dissect.target 3.15.dev20__tar.gz → 3.15.dev21__tar.gz

{dissect.target-3.15.dev20/dissect.target.egg-info → dissect.target-3.15.dev21}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.15.dev20
+Version: 3.15.dev21
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.15.dev20 → dissect.target-3.15.dev21}/dissect/target/plugins/filesystem/ntfs/mft.py

@@ -123,6 +123,12 @@ class MftPlugin(Plugin):
 
         The Master File Table (MFT) contains primarily metadata about every file and folder on a NFTS filesystem.
 
+        If the filesystem is part of a virtual NTFS filesystem (a ``VirtualFilesystem`` with the MFT properties
+        added to it through a "fake" ``NtfsFilesystem``), the paths returned in the MFT records are based on the
+        mount point of the ``VirtualFilesystem``. This ensures that the proper original drive letter is used when
+        available.
+        When no drive letter can be determined, the path will show as e.g. ``\\$fs$\\fs0``.
+
         References:
             - https://docs.microsoft.com/en-us/windows/win32/fileio/master-file-table
         """
@@ -136,6 +142,10 @@ class MftPlugin(Plugin):
             if fs.__type__ != "ntfs":
                 continue
 
+            # If this filesystem is a "fake" NTFS filesystem, used to enhance a
+            # VirtualFilesystem, The driveletter (more accurate mount point)
+            # returned will be that of the VirtualFilesystem. This makes sure
+            # the paths returned in the records are actually reachable.
             drive_letter = get_drive_letter(self.target, fs)
             volume_uuid = get_volume_identifier(fs)
 

{dissect.target-3.15.dev20 → dissect.target-3.15.dev21}/dissect/target/plugins/filesystem/ntfs/mft_timeline.py

@@ -105,6 +105,12 @@ class MftTimelinePlugin(Plugin):
 
         The Master File Table (MFT) contains metadata about every file and folder on a NFTS filesystem.
 
+        If the filesystem is part of a virtual NTFS filesystem (a ``VirtualFilesystem`` with the MFT properties
+        added to it through a "fake" ``NtfsFilesystem``), the paths returned in the MFT records are based on the
+        mount point of the ``VirtualFilesystem``. This ensures that the proper original drive letter is used when
+        available.
+        When no drive letter can be determined, the path will show as e.g. ``\\$fs$\\fs0``.
+
         References:
             - https://docs.microsoft.com/en-us/windows/win32/fileio/master-file-table
         """
@@ -112,6 +118,10 @@ class MftTimelinePlugin(Plugin):
             if fs.__type__ != "ntfs":
                 continue
 
+            # If this filesystem is a "fake" NTFS filesystem, used to enhance a
+            # VirtualFilesystem, The driveletter (more accurate mount point)
+            # returned will be that of the VirtualFilesystem. This makes sure
+            # the paths returned in the records are actually reachable.
             drive_letter = get_drive_letter(self.target, fs)
             extras = Extras(
                 serial=fs.ntfs.serial,

{dissect.target-3.15.dev20 → dissect.target-3.15.dev21}/dissect/target/plugins/filesystem/ntfs/usnjrnl.py

@@ -34,6 +34,12 @@ class UsnjrnlPlugin(Plugin):
         The Update Sequence Number Journal (UsnJrnl) is a feature of an NTFS file system and contains information about
         filesystem activities. Each volume has its own UsnJrnl.
 
+        If the filesystem is part of a virtual NTFS filesystem (a ``VirtualFilesystem`` with the UsnJrnl
+        properties added to it through a "fake" ``NtfsFilesystem``), the paths returned in the UsnJrnl records
+        are based on the mount point of the ``VirtualFilesystem``. This ensures that the proper original drive
+        letter is used when available.
+        When no drive letter can be determined, the path will show as e.g. ``\\$fs$\\fs0``.
+
         References:
             - https://en.wikipedia.org/wiki/USN_Journal
             - https://velociraptor.velocidex.com/the-windows-usn-journal-f0c55c9010e
@@ -47,6 +53,10 @@ class UsnjrnlPlugin(Plugin):
             if not usnjrnl:
                 continue
 
+            # If this filesystem is a "fake" NTFS filesystem, used to enhance a
+            # VirtualFilesystem, The driveletter (more accurate mount point)
+            # returned will be that of the VirtualFilesystem. This makes sure
+            # the paths returned in the records are actually reachable.
             drive_letter = get_drive_letter(self.target, fs)
             for record in usnjrnl.records():
                 try:

