dissect.target 3.20.dev38__tar.gz → 3.20.dev39__tar.gz

{dissect_target-3.20.dev38/dissect.target.egg-info → dissect_target-3.20.dev39}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.20.dev38
+Version: 3.20.dev39
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

dissect_target-3.20.dev39/dissect/target/plugins/apps/editor/editor.py

@@ -0,0 +1,23 @@
+from dissect.target.plugin import NamespacePlugin, export
+
+COMMON_EDITOR_FIELDS = [
+    ("datetime", "ts"),
+    ("string", "editor"),
+    ("path", "source"),
+]
+
+
+class EditorPlugin(NamespacePlugin):
+    """Editor plugin."""
+
+    __namespace__ = "editor"
+
+    @export
+    def extensions(self) -> None:
+        """Yields installed extensions."""
+        raise NotImplementedError
+
+    @export
+    def history(self) -> None:
+        """Yields history of files."""
+        raise NotImplementedError

{dissect_target-3.20.dev38/dissect/target/plugins/apps/texteditor → dissect_target-3.20.dev39/dissect/target/plugins/apps/editor}/windowsnotepad.py

@@ -16,11 +16,8 @@ from dissect.target.helpers.record import (
     WindowsUserRecord,
     create_extended_descriptor,
 )
-from dissect.target.plugin import export
-from dissect.target.plugins.apps.texteditor.texteditor import (
-    GENERIC_TAB_CONTENTS_RECORD_FIELDS,
-    TexteditorPlugin,
-)
+from dissect.target.plugin import alias, export
+from dissect.target.plugins.apps.editor.editor import COMMON_EDITOR_FIELDS, EditorPlugin
 from dissect.target.target import Target
 
 # Thanks to @Nordgaren, @daddycocoaman, @JustArion and @ogmini for their suggestions and feedback in the PR
@@ -94,16 +91,25 @@ struct options_v2 {
 };
 """
 
-WINDOWS_SAVED_TABS_EXTRA_FIELDS = [("datetime", "modification_time"), ("digest", "hashes"), ("path", "saved_path")]
+GENERIC_TAB_CONTENTS_RECORD_FIELDS = [
+    ("string", "content"),
+    ("path", "path"),
+    ("string", "deleted_content"),
+]
 
 WindowsNotepadUnsavedTabRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
-    "texteditor/windowsnotepad/tab/unsaved",
-    GENERIC_TAB_CONTENTS_RECORD_FIELDS,
+    "application/editor/windowsnotepad/tab/unsaved",
+    COMMON_EDITOR_FIELDS + GENERIC_TAB_CONTENTS_RECORD_FIELDS,
 )
 
 WindowsNotepadSavedTabRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
-    "texteditor/windowsnotepad/tab/saved",
-    GENERIC_TAB_CONTENTS_RECORD_FIELDS + WINDOWS_SAVED_TABS_EXTRA_FIELDS,
+    "application/editor/windowsnotepad/tab/saved",
+    COMMON_EDITOR_FIELDS
+    + GENERIC_TAB_CONTENTS_RECORD_FIELDS
+    + [
+        ("digest", "digest"),
+        ("path", "saved_path"),
+    ],
 )
 
 c_windowstab = cstruct().load(windowstab_def)
@@ -264,7 +270,7 @@ class WindowsNotepadTab:
         self.deleted_content = deleted_content if deleted_content else None
 
 
-class WindowsNotepadPlugin(TexteditorPlugin):
+class WindowsNotepadPlugin(EditorPlugin):
     """Windows notepad tab content plugin."""
 
     __namespace__ = "windowsnotepad"
@@ -273,28 +279,27 @@ class WindowsNotepadPlugin(TexteditorPlugin):
 
     def __init__(self, target: Target):
         super().__init__(target)
-        self.users_tabs: list[TargetPath, UnixUserRecord | WindowsUserRecord] = []
+        self.users_tabs: set[TargetPath, UnixUserRecord | WindowsUserRecord] = set()
         for user_details in self.target.user_details.all_with_home():
             for tab_file in user_details.home_path.glob(self.GLOB):
-                # These files seem to contain information on different settings / configurations,
-                # and are skipped for now
+                # These files contain information on different settings / configurations, and are skipped for now.
                 if tab_file.name.endswith(".1.bin") or tab_file.name.endswith(".0.bin"):
                     continue
 
-                self.users_tabs.append((tab_file, user_details.user))
+                self.users_tabs.add((tab_file, user_details.user))
 
     def check_compatible(self) -> None:
         if not self.users_tabs:
             raise UnsupportedPluginError("No Windows Notepad tab files found")
 
+    @alias("tabs")
     @export(record=[WindowsNotepadSavedTabRecord, WindowsNotepadUnsavedTabRecord])
-    def tabs(self) -> Iterator[WindowsNotepadSavedTabRecord | WindowsNotepadUnsavedTabRecord]:
+    def history(self) -> Iterator[WindowsNotepadSavedTabRecord | WindowsNotepadUnsavedTabRecord]:
         """Return contents from Windows 11 Notepad tabs - and its deleted content if available.
 
