dissect.target 3.13.dev26__py3-none-any.whl → 3.14__py3-none-any.whl

dissect/target/target.py

@@ -155,7 +155,9 @@ class Target:
         """Resolve all disks, volumes and filesystems and load an operating system on the current ``Target``."""
         self.disks.apply()
         self.volumes.apply()
+        self.filesystems.apply()
         self._init_os()
+        self._mount_others()
         self._applied = True
 
     @property
@@ -424,7 +426,8 @@ class Target:
             if isinstance(os_plugin, plugin.OSPlugin):
                 self._os_plugin = os_plugin.__class__
             elif issubclass(os_plugin, plugin.OSPlugin):
-                os_plugin = os_plugin.create(self, os_plugin.detect(self))
+                if fs := os_plugin.detect(self):
+                    os_plugin = os_plugin.create(self, fs)
 
             self._os = self.add_plugin(os_plugin)
             return
@@ -481,6 +484,20 @@ class Target:
         self._os_plugin = os_plugin
         self._os = self.add_plugin(os_plugin.create(self, fs))
 
+    def _mount_others(self) -> None:
+        root_fs = self.fs
+        counter = 0
+        path = "/$fs$/fs0"
+
+        for fs in self.filesystems:
+            if fs not in root_fs.mounts.values():
+                # determine mount point
+                while root_fs.path(path).exists():
+                    counter += 1
+                    path = f"/$fs$/fs{counter}"
+
+                root_fs.mount(path, fs)
+
     def add_plugin(
         self,
         plugin_cls: Union[plugin.Plugin, type[plugin.Plugin]],
@@ -712,18 +729,12 @@ class DiskCollection(Collection[container.Container]):
 
 
 class VolumeCollection(Collection[volume.Volume]):
-    def open(self, vol: volume.Volume) -> None:
-        try:
-            if not hasattr(vol, "fs") or vol.fs is None:
-                vol.fs = filesystem.open(vol)
-                self.target.log.debug("Opened filesystem: %s on %s", vol.fs, vol)
-            self.target.filesystems.add(vol.fs)
-        except FilesystemError as e:
-            self.target.log.warning("Can't identify filesystem: %s", vol)
-            self.target.log.debug("", exc_info=e)
-
     def apply(self) -> None:
-        todo = self.entries
+        # We don't want later additions to modify the todo, so make a copy
+        todo = self.entries[:]
+        fs_volumes = []
+        lvm_volumes = []
+        encrypted_volumes = []
 
         while todo:
             new_volumes = []
@@ -738,23 +749,35 @@ class VolumeCollection(Collection[volume.Volume]):
                 else:
                     # We could be getting "regular" volume systems out of LVM or encrypted volumes
                     # Try to open each volume as a regular volume system, or add as a filesystem if it fails
+                    # There are a few scenarios were we want to discard the opened volume, though
+                    #
+                    # If the current volume offset is 0 and originates from a "regular" volume system, we're likely
+                    # opening a volume system on the same disk again
+                    # Sometimes BSD systems are configured this way and an FFS volume "starts" at offset 0
+                    #
+                    # If we opened an empty volume system, it might also be the case that a filesystem actually
+                    # "starts" at offset 0
+
+                    # Regardless of what happens, we want to try to open it as a filesystem later on
+                    fs_volumes.append(vol)
+
+                    if vol.offset == 0 and vol.vs and vol.vs.__type__ == "disk":
+                        # We are going to re-open a volume system on itself, bail out
+                        self.target.log.info("Found volume with offset 0, opening as raw volume instead")
+                        continue
+
                     try:
                         vs = volume.open(vol)
                     except Exception:
                         # If opening a volume system fails, there's likely none, so open as a filesystem instead
-                        self.open(vol)
                         continue
 
                     if not len(vs.volumes):
-                        self.open(vol)
+                        # We opened an empty volume system, discard
                         continue
 
