dissect.target 3.17.dev18__py3-none-any.whl → 3.17.dev20__py3-none-any.whl

dissect/target/filesystem.py

@@ -525,21 +525,21 @@ class FilesystemEntry:
             follow_symlinks: Whether to resolve the entry if it is a symbolic link.
 
         Returns:
-            The resolved symbolic link if ``follow_symlinks`` is ``True`` and the ``FilesystemEntry`` is a
-            symbolic link or else the ``FilesystemEntry`` itself.
+            The resolved symbolic link if ``follow_symlinks`` is ``True`` and the :class:`FilesystemEntry` is a
+            symbolic link or else the :class:`FilesystemEntry` itself.
         """
         if follow_symlinks and self.is_symlink():
             return self.readlink_ext()
         return self
 
     def get(self, path: str) -> FilesystemEntry:
-        """Retrieve a FilesystemEntry relative to this entry.
+        """Retrieve a :class:`FilesystemEntry` relative to this entry.
 
         Args:
             path: The path relative to this filesystem entry.
 
         Returns:
-            A relative FilesystemEntry.
+            A relative :class:`FilesystemEntry`.
         """
         raise NotImplementedError()
 
@@ -560,10 +560,10 @@ class FilesystemEntry:
         raise NotImplementedError()
 
     def scandir(self) -> Iterator[FilesystemEntry]:
-        """Iterate over the contents of a directory, return them as FilesystemEntry's.
+        """Iterate over the contents of a directory, yields :class:`FilesystemEntry`.
 
         Returns:
-            An iterator of directory entries as FilesystemEntry's.
+            An iterator of :class:`FilesystemEntry`.
         """
         raise NotImplementedError()
 
@@ -576,10 +576,10 @@ class FilesystemEntry:
         return list(self.iterdir())
 
     def listdir_ext(self) -> list[FilesystemEntry]:
-        """List the contents of a directory as FilesystemEntry's.
+        """List the contents of a directory as a list of :class:`FilesystemEntry`.
 
         Returns:
-            A list of FilesystemEntry's.
+            A list of :class:`FilesystemEntry`.
         """
         return list(self.scandir())
 
@@ -614,7 +614,7 @@ class FilesystemEntry:
         onerror: Optional[Callable] = None,
         followlinks: bool = False,
     ) -> Iterator[FilesystemEntry]:
-        """Walk a directory and show its contents as FilesystemEntry's.
+        """Walk a directory and show its contents as :class:`FilesystemEntry`.
 
         It walks across all the files inside the entry recursively.
 
@@ -629,11 +629,11 @@ class FilesystemEntry:
             followlinks: ``True`` if we want to follow any symbolic link
 
         Returns:
-            An iterator of directory entries as FilesystemEntry's.
+            An iterator of :class:`FilesystemEntry`.
         """
         yield from fsutil.walk_ext(self, topdown, onerror, followlinks)
 
-    def glob(self, pattern) -> Iterator[str]:
+    def glob(self, pattern: str) -> Iterator[str]:
         """Iterate over this directory part of ``patern``, returning entries matching ``pattern`` as strings.
 
         Args:
@@ -645,21 +645,23 @@ class FilesystemEntry:
         for entry in self.glob_ext(pattern):
             yield entry.path
 
-    def glob_ext(self, pattern) -> Iterator[FilesystemEntry]:
-        """Iterate over the directory part of ``pattern``, returning entries matching ``pattern`` as FilesysmteEntry's.
+    def glob_ext(self, pattern: str) -> Iterator[FilesystemEntry]:
+        """Iterate over the directory part of ``pattern``, returning entries matching
+        ``pattern`` as :class:`FilesysmteEntry`.
 
         Args:
             pattern: The pattern to glob for.
 
         Returns:
-            An iterator of FilesystemEntry's that match the pattern.
+            An iterator of :class:`FilesystemEntry` that match the pattern.
         """
         yield from fsutil.glob_ext(self, pattern)
 
     def exists(self, path: str) -> bool:
         """Determines whether a ``path``, relative to this entry, exists.
 
-        If the `path` is a symbolic link, it will attempt to resolve it to find the FilesystemEntry it points to.
+        If the `path` is a symbolic link, it will attempt to resolve it to find
+        the :class:`FilesystemEntry` it points to.
 
         Args:
             path: The path relative to this entry.
@@ -737,7 +739,7 @@ class FilesystemEntry:
         raise NotImplementedError()
 
     def readlink_ext(self) -> FilesystemEntry:
-        """Read the link where this entry points to, return the resulting path as FilesystemEntry.
+        """Read the link where this entry points to, return the resulting path as :class:`FilesystemEntry`.
 
         If it is a symlink and returns the string that corresponds to that path.
         This means it follows the path a link points to, it tries to do it recursively.
@@ -860,7 +862,7 @@ class VirtualDirectory(FilesystemEntry):
         raise TypeError(f"lattr is not allowed on VirtualDirectory: {self.path}")
 
     def add(self, name: str, entry: FilesystemEntry) -> None:
-        """Add an entry to this VirtualDirectory."""
+        """Add an entry to this :class:`VirtualDirectory`."""
         if not self.fs.case_sensitive:
             name = name.lower()
 
@@ -1214,7 +1216,7 @@ class VirtualFilesystem(Filesystem):
         self.map_file_entry(vfspath, VirtualFile(self, file_path, fh))
 
     def map_file_entry(self, vfspath: str, entry: FilesystemEntry) -> None:
-        """Map a FilesystemEntry into the VFS.
+        """Map a :class:`FilesystemEntry` into the VFS.
 
