dissect.target 3.21.dev2__py3-none-any.whl → 3.21.dev4__py3-none-any.whl

dissect/target/plugins/os/unix/etc/etc.py

@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 import fnmatch
 import re
 from pathlib import Path
@@ -30,9 +32,10 @@ class EtcTree(ConfigurationTreePlugin):
     def __init__(self, target: Target):
         super().__init__(target, "/etc")
 
-    def _sub(self, items: ConfigurationEntry, entry: Path, pattern: str) -> Iterator[UnixConfigTreeRecord]:
+    def _sub(
+        self, items: ConfigurationEntry | dict, entry: Path, orig_path: Path, pattern: str
+    ) -> Iterator[UnixConfigTreeRecord]:
         index = 0
-        config_entry = items
         if not isinstance(items, dict):
             items = items.as_dict()
 
@@ -41,7 +44,7 @@ class EtcTree(ConfigurationTreePlugin):
             path = Path(entry) / Path(key)
 
             if isinstance(value, dict):
-                yield from self._sub(value, path, pattern)
+                yield from self._sub(value, path, orig_path, pattern)
                 continue
 
             if not isinstance(value, list):
@@ -50,7 +53,7 @@ class EtcTree(ConfigurationTreePlugin):
             if fnmatch.fnmatch(path, pattern):
                 data = {
                     "_target": self.target,
-                    "source": self.target.fs.path(config_entry.entry.path),
+                    "source": self.target.fs.path(orig_path),
                     "path": path,
                     "key": key,
                     "value": value,
@@ -71,8 +74,11 @@ class EtcTree(ConfigurationTreePlugin):
         for entry, subs, items in self.config_fs.walk(root):
             for item in items:
                 try:
-                    config_object = self.get(str(Path(entry) / Path(item)))
-                    yield from self._sub(config_object, Path(entry) / Path(item), pattern)
+                    path = Path(entry) / item
+                    config_object = self.get(str(path))
+
+                    if isinstance(config_object, ConfigurationEntry):
+                        yield from self._sub(config_object, path, orig_path=path, pattern=pattern)
                 except Exception:
                     self.target.log.warning("Could not open configuration item: %s", item)
                     pass

dissect/target/plugins/os/unix/trash.py

@@ -31,15 +31,25 @@ class GnomeTrashPlugin(Plugin):
 
     def __init__(self, target: Target):
         super().__init__(target)
-        self.trashes = list(self._garbage_collector())
+        self.trashes = set(self._garbage_collector())
 
     def _garbage_collector(self) -> Iterator[tuple[UserDetails, TargetPath]]:
         """it aint much, but its honest work"""
+
+        # home trash folders
         for user_details in self.target.user_details.all_with_home():
             for trash_path in self.PATHS:
                 if (path := user_details.home_path.joinpath(trash_path)).exists():
                     yield user_details, path
 
+        # mounted devices trash folders
+        for mount_path in list(self.target.fs.mounts) + ["/mnt", "/media"]:
+            if mount_path == "/":
+                continue
+
+            for mount_trash in self.target.fs.path(mount_path).rglob(".Trash-*"):
+                yield UserDetails(None, None), mount_trash
+
     def check_compatible(self) -> None:
         if not self.trashes:
             raise UnsupportedPluginError("No Trash folder(s) found")
@@ -52,7 +62,8 @@ class GnomeTrashPlugin(Plugin):
         Recovers deleted files and artifacts from ``$HOME/.local/share/Trash``.
         Probably also works with other desktop interfaces as long as they follow the Trash specification from FreeDesktop.
 
-        Currently does not parse media trash locations such as ``/media/$Label/.Trash-1000/*``.
+        Also parses media trash locations such as ``/media/$USER/$Label/.Trash-*``, ``/mnt/$Label/.Trash-*`` and other
+        locations as defined in ``/etc/fstab``.
 
         Resources:
             - https://specifications.freedesktop.org/trash-spec/latest/