{dissect.target-3.15.dev20 → dissect.target-3.15.dev21}/dissect/target/plugins/filesystem/ntfs/utils.py

@@ -1,3 +1,4 @@
+import re
 from enum import Enum, auto
 from typing import Optional, Tuple
 from uuid import UUID
@@ -8,6 +9,8 @@ from dissect.ntfs.mft import MftRecord
 from dissect.target import Target
 from dissect.target.filesystems.ntfs import NtfsFilesystem
 
+DRIVE_LETTER_RE = re.compile(r"[a-zA-Z]:")
+
 
 class InformationType(Enum):
     STANDARD_INFORMATION = auto()
@@ -20,13 +23,33 @@ def get_drive_letter(target: Target, filesystem: NtfsFilesystem):
 
     When the drive letter is not available for that filesystem it returns empty.
     """
+    # A filesystem can be known under multiple drives (mount points). If it is
+    # a windows system volume, there are the default sysvol and c: drives.
+    # If the target has a virtual ntfs filesystem, e.g. as constructed by the
+    # tar and dir loaders, there is also the /$fs$/fs<n> drive, under which the
+    # "fake" ntfs filesystem is mounted.
+    # The precedence for drives is first the drive letter drives (e.g. c:),
+    # second the "normally" named drives (e.g. sysvol) and finally the anonymous
+    # drives (e.g. /$fs/fs0).
     mount_items = (item for item in target.fs.mounts.items() if hasattr(item[1], "ntfs"))
-    driveletters = [key for key, fs in mount_items if fs.ntfs is filesystem.ntfs]
+    drives = [key for key, fs in mount_items if fs.ntfs is filesystem.ntfs]
+
+    single_letter_drives = []
+    other_drives = []
+    anon_drives = []
+
+    for drive in drives:
+        if DRIVE_LETTER_RE.match(drive):
+            single_letter_drives.append(drive)
+        elif "$fs$" in drive:
+            anon_drives.append(drive)
+        else:
+            other_drives.append(drive)
+
+    drives = sorted(single_letter_drives) + sorted(other_drives) + sorted(anon_drives)
 
-    if driveletters:
-        # Currently, mount_dict contain 2 instances of the same filesystem: 'sysvol' and 'c:'
-        # This is to choose the latter which will be 'c:'
-        return f"{driveletters[-1]}\\"
+    if drives:
+        return f"{drives[0]}\\"
     else:
         return ""
 

{dissect.target-3.15.dev20 → dissect.target-3.15.dev21/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.15.dev20
+Version: 3.15.dev21
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.15.dev20 → dissect.target-3.15.dev21}/tests/plugins/filesystem/ntfs/test_mft.py

@@ -37,11 +37,26 @@ def load_mft_plugin(target_win):
     target_win.add_plugin(MftPlugin)
 
 
-def test_driveletter():
+@pytest.mark.parametrize(
+    "drive_letters, expected",
+    [
+        (("z:", "c:", "a:"), "a:\\"),
+        (("foo", "bar", "bla"), "bar\\"),
+        (("$fs$\\fs2", "$fs$\\fs1", "$fs$\\fs0"), "$fs$\\fs0\\"),
+        (("sysvol", "c:"), "c:\\"),
+        (("sysvol", "c:", "a:"), "a:\\"),
+        (("$fs$\\fs0", "sysvol", "c:"), "c:\\"),
+        (("$fs$\\fs0", "sysvol"), "sysvol\\"),
+        (("$fs$\\fs0",), "$fs$\\fs0\\"),
+    ],
+)
+def test_driveletter(drive_letters, expected):
     mocked_target = Mock()
-    mocked_cdisk = Mock()
-    mocked_target.fs.mounts = {"sysvol": mocked_cdisk, "c:": mocked_cdisk}
-    assert get_drive_letter(mocked_target, mocked_cdisk) == "c:\\"
+    mocked_disk = Mock()
+    num_drives = len(drive_letters)
+    mocked_target.fs.mounts = dict(zip(drive_letters, [mocked_disk] * num_drives))
+
+    assert get_drive_letter(mocked_target, mocked_disk) == expected
 
 
 def test_driveletter_unknown():