         Any missing subdirectories up to, but not including, the last part of
         ``vfspath`` will be created.
@@ -1271,7 +1273,7 @@ class VirtualFilesystem(Filesystem):
         return self.map_dir_from_tar(vfspath.lstrip("/"), tar_file, map_single_file=True)
 
     def link(self, src: str, dst: str) -> None:
-        """Hard link a FilesystemEntry to another location.
+        """Hard link a :class:`FilesystemEntry` to another location.
 
         Args:
             src: The path to the target of the link.
@@ -1291,65 +1293,132 @@ class VirtualFilesystem(Filesystem):
         self.map_file_entry(dst, VirtualSymlink(self, dst, src))
 
 
-class RootFilesystem(Filesystem):
-    __type__ = "root"
+class LayerFilesystem(Filesystem):
+    __type__ = "layer"
 
-    def __init__(self, target: Target):
-        self.target = target
-        self.layers = []
+    def __init__(self, **kwargs):
+        self.layers: list[Filesystem] = []
         self.mounts = {}
         self._alt_separator = "/"
         self._case_sensitive = True
-        self._root_entry = RootFilesystemEntry(self, "/", [])
-        self.root = self.add_layer()
-        super().__init__(None)
+        self._root_entry = LayerFilesystemEntry(self, "/", [])
+        self.root = self.append_layer()
+        super().__init__(None, **kwargs)
+
+    def __getattr__(self, attr: str) -> Any:
+        """Provide "magic" access to filesystem specific attributes from any of the layers.
+
+        For example, on a :class:`LayerFilesystem` ``fs``, you can do ``fs.ntfs`` to access the
+        internal NTFS object if it has an NTFS layer.
+        """
+        for fs in self.layers:
+            try:
+                return getattr(fs, attr)
+            except AttributeError:
+                continue
+        else:
+            return object.__getattribute__(self, attr)
 
     @staticmethod
     def detect(fh: BinaryIO) -> bool:
-        raise TypeError("Detect is not allowed on RootFilesystem class")
+        raise TypeError("Detect is not allowed on LayerFilesystem class")
 
-    def mount(self, path: str, fs: Filesystem) -> None:
+    def mount(self, path: str, fs: Filesystem, ignore_existing: bool = True) -> None:
         """Mount a filesystem at a given path.
 
         If there's an overlap with an existing mount, creates a new layer.
+
+        Args:
+            path: The path to mount the filesystem at.
+            fs: The filesystem to mount.
+            ignore_existing: Whether to ignore existing mounts and create a new layer. Defaults to ``True``.
         """
         root = self.root
         for mount in self.mounts.keys():
-            if path == mount:
+            if ignore_existing and path == mount:
                 continue
 
             if path.startswith(mount):
-                root = self.add_layer()
+                root = self.append_layer()
                 break
 
         root.map_fs(path, fs)
         self.mounts[path] = fs
 
     def link(self, dst: str, src: str) -> None:
-        """Hard link a RootFilesystemEntry to another location."""
-        dst = fsutil.normalize(dst, alt_separator=self.alt_separator)
+        """Hard link a :class:`FilesystemEntry` to another location."""
         self.root.map_file_entry(dst, self.get(src))
 
     def symlink(self, dst: str, src: str) -> None:
         """Create a symlink to another location."""
         self.root.symlink(dst, src)
 
-    def add_layer(self, **kwargs) -> VirtualFilesystem:
+    def append_layer(self, **kwargs) -> VirtualFilesystem:
+        """Append a new layer."""
+        layer = VirtualFilesystem(case_sensitive=self.case_sensitive, alt_separator=self.alt_separator, **kwargs)
+        self.append_fs_layer(layer)
+        return layer
+
+    add_layer = append_layer
+
+    def prepend_layer(self, **kwargs) -> VirtualFilesystem:
+        """Prepend a new layer."""
         layer = VirtualFilesystem(case_sensitive=self.case_sensitive, alt_separator=self.alt_separator, **kwargs)
-        self.layers.append(layer)
-        self._root_entry.entries.append(layer.root)
+        self.prepend_fs_layer(layer)
         return layer
 
