dissect.target 3.14.dev20__py3-none-any.whl → 3.14.dev23__py3-none-any.whl

dissect/target/plugins/filesystem/yara.py

@@ -5,7 +5,7 @@ try:
 except ImportError:
     raise ImportError("Please install 'yara-python' to use 'target-query -f yara'.")
 
-from dissect.target.exceptions import FileNotFoundError, UnsupportedPluginError
+from dissect.target.exceptions import FileNotFoundError
 from dissect.target.helpers.record import TargetRecordDescriptor
 from dissect.target.plugin import Plugin, arg, export
 
@@ -26,8 +26,7 @@ class YaraPlugin(Plugin):
     DEFAULT_MAX_SIZE = 10 * 1024 * 1024
 
     def check_compatible(self) -> None:
-        if not self.target.has_function("walkfs"):
-            raise UnsupportedPluginError("No walkfs plugin found")
+        pass
 
     @arg("--rule-files", "-r", type=Path, nargs="+", required=True, help="path to YARA rule file")
     @arg("--scan-path", default="/", help="path to recursively scan")
@@ -43,20 +42,22 @@ class YaraPlugin(Plugin):
         rule_data = "\n".join([rule_file.read_text() for rule_file in rule_files])
 
         rules = yara.compile(source=rule_data)
-        for entry, _ in self.target.walkfs_ext(scan_path):
-            try:
-                if not entry.is_file() or entry.stat().st_size > max_size:
+        for _, _, files in self.target.fs.walk_ext(scan_path):
+            for file_entry in files:
+                path = self.target.fs.path(file_entry.path)
+                try:
+                    if path.stat().st_size > max_size:
+                        continue
+
+                    for match in rules.match(data=path.read_bytes()):
+                        yield YaraMatchRecord(
+                            path=path,
+                            digest=path.get().hash(),
+                            rule=match.rule,
+                            tags=match.tags,
+                            _target=self.target,
+                        )
+                except FileNotFoundError:
                     continue
-
-                for match in rules.match(data=entry.read_bytes()):
-                    yield YaraMatchRecord(
-                        path=entry,
-                        digest=entry.get().hash(),
-                        rule=match.rule,
-                        tags=match.tags,
-                        _target=self.target,
-                    )
-            except FileNotFoundError:
-                continue
-            except Exception:
-                self.target.log.exception("Error scanning file: %s", entry)
+                except Exception:
+                    self.target.log.exception("Error scanning file: %s", path)

dissect/target/plugins/os/unix/_os.py

@@ -6,8 +6,6 @@ import uuid
 from struct import unpack
 from typing import Iterator, Optional, Union
 
-from flow.record.fieldtypes import posix_path
-
 from dissect.target.filesystem import Filesystem
 from dissect.target.helpers.fsutil import TargetPath
 from dissect.target.helpers.record import UnixUserRecord
@@ -62,7 +60,7 @@ class UnixPlugin(OSPlugin):
                         uid=pwent.get(2),
                         gid=pwent.get(3),
                         gecos=pwent.get(4),
-                        home=posix_path(pwent.get(5)),
+                        home=self.target.fs.path(pwent.get(5)),
                         shell=pwent.get(6),
                         source=passwd_file,
                         _target=self.target,

dissect/target/plugins/os/unix/bsd/osx/user.py

@@ -1,8 +1,6 @@
 import plistlib
 from typing import Iterator
 
-from flow.record.fieldtypes import posix_path
-
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
 from dissect.target.helpers.record import create_extended_descriptor
@@ -49,7 +47,7 @@ class UserPlugin(Plugin):
                         password_last_time=account_policy.get("passwordLastSetTime"),
                         failed_login_count=account_policy.get("failedLoginCount"),
                         failed_login_time=account_policy.get("failedLoginTimestamp"),
-                        source=posix_path(user_details.user.source),
+                        source=self.target.fs.path(user_details.user.source),
                         _user=user_details.user,
                         _target=self.target,
                     )

dissect/target/plugins/os/unix/esxi/_os.py

@@ -12,7 +12,6 @@ from typing import Any, BinaryIO, Iterator, Optional, TextIO
 from defusedxml import ElementTree
 from dissect.hypervisor.util import vmtar
 from dissect.sql import sqlite3
-from flow.record.fieldtypes import path
 
