dissect.target 3.19.dev43__tar.gz → 3.19.dev44__tar.gz

Sign up to get free protection for your applications and to get access to all the features.
Files changed (617) hide show
  1. {dissect_target-3.19.dev43/dissect.target.egg-info → dissect_target-3.19.dev44}/PKG-INFO +1 -1
  2. dissect_target-3.19.dev44/dissect/target/plugins/apps/texteditor/texteditor.py +13 -0
  3. dissect_target-3.19.dev44/dissect/target/plugins/apps/texteditor/windowsnotepad.py +340 -0
  4. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44/dissect.target.egg-info}/PKG-INFO +1 -1
  5. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect.target.egg-info/SOURCES.txt +5 -0
  6. dissect_target-3.19.dev44/tests/plugins/apps/texteditor/test_texteditor.py +190 -0
  7. dissect_target-3.19.dev44/tests/tools/__init__.py +0 -0
  8. dissect_target-3.19.dev44/tests/volumes/__init__.py +0 -0
  9. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/COPYRIGHT +0 -0
  10. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/LICENSE +0 -0
  11. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/MANIFEST.in +0 -0
  12. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/README.md +0 -0
  13. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/__init__.py +0 -0
  14. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/container.py +0 -0
  15. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/containers/__init__.py +0 -0
  16. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/containers/asdf.py +0 -0
  17. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/containers/ewf.py +0 -0
  18. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/containers/fortifw.py +0 -0
  19. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/containers/hdd.py +0 -0
  20. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/containers/hds.py +0 -0
  21. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/containers/qcow2.py +0 -0
  22. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/containers/raw.py +0 -0
  23. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/containers/split.py +0 -0
  24. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/containers/vdi.py +0 -0
  25. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/containers/vhd.py +0 -0
  26. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/containers/vhdx.py +0 -0
  27. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/containers/vmdk.py +0 -0
  28. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/data/autocompletion/target_bash_completion.sh +0 -0
  29. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/exceptions.py +0 -0
  30. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystem.py +0 -0
  31. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/__init__.py +0 -0
  32. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/ad1.py +0 -0
  33. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/btrfs.py +0 -0
  34. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/cb.py +0 -0
  35. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/config.py +0 -0
  36. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/cpio.py +0 -0
  37. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/dir.py +0 -0
  38. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/exfat.py +0 -0
  39. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/extfs.py +0 -0
  40. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/fat.py +0 -0
  41. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/ffs.py +0 -0
  42. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/itunes.py +0 -0
  43. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/jffs.py +0 -0
  44. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/ntfs.py +0 -0
  45. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/overlay.py +0 -0
  46. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/smb.py +0 -0
  47. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/squashfs.py +0 -0
  48. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/tar.py +0 -0
  49. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/vmfs.py +0 -0
  50. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/vmtar.py +0 -0
  51. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/xfs.py +0 -0
  52. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/filesystems/zip.py +0 -0
  53. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/__init__.py +0 -0
  54. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/cache.py +0 -0
  55. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/compat/__init__.py +0 -0
  56. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/compat/path_310.py +0 -0
  57. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/compat/path_311.py +0 -0
  58. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/compat/path_312.py +0 -0
  59. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/compat/path_39.py +0 -0
  60. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/compat/path_common.py +0 -0
  61. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/config.py +0 -0
  62. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/configutil.py +0 -0
  63. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/cyber.py +0 -0
  64. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/data/windowsZones.xml +0 -0
  65. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/descriptor_extensions.py +0 -0
  66. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/docs.py +0 -0
  67. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/fsutil.py +0 -0
  68. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/hashutil.py +0 -0
  69. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/keychain.py +0 -0
  70. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/lazy.py +0 -0
  71. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/loaderutil.py +0 -0
  72. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/localeutil.py +0 -0
  73. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/mount.py +0 -0
  74. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/mui.py +0 -0
  75. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/network_managers.py +0 -0
  76. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/polypath.py +0 -0
  77. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/protobuf.py +0 -0
  78. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/record.py +0 -0
  79. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/record_modifier.py +0 -0
  80. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/regutil.py +0 -0
  81. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/shell_application_ids.py +0 -0
  82. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/shell_folder_ids.py +0 -0
  83. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/targetd.py +0 -0
  84. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/helpers/utils.py +0 -0
  85. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loader.py +0 -0
  86. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/__init__.py +0 -0
  87. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/ab.py +0 -0
  88. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/ad1.py +0 -0
  89. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/asdf.py +0 -0
  90. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/cb.py +0 -0
  91. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/cyber.py +0 -0
  92. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/dir.py +0 -0
  93. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/hyperv.py +0 -0
  94. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/itunes.py +0 -0
  95. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/kape.py +0 -0
  96. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/libvirt.py +0 -0
  97. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/local.py +0 -0
  98. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/log.py +0 -0
  99. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/mqtt.py +0 -0
  100. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/multiraw.py +0 -0
  101. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/ova.py +0 -0
  102. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/overlay.py +0 -0
  103. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/ovf.py +0 -0
  104. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/phobos.py +0 -0
  105. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/profile.py +0 -0
  106. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/pvm.py +0 -0
  107. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/pvs.py +0 -0
  108. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/raw.py +0 -0
  109. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/remote.py +0 -0
  110. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/res.py +0 -0
  111. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/smb.py +0 -0
  112. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/tanium.py +0 -0
  113. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/tar.py +0 -0
  114. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/target.py +0 -0
  115. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/targetd.py +0 -0
  116. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/utm.py +0 -0
  117. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/vb.py +0 -0
  118. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/vbox.py +0 -0
  119. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/velociraptor.py +0 -0
  120. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/vma.py +0 -0
  121. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/vmwarevm.py +0 -0
  122. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/vmx.py +0 -0
  123. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/loaders/xva.py +0 -0
  124. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugin.py +0 -0
  125. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/__init__.py +0 -0
  126. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/__init__.py +0 -0
  127. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/av/__init__.py +0 -0
  128. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/av/mcafee.py +0 -0
  129. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/av/sophos.py +0 -0
  130. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/av/symantec.py +0 -0
  131. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/av/trendmicro.py +0 -0
  132. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/browser/__init__.py +0 -0
  133. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/browser/brave.py +0 -0
  134. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/browser/browser.py +0 -0
  135. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/browser/chrome.py +0 -0
  136. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/browser/chromium.py +0 -0
  137. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/browser/edge.py +0 -0
  138. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/browser/firefox.py +0 -0
  139. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/browser/iexplore.py +0 -0
  140. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/container/__init__.py +0 -0
  141. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/container/docker.py +0 -0
  142. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/remoteaccess/__init__.py +0 -0
  143. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/remoteaccess/anydesk.py +0 -0
  144. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/remoteaccess/remoteaccess.py +0 -0
  145. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/remoteaccess/teamviewer.py +0 -0
  146. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/shell/__init__.py +0 -0
  147. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/shell/powershell.py +0 -0
  148. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/ssh/__init__.py +0 -0
  149. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/ssh/openssh.py +0 -0
  150. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/ssh/opensshd.py +0 -0