+    def append_fs_layer(self, fs: Filesystem) -> None:
+        """Append a filesystem as a layer.
+
+        Args:
+            fs: The filesystem to append.
+        """
+        # Counterintuitively, we prepend the filesystem to the list of layers
+        # We could reverse the list of layers upon iteration, but that is a hot path
+        self.layers.insert(0, fs)
+        self._root_entry.entries.insert(0, fs.get("/"))
+
+    def prepend_fs_layer(self, fs: Filesystem) -> None:
+        """Prepend a filesystem as a layer.
+
+        Args:
+            fs: The filesystem to prepend.
+        """
+        # Counterintuitively, we append the filesystem to the list of layers
+        # We could reverse the list of layers upon iteration, but that is a hot path
+        self.layers.append(fs)
+        self._root_entry.entries.append(fs.get("/"))
+
+    def remove_fs_layer(self, fs: Filesystem) -> None:
+        """Remove a filesystem layer.
+
+        Args:
+            fs: The filesystem to remove.
+        """
+        self.remove_layer(self.layers.index(fs))
+
+    def remove_layer(self, idx: int) -> None:
+        """Remove a layer by index.
+
+        Args:
+            idx: The index of the layer to remove.
+        """
+        del self.layers[idx]
+        del self._root_entry.entries[idx]
+
     @property
     def case_sensitive(self) -> bool:
+        """Whether the filesystem is case sensitive."""
         return self._case_sensitive
 
     @property
     def alt_separator(self) -> str:
+        """The alternative separator of the filesystem."""
         return self._alt_separator
 
     @case_sensitive.setter
     def case_sensitive(self, value: bool) -> None:
+        """Set the case sensitivity of the filesystem (and all layers)."""
         self._case_sensitive = value
         self.root.case_sensitive = value
         for layer in self.layers:
@@ -1357,14 +1426,14 @@ class RootFilesystem(Filesystem):
 
     @alt_separator.setter
     def alt_separator(self, value: str) -> None:
+        """Set the alternative separator of the filesystem (and all layers)."""
         self._alt_separator = value
         self.root.alt_separator = value
         for layer in self.layers:
             layer.alt_separator = value
 
-    def get(self, path: str, relentry: FilesystemEntry = None) -> FilesystemEntry:
-        self.target.log.debug("%r::get(%r)", self, path)
-
+    def get(self, path: str, relentry: Optional[LayerFilesystemEntry] = None) -> LayerFilesystemEntry:
+        """Get a :class:`FilesystemEntry` from the filesystem."""
         entry = relentry or self._root_entry
         path = fsutil.normalize(path, alt_separator=self.alt_separator).strip("/")
         full_path = fsutil.join(entry.path, path, alt_separator=self.alt_separator)
@@ -1388,9 +1457,10 @@ class RootFilesystem(Filesystem):
                 raise NotASymlinkError(full_path)
             raise FileNotFoundError(full_path)
 
-        return RootFilesystemEntry(self, full_path, entries)
+        return LayerFilesystemEntry(self, full_path, entries)
 
     def _get_from_entry(self, path: str, entry: FilesystemEntry) -> FilesystemEntry:
+        """Get a :class:`FilesystemEntry` relative to a specific entry."""
         parts = path.split("/")
 
         for part in parts:
@@ -1405,11 +1475,11 @@ class RootFilesystem(Filesystem):
 class EntryList(list):
     """Wrapper list for filesystem entries.
 
-    Expose a getattr on a list of items. Useful in cases where
-    there's a virtual filesystem entry as well as a real one.
+    Exposes a ``__getattr__`` on a list of items. Useful to access internal objects from filesystem implementations.
+    For example, access the underlying NTFS object from a list of virtual and NTFS entries.
     """
 
-    def __init__(self, value: Any):
+    def __init__(self, value: FilesystemEntry | list[FilesystemEntry]):
         if not isinstance(value, list):
             value = [value]
         super().__init__(value)
@@ -1424,20 +1494,12 @@ class EntryList(list):
             return object.__getattribute__(self, attr)
 
 
-class RootFilesystemEntry(FilesystemEntry):
+class LayerFilesystemEntry(FilesystemEntry):
     def __init__(self, fs: Filesystem, path: str, entry: FilesystemEntry):
         super().__init__(fs, path, EntryList(entry))
-        self.entries = self.entry
+        self.entries: EntryList = self.entry
         self._link = None
 
-    def __getattr__(self, attr):
-        for entry in self.entries:
-            try:
-                return getattr(entry, attr)
-            except AttributeError:
-                continue
-        return object.__getattribute__(self, attr)
-
     def _exec(self, func: str, *args, **kwargs) -> Any:
         """Helper method to execute a method over all contained entries."""
         exc = []
@@ -1451,18 +1513,16 @@ class RootFilesystemEntry(FilesystemEntry):
             exceptions = ",".join(exc)
         else:
             exceptions = "No entries"
+
         raise FilesystemError(f"Can't resolve {func} for {self}: {exceptions}")
 
     def get(self, path: str) -> FilesystemEntry:
-        self.fs.target.log.debug("%r::get(%r)", self, path)
         return self.fs.get(path, self._resolve())
 
     def open(self) -> BinaryIO:
-        self.fs.target.log.debug("%r::open()", self)
         return self._resolve()._exec("open")
 
     def iterdir(self) -> Iterator[str]:
-        self.fs.target.log.debug("%r::iterdir()", self)
         yielded = {".", ".."}
         selfentry = self._resolve()
         for fsentry in selfentry.entries:
@@ -1474,8 +1534,7 @@ class RootFilesystemEntry(FilesystemEntry):
                 yield entry_name
                 yielded.add(name)
 