 try:
     from dissect.hypervisor.util.envelope import Envelope, KeyStore
@@ -159,7 +158,7 @@ class ESXiPlugin(UnixPlugin):
         root = ElementTree.fromstring(inv_file.read_text("utf-8"))
         for entry in root.iter("ConfigEntry"):
             yield VirtualMachineRecord(
-                path=path.from_posix(entry.findtext("vmxCfgPath")),
+                path=self.target.fs.path(entry.findtext("vmxCfgPath")),
                 _target=self.target,
             )
 

dissect/target/plugins/os/unix/log/journal.py

@@ -5,7 +5,6 @@ import zstandard
 from dissect.cstruct import Instance, cstruct
 from dissect.util import ts
 from dissect.util.compression import lz4
-from flow.record.fieldtypes import path
 
 from dissect.target import Target
 from dissect.target.exceptions import UnsupportedPluginError
@@ -394,6 +393,8 @@ class JournalPlugin(Plugin):
             - https://github.com/systemd/systemd/blob/9203abf79f1d05fdef9b039e7addf9fc5a27752d/man/systemd.journal-fields.xml
         """  # noqa: E501
 
+        path_function = self.target.fs.path
+
         for _path in self.journal_paths:
             fh = _path.open()
 
@@ -409,7 +410,7 @@ class JournalPlugin(Plugin):
                     message=entry.get("message"),
                     message_id=entry.get("message_id"),
                     priority=get_optional(entry.get("priority"), int),
-                    code_file=get_optional(entry.get("code_file"), path.from_posix),
+                    code_file=get_optional(entry.get("code_file"), path_function),
                     code_line=get_optional(entry.get("code_line"), int),
                     code_func=entry.get("code_func"),
                     errno=get_optional(entry.get("errno"), int),
@@ -427,12 +428,12 @@ class JournalPlugin(Plugin):
                     uid=get_optional(entry.get("uid"), int),
                     gid=get_optional(entry.get("gid"), int),
                     comm=entry.get("comm"),
-                    exe=get_optional(entry.get("exe"), path.from_posix),
+                    exe=get_optional(entry.get("exe"), path_function),
                     cmdline=entry.get("cmdline"),
                     cap_effective=entry.get("cap_effective"),
                     audit_session=get_optional(entry.get("audit_session"), int),
                     audit_loginuid=get_optional(entry.get("audit_loginuid"), int),
-                    systemd_cgroup=get_optional(entry.get("systemd_cgroup"), path.from_posix),
+                    systemd_cgroup=get_optional(entry.get("systemd_cgroup"), path_function),
                     systemd_slice=entry.get("systemd_slice"),
                     systemd_unit=entry.get("systemd_unit"),
                     systemd_user_unit=entry.get("systemd_user_unit"),
@@ -451,8 +452,8 @@ class JournalPlugin(Plugin):
                     kernel_device=entry.get("kernel_device"),
                     kernel_subsystem=entry.get("kernel_subsystem"),
                     udev_sysname=entry.get("udev_sysname"),
-                    udev_devnode=get_optional(entry.get("udev_devnode"), path.from_posix),
-                    udev_devlink=get_optional(entry.get("udev_devlink"), path.from_posix),
+                    udev_devnode=get_optional(entry.get("udev_devnode"), path_function),
+                    udev_devlink=get_optional(entry.get("udev_devlink"), path_function),
                     journal_hostname=entry.get("hostname"),
                     filepath=_path,
                     _target=self.target,

dissect/target/plugins/os/windows/_os.py

@@ -77,7 +77,8 @@ class WindowsPlugin(OSPlugin):
                                             self.target.fs.mount(drive, volume.fs)
                                             break
         except Exception as e:
-            self.target.log.warning("Failed to map drive letters", exc_info=e)
+            self.target.log.warning("Failed to map drive letters")
+            self.target.log.debug("", exc_info=e)
 