-                    for new_vol in vs.volumes:
-                        if new_vol.offset == 0:
-                            self.target.log.info("Found volume with offset 0, opening as raw volume instead")
-                            self.open(new_vol)
-                            continue
-                        new_volumes.append(new_vol)
+                    self.entries.extend(vs.volumes)
+                    new_volumes.extend(vs.volumes)
 
             self.target.log.debug("LVM volumes found: %s", lvm_volumes)
             self.target.log.debug("Encrypted volumes found: %s", encrypted_volumes)
@@ -773,20 +796,30 @@ class VolumeCollection(Collection[volume.Volume]):
 
             todo = new_volumes
 
-        # ASDF - getting the correct starting system volume
-        start_fs = None
-        start_vol = None
-        for idx, vol in enumerate(self.entries):
-            if start_fs is None and (vol.name is None):
-                start_fs = idx
+        mv_fs_volumes = []
+        for vol in fs_volumes:
+            try:
+                if getattr(vol, "fs", None) is None:
+                    if filesystem.is_multi_volume_filesystem(vol):
+                        mv_fs_volumes.append(vol)
+                    else:
+                        vol.fs = filesystem.open(vol)
+                        self.target.log.debug("Opened filesystem: %s on %s", vol.fs, vol)
 
-            if start_vol is None and start_fs is not None and (vol.name is not None and vol.fs is None):
-                start_vol = idx
+                if getattr(vol, "fs", None) is not None:
+                    self.target.filesystems.add(vol.fs)
+            except FilesystemError as e:
+                self.target.log.warning("Can't identify filesystem: %s", vol)
+                self.target.log.debug("", exc_info=e)
 
-            if start_fs is not None and start_vol is not None and (vol.name is not None and vol.fs is None):
-                rel_vol = idx - start_vol
-                vol.fs = self.entries[start_fs + rel_vol].fs
+        for fs in filesystem.open_multi_volume(mv_fs_volumes):
+            self.target.filesystems.add(fs)
+            for vol in fs.volume:
+                vol.fs = fs
 
 
 class FilesystemCollection(Collection[filesystem.Filesystem]):
-    pass
+    def apply(self) -> None:
+        for fs in self.entries:
+            for subfs in fs.iter_subfs():
+                self.add(subfs)

dissect/target/tools/info.py

@@ -86,7 +86,8 @@ def main():
                     print("-" * 70)
                 print_target_info(target)
         except Exception as e:
-            target.log.error("Exception in retrieving information for target: `%s`", target, exc_info=e)
+            target.log.error("Exception in retrieving information for target: `%s`. Use `-vv` for details.", target)
+            target.log.debug("", exc_info=e)
 
 
 def get_target_info(target: Target) -> dict[str, Union[str, list[str]]]:

dissect/target/tools/mount.py

@@ -3,6 +3,7 @@ import logging
 from typing import Union
 
 from dissect.target import Target, filesystem
+from dissect.target.helpers.utils import parse_options_string
 from dissect.target.tools.utils import (
     catch_sigpipe,
     configure_generic_arguments,
@@ -70,7 +71,7 @@ def main():
         vfs.mount(fname, fs)
 
     # This is kinda silly because fusepy will convert this back into string arguments
-    options = _parse_options(args.options) if args.options else {}
+    options = parse_options_string(args.options) if args.options else {}
 
     options["nothreads"] = True
     options["allow_other"] = True
@@ -83,17 +84,6 @@ def main():
         parser.exit("FUSE error")
 
