dissect.target 3.22.dev18__tar.gz → 3.22.dev20__tar.gz

{dissect_target-3.22.dev18/dissect.target.egg-info → dissect_target-3.22.dev20}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.22.dev18
+Version: 3.22.dev20
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3
@@ -44,7 +44,7 @@ Requires-Dist: dissect.etl<4,>=3; extra == "full"
 Requires-Dist: dissect.extfs<4,>=3; extra == "full"
 Requires-Dist: dissect.fat<4,>=3; extra == "full"
 Requires-Dist: dissect.ffs<4,>=3; extra == "full"
-Requires-Dist: dissect.fve<5,>=4; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "full"
+Requires-Dist: dissect.fve<5,>=4.2.dev; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "full"
 Requires-Dist: dissect.jffs<2,>=1.5.dev; extra == "full"
 Requires-Dist: dissect.ole<4,>=3; extra == "full"
 Requires-Dist: dissect.shellitem<4,>=3; extra == "full"
@@ -73,7 +73,7 @@ Requires-Dist: dissect.evidence[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.extfs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.fat[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.ffs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
-Requires-Dist: dissect.fve[dev]<5.0.dev,>=4.0.dev; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "dev"
+Requires-Dist: dissect.fve[dev]<5.0.dev,>=4.2.dev; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "dev"
 Requires-Dist: dissect.hypervisor[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.jffs[dev]<2.0.dev,>=1.5.dev; extra == "dev"
 Requires-Dist: dissect.ntfs[dev]<4.0.dev,>=3.4.dev; extra == "dev"

{dissect_target-3.22.dev18 → dissect_target-3.22.dev20}/dissect/target/plugins/os/windows/log/evtx.py

@@ -3,6 +3,7 @@ from __future__ import annotations
 import datetime
 import re
 from functools import lru_cache
+from pathlib import Path
 from typing import Any, Iterator
 
 from dissect.eventlog import evtx
@@ -75,8 +76,10 @@ class EvtxPlugin(WindowsEventlogsMixin, plugin.Plugin):
                 self.target.log.exception("Failed to open event log: %s", entry)
                 continue
 
+            self.target.log.info("Processing event log file %s", entry)
+
             for event in evtx.Evtx(entry_data):
-                yield self._build_record(event)
+                yield self._build_record(event, entry)
 
     @plugin.export(record=DynamicDescriptor(["datetime"]))
     def scraped_evtx(self) -> Iterator[DynamicDescriptor]:
@@ -91,16 +94,19 @@ class EvtxPlugin(WindowsEventlogsMixin, plugin.Plugin):
         chnk = evtx.ElfChnk(chunk)
         try:
             for event in chnk.read():
-                yield self._build_record(event)
+                yield self._build_record(event, None)
         except MalformedElfChnkException:
             pass
 
-    def _build_record(self, evtx_record) -> Record:
+    def _build_record(self, evtx_record: dict, source: Path | None) -> Record:
         # predictable order of fields in the list is important, since we'll
         # be constructing a record descriptor from it.
         evtx_record_fields = sorted(evtx_record.items())
 
-        record_values = {"_target": self.target}
+        record_values = {
+            "_target": self.target,
+            "source": source,
+        }
         record_fields = [
             ("datetime", "ts"),
             ("string", "Provider_Name"),
@@ -140,6 +146,9 @@ class EvtxPlugin(WindowsEventlogsMixin, plugin.Plugin):
                 if key == "EventID":
                     value = int(value)
 
+                if key in record_values:
+                    key = unique_key(key, record_values)
+
                 record_values[key] = value
 
                 if key in ("Provider_Name", "EventID"):
@@ -147,6 +156,8 @@ class EvtxPlugin(WindowsEventlogsMixin, plugin.Plugin):
 
                 record_fields.append(("string", key))
 
