.net flow.record.fieldtypes.net.ip flow.record.fieldtypes.net.ipv4 flow.record.fieldtypes.net.tcp flow.record.fieldtypes.net.udp flow.record.jsonpacker flow.record.packer flow.record.selector flow.record.stream flow.record.tools flow.record.tools.geoip flow.record.tools.rdump flow.record.utils flow.record.whitelist Module (class in acquire.acquire.acquire) (class in dissect.target.plugins.os.unix.linux.modules) module (dissect.executable.pe.directory.delay_import.DelayImportFunction attribute) (dissect.executable.pe.directory.ImportFunction attribute) (dissect.executable.pe.directory.imports.ImportFunction attribute) (dissect.squashfs.compression.AvailableLZ4 attribute) (dissect.squashfs.compression.AvailableLZO attribute) (dissect.squashfs.compression.Compression attribute) (dissect.squashfs.compression.NativeLZMA attribute) (dissect.squashfs.compression.NativeXZ attribute) (dissect.squashfs.compression.NativeZlib attribute) (dissect.squashfs.compression.NativeZSTD attribute) (dissect.target.plugin.FailureDescriptor attribute) (dissect.target.plugin.FunctionDescriptor attribute) (dissect.target.plugin.PluginDescriptor attribute) module_arg() (in module acquire.acquire.acquire) MODULE_LOOKUP (in module acquire.acquire.acquire) module_name (acquire.acquire.collector.Record attribute) MODULE_PATH (in module dissect.target.container) (in module dissect.target.filesystem) (in module dissect.target.plugin) ModulePlugin (class in dissect.target.plugins.os.unix.linux.modules) ModuleRecord (in module dissect.target.plugins.os.unix.linux.modules) modules (dissect.executable.pe.directory.bound_import.BoundImportDirectory property) (dissect.executable.pe.directory.BoundImportDirectory property) (dissect.executable.pe.directory.delay_import.DelayImportDirectory property) (dissect.executable.pe.directory.DelayImportDirectory property) (dissect.executable.pe.directory.ImportDirectory property) (dissect.executable.pe.directory.imports.ImportDirectory property) MODULES (in module acquire.acquire.acquire) modules() (dissect.target.plugins.os.windows.regf.cit.CITPlugin method) MongoReader (class in flow.record.adapter.mongo) MongoWriter (class in flow.record.adapter.mongo) monitor (dissect.target.loaders.mqtt.Broker attribute) MonthlyDateTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) MonthlyDowTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) MORE_MASK (dissect.eventlog.bxml.Token attribute) mount (dissect.target.filesystem.VirtualFilesystem attribute) mount() (dissect.target.filesystem.LayerFilesystem method) (dissect.target.helpers.nfs.client.mount.Client method) MOUNT_LETTER_MAP (dissect.target.plugins.os.windows.regf.usb.UsbPlugin attribute) mount_name (dissect.ffs.FFS attribute) (dissect.ffs.ffs.FFS attribute) mount_stat (dissect.target.helpers.nfs.client.mount.MountError attribute) MountError MountOK (class in dissect.target.helpers.nfs.nfs3) MountProc (in module dissect.target.helpers.nfs.nfs3) MountProgram (in module dissect.target.helpers.nfs.nfs3) MountResultDeserializer (class in dissect.target.helpers.nfs.serializer) mounts (dissect.target.filesystem.LayerFilesystem attribute) MountStat (class in dissect.target.helpers.nfs.nfs3) MPC (dissect.target.plugins.os.windows.network.IfTypes attribute) MPLS (dissect.target.plugins.os.windows.network.IfTypes attribute) MPLS_IN_IP (dissect.target.helpers.network.IANAProtocol attribute) MPLS_TUNNEL (dissect.target.plugins.os.windows.network.IfTypes attribute) mqtt_client (dissect.target.loaders.mqtt.Broker attribute) MqttConnection (class in dissect.target.loaders.mqtt) MqttDiagnosticLine (class in dissect.target.loaders.mqtt) MqttLoader (class in dissect.target.loaders.mqtt) MqttStream (class in dissect.target.loaders.mqtt) MqttTransferRatePerSecond (class in dissect.target.loaders.mqtt) MRUPlugin (class in dissect.target.plugins.os.windows.regf.mru) msc() (dissect.target.plugins.apps.av.mcafee.McAfeePlugin method) MSDSL (dissect.target.plugins.os.windows.network.IfTypes attribute) MSG_ACCEPTED (dissect.target.helpers.sunrpc.serializer.ReplyStat attribute) MSG_DENIED (dissect.target.helpers.sunrpc.serializer.ReplyStat attribute) MSGPACK (dissect.target.tools.dump.Serialization attribute) msgs (acquire.acquire.dynamic.windows.handles.DuplicateFilter attribute) MSNPlugin (class in dissect.target.plugins.apps.chat.msn) MSOffice (class in dissect.target.plugins.apps.productivity.msoffice) msoffice() (dissect.target.plugins.os.windows.regf.mru.MRUPlugin method) MSOfficeMRURecord (in module dissect.target.plugins.os.windows.regf.mru) MSSQL (class in acquire.acquire.acquire) MSSQL_KEY_GLOB (dissect.target.plugins.os.windows.log.mssql.MssqlPlugin attribute) MssqlErrorlogRecord (in module dissect.target.plugins.os.windows.log.mssql) MssqlPlugin (class in dissect.target.plugins.os.windows.log.mssql) mstsc() (dissect.target.plugins.os.windows.regf.mru.MRUPlugin method) mtime (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) (dissect.apfs.objects.fs.INode property) (dissect.btrfs.btrfs.INode property) (dissect.btrfs.INode property) (dissect.database.bsd.tools.rpm.PackageEntry attribute) (dissect.extfs.extfs.INode property) (dissect.extfs.INode property) (dissect.fat.fat.DirectoryEntry property) (dissect.fat.fat.RootDirectory property) (dissect.ffs.ffs.INode property) (dissect.jffs.jffs2.INode property) (dissect.ole.ole.DirectoryEntry attribute) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx6.INode6 property) (dissect.squashfs.INode property) (dissect.squashfs.squashfs.INode property) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.vmfs.FileDescriptor property) (dissect.xfs.xfs.INode property) mtime_ns (dissect.btrfs.btrfs.INode property) (dissect.btrfs.INode property) (dissect.extfs.extfs.INode property) (dissect.extfs.INode property) (dissect.ffs.ffs.INode property) (dissect.xfs.xfs.INode property) MTP (dissect.target.helpers.network.IANAProtocol attribute) MTP_FILE_ENTRY (class in dissect.target.plugins.os.windows.regf.shellbags) MTP_VOLUME (class in dissect.target.plugins.os.windows.regf.shellbags) mui_id (dissect.eventlog.wevt_object.TASK attribute) MUI_TZ_MAP (in module dissect.target.helpers.mui) muicache() (dissect.target.plugins.os.windows.regf.muicache.MuiCachePlugin method) MuiCachePlugin (class in dissect.target.plugins.os.windows.regf.muicache) MuiCacheRecord (in module dissect.target.plugins.os.windows.regf.muicache) MULTI_SZ (dissect.target.helpers.regutil.RegistryValueType attribute) MultiDict (class in dissect.target.plugins.apps.vpn.wireguard) MultiRawLoader (class in dissect.target.loaders.multiraw) MUTANT (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) MUTEX (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) mutiple_instances_policy (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) MUX (dissect.target.helpers.network.IANAProtocol attribute) MVL (dissect.target.plugins.os.windows.network.IfTypes attribute) MYRINET (dissect.target.plugins.os.windows.network.IfTypes attribute) mz_header (dissect.executable.PE attribute) (dissect.executable.pe.PE attribute) (dissect.executable.pe.pe.PE attribute) N N (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) n_literal_payload_bytes (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) n_literals (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) n_lmd_payload_bytes (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) n_matches (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) n_payload_bytes (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) n_raw_bytes (dissect.util.compression.lzfse.LZFSECompressedBlockHeader attribute) name (acquire.acquire.dynamic.windows.named_objects.NamedObject attribute) (acquire.acquire.dynamic.windows.types.Handle attribute) (acquire.acquire.dynamic.windows.types.OBJECT_DIRECTORY_INFORMATION property) (acquire.acquire.dynamic.windows.types.PUBLIC_OBJECT_TYPE_INFORMATION property) (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.DirectoryEntry property) (dissect.apfs.objects.fs.FS property) (dissect.apfs.objects.fs.INode property) (dissect.apfs.objects.fs.Snapshot property) (dissect.apfs.objects.fs.XAttr property) (dissect.archive.vbk.DirItem attribute) (dissect.archive.vbk.RootDirectory attribute) (dissect.archive.vma.Device attribute) (dissect.archive.wim.DirectoryEntry attribute) (dissect.cim.cim.Class property) (dissect.cim.cim.Instance property) (dissect.cim.cim.Namespace attribute) (dissect.cim.cim.Property property) (dissect.cim.classes.ClassInstanceProperty property) (dissect.clfs.blf.Container attribute) (dissect.clfs.blf.Stream attribute) (dissect.cramfs.cramfs.INode property) (dissect.cramfs.INode property) (dissect.cstruct.Field attribute) (dissect.cstruct.types.Field attribute) (dissect.cstruct.types.structure.Field attribute) (dissect.database.bsd.tools.rpm.Package property) (dissect.database.ese.Index attribute) (dissect.database.ese.index.Index attribute) (dissect.database.ese.Table attribute) (dissect.database.ese.table.Column attribute) (dissect.database.ese.table.Table attribute) (dissect.database.ese.util.ColumnType attribute) (dissect.database.sqlite3.Column attribute) (dissect.database.sqlite3.sqlite3.Column attribute) (dissect.database.sqlite3.sqlite3.Index attribute) (dissect.database.sqlite3.sqlite3.Table attribute) (dissect.database.sqlite3.Table attribute) (dissect.eventlog.bxml.BxmlTag attribute) (dissect.eventlog.wevt_object.WevtName attribute) (dissect.executable.elf.elf.Section property) (dissect.executable.elf.elf.Symbol property) (dissect.executable.elf.Section property) (dissect.executable.elf.Symbol property) (dissect.executable.pe.directory.bound_import.BoundImportForwardReference property) (dissect.executable.pe.directory.bound_import.BoundImportModule property) (dissect.executable.pe.directory.com_descriptor.ComStream attribute) (dissect.executable.pe.directory.delay_import.DelayImportModule property) (dissect.executable.pe.directory.export.ExportDirectory property) (dissect.executable.pe.directory.export.ExportFunction attribute) (dissect.executable.pe.directory.ExportDirectory property) (dissect.executable.pe.directory.ImportModule property) (dissect.executable.pe.directory.imports.ImportModule property) (dissect.executable.pe.directory.resource.Resource attribute) (dissect.executable.pe.pe.Section property) (dissect.extfs.extfs.XAttr attribute) (dissect.fat.fat.DirectoryEntry attribute) (dissect.fat.fat.RootDirectory attribute) (dissect.ffs.ffs.INode attribute) (dissect.hypervisor.disk.qcow2.QCow2Snapshot attribute) (dissect.jffs.jffs2.DirEntry property) (dissect.ntfs.attr.Attribute property) (dissect.ntfs.attr.AttributeHeader property) (dissect.ntfs.Attribute property) (dissect.ntfs.AttributeHeader property) (dissect.ntfs.Index attribute) (dissect.ntfs.index.Index attribute) (dissect.ole.ole.DirectoryEntry attribute) (dissect.qnxfs.qnx4.INode4 property) (dissect.regf.regf.KeyNode attribute) (dissect.squashfs.INode attribute) (dissect.squashfs.squashfs.INode attribute) (dissect.target.filesystem.FilesystemEntry attribute) (dissect.target.helpers.nfs.nfs3.EntryPlus attribute) (dissect.target.helpers.regutil.KeyCollection property) (dissect.target.helpers.regutil.RegfKey property) (dissect.target.helpers.regutil.RegfValue property) (dissect.target.helpers.regutil.RegistryKey property) (dissect.target.helpers.regutil.RegistryValue property) (dissect.target.helpers.regutil.ValueCollection property) (dissect.target.helpers.regutil.VirtualKey property) (dissect.target.helpers.regutil.VirtualValue property) (dissect.target.loaders.cb.CbRegistryKey property) (dissect.target.loaders.cb.CbRegistryValue property) (dissect.target.loaders.containerimage.ContainerImageTarSubLoader attribute) (dissect.target.loaders.res.File attribute) (dissect.target.loaders.res.Folder attribute) (dissect.target.loaders.smb.SmbRegistryHive attribute) (dissect.target.loaders.smb.SmbRegistryKey property) (dissect.target.loaders.smb.SmbRegistryValue property) (dissect.target.plugin.FunctionDescriptor attribute) (dissect.target.plugins.apps.webserver.apache.LogFormat attribute) (dissect.target.plugins.os.unix.linux.modules.Module attribute) (dissect.target.plugins.os.unix.linux.network.DhcpLease attribute) (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) (dissect.target.plugins.os.unix.linux.network.ProcConfigParser.ParserContext attribute) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager attribute) (dissect.target.plugins.os.unix.linux.network_managers.Template attribute) (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) (dissect.target.plugins.os.windows.datetime.WindowsTimezone attribute) (dissect.target.plugins.os.windows.dpapi.crypto.CipherAlgorithm attribute) (dissect.target.plugins.os.windows.dpapi.crypto.HashAlgorithm attribute) (dissect.target.plugins.os.windows.env.EnvVarDetails attribute) (dissect.target.plugins.os.windows.jumplist.JumpListFile property) (dissect.target.plugins.os.windows.regf.shellbags.CDBURN property) (dissect.target.plugins.os.windows.regf.shellbags.COMPRESSED_FOLDER property) (dissect.target.plugins.os.windows.regf.shellbags.CONTROL_PANEL property) (dissect.target.plugins.os.windows.regf.shellbags.CONTROL_PANEL_CATEGORY property) (dissect.target.plugins.os.windows.regf.shellbags.CONTROL_PANEL_CPL_FILE property) (dissect.target.plugins.os.windows.regf.shellbags.DELEGATE property) (dissect.target.plugins.os.windows.regf.shellbags.FILE_ENTRY property) (dissect.target.plugins.os.windows.regf.shellbags.GAME_FOLDER property) (dissect.target.plugins.os.windows.regf.shellbags.MTP_FILE_ENTRY property) (dissect.target.plugins.os.windows.regf.shellbags.MTP_VOLUME property) (dissect.target.plugins.os.windows.regf.shellbags.NETWORK property) (dissect.target.plugins.os.windows.regf.shellbags.ROOT_FOLDER property) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM property) (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN property) (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN0 property) (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN1 property) (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN_0x74 property) (dissect.target.plugins.os.windows.regf.shellbags.URI property) (dissect.target.plugins.os.windows.regf.shellbags.USERS_PROPERTY_VIEW property) (dissect.target.plugins.os.windows.regf.shellbags.VOLUME property) (dissect.target.Target property) (dissect.target.target.Target property) (dissect.target.tools.diff.DifferentialEntry attribute) (dissect.target.volume.Volume attribute) (dissect.vmfs.descriptor.DirEntry attribute) (dissect.vmfs.DirEntry attribute) (dissect.vmfs.lvm.Volume attribute) (dissect.vmfs.Volume attribute) (dissect.volume.ddf.ddf.VirtualDiskRecord attribute) (dissect.volume.disk.Partition attribute) (dissect.volume.disk.partition.Partition attribute) (dissect.volume.lvm.metadata.HistoricalLogicalVolume attribute) (dissect.volume.lvm.metadata.LogicalVolume property) (dissect.volume.lvm.metadata.PhysicalVolume property) (dissect.volume.lvm.metadata.Segment property) (dissect.volume.lvm.metadata.VolumeGroup property) (dissect.volume.raid.raid.VirtualDisk attribute) (dissect.volume.vinum.config.Plex attribute) (dissect.volume.vinum.config.SD attribute) (dissect.volume.vinum.config.Volume attribute) (dissect.volume.vinum.vinum.VinumPhysicalDisk attribute) (dissect.xfs.XFS attribute) (dissect.xfs.xfs.XFS attribute) (flow.record.base.GroupedRecord attribute) (flow.record.base.RecordDescriptor attribute) (flow.record.base.RecordField attribute) (flow.record.GroupedRecord attribute) (flow.record.RecordDescriptor attribute) (flow.record.RecordField attribute) (flow.record.stream.PathTemplateWriter attribute) name() (in module flow.record.selector) name_hash (dissect.cim.classes.ClassInstance attribute) name_offset (dissect.cim.classes.PropertyReference attribute) name_thunk (dissect.executable.pe.directory.delay_import.DelayImportFunction attribute) NAME_TO_CP (in module dissect.executable.pe.locale_id) NAME_TO_GUID_MAP (in module dissect.database.ese.tools.sru) NamedObject (class in acquire.acquire.dynamic.windows.named_objects) NamedObjectType (class in acquire.acquire.dynamic.windows.named_objects) names (dissect.apfs.objects.fs.INode property) (dissect.eventlog.evtx.ElfChnk attribute) (dissect.eventlog.wevt_object.TEMP attribute) names() (dissect.evidence.asdf.asdf.Metadata method) (in module flow.record.selector) Namespace (class in dissect.cim.cim) namespace (dissect.cim.cim.Class attribute) (dissect.cim.cim.Instance attribute) (dissect.cim.utils.ObjectPath attribute) (dissect.target.plugin.FunctionDescriptor attribute) (dissect.target.plugin.PluginDescriptor attribute) namespace() (dissect.cim.CIM method) (dissect.cim.cim.CIM method) (dissect.cim.cim.Namespace method) NAMESPACE_CLASS_NAME (in module dissect.cim.c_cim) NamespacePlugin (class in dissect.target.plugin) namespaces (dissect.cim.cim.Namespace property) NARP (dissect.target.helpers.network.IANAProtocol attribute) native() (dissect.target.plugins.apps.productivity.msoffice.MSOffice method) NATIVE_TYPE_MAP (in module dissect.database.ese.tools.sru) NativeLZMA (class in dissect.squashfs.compression) NativePluginStatus (class in dissect.target.plugins.apps.productivity.msoffice) NativeXZ (class in dissect.squashfs.compression) NativeZlib (class in dissect.squashfs.compression) NativeZSTD (class in dissect.squashfs.compression) nblocks (dissect.ffs.ffs.INode property) (dissect.xfs.xfs.INode property) ndis() (dissect.target.plugins.os.windows.generic.GenericPlugin method) NdisRecord (in module dissect.target.plugins.os.windows.generic) near_copies (dissect.volume.raid.stream.RAID10Stream attribute) NEEDLE (dissect.target.plugins.os.windows.log.evt.EvtPlugin attribute) (dissect.target.plugins.os.windows.log.evtx.EvtxPlugin attribute) Needle (in module dissect.target.helpers.scrape) needs_backing_file (dissect.hypervisor.disk.qcow2.QCow2 property) needs_data_file (dissect.hypervisor.disk.qcow2.QCow2 property) net (flow.record.fieldtypes.net.ipv4.subnet attribute) (in module flow.record.base) NetAddress (in module dissect.target.plugins.os.unix.linux.network) NETBLT (dissect.target.helpers.network.IANAProtocol attribute) NethistPlugin (class in dissect.target.plugins.os.windows.regf.nethist) netloc (flow.record.fieldtypes.uri property) netmask (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager property) (flow.record.fieldtypes.net.ip.ipinterface property) (flow.record.fieldtypes.net.ip.ipnetwork property) (flow.record.fieldtypes.net.ipinterface property) (flow.record.fieldtypes.net.ipnetwork property) netmask() (dissect.target.plugins.os.unix.linux._os.LinuxPlugin method) NetSocket (class in dissect.target.plugins.os.unix.linux.proc) NetSocketPlugin (class in dissect.target.plugins.os.unix.linux.sockets) NetSocketRecord (in module dissect.target.plugins.os.unix.linux.sockets) Netstat (class in acquire.acquire.acquire) netstat() (dissect.target.plugins.os.unix.linux.netstat.NetstatPlugin method) NETSTAT_HEADER (in module dissect.target.plugins.os.unix.linux.netstat) NETSTAT_TEMPLATE (in module dissect.target.plugins.os.unix.linux.netstat) NetstatPlugin (class in dissect.target.plugins.os.unix.linux.netstat) Network (class in acquire.acquire.acquire) NETWORK (class in dissect.target.plugins.os.windows.regf.shellbags) network (flow.record.fieldtypes.net.ip.ipinterface property) (flow.record.fieldtypes.net.ipinterface property) network_connectivity() (dissect.target.plugins.os.windows.sru.SRUPlugin method) network_data() (dissect.target.plugins.os.windows.sru.SRUPlugin method) network_history() (dissect.target.plugins.os.windows.regf.nethist.NethistPlugin method) network_manager (dissect.target.plugins.os.unix.linux._os.LinuxPlugin attribute) network_profile_name (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) network_settings_id (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) network_settings_name (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) NetworkConnectivityRecord (in module dissect.target.plugins.os.windows.sru) NetworkDataRecord (in module dissect.target.plugins.os.windows.sru) networkdrive() (dissect.target.plugins.os.windows.regf.mru.MRUPlugin method) NetworkHistoryRecord (in module dissect.target.plugins.os.windows.regf.nethist) NetworkManager (class in dissect.target.plugins.os.unix.linux.network_managers) NetworkManagerConfigParser (class in dissect.target.plugins.os.unix.linux.network) NetworkManagerConfigParser.ParserContext (class in dissect.target.plugins.os.unix.linux.network) NetworkManagerLeaseParser (class in dissect.target.plugins.os.unix.linux.network) NetworkPlugin (class in dissect.target.plugins.os.default.network) new_file_handler() (in module acquire.acquire.log) NEW_SYN_RECV (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) next (dissect.cstruct.parser.TokenConsumer property) (dissect.evidence.ewf.SectionDescriptor attribute) next() (dissect.apfs.cursor.Cursor method) (dissect.btrfs.tree.Cursor method) (dissect.database.ese.btree.BTree method) (dissect.database.ese.cursor.Cursor method) next_buffer (dissect.etl.Buffer property) (dissect.etl.etl.Buffer property) next_node() (dissect.btrfs.tree.Cursor method) next_page (dissect.database.ese.Page attribute) (dissect.database.ese.page.Page attribute) next_page() (dissect.database.ese.btree.BTree method) next_state (dissect.fve.bde.information.Information property) next_store (dissect.volume.vss.Store attribute) NFAS (dissect.target.plugins.os.windows.network.IfTypes attribute) nfs_volume_uuid() (in module dissect.target.plugins.os.unix.esxi._os) NfsError NfsFilesystem (class in dissect.target.filesystems.nfs) NfsFilesystemEntry (class in dissect.target.filesystems.nfs) NfsProgram (in module dissect.target.helpers.nfs.nfs3) NfsStat (class in dissect.target.helpers.nfs.nfs3) nfsstat (dissect.target.helpers.nfs.client.nfs.NfsError attribute) NfsStream (class in dissect.target.filesystems.nfs) NfsTime (class in dissect.target.helpers.nfs.nfs3) NfsTimeSerializer (class in dissect.target.helpers.nfs.serializer) NfsVersion (in module dissect.target.helpers.nfs.nfs3) NginxPlugin (class in dissect.target.plugins.apps.webserver.nginx) nkeys (dissect.apfs.objects.btree_node.BTreeNode property) (dissect.apfs.objects.BTreeNode property) nlink (dissect.jffs.jffs2.INode property) (dissect.qnxfs.qnx4.INode4 property) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) nms() (in module dissect.target.helpers.cyber) NMS_JUMBLE_LOOP_SPEED (in module dissect.target.helpers.cyber) NMS_JUMBLE_SECONDS (in module dissect.target.helpers.cyber) NMS_MASK_TABLE (in module dissect.target.helpers.cyber) NMS_REVEAL_LOOP_SPEED (in module dissect.target.helpers.cyber) NMS_REVEAL_SECONDS (in module dissect.target.helpers.cyber) NMS_TYPE_EFFECT_SPEED (in module dissect.target.helpers.cyber) no_cache (dissect.target.helpers.cache.Cache attribute) NO_COLOR (in module dissect.target.tools.qfind) NO_DOCS (in module dissect.target.helpers.docs) NO_VOLUME_LABEL_ENTRY (in module dissect.fat.c_exfat) NoCellData, [1] Node (class in dissect.database.ese.page) (class in dissect.util.compression.lzxpress_huffman) (class in dissect.volume.dm.btree) node (dissect.database.ese.record.RecordData attribute) node() (dissect.database.ese.btree.BTree method) (dissect.database.ese.Page method) (dissect.database.ese.page.Page method) node_count (dissect.database.ese.Page attribute) (dissect.database.ese.page.Page attribute) node_size (dissect.btrfs.Btrfs attribute) (dissect.btrfs.btrfs.Btrfs attribute) node_vcn (dissect.ntfs.index.IndexEntry property) (dissect.ntfs.IndexEntry property) nodes() (dissect.database.ese.Page method) (dissect.database.ese.page.Page method) nofua (dissect.volume.lvm.metadata.WriteCacheSegment attribute) noheader (dissect.target.plugins.os.windows.regf.shimcache.ShimCache attribute) NoMoreEntriesError NoMoreEventsError nonce (dissect.fve.bde.information.AesCcmEncryptedDatum property) nonce_counter (dissect.fve.bde.information.AesCcmEncryptedDatum property) nonce_time (dissect.fve.bde.information.AesCcmEncryptedDatum property) NONE (dissect.target.helpers.regutil.RegistryValueType attribute) (dissect.target.plugins.apps.container.podman.ContainerState attribute) (dissect.target.tools.dump.Compression attribute) NONE_OBJECT (in module flow.record.selector) NoNeighbourPageError, [1] NoneObject (class in flow.record.selector) NONSPACE_MARK (dissect.database.ese.lcmapstring.SCRIPT attribute) noop() (in module dissect.database.ese.record) NORM_IGNORECASE (dissect.database.ese.lcmapstring.MapFlags attribute) NORM_IGNOREKANATYPE (dissect.database.ese.lcmapstring.MapFlags attribute) NORM_IGNORENONSPACE (dissect.database.ese.lcmapstring.MapFlags attribute) NORM_IGNORESYMBOLS (dissect.database.ese.lcmapstring.MapFlags attribute) NORM_IGNOREWIDTH (dissect.database.ese.lcmapstring.MapFlags attribute) NORM_LINGUISTIC_CASING (dissect.database.ese.lcmapstring.MapFlags attribute) NORMAL_SUBCLUSTER_TYPES (in module dissect.hypervisor.disk.c_qcow2) normalise_field_name() (in module dissect.target.plugins.apps.webserver.iis) normalize() (flow.record.fieldtypes.uri static method) (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.polypath) normalize_fieldname() (in module flow.record.base) normalize_language() (in module dissect.target.helpers.localeutil) normalize_path() (in module acquire.acquire.utils) normalize_timezone() (in module dissect.target.helpers.localeutil) normpath() (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.polypath) NOT (dissect.util.ldap.LogicalOperator attribute) NotADirectoryError, [1], [2], [3], [4], [5], [6], [7], [8], [9], [10], [11], [12], [13], [14], [15], [16], [17], [18], [19], [20], [21], [22], [23], [24] NotAFileError, [1], [2], [3] NotAnIndexFileError NotAnRDMFileError NotAReparsePointError, [1] NotASymlinkError, [1], [2], [3], [4], [5], [6], [7], [8], [9], [10], [11], [12], [13], [14], [15], [16], [17], [18], [19], [20] NotFoundError, [1] NOTICE (dissect.target.plugins.os.unix.log.journal.JournalMessagePriority attribute) NOTIFICATIONS_DIR (in module dissect.target.plugins.os.windows.notifications) NotificationsPlugin (class in dissect.target.plugins.os.windows.notifications) now (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) now() (in module dissect.util.ts) NoWriteAheadLog, [1] nr_of_items (dissect.eventlog.wevt.WEVT_TYPE property) ns (dissect.cim.cim.Class property) (dissect.cim.cim.Instance property) NS (dissect.hypervisor.descriptor.ovf.OVF attribute) ns (flow.record.selector.CompiledSelector attribute) (in module dissect.target.plugins.os.unix.linux.recentlyused) NS() (dissect.cim.index.Key method) NSDictionary (class in dissect.util.plist) nseconds (dissect.target.helpers.nfs.nfs3.NfsTime attribute) NSFNET_IGP (dissect.target.helpers.network.IANAProtocol attribute) NSH (dissect.target.helpers.network.IANAProtocol attribute) NSIP (dissect.target.plugins.os.windows.network.IfTypes attribute) nskeyed (dissect.util.plist.NSObject attribute) NSKeyedArchiver (class in dissect.util.plist) NSObject (class in dissect.util.plist) nt (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry attribute) nt52_entry_type() (in module dissect.target.plugins.os.windows.regf.shimcache) nt61_entry_type() (in module dissect.target.plugins.os.windows.regf.shimcache) ntdll (in module acquire.acquire.dynamic.windows.ntdll) NTDS (class in acquire.acquire.acquire) NTFS (class in acquire.acquire.acquire) (class in dissect.ntfs) (class in dissect.ntfs.ntfs) ntfs (dissect.ntfs.Mft attribute) (dissect.ntfs.mft.Mft attribute) (dissect.ntfs.mft.MftRecord attribute) (dissect.ntfs.MftRecord attribute) (dissect.ntfs.UsnJrnl attribute) (dissect.ntfs.usnjrnl.UsnJrnl attribute) (dissect.target.filesystems.ntfs.NtfsFilesystem attribute) NTFS (dissect.target.plugins.os.windows.everything.parser.EverythingFSType attribute) ntfs_def (in module dissect.ntfs.c_ntfs) ntfs_filesystems (dissect.target.plugins.filesystem.ntfs.mft.MftPlugin attribute) NTFS_NEEDLE (in module dissect.target.loaders.phobos) NTFS_SIGNATURE (in module dissect.ntfs) (in module dissect.ntfs.c_ntfs) NtfsFilesystem (class in dissect.target.filesystems.ntfs) NtfsFilesystemEntry (class in dissect.target.filesystems.ntfs) NtOpenDirectoryObject (in module acquire.acquire.dynamic.windows.ntdll) NtQueryDirectoryObject (in module acquire.acquire.dynamic.windows.ntdll) NtQueryInformationFile (in module acquire.acquire.dynamic.windows.ntdll) NtQueryObject (in module acquire.acquire.dynamic.windows.ntdll) NtQuerySystemInformation (in module acquire.acquire.dynamic.windows.ntdll) NTSTATUS (in module acquire.acquire.dynamic.windows.types) NtStatusCode (class in acquire.acquire.dynamic.windows.ntdll) ntversion (dissect.target.plugins.os.windows.regf.shimcache.ShimCache attribute) ntversion() (dissect.target.plugins.os.windows.generic.GenericPlugin method) NULL (dissect.eventlog.bxml.BxmlType attribute) (in module acquire.acquire.dynamic.windows.types) NULL_GUID (in module dissect.hypervisor.disk.hdd) null_terminated (dissect.cstruct.types.base.BaseArray attribute) (dissect.cstruct.types.BaseArray attribute) NullGuid (in module dissect.etl.utils) NullPointerDereference, [1] NullSessionPipeRecord (in module dissect.target.plugins.os.windows.generic) nullsessionpipes() (dissect.target.plugins.os.windows.generic.GenericPlugin method) num (dissect.database.ese.Page attribute) (dissect.database.ese.page.Node attribute) (dissect.database.ese.page.Page attribute) (dissect.database.ese.page.Tag attribute) (dissect.database.sqlite3.sqlite3.Page attribute) (dissect.executable.elf.elf.Table attribute) (dissect.ffs.ffs.CylinderGroup attribute) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) (dissect.xfs.xfs.AllocationGroup attribute) NUM_APPDB_CHUNKS (in module dissect.target.plugins.os.windows.notifications) num_blocks (dissect.cramfs.BlockStream attribute) (dissect.cramfs.cramfs.BlockStream attribute) (dissect.qnxfs.QNX6 attribute) (dissect.qnxfs.qnx6.QNX6 attribute) num_difat_entries (dissect.ole.OLE attribute) (dissect.ole.ole.OLE attribute) num_disks (dissect.volume.raid.raid.VirtualDisk attribute) num_entries (dissect.cstruct.types.base.BaseArray attribute) (dissect.cstruct.types.BaseArray attribute) (dissect.evidence.ewf.TableSection attribute) (dissect.volume.dm.btree.Node attribute) num_fat_entries (dissect.ole.OLE attribute) (dissect.ole.ole.OLE attribute) num_fields (dissect.target.helpers.configutil.CSVish attribute) num_inodes (dissect.qnxfs.QNX6 attribute) (dissect.qnxfs.qnx6.QNX6 attribute) NUM_OVERFLOW_SLOTS (dissect.target.plugins.os.unix.locate.plocate.PLocateFile attribute) num_properties (dissect.cim.classes.PropertyStates attribute) num_stripes (dissect.btrfs.stream.Chunk attribute) number (dissect.target.volume.Volume attribute) (dissect.volume.ddf.ddf.VirtualDiskRecord attribute) (dissect.volume.disk.Partition attribute) (dissect.volume.disk.partition.Partition attribute) NVP_II (dissect.target.helpers.network.IANAProtocol attribute) NxFusionWbc (class in dissect.apfs.objects) (class in dissect.apfs.objects.nx_fusion_wbc) NxFusionWbcList (class in dissect.apfs.objects) (class in dissect.apfs.objects.nx_fusion_wbc_list) NxReaper (class in dissect.apfs.objects) (class in dissect.apfs.objects.nx_reaper) NxReapList (class in dissect.apfs.objects) (class in dissect.apfs.objects.nx_reap_list) NxSuperblock (class in dissect.apfs.objects) (class in dissect.apfs.objects.nx_superblock) O oatimestamp() (in module dissect.util.ts) obj (dissect.util.plist.NSObject attribute) OBJ_ATTR (class in acquire.acquire.dynamic.windows.ntdll) obj_attributes (dissect.target.helpers.nfs.nfs3.LookupResult attribute) (dissect.target.helpers.nfs.nfs3.ReadlinkResult attribute) OBJ_CASE_INSENSITIVE (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) OBJ_EXCLUSIVE (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) OBJ_FORCE_ACCESS_CHECK (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) OBJ_IGNORE_IMPERSONATED_DEVICEMAP (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) OBJ_INHERIT (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) OBJ_KERNEL_HANDLE (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) OBJ_OPENIF (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) OBJ_OPENLINK (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) OBJ_PERMANENT (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) OBJ_VALID_ATTRIBUTES (acquire.acquire.dynamic.windows.ntdll.OBJ_ATTR attribute) object (acquire.acquire.dynamic.windows.types.Handle attribute) (acquire.acquire.dynamic.windows.types.SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX property) Object (class in dissect.apfs.objects) (class in dissect.apfs.objects.base) object (dissect.apfs.objects.base.Object attribute) (dissect.apfs.objects.BTree attribute) (dissect.apfs.objects.btree.BTree attribute) (dissect.apfs.objects.btree_node.BTreeNode attribute) (dissect.apfs.objects.BTreeNode attribute) (dissect.apfs.objects.checkpoint_map.CheckpointMap attribute) (dissect.apfs.objects.CheckpointMap attribute) (dissect.apfs.objects.efi_jumpstart.EfiJumpstart attribute) (dissect.apfs.objects.EfiJumpstart attribute) (dissect.apfs.objects.EncryptionRollingRecoveryBlock attribute) (dissect.apfs.objects.EncryptionRollingState attribute) (dissect.apfs.objects.er_recovery_block.EncryptionRollingRecoveryBlock attribute) (dissect.apfs.objects.er_state.EncryptionRollingState attribute) (dissect.apfs.objects.FS attribute) (dissect.apfs.objects.fs.FS attribute) (dissect.apfs.objects.GBitmap attribute) (dissect.apfs.objects.gbitmap.GBitmap attribute) (dissect.apfs.objects.gbitmap_block.GBitmapBlock attribute) (dissect.apfs.objects.GBitmapBlock attribute) (dissect.apfs.objects.integrity_meta.IntegrityMeta attribute) (dissect.apfs.objects.IntegrityMeta attribute) (dissect.apfs.objects.keybag.Keybag attribute) (dissect.apfs.objects.nx_fusion_wbc.NxFusionWbc attribute) (dissect.apfs.objects.nx_fusion_wbc_list.NxFusionWbcList attribute) (dissect.apfs.objects.nx_reap_list.NxReapList attribute) (dissect.apfs.objects.nx_reaper.NxReaper attribute) (dissect.apfs.objects.nx_superblock.NxSuperblock attribute) (dissect.apfs.objects.NxFusionWbc attribute) (dissect.apfs.objects.NxFusionWbcList attribute) (dissect.apfs.objects.NxReaper attribute) (dissect.apfs.objects.NxReapList attribute) (dissect.apfs.objects.NxSuperblock attribute) (dissect.apfs.objects.Object attribute) (dissect.apfs.objects.ObjectMap attribute) (dissect.apfs.objects.omap.ObjectMap attribute) (dissect.apfs.objects.snap_meta_ext.SnapMetaExt attribute) (dissect.apfs.objects.SnapMetaExt attribute) (dissect.apfs.objects.Spaceman attribute) (dissect.apfs.objects.spaceman.Spaceman attribute) (dissect.apfs.objects.spaceman_cab.SpacemanChunkInfoAddressBlock attribute) (dissect.apfs.objects.spaceman_cib.SpacemanChunkInfoBlock attribute) (dissect.apfs.objects.SpacemanChunkInfoAddressBlock attribute) (dissect.apfs.objects.SpacemanChunkInfoBlock attribute) (dissect.target.helpers.nfs.nfs3.LookupResult attribute) object() (dissect.cim.index.Key method) OBJECT_ATTRIBUTES (class in acquire.acquire.dynamic.windows.ntdll) OBJECT_DIRECTORY_INFORMATION (class in acquire.acquire.dynamic.windows.types) OBJECT_INFORMATION_CLASS (class in acquire.acquire.dynamic.windows.types) object_tables (dissect.hypervisor.descriptor.hyperv.HyperVFile attribute) object_type (dissect.ntfs.ACE attribute) (dissect.ntfs.secure.ACE attribute) object_type_index (acquire.acquire.dynamic.windows.types.Handle attribute) (acquire.acquire.dynamic.windows.types.SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX property) ObjectBasicInformation (acquire.acquire.dynamic.windows.types.OBJECT_INFORMATION_CLASS attribute) ObjectEntryType (in module dissect.hypervisor.descriptor.c_hyperv) ObjectGuid (in module dissect.etl.utils) objectid (dissect.btrfs.btrfs.Subvolume attribute) (dissect.btrfs.Subvolume attribute) ObjectMap (class in dissect.apfs.objects) (class in dissect.apfs.objects.omap) ObjectNameInformation (acquire.acquire.dynamic.windows.types.OBJECT_INFORMATION_CLASS attribute) ObjectPath (class in dissect.cim.utils) Objects (class in dissect.cim.objects) objects (dissect.cim.CIM attribute) (dissect.cim.cim.CIM attribute) objects() (dissect.cim.index.Key method) (dissect.cim.objects.DataPage method) ObjectTypeInformation (acquire.acquire.dynamic.windows.types.OBJECT_INFORMATION_CLASS attribute) OCI_IMAGE (in module dissect.target.loaders.containerimage) oci_layers() (in module dissect.target.filesystems.overlay) OFFICE_COMPONENTS (dissect.target.plugins.apps.productivity.msoffice.MSOffice attribute) OFFICE_DEFAULT_ROOT (dissect.target.plugins.apps.productivity.msoffice.MSOffice attribute) OFFICE_DEFAULT_USER_STARTUP (dissect.target.plugins.apps.productivity.msoffice.MSOffice attribute) OFFICE_KEY (dissect.target.plugins.apps.productivity.msoffice.MSOffice attribute) OFFICE_STARTUP_OPTIONS (dissect.target.plugins.apps.productivity.msoffice.MSOffice attribute) OfficeNativeAddinRecord (in module dissect.target.plugins.apps.productivity.msoffice) OfficeStartupItem (in module dissect.target.plugins.apps.productivity.msoffice) OfficeWebAddinRecord (in module dissect.target.plugins.apps.productivity.msoffice) offset (dissect.archive.vbk.Bank attribute) (dissect.archive.vbk.SnapshotSlot attribute) (dissect.archive.vbk.StgBlockDescriptor property) (dissect.archive.vma.Extent attribute) (dissect.archive.wim.CompressedStream attribute) (dissect.archive.wim.Resource attribute) (dissect.btrfs.stream.Chunk attribute) (dissect.btrfs.stream.Extent attribute) (dissect.btrfs.stream.Stripe attribute) (dissect.cim.cim.Property property) (dissect.cim.classes.ClassDefinitionProperty attribute) (dissect.cim.classes.ClassInstanceProperty property) (dissect.clfs.blf.Stream attribute) (dissect.clfs.c_clfs.BlockHeader attribute) (dissect.clfs.container.Container attribute) (dissect.cramfs.cramfs.INode attribute) (dissect.cramfs.INode attribute) (dissect.cstruct.Field attribute) (dissect.cstruct.types.Field attribute) (dissect.cstruct.types.structure.Field attribute) (dissect.database.bsd.db.Page attribute) (dissect.database.ese.page.Tag attribute) (dissect.database.ese.table.Column property) (dissect.database.sqlite3.sqlite3.Cell attribute) (dissect.database.sqlite3.sqlite3.Page attribute) (dissect.database.sqlite3.sqlite3.WALFrame attribute) (dissect.etl.Buffer attribute) (dissect.etl.etl.Buffer attribute) (dissect.eventlog.wevt.WEVT attribute) (dissect.eventlog.wevt.WEVT_TYPE attribute) (dissect.eventlog.wevt_object.WevtObject attribute) (dissect.evidence.ad1.FileEntry attribute) (dissect.evidence.ad1.FileMeta attribute) (dissect.evidence.ewf.SectionDescriptor attribute) (dissect.evidence.ewf.Segment attribute) (dissect.evidence.ewf.TableSection attribute) (dissect.executable.elf.elf.Section attribute) (dissect.executable.elf.elf.SectionTable attribute) (dissect.executable.elf.elf.Segment attribute) (dissect.executable.elf.elf.SegmentTable attribute) (dissect.executable.elf.Section attribute) (dissect.executable.elf.SectionTable attribute) (dissect.executable.elf.Segment attribute) (dissect.executable.elf.SegmentTable attribute) (dissect.executable.pe.directory.com_descriptor.ComStream attribute) (dissect.ffs.ffs.CylinderGroup attribute) (dissect.fve.bde.eow.EowBitmap attribute) (dissect.fve.bde.eow.EowInformation attribute) (dissect.fve.bde.information.Information attribute) (dissect.fve.crypto.dmcrypt.CryptStream attribute) (dissect.fve.luks.metadata.KeyslotArea attribute) (dissect.fve.luks.metadata.Segment attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageFileObject attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageObjectTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageReplayLog attribute) (dissect.hypervisor.disk.asif.Directory attribute) (dissect.hypervisor.disk.asif.Table attribute) (dissect.hypervisor.disk.qcow2.L2Table attribute) (dissect.hypervisor.disk.qcow2.QCow2Snapshot attribute) (dissect.hypervisor.disk.vhd.BlockAllocationTable attribute) (dissect.hypervisor.disk.vhdx.BlockAllocationTable attribute) (dissect.hypervisor.disk.vhdx.MetadataTable attribute) (dissect.hypervisor.disk.vhdx.ParentLocator attribute) (dissect.hypervisor.disk.vhdx.RegionTable attribute) (dissect.hypervisor.disk.vmdk.RawDisk attribute) (dissect.hypervisor.disk.vmdk.SparseDisk attribute) (dissect.ntfs.attr.AttributeHeader attribute) (dissect.ntfs.AttributeHeader attribute) (dissect.ntfs.index.IndexBuffer attribute) (dissect.ntfs.index.IndexEntry attribute) (dissect.ntfs.IndexEntry attribute) (dissect.ntfs.mft.MftRecord attribute) (dissect.ntfs.MftRecord attribute) (dissect.ntfs.usnjrnl.UsnRecord attribute) (dissect.ntfs.UsnRecord attribute) (dissect.ole.ole.ChainStream attribute) (dissect.squashfs.INode attribute) (dissect.squashfs.squashfs.INode attribute) (dissect.target.helpers.nfs.nfs3.ReadParams attribute) (dissect.target.loaders.res.File attribute) (dissect.target.volume.Volume attribute) (dissect.util.stream.RangeStream attribute) (dissect.volume.disk.Partition attribute) (dissect.volume.disk.partition.Partition attribute) (dissect.volume.disk.schemes.MBR attribute) (dissect.volume.disk.schemes.mbr.MBR attribute) (dissect.volume.raid.raid.PhysicalDisk attribute) (dissect.volume.vss.BlockList attribute) (dissect.volume.vss.RangeList attribute) (dissect.volume.vss.StoreBitmap attribute) offset_data (dissect.hypervisor.util.vmtar.VisorTarInfo attribute) offset_into_cluster() (in module dissect.hypervisor.disk.qcow2) offset_into_subcluster() (in module dissect.hypervisor.disk.qcow2) offset_to_data (dissect.executable.pe.directory.resource.ResourceDataEntry property) (dissect.executable.pe.directory.ResourceDataEntry property) offset_to_l1_index() (in module dissect.hypervisor.disk.qcow2) offset_to_l2_index() (in module dissect.hypervisor.disk.qcow2) offset_to_sc_index() (in module dissect.hypervisor.disk.qcow2) offsets (dissect.target.containers.split.SplitContainer attribute) oid (dissect.apfs.cursor.Cursor attribute) (dissect.apfs.objects.base.Object property) (dissect.apfs.objects.fs.INode attribute) (dissect.apfs.objects.Object property) (dissect.apfs.stream.FileStream attribute) OK (dissect.target.helpers.nfs.nfs3.MountStat attribute) (dissect.target.helpers.nfs.nfs3.NfsStat attribute) oldest_record_number (dissect.eventlog.Evt attribute) (dissect.eventlog.evt.Evt attribute) OLE (class in dissect.ole) (class in dissect.ole.ole) ole (dissect.ole.ole.Chain attribute) (dissect.ole.ole.DirectoryEntry attribute) (dissect.target.plugins.os.windows.jumplist.AutomaticDestinationFile attribute) ole32 (in module acquire.acquire.gui.win32) ole_def (in module dissect.ole.c_ole) omap (dissect.apfs.cursor.Cursor attribute) (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) (dissect.apfs.objects.nx_superblock.NxSuperblock property) (dissect.apfs.objects.NxSuperblock property) on_descriptor (flow.record.jsonpacker.JsonRecordPacker attribute) (flow.record.JsonRecordPacker attribute) (flow.record.packer.RecordPacker attribute) on_new_descriptor() (flow.record.stream.RecordStreamWriter method) OnDemand (dissect.target.plugins.apps.productivity.msoffice.LoadBehavior attribute) ONLY_READ_CACHE (in module dissect.target.helpers.cache) OP_EOS (in module dissect.util.compression.lzvn) OP_LRG_D (in module dissect.util.compression.lzvn) OP_LRG_L (in module dissect.util.compression.lzvn) OP_LRG_M (in module dissect.util.compression.lzvn) OP_MED_D (in module dissect.util.compression.lzvn) OP_NOP (in module dissect.util.compression.lzvn) OP_PRE_D (in module dissect.util.compression.lzvn) OP_SML_D (in module dissect.util.compression.lzvn) OP_SML_L (in module dissect.util.compression.lzvn) OP_SML_M (in module dissect.util.compression.lzvn) OP_UDEF (in module dissect.util.compression.lzvn) opaque (dissect.target.helpers.nfs.nfs3.CookieVerf attribute) (dissect.target.helpers.nfs.nfs3.FileHandle attribute) OpaqueVarLengthSerializer (class in dissect.target.helpers.sunrpc.serializer) OPCO (class in dissect.eventlog.wevt_object) opcode (dissect.etl.headers.event.EventDescriptor attribute) (dissect.etl.headers.event.EventHeader property) (dissect.etl.headers.headers.MessageTraceHeader attribute) (dissect.etl.headers.system.SystemSpecificHeader property) open (in module dissect.hypervisor.util.vmtar) open() (dissect.apfs.objects.fs.INode method) (dissect.apfs.objects.fs.Snapshot method) (dissect.apfs.objects.fs.XAttr method) (dissect.archive.vbk.DirItem method) (dissect.archive.vbk.IntFibItem method) (dissect.archive.vma.Device method) (dissect.archive.wim.DirectoryEntry method) (dissect.archive.wim.Resource method) (dissect.archive.xva.XVA method) (dissect.btrfs.btrfs.INode method) (dissect.btrfs.INode method) (dissect.cim.classes.DataRegion method) (dissect.clfs.c_clfs.BlockHeader method) (dissect.cramfs.cramfs.INode method) (dissect.cramfs.INode method) (dissect.database.sqlite3.sqlite3.Page method) (dissect.etl.Buffer method) (dissect.etl.etl.Buffer method) (dissect.evidence.ad1.AD1 method) (dissect.evidence.ad1.FileEntry method) (dissect.evidence.asdf.asdf.AsdfSnapshot method) (dissect.evidence.asdf.asdf.Metadata method) (dissect.evidence.asdf.AsdfSnapshot method) (dissect.evidence.AsdfSnapshot method) (dissect.evidence.EWF method) (dissect.evidence.ewf.EWF method) (dissect.executable.PE method) (dissect.executable.pe.directory.com_descriptor.ComStream method) (dissect.executable.pe.directory.debug.DebugEntry method) (dissect.executable.pe.directory.resource.Resource method) (dissect.executable.pe.directory.resource.ResourceDataEntry method) (dissect.executable.pe.directory.ResourceDataEntry method) (dissect.executable.pe.PE method) (dissect.executable.pe.pe.PE method) (dissect.executable.pe.pe.Section method) (dissect.extfs.extfs.INode method) (dissect.extfs.INode method) (dissect.extfs.journal.DescriptorBlockTag method) (dissect.fat.fat.DirectoryEntry method) (dissect.fat.fat.RootDirectory method) (dissect.ffs.ffs.INode method) (dissect.fve.bde.BDE method) (dissect.fve.bde.bde.BDE method) (dissect.fve.luks.LUKS method) (dissect.fve.luks.luks.LUKS method) (dissect.hypervisor.descriptor.hyperv.HyperVStorageFileObject method) (dissect.hypervisor.disk.asif.ASIF method) (dissect.hypervisor.disk.hdd.HDD method) (dissect.hypervisor.disk.qcow2.QCow2 method) (dissect.hypervisor.disk.qcow2.QCow2Snapshot method) (dissect.jffs.jffs2.INode method) (dissect.ntfs.attr.Attribute method) (dissect.ntfs.attr.AttributeHeader method) (dissect.ntfs.Attribute method) (dissect.ntfs.AttributeHeader method) (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.MftRecord method) (dissect.ntfs.util.AttributeCollection method) (dissect.ole.ole.Chain method) (dissect.ole.ole.DirectoryEntry method) (dissect.ole.ole.MiniChain method) (dissect.qnxfs.qnx4.INode4 method) (dissect.qnxfs.qnx6.INode6 method) (dissect.regf.regf.RegistryHive method) (dissect.regf.RegistryHive method) (dissect.squashfs.INode method) (dissect.squashfs.squashfs.INode method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.MappedCompressedFile method) (dissect.target.filesystem.MappedFile method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry method) (dissect.target.filesystems.cb.CbFilesystemEntry method) (dissect.target.filesystems.config.ConfigurationEntry method) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.exfat.ExfatFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.fat.FatFilesystemEntry method) (dissect.target.filesystems.ffs.FfsFilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemEntry method) (dissect.target.filesystems.jffs.JffsFilesystemEntry method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry method) (dissect.target.filesystems.smb.SmbFilesystemEntry method) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystemEntry method) (dissect.target.filesystems.vbk.VbkFilesystemEntry method) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystemEntry method) (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) (dissect.target.helpers.mount.DissectMount method) (dissect.target.loaders.ab.AndroidBackup method) (dissect.target.loaders.itunes.ITunesBackup method) (dissect.target.loaders.res.File method) (dissect.target.loaders.res.ResFile method) (dissect.target.loaders.res.UPR method) (dissect.target.plugins.os.unix.linux.debian.proxmox._os.ProxmoxConfigFileEntry method) (dissect.target.Target class method) (dissect.target.target.Target class method) (dissect.vmfs.descriptor.FileDescriptor method) (dissect.vmfs.FileDescriptor method) (dissect.vmfs.lvm.Volume method) (dissect.vmfs.resource.ResourceManager method) (dissect.vmfs.Volume method) (dissect.volume.disk.Partition method) (dissect.volume.disk.partition.Partition method) (dissect.volume.dm.thin.ThinPool method) (dissect.volume.lvm.LVM2Device method) (dissect.volume.lvm.metadata.LogicalVolume method) (dissect.volume.lvm.metadata.MirrorSegment method) (dissect.volume.lvm.metadata.Segment method) (dissect.volume.lvm.metadata.StripedSegment method) (dissect.volume.lvm.metadata.ThinPoolSegment method) (dissect.volume.lvm.metadata.ThinSegment method) (dissect.volume.lvm.physical.LVM2Device method) (dissect.volume.raid.raid.PhysicalDisk method) (dissect.volume.raid.raid.VirtualDisk method) (dissect.volume.vss.Store method) (dissect.xfs.xfs.INode method) (in module dissect.target.container) (in module dissect.target.filesystem) (in module dissect.target.loader) (in module dissect.target.volume) (in module dissect.util.cpio) open_all() (dissect.target.Target class method) (dissect.target.target.Target class method) (dissect.target.volume.LogicalVolumeSystem class method) (dissect.target.volumes.ddf.DdfVolumeSystem class method) (dissect.target.volumes.lvm.LvmVolumeSystem class method) (dissect.target.volumes.md.MdVolumeSystem class method) (dissect.target.volumes.vmfs.VmfsVolumeSystem class method) open_child() (dissect.target.Target method) (dissect.target.target.Target method) open_children() (dissect.target.Target method) (dissect.target.target.Target method) open_decompress() (in module dissect.target.helpers.fsutil) open_direct() (dissect.target.Target class method) (dissect.target.target.Target class method) open_directory_object() (in module acquire.acquire.dynamic.windows.ntdll) open_encrypted() (in module dissect.target.volume) open_fve() (in module dissect.fve.tools.dd) open_handles_file (dissect.target.plugins.apps.edr.acquire.AcquirePlugin attribute) open_kape_file() (in module dissect.target.loaders.kape) open_lvm() (in module dissect.target.volume) OPEN_METH (dissect.hypervisor.util.vmtar.VisorTarFile attribute) open_multi_volume() (in module dissect.target.filesystem) open_parent() (in module dissect.hypervisor.disk.vhdx) (in module dissect.hypervisor.disk.vmdk) open_path() (in module dissect.target.tools.dump) (in module flow.record) (in module flow.record.base) open_path_or_stream() (in module flow.record) (in module flow.record.base) open_pool (dissect.volume.lvm.metadata.ThinPoolSegment attribute) open_process() (in module acquire.acquire.dynamic.windows.handles) open_raw() (dissect.target.Target class method) (dissect.target.target.Target class method) open_reader() (dissect.target.helpers.cache.Cache method) open_segment() (dissect.evidence.EWF method) (dissect.evidence.ewf.EWF method) open_shell() (in module dissect.target.tools.shell) open_stream() (in module flow.record) (in module flow.record.base) open_subvolume (dissect.btrfs.Btrfs attribute) (dissect.btrfs.btrfs.Btrfs attribute) open_subvolume() (dissect.target.filesystems.btrfs.BtrfsFilesystem method) open_target() (in module dissect.target.tools.utils.cli) open_targets() (in module dissect.target.tools.utils.cli) OPEN_TYPES (in module dissect.target.volumes.lvm) open_wal() (dissect.database.SQLite3 method) (dissect.database.sqlite3.SQLite3 method) (dissect.database.sqlite3.sqlite3.SQLite3 method) open_writer() (dissect.target.helpers.cache.Cache method) OPEN_WRITERS_LIMIT (in module dissect.target.tools.dump) OpenBsdPlugin (class in dissect.target.plugins.os.unix.bsd.openbsd._os) opendir() (dissect.target.helpers.mount.DissectMount method) opened (acquire.acquire.log.DelayedFileHandler attribute) OpenHandles (class in acquire.acquire.acquire) OpenProcess (in module acquire.acquire.dynamic.windows.handles) OpenProcessError OpenProcessToken (in module acquire.acquire.dynamic.windows.handles) opensave() (dissect.target.plugins.os.windows.regf.mru.MRUPlugin method) OpenSaveMRURecord (in module dissect.target.plugins.os.windows.regf.mru) OpenSSHPlugin (class in dissect.target.plugins.apps.ssh.openssh) OpenSSHUserRecordDescriptor (in module dissect.target.plugins.apps.ssh.ssh) openTable() (dissect.database.ese.tools.impacket.ESENT_DB method) OpenVPNClient (in module dissect.target.plugins.apps.vpn.openvpn) OpenVPNParser (class in dissect.target.plugins.apps.vpn.openvpn) OpenVPNPlugin (class in dissect.target.plugins.apps.vpn.openvpn) OpenVPNServer (in module dissect.target.plugins.apps.vpn.openvpn) OperatingSystem (class in dissect.target.plugin) OperationTypes (class in dissect.target.plugins.os.unix.packagemanager) operator (dissect.util.ldap.SearchFilter attribute) operator() (dissect.cstruct.expression.ExpressionTokenizer method) OPTICAL_CHANNEL (dissect.target.plugins.os.windows.network.IfTypes attribute) OPTICAL_TRANSPORT (dissect.target.plugins.os.windows.network.IfTypes attribute) optimize_ldap_query() (in module dissect.util.ldap) optional_header (dissect.executable.PE attribute) (dissect.executable.pe.PE attribute) (dissect.executable.pe.pe.PE attribute) options (dissect.target.loaders.log.LogLoader attribute) (dissect.target.plugins.os.unix.linux.network_managers.Parser attribute) (dissect.target.plugins.os.unix.linux.network_managers.Template attribute) OR (dissect.util.ldap.LogicalOperator attribute) ordinal (dissect.executable.pe.directory.export.ExportFunction property) org (dissect.volume.vinum.config.Plex attribute) org_to_layout (in module dissect.volume.vinum.vinum) org_to_level (in module dissect.volume.vinum.vinum) origin (dissect.volume.lvm.metadata.CacheSegment attribute) (dissect.volume.lvm.metadata.HistoricalLogicalVolume attribute) (dissect.volume.lvm.metadata.IntegritySegment attribute) (dissect.volume.lvm.metadata.SnapshotSegment attribute) (dissect.volume.lvm.metadata.ThinSegment attribute) (dissect.volume.lvm.metadata.WriteCacheSegment attribute) original_offset (dissect.volume.vss.BlockDescriptor attribute) original_size (dissect.archive.wim.CompressedStream attribute) (dissect.archive.wim.Resource attribute) OS (class in dissect.target.filesystems.cb) os (dissect.target.loaders.cellebrite.DeviceInfo attribute) os() (dissect.target.loaders.profile.ProfileOSPlugin method) (dissect.target.loaders.res.ResOSPlugin method) (dissect.target.plugin.OSPlugin method) (dissect.target.plugins.os.default._os.DefaultOSPlugin method) (dissect.target.plugins.os.unix._os.UnixPlugin method) (dissect.target.plugins.os.unix.bsd._os.BsdPlugin method) (dissect.target.plugins.os.unix.bsd.citrix._os.CitrixPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin method) (dissect.target.plugins.os.unix.esxi._os.ESXiPlugin method) (dissect.target.plugins.os.unix.linux._os.LinuxPlugin method) (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin method) (dissect.target.plugins.os.unix.linux.debian.proxmox._os.ProxmoxPlugin method) (dissect.target.plugins.os.unix.linux.debian.vyos._os.VyosPlugin method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSPlugin method) (dissect.target.plugins.os.windows._os.WindowsPlugin method) os2_header (dissect.executable.PE attribute) (dissect.executable.pe.PE attribute) (dissect.executable.pe.pe.PE attribute) os_crypt_key (dissect.target.plugins.apps.browser.chromium.ChromiumKeys attribute) os_match() (in module dissect.target.plugin) OS_MODULE_PATH (in module dissect.target.plugin) os_plugins() (in module dissect.target.plugin) os_tree() (dissect.target.plugin.OSPlugin method) os_type_from_path() (in module dissect.target.loaders.dir) osinfo() (dissect.target.plugins.general.osinfo.OSInfoPlugin method) OSInfoPlugin (class in dissect.target.plugins.general.osinfo) OSInfoRecord (in module dissect.target.plugins.general.osinfo) OSPFIGP (dissect.target.helpers.network.IANAProtocol attribute) OSPlugin (class in dissect.target.plugin) OSX (dissect.target.plugin.OperatingSystem attribute) Other (dissect.target.plugins.os.unix.packagemanager.OperationTypes attribute) OTHER (dissect.target.plugins.os.windows.network.IfTypes attribute) otime (dissect.btrfs.btrfs.INode property) (dissect.btrfs.INode property) otime_ns (dissect.btrfs.btrfs.INode property) (dissect.btrfs.INode property) OUTBOUND (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) outcome (acquire.acquire.collector.Record attribute) Outcome (class in acquire.acquire.collector) output (acquire.acquire.collector.Collector attribute) Output (class in acquire.acquire.outputs.base) output (dissect.target.plugin.FunctionDescriptor attribute) output_dir (dissect.target.tools.dump.DumpState attribute) OUTPUTS (in module dissect.target.plugin) outType (dissect.eventlog.wevt_object.TEMP_DESCRIPTOR attribute) ova (dissect.archive.xva.XVA property) (dissect.target.loaders.ova.OvaLoader attribute) OvaLoader (class in dissect.target.loaders.ova) overflow_data() (in module dissect.database.bsd.db) overlay (dissect.volume.vss.BlockDescriptor attribute) Overlay2Filesystem (class in dissect.target.filesystems.overlay) Overlay2Loader (class in dissect.target.loaders.overlay2) OverlayFilesystem (class in dissect.target.filesystems.overlay) OverlayLoader (class in dissect.target.loaders.overlay) overlays (dissect.util.stream.OverlayStream attribute) OverlayStream (class in dissect.util.stream) OVF (class in dissect.hypervisor.descriptor.ovf) OvfLoader (class in dissect.target.loaders.ovf) owner (dissect.ntfs.secure.SecurityDescriptor attribute) (dissect.ntfs.SecurityDescriptor attribute) (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) owner() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) owner_id (dissect.ntfs.attr.StandardInformation property) P P (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) p16() (in module dissect.cstruct) (in module dissect.cstruct.utils) p32() (in module dissect.cstruct) (in module dissect.cstruct.utils) p64() (in module dissect.cstruct) (in module dissect.cstruct.utils) p8() (in module dissect.cstruct) (in module dissect.cstruct.utils) pack() (dissect.target.tools.dump.SortedKeysJsonRecordPacker method) (flow.record.jsonpacker.JsonRecordPacker method) (flow.record.JsonRecordPacker method) (flow.record.packer.RecordPacker method) (in module dissect.cstruct) (in module dissect.cstruct.utils) pack_descriptors (flow.record.jsonpacker.JsonRecordPacker attribute) (flow.record.JsonRecordPacker attribute) pack_obj() (flow.record.jsonpacker.JsonRecordPacker method) (flow.record.JsonRecordPacker method) (flow.record.packer.RecordPacker method) Package (class in dissect.database.bsd.tools.rpm) PACKAGE_NAME_NEEDLE (in module dissect.target.plugins.os.windows.catroot) PackageEntry (class in dissect.database.bsd.tools.rpm) PackageManagerLogRecord (in module dissect.target.plugins.os.unix.packagemanager) PackageManagerPlugin (class in dissect.target.plugins.os.unix.packagemanager) Packages (class in dissect.database.bsd.tools.rpm) packb (in module flow.record.packer) packchar (dissect.cstruct.Packed attribute) (dissect.cstruct.types.Packed attribute) (dissect.cstruct.types.packed.Packed attribute) Packed (class in dissect.cstruct) (class in dissect.cstruct.types) (class in dissect.cstruct.types.packed) packed_size (dissect.target.loaders.res.File attribute) packer (dissect.target.tools.dump.JsonLinesWriter attribute) (flow.record.adapter.jsonfile.JsonfileReader attribute) (flow.record.adapter.jsonfile.JsonfileWriter attribute) (flow.record.adapter.splunk.SplunkWriter attribute) (flow.record.stream.RecordStreamReader attribute) (flow.record.stream.RecordStreamWriter attribute) packer_on_new_descriptor() (flow.record.adapter.jsonfile.JsonfileWriter method) packet() (dissect.target.plugins.os.unix.linux.proc.Sockets method) (dissect.target.plugins.os.unix.linux.sockets.NetSocketPlugin method) PacketSocket (class in dissect.target.plugins.os.unix.linux.proc) PacketSocketRecord (in module dissect.target.plugins.os.unix.linux.sockets) PaddingTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) Page (class in dissect.database.bsd.db) (class in dissect.database.ese) (class in dissect.database.ese.page) (class in dissect.database.sqlite3.sqlite3) page (dissect.archive.vbk.Bank attribute) (dissect.archive.vbk.FibMetaSparseTable attribute) (dissect.archive.vbk.FibStream attribute) (dissect.archive.vbk.MetaTableDescriptor property) (dissect.archive.vbk.MetaVector attribute) (dissect.archive.vbk.PropertiesDictionary attribute) (dissect.cim.index.IndexPage attribute) (dissect.database.bsd.DB attribute) (dissect.database.bsd.db.DB attribute) (dissect.database.DB attribute) (dissect.database.ESE attribute) (dissect.database.ese.ESE attribute) (dissect.database.ese.ese.ESE attribute) (dissect.database.ese.page.Tag attribute) (dissect.database.SQLite3 attribute) (dissect.database.sqlite3.SQLite3 attribute) (dissect.database.sqlite3.sqlite3.Cell attribute) (dissect.database.sqlite3.sqlite3.Index attribute) (dissect.database.sqlite3.sqlite3.SQLite3 attribute) (dissect.database.sqlite3.sqlite3.Table attribute) (dissect.database.sqlite3.Table attribute) page() (dissect.archive.vbk.SnapshotSlot method) (dissect.archive.vbk.VBK method) (dissect.cim.index.Store method) (dissect.cim.objects.Store method) page_count (dissect.database.sqlite3.sqlite3.WALFrame property) PAGE_FLAG (in module dissect.database.ese.c_ese) page_map (dissect.database.sqlite3.sqlite3.WALCheckpoint property) page_num (dissect.cim.index.IndexPage attribute) page_number (dissect.cim.objects.DataPage attribute) (dissect.database.sqlite3.sqlite3.WALFrame property) page_size (dissect.database.bsd.DB attribute) (dissect.database.bsd.db.DB attribute) (dissect.database.DB attribute) (dissect.database.ESE attribute) (dissect.database.ese.ESE attribute) (dissect.database.ese.ese.ESE attribute) (dissect.database.SQLite3 attribute) (dissect.database.sqlite3.SQLite3 attribute) (dissect.database.sqlite3.sqlite3.SQLite3 attribute) PAGE_SIZE (in module dissect.archive.c_vbk) PAGE_TYPES (in module dissect.database.sqlite3.sqlite3) PageFaultGuid (in module dissect.etl.utils) pages() (dissect.archive.vbk.MetaBlob method) (dissect.database.ESE method) (dissect.database.ese.ESE method) (dissect.database.ese.ese.ESE method) (dissect.database.SQLite3 method) (dissect.database.sqlite3.SQLite3 method) (dissect.database.sqlite3.sqlite3.SQLite3 method) PAINTSTRUCT (class in acquire.acquire.gui.win32) Pair (class in dissect.hypervisor.descriptor.vmx) Palette (in module dissect.cstruct.utils) PamUnixService (class in dissect.target.plugins.os.unix.log.auth) PanelPathRecord (in module dissect.target.plugins.apps.productivity.sevenzip) PARA (dissect.target.plugins.os.windows.network.IfTypes attribute) PARALLELS_SYSTEM_PATHS (in module dissect.target.plugins.child.parallels) PARALLELS_USER_PATHS (in module dissect.target.plugins.child.parallels) ParallelsChildTargetPlugin (class in dissect.target.plugins.child.parallels) params (dissect.target.helpers.sunrpc.sunrpc.CallBody attribute) (flow.record.fieldtypes.uri property) Params (in module dissect.target.helpers.sunrpc.client) parent (dissect.apfs.objects.fs.INode property) (dissect.btrfs.btrfs.INode attribute) (dissect.btrfs.btrfs.Subvolume attribute) (dissect.btrfs.INode attribute) (dissect.btrfs.Subvolume attribute) (dissect.fat.fat.DirectoryEntry attribute) (dissect.ffs.ffs.INode attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.hypervisor.disk.hdd.HDS attribute) (dissect.hypervisor.disk.hdd.Shot attribute) (dissect.hypervisor.disk.vdi.VDI attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) (dissect.hypervisor.disk.vmdk.SparseDisk attribute) (dissect.hypervisor.disk.vmdk.VMDK attribute) (dissect.jffs.jffs2.INode attribute) (dissect.ntfs.usnjrnl.UsnRecord property) (dissect.ntfs.UsnRecord property) (dissect.squashfs.INode attribute) (dissect.squashfs.squashfs.INode attribute) (dissect.target.helpers.compat.path_310.PureDissectPath property) (dissect.target.helpers.compat.path_311.PureDissectPath property) (dissect.target.loaders.res.Folder attribute) (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) (dissect.target.plugins.os.unix.locate.mlocate.MLocate attribute) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM attribute) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.vmfs.FileDescriptor property) (flow.record.fieldtypes.path property) (in module flow.record.whitelist) parent() (dissect.cim.cim.Namespace method) parent_guid (dissect.etl.headers.headers.EventInstanceGUIDHeader property) parent_index (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj attribute) parent_inum (dissect.jffs.jffs2.DirEntry attribute) parent_locator (dissect.hypervisor.disk.vhdx.VHDX attribute) PARENT_LOCATOR_GUID (in module dissect.hypervisor.disk.c_vhdx) parent_name (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) ParentLocator (class in dissect.hypervisor.disk.vhdx) parents (dissect.apfs.objects.fs.INode property) (dissect.btrfs.btrfs.INode property) (dissect.btrfs.INode property) (dissect.target.helpers.compat.path_310.PureDissectPath property) (dissect.target.helpers.compat.path_311.PureDissectPath property) PARITY_0 (dissect.volume.raid.stream.Layout attribute) PARITY_0_6 (dissect.volume.raid.stream.Layout attribute) PARITY_N (dissect.volume.raid.stream.Layout attribute) PARITY_N_6 (dissect.volume.raid.stream.Layout attribute) parse (dissect.database.ese.util.ColumnType attribute) parse() (dissect.cstruct.parser.CStyleParser method) (dissect.cstruct.parser.Parser method) (dissect.cstruct.parser.TokenParser method) (dissect.hypervisor.descriptor.vmx.VMX class method) (dissect.hypervisor.disk.vmdk.DiskDescriptor class method) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager method) (dissect.target.plugins.os.unix.linux.network_managers.Parser method) (dissect.target.plugins.os.unix.log.auth.BaseService class method) (dissect.target.plugins.os.unix.log.auth.PamUnixService class method) (dissect.target.plugins.os.unix.log.auth.PkexecService class method) (dissect.target.plugins.os.unix.log.auth.SshdService class method) (dissect.target.plugins.os.unix.log.auth.SudoService class method) (dissect.target.plugins.os.unix.log.auth.SuService class method) (dissect.target.plugins.os.unix.log.auth.SystemdLogindService class method) (dissect.target.plugins.os.windows.prefetch.Prefetch method) (dissect.util.ldap.SearchFilter class method) (dissect.vmfs.address.Address static method) (dissect.vmfs.address.FileBlockAddr static method) (dissect.vmfs.address.FileDescriptorAddr static method) (dissect.vmfs.address.JournalBlockAddr static method) (dissect.vmfs.address.LargeFileBlockAddr static method) (dissect.vmfs.address.PointerBlockAddr static method) (dissect.vmfs.address.PointerBlockAddr64 static method) (dissect.vmfs.address.SmallFileBlockAddr static method) (dissect.vmfs.address.SubBlockAddr static method) (dissect.vmfs.address.SubBlockAddr64 static method) (in module dissect.shellitem.tools.lnk) (in module dissect.target.helpers.configutil) parse_acquire_args() (in module acquire.acquire.utils) parse_address() (dissect.vmfs.resource.FileBlockResourceVMFS5 method) (dissect.vmfs.resource.FileDescriptorResourceVMFS5 method) (dissect.vmfs.resource.FileDescriptorResourceVMFS6 method) (dissect.vmfs.resource.JournalBlockResourceVMFS6 method) (dissect.vmfs.resource.LargeFileBlockResourceVMFS6 method) (dissect.vmfs.resource.PointerBlock2ResourceVMFS5 method) (dissect.vmfs.resource.PointerBlock2ResourceVMFS6 method) (dissect.vmfs.resource.PointerBlockResourceVMFS5 method) (dissect.vmfs.resource.PointerBlockResourceVMFS6 method) (dissect.vmfs.resource.ResourceFile method) (dissect.vmfs.resource.SmallFileBlockResourceVMFS6 method) (dissect.vmfs.resource.SubBlockResourceVMFS5 method) (dissect.vmfs.resource.SubBlockResourceVMFS6 method) parse_arguments() (in module dissect.target.tools.dump) parse_attr() (in module dissect.target.plugins.filesystem.unix.capability) parse_autodetect_format_log() (in module dissect.target.plugins.apps.webserver.iis) parse_boot_cfg() (in module dissect.target.plugins.os.unix.esxi._os) parse_bxml() (in module dissect.eventlog.bxml) parse_cell_data() (dissect.regf.regf.RegistryHive method) (dissect.regf.RegistryHive method) parse_chunk() (in module dissect.eventlog.evt) parse_cipher_spec() (in module dissect.fve.crypto) parse_color_data() (in module dissect.target.plugins.os.windows.rdpcache) parse_config() (dissect.target.plugins.apps.webserver.nginx.NginxPlugin method) (in module dissect.target.helpers.configutil) parse_config_store() (in module dissect.target.plugins.os.unix.esxi._os) parse_datetime_iso() (in module dissect.target.tools.dump) parse_debian_centos_dhclient_lease() (in module dissect.target.plugins.os.unix.linux.network) parse_def() (in module flow.record.base) parse_device_name() (in module dissect.target.plugins.os.windows.regf.usb) parse_dynamic_dst() (in module dissect.target.plugins.os.windows.datetime) parse_entry() (in module dissect.target.plugins.filesystem.unix.capability) parse_esedb() (dissect.target.plugins.os.windows.search.SearchIndexPlugin method) parse_esx_conf() (in module dissect.target.plugins.os.unix.esxi._os) parse_file() (dissect.target.helpers.configutil.Bin method) (dissect.target.helpers.configutil.ConfigurationParser method) (dissect.target.helpers.configutil.CSVish method) (dissect.target.helpers.configutil.Default method) (dissect.target.helpers.configutil.Env method) (dissect.target.helpers.configutil.Indentation method) (dissect.target.helpers.configutil.Ini method) (dissect.target.helpers.configutil.Json method) (dissect.target.helpers.configutil.Leases method) (dissect.target.helpers.configutil.SystemD method) (dissect.target.helpers.configutil.Toml method) (dissect.target.helpers.configutil.Txt method) (dissect.target.helpers.configutil.Xml method) (dissect.target.helpers.configutil.Yaml method) (dissect.target.plugins.apps.vpn.openvpn.OpenVPNParser method) (dissect.target.plugins.os.windows.amcache.AmcachePluginOldMixin method) parse_files() (in module dissect.target.plugins.os.windows.everything.parser) parse_fish_history() (dissect.target.plugins.os.unix.history.CommandHistoryPlugin method) parse_flex_value() (in module dissect.target.helpers.regutil) parse_folder() (in module dissect.target.plugins.os.windows.everything.parser) parse_folders() (in module dissect.target.plugins.os.windows.everything.parser) parse_fs_object_key() (in module dissect.apfs.util) parse_fsblock() (in module dissect.xfs.xfs) parse_fstab() (in module dissect.target.plugins.os.unix._os) parse_generic_history() (dissect.target.plugins.os.unix.history.CommandHistoryPlugin method) parse_host_user() (in module dissect.target.plugins.apps.ssh.putty) parse_iis_datetime() (in module dissect.target.plugins.apps.webserver.iis) parse_iis_format_log() (in module dissect.target.plugins.apps.webserver.iis) parse_inventory_application() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) parse_inventory_application_file() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) parse_inventory_application_shortcut() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) parse_inventory_device_container() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) parse_inventory_driver_binary() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) parse_inventory_file() (in module dissect.target.plugins.apps.virtualization.vmware_workstation) parse_ip() (in module dissect.target.plugins.os.unix.linux.proc) parse_json_line() (in module dissect.target.plugins.apps.webserver.nginx) parse_key() (dissect.target.plugins.apps.productivity.sevenzip.SevenZipPlugin method) parse_key_bag() (in module dissect.target.loaders.itunes) parse_key_type() (in module dissect.target.helpers.keychain) parse_known_host() (in module dissect.target.plugins.apps.ssh.openssh) parse_lnk_file() (in module dissect.target.plugins.os.windows.lnk) parse_log_date_time() (in module dissect.target.plugins.os.unix.linux.debian.dpkg) parse_log_line() (in module dissect.target.plugins.os.unix.linux.debian.dpkg) parse_metadata() (in module dissect.volume.lvm.physical) parse_metrics() (dissect.target.plugins.os.windows.prefetch.Prefetch method) parse_mru_ex_key() (in module dissect.target.plugins.os.windows.regf.mru) parse_mru_key() (in module dissect.target.plugins.os.windows.regf.mru) parse_netscaler_bash_history() (dissect.target.plugins.os.unix.bsd.citrix.history.CitrixCommandHistoryPlugin method) parse_netscaler_cli_history() (dissect.target.plugins.os.unix.bsd.citrix.history.CitrixCommandHistoryPlugin method) parse_network_manager_centos_dhcp_lease() (in module dissect.target.plugins.os.unix.linux.network) parse_network_manager_dhcp_lease_new() (in module dissect.target.plugins.os.unix.linux.network) parse_network_manager_dhcp_lease_old() (in module dissect.target.plugins.os.unix.linux.network) parse_networkd_dhcp_lease() (in module dissect.target.plugins.os.unix.linux.network) parse_nsarray() (in module dissect.util.plist) parse_nsdata() (in module dissect.util.plist) parse_nsdate() (in module dissect.util.plist) parse_nsset() (in module dissect.util.plist) parse_nsurl() (in module dissect.util.plist) parse_nsuuid() (in module dissect.util.plist) parse_object_path() (in module dissect.cim.utils) parse_office_mru() (in module dissect.target.plugins.os.windows.regf.mru) parse_office_mru_key() (in module dissect.target.plugins.os.windows.regf.mru) parse_options_string() (in module dissect.target.helpers.utils) parse_path() (in module flow.record.adapter.mongo) parse_path_uri() (in module dissect.target.helpers.loaderutil) parse_payload() (in module dissect.etl.etl) parse_programs() (dissect.target.plugins.os.windows.amcache.AmcachePluginOldMixin method) parse_recently_used_xbel() (in module dissect.target.plugins.os.unix.linux.recentlyused) parse_record() (in module dissect.eventlog.evt) parse_shell_item_list() (in module dissect.target.plugins.os.windows.regf.shellbags) parse_sqlite() (dissect.target.plugins.os.windows.search.SearchIndexPlugin method) parse_ssh_key() (in module dissect.target.plugins.apps.ssh.openssh) parse_ssh_public_key_file() (in module dissect.target.plugins.apps.ssh.openssh) parse_start() (in module dissect.target.plugins.apps.remoteaccess.teamviewer) parse_start_element() (dissect.eventlog.bxml.Bxml method) parse_status_block() (in module dissect.target.plugins.os.unix.linux.debian.dpkg) parse_systemtime_transition() (in module dissect.target.plugins.os.windows.datetime) parse_table_columns_constraints() (in module dissect.database.sqlite3.util) parse_ts() (in module dissect.target.plugins.os.unix.linux.recentlyused) (in module dissect.target.plugins.os.windows.regf.nethist) (in module dissect.target.plugins.os.windows.startupinfo) parse_tzi() (in module dissect.target.plugins.os.windows.datetime) parse_ubuntu_cloud_init_dhcp_lease() (in module dissect.target.plugins.os.unix.linux.network) parse_unix_dhcp_leases() (in module dissect.target.plugins.os.unix.linux.network_managers) parse_unix_dhcp_log_messages() (in module dissect.target.plugins.os.unix.linux.network_managers) parse_v1() (dissect.util.compression.lzfse.LZFSECompressedBlockHeader class method) parse_v2() (dissect.util.compression.lzfse.LZFSECompressedBlockHeader class method) parse_value() (in module dissect.regf.regf) parse_version() (in module dissect.target.plugins.os.unix.linux.fortios._os) parse_vinum_config() (in module dissect.volume.vinum.config) parse_w3c_format_log() (in module dissect.target.plugins.apps.webserver.iis) parse_win_datetime() (in module dissect.target.plugins.os.windows.amcache) parse_win_timestamp() (in module dissect.target.plugins.os.windows.amcache) parse_zsh_history() (dissect.target.plugins.os.unix.history.CommandHistoryPlugin method) parsed_data (dissect.target.helpers.configutil.ConfigurationParser attribute) (dissect.target.helpers.configutil.Env attribute) (dissect.target.helpers.configutil.Ini attribute) parsed_path (dissect.target.loader.Loader attribute) parsed_query (dissect.target.loader.Loader attribute) parsed_schema (flow.record.adapter.avro.AvroWriter attribute) ParseError Parser (class in dissect.cstruct.parser) (class in dissect.target.plugins.os.unix.linux.network_managers) parser (dissect.target.helpers.compat.path_313.PureDissectPath attribute) (dissect.target.helpers.configutil.ParserConfig attribute) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager attribute) (dissect.target.plugins.os.unix.linux.network_managers.Template attribute) parser_items (dissect.target.filesystems.config.ConfigurationEntry attribute) ParserConfig (class in dissect.target.helpers.configutil) ParserError, [1] ParserOptions (class in dissect.target.helpers.configutil) part_number (dissect.archive.wim.Resource attribute) PARTITION (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) Partition (class in dissect.volume.disk) (class in dissect.volume.disk.partition) PARTITION_TYPES (in module dissect.volume.disk.partition) partition_uuid (dissect.hypervisor.disk.vmdk.ExtentDescriptor attribute) partitions (dissect.volume.disk.Disk attribute) (dissect.volume.disk.disk.Disk attribute) (dissect.volume.disk.schemes.APM attribute) (dissect.volume.disk.schemes.apm.APM attribute) (dissect.volume.disk.schemes.BSD attribute) (dissect.volume.disk.schemes.bsd.BSD attribute) (dissect.volume.disk.schemes.GPT attribute) (dissect.volume.disk.schemes.gpt.GPT attribute) (dissect.volume.disk.schemes.MBR attribute) (dissect.volume.disk.schemes.mbr.MBR attribute) parts() (dissect.cim.index.Key method) pass2key (dissect.hypervisor.descriptor.vmx.Phrase attribute) PASS2KEY_MAP (in module dissect.hypervisor.descriptor.vmx) pass_shown (acquire.acquire.gui.win32.Win32 attribute) PASSPHRASE (dissect.target.helpers.keychain.KeyType attribute) PASSWD_FILES (dissect.target.plugins.os.unix._os.UnixPlugin attribute) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin attribute) password (class in flow.record.fieldtypes.credential) (dissect.target.loaders.mqtt.Broker attribute) (flow.record.fieldtypes.uri property) password_hint (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) password_hint() (dissect.apfs.objects.keybag.VolumeKeybag method) passwords() (dissect.target.plugins.apps.browser.brave.BravePlugin method) (dissect.target.plugins.apps.browser.chrome.ChromePlugin method) (dissect.target.plugins.apps.browser.chromium.ChromiumMixin method) (dissect.target.plugins.apps.browser.chromium.ChromiumPlugin method) (dissect.target.plugins.apps.browser.edge.EdgePlugin method) (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin method) (dissect.target.plugins.os.unix.shadow.ShadowPlugin method) patch() (dissect.executable.elf.elf.Segment method) (dissect.executable.elf.Segment method) patched (dissect.executable.elf.elf.Segment attribute) (dissect.executable.elf.Segment attribute) PatchItem (class in dissect.archive.vbk) PATH (acquire.acquire.collector.ArtifactType attribute) path (acquire.acquire.outputs.dir.DirectoryOutput attribute) (acquire.acquire.outputs.tar.TarOutput attribute) (acquire.acquire.outputs.zip.ZipOutput attribute) (class in flow.record.fieldtypes) (dissect.apfs.objects.fs.INode property) (dissect.btrfs.btrfs.INode property) (dissect.btrfs.btrfs.Subvolume property) (dissect.btrfs.INode property) (dissect.btrfs.Subvolume property) (dissect.database.bsd.tools.rpm.PackageEntry attribute) (dissect.eventlog.Evtx attribute) (dissect.eventlog.evtx.ElfChnk attribute) (dissect.eventlog.evtx.Evtx attribute) (dissect.eventlog.wevtutil.WevtutilWrapper attribute) (dissect.fat.fat.DirectoryEntry property) (dissect.fat.fat.RootDirectory property) (dissect.hypervisor.disk.hdd.Descriptor attribute) (dissect.hypervisor.disk.hdd.HDD attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) (dissect.regf.regf.KeyNode property) (dissect.target.filesystem.FilesystemEntry attribute) (dissect.target.filesystems.smb.SmbStream attribute) (dissect.target.helpers.cache.CacheWriter attribute) (dissect.target.helpers.cache.LineReader attribute) (dissect.target.helpers.regutil.KeyCollection property) (dissect.target.helpers.regutil.RegfKey property) (dissect.target.helpers.regutil.RegistryKey property) (dissect.target.helpers.regutil.VirtualKey property) (dissect.target.loader.Loader attribute) (dissect.target.loaders.cb.CbRegistryKey property) (dissect.target.loaders.cellebrite.Dump attribute) (dissect.target.loaders.cellebrite.Extraction attribute) (dissect.target.loaders.cellebrite.Keychain attribute) (dissect.target.loaders.cellebrite.Ufd attribute) (dissect.target.loaders.cellebrite.Ufdx attribute) (dissect.target.loaders.res.File property) (dissect.target.loaders.res.Folder property) (dissect.target.loaders.smb.SmbRegistryKey property) (dissect.target.plugin.FunctionDescriptor attribute) (dissect.target.plugin.PluginDescriptor attribute) PATH (dissect.target.plugins.child.hyperv.HyperVChildTargetPlugin attribute) (dissect.target.plugins.child.virtuozzo.VirtuozzoChildTargetPlugin attribute) (dissect.target.plugins.os.unix.bsd.darwin.ios.applications.IOSApplicationsPlugin attribute) path (dissect.target.plugins.os.unix.linux.modules.Module attribute) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) (dissect.target.plugins.os.unix.locate.gnulocate.GNULocatePlugin attribute) (dissect.target.plugins.os.unix.locate.mlocate.MLocate attribute) (dissect.target.plugins.os.unix.locate.mlocate.MLocatePlugin attribute) (dissect.target.plugins.os.unix.locate.plocate.PLocatePlugin attribute) (dissect.target.tools.diff.DifferentialEntry attribute) (dissect.target.tools.dump.DumpState property) (dissect.target.tools.dump.Sink attribute) (flow.record.adapter.archive.ArchiveWriter attribute) (flow.record.adapter.split.SplitWriter attribute) (flow.record.base.DynamicFieldtypeModule attribute) (flow.record.fieldtypes.uri property) path() (dissect.target.filesystem.Filesystem method) path_extensions() (dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin method) path_information (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) (dissect.volume.ddf.ddf.PhysicalDiskRecord attribute) path_query (dissect.target.Target attribute) (dissect.target.target.Target attribute) PATH_REPLACEMENTS (in module dissect.target.loaders.res) path_scheme (dissect.target.Target attribute) (dissect.target.target.Target attribute) path_template (flow.record.stream.PathTemplateWriter attribute) pathenvironment() (dissect.target.plugins.os.windows.generic.GenericPlugin method) pathext (dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin property) PathextRecord (in module dissect.target.plugins.os.windows.env) PathHistoryRecord (in module dissect.target.plugins.apps.productivity.sevenzip) paths (dissect.apfs.objects.fs.INode property) (dissect.target.loaders.direct.DirectLoader attribute) PATHS (dissect.target.plugins.apps.shell.powershell.PowerShellHistoryPlugin attribute) paths (dissect.target.plugins.child.colima.ColimaChildTargetPlugin attribute) (dissect.target.plugins.child.lima.LimaChildTargetPlugin attribute) PATHS (dissect.target.plugins.os.unix.linux.debian.snap.SnapPlugin attribute) (dissect.target.plugins.os.unix.trash.GnomeTrashPlugin attribute) paths (dissect.target.plugins.os.windows.adpolicy.ADPolicyPlugin attribute) PATHS (dissect.target.plugins.os.windows.log.etl.EtlPlugin attribute) (dissect.target.plugins.os.windows.log.schedlgu.SchedLgUPlugin attribute) paths (dissect.target.plugins.os.windows.log.schedlgu.SchedLgUPlugin attribute) paths() (dissect.btrfs.btrfs.INode method) (dissect.btrfs.INode method) (dissect.target.plugins.os.windows.rdpcache.RdpCachePlugin method) PathTemplateWriter (class in flow.record.stream) pattern (dissect.target.plugins.apps.webserver.apache.LogFormat attribute) PATTERN_IPTABLES_SAVE_GENERATED (in module dissect.target.plugins.os.unix.linux.iptables) PATTERN_IPTABLES_SAVE_POLICY (in module dissect.target.plugins.os.unix.linux.iptables) PATTERN_IPTABLES_SAVE_RULE (in module dissect.target.plugins.os.unix.linux.iptables) patterns (dissect.cstruct.parser.TokenCollection attribute) pause_writeback (dissect.volume.lvm.metadata.WriteCacheSegment attribute) paused (dissect.fve.bde.BDE property) (dissect.fve.bde.bde.BDE property) PAUSED (dissect.target.plugins.apps.container.podman.ContainerState attribute) payload (dissect.etl.headers.headers.Header property) (dissect.etl.headers.logfile.LogfileHeader property) (dissect.eventlog.wevt.WEVT_TYPE attribute) payload_offset (dissect.etl.headers.headers.MessageTraceHeader attribute) payload_size (dissect.eventlog.wevt.WEVT attribute) payload_types (dissect.eventlog.wevt.WEVT property) PB (dissect.vmfs.resource.ResourceManager property) pb() (dissect.hypervisor.disk.vhdx.BlockAllocationTable method) PB2 (dissect.vmfs.resource.ResourceManager property) pbeWithSha1AndTripleDES_CBC (in module dissect.target.plugins.apps.browser.firefox) pbkdf2() (in module dissect.target.plugins.os.windows.dpapi.crypto) PBKDF2_SALT (in module dissect.hypervisor.util.envelope) PBM_DELTAPOS (in module acquire.acquire.gui.win32) PBM_SETPOS (in module acquire.acquire.gui.win32) PBM_SETRANGE (in module acquire.acquire.gui.win32) PBM_SETRANGE32 (in module acquire.acquire.gui.win32) PBM_SETSTEP (in module acquire.acquire.gui.win32) PBM_STEPIT (in module acquire.acquire.gui.win32) PBS_SMOOTH (in module acquire.acquire.gui.win32) PCA (class in acquire.acquire.acquire) PCA_RESOLVE_CALLED (dissect.target.plugins.os.windows.amcache.PcaGeneralDbType attribute) PcaAppLaunchAppcompatRecord (in module dissect.target.plugins.os.windows.amcache) PcaGeneralAppcompatRecord (in module dissect.target.plugins.os.windows.amcache) PcaGeneralDbType (class in dissect.target.plugins.os.windows.amcache) pcr_bitmap (dissect.fve.bde.information.TpmEncryptedBlobDatum property) pdb (dissect.executable.pe.directory.debug.CodeViewDebugEntry property) pdb_path() (dissect.executable.PE method) (dissect.executable.pe.PE method) (dissect.executable.pe.pe.PE method) PE (class in dissect.executable) (class in dissect.executable.pe) (class in dissect.executable.pe.pe) pe (dissect.executable.pe.directory.base.DataDirectory attribute) (dissect.executable.pe.directory.DataDirectory attribute) (dissect.executable.pe.directory.debug.DebugEntry attribute) (dissect.executable.pe.directory.delay_import.DelayImportModule attribute) (dissect.executable.pe.directory.ImportModule attribute) (dissect.executable.pe.directory.imports.ImportModule attribute) (dissect.executable.pe.pe.Section attribute) (dissect.executable.pe.pe.VirtualStream attribute) pe_count (dissect.volume.lvm.metadata.PhysicalVolume attribute) pe_start (dissect.volume.lvm.metadata.PhysicalVolume attribute) PEBS_INDEX (dissect.etl.headers.event.ExtType attribute) peek() (dissect.target.helpers.configutil.PeekableIterator method) (dissect.util.stream.AlignedStream method) PeekableIterator (class in dissect.target.helpers.configutil) peers (dissect.target.loaders.mqtt.MqttLoader attribute) peers() (dissect.target.loaders.mqtt.Broker method) PEM_ENCRYPTED (in module dissect.target.plugins.apps.ssh.ssh) PEM_MARKER_END_DSA (in module dissect.target.plugins.apps.ssh.ssh) PEM_MARKER_END_EC (in module dissect.target.plugins.apps.ssh.ssh) PEM_MARKER_END_RSA (in module dissect.target.plugins.apps.ssh.ssh) PEM_MARKER_START_DSA (in module dissect.target.plugins.apps.ssh.ssh) PEM_MARKER_START_EC (in module dissect.target.plugins.apps.ssh.ssh) PEM_MARKER_START_RSA (in module dissect.target.plugins.apps.ssh.ssh) pending_updates_count (dissect.target.tools.dump.DumpState attribute) PENDING_UPDATES_LIMIT (in module dissect.target.tools.dump) perf_freq (dissect.etl.headers.logfile.LogfileHeader property) PerfinfoGuid (in module dissect.etl.utils) PerfinfoTraceHeader (class in dissect.etl.headers.system) PERFORMANCE_FREQ (dissect.etl.headers.logfile.ReservedFlags attribute) PERFORMANCE_TIMESTAMP (dissect.etl.headers.headers.EventProperty attribute) persist() (dissect.target.tools.dump.DumpState method) persist_execution_report() (in module acquire.acquire.utils) (in module dissect.target.tools.utils.cli) persist_processing_state() (in module dissect.target.tools.dump) persisted_state() (in module dissect.target.tools.dump) PF (in module dissect.executable.elf.c_elf) pfro() (dissect.target.plugins.os.windows.log.pfro.PfroPlugin method) PfroPlugin (class in dissect.target.plugins.os.windows.log.pfro) PfroRecord (in module dissect.target.plugins.os.windows.log.pfro) pfwlog_def (in module dissect.target.plugins.apps.av.trendmicro) PGM (dissect.target.helpers.network.IANAProtocol attribute) pgno (dissect.database.bsd.db.Page attribute) pgnoFDPMSO (in module dissect.database.ese.c_ese) pgnoFDPMSO_NameIndex (in module dissect.database.ese.c_ese) pgnoFDPMSO_RootObjectIndex (in module dissect.database.ese.c_ese) pgnoFDPMSOShadow (in module dissect.database.ese.c_ese) PhobosLoader (class in dissect.target.loaders.phobos) Phrase (class in dissect.hypervisor.descriptor.vmx) physical_address (dissect.executable.elf.elf.Segment attribute) (dissect.executable.elf.Segment attribute) physical_disk_data (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) physical_disk_records (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) physical_disk_sequence (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) physical_disks (dissect.volume.raid.raid.Configuration attribute) physical_page() (dissect.cim.objects.Store method) PHYSICAL_SECTOR_SIZE_GUID (in module dissect.hypervisor.disk.c_vhdx) physical_threads (dissect.volume.lvm.metadata.VdoPoolSegment attribute) physical_volumes (dissect.volume.lvm.metadata.VolumeGroup attribute) PhysicalDisk (class in dissect.volume.raid.raid) PhysicalDiskData (class in dissect.volume.ddf.ddf) PhysicalDiskRecord (class in dissect.volume.ddf.ddf) PhysicalVolume (class in dissect.volume.lvm.metadata) pid (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) pid_def (in module dissect.target.plugins.os.windows.productkey) PIM (dissect.target.helpers.network.IANAProtocol attribute) PIPE (dissect.target.helpers.network.IANAProtocol attribute) PKCS8_MARKER_END (in module dissect.target.plugins.apps.ssh.ssh) PKCS8_MARKER_END_ENCRYPTED (in module dissect.target.plugins.apps.ssh.ssh) PKCS8_MARKER_START (in module dissect.target.plugins.apps.ssh.ssh) PKCS8_MARKER_START_ENCRYPTED (in module dissect.target.plugins.apps.ssh.ssh) PkexecService (class in dissect.target.plugins.os.unix.log.auth) Plain (class in dissect.fve.crypto) (class in dissect.fve.crypto.base) Plain64 (class in dissect.fve.crypto) (class in dissect.fve.crypto.base) Plain64BE (class in dissect.fve.crypto) (class in dissect.fve.crypto.base) PLC (dissect.target.plugins.os.windows.network.IfTypes attribute) Plex (class in dissect.volume.vinum.config) plex (dissect.volume.vinum.config.SD attribute) (dissect.volume.vinum.vinum.VinumPlexDisk attribute) plexes (dissect.volume.vinum.config.VinumConfigs attribute) (dissect.volume.vinum.vinum.Config attribute) (dissect.volume.vinum.vinum.VinumMirrorDisk attribute) plexoffset (dissect.volume.vinum.config.SD attribute) PlexOrg (class in dissect.volume.vinum.config) PlexState (class in dissect.volume.vinum.config) plist (dissect.util.plist.NSKeyedArchiver attribute) plocate_def (in module dissect.target.plugins.os.unix.locate.plocate) PLocateFile (class in dissect.target.plugins.os.unix.locate.plocate) PLocatePlugin (class in dissect.target.plugins.os.unix.locate.plocate) PLocateRecord (in module dissect.target.plugins.os.unix.locate.plocate) plug_and_play (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) Plugin (class in dissect.target.plugin) plugin_function_with_argparser() (in module dissect.target.tools.utils.cli) plugin_import_errors (dissect.target.tools.utils.report.ExecutionReport attribute) PluginDescriptor (class in dissect.target.plugin) PluginDescriptorLookup (class in dissect.target.plugin) PluginError PluginListPlugin (class in dissect.target.plugins.general.plugins) PluginNotFoundError PluginRegistry (class in acquire.acquire.uploaders.plugin_registry) (class in dissect.target.plugin) plugins (acquire.acquire.uploaders.plugin_registry.PluginRegistry attribute) PLUGINS (in module dissect.target.plugin) plugins() (dissect.target.plugins.general.plugins.PluginListPlugin method) (in module dissect.target.plugin) PMAP_PORT (dissect.target.helpers.sunrpc.client.Client attribute) PMC_COUNTERS (dissect.etl.headers.event.ExtType attribute) PNNI (dissect.target.helpers.network.IANAProtocol attribute) PodmanChildTargetPlugin (class in dissect.target.plugins.child.podman) PodmanContainerRecord (in module dissect.target.plugins.apps.container.podman) PodmanImageRecord (in module dissect.target.plugins.apps.container.podman) PodmanLogRecord (in module dissect.target.plugins.apps.container.podman) PodmanPlugin (class in dissect.target.plugins.apps.container.podman) PogoDebugEntry (class in dissect.executable.pe.directory.debug) Pointer (class in dissect.cstruct) (class in dissect.cstruct.types) (class in dissect.cstruct.types.pointer) pointer (dissect.cstruct.cstruct attribute) (dissect.cstruct.cstruct.cstruct attribute) (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) POINTER32 (dissect.etl.headers.headers.EventProperty attribute) POINTER64 (dissect.etl.headers.headers.EventProperty attribute) pointer_size (dissect.etl.ETL attribute) (dissect.etl.etl.ETL attribute) (dissect.etl.headers.logfile.LogfileHeader property) pointer_to_raw_data (dissect.executable.pe.pe.Section property) PointerBlock2Addr (class in dissect.vmfs.address) PointerBlock2Addr64 (class in dissect.vmfs.address) PointerBlock2ResourceVMFS5 (class in dissect.vmfs.resource) PointerBlock2ResourceVMFS6 (class in dissect.vmfs.resource) PointerBlockAddr (class in dissect.vmfs.address) PointerBlockAddr64 (class in dissect.vmfs.address) PointerBlockResourceVMFS5 (class in dissect.vmfs.resource) PointerBlockResourceVMFS6 (class in dissect.vmfs.resource) policy (dissect.volume.lvm.metadata.CachePoolSegment attribute) (dissect.volume.lvm.metadata.CacheSegment attribute) POLICY_CATEGORIES (in module dissect.target.plugins.os.windows.regf.auditpol) policy_def (in module dissect.target.plugins.os.windows.adpolicy) POLICY_MAP (in module dissect.target.plugins.os.windows.regf.auditpol) policy_settings (dissect.volume.lvm.metadata.CachePoolSegment attribute) (dissect.volume.lvm.metadata.CacheSegment attribute) POLICY_VALUES (in module dissect.target.plugins.os.windows.regf.auditpol) pool (dissect.volume.dm.thin.ThinDevice attribute) (dissect.volume.lvm.metadata.ThinPoolSegment attribute) PoolGuid (in module dissect.etl.utils) pop() (dissect.apfs.cursor.Cursor method) (dissect.btrfs.tree.Cursor method) (dissect.target.helpers.configutil.ScopeManager method) populate_role_guid_map() (dissect.target.plugins.os.windows.ual.UalPlugin method) port (class in flow.record.fieldtypes.net.tcp) (class in flow.record.fieldtypes.net.udp) (dissect.target.helpers.sunrpc.sunrpc.PortMapping attribute) (dissect.target.loaders.remote.RemoteStreamConnection attribute) (flow.record.adapter.splunk.SplunkWriter attribute) (flow.record.fieldtypes.uri property) Port (in module flow.record.fieldtypes.net.tcp) (in module flow.record.fieldtypes.net.udp) port() (in module dissect.target.loaders.mqtt) PORTABLE_DEVICES (dissect.target.plugins.os.windows.regf.usb.UsbPlugin attribute) PortMapping (class in dissect.target.helpers.sunrpc.sunrpc) PortMappingSerializer (class in dissect.target.helpers.sunrpc.serializer) pos (dissect.cstruct.expression.ExpressionTokenizer attribute) POS (dissect.target.plugins.os.windows.network.IfTypes attribute) posix_command (class in flow.record.fieldtypes) posix_path (class in flow.record.fieldtypes) post() (dissect.fve.crypto.base.IV method) postloop() (dissect.target.tools.shell.TargetCmd method) PowerGuid (in module dissect.etl.utils) PowerShell (class in acquire.acquire.acquire) powershell_history() (dissect.target.plugins.apps.shell.powershell.PowerShellHistoryPlugin method) PowerShellHistoryPlugin (class in dissect.target.plugins.apps.shell.powershell) ppid (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) PPP (dissect.target.plugins.os.windows.network.IfTypes attribute) PPPMULTILINKBUNDLE (dissect.target.plugins.os.windows.network.IfTypes attribute) pre_vc11 (dissect.executable.pe.directory.debug.VcFeatureDebugEntry property) precedence() (dissect.cstruct.Expression method) (dissect.cstruct.expression.Expression method) precedence_levels (dissect.cstruct.Expression attribute) (dissect.cstruct.expression.Expression attribute) predicted_tick (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) Prefetch (class in acquire.acquire.acquire) (class in dissect.target.plugins.os.windows.prefetch) prefetch() (dissect.target.plugins.os.windows.prefetch.PrefetchPlugin method) prefetch_def (in module dissect.target.plugins.os.windows.prefetch) prefetch_factor_inc (dissect.target.loaders.mqtt.MqttConnection attribute) prefetch_version_structs (in module dissect.target.plugins.os.windows.prefetch) prefetchdir (dissect.target.plugins.os.windows.prefetch.PrefetchPlugin attribute) PrefetchPlugin (class in dissect.target.plugins.os.windows.prefetch) PrefetchRecord (in module dissect.target.plugins.os.windows.prefetch) prefix (dissect.extfs.extfs.XAttr attribute) (dissect.target.filesystems.cb.CbFilesystem attribute) PREFIXES (in module dissect.target.loaders.dir) preloop() (dissect.target.tools.shell.ExtendedCmd method) (dissect.target.tools.shell.TargetCmd method) prepare_client() (acquire.acquire.uploaders.minio.MinIO method) (acquire.acquire.uploaders.plugin.UploaderPlugin method) prepare_insert_sql() (in module flow.record.adapter.sqlite) prepare_ls_colors() (in module dissect.target.tools.utils.fs) prepend_fs_layer() (dissect.target.filesystem.LayerFilesystem method) prepend_layer() (dissect.target.filesystem.LayerFilesystem method) prev (dissect.target.loaders.mqtt.MqttConnection attribute) prev() (dissect.apfs.cursor.Cursor method) (dissect.btrfs.tree.Cursor method) (dissect.database.ese.btree.BTree method) (dissect.database.ese.cursor.Cursor method) prev_node() (dissect.btrfs.tree.Cursor method) prev_page() (dissect.database.ese.btree.BTree method) previous (dissect.cstruct.parser.TokenConsumer attribute) previous_bitmap (dissect.volume.vss.Store property) previous_page (dissect.database.ese.Page attribute) (dissect.database.ese.page.Page attribute) previous_path (dissect.target.plugins.os.unix.locate.gnulocate.GNULocateFile attribute) previous_store (dissect.volume.vss.Store attribute) previous_timestamps (dissect.target.plugins.os.windows.prefetch.Prefetch property) primary_element_count (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) primary_header (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) primary_header_offset (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) primary_index (dissect.database.ese.Table property) (dissect.database.ese.table.Table property) PRIMARY_ISDN (dissect.target.plugins.os.windows.network.IfTypes attribute) primary_key (dissect.database.sqlite3.sqlite3.Table attribute) (dissect.database.sqlite3.Table attribute) primary_raid_level (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) principal_id (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) print_acquire_warning() (in module acquire.acquire.acquire) print_disks_overview() (in module acquire.acquire.acquire) print_error() (in module flow.record.tools.rdump) print_extensive_file_stat_listing() (in module dissect.target.tools.utils.fs) print_ls() (in module dissect.target.tools.utils.fs) print_name (dissect.archive.wim.ReparsePoint property) (dissect.ntfs.attr.ReparsePoint property) print_object() (in module dissect.util.tools.dump_nskeyedarchiver) print_stat() (in module dissect.target.tools.utils.fs) print_target_info() (in module dissect.target.tools.info) print_volumes_overview() (in module acquire.acquire.acquire) print_xattr() (in module dissect.target.tools.utils.fs) PRINTABLE (in module dissect.cstruct.utils) priority (dissect.fve.bde.information.VmkInfoDatum property) (dissect.fve.luks.metadata.Keyslot attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) private_id (dissect.apfs.objects.fs.INode property) private_key_file (dissect.target.loaders.mqtt.Broker attribute) private_key_filter() (in module acquire.acquire.acquire) private_keys() (dissect.target.plugins.apps.ssh.openssh.OpenSSHPlugin method) PrivateKeyRecord (in module dissect.target.plugins.apps.ssh.ssh) PRIVILEGED (dissect.target.helpers.sunrpc.client.LocalPortPolicy attribute) PRM (dissect.target.helpers.network.IANAProtocol attribute) Proc (class in acquire.acquire.acquire) PROC_STAT_NAMES (in module dissect.target.plugins.os.unix.linux.proc) PROC_UNAVAIL (dissect.target.helpers.sunrpc.sunrpc.AcceptStat attribute) ProcConfigParser (class in dissect.target.plugins.os.unix.linux.network) ProcConfigParser.ParserContext (class in dissect.target.plugins.os.unix.linux.network) procedure (dissect.target.helpers.sunrpc.sunrpc.CallBody attribute) (dissect.target.helpers.sunrpc.sunrpc.ProcedureDescriptor attribute) ProcedureDescriptor (class in dissect.target.helpers.sunrpc.sunrpc) ProcedureParams (in module dissect.target.helpers.sunrpc.serializer) (in module dissect.target.helpers.sunrpc.sunrpc) ProcedureResults (in module dissect.target.helpers.sunrpc.serializer) (in module dissect.target.helpers.sunrpc.sunrpc) PROCESS (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) process() (dissect.target.helpers.logging.TargetLogAdapter method) (dissect.target.plugins.os.unix.linux.proc.ProcPlugin method) PROCESS_ALL_ACCESS (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) PROCESS_CREATE_PROCESS (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) PROCESS_CREATE_THREAD (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) PROCESS_DUP_HANDLE (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) process_generic_arguments() (in module dissect.target.tools.utils.cli) process_id (dissect.etl.headers.event.EventHeader property) (dissect.etl.headers.headers.EventInstanceGUIDHeader property) (dissect.etl.headers.headers.EventTraceHeader property) (dissect.etl.headers.headers.MessageTraceHeader property) (dissect.etl.headers.system.CompactSystemHeader property) (dissect.etl.headers.system.SystemHeader property) process_plugin_arguments() (in module dissect.target.tools.utils.cli) PROCESS_QUERY_INFORMATION (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) process_rules() (in module dissect.target.plugins.filesystem.yara) PROCESS_SET_INFORMATION (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) PROCESS_SET_QUOTA (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) PROCESS_START_KEY (dissect.etl.headers.event.ExtType attribute) PROCESS_TERMINATE (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) process_token_sid_type (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) PROCESS_VM_OPERATION (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) PROCESS_VM_READ (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) PROCESS_VM_WRITE (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) ProcessAccess (class in acquire.acquire.dynamic.windows.types) processes() (dissect.target.plugins.os.unix.linux.proc.ProcPlugin method) (dissect.target.plugins.os.unix.linux.processes.ProcProcesses method) ProcessGuid (in module dissect.etl.utils) processor_time (dissect.etl.headers.system.SystemHeader property) ProcessStateEnum (class in dissect.target.plugins.os.unix.linux.proc) ProcessToken (class in acquire.acquire.dynamic.windows.types) ProcNet (class in acquire.acquire.acquire) ProcPlugin (class in dissect.target.plugins.os.unix.linux.proc) ProcProcess (class in dissect.target.plugins.os.unix.linux.proc) ProcProcesses (class in dissect.target.plugins.os.unix.linux.processes) ProcProcessRecord (in module dissect.target.plugins.os.unix.linux.processes) produce_target_func_pairs() (in module dissect.target.tools.dump) productkey() (dissect.target.plugins.os.windows.productkey.WindowsProductKeyPlugin method) profile (dissect.volume.lvm.metadata.LogicalVolume attribute) (dissect.volume.lvm.metadata.VolumeGroup attribute) PROFILE_KEY (dissect.target.plugins.os.windows.regf.nethist.NethistPlugin attribute) ProfileLoader (class in dissect.target.loaders.profile) ProfileOSPlugin (class in dissect.target.loaders.profile) PROFILES (in module acquire.acquire.acquire) PROG_MISMATCH (dissect.target.helpers.sunrpc.sunrpc.AcceptStat attribute) PROG_UNAVAIL (dissect.target.helpers.sunrpc.sunrpc.AcceptStat attribute) program (dissect.target.helpers.sunrpc.sunrpc.CallBody attribute) (dissect.target.helpers.sunrpc.sunrpc.PortMapping attribute) (dissect.target.helpers.sunrpc.sunrpc.ProcedureDescriptor attribute) program_data (dissect.target.plugins.os.windows.regf.cit.Entry attribute) ProgramDataBitmaps (class in dissect.target.plugins.os.windows.regf.cit) programs() (dissect.target.plugins.os.windows.amcache.AmcachePluginOldMixin method) ProgramsAppcompatRecord (in module dissect.target.plugins.os.windows.amcache) ProgramUseData (class in dissect.target.plugins.os.windows.regf.cit) progress (acquire.acquire.gui.win32.Win32 property) Progress (class in dissect.evidence.tools.asdf.dd) progress (in module acquire.acquire.tools.decrypter) (in module dissect.archive.tools.backup) (in module dissect.fve.tools.dd) progress_bar (acquire.acquire.gui.win32.Win32 attribute) (flow.record.tools.rdump.ProgressMonitor attribute) progress_handler() (in module dissect.target.tools.qfind) PROGRESS_LOG_STEP (in module acquire.acquire.hashes) ProgressMonitor (class in flow.record.tools.rdump) prompt (dissect.target.tools.diff.DifferentialCli property) (dissect.target.tools.shell.RegistryCli property) (dissect.target.tools.shell.TargetCli property) (dissect.target.tools.shell.TargetHubCli attribute) (dissect.target.tools.shell.UnixConfigTreeCli property) prompt_base (dissect.target.tools.shell.RegistryCli attribute) (dissect.target.tools.shell.TargetCli attribute) (dissect.target.tools.shell.UnixConfigTreeCli attribute) prompt_ps1 (dissect.target.tools.shell.TargetCmd attribute) PROP_BWA_P2MP (dissect.target.plugins.os.windows.network.IfTypes attribute) PROP_CNLS (dissect.target.plugins.os.windows.network.IfTypes attribute) PROP_DOCS_WIRELESS_DOWNSTREAM (dissect.target.plugins.os.windows.network.IfTypes attribute) PROP_DOCS_WIRELESS_MACLAYER (dissect.target.plugins.os.windows.network.IfTypes attribute) PROP_DOCS_WIRELESS_UPSTREAM (dissect.target.plugins.os.windows.network.IfTypes attribute) PROP_MULTIPLEXOR (dissect.target.plugins.os.windows.network.IfTypes attribute) PROP_POINT2POINT_SERIAL (dissect.target.plugins.os.windows.network.IfTypes attribute) PROP_VIRTUAL (dissect.target.plugins.os.windows.network.IfTypes attribute) PROP_WIRELESS_P2P (dissect.target.plugins.os.windows.network.IfTypes attribute) properties (dissect.archive.vbk.DirItem property) (dissect.cim.cim.Class property) (dissect.cim.cim.Instance property) (dissect.cim.classes.ClassDefinition property) (dissect.cim.classes.ClassInstance property) (dissect.cim.classes.PropertyDefaultValues attribute) (dissect.fve.bde.information.Datum property) properties_length (dissect.cim.cim.Class property) PropertiesDictionary (class in dissect.archive.vbk) Property (class in dissect.cim.cim) property (dissect.cim.classes.ClassDefinitionProperty attribute) property_data (dissect.cim.classes.ClassDefinition attribute) property_default_values (dissect.cim.cim.Class property) property_offset (dissect.cim.classes.PropertyReference attribute) property_reference (dissect.cim.classes.PropertyReference attribute) property_references (dissect.cim.classes.ClassDefinition attribute) property_states (dissect.cim.classes.ClassInstance attribute) PROPERTY_STORE_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) PropertyDefaultValues (class in dissect.cim.classes) PropertyReference (class in dissect.cim.classes) PropertyStates (class in dissect.cim.classes) props (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin attribute) (dissect.target.Target attribute) (dissect.target.target.Target attribute) protection_class (dissect.target.loaders.itunes.ClassKey attribute) PROTEON_10MBIT (dissect.target.plugins.os.windows.network.IfTypes attribute) PROTEON_80MBIT (dissect.target.plugins.os.windows.network.IfTypes attribute) ProtobufVarint (class in dissect.target.helpers.protobuf) Protocol (class in dissect.target.helpers.sunrpc.sunrpc) (class in flow.record.adapter.splunk) protocol (dissect.target.helpers.sunrpc.sunrpc.PortMapping attribute) PROTOCOL (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) protocol (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) (flow.record.adapter.splunk.SplunkWriter attribute) (flow.record.fieldtypes.uri property) protocol_string (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) protocol_type (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) PROV_TRAITS (dissect.etl.headers.event.ExtType attribute) provided (dissect.target.filesystems.nfs.AuthFlavorNotSupported attribute) provider (dissect.database.ese.tools.sru.Entry attribute) (dissect.target.helpers.keychain.Key attribute) (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) provider_id (dissect.etl.headers.event.EventHeader property) (dissect.etl.headers.headers.Header property) (dissect.etl.headers.headers.MessageTraceHeader property) (dissect.etl.headers.system.SystemSpecificHeader property) (dissect.eventlog.wevt.WEVT property) provider_id() (dissect.etl.etl.Event method) provider_name() (dissect.etl.etl.Event method) PROXMOX (dissect.target.plugin.OperatingSystem attribute) ProxmoxChildTargetPlugin (class in dissect.target.plugins.child.proxmox) ProxmoxConfigDirectoryEntry (class in dissect.target.plugins.os.unix.linux.debian.proxmox._os) ProxmoxConfigFileEntry (class in dissect.target.plugins.os.unix.linux.debian.proxmox._os) ProxmoxLoader (class in dissect.target.loaders.proxmox) ProxmoxPlugin (class in dissect.target.plugins.os.unix.linux.debian.proxmox._os) ProxmoxProfile (class in acquire.acquire.acquire) PRVA (class in dissect.eventlog.wevt_object) PSM_KEY (dissect.etl.headers.event.ExtType attribute) PT (in module dissect.executable.elf.c_elf) PTP (dissect.target.helpers.network.IANAProtocol attribute) PUA_FIRST (dissect.database.ese.lcmapstring.SCRIPT attribute) PUA_LAST (dissect.database.ese.lcmapstring.SCRIPT attribute) public_key (dissect.target.loaders.itunes.ClassKey attribute) (dissect.target.plugins.apps.ssh.ssh.SSHPrivateKey attribute) public_key_info() (dissect.fve.bde.information.VmkInfoDatum method) public_keys() (dissect.target.plugins.apps.ssh.openssh.OpenSSHPlugin method) PUBLIC_OBJECT_TYPE_INFORMATION (class in acquire.acquire.dynamic.windows.types) PublicKeyInfoDatum (class in dissect.fve.bde.information) PublicKeyRecord (in module dissect.target.plugins.apps.ssh.ssh) publisher (flow.record.adapter.broker.BrokerWriter attribute) PUNCTUATION (dissect.database.ese.lcmapstring.SCRIPT attribute) PUNICODE_STRING (in module acquire.acquire.dynamic.windows.types) PUP (dissect.target.helpers.network.IANAProtocol attribute) PureDissectPath (class in dissect.target.helpers.compat.path_310) (class in dissect.target.helpers.compat.path_311) (class in dissect.target.helpers.compat.path_312) (class in dissect.target.helpers.compat.path_313) push() (dissect.apfs.cursor.Cursor method) (dissect.btrfs.tree.Cursor method) (dissect.target.helpers.configutil.ScopeManager method) push_notification() (dissect.target.plugins.os.windows.sru.SRUPlugin method) PushNotificationRecord (in module dissect.target.plugins.os.windows.sru) PuTTYPlugin (class in dissect.target.plugins.apps.ssh.putty) PuTTYSessionRecord (in module dissect.target.plugins.apps.ssh.putty) PuTTYUserRecordDescriptor (in module dissect.target.plugins.apps.ssh.putty) puu() (dissect.target.plugins.os.windows.regf.cit.CITPlugin method) pv (dissect.volume.lvm.metadata.VolumeGroup property) pvlen (dissect.database.bsd.tools.rpm.HeaderBlob attribute) PvmLoader (class in dissect.target.loaders.pvm) pvms (dissect.target.plugins.child.parallels.ParallelsChildTargetPlugin attribute) PVOID (in module acquire.acquire.dynamic.windows.types) PVP (dissect.target.helpers.network.IANAProtocol attribute) PVS (class in dissect.hypervisor.descriptor.pvs) PvsLoader (class in dissect.target.loaders.pvs) PY_311 (in module dissect.cstruct.types.enum) PY_311_OR_HIGHER (in module flow.record.fieldtypes) PY_312 (in module dissect.cstruct.types.enum) PY_312_OR_HIGHER (in module flow.record.fieldtypes) PY_313_OR_HIGHER (in module flow.record.fieldtypes) python_compile (in module dissect.cstruct.compiler) python_shell() (in module dissect.target.tools.shell) Q QCow2 (class in dissect.hypervisor.disk.qcow2) qcow2 (dissect.hypervisor.disk.qcow2.L2Table attribute) (dissect.hypervisor.disk.qcow2.QCow2Snapshot attribute) (dissect.hypervisor.disk.qcow2.QCow2Stream attribute) (dissect.target.containers.qcow2.QCow2Container attribute) qcow2_def (in module dissect.hypervisor.disk.c_qcow2) QCOW2_INCOMPAT_MASK (in module dissect.hypervisor.disk.c_qcow2) QCOW2_MAGIC (in module dissect.hypervisor.disk.c_qcow2) QCOW2_MAGIC_BYTES (in module dissect.hypervisor.disk.c_qcow2) QCow2ClusterType (in module dissect.hypervisor.disk.c_qcow2) QCow2Container (class in dissect.target.containers.qcow2) QCow2Snapshot (class in dissect.hypervisor.disk.qcow2) QCow2Stream (class in dissect.hypervisor.disk.qcow2) QCow2SubclusterType (in module dissect.hypervisor.disk.c_qcow2) QemuChildTargetPlugin (class in dissect.target.plugins.child.qemu) qfind() (dissect.target.plugins.scrape.qfind.QFindPlugin method) QFindMatchRecord (in module dissect.target.plugins.scrape.qfind) QFindPlugin (class in dissect.target.plugins.scrape.qfind) QLLC (dissect.target.plugins.os.windows.network.IfTypes attribute) QNX (dissect.target.helpers.network.IANAProtocol attribute) QNX4 (class in dissect.qnxfs) (class in dissect.qnxfs.qnx4) qnx4_def (in module dissect.qnxfs.c_qnx4) QNX6 (class in dissect.qnxfs) (class in dissect.qnxfs.qnx6) qnx6_def (in module dissect.qnxfs.c_qnx6) QnxFilesystem (class in dissect.target.filesystems.qnxfs) QnxFilesystemEntry (class in dissect.target.filesystems.qnxfs) qnxfs (dissect.target.filesystems.qnxfs.QnxFilesystem attribute) QNXFS() (in module dissect.qnxfs) (in module dissect.qnxfs.qnxfs) Qualifier (class in dissect.cim.classes) qualifier_reference (dissect.cim.classes.QualifierReference attribute) qualifier_references (dissect.cim.classes.ClassDefinition attribute) (dissect.cim.classes.ClassDefinitionProperty attribute) (dissect.cim.classes.ClassInstance attribute) QualifierReference (class in dissect.cim.classes) qualifiers (dissect.cim.cim.Property property) (dissect.cim.classes.ClassDefinition property) (dissect.cim.classes.ClassDefinitionProperty attribute) (dissect.cim.classes.ClassInstance property) (dissect.cim.classes.ClassInstanceProperty property) qualname (dissect.target.plugin.FunctionDescriptor attribute) (dissect.target.plugin.PluginDescriptor attribute) quarantine_id (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntry attribute) QUARANTINE_SUCCESS (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) QuarantinedFiles (class in acquire.acquire.acquire) QuarantineEntry (class in dissect.target.plugins.os.windows.defender.quarantine) QuarantineEntryResource (class in dissect.target.plugins.os.windows.defender.quarantine) query (dissect.util.ldap.SearchFilter attribute) (flow.record.fieldtypes.uri property) query() (dissect.cim.CIM method) (dissect.cim.cim.CIM method) (dissect.cim.cim.Namespace method) query_directory_object() (in module acquire.acquire.dynamic.windows.ntdll) query_port_mapping() (dissect.target.helpers.sunrpc.client.Client method) queue (dissect.cstruct.Expression attribute) (dissect.cstruct.expression.Expression attribute) (flow.record.adapter.elastic.ElasticWriter attribute) quit() (acquire.acquire.gui.win32.Win32 method) quitting (acquire.acquire.gui.win32.Win32 attribute) QWORD (dissect.target.helpers.regutil.RegistryValueType attribute) R r (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) R (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) (in module dissect.target.loaders.mqtt) RADIO_MAC (dissect.target.plugins.os.windows.network.IfTypes attribute) RADSL (dissect.target.plugins.os.windows.network.IfTypes attribute) RAID (class in dissect.volume.raid.raid) RAID0 (dissect.volume.raid.stream.Level attribute) raid0_lvs (dissect.volume.lvm.metadata.RAIDSegment attribute) RAID0Stream (class in dissect.volume.raid.stream) RAID1 (dissect.volume.raid.stream.Level attribute) RAID10 (dissect.volume.raid.stream.Level attribute) RAID10Stream (class in dissect.volume.raid.stream) RAID3 (dissect.volume.raid.stream.Level attribute) RAID4 (dissect.volume.raid.stream.Level attribute) RAID456Stream (class in dissect.volume.raid.stream) RAID5 (dissect.volume.raid.stream.Level attribute) (dissect.volume.vinum.config.PlexOrg attribute) RAID6 (dissect.volume.raid.stream.Level attribute) raid_disks (dissect.volume.md.md.MDPhysicalDisk attribute) (dissect.volume.md.MDPhysicalDisk attribute) (dissect.volume.raid.stream.RAID10Stream attribute) raid_level_qualifier (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) RAIDError raids (dissect.volume.lvm.metadata.RAIDSegment attribute) RAIDSegment (class in dissect.volume.lvm.metadata) range_list (dissect.volume.vss.Store property) RangeList (class in dissect.volume.vss) RangeStream (class in dissect.util.stream) raw (dissect.database.bsd.db.Page property) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.hypervisor.disk.vmdk.DiskDescriptor attribute) (dissect.hypervisor.disk.vmdk.ExtentDescriptor attribute) RAW (dissect.target.helpers.keychain.KeyType attribute) raw (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry attribute) (dissect.target.plugins.os.windows.firewall.LogConfig attribute) (dissect.target.volume.Volume attribute) (dissect.vmfs.descriptor.DirEntry attribute) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.vmfs.DirEntry attribute) (dissect.vmfs.FileDescriptor property) (dissect.volume.disk.Partition attribute) (dissect.volume.disk.partition.Partition attribute) raw() (dissect.target.plugins.os.unix.linux.proc.Sockets method) (dissect.target.plugins.os.unix.linux.sockets.NetSocketPlugin method) raw6() (dissect.target.plugins.os.unix.linux.proc.Sockets method) raw_data (dissect.etl.headers.event.EventHeaderExtendedDataItem attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) raw_page() (dissect.database.SQLite3 method) (dissect.database.sqlite3.SQLite3 method) (dissect.database.sqlite3.sqlite3.SQLite3 method) raw_size (dissect.executable.pe.pe.Section property) RawContainer (class in dissect.target.containers.raw) (in module dissect.target.container) RawDisk (class in dissect.hypervisor.disk.vmdk) RawLoader (class in dissect.target.loaders.raw) (in module dissect.target.loader) rc4_crypt() (in module dissect.target.plugins.os.windows.defender.quarantine) rcdata (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) rdev (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) rdm_mapping (dissect.vmfs.descriptor.FileDescriptor property) (dissect.vmfs.FileDescriptor property) RDP (dissect.target.helpers.network.IANAProtocol attribute) RdpCachePlugin (class in dissect.target.plugins.os.windows.rdpcache) RDPCacheRecord (in module dissect.target.plugins.os.windows.rdpcache) RE_ACCESS_COMMON_PATTERN (in module dissect.target.plugins.apps.webserver.apache) RE_ACCESS_LOG (in module dissect.target.plugins.apps.webserver.nginx) RE_ACCESS_LOG_DIRECTIVE (in module dissect.target.plugins.apps.webserver.nginx) RE_ANSI_ESCAPE (in module dissect.target.plugins.apps.container.docker) re_cdata (in module dissect.target.plugins.apps.av.mcafee) RE_CITRIX_NETSCALER_BASH_HISTORY_DATE (in module dissect.target.plugins.os.unix.bsd.citrix.history) RE_CLOUD_INIT_LINE (in module dissect.target.plugins.os.unix.log.messages) RE_CONFIG_CUSTOM_LOG_DIRECTIVE (in module dissect.target.plugins.apps.webserver.apache) RE_CONFIG_EOL (in module dissect.volume.vinum.config) RE_CONFIG_ERRORLOG_DIRECTIVE (in module dissect.target.plugins.apps.webserver.apache) RE_CONFIG_HOSTNAME (in module dissect.target.plugins.os.unix.bsd.citrix._os) RE_CONFIG_INCLUDE (in module dissect.target.plugins.apps.webserver.apache) RE_CONFIG_IP (in module dissect.target.plugins.os.unix.bsd.citrix._os) RE_CONFIG_ROOT (in module dissect.target.plugins.apps.webserver.apache) RE_CONFIG_TIMEZONE (in module dissect.target.plugins.os.unix.bsd.citrix._os) RE_CONFIG_USER (in module dissect.target.plugins.os.unix.bsd.citrix._os) RE_CRONJOB (in module dissect.target.plugins.os.unix.cronjobs) RE_CTR_LOG (in module dissect.target.plugins.apps.container.podman) RE_DEVICE_NAME (in module dissect.target.plugins.os.windows.regf.usb) RE_DOCKER_NS (in module dissect.target.plugins.apps.container.docker) RE_ENV_VAR_IN_STRING (in module dissect.target.plugins.apps.webserver.apache) RE_ENVVAR (in module dissect.target.plugins.os.unix.cronjobs) RE_ERROR_COMMON_PATTERN (in module dissect.target.plugins.apps.webserver.apache) RE_ERROR_LOG (in module dissect.target.plugins.apps.webserver.nginx) RE_ERROR_LOG_DIRECTIVE (in module dissect.target.plugins.apps.webserver.nginx) RE_EXTENDED_BASH (in module dissect.target.plugins.os.unix.history) RE_EXTENDED_ZSH (in module dissect.target.plugins.os.unix.history) RE_EXTENT_DESCRIPTOR (in module dissect.hypervisor.disk.vmdk) re_field (in module dissect.target.plugins.os.windows.log.amcache) RE_FISH (in module dissect.target.plugins.os.unix.history) re_illegal_characters (in module dissect.target.plugins.os.windows.log.evt) (in module dissect.target.plugins.os.windows.log.evtx) RE_INCLUDE_DIRECTIVE (in module dissect.target.plugins.apps.webserver.nginx) RE_KV (dissect.target.helpers.configutil.Env attribute) RE_LINE (in module dissect.target.plugins.os.unix.log.helpers) RE_LOADER_CONFIG_KERNEL_VERSION (in module dissect.target.plugins.os.unix.bsd.citrix._os) RE_LOG (in module dissect.target.plugins.apps.remoteaccess.teamviewer) RE_LOG_LINE (in module dissect.target.plugins.apps.remoteaccess.rustdesk) RE_MASTER_KEY (dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin attribute) RE_MSG_SEAT (dissect.target.plugins.os.unix.log.auth.SystemdLogindService attribute) RE_MSG_SESSION_LOGGED_OUT (dissect.target.plugins.os.unix.log.auth.SystemdLogindService attribute) RE_MSG_SESSION_NEW (dissect.target.plugins.os.unix.log.auth.SystemdLogindService attribute) RE_MSG_SESSION_NEW_VARIANT (dissect.target.plugins.os.unix.log.auth.SystemdLogindService attribute) RE_MSG_SESSION_REMOVED (dissect.target.plugins.os.unix.log.auth.SystemdLogindService attribute) RE_MSG_WATCHING (dissect.target.plugins.os.unix.log.auth.SystemdLogindService attribute) re_NOFLAG (in module dissect.target.plugins.scrape.qfind) re_normalize_path (in module dissect.target.helpers.polypath) RE_NORMALIZE_PATH (in module flow.record.fieldtypes) re_normalize_sbs_path (in module dissect.target.helpers.polypath) RE_PAM_UNIX (dissect.target.plugins.os.unix.log.auth.PamUnixService attribute) RE_PATH_SPLIT (in module dissect.target.plugins.os.windows.services) RE_PATH_SPLIT_FALLBACK (in module dissect.target.plugins.os.windows.services) RE_PKEXEC_COMMAND (dissect.target.plugins.os.unix.log.auth.PkexecService attribute) re_quoted (in module dissect.target.plugins.filesystem.resolver) RE_RAW_DISK (in module dissect.target.loaders.vbk) RE_REFERER_USER_AGENT_PATTERN (in module dissect.target.plugins.apps.webserver.apache) RE_REMOTE_PATTERN (in module dissect.target.plugins.apps.webserver.apache) RE_RESPONSE_TIME_PATTERN (in module dissect.target.plugins.apps.webserver.apache) RE_SSHD_PORTREGEX (dissect.target.plugins.os.unix.log.auth.SshdService attribute) RE_START (in module dissect.target.plugins.apps.remoteaccess.teamviewer) re_strip_tags (in module dissect.target.plugins.apps.av.mcafee) RE_SU_BY (dissect.target.plugins.os.unix.log.auth.SuService attribute) RE_SU_COMMAND (dissect.target.plugins.os.unix.log.auth.SuService attribute) RE_SU_ON (dissect.target.plugins.os.unix.log.auth.SuService attribute) RE_SUDO_COMMAND (dissect.target.plugins.os.unix.log.auth.SudoService attribute) RE_TIMESTAMP_PATTERN (in module dissect.target.plugins.os.windows.log.mssql) RE_TS (in module dissect.target.plugins.apps.remoteaccess.splashtop) (in module dissect.target.plugins.os.unix.linux.redhat.yum) (in module dissect.target.plugins.os.unix.log.helpers) RE_TS_ISO (in module dissect.target.plugins.os.unix.log.helpers) RE_URL (in module dissect.target.plugins.os.windows.search) RE_USER (dissect.target.plugins.os.unix.log.auth.SshdService attribute) (in module dissect.target.plugins.os.unix.log.auth) RE_VALID_FIELD_NAME (in module flow.record.base) RE_VALID_KEY_CHARS (in module dissect.target.plugins.os.windows.wer) RE_VALID_KEY_START_CHARS (in module dissect.target.plugins.os.windows.wer) RE_VALID_RECORD_TYPE_NAME (in module flow.record.base) RE_VIRTUALHOST (in module dissect.target.plugins.apps.webserver.apache) RE_VOLUME_ID (in module dissect.target.loaders.proxmox) REACH_DSL (dissect.target.plugins.os.windows.network.IfTypes attribute) read (dissect.hypervisor.disk.vmdk.RawDisk attribute) (dissect.target.containers.raw.RawContainer attribute) (dissect.target.loaders.mqtt.MqttConnection attribute) (flow.record.context.AppContext attribute) read() (dissect.cstruct.BitBuffer method) (dissect.cstruct.bitbuffer.BitBuffer method) (dissect.cstruct.cstruct method) (dissect.cstruct.cstruct.cstruct method) (dissect.cstruct.MetaType method) (dissect.cstruct.types.base.MetaType method) (dissect.cstruct.types.MetaType method) (dissect.eventlog.bxml.BxmlNameReader method) (dissect.eventlog.bxml.EvtxNameReader method) (dissect.eventlog.bxml.WevtNameReader method) (dissect.eventlog.evtx.ElfChnk method) (dissect.hypervisor.descriptor.hyperv.HyperVStorageFileObject method) (dissect.target.container.Container method) (dissect.target.containers.asdf.AsdfContainer method) (dissect.target.containers.asif.AsifContainer method) (dissect.target.containers.ewf.EwfContainer method) (dissect.target.containers.fortifw.FortiFirmwareContainer method) (dissect.target.containers.hdd.HddContainer method) (dissect.target.containers.hds.HdsContainer method) (dissect.target.containers.qcow2.QCow2Container method) (dissect.target.containers.split.SplitContainer method) (dissect.target.containers.vdi.VdiContainer method) (dissect.target.containers.vhd.VhdContainer method) (dissect.target.containers.vhdx.VhdxContainer