  151. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/ssh/putty.py +0 -0
  152. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/ssh/ssh.py +0 -0
  153. {dissect_target-3.19.dev43/dissect/target/plugins/apps/vpn → dissect_target-3.19.dev44/dissect/target/plugins/apps/texteditor}/__init__.py +0 -0
  154. {dissect_target-3.19.dev43/dissect/target/plugins/apps/webhosting → dissect_target-3.19.dev44/dissect/target/plugins/apps/vpn}/__init__.py +0 -0
  155. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/vpn/openvpn.py +0 -0
  156. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/vpn/wireguard.py +0 -0
  157. {dissect_target-3.19.dev43/dissect/target/plugins/apps/webserver → dissect_target-3.19.dev44/dissect/target/plugins/apps/webhosting}/__init__.py +0 -0
  158. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/webhosting/cpanel.py +0 -0
  159. {dissect_target-3.19.dev43/dissect/target/plugins/child → dissect_target-3.19.dev44/dissect/target/plugins/apps/webserver}/__init__.py +0 -0
  160. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/webserver/apache.py +0 -0
  161. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/webserver/caddy.py +0 -0
  162. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/webserver/citrix.py +0 -0
  163. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/webserver/iis.py +0 -0
  164. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/webserver/nginx.py +0 -0
  165. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/apps/webserver/webserver.py +0 -0
  166. {dissect_target-3.19.dev43/dissect/target/plugins/filesystem → dissect_target-3.19.dev44/dissect/target/plugins/child}/__init__.py +0 -0
  167. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/child/docker.py +0 -0
  168. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/child/esxi.py +0 -0
  169. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/child/hyperv.py +0 -0
  170. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/child/qemu.py +0 -0
  171. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/child/virtuozzo.py +0 -0
  172. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/child/vmware_workstation.py +0 -0
  173. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/child/wsl.py +0 -0
  174. {dissect_target-3.19.dev43/dissect/target/plugins/filesystem/ntfs → dissect_target-3.19.dev44/dissect/target/plugins/filesystem}/__init__.py +0 -0
  175. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/filesystem/acquire_handles.py +0 -0
  176. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/filesystem/acquire_hash.py +0 -0
  177. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/filesystem/icat.py +0 -0
  178. {dissect_target-3.19.dev43/dissect/target/plugins/filesystem/unix → dissect_target-3.19.dev44/dissect/target/plugins/filesystem/ntfs}/__init__.py +0 -0
  179. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/filesystem/ntfs/mft.py +0 -0
  180. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/filesystem/ntfs/mft_timeline.py +0 -0
  181. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/filesystem/ntfs/usnjrnl.py +0 -0
  182. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/filesystem/ntfs/utils.py +0 -0
  183. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/filesystem/resolver.py +0 -0
  184. {dissect_target-3.19.dev43/dissect/target/plugins/general → dissect_target-3.19.dev44/dissect/target/plugins/filesystem/unix}/__init__.py +0 -0
  185. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/filesystem/unix/capability.py +0 -0
  186. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/filesystem/unix/suid.py +0 -0
  187. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/filesystem/walkfs.py +0 -0
  188. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/filesystem/yara.py +0 -0
  189. {dissect_target-3.19.dev43/dissect/target/plugins/os → dissect_target-3.19.dev44/dissect/target/plugins/general}/__init__.py +0 -0
  190. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/general/config.py +0 -0
  191. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/general/default.py +0 -0
  192. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/general/example.py +0 -0
  193. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/general/loaders.py +0 -0
  194. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/general/network.py +0 -0
  195. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/general/osinfo.py +0 -0
  196. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/general/plugins.py +0 -0
  197. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/general/scrape.py +0 -0
  198. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/general/users.py +0 -0
  199. {dissect_target-3.19.dev43/dissect/target/plugins/os/unix → dissect_target-3.19.dev44/dissect/target/plugins/os}/__init__.py +0 -0
  200. {dissect_target-3.19.dev43/dissect/target/plugins/os/unix/bsd → dissect_target-3.19.dev44/dissect/target/plugins/os/unix}/__init__.py +0 -0
  201. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/_os.py +0 -0
  202. {dissect_target-3.19.dev43/dissect/target/plugins/os/unix/bsd/citrix → dissect_target-3.19.dev44/dissect/target/plugins/os/unix/bsd}/__init__.py +0 -0
  203. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/bsd/_os.py +0 -0
  204. {dissect_target-3.19.dev43/dissect/target/plugins/os/unix/bsd/freebsd → dissect_target-3.19.dev44/dissect/target/plugins/os/unix/bsd/citrix}/__init__.py +0 -0
  205. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/bsd/citrix/_os.py +0 -0
  206. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/bsd/citrix/history.py +0 -0
  207. {dissect_target-3.19.dev43/dissect/target/plugins/os/unix/bsd/ios → dissect_target-3.19.dev44/dissect/target/plugins/os/unix/bsd/freebsd}/__init__.py +0 -0
  208. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/bsd/freebsd/_os.py +0 -0
  209. {dissect_target-3.19.dev43/dissect/target/plugins/os/unix/bsd/openbsd → dissect_target-3.19.dev44/dissect/target/plugins/os/unix/bsd/ios}/__init__.py +0 -0
  210. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/bsd/ios/_os.py +0 -0
  211. {dissect_target-3.19.dev43/dissect/target/plugins/os/unix/bsd/osx → dissect_target-3.19.dev44/dissect/target/plugins/os/unix/bsd/openbsd}/__init__.py +0 -0
  212. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/bsd/openbsd/_os.py +0 -0
  213. {dissect_target-3.19.dev43/dissect/target/plugins/os/unix/esxi → dissect_target-3.19.dev44/dissect/target/plugins/os/unix/bsd/osx}/__init__.py +0 -0
  214. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/bsd/osx/_os.py +0 -0
  215. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/bsd/osx/user.py +0 -0
  216. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/cronjobs.py +0 -0
  217. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/datetime.py +0 -0
  218. {dissect_target-3.19.dev43/dissect/target/plugins/os/unix/etc → dissect_target-3.19.dev44/dissect/target/plugins/os/unix/esxi}/__init__.py +0 -0
  219. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/esxi/_os.py +0 -0
  220. {dissect_target-3.19.dev43/dissect/target/plugins/os/unix/linux → dissect_target-3.19.dev44/dissect/target/plugins/os/unix/etc}/__init__.py +0 -0
  221. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/etc/etc.py +0 -0
  222. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/etc.py +0 -0
  223. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/generic.py +0 -0
  224. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/history.py +0 -0
  225. {dissect_target-3.19.dev43/dissect/target/plugins/os/unix/linux/android → dissect_target-3.19.dev44/dissect/target/plugins/os/unix/linux}/__init__.py +0 -0
  226. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/_os.py +0 -0
  227. {dissect_target-3.19.dev43/dissect/target/plugins/os/unix/linux/debian → dissect_target-3.19.dev44/dissect/target/plugins/os/unix/linux/android}/__init__.py +0 -0
  228. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/android/_os.py +0 -0
  229. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/cmdline.py +0 -0
  230. {dissect_target-3.19.dev43/dissect/target/plugins/os/unix/linux/debian/vyos → dissect_target-3.19.dev44/dissect/target/plugins/os/unix/linux/debian}/__init__.py +0 -0
  231. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/debian/_os.py +0 -0
  232. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/debian/apt.py +0 -0
  233. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/debian/dpkg.py +0 -0
  234. {dissect_target-3.19.dev43/dissect/target/plugins/os/unix/linux/fortios → dissect_target-3.19.dev44/dissect/target/plugins/os/unix/linux/debian/vyos}/__init__.py +0 -0
  235. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/debian/vyos/_os.py +0 -0
  236. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/environ.py +0 -0
  237. {dissect_target-3.19.dev43/dissect/target/plugins/os/unix/linux/redhat → dissect_target-3.19.dev44/dissect/target/plugins/os/unix/linux/fortios}/__init__.py +0 -0
  238. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/fortios/_keys.py +0 -0
  239. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/fortios/_os.py +0 -0
  240. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/fortios/generic.py +0 -0
  241. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/fortios/locale.py +0 -0
  242. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/iptables.py +0 -0
  243. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/modules.py +0 -0
  244. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/netstat.py +0 -0
  245. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/proc.py +0 -0
  246. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/processes.py +0 -0
  247. {dissect_target-3.19.dev43/dissect/target/plugins/os/unix/linux/suse → dissect_target-3.19.dev44/dissect/target/plugins/os/unix/linux/redhat}/__init__.py +0 -0
  248. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/redhat/_os.py +0 -0
  249. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/redhat/yum.py +0 -0
  250. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/services.py +0 -0
  251. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/sockets.py +0 -0
  252. {dissect_target-3.19.dev43/dissect/target/plugins/os/unix/locate → dissect_target-3.19.dev44/dissect/target/plugins/os/unix/linux/suse}/__init__.py +0 -0
  253. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/suse/_os.py +0 -0
  254. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/linux/suse/zypper.py +0 -0
  255. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/locale.py +0 -0
  256. {dissect_target-3.19.dev43/dissect/target/plugins/os/unix/log → dissect_target-3.19.dev44/dissect/target/plugins/os/unix/locate}/__init__.py +0 -0
  257. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/locate/gnulocate.py +0 -0
  258. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/locate/locate.py +0 -0
  259. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/locate/mlocate.py +0 -0
  260. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/locate/plocate.py +0 -0
  261. {dissect_target-3.19.dev43/dissect/target/plugins/os/windows → dissect_target-3.19.dev44/dissect/target/plugins/os/unix/log}/__init__.py +0 -0
  262. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/log/atop.py +0 -0
  263. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/log/audit.py +0 -0
  264. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/log/auth.py +0 -0
  265. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/log/journal.py +0 -0
  266. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/log/lastlog.py +0 -0
  267. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/log/messages.py +0 -0
  268. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/log/utmp.py +0 -0
  269. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/packagemanager.py +0 -0
  270. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/unix/shadow.py +0 -0
  271. {dissect_target-3.19.dev43/dissect/target/plugins/os/windows/defender_helpers → dissect_target-3.19.dev44/dissect/target/plugins/os/windows}/__init__.py +0 -0