+        record_fields.append(("path", "source"))
+
         # tuple conversion here is needed for lru_cache
         desc = self._create_event_descriptor(tuple(record_fields))
         return desc(**record_values)
@@ -156,7 +167,7 @@ class EvtxPlugin(WindowsEventlogsMixin, plugin.Plugin):
 
 
 def format_value(value: Any) -> Any:
-    if value is None:
+    if value is None or value == "-":
         return
 
     if isinstance(value, evtx.BxmlSub):
@@ -169,3 +180,20 @@ def format_value(value: Any) -> Any:
         return utils.to_str(value)
     except UnicodeDecodeError:
         return repr(value)
+
+
+def unique_key(key: str, dictionary: dict[str, Any], count: int | None = None) -> str:
+    """Return a unique key for a given dict of key value pairs.
+
+    Makes the returned key unique by appending an incrementing integer after the given key name (e.g. ``key_2``).
+    Search is case sensitive so provide lower-cased ``key`` and ``dictionary`` arguments if case-insensitiveness
+    is desired.
+    """
+    count = count or 2
+    new_key = f"{key}_{count}_duplicate"
+
+    if new_key in dictionary:
+        return unique_key(key, dictionary, count + 1)
+
+    else:
+        return new_key

{dissect_target-3.22.dev18 → dissect_target-3.22.dev20}/dissect/target/volumes/bde.py

@@ -86,6 +86,13 @@ class BitlockerVolumeSystem(EncryptedVolumeSystem):
                 if not is_wildcard:
                     log.exception("Failed to unlock BDE volume with BEK file %s", bek_file)
 
+    def unlock_with_fvek(self, raw_key: bytes, is_wildcard: bool = False) -> None:
+        try:
+            self.bde.unlock_with_fvek(raw_key)
+        except ValueError as e:
+            if not is_wildcard:
+                log.exception("Failed to unlock BDE volume with raw FVEK key (%r): %s", raw_key, e)
+
     def unlock_volume(self) -> AlignedStream:
         if self.bde.has_clear_key():
             self.bde.unlock_with_clear_key()
@@ -101,6 +108,8 @@ class BitlockerVolumeSystem(EncryptedVolumeSystem):
                 elif key.key_type == KeyType.FILE:
                     bek_file = pathlib.Path(key.value)
                     self.unlock_with_bek_file(bek_file, key.is_wildcard)
+                elif key.key_type == KeyType.RAW:
+                    self.unlock_with_fvek(key.value, key.is_wildcard)
 
                 if self.bde.unlocked:
                     log.info("Volume %s with identifiers %s unlocked with %s", self.fh, identifiers, key)

{dissect_target-3.22.dev18 → dissect_target-3.22.dev20/dissect.target.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.22.dev18
+Version: 3.22.dev20
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3
@@ -44,7 +44,7 @@ Requires-Dist: dissect.etl<4,>=3; extra == "full"
 Requires-Dist: dissect.extfs<4,>=3; extra == "full"
 Requires-Dist: dissect.fat<4,>=3; extra == "full"
 Requires-Dist: dissect.ffs<4,>=3; extra == "full"
-Requires-Dist: dissect.fve<5,>=4; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "full"
+Requires-Dist: dissect.fve<5,>=4.2.dev; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "full"
 Requires-Dist: dissect.jffs<2,>=1.5.dev; extra == "full"
 Requires-Dist: dissect.ole<4,>=3; extra == "full"
 Requires-Dist: dissect.shellitem<4,>=3; extra == "full"
@@ -73,7 +73,7 @@ Requires-Dist: dissect.evidence[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.extfs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.fat[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.ffs[dev]<4.0.dev,>=3.0.dev; extra == "dev"
-Requires-Dist: dissect.fve[dev]<5.0.dev,>=4.0.dev; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "dev"
+Requires-Dist: dissect.fve[dev]<5.0.dev,>=4.2.dev; (platform_system != "Windows" or platform_python_implementation != "PyPy") and extra == "dev"
 Requires-Dist: dissect.hypervisor[dev]<4.0.dev,>=3.0.dev; extra == "dev"
 Requires-Dist: dissect.jffs[dev]<2.0.dev,>=1.5.dev; extra == "dev"
 Requires-Dist: dissect.ntfs[dev]<4.0.dev,>=3.4.dev; extra == "dev"