     @export(property=True)
     def hostname(self) -> Optional[str]:

dissect/target/plugins/os/windows/amcache.py

@@ -1,7 +1,6 @@
 from datetime import datetime, timezone
 
 from dissect.util.ts import wintimestamp
-from flow.record.fieldtypes import path
 
 from dissect.target.exceptions import RegistryKeyNotFoundError, UnsupportedPluginError
 from dissect.target.helpers import regutil
@@ -220,7 +219,7 @@ class AmcachePluginOldMixin:
                     created_timestamp=parse_win_timestamp(subkey_data.get("created_timestamp")),
                     mtime_regf=subkey.timestamp,
                     reference=int(subkey.name, 16),
-                    path=path.from_windows(subkey_data["full_path"]) if subkey_data.get("full_path") else None,
+                    path=self.target.fs.path(subkey_data["full_path"]) if subkey_data.get("full_path") else None,
                     language_code=subkey_data.get("language_code"),
                     digests=[None, subkey_data["sha1"][-40:] if subkey_data.get("sha1") else None, None],
                     program_id=subkey_data.get("program_id"),
@@ -265,7 +264,7 @@ class AmcachePluginOldMixin:
                         language_code=entry_data.get("LanguageCode"),
                         entry_type=entry_data.get("EntryType"),
                         uninstall_key=entry_data.get("UninstallKey"),
-                        path=path.from_windows(file_path_entry),
+                        path=self.target.fs.path(file_path_entry),
                         product_code=entry_data.get("ProductCode"),
                         package_code=entry_data.get("PackageCode"),
                         msi_package_code=entry_data.get("MsiPackageCode"),
@@ -284,7 +283,7 @@ class AmcachePluginOldMixin:
                         language_code=entry_data.get("LanguageCode"),
                         entry_type=entry_data.get("EntryType"),
                         uninstall_key=entry_data.get("UninstallKey"),
-                        path=path.from_windows(file_entry),
+                        path=self.target.fs.path(file_entry),
                         product_code=entry_data.get("ProductCode"),
                         package_code=entry_data.get("PackageCode"),
                         msi_package_code=entry_data.get("MsiPackageCode"),
@@ -416,7 +415,7 @@ class AmcachePlugin(AmcachePluginOldMixin, Plugin):
                 program_instance_id=entry_data.get("ProgramInstanceId"),
                 publisher=entry_data.get("Publisher"),
                 registry_key_path=entry_data.get("RegistryKeyPath"),
-                root_dir_path=path.from_windows(entry_data.get("RootDirPath")),
+                root_dir_path=self.target.fs.path(entry_data.get("RootDirPath")),
                 source=entry_data.get("Source"),
                 uninstall_string=entry_data.get("UninstallString"),
                 type=entry_data.get("Type"),
@@ -467,7 +466,7 @@ class AmcachePlugin(AmcachePluginOldMixin, Plugin):
                 mtime_regf=entry.timestamp,
                 program_id=entry_data.get("ProgramId"),
                 digests=[None, sha1_digest, None],
-                path=path.from_windows(entry_data.get("LowerCaseLongPath")),
+                path=self.target.fs.path(entry_data.get("LowerCaseLongPath")),
                 link_date=parse_win_datetime(entry_data.get("LinkDate")),
                 hash_path=entry_data.get("LongPathHash"),
                 name=entry_data.get("Name"),
@@ -492,8 +491,8 @@ class AmcachePlugin(AmcachePluginOldMixin, Plugin):
 
             yield BinaryAppcompatRecord(
                 mtime_regf=entry.timestamp,
-                driver_name=path.from_windows(entry_data.get("DriverName")),
-                inf=path.from_windows(entry_data.get("Inf")),
+                driver_name=self.target.fs.path(entry_data.get("DriverName")),
+                inf=self.target.fs.path(entry_data.get("Inf")),
                 driver_version=entry_data.get("DriverVersion"),
                 product=entry_data.get("Product"),
                 product_version=entry_data.get("ProductVersion"),
@@ -515,7 +514,7 @@ class AmcachePlugin(AmcachePluginOldMixin, Plugin):
         for entry in self.read_key_subkeys(key):
             yield ShortcutAppcompatRecord(
                 mtime_regf=entry.timestamp,
-                path=path.from_windows(entry.value("ShortCutPath").value),
+                path=self.target.fs.path(entry.value("ShortCutPath").value),
                 _target=self.target,
             )
 