{dissect.target-3.21.dev2.dist-info → dissect.target-3.21.dev4.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.21.dev2
+Version: 3.21.dev4
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3
@@ -23,81 +23,81 @@ Description-Content-Type: text/markdown
 License-File: LICENSE
 License-File: COPYRIGHT
 Requires-Dist: defusedxml
-Requires-Dist: dissect.cstruct <5,>=4
-Requires-Dist: dissect.eventlog <4,>=3
-Requires-Dist: dissect.evidence <4,>=3
-Requires-Dist: dissect.hypervisor <4,>=3
-Requires-Dist: dissect.ntfs <4,>=3.4
-Requires-Dist: dissect.regf <4,>=3.3
-Requires-Dist: dissect.util <4,>=3
-Requires-Dist: dissect.volume <4,>=2
-Requires-Dist: flow.record ~=3.18.0
+Requires-Dist: dissect.cstruct<5,>=4
+Requires-Dist: dissect.eventlog<4,>=3
+Requires-Dist: dissect.evidence<4,>=3
+Requires-Dist: dissect.hypervisor<4,>=3
+Requires-Dist: dissect.ntfs<4,>=3.4
+Requires-Dist: dissect.regf<4,>=3.3
+Requires-Dist: dissect.util<4,>=3
+Requires-Dist: dissect.volume<4,>=2
+Requires-Dist: flow.record~=3.18.0
 Requires-Dist: structlog
-Provides-Extra: cb
-Requires-Dist: dissect.target[full] ; extra == 'cb'
-Requires-Dist: carbon-black-cloud-sdk ~=1.4.3 ; extra == 'cb'
-Provides-Extra: dev
-Requires-Dist: dissect.target[full,mqtt,yara] ; extra == 'dev'
-Requires-Dist: dissect.archive[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
-Requires-Dist: dissect.btrfs[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
-Requires-Dist: dissect.cim[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.clfs[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
-Requires-Dist: dissect.cstruct <5.0.dev,>=4.0.dev ; extra == 'dev'
-Requires-Dist: dissect.esedb[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.etl[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.eventlog[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.evidence[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.extfs[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.fat[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.ffs[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.hypervisor[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.jffs[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
-Requires-Dist: dissect.ntfs[dev] <4.0.dev,>=3.4.dev ; extra == 'dev'
-Requires-Dist: dissect.regf[dev] <4.0.dev,>=3.3.dev ; extra == 'dev'
-Requires-Dist: dissect.shellitem[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.sql[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.squashfs[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
-Requires-Dist: dissect.thumbcache[dev] <2.0.dev,>=1.0.dev ; extra == 'dev'
-Requires-Dist: dissect.util <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.vmfs[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.volume[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.xfs[dev] <4.0.dev,>=3.0.dev ; extra == 'dev'
-Requires-Dist: dissect.fve[dev] <5.0.dev,>=4.0.dev ; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == 'dev'
 Provides-Extra: full
-Requires-Dist: asn1crypto ; extra == 'full'
-Requires-Dist: dissect.archive <2,>=1 ; extra == 'full'
-Requires-Dist: dissect.btrfs <2,>=1 ; extra == 'full'
-Requires-Dist: dissect.cim <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.clfs <2,>=1 ; extra == 'full'
-Requires-Dist: dissect.esedb <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.etl <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.extfs <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.fat <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.ffs <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.jffs <2,>=1 ; extra == 'full'
-Requires-Dist: dissect.ole <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.shellitem <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.squashfs <2,>=1 ; extra == 'full'
-Requires-Dist: dissect.sql <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.thumbcache <2,>=1 ; extra == 'full'
-Requires-Dist: dissect.vmfs <4,>=3 ; extra == 'full'
-Requires-Dist: dissect.xfs <4,>=3 ; extra == 'full'
-Requires-Dist: ipython ; extra == 'full'
-Requires-Dist: fusepy ; extra == 'full'