{dissect_target-3.22.dev18 → dissect_target-3.22.dev20}/dissect.target.egg-info/requires.txt

@@ -43,7 +43,7 @@ dissect.xfs[dev]<4.0.dev,>=3.0.dev
 pexpect
 
 [dev:platform_system != "Windows" or platform_python_implementation != "PyPy"]
-dissect.fve[dev]<5.0.dev,>=4.0.dev
+dissect.fve[dev]<5.0.dev,>=4.2.dev
 
 [full]
 asn1crypto
@@ -71,7 +71,7 @@ ruamel.yaml
 zstandard
 
 [full:platform_system != "Windows" or platform_python_implementation != "PyPy"]
-dissect.fve<5,>=4
+dissect.fve<5,>=4.2.dev
 
 [full:python_version < "3.11"]
 tomli

{dissect_target-3.22.dev18 → dissect_target-3.22.dev20}/pyproject.toml

@@ -56,8 +56,8 @@ full = [
     "dissect.extfs>=3,<4",
     "dissect.fat>=3,<4",
     "dissect.ffs>=3,<4",
-    "dissect.fve>=4,<5; platform_system != 'Windows' or platform_python_implementation != 'PyPy'",
-    "dissect.jffs>=1.5.dev,<2",     # TODO: update on release 
+    "dissect.fve>=4.2.dev,<5; platform_system != 'Windows' or platform_python_implementation != 'PyPy'",  # TODO: update on release
+    "dissect.jffs>=1.5.dev,<2",  # TODO: update on release
     "dissect.ole>=3,<4",
     "dissect.shellitem>=3,<4",
     "dissect.squashfs>=1,<2",
@@ -93,7 +93,7 @@ dev = [
     "dissect.extfs[dev]>=3.0.dev,<4.0.dev",
     "dissect.fat[dev]>=3.0.dev,<4.0.dev",
     "dissect.ffs[dev]>=3.0.dev,<4.0.dev",
-    "dissect.fve[dev]>=4.0.dev,<5.0.dev; platform_system != 'Windows' or platform_python_implementation != 'PyPy'",
+    "dissect.fve[dev]>=4.2.dev,<5.0.dev; platform_system != 'Windows' or platform_python_implementation != 'PyPy'",
     "dissect.hypervisor[dev]>=3.0.dev,<4.0.dev",
     "dissect.jffs[dev]>=1.5.dev,<2.0.dev",
     "dissect.ntfs[dev]>=3.4.dev,<4.0.dev",

{dissect_target-3.22.dev18 → dissect_target-3.22.dev20}/tests/plugins/os/windows/log/test_evtx.py

@@ -1,15 +1,19 @@
 import shutil
+from datetime import datetime, timezone
+from pathlib import Path
 
 import pytest
 
 from dissect.target.exceptions import RegistryKeyNotFoundError, UnsupportedPluginError
+from dissect.target.filesystem import VirtualFilesystem
 from dissect.target.helpers.regutil import VirtualKey, VirtualValue
 from dissect.target.plugins.os.windows.log import evt, evtx
 from dissect.target.plugins.scrape import scrape
+from dissect.target.target import Target
 from tests._utils import absolute_path
 
 
-def mock_registry_log_location(target_win, reg_key_name, mock_log_path):
+def mock_registry_log_location(target_win: Target, reg_key_name: str, mock_log_path: str) -> None:
     # Mock eventlog registry key in a specific control set,
     # CurrentControlSet used in preconfigured value is a soft link
     registry_hive = target_win.registry._root
@@ -39,7 +43,14 @@ def mock_registry_log_location(target_win, reg_key_name, mock_log_path):
         (True, True, True),
     ],
 )
-def test_evtx_plugin(target_win, fs_win, tmp_path, is_in_directory, is_in_registry, duplicate):
+def test_evtx_plugin(
+    target_win: Target,
+    fs_win: VirtualFilesystem,
+    tmp_path: Path,
+    is_in_directory: bool,
+    is_in_registry: bool,
+    duplicate: bool,
+) -> None:
     with pytest.raises(UnsupportedPluginError):
         target_win.add_plugin(evtx.EvtxPlugin)
 