@@ -637,7 +636,7 @@ class AmcachePlugin(AmcachePluginOldMixin, Plugin):
                 parts = line.rstrip().split("|")
                 yield AppLaunchAppcompatRecord(
                     ts=datetime.strptime(parts[-1], "%Y-%m-%d %H:%M:%S.%f").replace(tzinfo=timezone.utc),
-                    path=path.from_windows(parts[0]),
+                    path=self.target.fs.path(parts[0]),
                     _target=self.target,
                 )
 

dissect/target/plugins/os/windows/catroot.py

@@ -1,5 +1,5 @@
 from asn1crypto import algos, core
-from flow.record.fieldtypes import digest, path
+from flow.record.fieldtypes import digest
 
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import TargetRecordDescriptor
@@ -118,7 +118,7 @@ class CatrootPlugin(Plugin):
 
                             yield CatrootRecord(
                                 digest=fdigest,
-                                hint=path.from_windows(filehint) if filehint else None,
+                                hint=self.target.fs.path(filehint) if filehint else None,
                                 source=f,
                                 _target=self.target,
                             )

dissect/target/plugins/os/windows/generic.py

@@ -2,7 +2,6 @@ from datetime import datetime
 from typing import Optional
 
 from dissect.util.ts import from_unix
-from flow.record.fieldtypes import path
 
 from dissect.target.exceptions import RegistryError, UnsupportedPluginError
 from dissect.target.helpers.descriptor_extensions import (
@@ -250,7 +249,7 @@ class GenericPlugin(Plugin):
                     value = r.value(name)
                     yield AppInitRecord(
                         ts=r.ts,
-                        path=path.from_windows(value.value),
+                        path=self.target.fs.path(value.value),
                         _target=self.target,
                         _user=user,
                         _key=r,
@@ -279,7 +278,7 @@ class GenericPlugin(Plugin):
                 for value in r.values():
                     yield KnownDllRecord(
                         ts=r.ts,
-                        path=path.from_windows(value.value),
+                        path=self.target.fs.path(value.value),
                         _target=self.target,
                         _user=user,
                         _key=r,
@@ -325,7 +324,7 @@ class GenericPlugin(Plugin):
 
                         yield SessionManagerRecord(
                             ts=r.ts,
-                            path=path.from_windows(d),
+                            path=self.target.fs.path(d),
                             _target=self.target,
                             _user=user,
                             _key=r,
@@ -333,7 +332,7 @@ class GenericPlugin(Plugin):
                 else:
                     yield SessionManagerRecord(
                         ts=r.ts,
-                        path=path.from_windows(data.split(" ")[0]),
+                        path=self.target.fs.path(data.split(" ")[0]),
                         _target=self.target,
                         _user=user,
                         _key=r,
@@ -427,7 +426,7 @@ class GenericPlugin(Plugin):
                     value = r.value(name)
                     yield CommandProcAutoRunRecord(
                         ts=r.ts,
-                        path=path.from_windows(value.value),
+                        path=self.target.fs.path(value.value),
                         _target=self.target,
                         _user=user,
                         _key=r,
@@ -453,7 +452,7 @@ class GenericPlugin(Plugin):
             value = r.value("AlternateShell")
             yield AlternateShellRecord(
                 ts=r.ts,
-                path=path.from_windows(value.value),
+                path=self.target.fs.path(value.value),
                 _target=self.target,
                 _user=user,
                 _key=r,
@@ -477,7 +476,7 @@ class GenericPlugin(Plugin):
 
             yield BootShellRecord(
                 ts=r.ts,
-                path=path.from_windows(value.value),
+                path=self.target.fs.path(value.value),
                 _target=self.target,
                 _user=user,
                 _key=r,
@@ -500,7 +499,7 @@ class GenericPlugin(Plugin):
             user = self.target.registry.get_user(r)
             try:
                 value = r.value("PendingFileRenameOperations")
-                paths = map(path.from_windows, value.value)
+                paths = map(self.target.fs.path, value.value)
             except RegistryError:
                 continue
 
