dissect.target 3.20.2.dev45__tar.gz → 3.20.2.dev46__tar.gz

{dissect_target-3.20.2.dev45/dissect.target.egg-info → dissect_target-3.20.2.dev46}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: dissect.target
-Version: 3.20.2.dev45
+Version: 3.20.2.dev46
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.2.dev45 → dissect_target-3.20.2.dev46}/dissect/target/plugins/apps/browser/brave.py

@@ -25,11 +25,21 @@ class BravePlugin(ChromiumMixin, BrowserPlugin):
     DIRS = [
         # Windows
         "AppData/Local/BraveSoftware/Brave-Browser/User Data/Default",
+        "AppData/Local/BraveSoftware/Brave-Browser/User Data/Profile*",
         "AppData/Roaming/BraveSoftware/Brave-Browser/User Data/Default",
+        "AppData/Roaming/BraveSoftware/Brave-Browser/User Data/Profile*",
         # Linux
         ".config/BraveSoftware/Default",
+        ".config/BraveSoftware/Profile*",
+        ".config/BraveSoftware/Brave-Browser/Default",
+        ".config/BraveSoftware/Brave-Browser/Profile*",
+        "snap/brave/*/.config/BraveSoftware/Brave-Browser/Default",
+        "snap/brave/*/.config/BraveSoftware/Brave-Browser/Profile*",
         # Macos
         "Library/Application Support/BraveSoftware/Default",
+        "Library/Application Support/BraveSoftware/Brave-Browser/Default",
+        "Library/Application Support/BraveSoftware/Profile*",
+        "Library/Application Support/BraveSoftware/Brave-Browser/Profile*",
     ]
 
     BrowserHistoryRecord = create_extended_descriptor([UserRecordDescriptorExtension])(

{dissect_target-3.20.2.dev45 → dissect_target-3.20.2.dev46}/dissect/target/plugins/apps/browser/chrome.py

@@ -25,14 +25,21 @@ class ChromePlugin(ChromiumMixin, BrowserPlugin):
     DIRS = [
         # Windows
         "AppData/Local/Google/Chrome/User Data/Default",
+        "AppData/Local/Google/Chrome/User Data/Profile*",
         "AppData/Local/Google/Chrome/User Data/Snapshots/*/Default",
+        "AppData/Local/Google/Chrome/User Data/Snapshots/*/Profile*",
         "AppData/Local/Google/Chrome/continuousUpdates/User Data/Default",
+        "AppData/Local/Google/Chrome/continuousUpdates/User Data/Profile*",
         "Local Settings/Application Data/Google/Chrome/User Data/Default",
+        "Local Settings/Application Data/Google/Chrome/User Data/Profile*",
         # Linux
         ".config/google-chrome/Default",
+        ".config/google-chrome/Profile*",
         ".var/app/com.google.Chrome/config/google-chrome/Default",
+        ".var/app/com.google.Chrome/config/google-chrome/Profile*",
         # Macos
         "Library/Application Support/Google/Chrome/Default",
+        "Library/Application Support/Google/Chrome/Profile*",
     ]
 
     BrowserHistoryRecord = create_extended_descriptor([UserRecordDescriptorExtension])(

{dissect_target-3.20.2.dev45 → dissect_target-3.20.2.dev46}/dissect/target/plugins/apps/browser/edge.py

@@ -25,12 +25,17 @@ class EdgePlugin(ChromiumMixin, BrowserPlugin):
     DIRS = [
         # Linux
         ".config/microsoft-edge/Default/",
+        ".config/microsoft-edge/Profile*",
         ".var/app/com.microsoft.Edge/config/microsoft-edge/Default",
+        ".var/app/com.microsoft.Edge/config/microsoft-edge/Profile*",
         # Windows
         "AppData/Local/Microsoft/Edge/User Data/Default",
+        "AppData/Local/Microsoft/Edge/User Data/Profile*",
         "AppData/Local/Microsoft/Edge/User Data/Snapshots/*/Default",
+        "AppData/Local/Microsoft/Edge/User Data/Snapshots/*/Profile*",
         # Macos
         "Library/Application Support/Microsoft Edge/Default",
+        "Library/Application Support/Microsoft Edge/Profile*",
     ]
 