-    def scandir(self) -> Iterator[FilesystemEntry]:
-        self.fs.target.log.debug("%r::scandir()", self)
+    def scandir(self) -> Iterator[LayerFilesystemEntry]:
         # Every entry is actually a list of entries from the different
         # overlaying FSes, of which each may implement a different function
         # like .stat() or .open()
@@ -1495,49 +1554,115 @@ class RootFilesystemEntry(FilesystemEntry):
             # overlaying FSes may have different casing of the name.
             entry_name = entries[0].name
             path = fsutil.join(selfentry.path, entry_name, alt_separator=selfentry.fs.alt_separator)
-            yield RootFilesystemEntry(selfentry.fs, path, entries)
+            yield LayerFilesystemEntry(selfentry.fs, path, entries)
 
     def is_file(self, follow_symlinks: bool = True) -> bool:
-        self.fs.target.log.debug("%r::is_file()", self)
         try:
             return self._resolve(follow_symlinks=follow_symlinks)._exec("is_file", follow_symlinks=follow_symlinks)
         except FileNotFoundError:
             return False
 
     def is_dir(self, follow_symlinks: bool = True) -> bool:
-        self.fs.target.log.debug("%r::is_dir()", self)
         try:
             return self._resolve(follow_symlinks=follow_symlinks)._exec("is_dir", follow_symlinks=follow_symlinks)
         except FileNotFoundError:
             return False
 
     def is_symlink(self) -> bool:
-        self.fs.target.log.debug("%r::is_symlink()", self)
         return self._exec("is_symlink")
 
     def readlink(self) -> str:
-        self.fs.target.log.debug("%r::readlink()", self)
         if not self.is_symlink():
             raise NotASymlinkError(f"Not a link: {self}")
         return self._exec("readlink")
 
     def stat(self, follow_symlinks: bool = True) -> fsutil.stat_result:
-        self.fs.target.log.debug("%r::stat()", self)
         return self._resolve(follow_symlinks=follow_symlinks)._exec("stat", follow_symlinks=follow_symlinks)
 
     def lstat(self) -> fsutil.stat_result:
-        self.fs.target.log.debug("%r::lstat()", self)
         return self._exec("lstat")
 
     def attr(self) -> Any:
-        self.fs.target.log.debug("%r::attr()", self)
         return self._resolve()._exec("attr")
 
     def lattr(self) -> Any:
-        self.fs.target.log.debug("%r::lattr()", self)
         return self._exec("lattr")
 
 
+class RootFilesystem(LayerFilesystem):
+    __type__ = "root"
+
+    def __init__(self, target: Target):
+        self.target = target
+        super().__init__()
+
+    @staticmethod
+    def detect(fh: BinaryIO) -> bool:
+        raise TypeError("Detect is not allowed on RootFilesystem class")
+
+    def get(self, path: str, relentry: Optional[LayerFilesystemEntry] = None) -> RootFilesystemEntry:
+        self.target.log.debug("%r::get(%r)", self, path)
+        entry = super().get(path, relentry)
+        entry.__class__ = RootFilesystemEntry
+        return entry
+
+
+class RootFilesystemEntry(LayerFilesystemEntry):
+    fs: RootFilesystem
+
+    def get(self, path: str) -> RootFilesystemEntry:
+        self.fs.target.log.debug("%r::get(%r)", self, path)
+        entry = super().get(path)
+        entry.__class__ = RootFilesystemEntry
+        return entry
+
+    def open(self) -> BinaryIO:
+        self.fs.target.log.debug("%r::open()", self)
+        return super().open()
+
+    def iterdir(self) -> Iterator[str]:
+        self.fs.target.log.debug("%r::iterdir()", self)
+        yield from super().iterdir()
+
+    def scandir(self) -> Iterator[RootFilesystemEntry]:
+        self.fs.target.log.debug("%r::scandir()", self)
+        for entry in super().scandir():
+            entry.__class__ = RootFilesystemEntry
+            yield entry
+
+    def is_file(self, follow_symlinks: bool = True) -> bool:
+        self.fs.target.log.debug("%r::is_file()", self)
+        return super().is_file(follow_symlinks=follow_symlinks)
+
+    def is_dir(self, follow_symlinks: bool = True) -> bool:
+        self.fs.target.log.debug("%r::is_dir()", self)
+        return super().is_dir(follow_symlinks=follow_symlinks)
+
+    def is_symlink(self) -> bool:
+        self.fs.target.log.debug("%r::is_symlink()", self)
+        return super().is_symlink()
+
+    def readlink(self) -> str:
+        self.fs.target.log.debug("%r::readlink()", self)
+        return super().readlink()
+
+    def stat(self, follow_symlinks: bool = True) -> fsutil.stat_result:
+        self.fs.target.log.debug("%r::stat()", self)
+        return super().stat(follow_symlinks=follow_symlinks)
+
+    def lstat(self) -> fsutil.stat_result:
+        self.fs.target.log.debug("%r::lstat()", self)
+        return super().lstat()
+
+    def attr(self) -> Any:
+        self.fs.target.log.debug("%r::attr()", self)
+        return super().attr()
+
+    def lattr(self) -> Any:
+        self.fs.target.log.debug("%r::lattr()", self)
+        return super().lattr()
+
+
 def register(module: str, class_name: str, internal: bool = True) -> None:
     """Register a filesystem implementation to use when opening a filesystem.
 