@@ -89,7 +100,7 @@ def test_evtx_plugin(target_win, fs_win, tmp_path, is_in_directory, is_in_regist
     assert len({str(rec.EventID) for rec in records}) == 5
 
 
-def test_evtx_scraping(target_win):
+def test_evtx_scraping(target_win: Target) -> None:
     target_win.add_plugin(scrape.ScrapePlugin)
 
     plugin = evtx.EvtxPlugin(target_win)
@@ -100,3 +111,49 @@ def test_evtx_scraping(target_win):
         scraped_records = list(plugin.scraped_evtx())
 
     assert len(scraped_records) == 5
+
+
+def test_evtx_normalize_values(target_win: Target, fs_win: VirtualFilesystem) -> None:
+    """test if we normalize certain evtx fields correctly."""
+
+    # Example Security.evtx originates from Windows 10 22H2 Pro build 19045.2006,
+    # events exported after clean virtual machine post-install.
+    security_evtx = absolute_path("_data/plugins/os/windows/log/evtx/Security.evtx")
+    fs_win.map_file("Windows\\System32\\winevt\\Logs\\Security.evtx", security_evtx)
+
+    target_win.add_plugin(evtx.EvtxPlugin)
+
+    records = sorted(list(target_win.evtx()), key=lambda r: r.ts)
+
+    # Verified amount of events in Event Viewer
+    assert len(records) == 759
+
+    assert records[0].ts == datetime(2025, 3, 4, 10, 27, 58, 245262, tzinfo=timezone.utc)
+    assert records[0].Provider_Name == "Microsoft-Windows-Security-Auditing"
+    assert records[0].EventID == 4616
+    assert records[0].Channel == "Security"
+    assert records[0].Computer == "DESKTOP-L7A1DDP"
+    assert records[0].Correlation_ActivityID is None
+    assert records[0].SubjectUserSid == "S-1-5-18"
+    assert records[0].source == "sysvol\\windows\\system32\\winevt\\logs\\Security.evtx"
+
+    assert records[69].ts == datetime(2025, 3, 4, 10, 28, 2, 905350, tzinfo=timezone.utc)
+    assert records[69].PrivilegeList is None
+    assert records[69].SidHistory is None
+
+    # Should contain None instead of string "-"
+    assert {getattr(r, "IpAddress", None) for r in records} == {None, "127.0.0.1"}
+
+
+@pytest.mark.parametrize(
+    ("key", "keys", "expected_key"),
+    [
+        ("source", {"source", "_target"}, "source_2_duplicate"),
+        ("source", {"source", "source_2_duplicate", "_target"}, "source_3_duplicate"),
+        ("source", {"source", "source_2", "_target"}, "source_2_duplicate"),
+    ],
+)
+def test_evtx_key_deduplication(key: str, keys: set[str], expected_key: str) -> None:
+    """test if ``unique_keys`` correctly deduplicates key values."""
+
+    assert evtx.unique_key(key, keys) == expected_key

{dissect_target-3.22.dev18 → dissect_target-3.22.dev20}/tests/volumes/test_bde.py

@@ -1,7 +1,11 @@
+from typing import BinaryIO
+
 import pytest
 
 from dissect.target import volume
 from dissect.target.helpers import keychain
+from dissect.target.target import Target
+from tests._utils import absolute_path
 
 try:
     from dissect.target.volumes.bde import BitlockerVolumeSystem
@@ -11,18 +15,17 @@ except ModuleNotFoundError:
     HAS_DISSECT_FVE = False
 
 
-from tests._utils import absolute_path
-
-
 @pytest.fixture
-def encrypted_volume():
+def encrypted_volume() -> BinaryIO:
     data_file = "_data/volumes/bde/enc-volume.bin"
     with open(absolute_path(data_file), "rb") as f:
         yield f
 