     BrowserHistoryRecord = create_extended_descriptor([UserRecordDescriptorExtension])(

{dissect_target-3.20.2.dev45 → dissect_target-3.20.2.dev46/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.2
 Name: dissect.target
-Version: 3.20.2.dev45
+Version: 3.20.2.dev46
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.2.dev45 → dissect_target-3.20.2.dev46}/tests/plugins/apps/browser/test_brave.py

@@ -10,7 +10,8 @@ from tests._utils import absolute_path
 
 @pytest.fixture
 def target_brave(target_win_users: Target, fs_win: VirtualFilesystem) -> Iterator[Target]:
-    base_path = "Users\\John\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Default"
+    base_path_default = "Users\\John\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Default"
+    base_path_profile = "Users\\John\\AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data\\Profile 1"
     files = [
         ("History", "_data/plugins/apps/browser/chrome/History"),
         ("Preferences", "_data/plugins/apps/browser/chrome/Preferences"),
@@ -20,7 +21,8 @@ def target_brave(target_win_users: Target, fs_win: VirtualFilesystem) -> Iterato
     ]
 
     for filename, test_path in files:
-        fs_win.map_file("\\".join([base_path, filename]), absolute_path(test_path))
+        fs_win.map_file("\\".join([base_path_default, filename]), absolute_path(test_path))
+        fs_win.map_file("\\".join([base_path_profile, filename]), absolute_path(test_path))
 
     target_win_users.add_plugin(brave.BravePlugin)
 
@@ -29,29 +31,29 @@ def target_brave(target_win_users: Target, fs_win: VirtualFilesystem) -> Iterato
 
 def test_brave_history(target_brave: Target) -> None:
     records = list(target_brave.brave.history())
-    assert len(records) == 5
+    assert len(records) == 10
 
 
 def test_brave_downloads(target_brave: Target) -> None:
     records = list(target_brave.brave.downloads())
-    assert len(records) == 1
+    assert len(records) == 2
 
 
 def test_brave_extensions(target_brave: Target) -> None:
     records = list(target_brave.brave.extensions())
-    assert len(records) == 8
+    assert len(records) == 16
 
 
 def test_brave_cookies(target_brave: Target) -> None:
     records = list(target_brave.brave.cookies())
-    assert len(records) == 5
+    assert len(records) == 10
     assert all(record.host == ".tweakers.net" for record in records)
 
 
 def test_windows_edge_passwords_plugin(target_brave: Target) -> None:
     records = list(target_brave.brave.passwords())
 
-    assert len(records) == 2
+    assert len(records) == 4
 
     for record in records:
         assert record.browser == "brave"

{dissect_target-3.20.2.dev45 → dissect_target-3.20.2.dev46}/tests/plugins/apps/browser/test_chrome.py

@@ -27,6 +27,10 @@ def target_chrome_win(target_win_users: Target, fs_win: VirtualFilesystem) -> It
         "Users\\John\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\",
         absolute_path("_data/plugins/apps/browser/chrome/"),
     )
+    fs_win.map_dir(
+        "Users\\John\\AppData\\Local\\Google\\Chrome\\User Data\\Profile 1\\",
+        absolute_path("_data/plugins/apps/browser/chrome/"),
+    )
 
     target_win_users.add_plugin(ChromePlugin)
 
@@ -36,6 +40,7 @@ def target_chrome_win(target_win_users: Target, fs_win: VirtualFilesystem) -> It
 @pytest.fixture
 def target_chrome_unix(target_unix_users: Target, fs_unix: VirtualFilesystem) -> Iterator[Target]:
     fs_unix.map_dir("/root/.config/google-chrome/Default/", absolute_path("_data/plugins/apps/browser/chrome/"))
+    fs_unix.map_dir("/root/.config/google-chrome/Profile 1/", absolute_path("_data/plugins/apps/browser/chrome/"))
 
     target_unix_users.add_plugin(ChromePlugin)
 
@@ -49,6 +54,11 @@ def target_chrome_win_snapshot(target_win_users: Target, fs_win: VirtualFilesyst
         absolute_path("_data/plugins/apps/browser/chrome/"),
     )
 