@@ -528,7 +527,7 @@ class GenericPlugin(Plugin):
                 for v in r.values():
                     yield WinRarRecord(
                         ts=r.ts,
-                        path=path.from_windows(v.value),
+                        path=self.target.fs.path(v.value),
                         _target=self.target,
                         _user=user,
                         _key=r,
@@ -552,7 +551,7 @@ class GenericPlugin(Plugin):
                 for s in r.subkeys():
                     yield WinSockNamespaceProviderRecord(
                         ts=r.ts,
-                        librarypath=path.from_windows(s.value("LibraryPath").value),
+                        librarypath=self.target.fs.path(s.value("LibraryPath").value),
                         displaystring=s.value("DisplayString").value,
                         providerid=s.value("ProviderID").value,
                         enabled=s.value("Enabled").value,

dissect/target/plugins/os/windows/lnk.py

@@ -2,7 +2,6 @@ from typing import Iterator, Optional
 
 from dissect.shellitem.lnk import Lnk
 from dissect.util import ts
-from flow.record.fieldtypes import path
 
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.fsutil import TargetPath
@@ -88,17 +87,17 @@ class LnkPlugin(Plugin):
                 lnk_ctime = ts.from_unix(entry.stat().st_ctime)
 
                 lnk_relativepath = (
-                    path.from_windows(lnk_file.stringdata.relative_path.string)
+                    self.target.fs.path(lnk_file.stringdata.relative_path.string)
                     if lnk_file.flag("has_relative_path")
                     else None
                 )
                 lnk_workdir = (
-                    path.from_windows(lnk_file.stringdata.working_dir.string)
+                    self.target.fs.path(lnk_file.stringdata.working_dir.string)
                     if lnk_file.flag("has_working_dir")
                     else None
                 )
                 lnk_iconlocation = (
-                    path.from_windows(lnk_file.stringdata.icon_location.string)
+                    self.target.fs.path(lnk_file.stringdata.icon_location.string)
                     if lnk_file.flag("has_icon_location")
                     else None
                 )
@@ -115,9 +114,9 @@ class LnkPlugin(Plugin):
                 )
 
                 if local_base_path and common_path_suffix:
-                    lnk_full_path = path.from_windows(local_base_path + common_path_suffix)
+                    lnk_full_path = self.target.fs.path(local_base_path + common_path_suffix)
                 elif local_base_path and not common_path_suffix:
-                    lnk_full_path = path.from_windows(local_base_path)
+                    lnk_full_path = self.target.fs.path(local_base_path)
                 else:
                     lnk_full_path = None
 

dissect/target/plugins/os/windows/log/amcache.py

@@ -4,8 +4,6 @@ import re
 from datetime import datetime
 from typing import TYPE_CHECKING, Iterator, Union
 
-from flow.record.fieldtypes import path
-
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import TargetRecordDescriptor
 from dissect.target.plugin import Plugin, export
@@ -78,9 +76,9 @@ def create_record(
         modified=_to_log_timestamp(install_properties.get("modified")),
         access=_to_log_timestamp(install_properties.get("lastaccessed")),
         link_date=_to_log_timestamp(install_properties.get("linkdate")),
-        path=path.from_windows(install_properties.get("path")),
-        filename=path.from_windows(filename),
-        create=path.from_windows(create),
+        path=target.fs.path(install_properties.get("path")),
+        filename=target.fs.path(filename),
+        create=target.fs.path(create),
         size_of_image=install_properties.get("sizeofimage"),
         file_description=install_properties.get("filedescription"),
         size=install_properties.get("size"),

dissect/target/plugins/os/windows/log/pfro.py

@@ -1,8 +1,6 @@
 import datetime
 import re
 
-from flow.record.fieldtypes import path
-
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import TargetRecordDescriptor
 from dissect.target.plugin import Plugin, export
@@ -70,7 +68,7 @@ class PfroPlugin(Plugin):
 
                 yield PfroRecord(
                     ts=datetime.datetime.strptime(date, "%m/%d/%Y %H:%M:%S"),
-                    path=path.from_windows(file_path),
+                    path=self.target.fs.path(file_path),
                     operation=operation,
                     _target=self.target,
                 )

dissect/target/plugins/os/windows/prefetch.py

@@ -3,7 +3,6 @@ from io import BytesIO
 from dissect import cstruct
 from dissect.util import lzxpress_huffman
 from dissect.util.ts import wintimestamp
-from flow.record.fieldtypes import path
 