 
 @pytest.mark.skipif(not HAS_DISSECT_FVE, reason="requires dissect.fve")
-def test_bde_volume_failure(target_win, encrypted_volume):
+def test_bde_volume_failure(target_win: Target, encrypted_volume: BinaryIO) -> None:
+    """Test if not providing a key to decrypt a BDE volume results in no mounted volume."""
+
     enc_vol = volume.Volume(encrypted_volume, 1, 0, None, None, None, disk=encrypted_volume)
     target_win.volumes.add(enc_vol)
     target_win.volumes.apply()
@@ -32,9 +35,12 @@ def test_bde_volume_failure(target_win, encrypted_volume):
 
 
 @pytest.mark.skipif(not HAS_DISSECT_FVE, reason="requires dissect.fve")
-def test_bde_volume_with_recovery_key(target_win, encrypted_volume):
+def test_bde_volume_with_recovery_key(target_win: Target, encrypted_volume: BinaryIO) -> None:
+    """Test if we can decrypt a BDE volume using a recovery key."""
+
     recovery_key = "272316-265804-640728-713570-509047-503305-045837-324731"
 
+    keychain.KEYCHAIN.clear()
     keychain.register_key(
         keychain.KeyType.RECOVERY_KEY,
         recovery_key,
@@ -59,10 +65,13 @@ def test_bde_volume_with_recovery_key(target_win, encrypted_volume):
 
 
 @pytest.mark.skipif(not HAS_DISSECT_FVE, reason="requires dissect.fve")
-def test_bde_volume_with_passphrase(target_win, encrypted_volume):
+def test_bde_volume_with_passphrase(target_win: Target, encrypted_volume: BinaryIO) -> None:
+    """Test if we can decrypt a BDE volume using a passphrase."""
+
     identifier = "B6AD258A-2725-4A42-93C6-844478BF7A90"
     passphrase = "Password1234"
 
+    keychain.KEYCHAIN.clear()
     keychain.register_key(
         keychain.KeyType.PASSPHRASE,
         passphrase,
@@ -87,7 +96,10 @@ def test_bde_volume_with_passphrase(target_win, encrypted_volume):
 
 
 @pytest.mark.skipif(not HAS_DISSECT_FVE, reason="requires dissect.fve")
-def test_bde_volume_with_wildcard_key(target_win, encrypted_volume):
+def test_bde_volume_with_wildcard_key(target_win: Target, encrypted_volume: BinaryIO) -> None:
+    """Test if we can decrypt a BDE volume using a wildcard keychain key."""
+
+    keychain.KEYCHAIN.clear()
     keychain.register_wildcard_value("Password1234")
 
     enc_vol = volume.Volume(encrypted_volume, 1, 0, None, None, None, disk=encrypted_volume)
@@ -104,3 +116,26 @@ def test_bde_volume_with_wildcard_key(target_win, encrypted_volume):
     target_win.fs.mount("e:/", dec_vol.fs)
 
     assert target_win.fs.path("e:/test-folder/test-file-2.txt").exists()
+
+
+@pytest.mark.skipif(not HAS_DISSECT_FVE, reason="requires dissect.fve")
+def test_bde_volume_with_raw_key(target_win: Target, encrypted_volume: BinaryIO) -> None:
+    """Test if we can decrypt a BDE volume using a raw FVEK key."""
+
+    keychain.KEYCHAIN.clear()
+    keychain.register_wildcard_value("ab60a58f1a0b60be91ffa2b40ec338a072a011302a8ff58fc45eee742711dc7f")
+
+    enc_vol = volume.Volume(encrypted_volume, 1, 0, None, None, None, disk=encrypted_volume)
+    target_win.volumes.add(enc_vol)
+    target_win.volumes.apply()
+
+    assert len(target_win.volumes) == 2
+    assert enc_vol in target_win.volumes
+
+    dec_vol = next(v for v in target_win.volumes if v != enc_vol)
+
+    # virtual fs + ntfs fs
+    assert len(target_win.filesystems) == 2
+    target_win.fs.mount("e:/", dec_vol.fs)
+
+    assert target_win.fs.path("e:/test-folder/test-file-2.txt").exists()