+    fs_win.map_dir(
+        "Users\\John\\AppData\\Local\\Google\\Chrome\\User Data\\Snapshots\\116.0.5038.150\\Profile 1",
+        absolute_path("_data/plugins/apps/browser/chrome/"),
+    )
+
     target_win_users.add_plugin(ChromePlugin)
 
     yield target_win_users
@@ -62,7 +72,7 @@ def test_chrome_history(target_platform: Target, request: pytest.FixtureRequest)
     target_platform = request.getfixturevalue(target_platform)
     records = list(target_platform.chrome.history())
 
-    assert len(records) == 5
+    assert len(records) == 10
     assert set(["chrome"]) == set(record.browser for record in records)
 
     assert (
@@ -82,7 +92,7 @@ def test_chrome_downloads(target_platform: Target, request: pytest.FixtureReques
     target_platform = request.getfixturevalue(target_platform)
     records = list(target_platform.chrome.downloads())
 
-    assert len(records) == 1
+    assert len(records) == 2
     assert set(["chrome"]) == set(record.browser for record in records)
 
     assert records[0].id == 6
@@ -99,7 +109,7 @@ def test_chrome_extensions(target_platform: Target, request: pytest.FixtureReque
     target_platform = request.getfixturevalue(target_platform)
     records = list(target_platform.chrome.extensions())
 
-    assert len(records) == 8
+    assert len(records) == 16
     assert set(["chrome"]) == set(record.browser for record in records)
 
     assert records[0].ts_install == dt("2022-11-24T15:20:43.682152+00:00")
@@ -112,7 +122,7 @@ def test_chrome_extensions(target_platform: Target, request: pytest.FixtureReque
 def test_windows_chrome_passwords_plugin(target_chrome_win: Target) -> None:
     records = list(target_chrome_win.chrome.passwords())
 
-    assert len(records) == 2
+    assert len(records) == 4
 
     for record in records:
         assert record.browser == "chrome"
@@ -127,11 +137,14 @@ def test_unix_chrome_passwords_basic_plugin(target_unix_users: Target, fs_unix:
     fs_unix.map_dir(
         "/root/.config/google-chrome/Default/", absolute_path("_data/plugins/apps/browser/chromium/unix/basic/")
     )
+    fs_unix.map_dir(
+        "/root/.config/google-chrome/Profile 1/", absolute_path("_data/plugins/apps/browser/chromium/unix/basic/")
+    )
     target_unix_users.add_plugin(ChromePlugin)
 
     records = list(target_unix_users.chrome.passwords())
 
-    assert len(records) == 2
+    assert len(records) == 4
 
     for record in records:
         assert record.browser == "chrome"
@@ -146,11 +159,14 @@ def test_unix_chrome_passwords_gnome_plugin(target_unix_users: Target, fs_unix:
     fs_unix.map_dir(
         "/root/.config/google-chrome/Default/", absolute_path("_data/plugins/apps/browser/chromium/unix/gnome/")
     )
+    fs_unix.map_dir(
+        "/root/.config/google-chrome/Profile 1/", absolute_path("_data/plugins/apps/browser/chromium/unix/gnome/")
+    )
     target_unix_users.add_plugin(ChromePlugin)
 
     records = list(target_unix_users.chrome.passwords())
 
-    assert len(records) == 1
+    assert len(records) == 2
 
     assert records[0].decrypted_username == "username"
     assert records[0].decrypted_password is None
@@ -289,12 +305,17 @@ def test_windows_chrome_cookies_dpapi(target_win_users_dpapi: Target, fs_win: Vi
 
 
 def test_chrome_windows_snapshots(target_win_users: Target, fs_win: VirtualFilesystem) -> None:
-    base_dir = "Users\\John\\AppData\\Local\\Google\\Chrome\\User Data\\Default"
+    base_dirs = [
+        "Users\\John\\AppData\\Local\\Google\\Chrome\\User Data\\Default",
+        "Users\\John\\AppData\\Local\\Google\\Chrome\\User Data\\Profile 1",
+    ]
     snapshot_dirs = [
         "Users\\John\\AppData\\Local\\Google\\Chrome\\User Data\\Snapshots\\116.0.5038.150\\Default",
         "Users\\John\\AppData\\Local\\Google\\Chrome\\User Data\\Snapshots\\119.0.7845.119\\Default",
+        "Users\\John\\AppData\\Local\\Google\\Chrome\\User Data\\Snapshots\\116.0.5038.150\\Profile 1",
+        "Users\\John\\AppData\\Local\\Google\\Chrome\\User Data\\Snapshots\\119.0.7845.119\\Profile 1",
     ]
-    profile_dirs = [base_dir] + snapshot_dirs
+    profile_dirs = base_dirs + snapshot_dirs
 
