dissect.target 3.21.dev3__tar.gz → 3.21.dev4__tar.gz

{dissect_target-3.21.dev3/dissect.target.egg-info → dissect_target-3.21.dev4}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.21.dev3
+Version: 3.21.dev4
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.21.dev3 → dissect_target-3.21.dev4}/dissect/target/plugins/os/unix/trash.py

@@ -31,15 +31,25 @@ class GnomeTrashPlugin(Plugin):
 
     def __init__(self, target: Target):
         super().__init__(target)
-        self.trashes = list(self._garbage_collector())
+        self.trashes = set(self._garbage_collector())
 
     def _garbage_collector(self) -> Iterator[tuple[UserDetails, TargetPath]]:
         """it aint much, but its honest work"""
+
+        # home trash folders
         for user_details in self.target.user_details.all_with_home():
             for trash_path in self.PATHS:
                 if (path := user_details.home_path.joinpath(trash_path)).exists():
                     yield user_details, path
 
+        # mounted devices trash folders
+        for mount_path in list(self.target.fs.mounts) + ["/mnt", "/media"]:
+            if mount_path == "/":
+                continue
+
+            for mount_trash in self.target.fs.path(mount_path).rglob(".Trash-*"):
+                yield UserDetails(None, None), mount_trash
+
     def check_compatible(self) -> None:
         if not self.trashes:
             raise UnsupportedPluginError("No Trash folder(s) found")
@@ -52,7 +62,8 @@ class GnomeTrashPlugin(Plugin):
         Recovers deleted files and artifacts from ``$HOME/.local/share/Trash``.
         Probably also works with other desktop interfaces as long as they follow the Trash specification from FreeDesktop.
 
-        Currently does not parse media trash locations such as ``/media/$Label/.Trash-1000/*``.
+        Also parses media trash locations such as ``/media/$USER/$Label/.Trash-*``, ``/mnt/$Label/.Trash-*`` and other
+        locations as defined in ``/etc/fstab``.
 
         Resources:
             - https://specifications.freedesktop.org/trash-spec/latest/

{dissect_target-3.21.dev3 → dissect_target-3.21.dev4/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: dissect.target
-Version: 3.21.dev3
+Version: 3.21.dev4
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.21.dev3 → dissect_target-3.21.dev4}/tests/plugins/os/unix/test_trash.py

@@ -1,5 +1,6 @@
 from datetime import datetime, timezone
 from io import BytesIO
+from unittest.mock import patch
 
 from dissect.target.filesystem import VirtualFilesystem
 from dissect.target.plugins.os.unix._os import UnixPlugin
@@ -76,3 +77,26 @@ def test_gnome_trash(target_unix_users: Target, fs_unix: VirtualFilesystem) -> N
     assert results[1].path is None
     assert results[1].deleted_path == "/home/user/.local/share/Trash/expunged/123456789/some-dir/some-file.txt"
     assert results[1].filesize == 79
+
+
+def test_gnome_trash_mounts(target_unix_users: Target, fs_unix: VirtualFilesystem) -> None:
+    """test if GNOME Trash plugin finds Trash files in mounted devices from ``/etc/fstab``, ``/mnt`` and ``/media``."""
+
+    fs_unix.map_file_fh("etc/hostname", BytesIO(b"hostname"))
+    fs_unix.map_dir("home/user/.local/share/Trash", absolute_path("_data/plugins/os/unix/trash"))
+    fs_unix.map_dir("mnt/example/.Trash-1234", absolute_path("_data/plugins/os/unix/trash"))
+    fs_unix.map_dir("tmp/example/.Trash-5678", absolute_path("_data/plugins/os/unix/trash"))
+    fs_unix.map_dir("media/user/example/.Trash-1000", absolute_path("_data/plugins/os/unix/trash"))
+
+    with patch.object(target_unix_users.fs, "mounts", {"/tmp/example": None, "/mnt/example": None}):
+        target_unix_users.add_plugin(UnixPlugin)
+        plugin = GnomeTrashPlugin(target_unix_users)
+
+        assert sorted([str(t) for _, t in plugin.trashes]) == [
+            "/home/user/.local/share/Trash",
+            "/media/user/example/.Trash-1000",
+            "/mnt/example/.Trash-1234",
+            "/tmp/example/.Trash-5678",
+        ]
+
+        assert len(list(plugin.trash())) == 11 * len(plugin.trashes)