  272. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/_os.py +0 -0
  273. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/activitiescache.py +0 -0
  274. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/adpolicy.py +0 -0
  275. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/amcache.py +0 -0
  276. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/catroot.py +0 -0
  277. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/cim.py +0 -0
  278. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/clfs.py +0 -0
  279. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/credhist.py +0 -0
  280. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/datetime.py +0 -0
  281. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/defender.py +0 -0
  282. {dissect_target-3.19.dev43/dissect/target/plugins/os/windows/dpapi → dissect_target-3.19.dev44/dissect/target/plugins/os/windows/defender_helpers}/__init__.py +0 -0
  283. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/defender_helpers/defender_patterns.py +0 -0
  284. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/defender_helpers/defender_records.py +0 -0
  285. {dissect_target-3.19.dev43/dissect/target/plugins/os/windows/exchange → dissect_target-3.19.dev44/dissect/target/plugins/os/windows/dpapi}/__init__.py +0 -0
  286. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/dpapi/blob.py +0 -0
  287. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/dpapi/crypto.py +0 -0
  288. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/dpapi/dpapi.py +0 -0
  289. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/dpapi/master_key.py +0 -0
  290. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/env.py +0 -0
  291. {dissect_target-3.19.dev43/dissect/target/plugins/os/windows/log → dissect_target-3.19.dev44/dissect/target/plugins/os/windows/exchange}/__init__.py +0 -0
  292. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/exchange/exchange.py +0 -0
  293. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/generic.py +0 -0
  294. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/jumplist.py +0 -0
  295. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/lnk.py +0 -0
  296. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/locale.py +0 -0
  297. {dissect_target-3.19.dev43/dissect/target/plugins/os/windows/regf → dissect_target-3.19.dev44/dissect/target/plugins/os/windows/log}/__init__.py +0 -0
  298. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/log/amcache.py +0 -0
  299. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/log/etl.py +0 -0
  300. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/log/evt.py +0 -0
  301. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/log/evtx.py +0 -0
  302. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/log/pfro.py +0 -0
  303. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/log/schedlgu.py +0 -0
  304. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/notifications.py +0 -0
  305. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/prefetch.py +0 -0
  306. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/recyclebin.py +0 -0
  307. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/regf/7zip.py +0 -0
  308. {dissect_target-3.19.dev43/dissect/target/plugins/os/windows/task_helpers → dissect_target-3.19.dev44/dissect/target/plugins/os/windows/regf}/__init__.py +0 -0
  309. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/regf/appxdebugkeys.py +0 -0
  310. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/regf/auditpol.py +0 -0
  311. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/regf/bam.py +0 -0
  312. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/regf/cit.py +0 -0
  313. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/regf/clsid.py +0 -0
  314. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/regf/firewall.py +0 -0
  315. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/regf/mru.py +0 -0
  316. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/regf/muicache.py +0 -0
  317. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/regf/nethist.py +0 -0
  318. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/regf/recentfilecache.py +0 -0
  319. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/regf/regf.py +0 -0
  320. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/regf/runkeys.py +0 -0
  321. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/regf/shellbags.py +0 -0
  322. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/regf/shimcache.py +0 -0
  323. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/regf/trusteddocs.py +0 -0
  324. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/regf/usb.py +0 -0
  325. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/regf/userassist.py +0 -0
  326. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/registry.py +0 -0
  327. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/sam.py +0 -0
  328. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/services.py +0 -0
  329. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/sru.py +0 -0
  330. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/startupinfo.py +0 -0
  331. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/syscache.py +0 -0
  332. {dissect_target-3.19.dev43/dissect/target/tools → dissect_target-3.19.dev44/dissect/target/plugins/os/windows/task_helpers}/__init__.py +0 -0
  333. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/task_helpers/tasks_job.py +0 -0
  334. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/task_helpers/tasks_records.py +0 -0
  335. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/task_helpers/tasks_xml.py +0 -0
  336. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/tasks.py +0 -0
  337. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/thumbcache.py +0 -0
  338. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/ual.py +0 -0
  339. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/wer.py +0 -0
  340. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/plugins/os/windows/wua_history.py +0 -0
  341. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/report.py +0 -0
  342. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/target.py +0 -0
  343. {dissect_target-3.19.dev43/dissect/target/tools/dump → dissect_target-3.19.dev44/dissect/target/tools}/__init__.py +0 -0
  344. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/tools/build_pluginlist.py +0 -0
  345. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/tools/dd.py +0 -0
  346. {dissect_target-3.19.dev43/dissect/target/volumes → dissect_target-3.19.dev44/dissect/target/tools/dump}/__init__.py +0 -0
  347. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/tools/dump/run.py +0 -0
  348. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/tools/dump/state.py +0 -0
  349. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/tools/dump/utils.py +0 -0
  350. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/tools/fs.py +0 -0
  351. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/tools/fsutils.py +0 -0
  352. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/tools/info.py +0 -0
  353. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/tools/logging.py +0 -0
  354. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/tools/mount.py +0 -0
  355. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/tools/query.py +0 -0
  356. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/tools/reg.py +0 -0
  357. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/tools/shell.py +0 -0
  358. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/tools/utils.py +0 -0
  359. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/tools/yara.py +0 -0
  360. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/volume.py +0 -0
  361. {dissect_target-3.19.dev43/tests → dissect_target-3.19.dev44/dissect/target/volumes}/__init__.py +0 -0
  362. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/volumes/bde.py +0 -0
  363. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/volumes/ddf.py +0 -0
  364. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/volumes/disk.py +0 -0
  365. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/volumes/luks.py +0 -0
  366. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/volumes/lvm.py +0 -0
  367. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/volumes/md.py +0 -0
  368. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect/target/volumes/vmfs.py +0 -0
  369. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect.target.egg-info/dependency_links.txt +0 -0
  370. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect.target.egg-info/entry_points.txt +0 -0
  371. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect.target.egg-info/requires.txt +0 -0
  372. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/dissect.target.egg-info/top_level.txt +0 -0
  373. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/pyproject.toml +0 -0
  374. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/setup.cfg +0 -0
  375. {dissect_target-3.19.dev43/tests/containers → dissect_target-3.19.dev44/tests}/__init__.py +0 -0
  376. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/_docs/Makefile +0 -0
  377. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/_docs/conf.py +0 -0
  378. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/_docs/index.rst +0 -0
  379. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/_utils.py +0 -0
  380. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/conftest.py +0 -0
  381. {dissect_target-3.19.dev43/tests/filesystems → dissect_target-3.19.dev44/tests/containers}/__init__.py +0 -0
  382. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/containers/test_fortifw.py +0 -0
  383. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/containers/test_split.py +0 -0
  384. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/data/plugins/os/windows/jumplist/590aee7bdd69b59b.customDestinations-ms +0 -0
  385. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/data/plugins/os/windows/jumplist/5f7b5f1e01b83767.automaticDestinations-ms +0 -0
  386. {dissect_target-3.19.dev43/tests/helpers → dissect_target-3.19.dev44/tests/filesystems}/__init__.py +0 -0
  387. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/filesystems/test_cb.py +0 -0
  388. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/filesystems/test_config.py +0 -0
  389. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/filesystems/test_cpio.py +0 -0
  390. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/filesystems/test_dir.py +0 -0
  391. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/filesystems/test_exfat.py +0 -0
  392. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/filesystems/test_fat.py +0 -0
  393. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/filesystems/test_ntfs.py +0 -0
  394. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/filesystems/test_overlay.py +0 -0
  395. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/filesystems/test_smb.py +0 -0
  396. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/filesystems/test_tar.py +0 -0
  397. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/filesystems/test_vmtar.py +0 -0
  398. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/filesystems/test_zip.py +0 -0
  399. {dissect_target-3.19.dev43/tests/loaders → dissect_target-3.19.dev44/tests/helpers}/__init__.py +0 -0
  400. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/helpers/test_cache.py +0 -0
  401. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/helpers/test_config.py +0 -0
  402. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/helpers/test_configutil.py +0 -0
  403. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/helpers/test_docs.py +0 -0
  404. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/helpers/test_fsutil.py +0 -0
  405. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/helpers/test_hashutil.py +0 -0