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import TargetRecordDescriptor
@@ -212,7 +211,7 @@ class Prefetch:
                 self.fn.filename_strings_offset + entry.filename_string_offset,
                 entry.filename_string_number_of_characters,
             )
-            metrics.append(path.from_windows(filename.decode("utf-16-le")))
+            metrics.append(filename.decode("utf-16-le"))
         return metrics
 
     def read_filename(self, off, size):
@@ -290,15 +289,15 @@ class PrefetchPlugin(Plugin):
                 self.target.log.warning("Failed to parse prefetch file: %s", entry, exc_info=e)
                 continue
 
-            filename = path.from_windows(scca.header.name.decode("utf-16-le", errors="ignore").split("\x00")[0])
-            entry_name = path.from_windows(entry.name)
+            filename = self.target.fs.path(scca.header.name.decode("utf-16-le", errors="ignore").split("\x00")[0])
+            entry_name = self.target.fs.path(entry.name)
 
             if grouped:
                 yield GroupedPrefetchRecord(
                     ts=scca.latest_timestamp,
                     filename=filename,
                     prefetch=entry_name,
-                    linkedfiles=list(map(path.from_windows, scca.metrics)),
+                    linkedfiles=list(map(self.target.fs.path, scca.metrics)),
                     runcount=scca.fn.run_count,
                     previousruns=scca.previous_timestamps,
                     _target=self.target,
@@ -311,7 +310,7 @@ class PrefetchPlugin(Plugin):
                             ts=date,
                             filename=filename,
                             prefetch=entry_name,
-                            linkedfile=path.from_windows(linked_file),
+                            linkedfile=self.target.fs.path(linked_file),
                             runcount=scca.fn.run_count,
                             _target=self.target,
                         )

dissect/target/plugins/os/windows/recyclebin.py

@@ -2,7 +2,6 @@ from typing import Generator
 
 from dissect import cstruct
 from dissect.util.ts import wintimestamp
-from flow.record.fieldtypes import path
 
 from dissect.target import Target
 from dissect.target.exceptions import UnsupportedPluginError
@@ -115,10 +114,10 @@ class RecyclebinPlugin(Plugin):
 
         return RecycleBinRecord(
             ts=wintimestamp(entry.timestamp),
-            path=path.from_windows(entry.filename.rstrip("\x00")),
-            source=path.from_windows(source_path),
+            path=self.target.fs.path(entry.filename.rstrip("\x00")),
+            source=self.target.fs.path(source_path),
             filesize=entry.file_size,
-            deleted_path=path.from_windows(deleted_path),
+            deleted_path=self.target.fs.path(deleted_path),
             _target=self.target,
             _user=user,
         )

dissect/target/plugins/os/windows/regf/7zip.py

@@ -1,5 +1,3 @@
-from flow.record.fieldtypes import path
-
 from dissect.target.exceptions import RegistryError, UnsupportedPluginError
 from dissect.target.helpers.record import TargetRecordDescriptor
 from dissect.target.plugin import Plugin, export
@@ -66,7 +64,7 @@ class SevenZipPlugin(Plugin):
 
                 yield record(
                     ts=subkey.ts,
-                    path=path.from_windows(file_path),
+                    path=self.target.fs.path(file_path),
                     _target=self.target,
                 )
         except RegistryError:
@@ -90,7 +88,7 @@ class SevenZipPlugin(Plugin):
                 value = subkey.value("PanelPath0").value
                 yield PanelPathRecord(
                     ts=subkey.ts,
-                    path=path.from_windows(value),
+                    path=self.target.fs.path(value),
                     _target=self.target,
                 )
             except RegistryError:

dissect/target/plugins/os/windows/regf/bam.py

@@ -1,6 +1,5 @@
 from dissect.cstruct import cstruct
 from dissect.util.ts import wintimestamp
-from flow.record.fieldtypes import path
 