 
-def _parse_options(options: str) -> dict[str, Union[str, bool]]:
-    result = {}
-    for opt in options.split(","):
-        if "=" in opt:
-            key, _, value = opt.partition("=")
-            result[key] = value
-        else:
-            result[opt] = True
-    return result
-
-
 def _format_options(options: dict[str, Union[str, bool]]) -> str:
     return ",".join([key if value is True else f"{key}={value}" for key, value in options.items()])
 

dissect/target/tools/shell.py

@@ -171,6 +171,7 @@ class TargetCmd(cmd.Cmd):
         if command_args_str is not None:
             lexer = shlex.shlex(command_args_str, posix=True, punctuation_chars=True)
             lexer.wordchars += "$"
+            lexer.whitespace_split = True
             argparts = list(lexer)
 
         try:
@@ -448,7 +449,7 @@ class TargetCli(TargetCmd):
                 # entries has an alternative data stream and also list them.
                 entry = file_.get()
                 if isinstance(entry, RootFilesystemEntry):
-                    if entry.entries.fs.__fstype__ == "ntfs":
+                    if entry.entries.fs.__type__ == "ntfs":
                         attrs = entry.lattr()
                         for data_stream in attrs.DATA:
                             if data_stream.name != "":
@@ -888,7 +889,7 @@ class UnixConfigTreeCli(TargetCli):
         if isinstance(path, fsutil.TargetPath):
             return path
 
-        # It uses the alt seperator of the underlying fs
+        # It uses the alt separator of the underlying fs
         path = fsutil.abspath(path, cwd=str(self.cwd), alt_separator=self.target.fs.alt_separator)
         return self.config_tree.path(path)
 

dissect/target/volume.py

@@ -57,6 +57,11 @@ class VolumeSystem:
         serial: Serial number of the volume system, if any.
     """
 
+    # Due to lazy importing we generally can't use isinstance(), so we add a short identifying string to each class
+    # This has the added benefit of having a readily available "pretty name" for each implementation
+    __type__: str = None
+    """A short string identifying the type of volume system."""
+
     def __init__(
         self, fh: Union[BinaryIO, list[BinaryIO]], dsk: Optional[Container] = None, serial: Optional[str] = None
     ):
@@ -65,6 +70,9 @@ class VolumeSystem:
         self.serial = serial
         self._volumes_list: list[Volume] = None
 
+        if self.__type__ is None:
+            raise NotImplementedError(f"{self.__class__.__name__} must define __type__")
+
     def __repr__(self) -> str:
         return f"<{self.__class__.__name__} serial={self.serial}>"
 
@@ -124,20 +132,13 @@ class EncryptedVolumeSystem(VolumeSystem):
     It adds helper functions for interacting with the :attr:`~dissect.target.helpers.keychain.KEYCHAIN`,
     so that subclasses don't have to manually interact with it.
 
-    Subclasses must set the ``PROVIDER`` class attribute to a unique string, e.g. ``bitlocker``.
-
     Args:
         fh: The file-like object on which to open the encrypted volume system.
     """
 
-    PROVIDER: str = None
-
     def __init__(self, fh: BinaryIO, *args, **kwargs):
         super().__init__(fh, *args, **kwargs)
-
-        if not self.PROVIDER:
-            raise ValueError("Provider identifier is not set")
-        self.keys = keychain.get_keys_for_provider(self.PROVIDER) + keychain.get_keys_without_provider()
+        self.keys = keychain.get_keys_for_provider(self.__type__) + keychain.get_keys_without_provider()
 
     def get_keys_for_identifier(self, identifier: str) -> list[keychain.Key]:
         """Retrieves a list of keys that match a single ``identifier``.
@@ -399,7 +400,7 @@ def open_encrypted(volume: BinaryIO) -> Iterator[Volume]:
             log.debug("", exc_info=e)
         except Exception as e:
             log.error(
-                "Failed to open an encrypted volume %s with volume manager %s: %s", volume, manager_cls.PROVIDER, e
+                "Failed to open an encrypted volume %s with volume manager %s: %s", volume, manager_cls.__type__, e
             )
             log.debug("", exc_info=e)
     return None

dissect/target/volumes/bde.py

@@ -17,7 +17,7 @@ class BitlockerVolumeSystemError(VolumeSystemError):
 