dissect/target/loaders/vb.py

@@ -14,8 +14,8 @@ class VBLoader(Loader):
         return (mft_exists or c_drive_exists) and config_exists
 
     def map(self, target):
-        ntfs_overlay = target.fs.add_layer()
-        remap_overlay = target.fs.add_layer()
+        remap_overlay = target.fs.append_layer()
+        ntfs_overlay = target.fs.append_layer()
         dfs = DirectoryFilesystem(self.path, case_sensitive=False)
         target.filesystems.add(dfs)
 

dissect/target/plugins/filesystem/walkfs.py

@@ -3,7 +3,7 @@ from typing import Iterable
 from dissect.util.ts import from_unix
 
 from dissect.target.exceptions import FileNotFoundError, UnsupportedPluginError
-from dissect.target.filesystem import RootFilesystemEntry
+from dissect.target.filesystem import LayerFilesystemEntry
 from dissect.target.helpers.fsutil import TargetPath
 from dissect.target.helpers.record import TargetRecordDescriptor
 from dissect.target.plugin import Plugin, export
@@ -50,7 +50,7 @@ def generate_record(target: Target, path: TargetPath) -> FilesystemRecord:
     stat = path.lstat()
     btime = from_unix(stat.st_birthtime) if stat.st_birthtime else None
     entry = path.get()
-    if isinstance(entry, RootFilesystemEntry):
+    if isinstance(entry, LayerFilesystemEntry):
         fs_types = [sub_entry.fs.__type__ for sub_entry in entry.entries]
     else:
         fs_types = [entry.fs.__type__]

dissect/target/plugins/os/unix/esxi/_os.py

@@ -97,7 +97,7 @@ class ESXiPlugin(UnixPlugin):
 
         # Create a root layer for the "local state" filesystem
         # This stores persistent configuration data
-        local_layer = target.fs.add_layer()
+        local_layer = target.fs.append_layer()
 
         # Mount all the visor tars in individual filesystem layers
         _mount_modules(target, sysvol, cfg)
@@ -209,7 +209,7 @@ def _mount_modules(target: Target, sysvol: Filesystem, cfg: dict[str, str]):
             tfs = tar.TarFilesystem(cfile, tarinfo=vmtar.VisorTarInfo)
 
         if tfs:
-            target.fs.add_layer().mount("/", tfs)
+            target.fs.append_layer().mount("/", tfs)
 
 
 def _mount_local(target: Target, local_layer: VirtualFilesystem):

dissect/target/plugins/os/unix/linux/debian/vyos/_os.py

@@ -24,7 +24,7 @@ class VyosPlugin(LinuxPlugin):
         self._version, rootpath = latest
 
         # VyOS does some additional magic with base system files
-        layer = target.fs.add_layer()
+        layer = target.fs.append_layer()
         layer.map_file_entry("/", target.fs.root.get(f"/boot/{self._version}/{rootpath}"))
         super().__init__(target)
 

dissect/target/plugins/os/unix/linux/fortios/_os.py

@@ -113,7 +113,7 @@ class FortiOSPlugin(LinuxPlugin):
 
         # FortiGate
         if (datafs_tar := sysvol.path("/datafs.tar.gz")).exists():
-            target.fs.add_layer().mount("/data", TarFilesystem(datafs_tar.open("rb")))
+            target.fs.append_layer().mount("/data", TarFilesystem(datafs_tar.open("rb")))
 
         # Additional FortiGate or FortiManager tars with corrupt XZ streams
         target.log.warning("Attempting to load XZ files, this can take a while.")
@@ -127,11 +127,11 @@ class FortiOSPlugin(LinuxPlugin):
         ):
             if (tar := target.fs.path(path)).exists() or (tar := sysvol.path(path)).exists():
                 fh = xz.repair_checksum(tar.open("rb"))
-                target.fs.add_layer().mount("/", TarFilesystem(fh))
+                target.fs.append_layer().mount("/", TarFilesystem(fh))
 
         # FortiAnalyzer and FortiManager
         if (rootfs_ext_tar := sysvol.path("rootfs-ext.tar.xz")).exists():
-            target.fs.add_layer().mount("/", TarFilesystem(rootfs_ext_tar.open("rb")))
+            target.fs.append_layer().mount("/", TarFilesystem(rootfs_ext_tar.open("rb")))
 
         # Filesystem mounts can be discovered in the FortiCare debug report
         # or using ``fnsysctl ls`` and ``fnsysctl df`` in the cli.