  406. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/helpers/test_keychain.py +0 -0
  407. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/helpers/test_loaderutil.py +0 -0
  408. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/helpers/test_localeutil.py +0 -0
  409. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/helpers/test_modifier.py +0 -0
  410. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/helpers/test_protobuf.py +0 -0
  411. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/helpers/test_record.py +0 -0
  412. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/helpers/test_regutil.py +0 -0
  413. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/helpers/test_utils.py +0 -0
  414. {dissect_target-3.19.dev43/tests/plugins → dissect_target-3.19.dev44/tests/loaders}/__init__.py +0 -0
  415. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_ab.py +0 -0
  416. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_asdf.py +0 -0
  417. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_cb.py +0 -0
  418. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_dir.py +0 -0
  419. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_hyperv.py +0 -0
  420. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_kape.py +0 -0
  421. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_libvirt.py +0 -0
  422. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_local.py +0 -0
  423. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_log.py +0 -0
  424. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_mqtt.py +0 -0
  425. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_multiraw.py +0 -0
  426. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_ova.py +0 -0
  427. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_overlay.py +0 -0
  428. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_ovf.py +0 -0
  429. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_phobos.py +0 -0
  430. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_pvm.py +0 -0
  431. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_pvs.py +0 -0
  432. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_remote.py +0 -0
  433. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_smb.py +0 -0
  434. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_tanium.py +0 -0
  435. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_tar.py +0 -0
  436. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_utm.py +0 -0
  437. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_vbox.py +0 -0
  438. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_velociraptor.py +0 -0
  439. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/loaders/test_vmwarevm.py +0 -0
  440. {dissect_target-3.19.dev43/tests/plugins/apps → dissect_target-3.19.dev44/tests/plugins}/__init__.py +0 -0
  441. {dissect_target-3.19.dev43/tests/plugins/apps/av → dissect_target-3.19.dev44/tests/plugins/apps}/__init__.py +0 -0
  442. {dissect_target-3.19.dev43/tests/plugins/apps/browser → dissect_target-3.19.dev44/tests/plugins/apps/av}/__init__.py +0 -0
  443. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/av/test_mcafee.py +0 -0
  444. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/av/test_sophos.py +0 -0
  445. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/av/test_symantec.py +0 -0
  446. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/av/test_trendmicro.py +0 -0
  447. {dissect_target-3.19.dev43/tests/plugins/apps/container → dissect_target-3.19.dev44/tests/plugins/apps/browser}/__init__.py +0 -0
  448. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/browser/test_brave.py +0 -0
  449. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/browser/test_chrome.py +0 -0
  450. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/browser/test_chromium.py +0 -0
  451. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/browser/test_edge.py +0 -0
  452. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/browser/test_firefox.py +0 -0
  453. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/browser/test_iexplore.py +0 -0
  454. {dissect_target-3.19.dev43/tests/plugins/apps/remoteaccess → dissect_target-3.19.dev44/tests/plugins/apps/container}/__init__.py +0 -0
  455. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/container/test_docker.py +0 -0
  456. {dissect_target-3.19.dev43/tests/plugins/apps/shell → dissect_target-3.19.dev44/tests/plugins/apps/remoteaccess}/__init__.py +0 -0
  457. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/remoteaccess/test_anydesk.py +0 -0
  458. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/remoteaccess/test_teamviewer.py +0 -0
  459. {dissect_target-3.19.dev43/tests/plugins/apps/ssh → dissect_target-3.19.dev44/tests/plugins/apps/shell}/__init__.py +0 -0
  460. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/shell/test_powershell.py +0 -0
  461. {dissect_target-3.19.dev43/tests/plugins/apps/vpn → dissect_target-3.19.dev44/tests/plugins/apps/ssh}/__init__.py +0 -0
  462. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/ssh/test_openssh.py +0 -0
  463. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/ssh/test_opensshd.py +0 -0
  464. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/ssh/test_putty.py +0 -0
  465. {dissect_target-3.19.dev43/tests/plugins/apps/webhosting → dissect_target-3.19.dev44/tests/plugins/apps/texteditor}/__init__.py +0 -0
  466. {dissect_target-3.19.dev43/tests/plugins/apps/webserver → dissect_target-3.19.dev44/tests/plugins/apps/vpn}/__init__.py +0 -0
  467. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/vpn/test_openvpn.py +0 -0
  468. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/vpn/test_wireguard.py +0 -0
  469. {dissect_target-3.19.dev43/tests/plugins/child → dissect_target-3.19.dev44/tests/plugins/apps/webhosting}/__init__.py +0 -0
  470. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/webhosting/test_cpanel.py +0 -0
  471. {dissect_target-3.19.dev43/tests/plugins/filesystem → dissect_target-3.19.dev44/tests/plugins/apps/webserver}/__init__.py +0 -0
  472. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/webserver/test_apache.py +0 -0
  473. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/webserver/test_caddy.py +0 -0
  474. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/webserver/test_citrix.py +0 -0
  475. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/webserver/test_iis.py +0 -0
  476. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/webserver/test_nginx.py +0 -0
  477. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/apps/webserver/test_webserver.py +0 -0
  478. {dissect_target-3.19.dev43/tests/plugins/filesystem/ntfs → dissect_target-3.19.dev44/tests/plugins/child}/__init__.py +0 -0
  479. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/child/test_docker.py +0 -0
  480. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/child/test_hyperv.py +0 -0
  481. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/child/test_qemu.py +0 -0
  482. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/child/test_virtuozzo.py +0 -0
  483. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/child/test_wsl.py +0 -0
  484. {dissect_target-3.19.dev43/tests/plugins/filesystem/unix → dissect_target-3.19.dev44/tests/plugins/filesystem}/__init__.py +0 -0
  485. {dissect_target-3.19.dev43/tests/plugins/general → dissect_target-3.19.dev44/tests/plugins/filesystem/ntfs}/__init__.py +0 -0
  486. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/filesystem/ntfs/test_mft.py +0 -0
  487. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/filesystem/ntfs/test_usnjrnl.py +0 -0
  488. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/filesystem/test_acquire_handles.py +0 -0
  489. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/filesystem/test_acquire_hash.py +0 -0
  490. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/filesystem/test_icat.py +0 -0
  491. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/filesystem/test_resolver.py +0 -0
  492. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/filesystem/test_walkfs.py +0 -0
  493. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/filesystem/test_yara.py +0 -0
  494. {dissect_target-3.19.dev43/tests/plugins/os → dissect_target-3.19.dev44/tests/plugins/filesystem/unix}/__init__.py +0 -0
  495. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/filesystem/unix/test_capability.py +0 -0
  496. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/filesystem/unix/test_suid.py +0 -0
  497. {dissect_target-3.19.dev43/tests/plugins/os/unix → dissect_target-3.19.dev44/tests/plugins/general}/__init__.py +0 -0
  498. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/general/test_config.py +0 -0
  499. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/general/test_default.py +0 -0
  500. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/general/test_network.py +0 -0
  501. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/general/test_plugins.py +0 -0
  502. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/general/test_scrape.py +0 -0
  503. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/general/test_users.py +0 -0
  504. {dissect_target-3.19.dev43/tests/plugins/os/unix/bsd → dissect_target-3.19.dev44/tests/plugins/os}/__init__.py +0 -0
  505. {dissect_target-3.19.dev43/tests/plugins/os/unix/bsd/citrix → dissect_target-3.19.dev44/tests/plugins/os/unix}/__init__.py +0 -0
  506. {dissect_target-3.19.dev43/tests/plugins/os/unix/bsd/osx → dissect_target-3.19.dev44/tests/plugins/os/unix/bsd}/__init__.py +0 -0
  507. {dissect_target-3.19.dev43/tests/plugins/os/unix/esxi → dissect_target-3.19.dev44/tests/plugins/os/unix/bsd/citrix}/__init__.py +0 -0
  508. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/bsd/citrix/test__os.py +0 -0
  509. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/bsd/citrix/test_history.py +0 -0
  510. {dissect_target-3.19.dev43/tests/plugins/os/unix/linux → dissect_target-3.19.dev44/tests/plugins/os/unix/bsd/osx}/__init__.py +0 -0
  511. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/bsd/osx/test__os.py +0 -0
  512. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/bsd/osx/test_user.py +0 -0
  513. {dissect_target-3.19.dev43/tests/plugins/os/unix/linux/android → dissect_target-3.19.dev44/tests/plugins/os/unix/esxi}/__init__.py +0 -0
  514. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/esxi/test__os.py +0 -0
  515. {dissect_target-3.19.dev43/tests/plugins/os/unix/linux/debian → dissect_target-3.19.dev44/tests/plugins/os/unix/linux}/__init__.py +0 -0
  516. {dissect_target-3.19.dev43/tests/plugins/os/unix/linux/redhat → dissect_target-3.19.dev44/tests/plugins/os/unix/linux/android}/__init__.py +0 -0
  517. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/linux/android/test__os.py +0 -0
  518. {dissect_target-3.19.dev43/tests/plugins/os/unix/linux/suse → dissect_target-3.19.dev44/tests/plugins/os/unix/linux/debian}/__init__.py +0 -0
  519. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/linux/debian/test_apt.py +0 -0
  520. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/linux/debian/test_dpkg.py +0 -0
  521. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/linux/fortios/test_keys.py +0 -0
  522. {dissect_target-3.19.dev43/tests/plugins/os/unix/locate → dissect_target-3.19.dev44/tests/plugins/os/unix/linux/redhat}/__init__.py +0 -0
  523. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/linux/redhat/test_yum.py +0 -0
  524. {dissect_target-3.19.dev43/tests/plugins/os/unix/log → dissect_target-3.19.dev44/tests/plugins/os/unix/linux/suse}/__init__.py +0 -0
  525. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/linux/suse/test_zypper.py +0 -0
  526. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/linux/test_cmdline.py +0 -0
  527. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/linux/test_environ.py +0 -0
  528. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/linux/test_iptables.py +0 -0
  529. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/linux/test_modules.py +0 -0