         Windows Notepad application for Windows 11 is now able to restore both saved and unsaved tabs when you re-open
         the application.
 
-
         Resources:
             - https://github.com/fox-it/dissect.target/pull/540
             - https://github.com/JustArion/Notepad-Tabs
@@ -304,37 +309,41 @@ class WindowsNotepadPlugin(TexteditorPlugin):
             - https://github.com/Nordgaren/tabstate-util/issues/1
             - https://medium.com/@mahmoudsoheem/new-digital-forensics-artifact-from-windows-notepad-527645906b7b
 
-        Yields a WindowsNotepadSavedTabRecord or WindowsNotepadUnsavedTabRecord. with fields:
+        Yields ``WindowsNotepadSavedTabRecord`` or ``WindowsNotepadUnsavedTabRecord`` records:
 
         .. code-block:: text
 
-            content (string): The content of the tab.
-            path (path): The path to the tab file.
-            deleted_content (string): The deleted content of the tab, if available.
-            hashes (digest): A digest of the tab content.
-            saved_path (path): The path where the tab was saved.
-            modification_time (datetime): The modification time of the tab.
+            ts              (datetime): The modification time of the tab.
+            content         (string):   The content of the tab.
+            path            (path):     The path to the tab file.
+            deleted_content (string):   The deleted content of the tab, if available.
+            digest          (digest):   A digest of the tab content.
+            saved_path      (path):     The path where the tab was saved.
         """
         for file, user in self.users_tabs:
-            # Parse the file
-            tab: WindowsNotepadTab = WindowsNotepadTab(file)
+            tab = WindowsNotepadTab(file)
 
             if tab.is_saved:
                 yield WindowsNotepadSavedTabRecord(
+                    ts=wintimestamp(tab.tab_header.timestamp),
+                    editor="windowsnotepad",
                     content=tab.content,
                     path=tab.file,
                     deleted_content=tab.deleted_content,
-                    hashes=digest((None, None, tab.tab_header.sha256.hex())),
+                    digest=digest((None, None, tab.tab_header.sha256.hex())),
                     saved_path=tab.tab_header.filePath,
-                    modification_time=wintimestamp(tab.tab_header.timestamp),
-                    _target=self.target,
+                    source=file,
                     _user=user,
+                    _target=self.target,
                 )
+
             else:
                 yield WindowsNotepadUnsavedTabRecord(
+                    editor="windowsnotepad",
                     content=tab.content,
+                    deleted_content=tab.deleted_content,
                     path=tab.file,
-                    _target=self.target,
+                    source=file,
                     _user=user,
-                    deleted_content=tab.deleted_content,
+                    _target=self.target,
                 )

{dissect_target-3.20.dev38 → dissect_target-3.20.dev39/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.20.dev38
+Version: 3.20.dev39
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.20.dev38 → dissect_target-3.20.dev39}/dissect.target.egg-info/SOURCES.txt

@@ -139,6 +139,9 @@ dissect/target/plugins/apps/browser/firefox.py
 dissect/target/plugins/apps/browser/iexplore.py
 dissect/target/plugins/apps/container/__init__.py
 dissect/target/plugins/apps/container/docker.py
+dissect/target/plugins/apps/editor/__init__.py
+dissect/target/plugins/apps/editor/editor.py
+dissect/target/plugins/apps/editor/windowsnotepad.py
 dissect/target/plugins/apps/other/__init__.py
 dissect/target/plugins/apps/other/env.py
 dissect/target/plugins/apps/remoteaccess/__init__.py
@@ -153,9 +156,6 @@ dissect/target/plugins/apps/ssh/openssh.py
 dissect/target/plugins/apps/ssh/opensshd.py
 dissect/target/plugins/apps/ssh/putty.py
 dissect/target/plugins/apps/ssh/ssh.py
-dissect/target/plugins/apps/texteditor/__init__.py
-dissect/target/plugins/apps/texteditor/texteditor.py
-dissect/target/plugins/apps/texteditor/windowsnotepad.py
 dissect/target/plugins/apps/virtualization/__init__.py
 dissect/target/plugins/apps/virtualization/vmware_workstation.py
 dissect/target/plugins/apps/vpn/__init__.py
@@ -473,6 +473,8 @@ tests/plugins/apps/browser/test_firefox.py
 tests/plugins/apps/browser/test_iexplore.py
 tests/plugins/apps/container/__init__.py
 tests/plugins/apps/container/test_docker.py
+tests/plugins/apps/editor/__init__.py
+tests/plugins/apps/editor/test_windowsnotepad.py
 tests/plugins/apps/other/__init__.py
 tests/plugins/apps/other/test_envfile.py
 tests/plugins/apps/remoteaccess/__init__.py
@@ -485,8 +487,6 @@ tests/plugins/apps/ssh/__init__.py
 tests/plugins/apps/ssh/test_openssh.py
 tests/plugins/apps/ssh/test_opensshd.py
 tests/plugins/apps/ssh/test_putty.py
-tests/plugins/apps/texteditor/__init__.py
-tests/plugins/apps/texteditor/test_texteditor.py
 tests/plugins/apps/virtualization/__init__.py
 tests/plugins/apps/virtualization/test_vmware_workstation.py
 tests/plugins/apps/vpn/__init__.py