dissect/target/tools/shell.py

@@ -31,7 +31,7 @@ from dissect.target.exceptions import (
     RegistryValueNotFoundError,
     TargetError,
 )
-from dissect.target.filesystem import FilesystemEntry, RootFilesystemEntry
+from dissect.target.filesystem import FilesystemEntry, LayerFilesystemEntry
 from dissect.target.helpers import cyber, fsutil, regutil
 from dissect.target.plugin import arg
 from dissect.target.target import Target
@@ -469,7 +469,7 @@ class TargetCli(TargetCmd):
                 # If we happen to scan an NTFS filesystem see if any of the
                 # entries has an alternative data stream and also list them.
                 entry = file_.get()
-                if isinstance(entry, RootFilesystemEntry):
+                if isinstance(entry, LayerFilesystemEntry):
                     if entry.entries.fs.__type__ == "ntfs":
                         attrs = entry.lattr()
                         for data_stream in attrs.DATA:
@@ -512,34 +512,66 @@ class TargetCli(TargetCmd):
     @arg("-l", action="store_true")
     @arg("-a", "--all", action="store_true")  # ignored but included for proper argument parsing
     @arg("-h", "--human-readable", action="store_true")
+    @arg("-R", "--recursive", action="store_true", help="recursively list subdirectories encountered")
+    @arg("-c", action="store_true", dest="use_ctime", help="show time when file status was last changed")
+    @arg("-u", action="store_true", dest="use_atime", help="show time of last access")
     def cmd_ls(self, args: argparse.Namespace, stdout: TextIO) -> Optional[bool]:
         """list directory contents"""
 
         path = self.resolve_path(args.path)
 
+        if args.use_ctime and args.use_atime:
+            print("can't specify -c and -u at the same time")
+            return
+
         if not path or not path.exists():
             return
 
+        self._print_ls(args, path, 0, stdout)
+
+    def _print_ls(self, args: argparse.Namespace, path: fsutil.TargetPath, depth: int, stdout: TextIO) -> None:
+        path = self.resolve_path(path)
+        subdirs = []
+
         if path.is_dir():
             contents = self.scandir(path, color=True)
         elif path.is_file():
             contents = [(path, path.name)]
 
+        if depth > 0:
+            print(f"\n{str(path)}:", file=stdout)
+
         if not args.l:
-            print("\n".join([name for _, name in contents]), file=stdout)
+            for target_path, name in contents:
+                print(name, file=stdout)
+                if target_path.is_dir():
+                    subdirs.append(target_path)
         else:
             if len(contents) > 1:
                 print(f"total {len(contents)}", file=stdout)
             for target_path, name in contents:
-                self.print_extensive_file_stat(stdout=stdout, target_path=target_path, name=name)
+                self.print_extensive_file_stat(args=args, stdout=stdout, target_path=target_path, name=name)
+                if target_path.is_dir():
+                    subdirs.append(target_path)
+
+        if args.recursive and subdirs:
+            for subdir in subdirs:
+                self._print_ls(args, subdir, depth + 1, stdout)
 
-    def print_extensive_file_stat(self, stdout: TextIO, target_path: fsutil.TargetPath, name: str) -> None:
+    def print_extensive_file_stat(
+        self, args: argparse.Namespace, stdout: TextIO, target_path: fsutil.TargetPath, name: str
+    ) -> None:
         """Print the file status."""
         try:
             entry = target_path.get()
             stat = entry.lstat()
             symlink = f" -> {entry.readlink()}" if entry.is_symlink() else ""
-            utc_time = datetime.datetime.utcfromtimestamp(stat.st_mtime).isoformat()
+            show_time = stat.st_mtime
+            if args.use_ctime:
+                show_time = stat.st_ctime
+            elif args.use_atime:
+                show_time = stat.st_atime
+            utc_time = datetime.datetime.utcfromtimestamp(show_time).isoformat()
 
             print(
                 f"{stat_modestr(stat)} {stat.st_uid:4d} {stat.st_gid:4d} {stat.st_size:6d} {utc_time} {name}{symlink}",

{dissect.target-3.17.dev18.dist-info → dissect.target-3.17.dev20.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.17.dev18
+Version: 3.17.dev20
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect.target-3.17.dev18.dist-info → dissect.target-3.17.dev20.dist-info}/RECORD