  530. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/linux/test_netstat.py +0 -0
  531. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/linux/test_proc.py +0 -0
  532. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/linux/test_processes.py +0 -0
  533. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/linux/test_services.py +0 -0
  534. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/linux/test_sockets.py +0 -0
  535. {dissect_target-3.19.dev43/tests/plugins/os/windows → dissect_target-3.19.dev44/tests/plugins/os/unix/locate}/__init__.py +0 -0
  536. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/locate/test_gnulocate.py +0 -0
  537. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/locate/test_mlocate.py +0 -0
  538. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/locate/test_plocate.py +0 -0
  539. {dissect_target-3.19.dev43/tests/plugins/os/windows/regf → dissect_target-3.19.dev44/tests/plugins/os/unix/log}/__init__.py +0 -0
  540. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/log/test_atop.py +0 -0
  541. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/log/test_audit.py +0 -0
  542. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/log/test_auth.py +0 -0
  543. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/log/test_lastlog.py +0 -0
  544. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/log/test_messages.py +0 -0
  545. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/log/test_utmp.py +0 -0
  546. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/test__os.py +0 -0
  547. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/test_generic.py +0 -0
  548. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/test_history.py +0 -0
  549. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/test_ips.py +0 -0
  550. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/test_journal.py +0 -0
  551. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/test_locale.py +0 -0
  552. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/test_packagemanager.py +0 -0
  553. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/test_shadow.py +0 -0
  554. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/test_users.py +0 -0
  555. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/unix/test_version.py +0 -0
  556. {dissect_target-3.19.dev43/tests/tools → dissect_target-3.19.dev44/tests/plugins/os/windows}/__init__.py +0 -0
  557. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/log/test_etl.py +0 -0
  558. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/log/test_evt.py +0 -0
  559. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/log/test_evtx.py +0 -0
  560. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/log/test_schedlgu.py +0 -0
  561. {dissect_target-3.19.dev43/tests/volumes → dissect_target-3.19.dev44/tests/plugins/os/windows/regf}/__init__.py +0 -0
  562. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/regf/test_appxdebugkeys.py +0 -0
  563. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/regf/test_cit.py +0 -0
  564. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/regf/test_clsid.py +0 -0
  565. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/regf/test_muicache.py +0 -0
  566. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/regf/test_shellbags.py +0 -0
  567. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/regf/test_trusteddocs.py +0 -0
  568. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/regf/test_usb.py +0 -0
  569. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/regf/test_userassist.py +0 -0
  570. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test__os.py +0 -0
  571. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_adpolicy.py +0 -0
  572. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_amcache.py +0 -0
  573. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_catroot.py +0 -0
  574. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_clfs.py +0 -0
  575. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_credhist.py +0 -0
  576. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_datetime.py +0 -0
  577. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_defender.py +0 -0
  578. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_dpapi.py +0 -0
  579. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_env.py +0 -0
  580. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_generic.py +0 -0
  581. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_jumplist.py +0 -0
  582. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_lnk.py +0 -0
  583. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_locale.py +0 -0
  584. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_mru.py +0 -0
  585. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_notifications.py +0 -0
  586. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_prefetch.py +0 -0
  587. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_recyclebin.py +0 -0
  588. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_registry.py +0 -0
  589. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_sam.py +0 -0
  590. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_shimcache.py +0 -0
  591. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_sru.py +0 -0
  592. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_syscache.py +0 -0
  593. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_tasks.py +0 -0
  594. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_thumbcache.py +0 -0
  595. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_ual.py +0 -0
  596. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_wer.py +0 -0
  597. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/plugins/os/windows/test_wua_history.py +0 -0
  598. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/test_container.py +0 -0
  599. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/test_filesystem.py +0 -0
  600. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/test_plugin.py +0 -0
  601. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/test_registration.py +0 -0
  602. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/test_report.py +0 -0
  603. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/test_target.py +0 -0
  604. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/test_volume.py +0 -0
  605. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/tools/test_dump.py +0 -0
  606. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/tools/test_fs.py +0 -0
  607. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/tools/test_fsutils.py +0 -0
  608. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/tools/test_info.py +0 -0
  609. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/tools/test_mount.py +0 -0
  610. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/tools/test_query.py +0 -0
  611. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/tools/test_reg.py +0 -0
  612. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/tools/test_shell.py +0 -0
  613. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/tools/test_utils.py +0 -0
  614. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/tools/test_yara.py +0 -0
  615. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/volumes/test_bde.py +0 -0
  616. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tests/volumes/test_md.py +0 -0
  617. {dissect_target-3.19.dev43 → dissect_target-3.19.dev44}/tox.ini +0 -0
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.1
2
2
  Name: dissect.target
3
- Version: 3.19.dev43
3
+ Version: 3.19.dev44
4
4
  Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
5
5
  Author-email: Dissect Team <dissect@fox-it.com>
6
6
  License: Affero General Public License v3
@@ -0,0 +1,13 @@
1
+ from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
2
+ from dissect.target.helpers.record import create_extended_descriptor
3
+ from dissect.target.plugin import NamespacePlugin
4
+
5
+ GENERIC_TAB_CONTENTS_RECORD_FIELDS = [("string", "content"), ("path", "path"), ("string", "deleted_content")]
6
+
7
+ TexteditorTabContentRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
8
+ "texteditor/tab", GENERIC_TAB_CONTENTS_RECORD_FIELDS
9
+ )
10
+
11
+
12
+ class TexteditorPlugin(NamespacePlugin):
13
+ __namespace__ = "texteditor"
@@ -0,0 +1,340 @@
1
+ from __future__ import annotations
2
+
3
+ import logging
4
+ import zlib
5
+ from typing import Iterator
6
+
7
+ from dissect.cstruct import cstruct
8
+ from dissect.util.ts import wintimestamp
9
+ from flow.record.fieldtypes import digest
10
+
11
+ from dissect.target.exceptions import UnsupportedPluginError
12
+ from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
13
+ from dissect.target.helpers.fsutil import TargetPath
14
+ from dissect.target.helpers.record import (
15
+ UnixUserRecord,
16
+ WindowsUserRecord,
17
+ create_extended_descriptor,
18
+ )
19
+ from dissect.target.plugin import export
20
+ from dissect.target.plugins.apps.texteditor.texteditor import (
21
+ GENERIC_TAB_CONTENTS_RECORD_FIELDS,
22
+ TexteditorPlugin,
23
+ )
24
+ from dissect.target.target import Target
25
+
26
+ # Thanks to @Nordgaren, @daddycocoaman, @JustArion and @ogmini for their suggestions and feedback in the PR
27
+ # thread. This really helped to figure out the last missing bits and pieces
28
+ # required for recovering text from these files.
29
+
30
+ windowstab_def = """
31
+ struct file_header {
32
+ char magic[2]; // NP
33
+ uleb128 updateNumber; // increases on every settings update when fileType=9,
34
+ // doesn't seem to change on fileType 0 or 1
35
+ uleb128 fileType; // 0 if unsaved, 1 if saved, 9 if contains settings?
36
+ }
37
+
38
+ struct tab_header_saved {
39
+ uleb128 filePathLength;
40
+ wchar filePath[filePathLength];
41
+ uleb128 fileSize; // likely similar to fixedSizeBlockLength
42
+ uleb128 encoding;
43
+ uleb128 carriageReturnType;
44
+ uleb128 timestamp; // Windows Filetime format (not unix timestamp)
45
+ char sha256[32];
46
+ char unk0;
47
+ char unk1;
48
+ uleb128 fixedSizeBlockLength;
49
+ uleb128 fixedSizeBlockLengthDuplicate;
50
+ uint8 wordWrap; // 1 if wordwrap enabled, 0 if disabled
51
+ uint8 rightToLeft;
52
+ uint8 showUnicode;
53
+ uint8 optionsVersion;
54
+ };
55
+
56
+ struct tab_header_unsaved {
57
+ char unk0;
58
+ uleb128 fixedSizeBlockLength; // will always be 00 when unsaved because size is not yet known
59
+ uleb128 fixedSizeBlockLengthDuplicate; // will always be 00 when unsaved because size is not yet known
60
+ uint8 wordWrap; // 1 if wordwrap enabled, 0 if disabled
61
+ uint8 rightToLeft;
62
+ uint8 showUnicode;
63
+ uint8 optionsVersion;
64
+ };
65
+
66
+ struct tab_header_crc32_stub {
67
+ char unk1;
68
+ char unk2;
69
+ char crc32[4];
70
+ };
71
+
72
+ struct fixed_size_data_block {
73
+ uleb128 nAdded;
74
+ wchar data[nAdded];
75
+ uint8 hasRemainingVariableDataBlocks; // indicates whether after this single-data block more data will follow
76
+ char crc32[4];
77
+ };
78
+
79
+ struct variable_size_data_block {
80
+ uleb128 offset;
81
+ uleb128 nDeleted;
82
+ uleb128 nAdded;
83
+ wchar data[nAdded];
84
+ char crc32[4];
85
+ };
86
+
87
+ struct options_v1 {
88
+ uleb128 unk;
89
+ };
90
+
91
+ struct options_v2 {
92
+ uleb128 unk1; // likely autocorrect or spellcheck
93
+ uleb128 unk2; // likely autocorrect or spellcheck
94
+ };
95
+ """
96
+
97
+ WINDOWS_SAVED_TABS_EXTRA_FIELDS = [("datetime", "modification_time"), ("digest", "hashes"), ("path", "saved_path")]
98
+
99
+ WindowsNotepadUnsavedTabRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
100
+ "texteditor/windowsnotepad/tab/unsaved",
101
+ GENERIC_TAB_CONTENTS_RECORD_FIELDS,
102
+ )
103
+
104
+ WindowsNotepadSavedTabRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
105
+ "texteditor/windowsnotepad/tab/saved",
106
+ GENERIC_TAB_CONTENTS_RECORD_FIELDS + WINDOWS_SAVED_TABS_EXTRA_FIELDS,
107
+ )
108
+
109
+ c_windowstab = cstruct().load(windowstab_def)
110
+
111
+
112
+ def _calc_crc32(data: bytes) -> bytes:
113
+ """Perform a CRC32 checksum on the data and return it as bytes."""