method) (dissect.target.containers.vmdk.VmdkContainer method) (dissect.target.helpers.mount.DissectMount method) (dissect.target.loaders.mqtt.Broker method) (dissect.target.loaders.remote.RemoteStreamConnection method) (dissect.target.volume.Volume method) (dissect.util.compression.lzxpress_huffman.BitString method) (dissect.util.stream.AlignedStream method) (dissect.vmfs.resource.ResourceFile method) (dissect.vmfs.resource.ResourceManager method) (flow.record.stream.RecordStreamReader method) Read3ArgsSerializer (class in dissect.target.helpers.nfs.serializer) Read3ResultDeserializer (class in dissect.target.helpers.nfs.serializer) read_ahead (dissect.volume.lvm.metadata.LogicalVolume attribute) read_attribute() (dissect.eventlog.bxml.Bxml method) read_bin_file() (dissect.target.plugins.os.windows.recyclebin.RecyclebinPlugin method) read_binxml_fragment() (in module dissect.eventlog.bxml) read_block() (dissect.extfs.JDB2 method) (dissect.extfs.journal.JDB2 method) (dissect.volume.vss.Store method) (in module dissect.volume.vss) read_block_data() (in module dissect.volume.vss) read_char_reference() (dissect.eventlog.bxml.Bxml method) read_chunk (dissect.evidence.ewf.TableSection attribute) READ_CHUNK_SIZE (dissect.target.helpers.nfs.client.mount.Client attribute) (dissect.target.helpers.nfs.client.nfs.Client attribute) read_descriptor_array() (in module dissect.eventlog.bxml) read_descriptors_from_stream() (dissect.eventlog.bxml.BxmlTemplateDescriptor class method) read_entity_reference() (dissect.eventlog.bxml.Bxml method) read_etl_files() (dissect.target.plugins.os.windows.log.etl.EtlPlugin method) read_etl_records() (dissect.target.plugins.os.windows.log.etl.EtlRecordBuilder method) read_file() (dissect.target.helpers.configutil.ConfigurationParser method) read_filename() (dissect.target.plugins.os.windows.prefetch.Prefetch method) read_footer() (in module dissect.hypervisor.disk.vhd) read_fragment_header() (dissect.eventlog.bxml.Bxml method) read_guid() (in module dissect.eventlog.bxml) read_instance_info() (in module dissect.etl.headers.event) read_key_subkeys() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) read_list() (dissect.cim.classes.PropertyReference class method) (dissect.cim.classes.QualifierReference class method) read_name_from_stream() (dissect.eventlog.bxml.Bxml method) read_null_terminated_wstring() (in module dissect.regf.regf) read_page() (dissect.cim.index.Store method) (dissect.database.ESE method) (dissect.database.ese.ESE method) (dissect.database.ese.ese.ESE method) read_provider_traits() (in module dissect.etl.headers.event) read_record() (dissect.etl.Buffer method) (dissect.etl.etl.Buffer method) (in module dissect.database.sqlite3.sqlite3) read_records() (dissect.target.plugins.os.windows.sru.SRUPlugin method) read_recycle_bin() (dissect.target.plugins.os.windows.recyclebin.RecyclebinPlugin method) read_sb() (dissect.ffs.FFS static method) (dissect.ffs.ffs.FFS static method) read_sectors() (dissect.evidence.ewf.Segment method) (dissect.evidence.ewf.TableSection method) (dissect.hypervisor.disk.vhd.Disk method) (dissect.hypervisor.disk.vhd.DynamicDisk method) (dissect.hypervisor.disk.vhd.FixedDisk method) (dissect.hypervisor.disk.vhdx.VHDX method) (dissect.hypervisor.disk.vmdk.RawDisk method) (dissect.hypervisor.disk.vmdk.SparseDisk method) (dissect.hypervisor.disk.vmdk.VMDK method) (dissect.volume.lvm.LVM2Device method) (dissect.volume.lvm.physical.LVM2Device method) read_sid() (in module dissect.eventlog.bxml) (in module dissect.util.sid) read_stack_trace() (in module dissect.etl.headers.event) read_stack_trace64() (in module dissect.etl.headers.event) read_status_blocks() (in module dissect.target.plugins.os.unix.linux.debian.dpkg) read_systemtime() (in module dissect.eventlog.bxml) read_table() (flow.record.adapter.sqlite.SqliteReader method) read_table_records() (dissect.target.plugins.os.windows.ual.UalPlugin method) read_template_instance() (dissect.eventlog.bxml.Bxml method) read_token() (dissect.eventlog.bxml.Bxml method) read_truncated_name() (in module dissect.target.plugins.os.windows.everything.parser) read_uuid() (in module dissect.etl.headers.event) read_value() (dissect.eventlog.bxml.Bxml method) (in module dissect.eventlog.bxml) read_varint() (in module dissect.target.plugins.os.windows.everything.parser) read_wstrings() (in module dissect.target.plugins.os.windows.regf.mru) readable() (dissect.target.filesystem.VirtualFileHandle method) (dissect.util.stream.AlignedStream method) readall() (dissect.util.stream.AlignedStream method) (dissect.util.stream.ZlibStream method) readdir() (dissect.target.helpers.mount.DissectMount method) (dissect.target.helpers.nfs.client.nfs.Client method) ReadDirPlusParams (class in dissect.target.helpers.nfs.nfs3) ReadDirPlusParamsSerializer (class in dissect.target.helpers.nfs.serializer) ReadDirPlusProc (in module dissect.target.helpers.nfs.nfs3) ReadDirPlusResult (class in dissect.target.helpers.nfs.nfs3) ReadDirPlusResultDeserializer (class in dissect.target.helpers.nfs.serializer) ReadDirResult (class in dissect.target.helpers.nfs.client.nfs) reader (dissect.target.helpers.cache.CacheWriter attribute) (flow.record.adapter.avro.AvroReader attribute) (flow.record.adapter.csvfile.CsvfileReader attribute) readfile() (dissect.target.helpers.nfs.client.nfs.Client method) ReadFileProc (in module dissect.target.helpers.nfs.nfs3) readheader() (flow.record.stream.RecordStreamReader method) readinto() (dissect.target.container.Container method) (dissect.target.filesystem.VirtualFileHandle method) (dissect.target.volume.Volume method) (dissect.util.stream.AlignedStream method) (in module dissect.target.helpers.utils) readline (in module dissect.target.tools.shell) readline_escape() (in module dissect.target.tools.shell) readlink() (dissect.apfs.objects.fs.INode method) (dissect.archive.wim.DirectoryEntry method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry method) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.ffs.FfsFilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemEntry method) (dissect.target.filesystems.jffs.JffsFilesystemEntry method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry method) (dissect.target.filesystems.smb.SmbFilesystemEntry method) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystemEntry method) (dissect.target.filesystems.vbk.VbkFilesystemEntry method) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystemEntry method) (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) (dissect.target.helpers.mount.DissectMount method) (dissect.target.helpers.nfs.client.nfs.Client method) ReadLink3ResultDeserializer (class in dissect.target.helpers.nfs.serializer) readlink_ext() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemEntry method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystemEntry method) ReadLinkProc (in module dissect.target.helpers.nfs.nfs3) ReadlinkResult (class in dissect.target.helpers.nfs.nfs3) readoffset() (dissect.util.stream.AlignedStream method) ReadParams (class in dissect.target.helpers.nfs.nfs3) ReadResult (class in dissect.target.helpers.nfs.nfs3) reads() (dissect.cstruct.MetaType method) (dissect.cstruct.types.base.MetaType method) (dissect.cstruct.types.MetaType method) ready (acquire.acquire.gui.base.GUI attribute) realpath() (in module dissect.target.helpers.compat.path_common) rebind_auth() (dissect.target.helpers.nfs.client.nfs.Client method) (dissect.target.helpers.sunrpc.client.AbstractClient method) (dissect.target.helpers.sunrpc.client.Client method) rec (flow.record.selector.RecordContextMatcher attribute) recalculate (dissect.volume.lvm.metadata.IntegritySegment attribute) recent_files_def (in module dissect.target.plugins.os.windows.regf.recentfilecache) recentdocs() (dissect.target.plugins.os.windows.regf.mru.MRUPlugin method) RecentDocsRecord (in module dissect.target.plugins.os.windows.regf.mru) recentfilecache() (dissect.target.plugins.os.windows.regf.recentfilecache.RecentFileCachePlugin method) RecentFileCachePlugin (class in dissect.target.plugins.os.windows.regf.recentfilecache) RecentFileCacheRecord (in module dissect.target.plugins.os.windows.regf.recentfilecache) recently_used() (dissect.target.plugins.os.unix.linux.recentlyused.RecentlyUsedPlugin method) RecentlyUsedApplicationRecord (in module dissect.target.plugins.os.unix.linux.recentlyused) RecentlyUsedIconRecord (in module dissect.target.plugins.os.unix.linux.recentlyused) RecentlyUsedPlugin (class in dissect.target.plugins.os.unix.linux.recentlyused) RecentlyUsedRecord (in module dissect.target.plugins.os.unix.linux.recentlyused) Recents (class in acquire.acquire.acquire) reconfigure_log_file() (in module acquire.acquire.log) RECONNECT_WAIT (dissect.target.loaders.remote.RemoteStreamConnection attribute) Record (class in acquire.acquire.collector) (class in dissect.database.ese) (class in dissect.database.ese.record) (class in dissect.eventlog.evt) (class in dissect.target.plugins.os.windows.everything.parser) (class in flow.record) (class in flow.record.base) (class in flow.record.fieldtypes) record (class in flow.record.fieldtypes) (dissect.clfs.blf.BaseRecord attribute) (dissect.clfs.blf.TruncateRecord attribute) (dissect.database.ese.Index attribute) (dissect.database.ese.index.Index attribute) (dissect.database.ese.record.TagField attribute) (dissect.database.ese.Table attribute) (dissect.database.ese.table.Column attribute) (dissect.database.ese.table.Table attribute) (dissect.database.ese.tools.sru.Entry attribute) (dissect.eventlog.evt.Record attribute) (dissect.ntfs.attr.Attribute attribute) (dissect.ntfs.attr.AttributeHeader attribute) (dissect.ntfs.attr.AttributeRecord attribute) (dissect.ntfs.Attribute attribute) (dissect.ntfs.AttributeHeader attribute) (dissect.ntfs.AttributeRecord attribute) (dissect.ntfs.Index attribute) (dissect.ntfs.index.Index attribute) (dissect.ntfs.Secure attribute) (dissect.ntfs.secure.Secure attribute) (dissect.target.plugin.FunctionDescriptor property) (dissect.target.plugins.os.windows.search.TableRecord attribute) (dissect.target.tools.dump.RecordStreamElement attribute) (flow.record.selector.WrappedRecord attribute) record() (dissect.database.ese.cursor.Cursor method) (dissect.target.loaders.mqtt.MqttTransferRatePerSecond method) record_buffer (flow.record.adapter.splunk.SplunkWriter attribute) RECORD_BUFFER_LIMIT (in module flow.record.adapter.splunk) RECORD_CLASS_TEMPLATE (in module flow.record.base) record_count (dissect.target.tools.dump.DumpState property) (dissect.target.tools.dump.Sink attribute) record_descriptor_for_fields (flow.record.stream.RecordFieldRewriter attribute) RECORD_DIFF_RECORD_FIELDS (in module dissect.target.tools.diff) record_length (dissect.ntfs.attr.AttributeHeader property) (dissect.ntfs.AttributeHeader property) record_name (dissect.target.plugins.apps.edr.velociraptor.VelociraptorRecordBuilder attribute) RECORD_NAME (dissect.target.plugins.os.unix.log.auth.AuthLogRecordBuilder attribute) (dissect.target.plugins.os.windows.log.etl.EtlRecordBuilder attribute) (dissect.target.plugins.os.windows.log.evtx.EvtxPlugin attribute) (in module dissect.target.plugins.os.unix.linux.services) record_output() (in module dissect.target.tools.query) RECORD_PACK_EXT_TYPE (in module flow.record.packer) RECORD_PACK_TYPE_DATETIME (in module flow.record.packer) RECORD_PACK_TYPE_DESCRIPTOR (in module flow.record.packer) RECORD_PACK_TYPE_FIELDTYPE (in module flow.record.packer) RECORD_PACK_TYPE_GROUPEDRECORD (in module flow.record.packer) RECORD_PACK_TYPE_RECORD (in module flow.record.packer) RECORD_PACK_TYPE_VARINT (in module flow.record.packer) record_stream() (in module flow.record.stream) record_stream_for_path() (flow.record.stream.PathTemplateWriter method) record_to_document() (flow.record.adapter.elastic.ElasticWriter method) record_to_splunk_http_api_json() (in module flow.record.adapter.splunk) record_to_splunk_json() (in module flow.record.adapter.splunk) record_to_splunk_kv_line() (in module flow.record.adapter.splunk) record_to_splunk_tcp_api_json() (in module flow.record.adapter.splunk) RECORD_TYPE (in module dissect.volume.vss) RECORD_TYPE_MAP (in module flow.record.adapter.avro) RECORD_TYPES (in module dissect.target.plugins.filesystem.ntfs.mft) RECORD_VERSION (in module flow.record) (in module flow.record.base) RecordAdapter() (in module flow.record) (in module flow.record.base) RecordAdapterNotFound RecordArchiver (class in flow.record.stream) RecordContextMatcher (class in flow.record.selector) RecordCreatedRecord (in module dissect.target.tools.diff) RecordData (class in dissect.database.ese.record) RecordDeletedRecord (in module dissect.target.tools.diff) RecordDescriptor (class in flow.record) (class in flow.record.base) RecordDescriptorError, [1] RecordDescriptorExtensionBase (class in dissect.target.helpers.descriptor_extensions) RecordDescriptorNotFound RecordField (class in flow.record) (class in flow.record.base) RecordFieldRewriter (class in flow.record.stream) RecordFieldSet (class in flow.record.base) RecordNumber (dissect.eventlog.evt.Record attribute) RecordOutput() (in module flow.record.stream) RecordPacker (class in flow.record.packer) RecordPrinter (class in flow.record.stream) RecordReader() (in module flow.record) (in module flow.record.base) records (dissect.apfs.objects.fs.INode property) (dissect.fve.bde.eow.EowBitmap property) RECORDS (flow.record.adapter.splunk.SourceType attribute) records (flow.record.base.GroupedRecord attribute) (flow.record.GroupedRecord attribute) records() (dissect.apfs.objects.FS method) (dissect.apfs.objects.fs.FS method) (dissect.clfs.container.Container method) (dissect.database.bsd.DB method) (dissect.database.bsd.db.DB method) (dissect.database.DB method) (dissect.database.ese.Table method) (dissect.database.ese.table.Table method) (dissect.database.ese.tools.certlog.CertLog method) (dissect.ntfs.UsnJrnl method) (dissect.ntfs.usnjrnl.UsnJrnl method) (dissect.target.plugins.filesystem.ntfs.mft.MftPlugin method) RECORDSTREAM_MAGIC (in module flow.record) (in module flow.record.base) RECORDSTREAM_MAGIC_DEPTH (in module flow.record.base) RecordStreamElement (class in dissect.target.tools.dump) RecordStreamReader (class in flow.record.stream) RecordStreamWriter (class in flow.record.stream) recordType (flow.record.base.RecordDescriptor attribute) (flow.record.RecordDescriptor attribute) recordtype (flow.record.stream.RecordStreamReader attribute) RecordUnchangedRecord (in module dissect.target.tools.diff) RecordValue (in module dissect.database.ese.util) RecordWrapper (class in dissect.database.ese.tools.impacket) RecordWriter() (in module flow.record) (in module flow.record.base) recover() (dissect.target.plugins.os.windows.rdpcache.RdpCachePlugin method) recover_quarantined_file_streams() (in module dissect.target.plugins.os.windows.defender.quarantine) recover_string() (in module dissect.target.helpers.scrape) RECOVERY_KEY (dissect.target.helpers.keychain.KeyType attribute) recurse() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (in module dissect.target.helpers.fsutil) recursor() (in module dissect.target.tools.reg) RecycleBin (class in acquire.acquire.acquire) recyclebin() (dissect.target.plugins.os.windows.recyclebin.RecyclebinPlugin method) recyclebin_def (in module dissect.target.plugins.os.windows.recyclebin) recyclebin_filter() (in module acquire.acquire.acquire) recyclebin_paths (dissect.target.plugins.os.windows.recyclebin.RecyclebinPlugin attribute) RecyclebinPlugin (class in dissect.target.plugins.os.windows.recyclebin) RecycleBinRecord (in module dissect.target.plugins.os.windows.recyclebin) RED (dissect.target.helpers.cyber.Color attribute) (dissect.target.tools.shell.AnsiColors attribute) RedHatPlugin (class in dissect.target.plugins.os.unix.linux.redhat._os) ref (dissect.archive.xva.XVAStream attribute) (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) refcnt (dissect.target.plugins.os.unix.linux.modules.Module attribute) reference (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) (dissect.volume.ddf.ddf.PhysicalDiskData attribute) (dissect.volume.ddf.ddf.PhysicalDiskRecord attribute) reference() (dissect.cim.index.Key method) reference_count (dissect.archive.wim.Resource attribute) referenced_fields (flow.record.selector.SelectorResult attribute) ReferenceNotFoundError, [1] references (dissect.hypervisor.descriptor.ovf.OVF attribute) references() (dissect.cim.index.Key method) REFS (dissect.target.plugins.os.windows.everything.parser.EverythingFSType attribute) REG (dissect.target.helpers.nfs.nfs3.FileType attribute) REG_BINARY (in module dissect.regf.c_regf) REG_DWORD (in module dissect.regf.c_regf) REG_DWORD_BIG_ENDIAN (in module dissect.regf.c_regf) REG_EXPAND_SZ (in module dissect.regf.c_regf) REG_FULL_RESOURCE_DESCRIPTOR (in module dissect.regf.c_regf) reg_keys (dissect.target.plugins.os.windows.env.EnvVarDetails attribute) REG_LINK (in module dissect.regf.c_regf) REG_MULTI_SZ (in module dissect.regf.c_regf) REG_NONE (in module dissect.regf.c_regf) REG_QWORD (in module dissect.regf.c_regf) REG_RESOURCE_LIST (in module dissect.regf.c_regf) REG_RESOURCE_REQUIREMENTS_LIST (in module dissect.regf.c_regf) REG_SZ (in module dissect.regf.c_regf) reg_value (dissect.target.plugins.os.windows.env.EnvVarDetails attribute) REGEX_IPV4 (in module flow.record.tools.geoip) REGEX_PACKAGE_NAMES (in module dissect.target.plugins.os.unix.linux.debian.apt) regf() (dissect.target.plugins.os.windows.regf.regf.RegfPlugin method) regf_def (in module dissect.regf.c_regf) RegfHive (class in dissect.target.helpers.regutil) RegfKey (class in dissect.target.helpers.regutil) RegFlex (class in dissect.target.helpers.regutil) RegFlexHive (class in dissect.target.helpers.regutil) RegFlexKey (class in dissect.target.helpers.regutil) RegFlexValue (class in dissect.target.helpers.regutil) RegfPlugin (class in dissect.target.plugins.os.windows.regf.regf) RegfValue (class in dissect.target.helpers.regutil) region_offset (dissect.fve.bde.eow.EowBitmap property) region_size (dissect.fve.bde.eow.EowBitmap property) (dissect.volume.lvm.metadata.MirrorSegment attribute) (dissect.volume.lvm.metadata.RAIDSegment attribute) region_table (dissect.hypervisor.disk.vhdx.VHDX attribute) region_tables (dissect.hypervisor.disk.vhdx.VHDX attribute) RegionTable (class in dissect.hypervisor.disk.vhdx) register() (acquire.acquire.uploaders.plugin_registry.PluginRegistry method) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager method) (flow.record.jsonpacker.JsonRecordPacker method) (flow.record.JsonRecordPacker method) (flow.record.packer.RecordPacker method) (in module dissect.target.container) (in module dissect.target.filesystem) (in module dissect.target.loader) (in module dissect.target.plugin) register_aliases() (dissect.target.tools.shell.ExtendedCmd method) register_key() (in module dissect.target.helpers.keychain) register_keychain_file() (in module dissect.target.helpers.keychain) register_module() (in module acquire.acquire.acquire) register_wildcard_value() (in module dissect.target.helpers.keychain) registered (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager property) REGISTERED_PLUGIN (dissect.target.target.Event attribute) registered_plugins (dissect.target.tools.utils.report.TargetExecutionReport attribute) RegistrationTrigger (in module dissect.target.plugins.os.windows.tasks.records) registry (acquire.acquire.collector.CollectionReport attribute) Registry (class in acquire.acquire.acquire) registry (dissect.target.tools.shell.RegistryCli attribute) registry() (dissect.target.plugins.os.windows.cam.CamPlugin method) RegistryCli (class in dissect.target.tools.shell) RegistryCorruptError RegistryError RegistryGuid (in module dissect.etl.utils) RegistryHive (class in dissect.regf) (class in dissect.regf.regf) (class in dissect.target.helpers.regutil) RegistryKey (class in dissect.target.helpers.regutil) RegistryKeyNotFoundError, [1], [2] RegistryKeyNotFoundException RegistryKeyRecord (in module dissect.target.plugins.os.windows.regf.regf) RegistryPlugin (class in dissect.target.plugins.os.windows.registry) RegistryRecordDescriptorExtension (class in dissect.target.helpers.descriptor_extensions) RegistryValue (class in dissect.target.helpers.regutil) RegistryValueNotFoundError, [1], [2] RegistryValueRecord (in module dissect.target.plugins.os.windows.regf.regf) RegistryValueType (class in dissect.target.helpers.regutil) REGKEY_GLOBS (dissect.target.plugins.os.windows.regf.appxdebugkeys.AppxDebugKeysPlugin attribute) REGULAR_1822 (dissect.target.plugins.os.windows.network.IfTypes attribute) RejectedReply (class in dissect.target.helpers.sunrpc.sunrpc) RejectStat (class in dissect.target.helpers.sunrpc.sunrpc) RELATED_ACTIVITY_ID (dissect.etl.headers.event.ExtType attribute) related_sections() (dissect.executable.elf.elf.SectionTable method) (dissect.executable.elf.SectionTable method) related_segments() (dissect.executable.elf.elf.SegmentTable method) (dissect.executable.elf.SegmentTable method) relative (dissect.archive.wim.ReparsePoint property) (dissect.ntfs.attr.ReparsePoint property) relative_inum (dissect.xfs.xfs.INode attribute) relative_offset (dissect.volume.vss.BlockDescriptor attribute) relative_path (dissect.target.loaders.itunes.FileInfo attribute) relative_to() (dissect.target.helpers.compat.path_310.PureDissectPath method) (dissect.target.helpers.compat.path_311.PureDissectPath method) RelativeStream (class in dissect.util.stream) release (dissect.database.bsd.tools.rpm.Package property) release() (dissect.target.helpers.mount.DissectMount method) releasedir() (dissect.target.helpers.mount.DissectMount method) reload() (dissect.target.Target method) (dissect.target.target.Target method) relpath() (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.polypath) rem_address (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) remainder (dissect.etl.headers.headers.Marker property) REMAINDER_MASK (dissect.etl.headers.headers.Marker attribute) remote_ip (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) remote_port (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) RemoteAccess (class in acquire.acquire.acquire) RemoteAccessFileTransferRecord (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin attribute) (dissect.target.plugins.apps.remoteaccess.splashtop.SplashtopPlugin attribute) (in module dissect.target.plugins.apps.remoteaccess.remoteaccess) RemoteAccessLogRecord (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin attribute) (dissect.target.plugins.apps.remoteaccess.rustdesk.RustdeskPlugin attribute) (dissect.target.plugins.apps.remoteaccess.splashtop.SplashtopPlugin attribute) (dissect.target.plugins.apps.remoteaccess.teamviewer.TeamViewerPlugin attribute) (in module dissect.target.plugins.apps.remoteaccess.remoteaccess) RemoteAccessPlugin (class in dissect.target.plugins.apps.remoteaccess.remoteaccess) RemoteLoader (class in dissect.target.loaders.remote) RemoteStream (class in dissect.target.loaders.remote) RemoteStreamConnection (class in dissect.target.loaders.remote) removal_time (dissect.volume.lvm.metadata.HistoricalLogicalVolume attribute) Remove (dissect.target.plugins.os.unix.packagemanager.OperationTypes attribute) remove() (acquire.acquire.uploaders.plugin_registry.PluginRegistry method) remove_fs_layer() (dissect.target.filesystem.LayerFilesystem method) remove_handler() (flow.record.utils.EventHandler method) remove_layer() (dissect.target.filesystem.LayerFilesystem method) REMOVING (dissect.target.plugins.apps.container.podman.ContainerState attribute) rename() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) render_stacktrace_only_in_debug_or_less() (in module dissect.target.tools.utils.logging) repair_checksum() (in module dissect.util.compression.xz) reparse_point (dissect.archive.wim.DirectoryEntry property) reparse_point_name (dissect.ntfs.mft.MftRecord property) (dissect.ntfs.MftRecord property) reparse_point_record (dissect.ntfs.mft.MftRecord property) (dissect.ntfs.MftRecord property) reparse_point_substitute_name (dissect.ntfs.mft.MftRecord property) (dissect.ntfs.MftRecord property) ReparsePoint (class in dissect.archive.wim) (class in dissect.ntfs.attr) replace() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) replace_dash_with_none() (in module dissect.target.plugins.apps.webserver.iis) REPLACE_LIST (in module flow.record.adapter.text) REPLACEMENTS (in module dissect.target.plugins.filesystem.resolver) replay_logs (dissect.hypervisor.descriptor.hyperv.HyperVFile attribute) REPLY (dissect.target.helpers.sunrpc.serializer.MessageType attribute) ReplyStat (class in dissect.target.helpers.sunrpc.serializer) repo() (dissect.target.plugins.os.windows.cim.CimPlugin method) report (acquire.acquire.collector.Collector attribute) ReproDebugEntry (class in dissect.executable.pe.directory.debug) reprsid() (in module dissect.eventlog.evt) REQUEST_DISPOSITION (in module dissect.database.ese.tools.certlog) REQUEST_STATUS_CODE (in module dissect.database.ese.tools.certlog) REQUEST_TYPE (in module dissect.database.ese.tools.certlog) required_privileges (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) requirements (dissect.fve.luks.metadata.Config attribute) reserved (acquire.acquire.dynamic.windows.types.Handle attribute) (acquire.acquire.dynamic.windows.types.SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX property) (dissect.hypervisor.disk.asif.DataStream attribute) reserved1 (dissect.etl.headers.event.EventHeaderExtendedDataItem attribute) reserved2 (dissect.etl.headers.event.EventHeaderExtendedDataItem attribute) RESERVED_255 (dissect.target.helpers.network.IANAProtocol attribute) RESERVED_FIELDS (in module flow.record.adapter.splunk) (in module flow.record.base) RESERVED_IDX (in module dissect.evidence.asdf.asdf) RESERVED_RDUMP_FIELDS (in module flow.record.adapter.splunk) reserved_regions() (dissect.fve.bde.BDE method) (dissect.fve.bde.bde.BDE method) RESERVED_SPLUNK_APP_FIELDS (in module flow.record.adapter.splunk) RESERVED_SPLUNK_FIELDS (in module flow.record.adapter.splunk) ReservedFlags (class in dissect.etl.headers.logfile) RESET (dissect.target.tools.shell.AnsiColors attribute) reset() (acquire.acquire.esxi.EsxiMemoryManager method) (dissect.apfs.cursor.Cursor method) (dissect.btrfs.tree.Cursor method) (dissect.cstruct.BitBuffer method) (dissect.cstruct.bitbuffer.BitBuffer method) (dissect.database.ese.btree.BTree method) (dissect.database.ese.cursor.Cursor method) reset_flags() (dissect.cstruct.parser.TokenConsumer method) ResFile (class in dissect.target.loaders.res) reshape_count (dissect.volume.lvm.metadata.Segment attribute) RESHDR_FLAG (in module dissect.archive.c_wim) resident (dissect.ntfs.attr.Attribute property) (dissect.ntfs.attr.AttributeHeader property) (dissect.ntfs.Attribute property) (dissect.ntfs.AttributeHeader property) (dissect.ntfs.mft.MftRecord property) (dissect.ntfs.MftRecord property) ResLoader (class in dissect.target.loaders.res) RESOLVE (dissect.target.helpers.record_modifier.Modifier attribute) resolve() (dissect.cstruct.cstruct method) (dissect.cstruct.cstruct.cstruct method) (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) (dissect.target.plugins.filesystem.resolver.ResolverPlugin method) resolve_address() (dissect.vmfs.resource.FileBlockResourceVMFS5 method) (dissect.vmfs.resource.LargeFileBlockResourceVMFS6 method) (dissect.vmfs.resource.ResourceFile method) (dissect.vmfs.resource.SmallFileBlockResourceVMFS6 method) resolve_attr_path() (in module flow.record.selector) resolve_default() (dissect.target.plugins.filesystem.resolver.ResolverPlugin method) resolve_fs() (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj method) resolve_glob_path() (dissect.target.tools.shell.TargetCli method) (dissect.target.tools.shell.UnixConfigTreeCli method) resolve_id() (dissect.database.ese.tools.sru.SRU method) resolve_key() (dissect.target.tools.shell.RegistryCli method) (dissect.target.tools.shell.UnixConfigTreeCli method) resolve_link() (in module dissect.target.helpers.fsutil) resolve_path (dissect.btrfs.btrfs.Subvolume attribute) (dissect.btrfs.Subvolume attribute) resolve_path() (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj method) (dissect.target.tools.shell.TargetCli method) (dissect.target.tools.shell.UnixConfigTreeCli method) resolve_windows() (dissect.target.plugins.filesystem.resolver.ResolverPlugin method) ResolveError, [1] ResolverPlugin (class in dissect.target.plugins.filesystem.resolver) ResOSPlugin (class in dissect.target.loaders.res) Resource (class in dissect.archive.wim) (class in dissect.executable.pe.directory.resource) resource (dissect.vmfs.address.FileDescriptorAddr property) (dissect.vmfs.address.JournalBlockAddr property) (dissect.vmfs.address.PointerBlockAddr property) (dissect.vmfs.address.PointerBlockAddr64 property) (dissect.vmfs.address.SmallFileBlockAddr property) (dissect.vmfs.address.SubBlockAddr property) (dissect.vmfs.address.SubBlockAddr64 property) resource_id (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntryResource attribute) RESOURCE_LIST (dissect.target.helpers.regutil.RegistryValueType attribute) RESOURCE_REQUIREMENTS_LIST (dissect.target.helpers.regutil.RegistryValueType attribute) RESOURCE_TYPE_ABBREVIATIONS (in module dissect.vmfs.resource) RESOURCE_TYPE_MAP_VMFS5 (in module dissect.vmfs.resource) RESOURCE_TYPE_MAP_VMFS6 (in module dissect.vmfs.resource) ResourceDataEntry (class in dissect.executable.pe.directory) (class in dissect.executable.pe.directory.resource) ResourceDirectory (class in dissect.executable.pe.directory) (class in dissect.executable.pe.directory.resource) ResourceDirectoryEntry (class in dissect.executable.pe.directory) (class in dissect.executable.pe.directory.resource) ResourceEntry (class in dissect.executable.pe.directory) (class in dissect.executable.pe.directory.resource) ResourceFile (class in dissect.vmfs.resource) ResourceManager (class in dissect.vmfs.resource) resources (dissect.archive.wim.WIM property) (dissect.executable.PE property) (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) (dissect.executable.pe.PE property) (dissect.executable.pe.pe.PE property) (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntry attribute) (dissect.vmfs.resource.ResourceManager attribute) (dissect.vmfs.VMFS attribute) (dissect.vmfs.vmfs.VMFS attribute) restansmit (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) restart_on_failure_count (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) restart_on_failure_interval (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) result (acquire.acquire.gui.win32.Win32 attribute) (dissect.target.helpers.sunrpc.sunrpc.RejectedReply attribute) (flow.record.selector.SelectorResult attribute) ResultDeserializer (class in dissect.target.helpers.nfs.serializer) results (dissect.target.helpers.sunrpc.sunrpc.AcceptedReply attribute) Results (in module dissect.target.helpers.sunrpc.client) results() (dissect.target.plugins.apps.edr.velociraptor.VelociraptorPlugin method) results_dir (dissect.target.plugins.apps.edr.velociraptor.VelociraptorPlugin attribute) ResultType (in module dissect.target.helpers.nfs.serializer) retries (dissect.target.loaders.mqtt.MqttConnection attribute) reveal_text (acquire.acquire.gui.win32.Win32 attribute) reverse (dissect.volume.vss.BlockMap attribute) reverse() (dissect.cim.mappings.Mapping method) reverse_read() (in module dissect.target.helpers.fsutil) reverse_readlines() (in module dissect.target.helpers.fsutil) reverse_search() (in module dissect.target.loaders.res) revision (dissect.executable.pe.directory.security.Certificate property) rewrite() (flow.record.stream.RecordFieldRewriter method) REWRITE_CACHE (in module dissect.target.helpers.cache) RFC1483 (dissect.target.plugins.os.windows.network.IfTypes attribute) rfc4716_def (in module dissect.target.plugins.apps.ssh.ssh) RFC4716_MAGIC (in module dissect.target.plugins.apps.ssh.ssh) RFC4716_MARKER_END (in module dissect.target.plugins.apps.ssh.ssh) RFC4716_MARKER_START (in module dissect.target.plugins.apps.ssh.ssh) RFC4716_NONE (in module dissect.target.plugins.apps.ssh.ssh) RFC4716_PADDING (in module dissect.target.plugins.apps.ssh.ssh) RFC877_X25 (dissect.target.plugins.os.windows.network.IfTypes attribute) rglob() (dissect.target.helpers.compat.path_313.TargetPath method) rid_to_key() (in module dissect.target.plugins.os.windows.credential.sam) RIGHT_ASYMMETRIC (dissect.volume.raid.stream.Layout attribute) RIGHT_ASYMMETRIC_6 (dissect.volume.raid.stream.Layout attribute) right_page (dissect.database.sqlite3.sqlite3.Page attribute) right_sibling (dissect.ole.ole.DirectoryEntry property) RIGHT_SYMMETRIC (dissect.volume.raid.stream.Layout attribute) RIGHT_SYMMETRIC_6 (dissect.volume.raid.stream.Layout attribute) rmdir() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) rmem (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) ROHC (dissect.target.helpers.network.IANAProtocol attribute) role (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) (dissect.fve.bde.information.Datum property) role_access() (dissect.target.plugins.os.windows.ual.UalPlugin method) role_guid_map (dissect.target.plugins.os.windows.ual.UalPlugin attribute) RoleAccessRecord (in module dissect.target.plugins.os.windows.ual) root (acquire.acquire.dynamic.windows.named_objects.NamedObject attribute) (dissect.apfs.objects.BTree attribute) (dissect.apfs.objects.btree.BTree attribute) (dissect.apfs.objects.FS attribute) (dissect.apfs.objects.fs.FS attribute) (dissect.archive.vbk.MetaBlob attribute) (dissect.archive.vbk.RootDirectory attribute) (dissect.archive.vbk.SubFolderItem attribute) (dissect.archive.vbk.VBK attribute) (dissect.archive.wim.Image attribute) (dissect.btrfs.Btrfs attribute) (dissect.btrfs.btrfs.Btrfs attribute) (dissect.btrfs.btrfs.Subvolume property) (dissect.btrfs.Subvolume property) (dissect.cim.CIM attribute) (dissect.cim.cim.CIM attribute) (dissect.cramfs.CramFS attribute) (dissect.cramfs.cramfs.CramFS attribute) (dissect.database.ese.btree.BTree attribute) (dissect.database.ese.Index property) (dissect.database.ese.index.Index property) (dissect.database.ese.Table property) (dissect.database.ese.table.Table property) (dissect.evidence.ad1.AD1 attribute) (dissect.extfs.ExtFS attribute) (dissect.extfs.extfs.ExtFS attribute) (dissect.fat.fat.FATFS attribute) (dissect.fat.FATFS attribute) (dissect.ffs.FFS attribute) (dissect.ffs.ffs.FFS attribute) (dissect.hypervisor.descriptor.hyperv.HyperVFile attribute) (dissect.jffs.JFFS2 attribute) (dissect.jffs.jffs2.JFFS2 attribute) (dissect.ntfs.Index attribute) (dissect.ntfs.index.Index attribute) (dissect.ntfs.Mft property) (dissect.ntfs.mft.Mft property) (dissect.ole.OLE attribute) (dissect.ole.ole.OLE attribute) (dissect.qnxfs.QNX4 attribute) (dissect.qnxfs.qnx4.QNX4 attribute) (dissect.qnxfs.QNX6 attribute) (dissect.qnxfs.qnx6.QNX6 attribute) (dissect.squashfs.SquashFS attribute) (dissect.squashfs.squashfs.SquashFS attribute) (dissect.target.filesystem.LayerFilesystem attribute) (dissect.target.filesystem.VirtualFilesystem attribute) (dissect.target.loaders.itunes.ITunesBackup attribute) (dissect.target.plugins.os.unix.linux.proc.ProcProcess attribute) (dissect.vmfs.VMFS attribute) (dissect.vmfs.vmfs.VMFS attribute) (dissect.volume.dm.btree.BTree attribute) (dissect.xfs.XFS attribute) (dissect.xfs.xfs.XFS attribute) root() (dissect.regf.regf.RegistryHive method) (dissect.regf.RegistryHive method) (dissect.target.helpers.regutil.RegfHive method) (dissect.target.helpers.regutil.RegistryHive method) (dissect.target.plugins.os.windows.registry.RegistryPlugin method) root_cause_str() (dissect.target.exceptions.UnsupportedPluginError method) root_dir_cluster (dissect.fat.ExFAT attribute) (dissect.fat.exfat.ExFAT attribute) root_dir_sector (dissect.fat.ExFAT attribute) (dissect.fat.exfat.ExFAT attribute) root_directory (dissect.fat.ExFAT attribute) (dissect.fat.exfat.ExFAT attribute) root_dirs (acquire.acquire.acquire.History.DirCombinations attribute) ROOT_FOLDER (class in dissect.target.plugins.os.windows.regf.shellbags) root_item (dissect.btrfs.tree.BTree attribute) root_key (dissect.target.loaders.cb.CbRegistryHive attribute) root_manifest_path (dissect.target.plugins.apps.productivity.msoffice.ClickOnceDeploymentManifestParser attribute) ROOT_NAMESPACE_NAME (in module dissect.cim.c_cim) root_offset (dissect.btrfs.tree.BTree attribute) root_page (dissect.cim.index.Store attribute) (dissect.database.ese.Table attribute) (dissect.database.ese.table.Catalog attribute) (dissect.database.ese.table.Table attribute) root_tree (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) RootDirectory (class in dissect.archive.vbk) (class in dissect.fat.fat) RootFilesystem (class in dissect.target.filesystem) RootFilesystemEntry (class in dissect.target.filesystem) rotate_existing_file() (flow.record.stream.PathTemplateWriter method) rotate_parity_count (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) ROTATING_N_CONTINUE (dissect.volume.raid.stream.Layout attribute) ROTATING_N_RESTART (dissect.volume.raid.stream.Layout attribute) ROTATING_ZERO_RESTART (dissect.volume.raid.stream.Layout attribute) rounds (dissect.hypervisor.descriptor.vmx.Phrase attribute) Row (class in dissect.database.sqlite3) (class in dissect.database.sqlite3.sqlite3) row() (dissect.database.sqlite3.sqlite3.Table method) (dissect.database.sqlite3.Table method) rows() (dissect.database.sqlite3.sqlite3.Table method) (dissect.database.sqlite3.Table method) RPC_MISMATCH (dissect.target.helpers.sunrpc.sunrpc.RejectStat attribute) rpc_version (dissect.target.helpers.sunrpc.sunrpc.CallBody attribute) rpm_def (in module dissect.database.bsd.tools.c_rpm) RS232 (dissect.target.plugins.os.windows.network.IfTypes attribute) RSRB (dissect.target.plugins.os.windows.network.IfTypes attribute) rsrc (dissect.executable.pe.directory.resource.ResourceEntry attribute) (dissect.executable.pe.directory.ResourceEntry attribute) RSVP (dissect.target.helpers.network.IANAProtocol attribute) RSVP_E2E_IGNORE (dissect.target.helpers.network.IANAProtocol attribute) RtlNtStatusToDosError (in module acquire.acquire.dynamic.windows.ntdll) RULE_KEYS (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin attribute) rules() (dissect.target.plugins.os.windows.firewall.WindowsFirewallPlugin method) Run (in module dissect.fve.bde.bde) run() (acquire.acquire.acquire.FileHashes class method) (acquire.acquire.acquire.Module class method) (acquire.acquire.acquire.OpenHandles class method) (acquire.acquire.acquire.SSH class method) (dissect.target.plugins.os.windows.regf.mru.MRUPlugin method) run_as (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) run_cli() (in module dissect.target.tools.shell) RUN_ENCRYPTED (dissect.fve.bde.bde.BitlockerStream attribute) run_level (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) run_only_idle (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) run_only_network_available (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) RUN_PLAIN (dissect.fve.bde.bde.BitlockerStream attribute) RUN_SPARSE (dissect.fve.bde.bde.BitlockerStream attribute) RUN_VISTA_HEADER (dissect.fve.bde.bde.BitlockerStream attribute) RunKeyRecord (in module dissect.target.plugins.os.windows.regf.runkeys) runkeys() (dissect.target.plugins.os.windows.regf.runkeys.RunKeysPlugin method) RunKeysPlugin (class in dissect.target.plugins.os.windows.regf.runkeys) runlist (dissect.ntfs.stream.CompressedRunlistStream property) (dissect.util.stream.RunlistStream property) runlist() (dissect.fat.ExFAT method) (dissect.fat.exfat.ExFAT method) (dissect.fat.fat.FAT method) RunlistStream (class in dissect.util.stream) RunMRURecord (in module dissect.target.plugins.os.windows.regf.mru) RUNNING (dissect.target.plugins.apps.container.podman.ContainerState attribute) runs (dissect.vmfs.lvm.VolumeStream attribute) runs() (dissect.fve.bde.eow.EowBitmap method) (dissect.fve.bde.eow.EowBitmapRecord method) runtime (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) RustdeskPlugin (class in dissect.target.plugins.apps.remoteaccess.rustdesk) rva (dissect.executable.pe.directory.basereloc.BaseRelocation attribute) RVD (dissect.target.helpers.network.IANAProtocol attribute) rx_queue (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) S S (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) sacl (dissect.ntfs.secure.SecurityDescriptor attribute) (dissect.ntfs.SecurityDescriptor attribute) salt (dissect.fve.bde.information.StretchKeyDatum property) (dissect.fve.luks.metadata.Digest attribute) (dissect.fve.luks.metadata.KeyslotKdf attribute) (dissect.hypervisor.descriptor.vmx.Phrase attribute) (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) sam() (dissect.target.plugins.os.windows.credential.sam.SamPlugin method) sam_def (in module dissect.target.plugins.os.windows.credential.sam) SAM_KEY (dissect.target.plugins.os.windows.credential.sam.SamPlugin attribute) SamPlugin (class in dissect.target.plugins.os.windows.credential.sam) SamRecord (in module dissect.target.plugins.os.windows.credential.sam) sanitize_fieldvalues() (in module flow.record.adapter.xlsx) SAT_EXPAK (dissect.target.helpers.network.IANAProtocol attribute) SAT_MON (dissect.target.helpers.network.IANAProtocol attribute) sb (dissect.apfs.APFS attribute) (dissect.apfs.apfs.APFS attribute) (dissect.btrfs.Btrfs attribute) (dissect.btrfs.btrfs.Btrfs attribute) (dissect.cramfs.CramFS attribute) (dissect.cramfs.cramfs.CramFS attribute) (dissect.extfs.ExtFS attribute) (dissect.extfs.extfs.ExtFS attribute) (dissect.extfs.JDB2 attribute) (dissect.extfs.journal.JDB2 attribute) (dissect.ffs.FFS attribute) (dissect.ffs.ffs.FFS attribute) (dissect.qnxfs.QNX6 attribute) (dissect.qnxfs.qnx6.QNX6 attribute) (dissect.squashfs.SquashFS attribute) (dissect.squashfs.squashfs.SquashFS attribute) SB (dissect.vmfs.resource.ResourceManager property) sb (dissect.volume.dm.thin.Metadata attribute) (dissect.xfs.XFS attribute) (dissect.xfs.xfs.AllocationGroup attribute) (dissect.xfs.xfs.XFS attribute) sb() (dissect.hypervisor.disk.vhdx.BlockAllocationTable method) sb2 (dissect.qnxfs.QNX6 attribute) (dissect.qnxfs.qnx6.QNX6 attribute) SBLOCKSEARCH (in module dissect.ffs.ffs) sbs (dissect.apfs.APFS