@@ -1,7 +1,7 @@
 dissect/target/__init__.py,sha256=Oc7ounTgq2hE4nR6YcNabetc7SQA40ldSa35VEdZcQU,63
 dissect/target/container.py,sha256=0YcwcGmfJjhPXUB6DEcjWEoSuAtTDxMDpoTviMrLsxM,9353
 dissect/target/exceptions.py,sha256=VVW_Rq_vQinapz-2mbJ3UkxBEZpb2pE_7JlhMukdtrY,2877
-dissect/target/filesystem.py,sha256=VD1BA6hLqH_FPWFZ-wliEuCxnFrUK61S9VbGK7CtA5w,55597
+dissect/target/filesystem.py,sha256=1i-lToeTX-HgQXQOYxPXH-90M_eq43W4FFzNDRdpgpk,60094
 dissect/target/loader.py,sha256=_mrMOzKdpb7nlZJpLENOLuU4Ty92PzJem9GFDuo0PK4,7298
 dissect/target/plugin.py,sha256=HAN8maaDt-Rlqt8Rr1IW7gXQpzNQZjCVz-i4aSPphSw,48677
 dissect/target/report.py,sha256=06uiP4MbNI8cWMVrC1SasNS-Yg6ptjVjckwj8Yhe0Js,7958
@@ -102,7 +102,7 @@ dissect/target/loaders/tar.py,sha256=ah5t9tzplJp-fJrvwTTtfqdjXTpZLQIikWglnaTKQHs
 dissect/target/loaders/target.py,sha256=MU_HUtg58YdhdZu6ga1sYG7fK61Dn7N0TBkWXDCWwyc,798
 dissect/target/loaders/targetd.py,sha256=sfbn2_j3il2G-rPywAoNT5YPtD5KmKkmBv1zrPDRs6I,8250
 dissect/target/loaders/utm.py,sha256=e5x5ZI3HeL0STh4S-CaQb68Rnug4SVZR9zlmHaGFj0M,978
-dissect/target/loaders/vb.py,sha256=CnQcn7bAkMzIB1y-lWLtPPXdIVsyeDaT6hTZEurjkV4,2072
+dissect/target/loaders/vb.py,sha256=CdimOMeoJEDq8xYDgtldGSiwhR-dY5uxac1L0sYwAEU,2078
 dissect/target/loaders/vbox.py,sha256=8JD7D8iAY9JRvTHsrosp5ZMsZezuLhZ10Zt8sEL7KBI,732
 dissect/target/loaders/velociraptor.py,sha256=FNxZgs_ehmgGO_Giw5oNl7cVOWNqI2nEiPWT4GjF2e0,4955
 dissect/target/loaders/vma.py,sha256=AAY5-s-nz6wgvmcFkptJD7nNXhpkdf6SqEKVOrJaIKs,644
@@ -160,7 +160,7 @@ dissect/target/plugins/filesystem/acquire_handles.py,sha256=-pX_akH5GrYe0HofXOa2
 dissect/target/plugins/filesystem/acquire_hash.py,sha256=OVxI19-Bl1tdqCiFMscFMLmyoiBOsuAjL-Q8aQpEwl0,1441
 dissect/target/plugins/filesystem/icat.py,sha256=bOMi04IlljnKwxTWTZJKtK7RxKnabFu3WcXyUwzkE-4,4090
 dissect/target/plugins/filesystem/resolver.py,sha256=HfyASUFV4F9uD-yFXilFpPTORAsRDvdmTvuYHgOaOWg,4776
-dissect/target/plugins/filesystem/walkfs.py,sha256=aCEBmT3uoQdMdSGUshMOsKpcjrzAFg3HzeYW24PJZwk,2296
+dissect/target/plugins/filesystem/walkfs.py,sha256=e8HEZcV5Wiua26FGWL3xgiQ_PIhcNvGI5KCdsAx2Nmo,2298
 dissect/target/plugins/filesystem/yara.py,sha256=q_pbrQArNaWP4ILRzK7VQhukIw16LhUvntoviHmZ38Q,2241
 dissect/target/plugins/filesystem/ntfs/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/target/plugins/filesystem/ntfs/mft.py,sha256=Za-fsTcKlAlhm9ugJlMdwsJVf2Osrh4PrEGSFuv-Eeo,9564
@@ -205,7 +205,7 @@ dissect/target/plugins/os/unix/bsd/osx/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JC
 dissect/target/plugins/os/unix/bsd/osx/_os.py,sha256=KvP7YJ7apVwoIop7MR-8q5QbVGoB6MdR42l6ssEe6es,4081
 dissect/target/plugins/os/unix/bsd/osx/user.py,sha256=qopB0s3n7e6Q7NjWzn8Z-dKtDtU7e6In4Vm7hIvvedo,2322
 dissect/target/plugins/os/unix/esxi/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-dissect/target/plugins/os/unix/esxi/_os.py,sha256=jqw71St-L_BiREai8bw27oFOrLK4_GuEDLUTK5FMGLU,17498
+dissect/target/plugins/os/unix/esxi/_os.py,sha256=8kFFK9986zN8hXmDUWwdQHtbV33nWKerRuisg_xbsoQ,17504
 dissect/target/plugins/os/unix/linux/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/target/plugins/os/unix/linux/_os.py,sha256=YJYwuq_iAinOrPqTE49Q4DLYMWBeRCly1uTbDvPhp6Q,2796
 dissect/target/plugins/os/unix/linux/cmdline.py,sha256=XIvaTL42DzeQGhqHN_RTMI5g8hbI2_wjzb7KZ0kPOM0,1591
@@ -224,10 +224,10 @@ dissect/target/plugins/os/unix/linux/debian/_os.py,sha256=GI19ZqcyfZ1mUYg2NCx93H
 dissect/target/plugins/os/unix/linux/debian/apt.py,sha256=dkTfLrS-MS8wfrXILFLHDoLqBkM_w16KTRQ7ysiZkZY,4316
 dissect/target/plugins/os/unix/linux/debian/dpkg.py,sha256=DPBLQiHAF7ZS8IorRsGAiBj4HhvwuJbmkMEHOuTZisw,5735