114
+ return zlib.crc32(data).to_bytes(length=4, byteorder="big")
115
+
116
+
117
+ class WindowsNotepadTab:
118
+ """Windows notepad tab content parser"""
119
+
120
+ def __init__(self, file: TargetPath):
121
+ self.file = file
122
+ self.is_saved = None
123
+ self.content = None
124
+ self.deleted_content = None
125
+ self._process_tab_file()
126
+
127
+ def __repr__(self) -> str:
128
+ return (
129
+ f"<{self.__class__.__name__} saved={self.is_saved} "
130
+ f"content_size={len(self.content)} has_deleted_content={self.deleted_content is not None}>"
131
+ )
132
+
133
+ def _process_tab_file(self) -> None:
134
+ """Parse a binary tab file and reconstruct the contents."""
135
+ with self.file.open("rb") as fh:
136
+ # Header is the same for all types
137
+ self.file_header = c_windowstab.file_header(fh)
138
+
139
+ # fileType == 1 # 0 is unsaved, 1 is saved, 9 is settings?
140
+ self.is_saved = self.file_header.fileType == 1
141
+
142
+ # Tabs can be saved to a file with a filename on disk, or unsaved (kept in the TabState folder).
143
+ # Depending on the file's saved state, different header fields are present
144
+ self.tab_header = (
145
+ c_windowstab.tab_header_saved(fh) if self.is_saved else c_windowstab.tab_header_unsaved(fh)
146
+ )
147
+
148
+ # There appears to be a optionsVersion field that specifies the options that are passed.
149
+ # At the moment of writing, it is not sure whether this specifies a version or a number of bytes
150
+ # that is parsed, so just going with the 'optionsVersion' type for now.
151
+ # We don't use the options, but since they are required for the CRC32 checksum
152
+ # we store the byte representation
153
+ if self.tab_header.optionsVersion == 0:
154
+ # No options specified
155
+ self.options = b""
156
+ elif self.tab_header.optionsVersion == 1:
157
+ self.options = c_windowstab.options_v1(fh).dumps()
158
+ elif self.tab_header.optionsVersion == 2:
159
+ self.options = c_windowstab.options_v2(fh).dumps()
160
+ else:
161
+ # Raise an error, since we don't know how many bytes future optionVersions will occupy.
162
+ # Now knowing how many bytes to parse can mess up the alignment and structs.
163
+ raise NotImplementedError("Unknown Windows Notepad tab option version")
164
+
165
+ # If the file is not saved to disk and no fixedSizeBlockLength is present, an extra checksum stub
166
+ # is present. So parse that first
167
+ if not self.is_saved and self.tab_header.fixedSizeBlockLength == 0:
168
+ # Two unknown bytes before the CRC32
169
+ tab_header_crc32_stub = c_windowstab.tab_header_crc32_stub(fh)
170
+
171
+ # Calculate CRC32 of the header and check if it matches
172
+ actual_header_crc32 = _calc_crc32(
173
+ self.file_header.dumps()[3:]
174
+ + self.tab_header.dumps()
175
+ + self.options
176
+ + tab_header_crc32_stub.dumps()[:-4]
177
+ )
178
+ if tab_header_crc32_stub.crc32 != actual_header_crc32:
179
+ logging.warning(
180
+ "CRC32 mismatch in header of file: %s (expected=%s, actual=%s)",
181
+ self.file.name,
182
+ tab_header_crc32_stub.crc32.hex(),
183
+ actual_header_crc32.hex(),
184
+ )
185
+
186
+ # Used to store the final content
187
+ self.content = ""
188
+
189
+ # In the case that a fixedSizeDataBlock is present, this value is set to a nonzero value
190
+ if self.tab_header.fixedSizeBlockLength > 0:
191
+ # So we parse the fixed size data block
192
+ self.data_entry = c_windowstab.fixed_size_data_block(fh)
193
+
194
+ # The header (minus the magic) plus all data is included in the checksum
195
+ actual_crc32 = _calc_crc32(
196
+ self.file_header.dumps()[3:] + self.tab_header.dumps() + self.options + self.data_entry.dumps()[:-4]
197
+ )
198
+
199
+ if self.data_entry.crc32 != actual_crc32:
200
+ logging.warning(
201
+ "CRC32 mismatch in single-block file: %s (expected=%s, actual=%s)",
202
+ self.file.name,
203
+ self.data_entry.crc32.hex(),
204
+ actual_crc32.hex(),
205
+ )
206
+
207
+ # Add the content of the fixed size data block to the tab content
208
+ self.content += self.data_entry.data
209
+
210
+ # Used to store the deleted content, if available
211
+ deleted_content = ""
212
+
213
+ # If fixedSizeBlockLength in the header has a value of zero, this means that the entire file consists of
214
+ # variable-length blocks. Furthermore, if there is any remaining data after the
215
+ # first fixed size blocks, as indicated by the value of hasRemainingVariableDataBlocks,
216
+ # also continue we also want to continue parsing
217
+ if self.tab_header.fixedSizeBlockLength == 0 or (
218
+ self.tab_header.fixedSizeBlockLength > 0 and self.data_entry.hasRemainingVariableDataBlocks == 1
219
+ ):
220
+ # Here, data is stored in variable-length blocks. This happens, for example, when several
221
+ # additions and deletions of characters have been recorded and these changes have not been 'flushed'
222
+
223
+ # Since we don't know the size of the file up front, and offsets don't necessarily have to be in order,
224
+ # a list is used to easily insert text at offsets
225
+ text = []
226
+
227
+ while True:
228
+ # Unfortunately, there is no way of determining how many blocks there are. So just try to parse
229
+ # until we reach EOF, after which we stop.
230
+ try:
231
+ data_entry = c_windowstab.variable_size_data_block(fh)
232
+ except EOFError:
233
+ break
234
+
235
+ # Either the nAdded is nonzero, or the nDeleted
236
+ if data_entry.nAdded > 0:
237
+ # Check the CRC32 checksum for this block
238
+ actual_crc32 = _calc_crc32(data_entry.dumps()[:-4])
239
+ if data_entry.crc32 != actual_crc32:
240
+ logging.warning(
241
+ "CRC32 mismatch in multi-block file: %s (expected=%s, actual=%s)",
242
+ self.file.name,
243
+ data_entry.crc32.hex(),
244
+ actual_crc32.hex(),
245
+ )
246
+
247
+ # Insert the text at the correct offset.
248
+ for idx in range(data_entry.nAdded):
249
+ text.insert(data_entry.offset + idx, data_entry.data[idx])
250
+
251
+ elif data_entry.nDeleted > 0:
252
+ # Create a new slice. Include everything up to the offset,
253
+ # plus everything after the nDeleted following bytes
254
+ deleted_content += "".join(text[data_entry.offset : data_entry.offset + data_entry.nDeleted])
255
+ text = text[: data_entry.offset] + text[data_entry.offset + data_entry.nDeleted :]
256
+
257
+ # Join all the characters to reconstruct the original text within the variable-length data blocks
258
+ text = "".join(text)
259
+
260
+ # Finally, add the reconstructed text to the tab content
261
+ self.content += text
262
+
263
+ # Set None if no deleted content was found
264
+ self.deleted_content = deleted_content if deleted_content else None
265
+
266
+
267
+ class WindowsNotepadPlugin(TexteditorPlugin):
268
+ """Windows notepad tab content plugin."""