attribute) (dissect.apfs.apfs.APFS attribute) scan_id (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntry attribute) scandir() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry method) (dissect.target.filesystems.cb.CbFilesystemEntry method) (dissect.target.filesystems.config.ConfigurationEntry method) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.exfat.ExfatFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.fat.FatFilesystemEntry method) (dissect.target.filesystems.ffs.FfsFilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemEntry method) (dissect.target.filesystems.jffs.JffsFilesystemEntry method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry method) (dissect.target.filesystems.smb.SmbFilesystemEntry method) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystemEntry method) (dissect.target.filesystems.vbk.VbkFilesystemEntry method) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystemEntry method) (dissect.target.tools.diff.TargetComparison method) (dissect.target.tools.shell.RegistryCli method) (in module dissect.target.helpers.compat.path_common) SCC_SP (dissect.target.helpers.network.IANAProtocol attribute) SchedLgU (class in dissect.target.plugins.os.windows.log.schedlgu) schedlgu() (dissect.target.plugins.os.windows.log.schedlgu.SchedLgUPlugin method) SCHEDLGU_REGEX_PATTERN (in module dissect.target.plugins.os.windows.log.schedlgu) SchedLgUPlugin (class in dissect.target.plugins.os.windows.log.schedlgu) SchedLgURecord (in module dissect.target.plugins.os.windows.log.schedlgu) ScheduledTasks (class in dissect.target.plugins.os.windows.tasks.xml) schema (flow.record.adapter.avro.AvroReader attribute) (flow.record.adapter.avro.AvroWriter attribute) schema_to_descriptor() (in module flow.record.adapter.avro) scheme (dissect.volume.disk.Disk attribute) (dissect.volume.disk.disk.Disk attribute) (flow.record.fieldtypes.uri property) ScopeManager (class in dissect.target.helpers.configutil) SCPS (dissect.target.helpers.network.IANAProtocol attribute) scrape_blocks() (in module dissect.evidence.asdf.asdf) scrape_chunks() (in module dissect.target.helpers.scrape) scrape_chunks_from_disks() (dissect.target.plugins.scrape.scrape.ScrapePlugin method) scrape_needles_from_disks() (dissect.target.plugins.scrape.scrape.ScrapePlugin method) scrape_pos() (in module dissect.target.loaders.phobos) scraped_evt() (dissect.target.plugins.os.windows.log.evt.EvtPlugin method) scraped_evtx() (dissect.target.plugins.os.windows.log.evtx.EvtxPlugin method) ScrapePlugin (class in dissect.target.plugins.scrape.scrape) SCRIPT (class in dissect.database.ese.lcmapstring) SCTP (dissect.target.helpers.network.IANAProtocol attribute) SD (class in dissect.volume.vinum.config) sdl (dissect.executable.pe.directory.debug.VcFeatureDebugEntry property) SDLC (dissect.target.plugins.os.windows.network.IfTypes attribute) sdp_cpu_provider() (dissect.target.plugins.os.windows.sru.SRUPlugin method) sdp_network_provider() (dissect.target.plugins.os.windows.sru.SRUPlugin method) sdp_physical_disk_provider() (dissect.target.plugins.os.windows.sru.SRUPlugin method) sdp_volume_provider() (dissect.target.plugins.os.windows.sru.SRUPlugin method) SdpCpuProviderRecord (in module dissect.target.plugins.os.windows.sru) SdpNetworkProviderRecord (in module dissect.target.plugins.os.windows.sru) SdpPhysicalDiskProviderRecord (in module dissect.target.plugins.os.windows.sru) SdpVolumeProviderRecord (in module dissect.target.plugins.os.windows.sru) SDRP (dissect.target.helpers.network.IANAProtocol attribute) sds (dissect.ntfs.Secure attribute) (dissect.ntfs.secure.Secure attribute) (dissect.volume.vinum.config.VinumConfigs attribute) (dissect.volume.vinum.vinum.Config attribute) (dissect.volume.vinum.vinum.VinumPlexDisk attribute) SDSL (dissect.target.plugins.os.windows.network.IfTypes attribute) SDState (class in dissect.volume.vinum.config) search() (dissect.apfs.cursor.Cursor method) (dissect.apfs.objects.BTree method) (dissect.apfs.objects.btree.BTree method) (dissect.btrfs.tree.Cursor method) (dissect.database.ese.btree.BTree method) (dissect.database.ese.cursor.Cursor method) (dissect.database.ese.Index method) (dissect.database.ese.index.Index method) (dissect.database.ese.Table method) (dissect.database.ese.table.Table method) (dissect.ntfs.Index method) (dissect.ntfs.index.Index method) (dissect.target.plugins.os.windows.search.SearchIndexPlugin method) search_key() (dissect.database.ese.cursor.Cursor method) (dissect.database.ese.Index method) (dissect.database.ese.index.Index method) SearchFilter (class in dissect.util.ldap) SearchIndexActivityRecord (in module dissect.target.plugins.os.windows.search) SearchIndexPlugin (class in dissect.target.plugins.os.windows.search) SearchIndexRecord (in module dissect.target.plugins.os.windows.search) SearchIndexRecords (in module dissect.target.plugins.os.windows.search) secondary_element_count (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) secondary_element_seq (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) secondary_header (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) secondary_header_offset (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) SECONDARY_HEADER_OFFSETS (in module dissect.fve.luks.c_luks) secondary_raid_level (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) seconds (dissect.target.helpers.nfs.nfs3.NfsTime attribute) secrets() (dissect.target.plugins.os.windows.credential.lsa.LSAPlugin method) sect (dissect.ole.ole.Chain attribute) SECTION (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) Section (class in dissect.executable.elf) (class in dissect.executable.elf.elf) (class in dissect.executable.pe.pe) section (dissect.evidence.ewf.HeaderSection attribute) (dissect.evidence.ewf.TableSection attribute) (dissect.evidence.ewf.VolumeSection attribute) (dissect.executable.pe.pe.SectionStream attribute) SectionDescriptor (class in dissect.evidence.ewf) sections (dissect.evidence.ewf.Segment attribute) (dissect.executable.ELF attribute) (dissect.executable.elf.ELF attribute) (dissect.executable.elf.elf.ELF attribute) (dissect.executable.PE attribute) (dissect.executable.pe.PE attribute) (dissect.executable.pe.pe.PE attribute) (dissect.target.plugins.os.unix.linux.network_managers.Parser attribute) (dissect.target.plugins.os.unix.linux.network_managers.Template attribute) SectionStream (class in dissect.executable.pe.pe) SectionTable (class in dissect.executable.elf) (class in dissect.executable.elf.elf) sector_count (dissect.evidence.ewf.Segment attribute) (dissect.evidence.ewf.TableSection attribute) (dissect.evidence.ewf.VolumeSection attribute) (dissect.hypervisor.disk.vmdk.RawDisk attribute) (dissect.hypervisor.disk.vmdk.SparseDisk attribute) (dissect.hypervisor.disk.vmdk.VMDK attribute) sector_offset (dissect.evidence.ewf.Segment attribute) (dissect.evidence.ewf.TableSection attribute) (dissect.hypervisor.disk.vmdk.RawDisk attribute) (dissect.hypervisor.disk.vmdk.SparseDisk attribute) SECTOR_SHIFT (in module dissect.ntfs.c_ntfs) sector_size (dissect.btrfs.Btrfs attribute) (dissect.btrfs.btrfs.Btrfs attribute) (dissect.btrfs.stream.ExtentStream attribute) (dissect.evidence.ewf.EWFStream attribute) (dissect.evidence.ewf.VolumeSection attribute) (dissect.fat.ExFAT attribute) (dissect.fat.exfat.ExFAT attribute) (dissect.fat.fat.FATFS attribute) (dissect.fat.FATFS attribute) (dissect.fve.bde.BDE property) (dissect.fve.bde.bde.BDE property) (dissect.fve.bde.bde.BitlockerStream attribute) (dissect.fve.bde.bde.BootSector attribute) (dissect.fve.crypto.base.Cipher attribute) (dissect.fve.crypto.Cipher attribute) (dissect.fve.crypto.dmcrypt.CryptStream attribute) (dissect.fve.luks.metadata.KeyslotArea attribute) (dissect.fve.luks.metadata.Segment attribute) (dissect.hypervisor.disk.vdi.VDI attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) (dissect.ole.OLE attribute) (dissect.ole.ole.ChainStream attribute) (dissect.ole.ole.OLE attribute) (dissect.target.loaders.mqtt.DiskMessage attribute) (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) (dissect.volume.disk.Disk attribute) (dissect.volume.disk.disk.Disk attribute) (dissect.volume.disk.schemes.APM attribute) (dissect.volume.disk.schemes.apm.APM attribute) (dissect.volume.disk.schemes.BSD attribute) (dissect.volume.disk.schemes.bsd.BSD attribute) (dissect.volume.disk.schemes.GPT attribute) (dissect.volume.disk.schemes.gpt.GPT attribute) (dissect.volume.disk.schemes.MBR attribute) (dissect.volume.disk.schemes.mbr.MBR attribute) SECTOR_SIZE (in module dissect.clfs.c_clfs) (in module dissect.hypervisor.disk.c_hdd) (in module dissect.hypervisor.disk.c_vhd) (in module dissect.hypervisor.disk.c_vmdk) (in module dissect.ntfs.c_ntfs) (in module dissect.volume.dm.c_dm) (in module dissect.volume.lvm.c_lvm2) (in module dissect.volume.md.c_md) (in module dissect.volume.vinum.c_vinum) sector_size_shift (dissect.ntfs.NTFS attribute) (dissect.ntfs.ntfs.NTFS attribute) sector_to_cluster() (dissect.fat.ExFAT method) (dissect.fat.exfat.ExFAT method) sectors (dissect.hypervisor.disk.vmdk.DiskDescriptor attribute) (dissect.hypervisor.disk.vmdk.ExtentDescriptor attribute) (dissect.volume.md.md.MDPhysicalDisk attribute) (dissect.volume.md.MDPhysicalDisk attribute) sectors_per_bit (dissect.volume.lvm.metadata.IntegritySegment attribute) sectors_per_block (dissect.apfs.APFS property) (dissect.apfs.apfs.APFS property) Secure (class in dissect.ntfs) (class in dissect.ntfs.secure) secure (dissect.ntfs.NTFS attribute) (dissect.ntfs.ntfs.NTFS attribute) SECURE_VMTP (dissect.target.helpers.network.IANAProtocol attribute) security (dissect.archive.wim.Image attribute) (dissect.executable.PE property) (dissect.executable.pe.PE property) (dissect.executable.pe.pe.PE property) security_cookie (dissect.executable.pe.directory.load_config.LoadConfigDirectory property) (dissect.executable.pe.directory.LoadConfigDirectory property) security_descriptor (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) security_id (dissect.ntfs.attr.StandardInformation property) SECURITY_POLICY_KEY (dissect.target.plugins.os.windows.credential.lsa.LSAPlugin attribute) SecurityBlock (class in dissect.archive.wim) SecurityDescriptor (class in dissect.ntfs) (class in dissect.ntfs.secure) SecurityDirectory (class in dissect.executable.pe.directory) (class in dissect.executable.pe.directory.security) seek (dissect.hypervisor.disk.vmdk.RawDisk attribute) (dissect.target.containers.raw.RawContainer attribute) seek() (acquire.acquire.crypt.EncryptedStream method) (acquire.acquire.tools.decrypter.EncryptedFile method) (acquire.acquire.volatilestream.VolatileStream method) (dissect.database.ese.cursor.Cursor method) (dissect.evidence.asdf.streams.SubStreamBase method) (dissect.target.container.Container method) (dissect.target.containers.asdf.AsdfContainer method) (dissect.target.containers.asif.AsifContainer method) (dissect.target.containers.ewf.EwfContainer method) (dissect.target.containers.fortifw.FortiFirmwareContainer method) (dissect.target.containers.hdd.HddContainer method) (dissect.target.containers.hds.HdsContainer method) (dissect.target.containers.qcow2.QCow2Container method) (dissect.target.containers.split.SplitContainer method) (dissect.target.containers.vdi.VdiContainer method) (dissect.target.containers.vhd.VhdContainer method) (dissect.target.containers.vhdx.VhdxContainer method) (dissect.target.containers.vmdk.VmdkContainer method) (dissect.target.filesystem.VirtualFileHandle method) (dissect.target.loaders.mqtt.Broker method) (dissect.target.volume.Volume method) (dissect.util.stream.AlignedStream method) seek_and_return() (in module dissect.thumbcache.util) seek_key() (dissect.database.ese.cursor.Cursor method) seekable() (acquire.acquire.tools.decrypter.EncryptedFile method) (acquire.acquire.volatilestream.VolatileStream method) (dissect.target.container.Container method) (dissect.target.filesystem.VirtualFileHandle method) (dissect.target.volume.Volume method) (dissect.util.stream.AlignedStream method) SeekMessage (class in dissect.target.loaders.mqtt) seen_paths (acquire.acquire.collector.CollectionReport attribute) Segment (class in dissect.evidence.ewf) (class in dissect.executable.elf) (class in dissect.executable.elf.elf) (class in dissect.fve.luks.metadata) (class in dissect.volume.lvm.metadata) segment (dissect.evidence.ewf.HeaderSection attribute) (dissect.evidence.ewf.TableSection attribute) (dissect.evidence.ewf.VolumeSection attribute) (dissect.ntfs.mft.MftRecord attribute) (dissect.ntfs.MftRecord attribute) segment_count (dissect.volume.lvm.metadata.LogicalVolume attribute) segment_reference() (in module dissect.ntfs.util) SegmentIntegrity (class in dissect.fve.luks.metadata) segments (dissect.executable.ELF attribute) (dissect.executable.elf.ELF attribute) (dissect.executable.elf.elf.ELF attribute) (dissect.fve.luks.metadata.Digest attribute) (dissect.fve.luks.metadata.Metadata attribute) (dissect.volume.lvm.metadata.LogicalVolume property) segments() (dissect.ntfs.Mft method) (dissect.ntfs.mft.Mft method) SegmentTable (class in dissect.executable.elf) (class in dissect.executable.elf.elf) select_event_header() (in module dissect.etl.headers.utils) select_header() (dissect.target.plugins.os.windows.recyclebin.RecyclebinPlugin method) Selector (class in flow.record.selector) selector (flow.record.adapter.avro.AvroReader attribute) (flow.record.adapter.csvfile.CsvfileReader attribute) (flow.record.adapter.duckdb.DuckdbReader attribute) (flow.record.adapter.elastic.ElasticReader attribute) (flow.record.adapter.jsonfile.JsonfileReader attribute) (flow.record.adapter.mongo.MongoReader attribute) (flow.record.adapter.sqlite.SqliteReader attribute) (flow.record.adapter.xlsx.XlsxReader attribute) (flow.record.stream.RecordStreamReader attribute) selector_backtrace (flow.record.selector.RecordContextMatcher attribute) selector_backtrace_verbosity (flow.record.selector.RecordContextMatcher attribute) SelectorResult (class in flow.record.selector) SEMAPHORE (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) send_event() (dissect.target.Target method) (dissect.target.target.Target method) SendEmailRecord (in module dissect.target.plugins.os.windows.tasks.records) SendMessage (in module acquire.acquire.gui.win32) sensor (dissect.target.loaders.cb.CbLoader attribute) separator (dissect.target.helpers.configutil.ConfigurationParser attribute) SEPARATOR (dissect.target.helpers.configutil.Default attribute) separator (dissect.target.helpers.configutil.ParserConfig attribute) (dissect.target.helpers.configutil.ParserOptions attribute) SEPFirewallRecord (in module dissect.target.plugins.apps.av.symantec) SEPLogRecord (in module dissect.target.plugins.apps.av.symantec) seqno (dissect.volume.lvm.metadata.VolumeGroup attribute) SEQPACKET (dissect.target.plugins.os.unix.linux.proc.Sockets.SocketStreamType attribute) SEQUENCE (dissect.etl.headers.headers.EventProperty attribute) sequence (dissect.extfs.journal.CommitBlock attribute) (dissect.extfs.journal.DescriptorBlock attribute) sequence_number (dissect.etl.headers.headers.MessageTraceHeader property) (dissect.fve.bde.eow.EowBitmapRecord property) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTable property) (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) serial (dissect.ntfs.NTFS property) (dissect.ntfs.ntfs.NTFS property) (dissect.target.volume.VolumeSystem attribute) (dissect.volume.disk.Disk property) (dissect.volume.disk.disk.Disk property) SERIAL_TYPES (in module dissect.database.sqlite3.sqlite3) serialise_record_column_values() (in module dissect.database.ese.record) Serializable (in module dissect.target.helpers.sunrpc.serializer) Serialization (class in dissect.target.tools.dump) serialization (dissect.target.tools.dump.DumpState attribute) serialize() (dissect.target.helpers.nfs.serializer.DirOpArgs3Serializer method) (dissect.target.helpers.nfs.serializer.Read3ArgsSerializer method) (dissect.target.helpers.nfs.serializer.ReadDirPlusParamsSerializer method) (dissect.target.helpers.sunrpc.serializer.AuthSerializer method) (dissect.target.helpers.sunrpc.serializer.Int32Serializer method) (dissect.target.helpers.sunrpc.serializer.MessageSerializer method) (dissect.target.helpers.sunrpc.serializer.OpaqueVarLengthSerializer method) (dissect.target.helpers.sunrpc.serializer.PortMappingSerializer method) (dissect.target.helpers.sunrpc.serializer.Serializer method) (dissect.target.helpers.sunrpc.serializer.StringSerializer method) (dissect.target.tools.dump.DumpState method) serialize_handles_into_csv() (in module acquire.acquire.dynamic.windows.handles) serialize_into_csv() (in module acquire.acquire.hashes) serialize_obj() (in module dissect.target.tools.dump) Serializer (class in dissect.target.helpers.sunrpc.serializer) SERIALIZERS (in module dissect.target.tools.dump) SERVER_GLOBS (dissect.target.plugins.apps.remoteaccess.rustdesk.RustdeskPlugin attribute) SERVER_ID_MAP (in module dissect.target.plugins.os.windows.wua_history) server_root (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) SERVER_SELECTION_MAP (in module dissect.target.plugins.os.windows.wua_history) server_sid (dissect.ntfs.ACE attribute) (dissect.ntfs.secure.ACE attribute) SERVICE_ENUMS (in module dissect.target.plugins.os.windows.services) SERVICE_GLOBS (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin attribute) ServiceRecord (in module dissect.target.plugins.os.windows.services) SERVICES (dissect.target.plugins.os.unix.log.auth.AuthLogRecordBuilder attribute) services() (dissect.target.plugins.os.unix.linux.services.ServicesPlugin method) (dissect.target.plugins.os.windows.services.ServicesPlugin method) ServicesPlugin (class in dissect.target.plugins.os.unix.linux.services) (class in dissect.target.plugins.os.windows.services) SESPARSE_MAGIC (in module dissect.hypervisor.disk.c_vmdk) SESSION (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) session (dissect.target.filesystems.cb.CbFilesystem attribute) (dissect.target.loaders.cb.CbLoader attribute) (dissect.target.loaders.cb.CbRegistry attribute) (dissect.target.loaders.cb.CbRegistryHive attribute) (dissect.target.loaders.cb.CbRegistryKey attribute) (flow.record.adapter.splunk.SplunkWriter attribute) sessionmanager() (dissect.target.plugins.os.windows.generic.GenericPlugin method) SessionManagerRecord (in module dissect.target.plugins.os.windows.generic) sessions() (dissect.target.plugins.apps.ssh.putty.PuTTYPlugin method) SessionStateChangeTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) set() (dissect.eventlog.bxml.BxmlSub method) (dissect.target.plugins.os.unix.linux.fortios._os.ConfigNode method) set_cli_args() (dissect.target.tools.utils.report.ExecutionReport method) set_event_callback() (dissect.target.Target class method) (dissect.target.target.Target class method) set_event_callbacks() (dissect.target.tools.utils.report.ExecutionReport method) set_filename() (acquire.acquire.log.DelayedFileHandler method) set_ignored_fields_for_comparison() (in module flow.record) (in module flow.record.base) set_name() (dissect.target.plugins.os.unix.linux.network_managers.Template method) set_name_reader() (dissect.eventlog.bxml.Bxml method) set_plugin_stats() (dissect.target.tools.utils.report.ExecutionReport method) set_stream() (acquire.acquire.log.DelayedFileHandler method) SetLastError (in module acquire.acquire.dynamic.windows.handles) setup() (acquire.acquire.esxi.EsxiMemoryManager method) setup_logger() (in module dissect.cstruct.tools.stubgen) setup_logging() (in module acquire.acquire.log) (in module acquire.acquire.tools.decrypter) (in module dissect.archive.tools.backup) sevenzip() (dissect.target.plugins.apps.productivity.sevenzip.SevenZipPlugin method) SevenZipPlugin (class in dissect.target.plugins.apps.productivity.sevenzip) SevenZipRecord (in module dissect.target.plugins.apps.productivity.sevenzip) SEVERITY (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) SFB (dissect.vmfs.resource.ResourceManager property) SHA1 (acquire.acquire.hashes.HashFunc attribute) sha1 (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry attribute) (flow.record.fieldtypes.digest property) sha1() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (in module dissect.target.helpers.hashutil) SHA256 (acquire.acquire.hashes.HashFunc attribute) sha256 (flow.record.fieldtypes.digest property) sha256() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (in module dissect.target.helpers.hashutil) SHADOW_FILES (dissect.target.plugins.os.unix.shadow.ShadowPlugin attribute) ShadowPlugin (class in dissect.target.plugins.os.unix.shadow) shard (acquire.acquire.gui.base.GUI property) share_name (dissect.target.filesystems.smb.SmbFilesystem attribute) (dissect.target.filesystems.smb.SmbStream attribute) SharePoint (class in acquire.acquire.acquire) SHDSL (dissect.target.plugins.os.windows.network.IfTypes attribute) shell32 (in module acquire.acquire.gui.win32) shell_identifier (dissect.target.plugins.os.windows.regf.shellbags.DELEGATE attribute) shell_items (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK_BEEF0005 attribute) ShellBagRecord (in module dissect.target.plugins.os.windows.regf.shellbags) shellbags() (dissect.target.plugins.os.windows.regf.shellbags.ShellBagsPlugin method) ShellBagsPlugin (class in dissect.target.plugins.os.windows.regf.shellbags) shift_size (dissect.fve.luks.metadata.KeyslotArea attribute) SHIM6 (dissect.target.helpers.network.IANAProtocol attribute) shim_def (in module dissect.target.plugins.os.windows.regf.shimcache) SHIM_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) ShimCache (class in dissect.target.plugins.os.windows.regf.shimcache) shimcache() (dissect.target.plugins.os.windows.regf.shimcache.ShimcachePlugin method) SHIMCACHE_WIN_TYPE (class in dissect.target.plugins.os.windows.regf.shimcache) ShimCacheGeneratorType (in module dissect.target.plugins.os.windows.regf.shimcache) ShimcachePlugin (class in dissect.target.plugins.os.windows.regf.shimcache) ShimcacheRecord (in module dissect.target.plugins.os.windows.regf.shimcache) SHITEM (class in dissect.target.plugins.os.windows.regf.shellbags) SHITEMID (class in acquire.acquire.gui.win32) SHN (in module dissect.executable.elf.c_elf) short_name (dissect.archive.wim.DirectoryEntry attribute) (dissect.fat.fat.DirectoryEntry attribute) (dissect.fat.fat.RootDirectory attribute) ShortcutAppcompatRecord (in module dissect.target.plugins.os.windows.amcache) shortcuts() (dissect.target.plugins.os.windows.amcache.AmcachePlugin method) SHORTNAMES (dissect.target.plugins.os.windows.registry.RegistryPlugin attribute) Shot (class in dissect.hypervisor.disk.hdd) shots (dissect.hypervisor.disk.hdd.Snapshots attribute) should_ignore_file() (in module dissect.target.plugins.os.unix.linux.services) should_ignore_ip() (in module dissect.target.plugins.os.unix.linux.network_managers) should_stop (flow.record.tools.rdump.ProgressMonitor attribute) show() (acquire.acquire.gui.base.GUI method) (acquire.acquire.gui.win32.Win32 method) show_duplicates() (in module acquire.acquire.tools.decrypter) ShowMessageRecord (in module dissect.target.plugins.os.windows.tasks.records) SHT (in module dissect.executable.elf.c_elf) shutdown() (dissect.target.plugins.os.windows.log.etl.EtlPlugin method) sibling_id (dissect.apfs.objects.fs.DirectoryEntry property) (dissect.apfs.objects.fs.INode attribute) sibling_link (dissect.apfs.objects.fs.INode property) siblings (dissect.apfs.objects.fs.INode property) SID (dissect.etl.headers.event.ExtType attribute) (dissect.eventlog.bxml.BxmlType attribute) sid (dissect.ntfs.ACE attribute) (dissect.ntfs.secure.ACE attribute) (dissect.ole.ole.DirectoryEntry attribute) sid() (dissect.target.plugins.os.windows.generic.GenericPlugin method) sign (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) sign_computed (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) signature (dissect.eventlog.wevt.WEVT_TYPE attribute) (dissect.executable.pe.directory.debug.CodeViewDebugEntry property) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK property) SIGNATURE (in module dissect.ole.c_ole) SIGNATURE_BETA (in module dissect.ole.c_ole) SIGNATURE_MASK (in module dissect.util.compression.lznt1) signed (dissect.cstruct.Int attribute) (dissect.cstruct.LEB128 attribute) (dissect.cstruct.types.Int attribute) (dissect.cstruct.types.int.Int attribute) (dissect.cstruct.types.LEB128 attribute) (dissect.cstruct.types.leb128.LEB128 attribute) sii (dissect.ntfs.Secure attribute) (dissect.ntfs.secure.Secure attribute) SimpleDatum (class in dissect.fve.bde.information) SimpleLargeDatum (class in dissect.fve.bde.information) Sink (class in dissect.target.tools.dump) sink_path (dissect.target.tools.dump.RecordStreamElement attribute) sink_records() (in module dissect.target.tools.dump) sinks (dissect.target.tools.dump.DumpState attribute) SIP (dissect.target.plugins.os.windows.network.IfTypes attribute) size (dissect.apfs.objects.fs.INode property) (dissect.archive.vbk.Bank attribute) (dissect.archive.vbk.DirItem property) (dissect.archive.vbk.ExtFibItem property) (dissect.archive.vbk.IncrementItem property) (dissect.archive.vbk.IntFibItem property) (dissect.archive.vbk.PatchItem property) (dissect.archive.vbk.SnapshotSlot property) (dissect.archive.vma.Device attribute) (dissect.archive.vma.Extent attribute) (dissect.archive.wim.Resource attribute) (dissect.btrfs.btrfs.INode property) (dissect.btrfs.INode property) (dissect.cim.classes.DataRegion attribute) (dissect.clfs.blf.Container attribute) (dissect.cramfs.cramfs.INode property) (dissect.cramfs.INode property) (dissect.cstruct.MetaType attribute) (dissect.cstruct.types.base.MetaType attribute) (dissect.cstruct.types.MetaType attribute) (dissect.database.bsd.tools.rpm.PackageEntry attribute) (dissect.database.ese.page.Tag attribute) (dissect.database.ese.table.Column property) (dissect.database.ese.util.ColumnType attribute) (dissect.database.sqlite3.sqlite3.Cell attribute) (dissect.etl.Buffer property) (dissect.etl.etl.Buffer property) (dissect.etl.etl.EventRecord property) (dissect.etl.headers.event.EventHeaderExtendedDataItem attribute) (dissect.etl.headers.headers.Header property) (dissect.etl.headers.system.SystemSpecificHeader property) (dissect.eventlog.bxml.BxmlTemplateDescriptor property) (dissect.eventlog.wevt.WEVT property) (dissect.eventlog.wevt.WEVT_TYPE property) (dissect.evidence.ad1.FileEntry attribute) (dissect.evidence.EWF attribute) (dissect.evidence.ewf.EWF attribute) (dissect.evidence.ewf.SectionDescriptor attribute) (dissect.evidence.ewf.Segment attribute) (dissect.evidence.ewf.TableSection attribute) (dissect.evidence.tools.asdf.dd.Progress attribute) (dissect.executable.elf.elf.Section attribute) (dissect.executable.elf.elf.SectionTable attribute) (dissect.executable.elf.elf.Segment attribute) (dissect.executable.elf.elf.SegmentTable attribute) (dissect.executable.elf.elf.Symbol attribute) (dissect.executable.elf.Section attribute) (dissect.executable.elf.SectionTable attribute) (dissect.executable.elf.Segment attribute) (dissect.executable.elf.SegmentTable attribute) (dissect.executable.elf.Symbol attribute) (dissect.executable.pe.directory.base.DataDirectory attribute) (dissect.executable.pe.directory.com_descriptor.ComStream attribute) (dissect.executable.pe.directory.DataDirectory attribute) (dissect.executable.pe.directory.debug.DebugEntry property) (dissect.executable.pe.directory.resource.ResourceDataEntry property) (dissect.executable.pe.directory.ResourceDataEntry property) (dissect.executable.pe.directory.security.Certificate property) (dissect.extfs.extfs.INode property) (dissect.extfs.INode property) (dissect.fat.fat.DirectoryEntry property) (dissect.fat.fat.RootDirectory property) (dissect.ffs.ffs.INode property) (dissect.fve.bde.eow.EowBitmap property) (dissect.fve.bde.eow.EowBitmapRecord property) (dissect.fve.bde.eow.EowInformation property) (dissect.fve.bde.information.Datum property) (dissect.fve.bde.information.Information property) (dissect.fve.luks.metadata.KeyslotArea attribute) (dissect.fve.luks.metadata.Segment attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageFileObject attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTable attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.hypervisor.disk.asif.ASIF attribute) (dissect.hypervisor.disk.qcow2.QCow2 attribute) (dissect.hypervisor.disk.vhd.Disk attribute) (dissect.hypervisor.disk.vhdx.VHDX attribute) (dissect.hypervisor.disk.vmdk.SparseDisk attribute) (dissect.hypervisor.util.envelope.Envelope attribute) (dissect.jffs.jffs2.INode property) (dissect.ntfs.attr.AttributeHeader property) (dissect.ntfs.AttributeHeader property) (dissect.ntfs.index.IndexBuffer attribute) (dissect.ole.ole.Chain attribute) (dissect.ole.ole.DirectoryEntry attribute) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx6.INode6 property) (dissect.regf.regf.KeyValue property) (dissect.shellitem.lnk.lnk.LnkInfo attribute) (dissect.shellitem.lnk.lnk.LnkTargetIdList attribute) (dissect.squashfs.INode property) (dissect.squashfs.SquashFS attribute) (dissect.squashfs.squashfs.INode property) (dissect.squashfs.squashfs.SquashFS attribute) (dissect.target.container.Container attribute) (dissect.target.filesystems.exfat.ExfatFilesystemEntry attribute) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) (dissect.target.loaders.ab.AndroidBackup attribute) (dissect.target.loaders.itunes.FileInfo property) (dissect.target.loaders.res.File attribute) (dissect.target.plugins.os.unix.linux.modules.Module attribute) (dissect.target.plugins.os.windows.everything.parser.EverythingIndexObj attribute) (dissect.target.plugins.os.windows.everything.parser.Record attribute) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK property) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM attribute) (dissect.target.volume.Volume attribute) (dissect.util.stream.AlignedStream attribute) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.vmfs.Device attribute) (dissect.vmfs.FileDescriptor property) (dissect.vmfs.lvm.Device attribute) (dissect.vmfs.lvm.Volume attribute) (dissect.vmfs.Volume attribute) (dissect.volume.ddf.ddf.PhysicalDiskRecord attribute) (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) (dissect.volume.disk.Partition attribute) (dissect.volume.disk.partition.Partition attribute) (dissect.volume.lvm.LVM2Device attribute) (dissect.volume.lvm.physical.LVM2Device attribute) (dissect.volume.raid.raid.PhysicalDisk attribute) (dissect.volume.raid.raid.VirtualDisk attribute) (dissect.volume.vss.Store attribute) (dissect.xfs.xfs.INode property) size() (dissect.archive.wim.DirectoryEntry method) (dissect.ntfs.mft.MftRecord method) (dissect.ntfs.MftRecord method) (dissect.ntfs.util.AttributeCollection method) size_bytes (dissect.target.tools.dump.Sink attribute) SIZE_MASK (in module dissect.util.compression.lznt1) size_threshold (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) size_to_clusters() (in module dissect.hypervisor.disk.qcow2) size_to_subclusters() (in module dissect.hypervisor.disk.qcow2) SIZET (dissect.eventlog.bxml.BxmlType attribute) sk (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) SKIP (dissect.target.helpers.network.IANAProtocol attribute) skip() (dissect.util.compression.lzxpress_huffman.BitString method) skip_lines (dissect.target.helpers.configutil.Default attribute) skip_list (acquire.acquire.collector.Collector attribute) SKIP_TABLES (in module dissect.database.ese.tools.certlog) (in module dissect.database.ese.tools.sru) (in module dissect.database.ese.tools.ual) sl (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) slab_size_mb (dissect.volume.lvm.metadata.VdoPoolSegment attribute) SLIP (dissect.target.plugins.os.windows.network.IfTypes attribute) slot (dissect.archive.vbk.MetaBlob attribute) slot1 (dissect.archive.vbk.VBK attribute) slot2 (dissect.archive.vbk.VBK attribute) SLUG_RE (in module dissect.target.helpers.utils) slugify() (in module dissect.target.helpers.utils) slugify_descriptor_name() (in module dissect.target.tools.dump) SM (dissect.target.helpers.network.IANAProtocol attribute) SmallFileBlockAddr (class in dissect.vmfs.address) SmallFileBlockResourceVMFS6 (class in dissect.vmfs.resource) SmbFilesystem (class in dissect.target.filesystems.smb) SmbFilesystemEntry (class in dissect.target.filesystems.smb) SmbLoader (class in dissect.target.loaders.smb) SmbRegistry (class in dissect.target.loaders.smb) SmbRegistryHive (class in dissect.target.loaders.smb) SmbRegistryKey (class in dissect.target.loaders.smb) SmbRegistryValue (class in dissect.target.loaders.smb) SmbStream (class in dissect.target.filesystems.smb) SMDS_DXI (dissect.target.plugins.os.windows.network.IfTypes attribute) SMDS_ICIP (dissect.target.plugins.os.windows.network.IfTypes attribute) SMP (dissect.target.helpers.network.IANAProtocol attribute) snap() (dissect.target.plugins.os.unix.linux.debian.snap.SnapPlugin method) snap_id (dissect.vmfs.lvm.Volume attribute) (dissect.vmfs.Volume attribute) snap_meta_tree (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) SnapMetaExt (class in dissect.apfs.objects) (class in dissect.apfs.objects.snap_meta_ext) SnapPlugin (class in dissect.target.plugins.os.unix.linux.debian.snap) Snapshot (class in dissect.apfs.objects.fs) Snapshots (class in dissect.hypervisor.disk.hdd) snapshots (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) (dissect.hypervisor.disk.hdd.Descriptor attribute) (dissect.hypervisor.disk.qcow2.QCow2 property) SnapshotSegment (class in dissect.volume.lvm.metadata) SnapshotSlot (class in dissect.archive.vbk) SnapshotTableEntry (in module dissect.evidence.asdf.asdf) SNP (dissect.target.helpers.network.IANAProtocol attribute) SOCK (dissect.target.helpers.nfs.nfs3.FileType attribute) sock (flow.record.adapter.splunk.SplunkWriter attribute) SOCKET_TIMEOUT (dissect.target.loaders.remote.RemoteStreamConnection attribute) Sockets (class in dissect.target.plugins.os.unix.linux.proc) sockets (dissect.target.plugins.os.unix.linux.proc.ProcPlugin attribute) (dissect.target.plugins.os.unix.linux.sockets.NetSocketPlugin attribute) Sockets.PacketProtocolTypes (class in dissect.target.plugins.os.unix.linux.proc) Sockets.SocketStateType (class in dissect.target.plugins.os.unix.linux.proc) Sockets.SocketStreamType (class in dissect.target.plugins.os.unix.linux.proc) Sockets.TCPStates (class in dissect.target.plugins.os.unix.linux.proc) Sockets.UDPStates (class in dissect.target.plugins.os.unix.linux.proc) software (dissect.target.plugins.os.windows.firewall.LogConfig attribute) SOFTWARE_LOOPBACK (dissect.target.plugins.os.windows.network.IfTypes attribute) SOLARIS_DEV_DIR (in module dissect.target.loaders.local) SOLARIS_DRIVE_REGEX (in module dissect.target.loaders.local) some_other_way_of_using_a_variable_comment (in module codestyle) some_random_variable (in module codestyle) SONET (dissect.target.plugins.os.windows.network.IfTypes attribute) SONET_OVERHEAD_CHANNEL (dissect.target.plugins.os.windows.network.IfTypes attribute) SONET_PATH (dissect.target.plugins.os.windows.network.IfTypes attribute) SONET_VT (dissect.target.plugins.os.windows.network.IfTypes attribute) sophoshomelogs() (dissect.target.plugins.apps.av.sophos.SophosPlugin method) SophosLogRecord (in module dissect.target.plugins.apps.av.sophos) SophosPlugin (class in dissect.target.plugins.apps.av.sophos) SORT_DIGITSASNUMBERS (dissect.database.ese.lcmapstring.MapFlags attribute) sort_files() (in module acquire.acquire.acquire) SORT_STRINGSORT (dissect.database.ese.lcmapstring.MapFlags attribute) SortedKeysJsonRecordPacker (class in dissect.target.tools.dump) source (dissect.target.loaders.cellebrite.CellebriteFilesystem attribute) (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) (dissect.util.compression.lzxpress_huffman.BitString attribute) (flow.record.adapter.broker.BrokerWriter attribute) source_count (flow.record.context.AppContext attribute) source_size (dissect.archive.vbk.StgBlockDescriptor property) source_total (flow.record.context.AppContext attribute) SourceName (dissect.eventlog.evt.Record attribute) SourceType (class in flow.record.adapter.splunk) SPACE (dissect.database.sqlite3.Column attribute) (dissect.database.sqlite3.sqlite3.Column attribute) Spaceman (class in dissect.apfs.objects) (class in dissect.apfs.objects.spaceman) SpacemanBitmap (class in dissect.apfs.objects) (class in dissect.apfs.objects.spaceman_bitmap) SpacemanChunkInfoAddressBlock (class in dissect.apfs.objects) (class in dissect.apfs.objects.spaceman_cab) SpacemanChunkInfoBlock (class in dissect.apfs.objects) (class in dissect.apfs.objects.spaceman_cib) span_stats (dissect.target.plugins.os.windows.regf.cit.BaseUseData attribute) SPARSE (in module dissect.hypervisor.disk.c_vdi) SPARSE_BYTES (in module dissect.evidence.asdf.asdf) SparseDisk (class in dissect.hypervisor.disk.vmdk) SparseExtentHeader (class in dissect.hypervisor.disk.vmdk) SPEC (acquire.acquire.acquire.ActiveDirectory attribute) (acquire.acquire.acquire.ActivitiesCache attribute) (acquire.acquire.acquire.Appcompat attribute) (acquire.acquire.acquire.Applications attribute) (acquire.acquire.acquire.AV attribute) (acquire.acquire.acquire.BITS attribute) (acquire.acquire.acquire.Boot attribute) (acquire.acquire.acquire.BSD attribute) (acquire.acquire.acquire.DNS attribute) (acquire.acquire.acquire.Docker attribute) (acquire.acquire.acquire.DPAPI attribute) (acquire.acquire.acquire.Drivers attribute) (acquire.acquire.acquire.EDR attribute) (acquire.acquire.acquire.ESXi attribute) (acquire.acquire.acquire.Etc attribute) (acquire.acquire.acquire.ETL attribute) (acquire.acquire.acquire.History attribute) (acquire.acquire.acquire.Home attribute) (acquire.acquire.acquire.MacOS attribute) (acquire.acquire.acquire.MacOSApplicationsInfo attribute) (acquire.acquire.acquire.Misc attribute) (acquire.acquire.acquire.Module attribute) (acquire.acquire.acquire.MSSQL attribute) (acquire.acquire.acquire.Netstat attribute) (acquire.acquire.acquire.Network attribute) (acquire.acquire.acquire.NTDS attribute) (acquire.acquire.acquire.PCA attribute) (acquire.acquire.acquire.PowerShell attribute) (acquire.acquire.acquire.Prefetch attribute) (acquire.acquire.acquire.QuarantinedFiles attribute) (acquire.acquire.acquire.Recents attribute) (acquire.acquire.acquire.Registry attribute) (acquire.acquire.acquire.RemoteAccess attribute) (acquire.acquire.acquire.SSH attribute) (acquire.acquire.acquire.Startup attribute) (acquire.acquire.acquire.Syscache attribute) (acquire.acquire.acquire.Tasks attribute) (acquire.acquire.acquire.TextEditor attribute) (acquire.acquire.acquire.ThumbnailCache attribute) (acquire.acquire.acquire.Var attribute) (acquire.acquire.acquire.WBEM attribute) (acquire.acquire.acquire.WebHosting attribute) (acquire.acquire.acquire.WinDnsClientCache attribute) (acquire.acquire.acquire.WindowsNotifications attribute) (acquire.acquire.acquire.WinMemFiles attribute) (acquire.acquire.acquire.WinProcEnv attribute) (acquire.acquire.acquire.WinProcesses attribute) SpecData (class in dissect.target.helpers.nfs.nfs3) specdata1 (dissect.target.helpers.nfs.nfs3.SpecData attribute) specdata2 (dissect.target.helpers.nfs.nfs3.SpecData attribute) SpecDataSerializer (class in dissect.target.helpers.nfs.serializer) SPECIAL_FOLDER_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) SplashtopPlugin (class in dissect.target.plugins.apps.remoteaccess.splashtop) split() (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.polypath) split_column_def() (in module dissect.database.sqlite3.util) split_into_records() (in module dissect.target.plugins.os.unix.linux.debian.apt) split_package_names() (in module dissect.target.plugins.os.unix.linux.debian.apt) split_sql_list() (in module dissect.database.sqlite3.util) SplitContainer (class in dissect.target.containers.split) splitdrive (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.polypath) splitext (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.polypath) SplitIoGuid (in module dissect.etl.utils) splitroot() (in module dissect.target.helpers.fsutil) (in module dissect.target.helpers.polypath) SplitWriter (class in flow.record.adapter.split) SplunkReader (class in flow.record.adapter.splunk) SplunkWriter (class in flow.record.adapter.splunk) SPRITE_RPC (dissect.target.helpers.network.IANAProtocol attribute) SPS (dissect.target.helpers.network.IANAProtocol attribute) sql (dissect.database.sqlite3.sqlite3.Index attribute) (dissect.database.sqlite3.sqlite3.Table attribute) (dissect.database.sqlite3.Table attribute) sqlite (dissect.database.sqlite3.sqlite3.Index attribute) (dissect.database.sqlite3.sqlite3.Page attribute) (dissect.database.sqlite3.sqlite3.Table attribute) (dissect.database.sqlite3.Table attribute) SQLite3 (class in dissect.database) (class in dissect.database.sqlite3) (class in dissect.database.sqlite3.sqlite3) sqlite3_def (in module dissect.database.sqlite3.c_sqlite3) SQLITE3_HEADER_MAGIC (in module dissect.database.sqlite3.sqlite3) SQLITE_FIELD_MAP (in module flow.record.adapter.sqlite) SqliteReader (class in flow.record.adapter.sqlite) SqliteWriter (class in flow.record.adapter.sqlite) SquashFS (class in dissect.squashfs) (class in dissect.squashfs.squashfs) squashfs (dissect.target.filesystems.squashfs.SquashFSFilesystem attribute) squashfs_def (in module dissect.squashfs.c_squashfs) SquashFSFilesystem (class in dissect.target.filesystems.squashfs) SquashFSFilesystemEntry (class in dissect.target.filesystems.squashfs) src_index (dissect.target.tools.diff.DifferentialCli attribute) src_target (dissect.target.tools.diff.DifferentialCli property) (dissect.target.tools.diff.TargetComparison attribute) src_target_entry (dissect.target.tools.diff.DifferentialEntry attribute) SRP (dissect.target.helpers.network.IANAProtocol attribute) (dissect.target.plugins.os.windows.network.IfTypes attribute) SRU (class in dissect.database.ese.tools.sru) sru (dissect.database.ese.tools.sru.Entry attribute) SRUPlugin (class in dissect.target.plugins.os.windows.sru) SRURecord (in module dissect.target.plugins.os.windows.sru) SS7_SIGLINK (dissect.target.plugins.os.windows.network.IfTypes attribute) SS_LEFT (in module acquire.acquire.gui.win32) SSCOPMCE (dissect.target.helpers.network.IANAProtocol attribute) SSH (class in acquire.acquire.acquire) ssh_directory_globs() (dissect.target.plugins.apps.ssh.openssh.OpenSSHPlugin method) SSHD_BOOLEAN_FIELDS (in module dissect.target.plugins.apps.ssh.opensshd) SSHD_BOOLEAN_VALUES (in module dissect.target.plugins.apps.ssh.opensshd) sshd_config_path (dissect.target.plugins.apps.ssh.opensshd.SSHServerPlugin attribute) SSHD_DIRECTORIES (dissect.target.plugins.apps.ssh.openssh.OpenSSHPlugin attribute) sshd_directory (dissect.target.plugins.apps.ssh.openssh.OpenSSHPlugin attribute) (dissect.target.plugins.apps.ssh.opensshd.SSHServerPlugin attribute) SSHD_INTEGER_FIELDS (in module dissect.target.plugins.apps.ssh.opensshd) SSHD_MULTIPLE_DEFINITIONS_ALLOWED_FIELDS (in module dissect.target.plugins.apps.ssh.opensshd) SshdService (class in dissect.target.plugins.os.unix.log.auth) SSHPlugin (class in dissect.target.plugins.apps.ssh.ssh) SSHPrivateKey (class in dissect.target.plugins.apps.ssh.ssh) SSHServerPlugin (class in dissect.target.plugins.apps.ssh.opensshd) ST (dissect.target.helpers.network.IANAProtocol attribute) st_atime (dissect.target.helpers.fsutil.stat_result attribute) st_atime_ns (dissect.target.helpers.fsutil.stat_result attribute) st_birthtime (dissect.target.helpers.fsutil.stat_result attribute) st_birthtime_ns (dissect.target.helpers.fsutil.stat_result attribute) st_blksize (dissect.target.helpers.fsutil.stat_result attribute) st_blocks (dissect.target.helpers.fsutil.stat_result attribute) st_ctime (dissect.target.helpers.fsutil.stat_result attribute) st_ctime_ns (dissect.target.helpers.fsutil.stat_result attribute) st_dev (dissect.target.helpers.fsutil.stat_result attribute) st_file_attributes (dissect.target.helpers.fsutil.stat_result attribute) st_flags (dissect.target.helpers.fsutil.stat_result attribute) st_fstype (dissect.target.helpers.fsutil.stat_result attribute) st_gen (dissect.target.helpers.fsutil.stat_result attribute) st_gid (dissect.target.helpers.fsutil.stat_result attribute) st_ino (dissect.target.helpers.fsutil.stat_result attribute) st_mode (dissect.target.helpers.fsutil.stat_result attribute) st_mtime (dissect.target.helpers.fsutil.stat_result attribute) st_mtime_ns (dissect.target.helpers.fsutil.stat_result attribute) st_nlink (dissect.target.helpers.fsutil.stat_result attribute) st_rdev (dissect.target.helpers.fsutil.stat_result attribute) st_reparse_tag (dissect.target.helpers.fsutil.stat_result attribute) st_size (dissect.target.helpers.fsutil.stat_result attribute) st_uid (dissect.target.helpers.fsutil.stat_result attribute) STABLE (in module dissect.regf.regf) stack (dissect.cstruct.Expression attribute) (dissect.cstruct.expression.Expression attribute) STACK_TRACE32 (dissect.etl.headers.event.ExtType attribute) STACK_TRACE64 (dissect.etl.headers.event.ExtType attribute) STACKTOSTACK (dissect.target.plugins.os.windows.network.IfTypes attribute) stacktrace (dissect.target.plugin.FailureDescriptor attribute) StackWalkGuid (in module dissect.etl.utils) stamp (dissect.target.helpers.sunrpc.sunrpc.AuthUnix attribute) standard_bias (dissect.target.plugins.os.windows.datetime.TimezoneInformation attribute) standard_date (dissect.target.plugins.os.windows.datetime.TimezoneInformation attribute) standard_header_fields() (dissect.etl.headers.headers.Header method) STANDARD_INFORMATION (dissect.target.plugins.filesystem.ntfs.utils.InformationType attribute) STANDARD_RIGHTS_ALL (in module acquire.acquire.dynamic.windows.ntdll) StandardInformation (class in dissect.ntfs.attr) STARLAN (dissect.target.plugins.os.windows.network.IfTypes attribute) start (dissect.etl.ETL attribute) (dissect.etl.etl.ETL attribute) (dissect.hypervisor.disk.hdd.Storage attribute) (dissect.ole.ole.DirectoryEntry attribute) start() (dissect.target.loaders.mqtt.MqttDiagnosticLine method) (flow.record.tools.rdump.ProgressMonitor method) start_block (dissect.squashfs.FileStream attribute) (dissect.squashfs.squashfs.FileStream attribute) start_button (acquire.acquire.gui.win32.Win32 attribute) start_extent (dissect.volume.lvm.metadata.Segment attribute) start_in (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) start_offset (dissect.eventlog.Evt attribute) (dissect.eventlog.evt.Evt attribute) start_sector (dissect.hypervisor.disk.vmdk.ExtentDescriptor attribute) start_time (dissect.etl.ETL attribute) (dissect.etl.etl.ETL attribute) (dissect.etl.headers.logfile.LogfileHeader property) (dissect.target.tools.dump.DumpState attribute) start_update() (dissect.cstruct.types.structure.StructureMetaType method) start_when_available (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) starting_block (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) starttime (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) Startup (class in acquire.acquire.acquire) startup() (dissect.target.plugins.apps.productivity.msoffice.MSOffice method) startupinfo() (dissect.target.plugins.os.windows.startupinfo.StartupInfoPlugin method) StartupInfoPlugin (class in dissect.target.plugins.os.windows.startupinfo) StartupInfoRecord (in module dissect.target.plugins.os.windows.startupinfo) stat (dissect.target.helpers.sunrpc.sunrpc.AcceptedReply attribute) (dissect.target.helpers.sunrpc.sunrpc.RejectedReply attribute) stat() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.filesystem.LayerFilesystemEntry method) (dissect.target.filesystem.MappedFile method) (dissect.target.filesystem.RootFilesystemEntry method) (dissect.target.filesystem.VirtualDirectory method) (dissect.target.filesystem.VirtualFile method) (dissect.target.filesystem.VirtualSymlink method) (dissect.target.filesystems.ad1.AD1FilesystemEntry method) (dissect.target.filesystems.btrfs.BtrfsFilesystemEntry method) (dissect.target.filesystems.cb.CbFilesystemEntry method) (dissect.target.filesystems.config.ConfigurationEntry method) (dissect.target.filesystems.cramfs.CramfsFilesystemEntry method) (dissect.target.filesystems.dir.DirectoryFilesystemEntry method) (dissect.target.filesystems.exfat.ExfatFilesystemEntry method) (dissect.target.filesystems.extfs.ExtFilesystemEntry method) (dissect.target.filesystems.fat.FatFilesystemEntry method) (dissect.target.filesystems.ffs.FfsFilesystemEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemDirectoryEntry method) (dissect.target.filesystems.itunes.ITunesFilesystemEntry method) (dissect.target.filesystems.jffs.JffsFilesystemEntry method) (dissect.target.filesystems.nfs.NfsFilesystemEntry method) (dissect.target.filesystems.ntfs.NtfsFilesystemEntry method) (dissect.target.filesystems.qnxfs.QnxFilesystemEntry method) (dissect.target.filesystems.smb.SmbFilesystemEntry method) (dissect.target.filesystems.squashfs.SquashFSFilesystemEntry method) (dissect.target.filesystems.tar.TarFilesystemDirectoryEntry method) (dissect.target.filesystems.tar.TarFilesystemEntry method) (dissect.target.filesystems.vbk.VbkFilesystemEntry method) (dissect.target.filesystems.vmfs.VmfsFilesystemEntry method) (dissect.target.filesystems.xfs.XfsFilesystemEntry method) (dissect.target.filesystems.zip.ZipFilesystemEntry method) (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) (dissect.target.loaders.res.ResFile method) (dissect.target.plugins.os.unix.linux.proc.ProcProcess method) (in module dissect.target.tools.fs) stat_modestr() (in module dissect.target.tools.utils.fs) stat_result (class in dissect.target.helpers.fsutil) STAT_TEMPLATE (in module dissect.target.tools.utils.fs) state (dissect.apfs.cursor.Cursor property) (dissect.cim.classes.ClassInstanceProperty attribute) (dissect.cim.classes.PropertyDefaultValues attribute) (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) (dissect.vmfs.lvm.Volume attribute) (dissect.vmfs.Volume attribute) (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) (dissect.volume.ddf.ddf.PhysicalDiskRecord attribute) (dissect.volume.ddf.ddf.VirtualDiskRecord attribute) (dissect.volume.vinum.config.Plex attribute) (dissect.volume.vinum.config.SD attribute) (dissect.volume.vinum.config.Volume attribute) state_cls (dissect.cim.classes.PropertyStates attribute) STATE_FILE_NAME (in module dissect.target.tools.dump) state_offset (dissect.fve.bde.information.Information property) state_size (dissect.fve.bde.information.Information property) state_string (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) stats (dissect.target.plugins.os.windows.regf.cit.BaseUseData attribute) status (dissect.qnxfs.qnx4.INode4 property) (dissect.target.loaders.itunes.ITunesBackup attribute) (dissect.target.plugins.os.windows.log.schedlgu.SchedLgU attribute) (dissect.volume.lvm.metadata.LogicalVolume attribute) (dissect.volume.lvm.metadata.PhysicalVolume attribute) (dissect.volume.lvm.metadata.VolumeGroup attribute) status() (dissect.target.plugins.os.unix.linux.debian.dpkg.DpkgPlugin method) (in module dissect.evidence.tools.asdf.verify) STATUS_ACCESS_DENIED (acquire.acquire.dynamic.windows.ntdll.NtStatusCode attribute) STATUS_BUFFER_OVERFLOW (acquire.acquire.dynamic.windows.ntdll.NtStatusCode attribute) STATUS_EXIT (in module acquire.acquire.tools.decrypter) STATUS_FIELD_MAPPINGS (in module dissect.target.plugins.os.unix.linux.debian.dpkg) STATUS_FIELDS_TO_EXTRACT (in module dissect.target.plugins.os.unix.linux.debian.dpkg) STATUS_FILE_NAME (in module dissect.target.plugins.os.unix.linux.debian.dpkg) STATUS_FLAG_ALLOCATABLE (in module dissect.volume.lvm.c_lvm2) STATUS_FLAG_READ (in module dissect.volume.lvm.c_lvm2) STATUS_FLAG_RESIZEABLE (in module dissect.volume.lvm.c_lvm2) STATUS_FLAG_VISIBLE (in module dissect.volume.lvm.c_lvm2) STATUS_FLAG_WRITE (in module dissect.volume.lvm.c_lvm2) STATUS_INFO (in module acquire.acquire.tools.decrypter) STATUS_INFO_LENGTH_MISMATCH (acquire.acquire.dynamic.windows.ntdll.NtStatusCode attribute) STATUS_INVALID_HANDLE (acquire.acquire.dynamic.windows.ntdll.NtStatusCode attribute) STATUS_MAP (in module dissect.target.plugins.os.windows.wua_history) STATUS_MORE_ENTRIES (acquire.acquire.dynamic.windows.ntdll.NtStatusCode attribute) STATUS_NO_MORE_ENTRIES (acquire.acquire.dynamic.windows.ntdll.NtStatusCode attribute) STATUS_START (in module acquire.acquire.tools.decrypter) STATUS_SUCCESS (acquire.acquire.dynamic.windows.ntdll.NtStatusCode attribute) STATUS_UPDATE (in module acquire.acquire.tools.decrypter) STB (in module dissect.executable.elf.c_elf) std_name (dissect.target.plugins.os.windows.datetime.WindowsTimezone attribute) StgBlockDescriptor (class in dissect.archive.vbk) StgBlockDescriptorV7 (class in dissect.archive.vbk) STGTY (in module dissect.ole.c_ole) STILL_INFECTED (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) stop() (flow.record.tools.rdump.ProgressMonitor method) stop_going_on_batteries (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) STOPPED (dissect.target.plugins.apps.container.podman.ContainerState attribute) STOPPING (dissect.target.plugins.apps.container.podman.ContainerState attribute) Storage (class in dissect.hypervisor.disk.hdd) storage_data (dissect.hypervisor.disk.hdd.Descriptor attribute) storage_type (dissect.apfs.objects.base.Object property) (dissect.apfs.objects.Object property) StorageData (class in dissect.hypervisor.disk.hdd) storages (dissect.hypervisor.disk.hdd.StorageData attribute) StorageStream (class in dissect.hypervisor.disk.hdd) Store (class in dissect.cim.index) (class in dissect.cim.objects) (class in dissect.volume.vss) store (dissect.cim.index.Index attribute) (dissect.cim.index.IndexPage attribute) (dissect.cim.objects.DataPage attribute) (dissect.cim.objects.Objects attribute) (dissect.hypervisor.util.envelope.KeyStore attribute) (dissect.volume.vss.BlockList attribute) (dissect.volume.vss.RangeList attribute) (dissect.volume.vss.StoreBitmap attribute) (dissect.volume.vss.StoreStream attribute) STORE_BLOCK_SIZE (in module dissect.volume.vss) STORE_BLOCKLIST_ENTRY_SIZE (in module dissect.volume.vss) store_offset (dissect.volume.vss.BlockDescriptor attribute) STORE_RANGELIST_ENTRY_SIZE (in module dissect.volume.vss) store_volume_identifier (dissect.volume.vss.VSS property) StoreBitmap (class in dissect.volume.vss) stores (dissect.volume.vss.Catalog attribute) StoreStream (class in dissect.volume.vss) STP (dissect.target.helpers.network.IANAProtocol attribute) str_to_bool() (in module dissect.target.plugins.os.windows.tasks.xml) Stream (class in dissect.clfs.blf) stream (dissect.cstruct.BitBuffer attribute) (dissect.cstruct.bitbuffer.BitBuffer attribute) (dissect.eventlog.evtx.ElfChnk attribute) (dissect.target.containers.asif.AsifContainer attribute) (dissect.target.containers.hdd.HddContainer attribute) (dissect.target.containers.qcow2.QCow2Container attribute) (dissect.target.loaders.mqtt.MqttStream attribute) (dissect.target.loaders.remote.RemoteLoader attribute) (dissect.target.loaders.remote.RemoteStream attribute) STREAM (dissect.target.plugins.os.unix.linux.proc.Sockets.SocketStreamType attribute) stream (flow.record.adapter.stream.StreamReader attribute) (flow.record.adapter.stream.StreamWriter attribute) (flow.record.stream.PathTemplateWriter attribute) stream() (in module dissect.fve.tools.dd) (in module flow.record) (in module flow.record.base) STREAM_ATTRIBUTES (in module dissect.target.plugins.os.windows.defender.quarantine) STREAM_BUFFER_SIZE (in module dissect.util.stream) STREAM_ENTRY (in module dissect.fat.c_exfat) STREAM_FORMATTER (in module acquire.acquire.log) STREAM_ID (in module dissect.target.plugins.os.windows.defender.quarantine) stream_type_string (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) streaming_bulk_thread() (flow.record.adapter.elastic.ElasticWriter method) StreamReader (class in flow.record.adapter.stream) streams (dissect.archive.wim.DirectoryEntry attribute) (dissect.clfs.blf.BaseRecord attribute) (dissect.executable.pe.directory.com_descriptor.ComMetadata property) (dissect.hypervisor.disk.hdd.StorageStream attribute) streams() (dissect.evidence.asdf.asdf.AsdfSnapshot method) (dissect.evidence.asdf.AsdfSnapshot method) (dissect.evidence.AsdfSnapshot method) StreamWriter (class in flow.record.adapter.stream) StrEnum (class in acquire.acquire.utils) (class in dissect.target.helpers.utils) stretch() (in module dissect.fve.bde.key) stretch_key() (dissect.fve.bde.information.VmkInfoDatum method) stretch_keys() (dissect.fve.bde.information.VmkInfoDatum method) StretchKeyDatum (class in dissect.fve.bde.information) strictly_positive() (in module dissect.target.loaders.mqtt) string (class in flow.record.fieldtypes) STRING (dissect.database.sqlite3.Column attribute) (dissect.database.sqlite3.sqlite3.Column attribute) (dissect.eventlog.bxml.BxmlType attribute) string (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) string() (dissect.cim.index.IndexPage method) string_data (dissect.shellitem.lnk.lnk.LnkStringData attribute) string_table() (dissect.executable.pe.directory.resource.ResourceDirectory method) (dissect.executable.pe.directory.ResourceDirectory method) stringdata (dissect.shellitem.lnk.Lnk attribute) (dissect.shellitem.lnk.lnk.Lnk attribute) stringlist (class in flow.record.fieldtypes) Strings (dissect.eventlog.evt.Record attribute) StringSerializer (class in dissect.target.helpers.sunrpc.serializer) StringTable (class in dissect.executable.elf) (class in dissect.executable.elf.elf) strip_log() (in module dissect.target.plugins.apps.container.docker) strip_namespace() (dissect.target.plugins.os.windows.tasks.xml.ScheduledTasks method) (dissect.target.plugins.os.windows.tasks.xml.XmlTask method) STRIP_RE (in module dissect.target.helpers.utils) strip_size (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) Stripe (class in dissect.btrfs.stream) stripe_count (dissect.volume.lvm.metadata.RAIDSegment attribute) (dissect.volume.lvm.metadata.StripedSegment attribute) stripe_length (dissect.btrfs.stream.Chunk attribute) stripe_size (dissect.btrfs.Btrfs attribute) (dissect.btrfs.btrfs.Btrfs attribute) (dissect.volume.lvm.metadata.RAIDSegment attribute) (dissect.volume.lvm.metadata.StripedSegment attribute) (dissect.volume.raid.raid.VirtualDisk attribute) STRIPED (dissect.volume.vinum.config.PlexOrg attribute) StripedSegment (class in dissect.volume.lvm.metadata) stripes (dissect.btrfs.stream.Chunk attribute) (dissect.fve.luks.metadata.KeyslotAf attribute) (dissect.volume.lvm.metadata.StripedSegment attribute) stripesize (dissect.volume.vinum.config.Plex attribute) strong (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) STRUCT (dissect.target.plugins.os.windows.regf.shellbags.CDBURN attribute) (dissect.target.plugins.os.windows.regf.shellbags.COMPRESSED_FOLDER attribute) (dissect.target.plugins.os.windows.regf.shellbags.CONTROL_PANEL attribute) (dissect.target.plugins.os.windows.regf.shellbags.CONTROL_PANEL_CATEGORY attribute) (dissect.target.plugins.os.windows.regf.shellbags.CONTROL_PANEL_CPL_FILE attribute) (dissect.target.plugins.os.windows.regf.shellbags.DELEGATE attribute) (dissect.target.plugins.os.windows.regf.shellbags.FILE_ENTRY attribute) (dissect.target.plugins.os.windows.regf.shellbags.GAME_FOLDER attribute) (dissect.target.plugins.os.windows.regf.shellbags.MTP_FILE_ENTRY attribute) (dissect.target.plugins.os.windows.regf.shellbags.MTP_VOLUME attribute) (dissect.target.plugins.os.windows.regf.shellbags.NETWORK attribute) (dissect.target.plugins.os.windows.regf.shellbags.ROOT_FOLDER attribute) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM attribute) (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN0 attribute) (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN1 attribute) (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN_0x74 attribute) (dissect.target.plugins.os.windows.regf.shellbags.URI attribute) (dissect.target.plugins.os.windows.regf.shellbags.USERS_PROPERTY_VIEW attribute) (dissect.target.plugins.os.windows.regf.shellbags.VOLUME attribute) STRUCT_FMT (in module dissect.etl.manifest) Structure (class in dissect.cstruct) (class in dissect.cstruct.types) (class in dissect.cstruct.types.structure) StructureMetaType (class in dissect.cstruct.types.structure) StructureValuesProxy (class in dissect.cstruct.types.structure) STT (in module dissect.executable.elf.c_elf) Stub (class in acquire.acquire.gui.base) STV (in module dissect.executable.elf.c_elf) sub_block_size (dissect.vmfs.VMFS attribute) (dissect.vmfs.vmfs.VMFS attribute) sub_id (dissect.eventlog.bxml.BxmlSub attribute) sub_stripes (dissect.btrfs.stream.Chunk attribute) SubBlockAddr (class in dissect.vmfs.address) SubBlockAddr64 (class in dissect.vmfs.address) SubBlockResourceVMFS5 (class in dissect.vmfs.resource) SubBlockResourceVMFS6 (class in dissect.vmfs.resource) subcluster_bits (dissect.hypervisor.disk.qcow2.QCow2 attribute) subcluster_size (dissect.hypervisor.disk.qcow2.QCow2 attribute) subclusters_per_cluster (dissect.hypervisor.disk.qcow2.QCow2 attribute) SubFolderItem (class in dissect.archive.vbk) subfs (dissect.target.filesystems.btrfs.BtrfsFilesystem attribute) subitem (dissect.target.plugins.os.windows.regf.shellbags.UNKNOWN_0x74 attribute) subkey() (dissect.regf.regf.FastLeaf method) (dissect.regf.regf.HashLeaf method) (dissect.regf.regf.IndexLeaf method) (dissect.regf.regf.IndexRoot method) (dissect.regf.regf.KeyIndex method) (dissect.regf.regf.KeyNode method) (dissect.target.helpers.regutil.KeyCollection method) (dissect.target.helpers.regutil.RegfKey method) (dissect.target.helpers.regutil.RegistryKey method) (dissect.target.helpers.regutil.VirtualKey method) (dissect.target.loaders.cb.CbRegistryKey method) (dissect.target.loaders.smb.SmbRegistryKey method) (dissect.target.plugins.os.windows.registry.RegistryPlugin method) subkeys() (dissect.regf.regf.KeyNode method) (dissect.target.helpers.regutil.KeyCollection method) (dissect.target.helpers.regutil.RegfKey method) (dissect.target.helpers.regutil.RegistryKey method) (dissect.target.helpers.regutil.VirtualKey method) (dissect.target.loaders.cb.CbRegistryKey method) (dissect.target.loaders.smb.SmbRegistryKey method) subloader (dissect.target.loaders.tar.TarLoader attribute) (dissect.target.loaders.zip.ZipLoader attribute) subnet (class in flow.record.fieldtypes.net.ipv4) Subnet (in module flow.record.fieldtypes.net.ipv4) SubnetList (class in flow.record.fieldtypes.net.ipv4) subnets (flow.record.fieldtypes.net.ipv4.SubnetList attribute) subs (dissect.eventlog.bxml.Template attribute) subscriber (flow.record.adapter.broker.BrokerReader attribute) SUBSCRIPT (dissect.database.ese.lcmapstring.CASE attribute) subscription (flow.record.adapter.broker.BrokerReader attribute) substitute_name (dissect.archive.wim.ReparsePoint property) (dissect.ntfs.attr.ReparsePoint property) substitute_token_and_add_to_template() (dissect.eventlog.bxml.Bxml method) SubStreamBase (class in dissect.evidence.asdf.streams) subtype (dissect.apfs.objects.base.Object property) (dissect.apfs.objects.Object property) Subvolume (class in dissect.btrfs) (class in dissect.btrfs.btrfs) subvolume (dissect.btrfs.btrfs.INode attribute) (dissect.btrfs.INode attribute) (dissect.target.filesystems.btrfs.BtrfsFilesystem attribute) subvolumes() (dissect.btrfs.Btrfs method) (dissect.btrfs.btrfs.Btrfs method) SUCCESS (acquire.acquire.collector.Outcome attribute) (dissect.target.helpers.sunrpc.sunrpc.AcceptStat attribute) SudoService (class in dissect.target.plugins.os.unix.log.auth) suffix_length (flow.record.adapter.split.SplitWriter attribute) suid_binaries() (dissect.target.plugins.filesystem.unix.suid.SuidPlugin method) SuidPlugin (class in dissect.target.plugins.filesystem.unix.suid) SuidRecord (in module dissect.target.plugins.filesystem.unix.suid) summary (dissect.database.bsd.tools.rpm.Package property) SUN_ND (dissect.target.helpers.network.IANAProtocol attribute) SUNDAY (in module dissect.target.plugins.os.windows.datetime) SundayFirstCalendar (in module dissect.target.plugins.os.windows.datetime) super_class_name (dissect.cim.classes.ClassDefinition property) supported (dissect.target.filesystems.nfs.AuthFlavorNotSupported attribute) SUPPORTED_TYPES (in module dissect.cstruct.compiler) suppress() (in module dissect.target.loaders.mqtt) SuSEPlugin (class in dissect.target.plugins.os.unix.linux.suse._os) SuService (class in dissect.target.plugins.os.unix.log.auth) SW_SHOWNORMAL (in module acquire.acquire.gui.win32) swap() (in module dissect.cstruct) (in module dissect.cstruct.utils) swap16() (in module dissect.cstruct) (in module dissect.cstruct.utils) swap32() (in module dissect.cstruct) (in module dissect.cstruct.utils) swap64() (in module dissect.cstruct) (in module dissect.cstruct.utils) SWIPE (dissect.target.helpers.network.IANAProtocol attribute) switching (dissect.fve.bde.BDE property) (dissect.fve.bde.bde.BDE property) SymantecPlugin (class in dissect.target.plugins.apps.av.symantec) Symbol (class in dissect.executable.elf) (class in dissect.executable.elf.elf) (class in dissect.util.compression.lzxpress_huffman) symbol (dissect.executable.elf.elf.Symbol attribute) (dissect.executable.elf.Symbol attribute) (dissect.util.compression.lzfse.DecoderEntry attribute) (dissect.util.compression.lzxpress_huffman.Node attribute) (dissect.util.compression.lzxpress_huffman.Symbol attribute) symbol() (dissect.etl.etl.Event method) SYMBOL_1 (dissect.database.ese.lcmapstring.SCRIPT attribute) SYMBOL_2 (dissect.database.ese.lcmapstring.SCRIPT attribute) SYMBOL_3 (dissect.database.ese.lcmapstring.SCRIPT attribute) SYMBOL_4 (dissect.database.ese.lcmapstring.SCRIPT attribute) SYMBOL_5 (dissect.database.ese.lcmapstring.SCRIPT attribute) SYMBOL_6 (dissect.database.ese.lcmapstring.SCRIPT attribute) symbol_table (dissect.clfs.blf.Context attribute) symbol_tables (dissect.executable.ELF attribute) (dissect.executable.elf.ELF attribute) (dissect.executable.elf.elf.ELF attribute) SYMBOLIC_LINK (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) SymbolTable (class in dissect.executable.elf) (class in dissect.executable.elf.elf) SYMLINK (acquire.acquire.collector.ArtifactType attribute) symlink() (dissect.target.filesystem.LayerFilesystem method) (dissect.target.filesystem.VirtualFilesystem method) SYMLINK_FLAG (in module dissect.archive.c_wim) symlink_to() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) SymlinkRecursionError SymlinkUnavailableException, [1] SYN_RECV (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) SYN_SENT (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) SYNCHRONIZE (acquire.acquire.dynamic.windows.types.ProcessAccess attribute) Sys (class in acquire.acquire.acquire) Syscache (class in acquire.acquire.acquire) syscache() (dissect.target.plugins.os.windows.syscache.SyscachePlugin method) SyscachePlugin (class in dissect.target.plugins.os.windows.syscache) SyscacheRecord (in module dissect.target.plugins.os.windows.syscache) syskey (dissect.target.plugins.os.windows.credential.lsa.LSAPlugin property) SyslogConfigParser (class in dissect.target.plugins.os.unix.linux.network) sysmodules() (dissect.target.plugins.os.unix.linux.modules.ModulePlugin method) SYSOBJ (in module dissect.database.ese.c_ese) system (dissect.cim.CIM attribute) (dissect.cim.cim.CIM attribute) SYSTEM (dissect.target.plugins.os.unix.bsd.darwin.ios._os.Config attribute) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin attribute) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin attribute) (dissect.target.plugins.os.windows.registry.RegistryPlugin attribute) SYSTEM_APPS (dissect.target.plugins.os.unix.applications.UnixApplicationsPlugin attribute) system_data (dissect.target.plugins.os.windows.regf.cit.CIT attribute) SYSTEM_DIRS (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin attribute) SYSTEM_GLOBS (dissect.target.plugins.apps.remoteaccess.teamviewer.TeamViewerPlugin attribute) SYSTEM_HANDLE_INFORMATION_EX (class in acquire.acquire.dynamic.windows.types) SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX (class in acquire.acquire.dynamic.windows.types) system_header (dissect.etl.headers.logfile.LogfileHeader attribute) system_id (dissect.volume.lvm.metadata.VolumeGroup attribute) system_identities() (dissect.target.plugins.os.windows.ual.UalPlugin method) SYSTEM_INFORMATION_CLASS (class in acquire.acquire.dynamic.windows.types) SYSTEM_KEY (dissect.target.plugins.os.windows.credential.lsa.LSAPlugin attribute) SYSTEM_NAMESPACE_NAME (in module dissect.cim.c_cim) SYSTEM_PATHS (dissect.target.plugins.apps.container.podman.PodmanPlugin attribute) (dissect.target.plugins.os.unix.applications.UnixApplicationsPlugin attribute) (dissect.target.plugins.os.windows.search.SearchIndexPlugin attribute) SYSTEM_SID (dissect.target.plugins.os.windows.dpapi.dpapi.DPAPIPlugin attribute) SystemD (class in dissect.target.helpers.configutil) systemd() (dissect.target.plugins.os.unix.linux.services.ServicesPlugin method) SYSTEMD_PATHS (dissect.target.plugins.os.unix.linux.services.ServicesPlugin attribute) SystemData (class in dissect.target.plugins.os.windows.regf.cit) SystemDataBitmaps (class in dissect.target.plugins.os.windows.regf.cit) SystemdLogindService (class in dissect.target.plugins.os.unix.log.auth) SystemdNetworkConfigParser (class in dissect.target.plugins.os.unix.linux.network) SystemdNetworkConfigParser.DhcpConfig (class in dissect.target.plugins.os.unix.linux.network) SystemExtendedHandleInformation (acquire.acquire.dynamic.windows.types.SYSTEM_INFORMATION_CLASS attribute) SystemHandleInformation (acquire.acquire.dynamic.windows.types.SYSTEM_INFORMATION_CLASS attribute) SystemHeader (class in dissect.etl.headers.system) SystemIdentityRecord (in module dissect.target.plugins.os.windows.ual) SYSTEMINFO (dissect.etl.headers.headers.EventProperty attribute) SystemSpecificHeader (class in dissect.etl.headers.system) SYSTEMTIME (dissect.eventlog.bxml.BxmlType attribute) SYSVOL_SUBST (in module acquire.acquire.utils) SYSVOL_UPPER_SUBST (in module acquire.acquire.utils) SZ (dissect.target.helpers.regutil.RegistryValueType attribute) T T (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) t (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) T (in module acquire.acquire.uploaders.plugin_registry) (in module dissect.archive.vbk) (in module dissect.cstruct.cstruct) (in module dissect.cstruct.types.base) (in module dissect.cstruct.types.packed) (in module dissect.cstruct.types.pointer) (in module dissect.executable.elf.elf) (in module dissect.target.helpers.utils) (in module dissect.target.loaders.local) (in module dissect.target.target) (in module dissect.volume.vinum.vinum) Table (class in dissect.database.ese) (class in dissect.database.ese.table) (class in dissect.database.sqlite3) (class in dissect.database.sqlite3.sqlite3) (class in dissect.executable.elf.elf) (class in dissect.hypervisor.disk.asif) table (dissect.archive.vbk.FibStream attribute) (dissect.database.ese.cursor.Cursor attribute) (dissect.database.ese.Index attribute) (dissect.database.ese.index.Index attribute) (dissect.database.ese.record.RecordData attribute) (dissect.database.ese.tools.sru.Entry attribute) (dissect.evidence.asdf.asdf.AsdfSnapshot attribute) (dissect.evidence.asdf.asdf.AsdfStream attribute) (dissect.evidence.asdf.AsdfSnapshot attribute) (dissect.evidence.asdf.AsdfStream attribute) (dissect.evidence.AsdfSnapshot attribute) (dissect.evidence.AsdfStream attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry attribute) (dissect.hypervisor.disk.asif.Directory attribute) (dissect.target.plugins.os.windows.search.TableRecord attribute) (in module dissect.database.ese.sorting_table) table() (dissect.database.ESE method) (dissect.database.ese.ESE method) (dissect.database.ese.ese.ESE method) (dissect.database.ese.table.Catalog method) (dissect.database.SQLite3 method) (dissect.database.sqlite3.SQLite3 method) (dissect.database.sqlite3.sqlite3.SQLite3 method) TABLE_FIELD (dissect.target.plugins.apps.av.mcafee.McAfeePlugin attribute) TABLE_LOG (dissect.target.plugins.apps.av.mcafee.McAfeePlugin attribute) table_name (dissect.database.sqlite3.sqlite3.Index attribute) (dissect.database.sqlite3.sqlite3.Table attribute) (dissect.database.sqlite3.Table attribute) table_names() (flow.record.adapter.sqlite.SqliteReader method) table_offsets (dissect.evidence.ewf.Segment attribute) TableRecord (class in dissect.target.plugins.os.windows.search) tables (dissect.database.ese.table.Catalog attribute) (dissect.evidence.ewf.Segment attribute) tables() (dissect.database.ESE method) (dissect.database.ese.ESE method) (dissect.database.ese.ese.ESE method) (dissect.database.ese.tools.certlog.CertLog method) (dissect.database.SQLite3 method) (dissect.database.sqlite3.SQLite3 method) (dissect.database.sqlite3.sqlite3.SQLite3 method) TableSection (class in dissect.evidence.ewf) Tag (class in dissect.database.ese.page) tag (dissect.archive.wim.ReparsePoint attribute) (dissect.database.ese.page.Node attribute) (dissect.database.ese.page.Tag attribute) (dissect.extfs.journal.DescriptorBlockTag attribute) (dissect.ntfs.attr.ReparsePoint property) (flow.record.adapter.splunk.SplunkWriter attribute) tag() (dissect.database.ese.Page method) (dissect.database.ese.page.Page method) tag_count (dissect.database.ese.Page attribute) (dissect.database.ese.page.Page attribute) TAG_FLAG (in module dissect.database.ese.c_ese) tag_header (dissect.ntfs.attr.ReparsePoint attribute) tag_map (dissect.database.bsd.tools.rpm.HeaderBlob attribute) TAG_MASKS (in module dissect.util.compression.lznt1) tag_reserved (dissect.database.ese.Page attribute) (dissect.database.ese.page.Page attribute) tag_size (dissect.volume.lvm.metadata.IntegritySegment attribute) TAG_TO_LCID (in module dissect.executable.pe.locale_id) TagField (class in dissect.database.ese.record) TAGFLD_HEADER (in module dissect.database.ese.c_ese) tags (dissect.volume.lvm.metadata.LogicalVolume attribute) (dissect.volume.lvm.metadata.PhysicalVolume attribute) (dissect.volume.lvm.metadata.Segment attribute) (dissect.volume.lvm.metadata.VolumeGroup attribute) tags() (dissect.database.ese.Page method) (dissect.database.ese.page.Page method) (dissect.extfs.journal.DescriptorBlock method) TaniumLoader (class in dissect.target.loaders.tanium) tar (dissect.archive.xva.XVA attribute) (dissect.evidence.asdf.asdf.Metadata attribute) (dissect.target.loaders.tar.TarLoader attribute) (dissect.target.loaders.tar.TarSubLoader attribute) TAR_COMPRESSION_METHODS (in module acquire.acquire.outputs.tar) TAR_EXT (in module dissect.target.loaders.tar) TAR_EXT_COMP (in module dissect.target.loaders.tar) TAR_MAGIC (in module dissect.target.loaders.tar) TAR_MAGIC_COMP (in module dissect.target.loaders.tar) TarFilesystem (class in dissect.target.filesystems.tar) (in module dissect.target.filesystem) TarFilesystemDirectoryEntry (class in dissect.target.filesystems.tar) TarFilesystemEntry (class in dissect.target.filesystems.tar) tarfs (dissect.target.loaders.containerimage.ContainerImageTarSubLoader attribute) target (acquire.acquire.collector.CollectionReport attribute) (acquire.acquire.collector.Collector attribute) Target (class in dissect.target) (class in dissect.target.target) target (dissect.target.filesystem.RootFilesystem attribute) (dissect.target.filesystem.VirtualSymlink attribute) (dissect.target.helpers.nfs.nfs3.ReadlinkResult attribute) (dissect.target.plugin.Plugin attribute) (dissect.target.plugins.apps.browser.iexplore.WebCache attribute) (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin attribute) (dissect.target.plugins.os.unix.linux.debian.vyos._os.VyosPlugin attribute) (dissect.target.plugins.os.unix.linux.network_managers.LinuxNetworkManager attribute) (dissect.target.plugins.os.unix.linux.network_managers.NetworkManager attribute) (dissect.target.plugins.os.unix.linux.network_managers.Parser attribute) (dissect.target.plugins.os.unix.linux.proc.ProcProcess attribute) (dissect.target.plugins.os.unix.linux.proc.Sockets attribute) (dissect.target.plugins.os.unix.log.auth.AuthLogRecordBuilder attribute) (dissect.target.plugins.os.unix.log.journal.JournalFile attribute) (dissect.target.plugins.os.windows.log.schedlgu.SchedLgUPlugin attribute) (dissect.target.target.Collection attribute) (dissect.target.tools.dump.RecordStreamElement attribute) (dissect.target.tools.shell.TargetCmd attribute) (dissect.target.tools.utils.report.TargetExecutionReport attribute) target_fields (dissect.target.helpers.record.ExtendableRecordDescriptor attribute) target_idlist (dissect.shellitem.lnk.Lnk attribute) (dissect.shellitem.lnk.lnk.Lnk attribute) (dissect.shellitem.lnk.lnk.LnkTargetIdList attribute) target_path (dissect.target.tools.dump.Sink attribute) target_paths (dissect.target.tools.dump.DumpState attribute) target_reports (dissect.target.tools.utils.report.ExecutionReport attribute) target_shell() (in module dissect.target.tools.shell) TargetCli (class in dissect.target.tools.shell) TargetCmd (class in dissect.target.tools.shell) TargetComparison (class in dissect.target.tools.diff) TargetError TargetExecutionReport (class in dissect.target.tools.utils.report) TargetHubCli (class in dissect.target.tools.shell) TargetLoader (class in dissect.target.loaders.target) TargetLogAdapter (class in dissect.target.helpers.logging) TargetPath (class in dissect.target.helpers.compat.path_310) (class in dissect.target.helpers.compat.path_311) (class in dissect.target.helpers.compat.path_312) (class in dissect.target.helpers.compat.path_313) TargetPathNotFoundError TargetRecordDescriptor (in module dissect.target.helpers.record) TargetRecordDescriptorExtension (class in dissect.target.helpers.descriptor_extensions) targets (dissect.target.tools.diff.DifferentialCli attribute) (dissect.target.tools.shell.TargetHubCli attribute) TarLoader (class in dissect.target.loaders.tar) TarOutput (class in acquire.acquire.outputs.tar) TarSubLoader (class in dissect.target.loaders.tar) TASK (class in dissect.eventlog.wevt_object) task (dissect.etl.headers.event.EventDescriptor attribute) task_element (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) task_name (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) task_path (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.ScheduledTasks attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) Tasks (class in acquire.acquire.acquire) tasks (dissect.target.plugins.os.windows.tasks.xml.ScheduledTasks attribute) TBHISTORY_COLUMN_MAP (in module dissect.target.plugins.os.windows.wua_history) tbz (dissect.vmfs.address.FileBlockAddr property) (dissect.vmfs.address.LargeFileBlockAddr property) (dissect.vmfs.address.SmallFileBlockAddr property) TCF (dissect.target.helpers.network.IANAProtocol attribute) TCP (dissect.target.helpers.network.IANAProtocol attribute) (dissect.target.helpers.sunrpc.sunrpc.Protocol attribute) (flow.record.adapter.splunk.Protocol attribute) tcp() (dissect.target.plugins.os.unix.linux.proc.Sockets method) (dissect.target.plugins.os.unix.linux.sockets.NetSocketPlugin method) tcp6() (dissect.target.plugins.os.unix.linux.proc.Sockets method) TCP_CLOSE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) TCP_INIT (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) TCP_KEEPCNT (dissect.target.helpers.sunrpc.client.Client attribute) TCP_KEEPIDLE (dissect.target.helpers.sunrpc.client.Client attribute) TCP_KEEPINTVL (dissect.target.helpers.sunrpc.client.Client attribute) TcpIpGuid (in module dissect.etl.utils) TDLC (dissect.target.plugins.os.windows.network.IfTypes attribute) TeamViewerPlugin (class in dissect.target.plugins.apps.remoteaccess.teamviewer) Tee (in module dissect.target.helpers.cache) telemetry() (dissect.target.plugins.os.windows.regf.cit.CITPlugin method) tell (dissect.hypervisor.disk.vmdk.RawDisk attribute) (dissect.target.containers.raw.RawContainer attribute) tell() (acquire.acquire.crypt.EncryptedStream method) (dissect.evidence.asdf.streams.SubStreamBase method) (dissect.target.container.Container method) (dissect.target.containers.asdf.AsdfContainer method) (dissect.target.containers.asif.AsifContainer method) (dissect.target.containers.ewf.EwfContainer method) (dissect.target.containers.fortifw.FortiFirmwareContainer method) (dissect.target.containers.hdd.HddContainer method) (dissect.target.containers.hds.HdsContainer method) (dissect.target.containers.qcow2.QCow2Container method) (dissect.target.containers.split.SplitContainer method) (dissect.target.containers.vdi.VdiContainer method) (dissect.target.containers.vhd.VhdContainer method) (dissect.target.containers.vhdx.VhdxContainer method) (dissect.target.containers.vmdk.VmdkContainer method) (dissect.target.volume.Volume method) (dissect.util.stream.AlignedStream method) TEMP (class in dissect.eventlog.wevt_object) temp (dissect.target.helpers.cache.CacheWriter attribute) TEMP_DESCRIPTOR (class in dissect.eventlog.wevt_object) Template (class in dissect.eventlog.bxml) (class in dissect.target.plugins.os.unix.linux.network_managers) template (dissect.eventlog.bxml.Bxml attribute) (dissect.eventlog.wevt_object.TEMP attribute) (dissect.target.plugins.os.unix.linux.network_managers.Parser attribute) TEMPLATE_ID_INFECTION (dissect.target.plugins.apps.av.mcafee.McAfeePlugin attribute) templates (dissect.eventlog.bxml.Bxml attribute) (dissect.eventlog.evtx.ElfChnk attribute) TEMPLATES (in module dissect.target.plugins.os.unix.linux.network_managers) TerminalServerMRURecord (in module dissect.target.plugins.os.windows.regf.mru) TERMPAD (dissect.target.plugins.os.windows.network.IfTypes attribute) test (dissect.volume.vss.StoreBitmap attribute) text (dissect.fve.bde.information.UnicodeDatum property) TextEditor (class in acquire.acquire.acquire) textPgs (dissect.hypervisor.util.vmtar.VisorTarInfo attribute) TextWriter (class in flow.record.adapter.text) thin_pool (dissect.volume.lvm.metadata.ThinSegment attribute) ThinDevice (class in dissect.volume.dm.thin) ThinPool (class in dissect.volume.dm.thin) ThinPoolSegment (class in dissect.volume.lvm.metadata) ThinSegment (class in dissect.volume.lvm.metadata) THREAD (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) thread (acquire.acquire.gui.base.GUI attribute) (flow.record.adapter.elastic.ElasticWriter attribute) (flow.record.tools.rdump.ProgressMonitor attribute) thread_id (dissect.etl.headers.event.EventHeader property) (dissect.etl.headers.headers.EventInstanceGUIDHeader property) (dissect.etl.headers.headers.EventTraceHeader property) (dissect.etl.headers.headers.MessageTraceHeader property) (dissect.etl.headers.system.CompactSystemHeader property) (dissect.etl.headers.system.SystemHeader property) ThreadGuid (in module dissect.etl.utils) ThreadPoolGuid (in module dissect.etl.utils) threat_id (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntry attribute) Thumbcache (class in dissect.thumbcache) (class in dissect.thumbcache.thumbcache) thumbcache() (dissect.target.plugins.os.windows.thumbcache.ThumbcachePlugin method) thumbcache_def (in module dissect.thumbcache.c_thumbcache) ThumbcacheEntry (class in dissect.thumbcache) (class in dissect.thumbcache.thumbcache_file) ThumbcacheFile (class in dissect.thumbcache) (class in dissect.thumbcache.thumbcache_file) ThumbcachePlugin (class in dissect.target.plugins.os.windows.thumbcache) ThumbcacheRecord (in module dissect.target.plugins.os.windows.thumbcache) ThumbnailCache (class in acquire.acquire.acquire) ThumbnailIndex (class in dissect.thumbcache) (class in dissect.thumbcache.index) ThumbnailType (class in dissect.thumbcache.util) tile_to_bitmap() (in module dissect.target.plugins.os.windows.rdpcache) time (dissect.fve.luks.metadata.KeyslotKdf attribute) time_delta (dissect.etl.headers.headers.Header property) (dissect.etl.headers.headers.MessageTraceHeader property) time_format (dissect.target.plugins.os.windows.firewall.LogConfig attribute) TIME_WAIT (dissect.target.plugins.os.unix.linux.proc.Sockets.TCPStates attribute) TimeGenerated (dissect.eventlog.evt.Record attribute) timeline() (dissect.target.plugins.filesystem.ntfs.mft.MftPlugin method) timeout (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) timeout() (in module acquire.acquire.volatilestream) TIMER (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) timestamp (acquire.acquire.tools.decrypter.EncryptedFile property) (dissect.cim.classes.ClassDefinition property) TIMESTAMP (dissect.etl.headers.headers.EventProperty attribute) timestamp (dissect.etl.headers.headers.Header property) (dissect.evidence.asdf.asdf.AsdfSnapshot attribute) (dissect.evidence.asdf.AsdfSnapshot