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import TargetRecordDescriptor
@@ -57,6 +56,6 @@ class BamDamPlugin(Plugin):
                         data = c_bam.entry(entry.value)
                         yield BamDamRecord(
                             ts=wintimestamp(data.ts),
-                            path=path.from_windows(entry.name),
+                            path=self.target.fs.path(entry.name),
                             _target=self.target,
                         )

dissect/target/plugins/os/windows/regf/cit.py

@@ -11,7 +11,6 @@ from io import BytesIO
 from dissect.cstruct import cstruct
 from dissect.util.compression import lznt1
 from dissect.util.ts import wintimestamp
-from flow.record.fieldtypes import path
 
 from dissect.target.exceptions import RegistryValueNotFoundError, UnsupportedPluginError
 from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
@@ -735,7 +734,7 @@ class CITPlugin(Plugin):
                             start_time=local_wintimestamp(self.target, cit.header.StartTimeLocal),
                             current_time=local_wintimestamp(self.target, cit.header.CurrentTimeLocal),
                             aggregation_period_in_s=cit.header.AggregationPeriodInS,
-                            path=path.from_windows(entry.file_path),
+                            path=self.target.fs.path(entry.file_path),
                             command_line=entry.command_line,
                             pe_timedatestamp=program_data.PeTimeDateStamp,
                             pe_checksum=program_data.PeCheckSum,
@@ -895,7 +894,7 @@ class CITPlugin(Plugin):
                     yield CITTelemetryRecord(
                         regf_mtime=version_key.ts,
                         version=version_key.name,
-                        path=path.from_windows(value.name),
+                        path=self.target.fs.path(value.name),
                         value=str(c_cit.TELEMETRY_ANSWERS(value.value)).split(".")[1],
                         _target=self.target,
                     )
@@ -941,8 +940,8 @@ class CITPlugin(Plugin):
                     yield CITModuleRecord(
                         last_loaded=wintimestamp(value.value),
                         regf_mtime=monitored_dll.ts,
-                        tracked_module=path.from_windows(monitored_dll.name),
-                        executable=path.from_windows(value.name),
+                        tracked_module=self.target.fs.path(monitored_dll.name),
+                        executable=self.target.fs.path(value.name),
                         # These are actually specific for the tracked module, but just include them in every record
                         overflow_quota=overflow_quota,
                         overflow_value=overflow_value,

dissect/target/plugins/os/windows/regf/muicache.py

@@ -1,7 +1,5 @@
 from typing import Generator
 
-from flow.record.fieldtypes import path
-
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.descriptor_extensions import (
     RegistryRecordDescriptorExtension,
@@ -84,7 +82,7 @@ class MuiCachePlugin(Plugin):
                     index=index,
                     name=name,
                     value=entry.value,
-                    path=path.from_windows(entry_path),
+                    path=self.target.fs.path(entry_path),
                     _target=self.target,
                     _key=key,
                     _user=user,

dissect/target/plugins/os/windows/regf/recentfilecache.py

@@ -1,5 +1,4 @@
 from dissect import cstruct
-from flow.record.fieldtypes import path
 
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import TargetRecordDescriptor
@@ -59,7 +58,7 @@ class RecentFileCachePlugin(Plugin):
                 entry.path = entry.path.rstrip("\x00")
 
                 yield RecentFileCacheRecord(
-                    path=path.from_windows(entry.path),
+                    path=self.target.fs.path(entry.path),
                     _target=self.target,
                 )
             except EOFError:

dissect/target/plugins/os/windows/regf/shimcache.py

@@ -6,7 +6,6 @@ from typing import Callable, Generator, Optional, Tuple, Union
 
 from dissect.cstruct import Structure, cstruct
 from dissect.util.ts import wintimestamp
-from flow.record.fieldtypes import path
 
 from dissect.target.exceptions import Error, RegistryError, UnsupportedPluginError
 from dissect.target.helpers.record import TargetRecordDescriptor
@@ -358,6 +357,6 @@ class ShimcachePlugin(Plugin):
                 last_modified=ts,
                 name=name,
                 index=index,
-                path=path.from_windows(self.target.resolve(file_path)),
+                path=self.target.fs.path(self.target.resolve(file_path)),
                 _target=self.target,
             )

dissect/target/plugins/os/windows/regf/trusteddocs.py

@@ -73,7 +73,7 @@ class TrustedDocumentsPlugin(Plugin):
                     ts=key.ts,
                     type=value.type,
                     application=application,
-                    document_path=self.target.resolve(value.name),
+                    document_path=self.target.fs.path(self.target.resolve(value.name)),
                     value=value.value,
                     _key=key,
                     _user=user,