269
+
270
+ __namespace__ = "windowsnotepad"
271
+
272
+ GLOB = "AppData/Local/Packages/Microsoft.WindowsNotepad_*/LocalState/TabState/*.bin"
273
+
274
+ def __init__(self, target: Target):
275
+ super().__init__(target)
276
+ self.users_tabs: list[TargetPath, UnixUserRecord | WindowsUserRecord] = []
277
+ for user_details in self.target.user_details.all_with_home():
278
+ for tab_file in user_details.home_path.glob(self.GLOB):
279
+ # These files seem to contain information on different settings / configurations,
280
+ # and are skipped for now
281
+ if tab_file.name.endswith(".1.bin") or tab_file.name.endswith(".0.bin"):
282
+ continue
283
+
284
+ self.users_tabs.append((tab_file, user_details.user))
285
+
286
+ def check_compatible(self) -> None:
287
+ if not self.users_tabs:
288
+ raise UnsupportedPluginError("No Windows Notepad tab files found")
289
+
290
+ @export(record=[WindowsNotepadSavedTabRecord, WindowsNotepadUnsavedTabRecord])
291
+ def tabs(self) -> Iterator[WindowsNotepadSavedTabRecord | WindowsNotepadUnsavedTabRecord]:
292
+ """Return contents from Windows 11 Notepad tabs - and its deleted content if available.
293
+
294
+ Windows Notepad application for Windows 11 is now able to restore both saved and unsaved tabs when you re-open
295
+ the application.
296
+
297
+
298
+ Resources:
299
+ - https://github.com/fox-it/dissect.target/pull/540
300
+ - https://github.com/JustArion/Notepad-Tabs
301
+ - https://github.com/ogmini/Notepad-Tabstate-Buffer
302
+ - https://github.com/ogmini/Notepad-State-Library
303
+ - https://github.com/Nordgaren/tabstate-util
304
+ - https://github.com/Nordgaren/tabstate-util/issues/1
305
+ - https://medium.com/@mahmoudsoheem/new-digital-forensics-artifact-from-windows-notepad-527645906b7b
306
+
307
+ Yields a WindowsNotepadSavedTabRecord or WindowsNotepadUnsavedTabRecord. with fields:
308
+
309
+ .. code-block:: text
310
+
311
+ content (string): The content of the tab.
312
+ path (path): The path to the tab file.
313
+ deleted_content (string): The deleted content of the tab, if available.
314
+ hashes (digest): A digest of the tab content.
315
+ saved_path (path): The path where the tab was saved.
316
+ modification_time (datetime): The modification time of the tab.
317
+ """
318
+ for file, user in self.users_tabs:
319
+ # Parse the file
320
+ tab: WindowsNotepadTab = WindowsNotepadTab(file)
321
+
322
+ if tab.is_saved:
323
+ yield WindowsNotepadSavedTabRecord(
324
+ content=tab.content,
325
+ path=tab.file,
326
+ deleted_content=tab.deleted_content,
327
+ hashes=digest((None, None, tab.tab_header.sha256.hex())),
328
+ saved_path=tab.tab_header.filePath,
329
+ modification_time=wintimestamp(tab.tab_header.timestamp),
330
+ _target=self.target,
331
+ _user=user,
332
+ )
333
+ else:
334
+ yield WindowsNotepadUnsavedTabRecord(
335
+ content=tab.content,
336
+ path=tab.file,
337
+ _target=self.target,
338
+ _user=user,
339
+ deleted_content=tab.deleted_content,
340
+ )
@@ -1,6 +1,6 @@
1
1
  Metadata-Version: 2.1
2
2
  Name: dissect.target
3
- Version: 3.19.dev43
3
+ Version: 3.19.dev44
4
4
  Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
5
5
  Author-email: Dissect Team <dissect@fox-it.com>
6
6
  License: Affero General Public License v3
@@ -153,6 +153,9 @@ dissect/target/plugins/apps/ssh/openssh.py
153
153
  dissect/target/plugins/apps/ssh/opensshd.py
154
154
  dissect/target/plugins/apps/ssh/putty.py
155
155
  dissect/target/plugins/apps/ssh/ssh.py
156
+ dissect/target/plugins/apps/texteditor/__init__.py
157
+ dissect/target/plugins/apps/texteditor/texteditor.py
158
+ dissect/target/plugins/apps/texteditor/windowsnotepad.py
156
159
  dissect/target/plugins/apps/vpn/__init__.py
157
160
  dissect/target/plugins/apps/vpn/openvpn.py
158
161
  dissect/target/plugins/apps/vpn/wireguard.py
@@ -462,6 +465,8 @@ tests/plugins/apps/ssh/__init__.py
462
465
  tests/plugins/apps/ssh/test_openssh.py
463
466
  tests/plugins/apps/ssh/test_opensshd.py
464
467
  tests/plugins/apps/ssh/test_putty.py
468
+ tests/plugins/apps/texteditor/__init__.py
469
+ tests/plugins/apps/texteditor/test_texteditor.py
465
470
  tests/plugins/apps/vpn/__init__.py
466
471
  tests/plugins/apps/vpn/test_openvpn.py
467
472
  tests/plugins/apps/vpn/test_wireguard.py
@@ -0,0 +1,190 @@
1
+ import os
2
+ from pathlib import Path
3
+
4
+ from flow.record.fieldtypes import datetime as dt
5
+
6
+ from dissect.target.filesystem import VirtualFilesystem
7
+ from dissect.target.plugins.apps.texteditor.windowsnotepad import (
8
+ WindowsNotepadPlugin,
9
+ WindowsNotepadTab,
10
+ )
11
+ from dissect.target.target import Target
12
+ from tests._utils import absolute_path
13
+
14
+ text1 = "This is an unsaved tab, UTF-8 encoded with Windows (CRLF). It's only 88 characters long."
15
+ text2 = (
16
+ "Dissect は、インシデント対応のための優れたフレームワークです。 The Notepad window shows UTF-8 as the encoding. This text has 113 "
17
+ "characters."
18
+ )
19
+ text3 = "This is a very short text."
20
+ text4 = "This is another short test. And we should be able to parse this."
21
+ text5 = "This is a test and the text is longer than 256 bytes. "
22
+ text6 = "This is a test and the text is longer than 65536 bytes. "
23
+ text7 = (
24
+ "This a text, which is nothing special. But I am going to modify it a bit. For example, "
25
+ "I have removed quote some stuff. Adding a word in the beginning now... "
26
+ "At this point, I've edited it quite a lot."
27
+ )
28
+ text8 = (
29
+ "Closing application now. It's saved but now I'm adding unsaved changes and closing "
30
+ "the application again. Dit a few deletions!"
31
+ )
32
+ loremipsum = """Lorem ipsum dolor sit amet. Eum error blanditiis eum pariatur delectus ut consequuntur officiis a excepturi dignissimos et doloribus quia 33 perspiciatis soluta nam perspiciatis dolor. Ut repudiandae quidem cum sint modi qui sint consequatur. Aut autem quidem eum enim consequatur qui voluptate consequatur non similique voluptate. A vitae modi vel sint provident ut galisum tenetur sit voluptatem amet. Est impedit perspiciatis est repudiandae voluptates ut fugit alias! Eum magni esse aut velit illum qui excepturi aperiam. Ex dolores asperiores ut debitis omnis qui consequuntur dolore. Est voluptatem mollitia et quibusdam unde ea accusamus fuga. Cum quis galisum et impedit sunt qui aliquam perspiciatis sed modi quidem qui nisi molestias. Aut temporibus architecto ut neque voluptatem et consequatur deleniti sed accusantium quibusdam et omnis dignissimos ad rerum ipsam et rerum quia. Ut nihil repellat et eaque molestias quo iusto ipsum At optio sint eos quidem earum?\r\rEx deleniti unde eum tenetur rerum ea dolore numquam? Eos aperiam officiis et neque explicabo et enim atque ut eaque omnis non illum eveniet est molestias itaque et ratione voluptatem. Ea deserunt nemo et quos tempora et nostrum aperiam sit necessitatibus illo sit culpa placeat. Vel tempore quibusdam ut velit voluptate aut odio facere non voluptas earum est odio galisum et voluptas harum. Et blanditiis sapiente et nostrum laborum aut voluptatem explicabo a quasi assumenda. Est voluptatem quia eum minima galisum quo totam excepturi aut facilis enim vel voluptate repudiandae sit distinctio laboriosam. Quo possimus molestiae et molestiae accusantium est voluptas omnis sed obcaecati natus. Non vitae asperiores qui nostrum enim id saepe fugiat et incidunt quasi.\r\rEos ipsa facilis aut excepturi voluptatem a omnis magni vel magni iste. Sed ipsum consequatur qui reprehenderit deleniti et soluta molestiae. Ut vero assumenda id dolor ipsum in deleniti voluptatem aut quis quisquam sed repudiandae temporibus ab quia inventore. Sed velit fugit vel facere cumque et delectus ullam sed eaque impedit. Est veritatis dignissimos aut doloribus dolorem vel pariatur repellendus sit nesciunt similique eum architecto quia. Ea expedita veritatis eum dolorem molestiae ut enim fugit aut beatae quibusdam. Aut voluptas natus in quidem deleniti aut animi iure est incidunt tenetur qui culpa maiores! Et nostrum quaerat qui consequatur consequatur aut aliquam atque aut praesentium rerum et consequuntur exercitationem. Non accusantium ipsa vel consectetur vitae ut magnam autem et natus rerum ut consectetur inventore est doloremque temporibus 33 dolores doloribus! Aut perferendis optio et nostrum repellendus et fugit itaque ut nisi neque sed sint quaerat. Aut placeat architecto et eius sapiente eum molestiae quam. Quo mollitia sapiente non Quis neque non tempora laudantium. Quo distinctio quos et molestias natus sit veritatis consequuntur aut repellendus neque a porro galisum cum numquam nesciunt et animi earum? Aut dolorum dolore non assumenda omnis et molestiae amet id sint vero est eligendi harum sit temporibus magnam aut ipsam quos.\r\r""" # noqa: E501