     for dir in profile_dirs:
         fs_win.map_dir(
@@ -314,11 +335,12 @@ def test_chrome_windows_snapshots(target_win_users: Target, fs_win: VirtualFiles
     for records in records_list:
         assert set(["chrome"]) == set(record.browser for record in records)
 
-        base_path_records = [r for r in records if str(r.source.parent).endswith(base_dir)]
+        for base_dir in base_dirs:
+            base_path_records = [r for r in records if str(r.source.parent).endswith(base_dir)]
 
         for snapshot_dir in snapshot_dirs:
             # Retrieve records that are in the snapshot's directory.
             snapshot_records = [r for r in records if str(r.source.parent).endswith(snapshot_dir)]
 
-            # We map the same files in each of the snapshot directories.
-            assert len(base_path_records) == len(snapshot_records)
+        # We map the same files in each of the snapshot directories.
+        assert len(base_path_records) == len(snapshot_records)

{dissect_target-3.20.2.dev45 → dissect_target-3.20.2.dev46}/tests/plugins/apps/browser/test_edge.py

@@ -17,6 +17,10 @@ def target_edge_win(target_win_users: Target, fs_win: VirtualFilesystem) -> Iter
         "Users\\John\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\",
         absolute_path("_data/plugins/apps/browser/edge/"),
     )
+    fs_win.map_dir(
+        "Users\\John\\AppData\\Local\\Microsoft\\Edge\\User Data\\Profile 1\\",
+        absolute_path("_data/plugins/apps/browser/edge/"),
+    )
 
     target_win_users.add_plugin(EdgePlugin)
 
@@ -26,6 +30,7 @@ def target_edge_win(target_win_users: Target, fs_win: VirtualFilesystem) -> Iter
 @pytest.fixture
 def target_edge_unix(target_unix_users, fs_unix):
     fs_unix.map_dir("/root/.config/microsoft-edge/Default/", absolute_path("_data/plugins/apps/browser/edge/"))
+    fs_unix.map_dir("/root/.config/microsoft-edge/Profile 1/", absolute_path("_data/plugins/apps/browser/edge/"))
     target_unix_users.add_plugin(EdgePlugin)
 
     yield target_unix_users
@@ -37,6 +42,10 @@ def target_edge_win_snapshot(target_win_users: Target, fs_win: VirtualFilesystem
         "Users\\John\\AppData\\Local\\Microsoft\\Edge\\User Data\\Snapshots\\116.0.5038.150\\Default",
         absolute_path("_data/plugins/apps/browser/edge/"),
     )
+    fs_win.map_dir(
+        "Users\\John\\AppData\\Local\\Microsoft\\Edge\\User Data\\Snapshots\\116.0.5038.150\\Profile 1",
+        absolute_path("_data/plugins/apps/browser/edge/"),
+    )
 
     target_win_users.add_plugin(EdgePlugin)
 
@@ -51,7 +60,7 @@ def test_edge_history(target_platform: Target, request: pytest.FixtureRequest) -
     target_platform = request.getfixturevalue(target_platform)
     records = list(target_platform.edge.history())
 
-    assert len(records) == 45
+    assert len(records) == 90
     assert set(["edge"]) == set(record.browser for record in records)
 
     assert records[-1].url == "https://github.com/fox-it/dissect"
@@ -68,7 +77,7 @@ def test_edge_downloads(target_platform: Target, request: pytest.FixtureRequest)
     target_platform = request.getfixturevalue(target_platform)
     records = list(target_platform.edge.downloads())
 