-Requires-Dist: pycryptodome ; extra == 'full'
-Requires-Dist: ruamel.yaml ; extra == 'full'
-Requires-Dist: zstandard ; extra == 'full'
-Requires-Dist: dissect.fve <5,>=4 ; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == 'full'
-Requires-Dist: tomli ; (python_version < "3.11") and extra == 'full'
-Provides-Extra: mqtt
-Requires-Dist: dissect.target[full] ; extra == 'mqtt'
-Requires-Dist: paho-mqtt ==1.6.1 ; extra == 'mqtt'
-Provides-Extra: smb
-Requires-Dist: dissect.target[full] ; extra == 'smb'
-Requires-Dist: impacket ==0.10.0 ; extra == 'smb'
+Requires-Dist: asn1crypto; extra == "full"
+Requires-Dist: dissect.archive<2,>=1; extra == "full"
+Requires-Dist: dissect.btrfs<2,>=1; extra == "full"
+Requires-Dist: dissect.cim<4,>=3; extra == "full"
+Requires-Dist: dissect.clfs<2,>=1; extra == "full"
+Requires-Dist: dissect.esedb<4,>=3; extra == "full"
+Requires-Dist: dissect.etl<4,>=3; extra == "full"
+Requires-Dist: dissect.extfs<4,>=3; extra == "full"
+Requires-Dist: dissect.fat<4,>=3; extra == "full"
+Requires-Dist: dissect.ffs<4,>=3; extra == "full"
+Requires-Dist: dissect.fve<5,>=4; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "full"
+Requires-Dist: dissect.jffs<2,>=1; extra == "full"
+Requires-Dist: dissect.ole<4,>=3; extra == "full"
+Requires-Dist: dissect.shellitem<4,>=3; extra == "full"
+Requires-Dist: dissect.squashfs<2,>=1; extra == "full"
+Requires-Dist: dissect.sql<4,>=3; extra == "full"
+Requires-Dist: dissect.thumbcache<2,>=1; extra == "full"
+Requires-Dist: dissect.vmfs<4,>=3; extra == "full"
+Requires-Dist: dissect.xfs<4,>=3; extra == "full"
+Requires-Dist: ipython; extra == "full"
+Requires-Dist: fusepy; extra == "full"
+Requires-Dist: pycryptodome; extra == "full"
+Requires-Dist: ruamel.yaml; extra == "full"
+Requires-Dist: tomli; python_version < "3.11" and extra == "full"
+Requires-Dist: zstandard; extra == "full"
+Provides-Extra: dev
+Requires-Dist: dissect.target[full,mqtt,yara]; extra == "dev"
+Requires-Dist: dissect.archive[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.btrfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.cim[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.clfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.cstruct<5.0.dev,>=4.0.dev; extra == "dev"
+Requires-Dist: dissect.esedb[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.etl[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.eventlog[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.evidence[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.extfs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.fat[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.ffs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.fve[dev]<5.0.dev,>=4.0.dev; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "dev"
+Requires-Dist: dissect.hypervisor[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.jffs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.ntfs[dev]<4.0.dev,>=3.4.dev; extra == "dev"
+Requires-Dist: dissect.regf[dev]<4.0.dev,>=3.3.dev; extra == "dev"
+Requires-Dist: dissect.shellitem[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.sql[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.squashfs[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.thumbcache[dev]<2.0.dev,>=1.0.dev; extra == "dev"
+Requires-Dist: dissect.util<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.vmfs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.volume[dev]<4.0.dev,>=3.0.dev; extra == "dev"
+Requires-Dist: dissect.xfs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Provides-Extra: yara
-Requires-Dist: dissect.target[full] ; extra == 'yara'
-Requires-Dist: yara-python ; extra == 'yara'
+Requires-Dist: dissect.target[full]; extra == "yara"
+Requires-Dist: yara-python; extra == "yara"
+Provides-Extra: smb
+Requires-Dist: dissect.target[full]; extra == "smb"
+Requires-Dist: impacket==0.10.0; extra == "smb"
+Provides-Extra: cb
+Requires-Dist: dissect.target[full]; extra == "cb"
+Requires-Dist: carbon-black-cloud-sdk~=1.4.3; extra == "cb"
+Provides-Extra: mqtt
+Requires-Dist: dissect.target[full]; extra == "mqtt"
+Requires-Dist: paho-mqtt==1.6.1; extra == "mqtt"
 