dissect_target-3.20.dev38/tests/plugins/apps/texteditor/test_texteditor.py → dissect_target-3.20.dev39/tests/plugins/apps/editor/test_windowsnotepad.py

@@ -1,10 +1,9 @@
 import os
+from datetime import datetime, timezone
 from pathlib import Path
 
-from flow.record.fieldtypes import datetime as dt
-
 from dissect.target.filesystem import VirtualFilesystem
-from dissect.target.plugins.apps.texteditor.windowsnotepad import (
+from dissect.target.plugins.apps.editor.windowsnotepad import (
     WindowsNotepadPlugin,
     WindowsNotepadTab,
 )
@@ -77,8 +76,10 @@ def test_windows_tab_plugin_deleted_contents(
 
     # The recovered content in the records should match the original data, as well as the length
     for rec in records:
+        assert rec.editor == "windowsnotepad"
         assert rec.content == file_text_map[rec.path.name][0]
         assert rec.deleted_content == file_text_map[rec.path.name][1]
+        assert rec.source is not None
 
 
 def test_windows_tab_plugin_default(
@@ -137,8 +138,10 @@ def test_windows_tab_plugin_default(
 
     # The recovered content in the records should match the original data, as well as the length
     for rec in records:
+        assert rec.editor == "windowsnotepad"
         assert rec.content == file_text_map[rec.path.name][0]
         assert rec.deleted_content == file_text_map[rec.path.name][1]
+        assert rec.source is not None
 
 
 def test_windows_saved_tab_plugin_extra_fields(
@@ -148,13 +151,13 @@ def test_windows_saved_tab_plugin_extra_fields(
         "saved.bin": (
             "Saved!",
             "C:\\Users\\user\\Desktop\\Saved!.txt",
-            dt(2024, 3, 28, 13, 7, 55, 482183),
+            datetime(2024, 3, 28, 13, 7, 55, 482183, tzinfo=timezone.utc),
             "ed9b760289e614c9dc8776e7280abe870be0a85019a32220b35acc54c0ecfbc1",
         ),
         "appclosed_saved_and_deletions.bin": (
             text8,
             "C:\\Users\\user\\Desktop\\Saved.txt",
-            dt(2024, 3, 28, 13, 16, 21, 158279),
+            datetime(2024, 3, 28, 13, 16, 21, 158279, tzinfo=timezone.utc),
             "8d0533144aa42e2d81e7474332bdef6473e42b699041528d55a62e5391e914ce",
         ),
     }
@@ -183,8 +186,10 @@ def test_windows_saved_tab_plugin_extra_fields(
     # The recovered content in the records should match the original data, as well as the length and all the
     # other saved metadata
     for rec in records:
+        assert rec.editor == "windowsnotepad"
         assert len(rec.content) == len(file_text_map[rec.path.name][0])
         assert rec.content == file_text_map[rec.path.name][0]
         assert rec.saved_path == file_text_map[rec.path.name][1]
-        assert rec.modification_time == file_text_map[rec.path.name][2]
-        assert rec.hashes.sha256 == file_text_map[rec.path.name][3]
+        assert rec.ts == file_text_map[rec.path.name][2]
+        assert rec.digest.sha256 == file_text_map[rec.path.name][3]
+        assert rec.source is not None

dissect_target-3.20.dev38/dissect/target/plugins/apps/texteditor/texteditor.py

@@ -1,13 +0,0 @@
-from dissect.target.helpers.descriptor_extensions import UserRecordDescriptorExtension
-from dissect.target.helpers.record import create_extended_descriptor
-from dissect.target.plugin import NamespacePlugin
-
-GENERIC_TAB_CONTENTS_RECORD_FIELDS = [("string", "content"), ("path", "path"), ("string", "deleted_content")]
-
-TexteditorTabContentRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
-    "texteditor/tab", GENERIC_TAB_CONTENTS_RECORD_FIELDS
-)
-
-
-class TexteditorPlugin(NamespacePlugin):
-    __namespace__ = "texteditor"