-    assert len(records) == 2
+    assert len(records) == 4
     assert set(["edge"]) == set(record.browser for record in records)
 
     assert records[0].id == 1
@@ -85,7 +94,7 @@ def test_edge_extensions(target_platform: Target, request: pytest.FixtureRequest
     target_platform = request.getfixturevalue(target_platform)
     records = list(target_platform.edge.extensions())
 
-    assert len(records) == 39
+    assert len(records) == 78
     assert set(["edge"]) == set(record.browser for record in records)
 
     assert records[0].ts_install == dt("2023-04-18T08:39:57.968208+00:00")
@@ -98,7 +107,7 @@ def test_edge_extensions(target_platform: Target, request: pytest.FixtureRequest
 def test_windows_edge_passwords_plugin(target_edge_win: Target) -> None:
     records = list(target_edge_win.edge.passwords())
 
-    assert len(records) == 2
+    assert len(records) == 4
 
     for record in records:
         assert record.browser == "edge"
@@ -114,10 +123,14 @@ def test_unix_edge_passwords_basic_plugin(target_edge_unix: Target, fs_unix: Vir
         "/root/.config/microsoft-edge/Default/Login Data",
         absolute_path("_data/plugins/apps/browser/chromium/unix/basic/Login Data"),
     )
+    fs_unix.map_file(
+        "/root/.config/microsoft-edge/Profile 1/Login Data",
+        absolute_path("_data/plugins/apps/browser/chromium/unix/basic/Login Data"),
+    )
 
     records = list(target_edge_unix.edge.passwords())
 
-    assert len(records) == 2
+    assert len(records) == 4
 
     for record in records:
         assert record.browser == "edge"
@@ -133,10 +146,14 @@ def test_unix_edge_passwords_gnome_plugin(target_edge_unix: Target, fs_unix: Vir
         "/root/.config/microsoft-edge/Default/Login Data",
         absolute_path("_data/plugins/apps/browser/chromium/unix/gnome/Login Data"),
     )
+    fs_unix.map_file(
+        "/root/.config/microsoft-edge/Profile 1/Login Data",
+        absolute_path("_data/plugins/apps/browser/chromium/unix/gnome/Login Data"),
+    )
 
     records = list(target_edge_unix.edge.passwords())
 
-    assert len(records) == 1
+    assert len(records) == 2
 
     assert records[0].decrypted_username == "username"
     assert records[0].decrypted_password is None
@@ -144,12 +161,15 @@ def test_unix_edge_passwords_gnome_plugin(target_edge_unix: Target, fs_unix: Vir
 
 
 def test_edge_windows_snapshots(target_win_users: Target, fs_win: VirtualFilesystem) -> None:
-    base_dir = "Users\\John\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default"
+    base_dirs = [
+        "Users\\John\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default",
+        "Users\\John\\AppData\\Local\\Microsoft\\Edge\\User Data\\Profile 1",
+    ]
     snapshot_dirs = [
         "Users\\John\\AppData\\Local\\Microsoft\\Edge\\User Data\\Snapshots\\116.0.5038.150\\Default",
         "Users\\John\\AppData\\Local\\Microsoft\\Edge\\User Data\\Snapshots\\119.0.7845.119\\Default",
     ]
-    profile_dirs = [base_dir] + snapshot_dirs
+    profile_dirs = base_dirs + snapshot_dirs
 
     for dir in profile_dirs:
         fs_win.map_dir(
@@ -169,11 +189,12 @@ def test_edge_windows_snapshots(target_win_users: Target, fs_win: VirtualFilesys
     for records in records_list:
         assert set(["edge"]) == set(record.browser for record in records)
 
-        base_path_records = [r for r in records if str(r.source.parent).endswith(base_dir)]
+        for base_dir in base_dirs:
+            base_path_records = [r for r in records if str(r.source.parent).endswith(base_dir)]
 
         for snapshot_dir in snapshot_dirs:
             # Retrieve records that are in the snapshot's directory.
             snapshot_records = [r for r in records if str(r.source.parent).endswith(snapshot_dir)]
 
-            # We map the same files in each of the snapshot directories.
-            assert len(base_path_records) == len(snapshot_records)
+        # We map the same files in each of the snapshot directories.
+        assert len(base_path_records) == len(snapshot_records)