 # dissect.target
 

{dissect.target-3.21.dev2.dist-info → dissect.target-3.21.dev4.dist-info}/RECORD

@@ -206,7 +206,7 @@ dissect/target/plugins/os/unix/history.py,sha256=95EXJrD5ko7iFLsYhAwvR-2wDbVBSNs
 dissect/target/plugins/os/unix/locale.py,sha256=l42abqG1nGk90SDRt1DmkvqPvO5L-1GtaEwg6dj89qI,4323
 dissect/target/plugins/os/unix/packagemanager.py,sha256=xmisH9vMY7uR2d6lFVNuWrZrbVnKa6mYk6C3sbcLtlc,1279
 dissect/target/plugins/os/unix/shadow.py,sha256=TVQQcGhPFYV685ouqOagk4P1AsqAHseFN5lWYHPf3tI,4172
-dissect/target/plugins/os/unix/trash.py,sha256=Z-1r5VQorLauj_85TgURRLQI7ns1Q1N_922Vq8q_v18,6106
+dissect/target/plugins/os/unix/trash.py,sha256=7cHY94AxHFh2QbPbDflLkCTQxIlP0XyqJ-DgdMdI4A4,6524
 dissect/target/plugins/os/unix/bsd/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/target/plugins/os/unix/bsd/_os.py,sha256=e5rttTOFOmd7e2HqP9ZZFMEiPLBr-8rfH0XH1IIeroQ,1372
 dissect/target/plugins/os/unix/bsd/citrix/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
@@ -225,7 +225,7 @@ dissect/target/plugins/os/unix/bsd/osx/user.py,sha256=5rsGhsntBW9IXYIOrLpfYpSsJc
 dissect/target/plugins/os/unix/esxi/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/target/plugins/os/unix/esxi/_os.py,sha256=s6pAgUyfHh3QcY6sgvk5uVMmLvqK1tIHWR7MSbrFn8w,17789
 dissect/target/plugins/os/unix/etc/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
-dissect/target/plugins/os/unix/etc/etc.py,sha256=QngR0nA1azvbNTau4U9-jKOjSoGdyduDpyEna_6yxWY,2636
+dissect/target/plugins/os/unix/etc/etc.py,sha256=YSCRZZfQvmzaR5VWhTJhB8pIGliL6Nw5ruhdfvYKYaM,2783
 dissect/target/plugins/os/unix/linux/__init__.py,sha256=47DEQpj8HBSa-_TImW-5JCeuQeRkm5NMpJWZG3hSuFU,0
 dissect/target/plugins/os/unix/linux/_os.py,sha256=k1aHhWqocSHMVbF54VDw9wqwa0QSToOa69TMKAyQcxw,2979
 dissect/target/plugins/os/unix/linux/cmdline.py,sha256=n_Uetoplx33XpIY27oPtMaw1E2AbAEeGLCSkxHshWgY,1673
@@ -381,10 +381,10 @@ dissect/target/volumes/luks.py,sha256=OmCMsw6rCUXG1_plnLVLTpsvE1n_6WtoRUGQbpmu1z
 dissect/target/volumes/lvm.py,sha256=wwQVR9I3G9YzmY6UxFsH2Y4MXGBcKL9aayWGCDTiWMU,2269
 dissect/target/volumes/md.py,sha256=7ShPtusuLGaIv27SvEETtgsuoQyAa4iAAeOR1NEaajI,1689
 dissect/target/volumes/vmfs.py,sha256=-LoUbn9WNwTtLi_4K34uV_-wDw2W5hgaqxZNj4UmqAQ,1730
-dissect.target-3.21.dev2.dist-info/COPYRIGHT,sha256=m-9ih2RVhMiXHI2bf_oNSSgHgkeIvaYRVfKTwFbnJPA,301
-dissect.target-3.21.dev2.dist-info/LICENSE,sha256=DZak_2itbUtvHzD3E7GNUYSRK6jdOJ-GqncQ2weavLA,34523
-dissect.target-3.21.dev2.dist-info/METADATA,sha256=CTHczoLyn0a2fvRz-vr8ZIwgmq45_UFoO7PLB2SQpqA,13302
-dissect.target-3.21.dev2.dist-info/WHEEL,sha256=R06PA3UVYHThwHvxuRWMqaGcr-PuniXahwjmQRFMEkY,91
-dissect.target-3.21.dev2.dist-info/entry_points.txt,sha256=BWuxAb_6AvUAQpIQOQU0IMTlaF6TDht2AIZK8bHd-zE,492
-dissect.target-3.21.dev2.dist-info/top_level.txt,sha256=Mn-CQzEYsAbkxrUI0TnplHuXnGVKzxpDw_po_sXpvv4,8
-dissect.target-3.21.dev2.dist-info/RECORD,,
+dissect.target-3.21.dev4.dist-info/COPYRIGHT,sha256=m-9ih2RVhMiXHI2bf_oNSSgHgkeIvaYRVfKTwFbnJPA,301
+dissect.target-3.21.dev4.dist-info/LICENSE,sha256=DZak_2itbUtvHzD3E7GNUYSRK6jdOJ-GqncQ2weavLA,34523
+dissect.target-3.21.dev4.dist-info/METADATA,sha256=KDxf39pvneyhP8nqpKUAzGXkygiJEIUWWPlNT35kEOE,13186
+dissect.target-3.21.dev4.dist-info/WHEEL,sha256=PZUExdf71Ui_so67QXpySuHtCi3-J3wvF4ORK6k_S8U,91
+dissect.target-3.21.dev4.dist-info/entry_points.txt,sha256=BWuxAb_6AvUAQpIQOQU0IMTlaF6TDht2AIZK8bHd-zE,492
+dissect.target-3.21.dev4.dist-info/top_level.txt,sha256=Mn-CQzEYsAbkxrUI0TnplHuXnGVKzxpDw_po_sXpvv4,8
+dissect.target-3.21.dev4.dist-info/RECORD,,

{dissect.target-3.21.dev2.dist-info → dissect.target-3.21.dev4.dist-info}/WHEEL

@@ -1,5 +1,5 @@
 Wheel-Version: 1.0
-Generator: setuptools (75.5.0)
+Generator: setuptools (75.6.0)
 Root-Is-Purelib: true
 Tag: py3-none-any