attribute) (dissect.evidence.AsdfSnapshot attribute) (dissect.executable.PE property) (dissect.executable.pe.directory.bound_import.BoundImportForwardReference property) (dissect.executable.pe.directory.bound_import.BoundImportModule property) (dissect.executable.pe.directory.debug.DebugEntry property) (dissect.executable.pe.directory.delay_import.DelayImportModule property) (dissect.executable.pe.directory.export.ExportDirectory property) (dissect.executable.pe.directory.ExportDirectory property) (dissect.executable.pe.directory.ImportModule property) (dissect.executable.pe.directory.imports.ImportModule property) (dissect.executable.pe.directory.load_config.LoadConfigDirectory property) (dissect.executable.pe.directory.LoadConfigDirectory property) (dissect.executable.pe.directory.resource.ResourceDirectoryEntry property) (dissect.executable.pe.directory.ResourceDirectoryEntry property) (dissect.executable.pe.PE property) (dissect.executable.pe.pe.PE property) (dissect.ntfs.usnjrnl.UsnRecord property) (dissect.ntfs.UsnRecord property) (dissect.regf.regf.KeyNode property) (dissect.target.helpers.regutil.KeyCollection property) (dissect.target.helpers.regutil.RegfKey property) (dissect.target.helpers.regutil.RegistryKey property) (dissect.target.helpers.regutil.VirtualKey property) (dissect.target.loaders.cb.CbRegistryKey property) (dissect.target.loaders.smb.SmbRegistryKey property) (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntry attribute) (dissect.volume.ddf.ddf.VirtualDiskConfigurationRecord attribute) (dissect.volume.vinum.config.Plex attribute) (dissect.volume.vinum.config.SD attribute) (dissect.volume.vinum.config.Volume attribute) timestamp_base (dissect.etl.headers.logfile.LogfileHeader attribute) timestamp_ns (dissect.ntfs.usnjrnl.UsnRecord property) (dissect.ntfs.UsnRecord property) timestamp_scale (dissect.etl.headers.logfile.LogfileHeader attribute) TimestampRecord (in module flow.record.base) timestamps (dissect.target.loaders.mqtt.MqttTransferRatePerSecond attribute) (dissect.target.loaders.res.File attribute) TimeTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) TimeWritten (dissect.eventlog.evt.Record attribute) timezone() (dissect.target.plugins.os.default.locale.LocalePlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios.locale.LocalePlugin method) (dissect.target.plugins.os.unix.linux.fortios.locale.FortiOSLocalePlugin method) (dissect.target.plugins.os.unix.locale.UnixLocalePlugin method) (dissect.target.plugins.os.windows.locale.WindowsLocalePlugin method) timezone_from_path() (in module dissect.target.plugins.os.unix.locale) TimezoneInformation (class in dissect.target.plugins.os.windows.datetime) tls (dissect.executable.PE property) (dissect.executable.pe.PE property) (dissect.executable.pe.pe.PE property) TlsDirectory (class in dissect.executable.pe.directory) (class in dissect.executable.pe.directory.tls) TLSP (dissect.target.helpers.network.IANAProtocol attribute) to_base64() (in module flow.record.utils) to_bytes() (in module flow.record.utils) to_list() (in module dissect.target.helpers.utils) to_native_str() (in module flow.record.utils) to_record() (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext method) (dissect.target.plugins.os.unix.linux.network.ProcConfigParser.ParserContext method) to_str() (in module flow.record.utils) to_unix() (in module dissect.util.ts) to_unix_ms() (in module dissect.util.ts) to_unix_ns() (in module dissect.util.ts) to_unix_us() (in module dissect.util.ts) to_utc() (dissect.target.plugins.os.default.datetime.DateTimePlugin method) TOC (class in dissect.cim.objects) toc (dissect.apfs.objects.btree_node.BTreeNode property) (dissect.apfs.objects.BTreeNode property) (dissect.cim.classes.ClassInstance attribute) (dissect.cim.objects.DataPage attribute) TOK (dissect.cstruct.parser.TokenParser attribute) TOKEN (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) Token (class in dissect.cstruct.parser) (class in dissect.eventlog.bxml) (class in dissect.fve.luks.metadata) token (dissect.cstruct.parser.Token attribute) (dissect.eventlog.bxml.Token attribute) TOKEN_ADJUST_PRIVILEGES (acquire.acquire.dynamic.windows.types.ProcessToken attribute) TOKEN_CONFIG_MAP (in module dissect.volume.vinum.config) TOKEN_MASK (dissect.eventlog.bxml.Token attribute) TOKEN_PRIVILEGES (class in acquire.acquire.dynamic.windows.types) TOKEN_QUERY (acquire.acquire.dynamic.windows.types.ProcessToken attribute) TokenCollection (class in dissect.cstruct.parser) TokenConsumer (class in dissect.cstruct.parser) tokenize() (dissect.cstruct.expression.ExpressionTokenizer method) (in module dissect.volume.vinum.config) TokenizeError TOKENIZER_EXPRESSION (dissect.database.sqlite3.Column attribute) (dissect.database.sqlite3.sqlite3.Column attribute) TokenParser (class in dissect.cstruct.parser) tokens (dissect.cstruct.Expression attribute) (dissect.cstruct.expression.Expression attribute) (dissect.cstruct.expression.ExpressionTokenizer attribute) (dissect.cstruct.parser.TokenCollection attribute) (dissect.cstruct.parser.TokenConsumer attribute) (dissect.fve.luks.metadata.Metadata attribute) Toml (class in dissect.target.helpers.configutil) TOP (acquire.acquire.acquire.ExecutionOrder attribute) top (dissect.target.filesystem.VirtualDirectory attribute) (dissect.target.helpers.regutil.VirtualKey attribute) (dissect.util.plist.NSKeyedArchiver attribute) top_guid (dissect.hypervisor.disk.hdd.Snapshots attribute) topo (dissect.target.loaders.mqtt.Broker attribute) topo() (dissect.target.loaders.mqtt.MqttConnection method) topology() (dissect.target.loaders.mqtt.Broker method) total_bits (dissect.util.compression.lzfse.ValueDecoderEntry attribute) total_entries (dissect.thumbcache.index.ThumbnailIndex property) (dissect.thumbcache.ThumbnailIndex property) total_peers (dissect.target.loaders.mqtt.MqttDiagnosticLine attribute) total_sectors (dissect.fat.fat.FATFS attribute) (dissect.fat.FATFS attribute) total_size (dissect.target.loaders.mqtt.DiskMessage attribute) touch() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) TP_WORKER_FACTORY (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) tpm_encrypted_blob() (dissect.fve.bde.information.VmkInfoDatum method) TpmEncryptedBlobDatum (class in dissect.fve.bde.information) TPPP (dissect.target.helpers.network.IANAProtocol attribute) TR008 (dissect.target.plugins.os.windows.network.IfTypes attribute) tr_tm_when (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) trace() (dissect.target.helpers.logging.TargetLogAdapter method) (dissect.target.helpers.logging.TraceLogger method) trace_files (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin attribute) TRACE_LEVEL (in module dissect.target.helpers.logging) TraceLogger (class in dissect.target.helpers.logging) TRACKER_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) trailer_data (dissect.target.containers.fortifw.FortiFirmwareFile attribute) trailer_offset (dissect.target.containers.fortifw.FortiFirmwareFile attribute) transaction_id (dissect.volume.lvm.metadata.ThinPoolSegment attribute) (dissect.volume.lvm.metadata.ThinSegment attribute) transform_app_id() (in module dissect.target.plugins.os.windows.sru) transform_timestamp() (in module dissect.target.plugins.os.windows.sru) TRANSFORMS (in module dissect.target.plugins.os.windows.sru) translate() (dissect.target.plugins.os.unix.linux.network_managers.Parser method) translate_file_path() (in module dissect.target.loaders.itunes) translate_network_config() (dissect.target.plugins.os.unix.linux.network_managers.Parser method) translate_timezone() (in module dissect.target.plugins.os.unix.linux.fortios.locale) translate_tz() (in module dissect.target.plugins.os.windows.datetime) translated_path (dissect.target.loaders.itunes.FileInfo attribute) TRANSPHDLC (dissect.target.plugins.os.windows.network.IfTypes attribute) transport_agents() (dissect.target.plugins.os.windows.exchange.exchange.ExchangePlugin method) trash() (dissect.target.plugins.os.unix.trash.GnomeTrashPlugin method) trashes (dissect.target.plugins.os.unix.trash.GnomeTrashPlugin attribute) TrashRecord (in module dissect.target.plugins.os.unix.trash) tree (dissect.btrfs.btrfs.Subvolume property) (dissect.btrfs.Subvolume property) (dissect.executable.pe.directory.resource.ResourceDirectory attribute) (dissect.executable.pe.directory.ResourceDirectory attribute) tree_id (dissect.target.filesystems.smb.SmbStream attribute) TrendMicroPlugin (class in dissect.target.plugins.apps.av.trendmicro) TrendMicroWFFirewallRecord (in module dissect.target.plugins.apps.av.trendmicro) TrendMicroWFLogRecord (in module dissect.target.plugins.apps.av.trendmicro) trie_ip_line_re (dissect.target.plugins.os.unix.linux.network.ProcConfigParser attribute) TRIGRAM_SIZE_BYTES (dissect.target.plugins.os.unix.locate.plocate.PLocateFile attribute) TRUE (dissect.target.helpers.sunrpc.sunrpc.Bool attribute) truncate_records() (dissect.clfs.blf.BLF method) TruncateRecord (class in dissect.clfs.blf) TRUNK_1 (dissect.target.helpers.network.IANAProtocol attribute) TRUNK_2 (dissect.target.helpers.network.IANAProtocol attribute) trusteddocs() (dissect.target.plugins.os.windows.regf.trusteddocs.TrustedDocumentsPlugin method) TrustedDocumentsPlugin (class in dissect.target.plugins.os.windows.regf.trusteddocs) TrustedDocumentsRecord (in module dissect.target.plugins.os.windows.regf.trusteddocs) trustrecord_def (in module dissect.target.plugins.os.windows.regf.trusteddocs) try_decode_sz() (in module dissect.regf.regf) try_idna() (in module dissect.target.plugins.apps.browser.browser) ts (dissect.extfs.journal.CommitBlock attribute) (dissect.target.helpers.regutil.RegistryKey property) (dissect.target.plugins.os.unix.locate.mlocate.MLocate attribute) (dissect.target.plugins.os.unix.log.utmp.UtmpRecord attribute) (dissect.target.plugins.os.windows.log.schedlgu.SchedLgU attribute) ts() (dissect.etl.etl.Event method) ts1 (dissect.cim.classes.ClassInstance attribute) ts2 (dissect.cim.classes.ClassInstance attribute) TS_ID (dissect.etl.headers.event.ExtType attribute) ts_ns (dissect.target.plugins.os.unix.locate.mlocate.MLocate attribute) ts_to_ns() (in module dissect.ntfs.util) TTBL_WEVT_TYPE (class in dissect.eventlog.wevt) TUNNEL (dissect.target.plugins.os.windows.network.IfTypes attribute) TUNNEL_NAME_RE (dissect.target.plugins.apps.vpn.wireguard.WireGuardPlugin attribute) tx_cycle() (flow.record.adapter.duckdb.DuckdbWriter method) (flow.record.adapter.sqlite.SqliteWriter method) tx_queue (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) tx_rx_queue (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) Txt (class in dissect.target.helpers.configutil) TYPE (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) type (dissect.apfs.objects.base.Object property) (dissect.apfs.objects.fs.DirectoryEntry property) (dissect.apfs.objects.fs.INode property) (dissect.apfs.objects.keybag.Keybag property) (dissect.apfs.objects.Object property) (dissect.archive.vbk.DirItem property) (dissect.archive.vbk.FibBlockDescriptor property) (dissect.archive.vbk.FibMetaSparseTable attribute) (dissect.archive.vbk.MetaVector attribute) (dissect.btrfs.btrfs.INode property) (dissect.btrfs.INode property) (dissect.btrfs.stream.Chunk attribute) (dissect.cim.cim.Property property) (dissect.cim.classes.ClassDefinitionProperty attribute) (dissect.cim.classes.ClassInstanceProperty property) (dissect.cim.classes.QualifierReference attribute) (dissect.clfs.blf.Container attribute) (dissect.clfs.blf.Context attribute) (dissect.clfs.blf.Stream attribute) (dissect.cstruct.Field attribute) (dissect.cstruct.Pointer attribute) (dissect.cstruct.types.base.BaseArray attribute) (dissect.cstruct.types.BaseArray attribute) (dissect.cstruct.types.enum.EnumMetaType attribute) (dissect.cstruct.types.Field attribute) (dissect.cstruct.types.Pointer attribute) (dissect.cstruct.types.pointer.Pointer attribute) (dissect.cstruct.types.structure.Field attribute) (dissect.database.bsd.db.Page property) (dissect.database.ese.table.Column attribute) (dissect.database.sqlite3.sqlite3.Index attribute) (dissect.database.sqlite3.sqlite3.Table attribute) (dissect.database.sqlite3.Table attribute) (dissect.evidence.ewf.SectionDescriptor attribute) (dissect.executable.elf.elf.Section attribute) (dissect.executable.elf.elf.Segment attribute) (dissect.executable.elf.elf.Symbol attribute) (dissect.executable.elf.Section attribute) (dissect.executable.elf.Segment attribute) (dissect.executable.elf.Symbol attribute) (dissect.executable.pe.directory.basereloc.BaseRelocation attribute) (dissect.executable.pe.directory.debug.DebugEntry property) (dissect.executable.pe.directory.resource.Resource attribute) (dissect.executable.pe.directory.security.Certificate property) (dissect.ffs.ffs.INode property) (dissect.fve.bde.information.Datum property) (dissect.fve.luks.metadata.Digest attribute) (dissect.fve.luks.metadata.Keyslot attribute) (dissect.fve.luks.metadata.KeyslotAf attribute) (dissect.fve.luks.metadata.KeyslotArea attribute) (dissect.fve.luks.metadata.KeyslotKdf attribute) (dissect.fve.luks.metadata.Segment attribute) (dissect.fve.luks.metadata.SegmentIntegrity attribute) (dissect.fve.luks.metadata.Token attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.hypervisor.disk.hdd.Image attribute) (dissect.hypervisor.disk.vhdx.ParentLocator attribute) (dissect.hypervisor.disk.vmdk.ExtentDescriptor attribute) (dissect.hypervisor.util.envelope.EnvelopeAttribute attribute) (dissect.jffs.jffs2.DirEntry attribute) (dissect.jffs.jffs2.INode property) (dissect.ntfs.ACE property) (dissect.ntfs.attr.Attribute property) (dissect.ntfs.attr.AttributeHeader property) (dissect.ntfs.Attribute property) (dissect.ntfs.AttributeHeader property) (dissect.ntfs.secure.ACE property) (dissect.ole.ole.DirectoryEntry attribute) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx6.INode6 property) (dissect.regf.regf.KeyValue property) (dissect.squashfs.INode property) (dissect.squashfs.squashfs.INode property) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) (dissect.target.helpers.regutil.RegFlexValue property) (dissect.target.helpers.regutil.RegfValue property) (dissect.target.helpers.regutil.RegistryValue property) (dissect.target.helpers.regutil.ValueCollection property) (dissect.target.helpers.regutil.VirtualValue property) (dissect.target.loaders.cb.CbRegistryValue property) (dissect.target.loaders.cellebrite.Dump attribute) (dissect.target.loaders.cellebrite.Extraction attribute) (dissect.target.loaders.cellebrite.Keychain attribute) (dissect.target.loaders.smb.SmbRegistryValue property) (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) (dissect.target.plugins.os.unix.linux.proc.UnixSocket attribute) (dissect.target.plugins.os.windows.jumplist.JumpListFile property) (dissect.target.plugins.os.windows.regf.shellbags.SHITEM attribute) (dissect.target.volume.Volume attribute) (dissect.thumbcache.index.IndexEntry attribute) (dissect.thumbcache.index.ThumbnailIndex property) (dissect.thumbcache.IndexEntry attribute) (dissect.thumbcache.ThumbnailIndex property) (dissect.vmfs.address.Address property) (dissect.vmfs.descriptor.DirEntry attribute) (dissect.vmfs.descriptor.FileDescriptor property) (dissect.vmfs.DirEntry attribute) (dissect.vmfs.FileDescriptor property) (dissect.vmfs.resource.ResourceFile attribute) (dissect.volume.ddf.ddf.ControllerData attribute) (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) (dissect.volume.ddf.ddf.PhysicalDiskRecord attribute) (dissect.volume.ddf.ddf.VirtualDiskRecord attribute) (dissect.volume.disk.Partition attribute) (dissect.volume.disk.partition.Partition attribute) (dissect.volume.lvm.metadata.LogicalVolume property) (dissect.volume.lvm.metadata.Segment attribute) (flow.record.base.RecordField attribute) (flow.record.RecordField attribute) type_flags (dissect.apfs.objects.base.Object property) (dissect.apfs.objects.Object property) type_id (dissect.eventlog.bxml.BxmlTemplateDescriptor attribute) TYPE_MAP (in module dissect.squashfs.c_squashfs) (in module dissect.util.cpio) TYPE_MAX (dissect.etl.headers.event.ExtType attribute) type_name (acquire.acquire.dynamic.windows.named_objects.NamedObject attribute) (acquire.acquire.dynamic.windows.types.OBJECT_DIRECTORY_INFORMATION property) TYPE_PARSERS (in module dissect.database.bsd.tools.rpm) TYPE_POSIX (in module flow.record.fieldtypes) TYPE_READERS (in module dissect.eventlog.bxml) TYPE_SIZE_MAP (in module dissect.database.bsd.tools.rpm) type_str (dissect.volume.disk.Partition attribute) (dissect.volume.disk.partition.Partition attribute) TYPE_VARIATIONS (in module dissect.target.plugins.os.windows.regf.shimcache) TYPE_WINDOWS (in module flow.record.fieldtypes) typedefs (dissect.cstruct.cstruct attribute) (dissect.cstruct.cstruct.cstruct attribute) typedlist (class in flow.record.fieldtypes) TypeMatcher (class in flow.record.selector) TypeMatcherInstance (class in flow.record.selector) typename (flow.record.base.RecordField attribute) (flow.record.RecordField attribute) types (dissect.database.sqlite3.sqlite3.Cell property) TYPES (dissect.volume.disk.schemes.BSD attribute) (dissect.volume.disk.schemes.bsd.BSD attribute) (flow.record.packer.RecordPacker attribute) tz() (dissect.target.plugins.os.default.datetime.DateTimePlugin method) (dissect.target.plugins.os.windows.datetime.WindowsDateTimePlugin method) tz_def (in module dissect.target.plugins.os.windows.datetime) tzi (dissect.target.plugins.os.windows.datetime.WindowsTimezone attribute) tzinfo (dissect.target.filesystems.fat.FatFilesystem attribute) (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) tzinfo() (dissect.target.plugins.os.default.datetime.DateTimePlugin method) (dissect.target.plugins.os.unix.datetime.UnixDateTimePlugin method) (dissect.target.plugins.os.windows.datetime.WindowsDateTimePlugin method) tzname() (dissect.target.plugins.os.windows.datetime.WindowsTimezone method) U u16() (in module dissect.cstruct) (in module dissect.cstruct.utils) u32() (in module dissect.cstruct) (in module dissect.cstruct.utils) u64() (in module dissect.cstruct) (in module dissect.cstruct.utils) u8() (in module dissect.cstruct) (in module dissect.cstruct.utils) UAC_CHECK_FILE (in module dissect.target.loaders.uac) UacLoader (class in dissect.target.loaders.uac) UacTarSubloader (class in dissect.target.loaders.uac) UacZipSubLoader (class in dissect.target.loaders.uac) UAL (class in dissect.database.ese.tools.ual) UalPlugin (class in dissect.target.plugins.os.windows.ual) UalValue (in module dissect.database.ese.tools.ual) UDP (dissect.target.helpers.network.IANAProtocol attribute) (dissect.target.helpers.sunrpc.sunrpc.Protocol attribute) udp() (dissect.target.plugins.os.unix.linux.proc.Sockets method) (dissect.target.plugins.os.unix.linux.sockets.NetSocketPlugin method) udp6() (dissect.target.plugins.os.unix.linux.proc.Sockets method) UDP_DATA (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) UDP_LITE (dissect.target.helpers.network.IANAProtocol attribute) UdpIpGuid (in module dissect.etl.utils) Ufd (class in dissect.target.loaders.cellebrite) ufd (dissect.target.loaders.cellebrite.CellebriteLoader attribute) Ufdx (class in dissect.target.loaders.cellebrite) ufdx (dissect.target.loaders.cellebrite.CellebriteLoader attribute) ufstimestamp (in module dissect.util.ts) uid (dissect.apfs.objects.fs.INode property) (dissect.btrfs.btrfs.INode property) (dissect.btrfs.INode property) (dissect.cramfs.cramfs.INode property) (dissect.cramfs.INode property) (dissect.jffs.jffs2.INode property) (dissect.qnxfs.qnx4.INode4 property) (dissect.qnxfs.qnx6.INode6 property) (dissect.squashfs.INode property) (dissect.squashfs.squashfs.INode property) (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) (dissect.target.helpers.sunrpc.sunrpc.AuthUnix attribute) (dissect.target.plugins.os.unix.linux.proc.NetSocket attribute) (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) uint16 (class in flow.record.fieldtypes) UINT16 (dissect.eventlog.bxml.BxmlType attribute) uint32 (class in flow.record.fieldtypes) UINT32 (dissect.eventlog.bxml.BxmlType attribute) UInt32Serializer (class in dissect.target.helpers.sunrpc.serializer) UINT64 (dissect.eventlog.bxml.BxmlType attribute) UINT8 (dissect.eventlog.bxml.BxmlType attribute) ulDAEMagic (in module dissect.database.ese.c_ese) ULTRA (dissect.target.plugins.os.windows.network.IfTypes attribute) UmsEventGuid (in module dissect.etl.utils) UNALLOCATED (in module dissect.hypervisor.disk.c_vdi) UNALLOCATED_SUBCLUSTER_TYPES (in module dissect.hypervisor.disk.c_qcow2) unary_operators (dissect.cstruct.Expression attribute) (dissect.cstruct.expression.Expression attribute) unbiased_ordinal (dissect.executable.pe.directory.export.ExportFunction attribute) unbind() (acquire.acquire.collector.Collector method) unbox() (dissect.fve.bde.information.AesCcmEncryptedDatum method) unchanged (dissect.target.tools.diff.DirectoryDifferential attribute) UnexpectedResponse UNICODE_STRING (class in acquire.acquire.dynamic.windows.types) UnicodeDatum (class in dissect.fve.bde.information) unified_scheduling_engine (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) UnimplementedHeader (class in dissect.etl.headers.headers) Union (class in dissect.cstruct) (class in dissect.cstruct.types) (class in dissect.cstruct.types.structure) UnionMetaType (class in dissect.cstruct.types.structure) UnionProxy (class in dissect.cstruct.types.structure) unique_key() (in module dissect.target.plugins.os.windows.log.evtx) unique_process_id (acquire.acquire.dynamic.windows.types.Handle attribute) (acquire.acquire.dynamic.windows.types.SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX property) UNIX (dissect.target.plugin.OperatingSystem attribute) unix() (dissect.target.plugins.os.unix.linux.proc.Sockets method) (dissect.target.plugins.os.unix.linux.sockets.NetSocketPlugin method) UNIX_ACCESSORS (in module dissect.target.loaders.velociraptor) unix_file_mode (class in flow.record.fieldtypes) unix_now() (in module dissect.util.ts) unix_now_ms() (in module dissect.util.ts) unix_now_ns() (in module dissect.util.ts) unix_now_us() (in module dissect.util.ts) UnixApplicationRecord (in module dissect.target.plugins.os.unix.applications) UnixApplicationsPlugin (class in dissect.target.plugins.os.unix.applications) UnixConfigTreeCli (class in dissect.target.tools.shell) UnixConfigTreeRecord (in module dissect.target.plugins.os.unix.etc.etc) UnixDateTimePlugin (class in dissect.target.plugins.os.unix.datetime) UnixInterfaceRecord (in module dissect.target.helpers.record) UnixKeyboardRecord (in module dissect.target.plugins.os.unix.locale) UnixLocalePlugin (class in dissect.target.plugins.os.unix.locale) UnixPlugin (class in dissect.target.plugins.os.unix._os) UnixShadowRecord (in module dissect.target.plugins.os.unix.shadow) UnixSocket (class in dissect.target.plugins.os.unix.linux.proc) UnixSocketRecord (in module dissect.target.plugins.os.unix.linux.sockets) UnixUserRecord (in module dissect.target.helpers.record) UNKNOWN (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) (class in dissect.target.plugins.os.windows.regf.shellbags) (dissect.etl.headers.event.ExtType attribute) (dissect.target.plugins.apps.container.podman.ContainerState attribute) (dissect.target.plugins.os.windows.amcache.PcaGeneralDbType attribute) unknown (dissect.target.plugins.os.windows.regf.cit.SystemDataBitmaps attribute) UNKNOWN0 (class in dissect.target.plugins.os.windows.regf.shellbags) UNKNOWN1 (class in dissect.target.plugins.os.windows.regf.shellbags) UNKNOWN_0x74 (class in dissect.target.plugins.os.windows.regf.shellbags) UNKNOWN_BYTES (in module dissect.thumbcache.thumbcache_file) unknown_extensions (dissect.hypervisor.disk.qcow2.QCow2 attribute) unknown_extra (dissect.hypervisor.disk.qcow2.QCow2Snapshot attribute) unknown_fields (dissect.target.plugins.os.windows.defender.quarantine.QuarantineEntryResource attribute) UnknownSignatureException, [1] UnknownThumbnailTypeError unlink() (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) unload_address (dissect.executable.pe.directory.delay_import.DelayImportFunction attribute) unlock() (dissect.apfs.objects.FS method) (dissect.apfs.objects.fs.FS method) (dissect.fve.bde.BDE method) (dissect.fve.bde.bde.BDE method) (dissect.fve.luks.LUKS method) (dissect.fve.luks.luks.LUKS method) (dissect.hypervisor.descriptor.vmx.Pair method) (dissect.target.loaders.ab.AndroidBackup method) unlock_volume() (dissect.target.volumes.bde.BitlockerVolumeSystem method) (dissect.target.volumes.luks.LUKSVolumeSystem method) unlock_with_bek() (dissect.fve.bde.BDE method) (dissect.fve.bde.bde.BDE method) unlock_with_bek_file() (dissect.target.volumes.bde.BitlockerVolumeSystem method) unlock_with_clear_key() (dissect.fve.bde.BDE method) (dissect.fve.bde.bde.BDE method) unlock_with_fvek() (dissect.fve.bde.BDE method) (dissect.fve.bde.bde.BDE method) (dissect.target.volumes.bde.BitlockerVolumeSystem method) unlock_with_key_fh() (dissect.fve.luks.LUKS method) (dissect.fve.luks.luks.LUKS method) unlock_with_key_file() (dissect.fve.luks.LUKS method) (dissect.fve.luks.luks.LUKS method) (dissect.target.volumes.luks.LUKSVolumeSystem method) unlock_with_passcode_key() (dissect.target.loaders.itunes.KeyBag method) unlock_with_passphrase() (dissect.fve.bde.BDE method) (dissect.fve.bde.bde.BDE method) (dissect.fve.luks.LUKS method) (dissect.fve.luks.luks.LUKS method) (dissect.target.volumes.bde.BitlockerVolumeSystem method) (dissect.target.volumes.luks.LUKSVolumeSystem method) unlock_with_phrase() (dissect.hypervisor.descriptor.vmx.Pair method) (dissect.hypervisor.descriptor.vmx.VMX method) unlock_with_recovery_key() (dissect.target.volumes.bde.BitlockerVolumeSystem method) unlock_with_recovery_password() (dissect.fve.bde.BDE method) (dissect.fve.bde.bde.BDE method) unlock_with_volume_encryption_key() (dissect.target.volumes.luks.LUKSVolumeSystem method) unlocked (dissect.fve.bde.BDE property) (dissect.fve.bde.bde.BDE property) (dissect.fve.luks.LUKS property) (dissect.fve.luks.luks.LUKS property) (dissect.target.loaders.ab.AndroidBackup attribute) UNMAPPED_PAGE_VALUE (in module dissect.cim.c_cim) UnmappedPageError, [1] unmatched (flow.record.context.AppContext attribute) unmount_time (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) unpack() (flow.record.jsonpacker.JsonRecordPacker method) (flow.record.JsonRecordPacker method) (flow.record.packer.RecordPacker method) (in module dissect.cstruct) (in module dissect.cstruct.utils) unpack_obj() (flow.record.jsonpacker.JsonRecordPacker method) (flow.record.JsonRecordPacker method) (flow.record.packer.RecordPacker method) unpack_timestamps() (in module dissect.target.plugins.os.windows.regf.usb) unpackb (in module flow.record.packer) unseal_with_phrase() (dissect.hypervisor.descriptor.vmx.KeySafe method) UNSORTABLE (dissect.database.ese.lcmapstring.SCRIPT attribute) UnsupportedDataforkException, [1] UnsupportedPluginError UnsupportedVersion unwrap() (dissect.apfs.objects.keybag.KEK method) (dissect.apfs.objects.keybag.VEK method) (dissect.hypervisor.descriptor.vmx.Phrase method) (dissect.target.helpers.configutil.ListUnwrapper static method) (dissect.target.loaders.itunes.ClassKey method) (dissect.target.loaders.itunes.KeyBag method) unwrapped (dissect.target.loaders.itunes.ClassKey property) up (dissect.target.filesystem.VirtualDirectory attribute) UP (dissect.volume.vinum.config.PlexState attribute) (dissect.volume.vinum.config.SDState attribute) (dissect.volume.vinum.config.VolumeState attribute) upcase_table (dissect.fat.ExFAT attribute) (dissect.fat.exfat.ExFAT attribute) UPCASE_TABLE_ENTRY (in module dissect.fat.c_exfat) Update (dissect.target.plugins.os.unix.packagemanager.OperationTypes attribute) update() (dissect.evidence.tools.asdf.dd.Progress method) (dissect.target.helpers.configutil.ScopeManager method) (dissect.target.tools.dump.DumpState method) (in module dissect.util.hash.crc32) (in module dissect.util.hash.crc32c) update_descriptor_columns() (in module flow.record.adapter.sqlite) update_interval (flow.record.tools.rdump.ProgressMonitor attribute) update_prev() (dissect.target.helpers.configutil.ScopeManager method) update_progress_bar() (flow.record.tools.rdump.ProgressMonitor method) update_time (dissect.volume.md.md.MDPhysicalDisk attribute) (dissect.volume.md.MDPhysicalDisk attribute) UpdateDatum (class in dissect.fve.bde.information) UPF (class in dissect.target.loaders.res) upf (dissect.target.loaders.res.File attribute) (dissect.target.loaders.res.Folder attribute) upload_available (acquire.acquire.gui.base.GUI attribute) upload_file() (acquire.acquire.uploaders.minio.MinIO method) (acquire.acquire.uploaders.plugin.UploaderPlugin method) upload_files() (in module acquire.acquire.acquire) upload_files_using_uploader() (in module acquire.acquire.uploaders.plugin) upload_label (acquire.acquire.gui.win32.Win32 attribute) UploaderPlugin (class in acquire.acquire.uploaders.plugin) UploaderRegistry (in module acquire.acquire.uploaders.plugin_registry) UPPER (dissect.database.ese.lcmapstring.CASE attribute) upper() (in module flow.record.selector) UPR (class in dissect.target.loaders.res) uptime (dissect.target.plugins.os.unix.linux.proc.ProcProcess property) URI (class in dissect.target.plugins.os.windows.regf.shellbags) uri (class in flow.record.fieldtypes) (dissect.target.plugins.os.windows.regf.shellbags.URI attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) (flow.record.adapter.elastic.ElasticReader attribute) (flow.record.adapter.elastic.ElasticWriter attribute) usable_page_size (dissect.database.SQLite3 attribute) (dissect.database.sqlite3.SQLite3 attribute) (dissect.database.sqlite3.sqlite3.SQLite3 attribute) usage_counter (dissect.archive.vbk.StgBlockDescriptor property) USAGE_FORMAT_TMPL (in module dissect.target.tools.utils.cli) USB (dissect.target.plugins.os.windows.network.IfTypes attribute) usb() (dissect.target.plugins.os.windows.regf.usb.UsbPlugin method) USB_DEVICE_PROPERTY_KEYS (in module dissect.target.plugins.os.windows.regf.usb) USB_STOR (dissect.target.plugins.os.windows.regf.usb.UsbPlugin attribute) UsbPlugin (class in dissect.target.plugins.os.windows.regf.usb) UsbRegistryRecord (in module dissect.target.plugins.os.windows.regf.usb) use_compression (dissect.volume.lvm.metadata.VdoPoolSegment attribute) use_data (dissect.target.plugins.os.windows.regf.cit.Entry attribute) use_deduplication (dissect.volume.lvm.metadata.VdoPoolSegment attribute) use_default_value (dissect.cim.c_cim.ClassInstancePropertyState attribute) use_key() (dissect.fve.bde.information.VmkInfoDatum method) use_keys() (dissect.fve.bde.information.VmkInfoDatum method) use_metadata_hints (dissect.volume.lvm.metadata.VdoPoolSegment attribute) use_sparse_index (dissect.volume.lvm.metadata.VdoPoolSegment attribute) used (dissect.target.helpers.nfs.nfs3.FileAttributes attribute) used_by (dissect.target.plugins.os.unix.linux.modules.Module attribute) used_entries (dissect.thumbcache.index.ThumbnailIndex property) (dissect.thumbcache.ThumbnailIndex property) UseKeyDatum (class in dissect.fve.bde.information) user (dissect.database.bsd.tools.rpm.PackageEntry attribute) (dissect.target.plugins.general.users.UserDetails attribute) (dissect.target.plugins.os.unix.linux.proc.PacketSocket attribute) user() (dissect.target.plugins.os.windows.regf.clsid.CLSIDPlugin method) user32 (in module acquire.acquire.gui.win32) user_config_paths (dissect.target.plugins.apps.vpn.openvpn.OpenVPNPlugin attribute) USER_DIRS (dissect.target.plugins.apps.browser.firefox.FirefoxPlugin attribute) user_env() (dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin method) user_flags (dissect.ole.ole.DirectoryEntry attribute) USER_GLOBS (dissect.target.plugins.apps.remoteaccess.anydesk.AnydeskPlugin attribute) (dissect.target.plugins.apps.remoteaccess.rustdesk.RustdeskPlugin attribute) (dissect.target.plugins.apps.remoteaccess.teamviewer.TeamViewerPlugin attribute) user_id (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) user_key (dissect.target.plugins.os.windows.dpapi.master_key.CredSystem attribute) user_metadata (dissect.hypervisor.disk.asif.ASIF property) USER_MOUNTS (dissect.target.plugins.os.windows.regf.usb.UsbPlugin attribute) USER_PATH (dissect.target.plugins.os.unix.bsd.darwin.macos.user.UserPlugin attribute) USER_PATHS (dissect.target.plugins.apps.container.podman.PodmanPlugin attribute) (dissect.target.plugins.child.virtualbox.VirtualBoxChildTargetPlugin attribute) (dissect.target.plugins.os.unix.applications.UnixApplicationsPlugin attribute) (dissect.target.plugins.os.windows.search.SearchIndexPlugin attribute) user_sid (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry attribute) USER_VARIABLES (dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin attribute) userassist() (dissect.target.plugins.os.windows.regf.userassist.UserAssistPlugin method) userassist_def (in module dissect.target.plugins.os.windows.regf.userassist) UserAssistPlugin (class in dissect.target.plugins.os.windows.regf.userassist) UserAssistRecord (in module dissect.target.plugins.os.windows.regf.userassist) UserAssistRecordDescriptor (in module dissect.target.plugins.os.windows.regf.userassist) UserDetails (class in dissect.target.plugins.general.users) userdirs (dissect.target.plugins.apps.browser.chromium.ChromiumMixin attribute) username (class in flow.record.fieldtypes.credential) (dissect.target.loaders.mqtt.Broker attribute) (flow.record.fieldtypes.uri property) UserPlugin (class in dissect.target.plugins.os.unix.bsd.darwin.macos.user) UserRecord (in module dissect.target.plugins.general.users) UserRecordDescriptorExtension (class in dissect.target.helpers.descriptor_extensions) UserRegistryRecordDescriptor (in module dissect.target.plugins.os.windows.generic) (in module dissect.target.plugins.os.windows.regf.mru) users() (dissect.target.loaders.profile.ProfileOSPlugin method) (dissect.target.loaders.res.ResOSPlugin method) (dissect.target.plugin.OSPlugin method) (dissect.target.plugins.os.default._os.DefaultOSPlugin method) (dissect.target.plugins.os.unix._os.UnixPlugin method) (dissect.target.plugins.os.unix.bsd.citrix._os.CitrixPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin method) (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSPlugin method) (dissect.target.plugins.os.windows._os.WindowsPlugin method) users_dirs (dissect.target.plugins.apps.browser.iexplore.InternetExplorerPlugin attribute) users_files (dissect.target.plugins.os.unix.linux.recentlyused.RecentlyUsedPlugin attribute) USERS_PROPERTY_VIEW (class in dissect.target.plugins.os.windows.regf.shellbags) users_tabs (dissect.target.plugins.apps.editor.windowsnotepad.WindowsNotepadPlugin attribute) UserSid (dissect.eventlog.evt.Record attribute) UsersPlugin (class in dissect.target.plugins.general.users) uses_pbkdf2() (dissect.fve.bde.information.VmkInfoDatum method) USN_PAGE_SIZE (in module dissect.ntfs.c_ntfs) UsnJrnl (class in dissect.ntfs) (class in dissect.ntfs.usnjrnl) usnjrnl (dissect.ntfs.NTFS attribute) (dissect.ntfs.ntfs.NTFS attribute) (dissect.ntfs.usnjrnl.UsnRecord attribute) (dissect.ntfs.UsnRecord attribute) usnjrnl() (dissect.target.plugins.filesystem.ntfs.usnjrnl.UsnjrnlPlugin method) USNJRNL_PATHS (in module dissect.target.loaders.kape) UsnjrnlPlugin (class in dissect.target.plugins.filesystem.ntfs.usnjrnl) UsnjrnlRecord (in module dissect.target.plugins.filesystem.ntfs.usnjrnl) UsnRecord (class in dissect.ntfs) (class in dissect.ntfs.usnjrnl) ut_addr (dissect.target.plugins.os.unix.log.utmp.UtmpRecord attribute) ut_host (dissect.target.plugins.os.unix.log.utmp.UtmpRecord attribute) ut_id (dissect.target.plugins.os.unix.log.utmp.UtmpRecord attribute) ut_line (dissect.target.plugins.os.unix.log.utmp.UtmpRecord attribute) ut_pid (dissect.target.plugins.os.unix.log.utmp.UtmpRecord attribute) ut_type (dissect.target.plugins.os.unix.log.utmp.UtmpRecord attribute) ut_user (dissect.target.plugins.os.unix.log.utmp.UtmpRecord attribute) UTC (in module flow.record.fieldtypes) (in module flow.record.packer) utcoffset() (dissect.target.plugins.os.windows.datetime.WindowsTimezone method) UTI (dissect.target.helpers.network.IANAProtocol attribute) UtmLoader (class in dissect.target.loaders.utm) utmp_def (in module dissect.target.plugins.os.unix.log.utmp) UTMP_FIELDS (in module dissect.target.plugins.os.unix.log.utmp) utmp_paths (dissect.target.plugins.os.unix.log.utmp.UtmpPlugin attribute) UtmpFile (class in dissect.target.plugins.os.unix.log.utmp) UtmpPlugin (class in dissect.target.plugins.os.unix.log.utmp) UtmpRecord (class in dissect.target.plugins.os.unix.log.utmp) uuid (dissect.apfs.APFS property) (dissect.apfs.apfs.APFS property) (dissect.apfs.objects.FS property) (dissect.apfs.objects.fs.FS property) (dissect.apfs.objects.keybag.KEK property) (dissect.apfs.objects.keybag.VEK property) (dissect.apfs.objects.nx_superblock.NxSuperblock property) (dissect.apfs.objects.NxSuperblock property) (dissect.archive.vma.Extent attribute) (dissect.archive.vma.VMA attribute) (dissect.btrfs.Btrfs attribute) (dissect.btrfs.btrfs.Btrfs attribute) (dissect.btrfs.btrfs.Subvolume property) (dissect.btrfs.Subvolume property) (dissect.extfs.ExtFS attribute) (dissect.extfs.extfs.ExtFS attribute) (dissect.fve.luks.LUKS attribute) (dissect.fve.luks.luks.LUKS attribute) (dissect.target.loaders.itunes.ClassKey attribute) (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) (dissect.vmfs.Device attribute) (dissect.vmfs.lvm.Device attribute) (dissect.vmfs.lvm.Volume attribute) (dissect.vmfs.VMFS attribute) (dissect.vmfs.vmfs.VMFS attribute) (dissect.vmfs.Volume attribute) (dissect.volume.raid.raid.VirtualDisk attribute) (dissect.xfs.XFS attribute) (dissect.xfs.xfs.XFS attribute) uuid1timestamp() (in module dissect.util.ts) V V11 (dissect.target.plugins.os.windows.network.IfTypes attribute) V35 (dissect.target.plugins.os.windows.network.IfTypes attribute) V36 (dissect.target.plugins.os.windows.network.IfTypes attribute) V37 (dissect.target.plugins.os.windows.network.IfTypes attribute) va_to_rva() (dissect.executable.PE method) (dissect.executable.pe.PE method) (dissect.executable.pe.pe.PE method) val (flow.record.fieldtypes.net.ip.ipaddress attribute) (flow.record.fieldtypes.net.ip.ipinterface attribute) (flow.record.fieldtypes.net.ip.ipnetwork attribute) (flow.record.fieldtypes.net.ipaddress attribute) (flow.record.fieldtypes.net.ipinterface attribute) (flow.record.fieldtypes.net.ipnetwork attribute) (flow.record.fieldtypes.net.ipv4.address attribute) valid (dissect.clfs.blf.ControlRecord property) (dissect.database.sqlite3.sqlite3.WALFrame property) VALID_BPB_MEDIA (in module dissect.fat.c_fat) valid_max_banks (dissect.archive.vbk.SnapshotSlot attribute) valid_signatures (dissect.eventlog.wevt.WEVT_TYPE attribute) validate_bpb() (in module dissect.fat.fat) validate_header() (dissect.etl.headers.event.EventHeaderExtendedDataItem method) validate_ntstatus() (in module acquire.acquire.dynamic.windows.ntdll) validate_signature() (in module dissect.eventlog.wevt) Validation (class in dissect.fve.bde.information) validation (dissect.fve.bde.information.Information attribute) (dissect.fve.bde.information.Validation attribute) ValidationEntry (class in dissect.fve.bde.information) ValidationInfoDatum (class in dissect.fve.bde.information) value (dissect.apfs.objects.fs.DirectoryEntry attribute) (dissect.apfs.objects.fs.Snapshot attribute) (dissect.apfs.objects.fs.XAttr attribute) (dissect.cim.classes.ClassInstanceProperty property) (dissect.cim.classes.Qualifier attribute) (dissect.cim.classes.QualifierReference attribute) (dissect.cstruct.parser.Token attribute) (dissect.database.ese.util.ColumnType attribute) (dissect.eventlog.bxml.BxmlSub attribute) (dissect.executable.elf.elf.Symbol property) (dissect.executable.elf.Symbol property) (dissect.extfs.extfs.XAttr attribute) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.hypervisor.util.envelope.EnvelopeAttribute attribute) (dissect.regf.regf.KeyValue property) (dissect.target.helpers.keychain.Key attribute) (dissect.target.helpers.regutil.RegFlexValue property) (dissect.target.helpers.regutil.RegfValue property) (dissect.target.helpers.regutil.RegistryValue property) (dissect.target.helpers.regutil.ValueCollection property) (dissect.target.helpers.regutil.VirtualValue property) (dissect.target.loaders.cb.CbRegistryValue property) (dissect.target.loaders.smb.SmbRegistryValue property) (dissect.util.ldap.SearchFilter attribute) (dissect.vmfs.address.Address attribute) (flow.record.fieldtypes.boolean attribute) (flow.record.fieldtypes.uint16 attribute) (flow.record.fieldtypes.uint32 attribute) VALUE (in module dissect.regf.c_regf) value() (dissect.apfs.cursor.Cursor method) (dissect.database.bsd.tools.rpm.HeaderBlob method) (dissect.regf.regf.KeyNode method) (dissect.target.helpers.regutil.RegistryKey method) (dissect.target.loaders.mqtt.MqttTransferRatePerSecond method) (dissect.target.plugins.os.windows.registry.RegistryPlugin method) (dissect.volume.dm.btree.Node method) value_based_on_shndx() (dissect.executable.elf.elf.Symbol method) (dissect.executable.elf.Symbol method) value_bits (dissect.util.compression.lzfse.ValueDecoderEntry attribute) value_size (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry property) (dissect.volume.dm.btree.Node attribute) value_type (dissect.eventlog.bxml.BxmlTemplateDescriptor property) ValueCollection (class in dissect.target.helpers.regutil) ValueDecoderEntry (class in dissect.util.compression.lzfse) ValueList (class in dissect.regf.regf) values (dissect.database.sqlite3.sqlite3.Cell property) (dissect.target.helpers.regutil.ValueCollection attribute) VALUES (dissect.target.plugins.os.windows.productkey.WindowsProductKeyPlugin attribute) values() (dissect.hypervisor.descriptor.hyperv.HyperVFile method) (dissect.hypervisor.descriptor.hyperv.HyperVStorageKeyTableEntry method) (dissect.regf.regf.KeyNode method) (dissect.target.helpers.regutil.KeyCollection method) (dissect.target.helpers.regutil.RegfKey method) (dissect.target.helpers.regutil.RegistryKey method) (dissect.target.helpers.regutil.VirtualKey method) (dissect.target.loaders.cb.CbRegistryKey method) (dissect.target.loaders.smb.SmbRegistryKey method) (dissect.target.plugins.os.windows.registry.RegistryPlugin