 dissect/target/plugins/os/unix/linux/debian/vyos/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-dissect/target/plugins/os/unix/linux/debian/vyos/_os.py,sha256=q8qG2FLJhUbpjfwlNCmWAhFdTWMzSWUh7s7H8m4x7Fw,1741
+dissect/target/plugins/os/unix/linux/debian/vyos/_os.py,sha256=TPjcfv1n68RCe3Er4aCVQwQDCZwJT-NLvje3kPjDfhk,1744
 dissect/target/plugins/os/unix/linux/fortios/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/target/plugins/os/unix/linux/fortios/_keys.py,sha256=jDDHObfsUn9BGoIir9p4J_-rg9rI1rgoOfnL3R3lg4o,123358
-dissect/target/plugins/os/unix/linux/fortios/_os.py,sha256=gFFzByku_3qpSrHpnqJv6xIbIe3V4iGXdUxxGD_-EFA,19435
+dissect/target/plugins/os/unix/linux/fortios/_os.py,sha256=lyURdGaIsPmEhRZ6P5DQtwOggOLe9TZuY1cTirLSukA,19444
 dissect/target/plugins/os/unix/linux/fortios/generic.py,sha256=tT4-lE0Z_DeDIN3zHrQbE8JB3cRJop1_TiEst-Au0bs,1230
 dissect/target/plugins/os/unix/linux/fortios/locale.py,sha256=VDdk60sqe2JTfftssO05C667-_BpI3kcqKOTVzO3ueU,5209
 dissect/target/plugins/os/unix/linux/redhat/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -322,7 +322,7 @@ dissect/target/tools/logging.py,sha256=5ZnumtMWLyslxfrUGZ4ntRyf3obOOhmn8SBjKfdLc
 dissect/target/tools/mount.py,sha256=L_0tSmiBdW4aSaF0vXjB0bAkTC0kmT2N1hrbW6s5Jow,3254
 dissect/target/tools/query.py,sha256=6zz9SXS6YnHj7eguORS8Je7N4iM0i1PZDIQ-gyJ1nPY,15593
 dissect/target/tools/reg.py,sha256=FDsiBBDxjWVUBTRj8xn82vZe-J_d9piM-TKS3PHZCcM,3193
-dissect/target/tools/shell.py,sha256=6GF-mr4EpzX34G9sqTNKcccFJXhNTlrUqriRYIW7P7o,43544
+dissect/target/tools/shell.py,sha256=4v6Z06YJDjKv6e6SRvWNjQ2n_KHo_CjL4P0w1_gY_ro,44827
 dissect/target/tools/utils.py,sha256=sQizexY3ui5vmWw4KOBLg5ecK3TPFjD-uxDqRn56ZTY,11304
 dissect/target/tools/dump/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/target/tools/dump/run.py,sha256=aD84peRS4zHqC78fH7Vd4ni3m1ZmVP70LyMwBRvoDGY,9463
@@ -336,10 +336,10 @@ dissect/target/volumes/luks.py,sha256=OmCMsw6rCUXG1_plnLVLTpsvE1n_6WtoRUGQbpmu1z
 dissect/target/volumes/lvm.py,sha256=wwQVR9I3G9YzmY6UxFsH2Y4MXGBcKL9aayWGCDTiWMU,2269
 dissect/target/volumes/md.py,sha256=j1K1iKmspl0C_OJFc7-Q1BMWN2OCC5EVANIgVlJ_fIE,1673
 dissect/target/volumes/vmfs.py,sha256=-LoUbn9WNwTtLi_4K34uV_-wDw2W5hgaqxZNj4UmqAQ,1730
-dissect.target-3.17.dev18.dist-info/COPYRIGHT,sha256=m-9ih2RVhMiXHI2bf_oNSSgHgkeIvaYRVfKTwFbnJPA,301
-dissect.target-3.17.dev18.dist-info/LICENSE,sha256=DZak_2itbUtvHzD3E7GNUYSRK6jdOJ-GqncQ2weavLA,34523
-dissect.target-3.17.dev18.dist-info/METADATA,sha256=hkVxbE5ESL9e5xGrI4YY5UYYKF66WwuUIgRb8XRsaaQ,11300
-dissect.target-3.17.dev18.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
-dissect.target-3.17.dev18.dist-info/entry_points.txt,sha256=tvFPa-Ap-gakjaPwRc6Fl6mxHzxEZ_arAVU-IUYeo_s,447
-dissect.target-3.17.dev18.dist-info/top_level.txt,sha256=Mn-CQzEYsAbkxrUI0TnplHuXnGVKzxpDw_po_sXpvv4,8
-dissect.target-3.17.dev18.dist-info/RECORD,,
+dissect.target-3.17.dev20.dist-info/COPYRIGHT,sha256=m-9ih2RVhMiXHI2bf_oNSSgHgkeIvaYRVfKTwFbnJPA,301
+dissect.target-3.17.dev20.dist-info/LICENSE,sha256=DZak_2itbUtvHzD3E7GNUYSRK6jdOJ-GqncQ2weavLA,34523
+dissect.target-3.17.dev20.dist-info/METADATA,sha256=w19ITKpjeWu52HPdEU4SD_axvpgGpBr8_nsETBOLeEw,11300
+dissect.target-3.17.dev20.dist-info/WHEEL,sha256=GJ7t_kWBFywbagK5eo9IoUwLW6oyOeTKmQ-9iHFVNxQ,92
+dissect.target-3.17.dev20.dist-info/entry_points.txt,sha256=tvFPa-Ap-gakjaPwRc6Fl6mxHzxEZ_arAVU-IUYeo_s,447
+dissect.target-3.17.dev20.dist-info/top_level.txt,sha256=Mn-CQzEYsAbkxrUI0TnplHuXnGVKzxpDw_po_sXpvv4,8
+dissect.target-3.17.dev20.dist-info/RECORD,,