 
 class BitlockerVolumeSystem(EncryptedVolumeSystem):
-    PROVIDER = "bitlocker"
+    __type__ = "bitlocker"
 
     def __init__(self, fh: Union[BinaryIO, list[BinaryIO]], *args, **kwargs):
         super().__init__(fh, *args, **kwargs)

dissect/target/volumes/ddf.py

@@ -8,6 +8,8 @@ from dissect.target.volume import LogicalVolumeSystem, Volume
 
 
 class DdfVolumeSystem(LogicalVolumeSystem):
+    __type__ = "ddf"
+
     def __init__(self, fh: Union[BinaryIO, list[BinaryIO]], *args, **kwargs):
         self.ddf = DDF(fh)
         super().__init__(fh, *args, **kwargs)

dissect/target/volumes/disk.py

@@ -6,6 +6,8 @@ from dissect.target.volume import Volume, VolumeSystem
 
 
 class DissectVolumeSystem(VolumeSystem):
+    __type__ = "disk"
+
     def __init__(self, fh: Union[BinaryIO, list[BinaryIO]], *args, **kwargs):
         self._disk = disk.Disk(fh)
         super().__init__(fh, serial=self._disk.serial, *args, **kwargs)

dissect/target/volumes/luks.py

@@ -17,7 +17,7 @@ class LUKSVolumeSystemError(VolumeSystemError):
 
 
 class LUKSVolumeSystem(EncryptedVolumeSystem):
-    PROVIDER = "luks"
+    __type__ = "luks"
 
     def __init__(self, fh: Union[BinaryIO, list[BinaryIO]], *args, **kwargs):
         super().__init__(fh, *args, **kwargs)

dissect/target/volumes/lvm.py

@@ -22,6 +22,8 @@ KNOWN_SKIP_TYPES = (
 
 
 class LvmVolumeSystem(LogicalVolumeSystem):
+    __type__ = "lvm"
+
     def __init__(self, fh: Union[BinaryIO, list[BinaryIO]], *args, **kwargs):
         self.lvm = lvm.LVM2(fh)
         super().__init__(fh, *args, **kwargs)

dissect/target/volumes/md.py

@@ -7,6 +7,8 @@ from dissect.target.volume import LogicalVolumeSystem, Volume
 
 
 class MdVolumeSystem(LogicalVolumeSystem):
+    __type__ = "md"
+
     def __init__(self, fh: Union[BinaryIO, list[BinaryIO]], *args, **kwargs):
         self.md = MD(fh)
         super().__init__(fh, *args, **kwargs)

dissect/target/volumes/vmfs.py

@@ -11,6 +11,8 @@ log = logging.getLogger(__name__)
 
 
 class VmfsVolumeSystem(LogicalVolumeSystem):
+    __type__ = "vmfs"
+
     def __init__(self, fh: Union[BinaryIO, list[BinaryIO]], *args, **kwargs):
         self.lvm = lvm.LVM(fh)
         super().__init__(fh, *args, **kwargs)

{dissect.target-3.13.dev26.dist-info → dissect.target-3.14.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.13.dev26
+Version: 3.14
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3
@@ -38,6 +38,7 @@ Requires-Dist: dissect.target[full] ; extra == 'cb'
 Requires-Dist: carbon-black-cloud-sdk-python ~=1.4.3 ; extra == 'cb'
 Provides-Extra: full
 Requires-Dist: asn1crypto ; extra == 'full'
+Requires-Dist: dissect.btrfs <2.0.dev,>=1.0.dev ; extra == 'full'
 Requires-Dist: dissect.cim <4.0.dev,>=3.0.dev ; extra == 'full'
 Requires-Dist: dissect.clfs <2.0.dev,>=1.0.dev ; extra == 'full'
 Requires-Dist: dissect.esedb <4.0.dev,>=3.0.dev ; extra == 'full'