method) ValueType (in module dissect.target.helpers.regutil) Var (class in acquire.acquire.acquire) variable (dissect.target.plugins.os.unix.linux.proc.Environ attribute) VARIABLES (dissect.target.plugins.os.windows.env.EnvironmentVariablePlugin attribute) varint (class in flow.record.fieldtypes) varint() (in module dissect.database.sqlite3.sqlite3) (in module dissect.ntfs.util) vbase (dissect.util.compression.lzfse.ValueDecoderEntry attribute) VBK (class in dissect.archive.vbk) vbk (dissect.archive.vbk.Bank attribute) (dissect.archive.vbk.FibMetaSparseTable attribute) (dissect.archive.vbk.FibStream attribute) (dissect.archive.vbk.MetaItem attribute) (dissect.archive.vbk.MetaVector attribute) (dissect.archive.vbk.PropertiesDictionary attribute) (dissect.archive.vbk.SnapshotSlot attribute) (dissect.target.filesystems.vbk.VbkFilesystem attribute) vbk_def (in module dissect.archive.c_vbk) VBKError VbkFilesystem (class in dissect.target.filesystems.vbk) VbkFilesystemEntry (class in dissect.target.filesystems.vbk) vbkfs (dissect.target.loaders.vbk.VbkLoader attribute) VbkLoader (class in dissect.target.loaders.vbk) VBLoader (class in dissect.target.loaders.vb) VBox (class in dissect.hypervisor.descriptor.vbox) VBOX_XML_NAMESPACE (dissect.hypervisor.descriptor.vbox.VBox attribute) vboxes (dissect.target.plugins.child.virtualbox.VirtualBoxChildTargetPlugin attribute) VBoxLoader (class in dissect.target.loaders.vbox) vbr (dissect.fat.ExFAT attribute) (dissect.fat.exfat.ExFAT attribute) VcFeatureDebugEntry (class in dissect.executable.pe.directory.debug) vdcr (dissect.volume.ddf.ddf.DDFVirtualDisk attribute) VDI (class in dissect.hypervisor.disk.vdi) vdi (dissect.target.containers.vdi.VdiContainer attribute) vdi_def (in module dissect.hypervisor.disk.c_vdi) VDI_SIGNATURE (in module dissect.hypervisor.disk.c_vdi) VdiContainer (class in dissect.target.containers.vdi) vdo_offset (dissect.volume.lvm.metadata.VdoSegment attribute) vdo_pool (dissect.volume.lvm.metadata.VdoSegment attribute) VdoPoolSegment (class in dissect.volume.lvm.metadata) VdoSegment (class in dissect.volume.lvm.metadata) vdr (dissect.volume.ddf.ddf.DDFVirtualDisk attribute) VDSL (dissect.target.plugins.os.windows.network.IfTypes attribute) VEK (class in dissect.apfs.objects.keybag) vek() (dissect.apfs.objects.keybag.ContainerKeybag method) VEKBlob (class in dissect.apfs.objects.keybag) VELOCIRAPTOR_RESULTS (in module dissect.target.plugins.apps.edr.velociraptor) VelociraptorDirectoryFilesystem (class in dissect.target.loaders.velociraptor) VelociraptorLoader (class in dissect.target.loaders.velociraptor) VelociraptorPlugin (class in dissect.target.plugins.apps.edr.velociraptor) VelociraptorRecordBuilder (class in dissect.target.plugins.apps.edr.velociraptor) VelociraptorZipFilesystem (class in dissect.target.loaders.velociraptor) vendor (dissect.target.loaders.cellebrite.DeviceInfo attribute) verbose (flow.record.adapter.line.LineWriter attribute) VERBOSITY_ALL (flow.record.selector.Selector attribute) VERBOSITY_BRANCHES (flow.record.selector.Selector attribute) VERBOSITY_NONE (flow.record.selector.Selector attribute) verf (dissect.target.helpers.sunrpc.sunrpc.AcceptedReply attribute) (dissect.target.helpers.sunrpc.sunrpc.CallBody attribute) verifier (dissect.target.helpers.sunrpc.client.AuthScheme attribute) Verifier (in module dissect.target.helpers.nfs.client.nfs) (in module dissect.target.helpers.sunrpc.client) (in module dissect.target.helpers.sunrpc.serializer) (in module dissect.target.helpers.sunrpc.sunrpc) verifier_serializer (dissect.target.helpers.sunrpc.client.AuthScheme attribute) verify (dissect.archive.xva.XVAStream attribute) (dissect.hypervisor.util.envelope.Envelope attribute) verify() (acquire.acquire.tools.decrypter.EncryptedFile method) (dissect.apfs.objects.keybag.KEK method) (dissect.apfs.objects.keybag.VEK method) (dissect.archive.vbk.Bank method) (dissect.archive.vbk.SnapshotSlot method) VerifyError version (dissect.archive.vma.VMA attribute) (dissect.database.bsd.tools.rpm.Package property) (dissect.database.ESE attribute) (dissect.database.ese.ESE attribute) (dissect.database.ese.ese.ESE attribute) (dissect.etl.headers.event.EventDescriptor attribute) (dissect.etl.headers.headers.Header property) (dissect.etl.headers.headers.MessageTraceHeader property) (dissect.executable.pe.directory.com_descriptor.ComMetadata property) (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) (dissect.fve.bde.BDE property) (dissect.fve.bde.bde.BDE property) (dissect.fve.bde.information.Information property) (dissect.fve.bde.information.Validation property) (dissect.hypervisor.descriptor.hyperv.HyperVFile property) (dissect.hypervisor.disk.asif.Directory attribute) (dissect.hypervisor.util.envelope.Envelope attribute) (dissect.jffs.jffs2.DirEntry attribute) (dissect.regf.regf.RegistryHive attribute) (dissect.regf.RegistryHive attribute) (dissect.target.helpers.sunrpc.sunrpc.CallBody attribute) (dissect.target.helpers.sunrpc.sunrpc.PortMapping attribute) (dissect.target.helpers.sunrpc.sunrpc.ProcedureDescriptor attribute) (dissect.target.loaders.ab.AndroidBackup attribute) VERSION (dissect.target.plugins.os.unix.bsd.darwin.ios._os.Config attribute) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin attribute) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin attribute) version (dissect.target.plugins.os.unix.log.atop.AtopFile attribute) (dissect.target.plugins.os.windows.credential.credhist.CredHistEntry attribute) (dissect.target.plugins.os.windows.dpapi.blob.Blob attribute) (dissect.target.plugins.os.windows.everything.parser.EverythingDB attribute) (dissect.target.plugins.os.windows.firewall.LogConfig attribute) (dissect.target.plugins.os.windows.jumplist.CustomDestinationFile attribute) (dissect.target.plugins.os.windows.log.schedlgu.SchedLgU attribute) (dissect.target.plugins.os.windows.prefetch.Prefetch attribute) (dissect.target.plugins.os.windows.regf.shellbags.EXTENSION_BLOCK property) (dissect.target.plugins.os.windows.regf.shimcache.ShimCache attribute) (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) (dissect.thumbcache.index.ThumbnailIndex property) (dissect.thumbcache.thumbcache_file.ThumbcacheFile property) (dissect.thumbcache.ThumbcacheFile property) (dissect.thumbcache.ThumbnailIndex property) (dissect.volume.lvm.LVM2 attribute) (dissect.volume.lvm.lvm2.LVM2 attribute) (dissect.xfs.XFS attribute) (dissect.xfs.xfs.XFS attribute) VERSION (in module acquire.acquire.acquire) version (in module acquire.acquire.acquire) VERSION (in module dissect.evidence.asdf.asdf) version (in module flow.record.tools.rdump) version() (dissect.target.loaders.profile.ProfileOSPlugin method) (dissect.target.loaders.res.ResOSPlugin method) (dissect.target.plugin.OSPlugin method) (dissect.target.plugins.os.default._os.DefaultOSPlugin method) (dissect.target.plugins.os.unix.bsd.citrix._os.CitrixPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.ios._os.IOSPlugin method) (dissect.target.plugins.os.unix.bsd.darwin.macos._os.MacOSPlugin method) (dissect.target.plugins.os.unix.bsd.freebsd._os.FreeBsdPlugin method) (dissect.target.plugins.os.unix.bsd.openbsd._os.OpenBsdPlugin method) (dissect.target.plugins.os.unix.esxi._os.ESXiPlugin method) (dissect.target.plugins.os.unix.linux._os.LinuxPlugin method) (dissect.target.plugins.os.unix.linux.android._os.AndroidPlugin method) (dissect.target.plugins.os.unix.linux.debian.proxmox._os.ProxmoxPlugin method) (dissect.target.plugins.os.unix.linux.debian.vyos._os.VyosPlugin method) (dissect.target.plugins.os.unix.linux.fortios._os.FortiOSPlugin method) (dissect.target.plugins.os.windows._os.WindowsPlugin method) version_match() (in module dissect.target.plugins.os.windows.everything.parser) VERSION_NT52 (dissect.target.plugins.os.windows.regf.shimcache.SHIMCACHE_WIN_TYPE attribute) VERSION_NT61 (dissect.target.plugins.os.windows.regf.shimcache.SHIMCACHE_WIN_TYPE attribute) VERSION_WIN10 (dissect.target.plugins.os.windows.regf.shimcache.SHIMCACHE_WIN_TYPE attribute) VERSION_WIN10_CREATORS (dissect.target.plugins.os.windows.regf.shimcache.SHIMCACHE_WIN_TYPE attribute) VERSION_WIN81 (dissect.target.plugins.os.windows.regf.shimcache.SHIMCACHE_WIN_TYPE attribute) VERSION_WIN81_NO_HEADER (dissect.target.plugins.os.windows.regf.shimcache.SHIMCACHE_WIN_TYPE attribute) VERSIONS (dissect.target.plugins.os.windows.jumplist.CustomDestinationFile attribute) vfh (dissect.executable.PE attribute) (dissect.executable.pe.PE attribute) (dissect.executable.pe.pe.PE attribute) VFS_CAP_FLAGS_EFFECTIVE (in module dissect.target.plugins.filesystem.unix.capability) VFS_CAP_FLAGS_MASK (in module dissect.target.plugins.filesystem.unix.capability) VFS_CAP_REVISION_1 (in module dissect.target.plugins.filesystem.unix.capability) VFS_CAP_REVISION_2 (in module dissect.target.plugins.filesystem.unix.capability) VFS_CAP_REVISION_3 (in module dissect.target.plugins.filesystem.unix.capability) VFS_CAP_REVISION_MASK (in module dissect.target.plugins.filesystem.unix.capability) VFS_CAP_REVISION_SHIFT (in module dissect.target.plugins.filesystem.unix.capability) VFS_CAP_U32_1 (in module dissect.target.plugins.filesystem.unix.capability) VFS_CAP_U32_2 (in module dissect.target.plugins.filesystem.unix.capability) VFS_CAP_U32_3 (in module dissect.target.plugins.filesystem.unix.capability) vfu() (dissect.target.plugins.os.windows.sru.SRUPlugin method) VfuRecord (in module dissect.target.plugins.os.windows.sru) vg (dissect.volume.lvm.LVM2 property) (dissect.volume.lvm.lvm2.LVM2 property) (dissect.volume.lvm.metadata.HistoricalLogicalVolume property) (dissect.volume.lvm.metadata.LogicalVolume property) (dissect.volume.lvm.metadata.PhysicalVolume property) VHD (class in dissect.hypervisor.disk.vhd) vhd (dissect.target.containers.vhd.VhdContainer attribute) vhd_def (in module dissect.hypervisor.disk.c_vhd) VhdContainer (class in dissect.target.containers.vhd) VHDX (class in dissect.hypervisor.disk.vhdx) vhdx (dissect.hypervisor.disk.vhdx.BlockAllocationTable attribute) (dissect.target.containers.vhdx.VhdxContainer attribute) vhdx_def (in module dissect.hypervisor.disk.c_vhdx) VHDX_PARENT_LOCATOR_GUID (in module dissect.hypervisor.disk.c_vhdx) VhdxContainer (class in dissect.target.containers.vhdx) VINES (dissect.target.helpers.network.IANAProtocol attribute) Vinum (class in dissect.volume.vinum.vinum) vinum_def (in module dissect.volume.vinum.c_vinum) VinumConfigs (class in dissect.volume.vinum.config) VinumConfiguration (class in dissect.volume.vinum.vinum) VinumMirrorDisk (class in dissect.volume.vinum.vinum) VinumPhysicalDisk (class in dissect.volume.vinum.vinum) VinumPhysicalDiskDescriptor (in module dissect.volume.vinum.vinum) VinumPlexDisk (class in dissect.volume.vinum.vinum) virtual (dissect.executable.PE attribute) (dissect.executable.pe.PE attribute) (dissect.executable.pe.pe.PE attribute) virtual_address (dissect.executable.elf.elf.Segment attribute) (dissect.executable.elf.Segment attribute) (dissect.executable.pe.pe.Section property) virtual_disk (dissect.volume.raid.stream.LinearStream attribute) (dissect.volume.raid.stream.RAID0Stream attribute) (dissect.volume.raid.stream.RAID10Stream attribute) (dissect.volume.raid.stream.RAID456Stream attribute) virtual_disk_configuration_record (dissect.volume.ddf.ddf.DDFVirtualDisk property) virtual_disk_configuration_records (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) VIRTUAL_DISK_ID_GUID (in module dissect.hypervisor.disk.c_vhdx) virtual_disk_record (dissect.volume.ddf.ddf.DDFVirtualDisk property) virtual_disk_records (dissect.volume.ddf.ddf.DDFPhysicalDisk attribute) VIRTUAL_DISK_SIZE_GUID (in module dissect.hypervisor.disk.c_vhdx) virtual_disks (dissect.volume.raid.raid.Configuration attribute) virtual_extents (dissect.volume.lvm.metadata.VdoPoolSegment attribute) virtual_hosts (dissect.target.plugins.apps.webserver.apache.ApachePlugin attribute) virtual_machines() (dissect.target.plugins.os.windows.ual.UalPlugin method) virtual_offset (dissect.hypervisor.disk.asif.Table attribute) virtual_size (dissect.executable.pe.pe.Section property) VirtualBoxChildTargetPlugin (class in dissect.target.plugins.child.virtualbox) VirtualDirectory (class in dissect.target.filesystem) VirtualDisk (class in dissect.volume.raid.raid) VirtualDiskConfigurationRecord (class in dissect.volume.ddf.ddf) VirtualDiskRecord (class in dissect.volume.ddf.ddf) VirtualFile (class in dissect.target.filesystem) VirtualFileHandle (class in dissect.target.filesystem) VirtualFilesystem (class in dissect.target.filesystem) VirtualHive (class in dissect.target.helpers.regutil) VIRTUALIPADDRESS (dissect.target.plugins.os.windows.network.IfTypes attribute) VirtualizationInfoDatum (class in dissect.fve.bde.information) virtualized_block_offset (dissect.fve.bde.information.Information property) (dissect.fve.bde.information.VirtualizationInfoDatum property) virtualized_block_size (dissect.fve.bde.information.VirtualizationInfoDatum property) virtualized_sectors (dissect.fve.bde.information.Information property) VirtualKey (class in dissect.target.helpers.regutil) VirtualMachinePlugin (class in dissect.target.plugins.os.unix.linux.debian.proxmox.vm) VirtualMachineRecord (in module dissect.target.plugins.os.unix.esxi._os) (in module dissect.target.plugins.os.unix.linux.debian.proxmox.vm) (in module dissect.target.plugins.os.windows.ual) VirtualStream (class in dissect.executable.pe.pe) VirtualSymlink (class in dissect.target.filesystem) VirtualValue (class in dissect.target.helpers.regutil) VirtuozzoChildTargetPlugin (class in dissect.target.plugins.child.virtuozzo) VIRUS_TYPE (dissect.target.plugins.apps.av.symantec.SymantecPlugin attribute) VISA (dissect.target.helpers.network.IANAProtocol attribute) visibility (dissect.executable.elf.elf.Symbol attribute) (dissect.executable.elf.Symbol attribute) visoropen() (dissect.hypervisor.util.vmtar.VisorTarFile class method) VisorTarFile (class in dissect.hypervisor.util.vmtar) VisorTarInfo (class in dissect.hypervisor.util.vmtar) VISTA_AND_ABOVE_IDLIST_PROPS (dissect.shellitem.lnk.c_lnk.EXTRA_DATA_BLOCK_SIGNATURES attribute) vlan (dissect.target.plugins.os.unix.linux.network.NetworkManagerConfigParser.ParserContext attribute) VlanIdByInterface (in module dissect.target.plugins.os.unix.linux.network) vm_inventory() (dissect.target.plugins.os.unix.esxi._os.ESXiPlugin method) vm_xml (dissect.target.plugins.child.hyperv.HyperVChildTargetPlugin attribute) VMA (class in dissect.archive.vma) vma (dissect.archive.vma.Device attribute) (dissect.archive.vma.DeviceDataStream attribute) (dissect.target.loaders.vma.VmaLoader attribute) vma_def (in module dissect.archive.c_vma) VMA_EXTENT_MAGIC (in module dissect.archive.c_vma) VMA_MAGIC (in module dissect.archive.c_vma) VmaLoader (class in dissect.target.loaders.vma) VMAP (class in dissect.eventlog.wevt_object) vmcx (dissect.target.loaders.hyperv.HyperVLoader attribute) VMDK (class in dissect.hypervisor.disk.vmdk) vmdk (dissect.target.containers.vmdk.VmdkContainer attribute) vmdk_def (in module dissect.hypervisor.disk.c_vmdk) VMDK_MAGIC (in module dissect.hypervisor.disk.c_vmdk) VmdkContainer (class in dissect.target.containers.vmdk) VMFS (class in acquire.acquire.acquire) (class in dissect.vmfs) (class in dissect.vmfs.vmfs) vmfs (dissect.target.filesystems.vmfs.VmfsFilesystem attribute) (dissect.vmfs.descriptor.DirEntry attribute) (dissect.vmfs.descriptor.FileDescriptor attribute) (dissect.vmfs.DirEntry attribute) (dissect.vmfs.FileDescriptor attribute) (dissect.vmfs.resource.ResourceFile attribute) (dissect.vmfs.resource.ResourceManager attribute) (in module dissect.target.volume) vmfs_def (in module dissect.vmfs.c_vmfs) vmfs_uuid() (in module dissect.vmfs.util) VmfsFilesystem (class in dissect.target.filesystems.vmfs) VmfsFilesystemEntry (class in dissect.target.filesystems.vmfs) VmfsVolumeSystem (class in dissect.target.volumes.vmfs) VmkInfoDatum (class in dissect.fve.bde.information) vmlist() (dissect.target.plugins.os.unix.linux.debian.proxmox.vm.VirtualMachinePlugin method) VmtarFilesystem (class in dissect.target.filesystems.vmtar) VMTP (dissect.target.helpers.network.IANAProtocol attribute) VmwareDragAndDropRecord (in module dissect.target.plugins.apps.virtualization.vmware_workstation) VmwareVirtualMachineRecord (in module dissect.target.plugins.apps.virtualization.vmware_workstation) VmwarevmLoader (class in dissect.target.loaders.vmwarevm) VmwareWorkstationChildTargetPlugin (class in dissect.target.plugins.child.vmware_workstation) VmwareWorkstationPlugin (class in dissect.target.plugins.apps.virtualization.vmware_workstation) VMX (class in dissect.hypervisor.descriptor.vmx) vmx (dissect.target.loaders.vmx.VmxLoader attribute) VmxLoader (class in dissect.target.loaders.vmx) VOICE_EM (dissect.target.plugins.os.windows.network.IfTypes attribute) VOICE_ENCAP (dissect.target.plugins.os.windows.network.IfTypes attribute) VOICE_FXO (dissect.target.plugins.os.windows.network.IfTypes attribute) VOICE_FXS (dissect.target.plugins.os.windows.network.IfTypes attribute) VOICE_OVERIP (dissect.target.plugins.os.windows.network.IfTypes attribute) VOICEOVERATM (dissect.target.plugins.os.windows.network.IfTypes attribute) VOICEOVERFRAMERELAY (dissect.target.plugins.os.windows.network.IfTypes attribute) Void (class in dissect.cstruct) (class in dissect.cstruct.types) (class in dissect.cstruct.types.void) VoidArray (class in dissect.cstruct.types) (class in dissect.cstruct.types.void) VOLATILE (in module acquire.acquire.acquire) (in module dissect.regf.regf) VOLATILE_LINUX_PATHS (in module dissect.target.loaders.local) VolatileProfile (class in acquire.acquire.acquire) VolatileStream (class in acquire.acquire.volatilestream) VOLUME (class in dissect.target.plugins.os.windows.regf.shellbags) Volume (class in dissect.target.volume) (class in dissect.vmfs) (class in dissect.vmfs.lvm) (class in dissect.volume.vinum.config) volume (dissect.apfs.objects.fs.DirectoryEntry attribute) (dissect.apfs.objects.fs.INode attribute) (dissect.apfs.stream.FileStream attribute) (dissect.evidence.EWF attribute) (dissect.evidence.ewf.EWF attribute) (dissect.evidence.ewf.Segment attribute) (dissect.evidence.ewf.VolumeSection attribute) (dissect.target.filesystem.Filesystem attribute) (dissect.vmfs.lvm.VolumeStream attribute) (dissect.volume.vinum.config.Plex attribute) (dissect.volume.vinum.vinum.VinumMirrorDisk attribute) (dissect.volume.vinum.vinum.VinumPlexDisk attribute) volume_group (dissect.volume.lvm.LVM2 attribute) (dissect.volume.lvm.lvm2.LVM2 attribute) (dissect.volume.lvm.metadata.HistoricalLogicalVolume property) (dissect.volume.lvm.metadata.LogicalVolume property) (dissect.volume.lvm.metadata.PhysicalVolume property) VOLUME_HEADER_OFFSET (in module dissect.volume.vss) volume_id (dissect.fat.fat.FATFS attribute) (dissect.fat.FATFS attribute) (dissect.qnxfs.QNX6 attribute) (dissect.qnxfs.qnx6.QNX6 attribute) volume_identifier (dissect.volume.vss.VSS property) volume_keybag() (dissect.apfs.objects.keybag.ContainerKeybag method) volume_label (dissect.fat.ExFAT attribute) (dissect.fat.exfat.ExFAT attribute) (dissect.fat.fat.FATFS attribute) (dissect.fat.FATFS attribute) VOLUME_LABEL_ENTRY (in module dissect.fat.c_exfat) volume_name (dissect.extfs.ExtFS attribute) (dissect.extfs.extfs.ExtFS attribute) (dissect.ffs.FFS attribute) (dissect.ffs.ffs.FFS attribute) (dissect.ntfs.NTFS property) (dissect.ntfs.ntfs.NTFS property) (dissect.target.plugins.os.windows.regf.shellbags.VOLUME attribute) volume_size (dissect.volume.vss.Store attribute) VolumeCollection (class in dissect.target.target) VolumeGroup (class in dissect.volume.lvm.metadata) VolumeKeybag (class in dissect.apfs.objects.keybag) VolumeNotAvailableError, [1] volumes (dissect.apfs.APFS property) (dissect.apfs.apfs.APFS property) (dissect.target.plugins.os.windows.prefetch.Prefetch attribute) (dissect.target.Target attribute) (dissect.target.target.Target attribute) (dissect.target.volume.VolumeSystem property) (dissect.vmfs.Device attribute) (dissect.vmfs.LVM attribute) (dissect.vmfs.lvm.Device attribute) (dissect.vmfs.lvm.LVM attribute) (dissect.volume.vinum.config.VinumConfigs attribute) (dissect.volume.vinum.vinum.Config attribute) VolumeSection (class in dissect.evidence.ewf) VolumeState (class in dissect.volume.vinum.config) VolumeStream (class in dissect.vmfs.lvm) VolumeSystem (class in dissect.target.volume) VolumeSystemError VRRP (dissect.target.helpers.network.IANAProtocol attribute) vs (dissect.target.container.Container attribute) (dissect.target.volume.Volume attribute) vs_version_info() (dissect.executable.pe.directory.resource.ResourceDirectory method) (dissect.executable.pe.directory.ResourceDirectory method) VSS (class in dissect.volume.vss) vss (dissect.volume.vss.Catalog attribute) vss_def (in module dissect.volume.vss) VSS_IDENTIFIER (in module dissect.volume.vss) vxd (dissect.executable.pe.directory.resource.ResourceDirectory property) (dissect.executable.pe.directory.ResourceDirectory property) VYOS (dissect.target.plugin.OperatingSystem attribute) VyosPlugin (class in dissect.target.plugins.os.unix.linux.debian.vyos._os) W W (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) WAIT_COMPLETION_PACKET (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) wait_for_quit() (acquire.acquire.gui.base.GUI method) (acquire.acquire.gui.base.Stub method) wait_for_start() (acquire.acquire.gui.base.GUI method) (acquire.acquire.gui.base.Stub method) wake_to_run (dissect.target.plugins.os.windows.tasks.job.AtTask attribute) (dissect.target.plugins.os.windows.tasks.xml.XmlTask attribute) WAL (class in dissect.database.sqlite3) (class in dissect.database.sqlite3.sqlite3) wal (dissect.database.SQLite3 attribute) (dissect.database.sqlite3.SQLite3 attribute) (dissect.database.sqlite3.sqlite3.SQLite3 attribute) (dissect.database.sqlite3.sqlite3.WALCheckpoint attribute) (dissect.database.sqlite3.sqlite3.WALFrame attribute) wal_checksum() (in module dissect.database.sqlite3.sqlite3) WAL_HEADER_MAGIC (in module dissect.database.sqlite3.sqlite3) WAL_HEADER_MAGIC_BE (in module dissect.database.sqlite3.sqlite3) WAL_HEADER_MAGIC_LE (in module dissect.database.sqlite3.sqlite3) WALCheckpoint (class in dissect.database.sqlite3.sqlite3) WALFrame (class in dissect.database.sqlite3.sqlite3) walk() (dissect.apfs.cursor.Cursor method) (dissect.btrfs.tree.Cursor method) (dissect.extfs.JDB2 method) (dissect.extfs.journal.JDB2 method) (dissect.ole.ole.DirectoryEntry method) (dissect.regf.regf.RegistryHive method) (dissect.regf.RegistryHive method) (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) (dissect.target.plugins.os.windows.regf.regf.RegfPlugin method) (in module dissect.target.helpers.fsutil) (in module dissect.target.tools.fs) walk_agi() (dissect.xfs.XFS method) (dissect.xfs.xfs.AllocationGroup method) (dissect.xfs.xfs.XFS method) walk_ext() (dissect.target.filesystem.Filesystem method) (dissect.target.filesystem.FilesystemEntry method) (in module dissect.target.helpers.fsutil) walk_extents() (dissect.xfs.XFS method) (dissect.xfs.xfs.AllocationGroup method) (dissect.xfs.xfs.XFS method) walk_large_tree() (dissect.xfs.XFS method) (dissect.xfs.xfs.XFS method) walk_small_tree() (dissect.xfs.XFS method) (dissect.xfs.xfs.XFS method) walk_tree() (dissect.xfs.xfs.AllocationGroup method) (in module dissect.database.sqlite3.sqlite3) walkdir() (dissect.target.tools.diff.TargetComparison method) walkfs() (dissect.target.plugins.filesystem.walkfs.WalkFsPlugin method) WalkFsPlugin (class in dissect.target.plugins.filesystem.walkfs) WARNING (dissect.target.plugins.os.unix.log.journal.JournalMessagePriority attribute) was_path_seen() (acquire.acquire.collector.CollectionReport method) wb (flow.record.adapter.xlsx.XlsxReader attribute) (flow.record.adapter.xlsx.XlsxWriter attribute) WB_EXPAK (dissect.target.helpers.network.IANAProtocol attribute) WB_MON (dissect.target.helpers.network.IANAProtocol attribute) WBEM (class in acquire.acquire.acquire) Wchar (class in dissect.cstruct) (class in dissect.cstruct.types) (class in dissect.cstruct.types.wchar) WcharArray (class in dissect.cstruct) (class in dissect.cstruct.types) (class in dissect.cstruct.types.wchar) web() (dissect.target.plugins.apps.productivity.msoffice.MSOffice method) WebCache (class in dissect.target.plugins.apps.browser.iexplore) WebHosting (class in acquire.acquire.acquire) webkittimestamp() (in module dissect.util.ts) WebserverAccessLogRecord (in module dissect.target.plugins.apps.webserver.webserver) WebserverErrorLogRecord (in module dissect.target.plugins.apps.webserver.webserver) WebserverHostRecord (in module dissect.target.plugins.apps.webserver.webserver) WebserverPlugin (class in dissect.target.plugins.apps.webserver.webserver) WeeklyTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) WER (class in acquire.acquire.acquire) wer() (dissect.target.plugins.os.windows.wer.WindowsErrorReportingPlugin method) wer_files (dissect.target.plugins.os.windows.wer.WindowsErrorReportingPlugin attribute) WER_LOG_DIRS (dissect.target.plugins.os.windows.wer.WindowsErrorReportingPlugin attribute) WESP (dissect.target.helpers.network.IANAProtocol attribute) WEVT (class in dissect.eventlog.wevt) wevt_headers() (dissect.eventlog.CRIM method) (dissect.eventlog.wevt.CRIM method) wevt_object_def (in module dissect.eventlog.wevt_object) WEVT_TYPE (class in dissect.eventlog.wevt) WevtName (class in dissect.eventlog.wevt_object) WevtNameReader (class in dissect.eventlog.bxml) WevtObject (class in dissect.eventlog.wevt_object) WevtutilWrapper (class in dissect.eventlog.wevtutil) wffirewall() (dissect.target.plugins.apps.av.trendmicro.TrendMicroPlugin method) wflogs() (dissect.target.plugins.apps.av.trendmicro.TrendMicroPlugin method) WgetHstsRecord (in module dissect.target.plugins.apps.shell.wget) WgetPlugin (class in dissect.target.plugins.apps.shell.wget) WHITE (dissect.target.helpers.cyber.Color attribute) (dissect.target.tools.shell.AnsiColors attribute) WHITE_BRUSH (in module acquire.acquire.gui.win32) WHITELIST (in module flow.record.whitelist) WHITELIST_TREE (in module flow.record.whitelist) width (dissect.target.plugins.os.windows.rdpcache.BitmapTile attribute) WIM (class in dissect.archive.wim) wim (dissect.archive.wim.Image attribute) (dissect.archive.wim.Resource attribute) wim_def (in module dissect.archive.c_wim) WIM_IMAGE_TAG (in module dissect.archive.c_wim) Win32 (class in acquire.acquire.gui.win32) win_10_path() (in module dissect.target.plugins.os.windows.regf.shimcache) win_8_path() (in module dissect.target.plugins.os.windows.regf.shimcache) WIN_DATETIME_FIELDS (dissect.database.ese.tools.ual.UAL attribute) WinArpCache (class in acquire.acquire.acquire) WinDnsClientCache (class in acquire.acquire.acquire) window_size (dissect.target.loaders.mqtt.MqttTransferRatePerSecond attribute) WINDOWS (dissect.target.filesystems.cb.OS attribute) (dissect.target.plugin.OperatingSystem attribute) WINDOWS_10 (dissect.thumbcache.util.ThumbnailType attribute) WINDOWS_7 (dissect.thumbcache.util.ThumbnailType attribute) WINDOWS_81 (dissect.thumbcache.util.ThumbnailType attribute) WINDOWS_ACCESSORS (in module dissect.target.loaders.velociraptor) windows_command (class in flow.record.fieldtypes) WINDOWS_DRIVE_FIXED (in module dissect.target.loaders.local) WINDOWS_ERROR_INSUFFICIENT_BUFFER (in module dissect.target.loaders.local) WINDOWS_MEMBERS (in module dissect.target.loaders.tar) windows_path (class in flow.record.fieldtypes) WINDOWS_STATION (acquire.acquire.dynamic.windows.named_objects.NamedObjectType attribute) WINDOWS_VISTA (dissect.thumbcache.util.ThumbnailType attribute) WINDOWS_ZONE_MAP (in module dissect.target.helpers.localeutil) WindowsApplicationRecord (in module dissect.target.plugins.os.windows.regf.applications) WindowsApplicationsPlugin (class in dissect.target.plugins.os.windows.regf.applications) WindowsDateTimePlugin (class in dissect.target.plugins.os.windows.datetime) WindowsDynamicError WindowsErrorReportingPlugin (class in dissect.target.plugins.os.windows.wer) WindowsEventlogsMixin (class in dissect.target.plugins.os.windows.log.evt) WindowsFirewallLogRecord (in module dissect.target.plugins.os.windows.firewall) WindowsFirewallPlugin (class in dissect.target.plugins.os.windows.firewall) WindowsInterfaceRecord (in module dissect.target.helpers.record) WindowsKeyboardRecord (in module dissect.target.plugins.os.windows.locale) WindowsLocalePlugin (class in dissect.target.plugins.os.windows.locale) WindowsNetworkPlugin (class in dissect.target.plugins.os.windows.network) WindowsNotepadPlugin (class in dissect.target.plugins.apps.editor.windowsnotepad) WindowsNotepadSavedTabRecord (in module dissect.target.plugins.apps.editor.windowsnotepad) WindowsNotepadTab (class in dissect.target.plugins.apps.editor.windowsnotepad) WindowsNotepadUnsavedTabRecord (in module dissect.target.plugins.apps.editor.windowsnotepad) WindowsNotifications (class in acquire.acquire.acquire) WindowsPlugin (class in dissect.target.plugins.os.windows._os) WindowsProductKeyPlugin (class in dissect.target.plugins.os.windows.productkey) WindowsProductKeyRecord (in module dissect.target.plugins.os.windows.productkey) WindowsProfile (class in acquire.acquire.acquire) windowstab_def (in module dissect.target.plugins.apps.editor.windowsnotepad) WindowsTimezone (class in dissect.target.plugins.os.windows.datetime) WindowsUserRecord (in module dissect.target.helpers.record) WinlogonDefaultPasswordKeyProviderPlugin (class in dissect.target.plugins.os.windows.dpapi.keyprovider.defaultpassword.winlogon) WinMemDump (class in acquire.acquire.acquire) WinMemFiles (class in acquire.acquire.acquire) WinProcEnv (class in acquire.acquire.acquire) WinProcesses (class in acquire.acquire.acquire) winrar() (dissect.target.plugins.apps.productivity.winrar.WinRarPlugin method) WinRarPlugin (class in dissect.target.plugins.apps.productivity.winrar) WinRarRecord (in module dissect.target.plugins.apps.productivity.winrar) WinRDPSessions (class in acquire.acquire.acquire) winreg (dissect.target.loaders.smb.SmbRegistryHive attribute) winsocknamespaceprovider() (dissect.target.plugins.os.windows.generic.GenericPlugin method) WinSockNamespaceProviderRecord (in module dissect.target.plugins.os.windows.generic) wintimestamp() (in module dissect.util.ts) WireGuardInterfaceRecord (in module dissect.target.plugins.apps.vpn.wireguard) WireGuardPeerRecord (in module dissect.target.plugins.apps.vpn.wireguard) WireGuardPlugin (class in dissect.target.plugins.apps.vpn.wireguard) with_ip() (dissect.target.plugins.os.default.network.NetworkPlugin method) with_mac() (dissect.target.plugins.os.default.network.NetworkPlugin method) with_name() (dissect.target.helpers.compat.path_310.PureDissectPath method) (dissect.target.helpers.compat.path_311.PureDissectPath method) with_segments() (dissect.target.helpers.compat.path_312.PureDissectPath method) (dissect.target.helpers.compat.path_313.PureDissectPath method) with_stem() (dissect.target.helpers.compat.path_310.PureDissectPath method) (dissect.target.helpers.compat.path_311.PureDissectPath method) with_suffix() (dissect.target.helpers.compat.path_310.PureDissectPath method) (dissect.target.helpers.compat.path_311.PureDissectPath method) WM_CLOSE (in module acquire.acquire.gui.win32) WM_COMMAND (in module acquire.acquire.gui.win32) WM_CTLCOLORSTATIC (in module acquire.acquire.gui.win32) WM_DESTROY (in module acquire.acquire.gui.win32) WM_ENABLE (in module acquire.acquire.gui.win32) WM_PAINT (in module acquire.acquire.gui.win32) WM_SETFONT (in module acquire.acquire.gui.win32) WM_USER (in module acquire.acquire.gui.win32) WNDCLASSW (class in acquire.acquire.gui.win32) WNDPROC (in module acquire.acquire.gui.win32) WnfGuid (in module dissect.etl.utils) WnfTriggerRecord (in module dissect.target.plugins.os.windows.tasks.records) worker() (in module acquire.acquire.tools.decrypter) WORKER_COUNT (in module acquire.acquire.tools.decrypter) wpndatabase() (dissect.target.plugins.os.windows.notifications.NotificationsPlugin method) WpnDatabaseNotificationHandlerRecord (in module dissect.target.plugins.os.windows.notifications) WpnDatabaseNotificationRecord (in module dissect.target.plugins.os.windows.notifications) wpndb_files (dissect.target.plugins.os.windows.notifications.NotificationsPlugin attribute) wrap() (in module dissect.target.helpers.cache) WRAP_PASSCODE (dissect.target.loaders.itunes.ClassKey attribute) wrap_square_colors_in_border() (in module dissect.target.plugins.os.windows.rdpcache) wrap_type (dissect.target.loaders.itunes.ClassKey attribute) wrapped_key (dissect.hypervisor.descriptor.vmx.Pair attribute) (dissect.target.loaders.itunes.ClassKey attribute) WrappedRecord (class in flow.record.selector) wrapper (dissect.target.helpers.cache.Cache attribute) write (dissect.cstruct.BaseType attribute) (dissect.cstruct.types.base.BaseType attribute) (dissect.cstruct.types.BaseType attribute) write() (acquire.acquire.crypt.EncryptedStream method) (acquire.acquire.outputs.base.Output method) (acquire.acquire.outputs.dir.DirectoryOutput method) (acquire.acquire.outputs.tar.TarOutput method) (acquire.acquire.outputs.zip.ZipOutput method) (dissect.cstruct.BitBuffer method) (dissect.cstruct.bitbuffer.BitBuffer method) (dissect.cstruct.MetaType method) (dissect.cstruct.types.base.MetaType method) (dissect.cstruct.types.MetaType method) (dissect.evidence.asdf.streams.CompressedStream method) (dissect.evidence.asdf.streams.Crc32Stream method) (dissect.evidence.asdf.streams.HashedStream method) (dissect.evidence.asdf.streams.SubStreamBase method) (dissect.target.helpers.cache.LineWriter method) (dissect.target.helpers.cyber.CyberIO method) (flow.record.adapter.AbstractWriter method) (flow.record.adapter.archive.ArchiveWriter method) (flow.record.adapter.avro.AvroWriter method) (flow.record.adapter.broker.BrokerWriter method) (flow.record.adapter.csvfile.CsvfileWriter method) (flow.record.adapter.elastic.ElasticWriter method) (flow.record.adapter.jsonfile.JsonfileWriter method) (flow.record.adapter.line.LineWriter method) (flow.record.adapter.mongo.MongoWriter method) (flow.record.adapter.split.SplitWriter method) (flow.record.adapter.splunk.SplunkWriter method) (flow.record.adapter.sqlite.SqliteWriter method) (flow.record.adapter.stream.StreamWriter method) (flow.record.adapter.text.TextWriter method) (flow.record.adapter.xlsx.XlsxWriter method) (flow.record.stream.PathTemplateWriter method) (flow.record.stream.RecordPrinter method) (flow.record.stream.RecordStreamWriter method) write_bytes() (acquire.acquire.collector.Collector method) (acquire.acquire.outputs.base.Output method) (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) write_entry() (acquire.acquire.outputs.base.Output method) (in module dissect.thumbcache.tools.utils) write_header() (acquire.acquire.crypt.EncryptedStream method) write_policy (dissect.volume.lvm.metadata.VdoPoolSegment attribute) write_text() (dissect.target.helpers.compat.path_310.TargetPath method) (dissect.target.helpers.compat.path_311.TargetPath method) (dissect.target.helpers.compat.path_312.TargetPath method) (dissect.target.helpers.compat.path_313.TargetPath method) write_varint() (in module dissect.target.plugins.os.windows.everything.parser) write_volatile() (acquire.acquire.outputs.base.Output method) writeback_jobs (dissect.volume.lvm.metadata.WriteCacheSegment attribute) writebehind (dissect.volume.lvm.metadata.RAIDSegment attribute) writecache (dissect.volume.lvm.metadata.WriteCacheSegment attribute) writecache_block_size (dissect.volume.lvm.metadata.WriteCacheSegment attribute) writecache_setting_key (dissect.volume.lvm.metadata.WriteCacheSegment attribute) writecache_setting_val (dissect.volume.lvm.metadata.WriteCacheSegment attribute) WriteCacheSegment (class in dissect.volume.lvm.metadata) writeheader() (flow.record.stream.RecordStreamWriter method) writer (dissect.target.helpers.cache.CacheWriter attribute) (flow.record.adapter.archive.ArchiveWriter attribute) (flow.record.adapter.avro.AvroWriter attribute) (flow.record.adapter.csvfile.CsvfileWriter attribute) (flow.record.adapter.split.SplitWriter attribute) (flow.record.stream.PathTemplateWriter attribute) written (flow.record.adapter.split.SplitWriter attribute) ws (flow.record.adapter.xlsx.XlsxReader attribute) (flow.record.adapter.xlsx.XlsxWriter attribute) WS_BORDER (in module acquire.acquire.gui.win32) WS_CHILD (in module acquire.acquire.gui.win32) WS_DISABLED (in module acquire.acquire.gui.win32) WS_OVERLAPPEDWINDOW (in module acquire.acquire.gui.win32) WS_VISIBLE (in module acquire.acquire.gui.win32) WSLChildTargetPlugin (class in dissect.target.plugins.child.wsl) WSN (dissect.target.helpers.network.IANAProtocol attribute) wstring (in module flow.record.fieldtypes) wtmp() (dissect.target.plugins.os.unix.log.utmp.UtmpPlugin method) wtmp_paths (dissect.target.plugins.os.unix.log.utmp.UtmpPlugin attribute) WtmpRecord (in module dissect.target.plugins.os.unix.log.utmp) WUA_CODE_MAP (in module dissect.target.plugins.os.windows.wua_history) wua_history() (dissect.target.plugins.os.windows.wua_history.WuaHistoryPlugin method) WuaHistoryPlugin (class in dissect.target.plugins.os.windows.wua_history) WuaHistoryRecord (in module dissect.target.plugins.os.windows.wua_history) WWANPP (dissect.target.plugins.os.windows.network.IfTypes attribute) WWANPP2 (dissect.target.plugins.os.windows.network.IfTypes attribute) X X (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) x (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) X213 (dissect.target.plugins.os.windows.network.IfTypes attribute) X25_HUNTGROUP (dissect.target.plugins.os.windows.network.IfTypes attribute) X25_MLP (dissect.target.plugins.os.windows.network.IfTypes attribute) X25_PLE (dissect.target.plugins.os.windows.network.IfTypes attribute) XAttr (class in dissect.apfs.objects.fs) (class in dissect.extfs.extfs) xattr (dissect.apfs.objects.fs.INode property) (dissect.extfs.extfs.INode property) (dissect.extfs.INode property) XATTR_NAME_MAP (in module dissect.extfs.c_ext) XATTR_PREFIX_MAP (in module dissect.extfs.c_ext) XdrDeserializer (class in dissect.target.helpers.sunrpc.serializer) XdrSerializer (class in dissect.target.helpers.sunrpc.serializer) XF_MAP (in module dissect.apfs.c_apfs) xfields (dissect.apfs.objects.fs.DirectoryEntry attribute) (dissect.apfs.objects.fs.INode property) XFS (class in dissect.xfs) (class in dissect.xfs.xfs) xfs (dissect.target.filesystems.xfs.XfsFilesystem attribute) (dissect.xfs.xfs.AllocationGroup attribute) (dissect.xfs.xfs.INode attribute) xfs_def (in module dissect.xfs.c_xfs) XFS_NULL (in module dissect.xfs.c_xfs) XfsFilesystem (class in dissect.target.filesystems.xfs) XfsFilesystemEntry (class in dissect.target.filesystems.xfs) xfstimestamp() (in module dissect.util.ts) xid (dissect.apfs.cursor.Cursor attribute) (dissect.apfs.objects.base.Object property) (dissect.apfs.objects.fs.Snapshot attribute) (dissect.apfs.objects.Object property) (dissect.target.helpers.sunrpc.sunrpc.Message attribute) XlsxReader (class in flow.record.adapter.xlsx) XlsxWriter (class in flow.record.adapter.xlsx) xmemoryview() (in module dissect.util.xmemoryview) Xml (class in dissect.target.helpers.configutil) xml (dissect.hypervisor.descriptor.ovf.OVF attribute) (dissect.hypervisor.disk.hdd.Descriptor attribute) (dissect.target.loaders.hyperv.HyperVLoader attribute) xml_as_dict() (in module dissect.target.loaders.hyperv) XML_NAMESPACE (dissect.target.plugins.apps.productivity.msoffice.ClickOnceDeploymentManifestParser attribute) XMLEntry (class in dissect.hypervisor.disk.hdd) XmlTask (class in dissect.target.plugins.os.windows.tasks.xml) XNET (dissect.target.helpers.network.IANAProtocol attribute) XNS_IDP (dissect.target.helpers.network.IANAProtocol attribute) xor (in module dissect.fve.crypto.util) xor32_crc() (in module dissect.regf.regf) xor_key (dissect.target.containers.fortifw.FortiFirmwareFile attribute) xor_naive() (in module dissect.fve.crypto.util) xor_pseudo_simd() (in module dissect.fve.crypto.util) XTP (dissect.target.helpers.network.IANAProtocol attribute) XVA (class in dissect.archive.xva) xva (dissect.archive.xva.XVAStream attribute) (dissect.target.loaders.xva.XvaLoader attribute) XvaLoader (class in dissect.target.loaders.xva) XVAStream (class in dissect.archive.xva) Y Yaml (class in dissect.target.helpers.configutil) yara() (dissect.target.plugins.filesystem.yara.YaraPlugin method) YaraMatchRecord (in module dissect.target.plugins.filesystem.yara) YaraPlugin (class in dissect.target.plugins.filesystem.yara) year_rollover_helper() (in module dissect.target.helpers.utils) YELLOW (dissect.target.helpers.cyber.Color attribute) (dissect.target.tools.shell.AnsiColors attribute) yield_apps() (dissect.target.plugins.os.windows.cam.CamPlugin method) YUM_LOG_KEYWORDS (in module dissect.target.plugins.os.unix.linux.redhat.yum) YumPlugin (class in dissect.target.plugins.os.unix.linux.redhat.yum) Z Z (dissect.target.plugins.os.unix.linux.proc.ProcessStateEnum attribute) ZERO (in module dissect.target.plugins.os.windows.datetime) zero_new_blocks (dissect.volume.lvm.metadata.ThinPoolSegment attribute) ZERO_SUBCLUSTER_TYPES (in module dissect.hypervisor.disk.c_qcow2) ZeroSegment (class in dissect.volume.lvm.metadata) zip (dissect.target.filesystems.zip.ZipFilesystem attribute) (dissect.target.loaders.zip.ZipLoader attribute) (dissect.target.loaders.zip.ZipSubLoader attribute) ZIP_COMPRESSION_METHODS (in module acquire.acquire.outputs.zip) ZIP_EXT (in module dissect.target.loaders.zip) ZipFilesystem (class in dissect.target.filesystems.zip) ZipFilesystemEntry (class in dissect.target.filesystems.zip) ZipLoader (class in dissect.target.loaders.zip) ZipOutput (class in acquire.acquire.outputs.zip) ZipSubLoader (class in dissect.target.loaders.zip) zla (dissect.vmfs.descriptor.FileDescriptor property) (dissect.vmfs.FileDescriptor property) ZlibStream (class in dissect.util.stream) Zone (class in dissect.volume.raid.stream) zone_end (dissect.volume.raid.stream.Zone attribute) zones (dissect.volume.raid.stream.RAID0Stream attribute) ZSTD (dissect.target.tools.dump.Compression attribute) ZSTD_MAGIC (in module flow.record.base) ZypperPlugin (class in dissect.target.plugins.os.unix.linux.suse.zypper)