33
+
34
+
35
+ def test_windows_tab_parsing() -> None:
36
+ # Standalone parsing of tab files, so not using the plugin
37
+ tab_file = Path(absolute_path("_data/plugins/apps/texteditor/windowsnotepad/unsaved-with-deletions.bin"))
38
+ content = WindowsNotepadTab(tab_file)
39
+ assert content.content == "Not saved aasdflasd"
40
+ assert repr(content) == "<WindowsNotepadTab saved=False content_size=19 has_deleted_content=True>"
41
+
42
+
43
+ def test_windows_tab_plugin_deleted_contents(
44
+ target_win: Target, fs_win: VirtualFilesystem, tmp_path: Path, target_win_users: Target
45
+ ) -> None:
46
+ file_text_map = {
47
+ "unsaved-with-deletions.bin": ("Not saved aasdflasd", "snUlltllafds tjkf"),
48
+ "lots-of-deletions.bin": (
49
+ "This a text, which is nothing special. But I am going to modify it a bit. "
50
+ "For example, I have removed quote some stuff. "
51
+ "Adding a word in the beginning now... "
52
+ "At this point, I've edited it quite a lot.",
53
+ "b a ,elpmac ydaerlae already thi laiceps emos",
54
+ ),
55
+ }
56
+
57
+ tabcache = absolute_path("_data/plugins/apps/texteditor/windowsnotepad/")
58
+
59
+ user = target_win_users.user_details.find(username="John")
60
+ tab_dir = user.home_path.joinpath(
61
+ "AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState"
62
+ )
63
+
64
+ fs_win.map_dir("Users\\John", tmp_path)
65
+
66
+ for file in file_text_map.keys():
67
+ tab_file = str(tab_dir.joinpath(file))[3:]
68
+ fs_win.map_file(tab_file, os.path.join(tabcache, file))
69
+
70
+ target_win.add_plugin(WindowsNotepadPlugin)
71
+
72
+ records = list(target_win.windowsnotepad.tabs())
73
+
74
+ # Check the amount of files
75
+ assert len(list(tab_dir.iterdir())) == len(file_text_map.keys())
76
+ assert len(records) == len(file_text_map.keys())
77
+
78
+ # The recovered content in the records should match the original data, as well as the length
79
+ for rec in records:
80
+ assert rec.content == file_text_map[rec.path.name][0]
81
+ assert rec.deleted_content == file_text_map[rec.path.name][1]
82
+
83
+
84
+ def test_windows_tab_plugin_default(
85
+ target_win: Target, fs_win: VirtualFilesystem, tmp_path: Path, target_win_users: Target, caplog
86
+ ) -> None:
87
+ file_text_map = {
88
+ "c515e86f-08b3-4d76-844a-cddfcd43fcbb.bin": (text1, None),
89
+ "85167c9d-aac2-4469-ae44-db5dccf8f7f4.bin": (text2, None),
90
+ "dae80df8-e1e5-4996-87fe-b453f63fcb19.bin": (text3, "THis is "),
91
+ "3f915e17-cf6c-462b-9bd1-2f23314cb979.bin": (text4, None),
92
+ "ba291ccd-f1c3-4ca8-949c-c01f6633789d.bin": ((text5 * 5), None),
93
+ "e609218e-94f2-45fa-84e2-f29df2190b26.bin": ((text6 * 1260), None),
94
+ "3d0cc86e-dfc9-4f16-b74a-918c2c24188c.bin": (loremipsum, None),
95
+ "wrong-checksum.bin": (text4, None), # only added to check for corrupt checksum, not validity
96
+ "cfe38135-9dca-4480-944f-d5ea0e1e589f.bin": (
97
+ (loremipsum * 37)[:-2],
98
+ None,
99
+ ), # removed the two newlines in this file
100
+ "saved.bin": ("Saved!", None),
101
+ "unsaved.bin": ("Not saved at all", "snUllt"),
102
+ "unsaved-with-deletions.bin": ("Not saved aasdflasd", "snUlltllafds tjkf"),
103
+ "lots-of-deletions.bin": (text7, "b a ,elpmac ydaerlae already thi laiceps emos"),
104
+ "appclosed_saved_and_deletions.bin": (text8, None),
105
+ "appclosed_unsaved.bin": ("Closing application now", None),
106
+ "new-format.bin": ("", None),
107
+ "stored_unsaved_with_new_data.bin": ("Stored to disk but unsaved, but with extra data.", None),
108
+ }
109
+
110
+ tabcache = absolute_path("_data/plugins/apps/texteditor/windowsnotepad/")
111
+
112
+ user = target_win_users.user_details.find(username="John")
113
+ tab_dir = user.home_path.joinpath(
114
+ "AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState"
115
+ )
116
+
117
+ fs_win.map_dir("Users\\John", tmp_path)
118
+
119
+ for file in file_text_map.keys():
120
+ tab_file = str(tab_dir.joinpath(file))[3:]
121
+ fs_win.map_file(tab_file, os.path.join(tabcache, file))
122
+
123
+ target_win.add_plugin(WindowsNotepadPlugin)
124
+
125
+ records = list(target_win.windowsnotepad.tabs())
126
+
127
+ # Check the amount of files
128
+ assert len(list(tab_dir.iterdir())) == len(file_text_map.keys())
129
+ assert len(records) == len(file_text_map.keys())
130
+
131
+ for line in caplog.text.split("\n"):
132
+ # One file should still return contents, but there should be an entry for in the logging for a CRC missmatch.
133
+ assert (
134
+ "CRC32 mismatch in single-block file: wrong-checksum.bin (expected=deadbeef, actual=a48d30a6)" in line
135
+ or "CRC32 mismatch" not in line
136
+ )
137
+
138
+ # The recovered content in the records should match the original data, as well as the length
139
+ for rec in records:
140
+ assert rec.content == file_text_map[rec.path.name][0]
141
+ assert rec.deleted_content == file_text_map[rec.path.name][1]
142
+
143
+
144
+ def test_windows_saved_tab_plugin_extra_fields(
145
+ target_win: Target, fs_win: VirtualFilesystem, tmp_path: Path, target_win_users: Target
146
+ ) -> None:
147
+ file_text_map = {
148
+ "saved.bin": (
149
+ "Saved!",
150
+ "C:\\Users\\user\\Desktop\\Saved!.txt",
151
+ dt(2024, 3, 28, 13, 7, 55, 482183),
152
+ "ed9b760289e614c9dc8776e7280abe870be0a85019a32220b35acc54c0ecfbc1",
153
+ ),
154
+ "appclosed_saved_and_deletions.bin": (
155
+ text8,
156
+ "C:\\Users\\user\\Desktop\\Saved.txt",
157
+ dt(2024, 3, 28, 13, 16, 21, 158279),
158
+ "8d0533144aa42e2d81e7474332bdef6473e42b699041528d55a62e5391e914ce",
159
+ ),
160
+ }
161
+
162
+ tabcache = absolute_path("_data/plugins/apps/texteditor/windowsnotepad/")
163
+
164
+ user = target_win_users.user_details.find(username="John")
165
+ tab_dir = user.home_path.joinpath(
166
+ "AppData/Local/Packages/Microsoft.WindowsNotepad_8wekyb3d8bbwe/LocalState/TabState"
167
+ )
168
+
169
+ fs_win.map_dir("Users\\John", tmp_path)
170
+
171
+ for file in file_text_map.keys():
172
+ tab_file = str(tab_dir.joinpath(file))[3:]
173
+ fs_win.map_file(tab_file, os.path.join(tabcache, file))
174
+
175
+ target_win.add_plugin(WindowsNotepadPlugin)
176
+
177
+ records = list(target_win.windowsnotepad.tabs())
178
+
179
+ # Check the amount of files
180
+ assert len(list(tab_dir.iterdir())) == len(file_text_map.keys())
181
+ assert len(records) == len(file_text_map.keys())
182
+
183
+ # The recovered content in the records should match the original data, as well as the length and all the
184
+ # other saved metadata
185
+ for rec in records:
186
+ assert len(rec.content) == len(file_text_map[rec.path.name][0])
187
+ assert rec.content == file_text_map[rec.path.name][0]
188
+ assert rec.saved_path == file_text_map[rec.path.name][1]
189
+ assert rec.modification_time == file_text_map[rec.path.name][2]
190
+ assert rec.hashes.sha256 == file_text_map[rec.path.name][3]
File without changes
File without changes