dissect.target 3.22.dev46__tar.gz → 3.22.dev48__tar.gz

{dissect_target-3.22.dev46 → dissect_target-3.22.dev48}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.22.dev46
+Version: 3.22.dev48
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.22.dev46 → dissect_target-3.22.dev48}/dissect/target/loaders/velociraptor.py

@@ -5,11 +5,13 @@ import zipfile
 from typing import TYPE_CHECKING
 from urllib.parse import quote, unquote
 
+from dissect.target.filesystem import VirtualFilesystem
 from dissect.target.filesystems.dir import DirectoryFilesystem
 from dissect.target.filesystems.zip import ZipFilesystem
 from dissect.target.helpers.fsutil import basename, dirname, join
 from dissect.target.loaders.dir import DirLoader, find_dirs, map_dirs
 from dissect.target.plugin import OperatingSystem
+from dissect.target.plugins.apps.edr.velociraptor import VELOCIRAPTOR_RESULTS
 
 if TYPE_CHECKING:
     from pathlib import Path
@@ -31,7 +33,11 @@ def find_fs_directories(path: Path) -> tuple[OperatingSystem | None, list[Path]
         accessor_root = fs_root.joinpath(accessor)
         if accessor_root.exists():
             os_type, dirs = find_dirs(accessor_root)
-            if os_type in [OperatingSystem.UNIX, OperatingSystem.LINUX, OperatingSystem.OSX]:
+            if os_type in [
+                OperatingSystem.UNIX,
+                OperatingSystem.LINUX,
+                OperatingSystem.OSX,
+            ]:
                 return os_type, [dirs[0]]
 
     # Windows
@@ -69,7 +75,6 @@ def extract_drive_letter(name: str) -> str | None:
     # X: in URL encoding
     if len(name) == 4 and name.endswith("%3A"):
         return name[0].lower()
-
     return None
 
 
@@ -137,6 +142,21 @@ class VelociraptorLoader(DirLoader):
             zipfs=VelociraptorZipFilesystem,
         )
 
+        if (results := self.root.joinpath("results")).is_dir():
+            # Map artifact results collected by Velociraptor
+            vfs = VirtualFilesystem()
+
+            for artifact in results.iterdir():
+                if not artifact.name.endswith(".json"):
+                    continue
+
+                vfs.map_file_fh(artifact.name, artifact.open("rb"))
+
+            if (uploads := self.root.joinpath("uploads.json")).exists():
+                vfs.map_file_fh(uploads.name, uploads.open("rb"))
+
+            target.fs.mount(VELOCIRAPTOR_RESULTS, vfs)
+
 
 class VelociraptorDirectoryFilesystem(DirectoryFilesystem):
     def _resolve_path(self, path: str) -> Path:

dissect_target-3.22.dev48/dissect/target/plugins/apps/edr/acquire.py

@@ -0,0 +1,85 @@
+from __future__ import annotations
+
+import csv
+import gzip
+from typing import TYPE_CHECKING
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, export
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+    from dissect.target.target import Target
+
+AcquireOpenHandlesRecord = TargetRecordDescriptor(
+    "filesystem/acquire_open_handles",
+    [
+        ("path", "name"),
+        ("string", "handle_type"),
+        ("string", "object"),
+        ("varint", "unique_process_id"),
+        ("varint", "handle_value"),
+        ("varint", "granted_access"),
+        ("varint", "creator_back_trace_index"),
+        ("varint", "object_type_index"),
+        ("varint", "handle_attributes"),
+        ("varint", "reserved"),
+    ],
+)
+
+AcquireHashRecord = TargetRecordDescriptor(
+    "filesystem/acquire_hash",
+    [
+        ("path", "path"),
+        ("filesize", "filesize"),
+        ("digest", "digest"),
+    ],
+)
+
+
+class AcquirePlugin(Plugin):
+    """Returns records from data collected by Acquire."""
+
+    __namespace__ = "acquire"
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self.hash_file = target.fs.path("$metadata$/file-hashes.csv.gz")
+        self.open_handles_file = target.fs.path("$metadata$/open_handles.csv.gz")
+
+    def check_compatible(self) -> None:
+        if not self.hash_file.exists() and not self.open_handles_file.exists():
+            raise UnsupportedPluginError("No hash file or open handles found")
+
+    @export(record=AcquireHashRecord)
+    def hashes(self) -> Iterator[AcquireHashRecord]:
+        """Return file hashes collected by Acquire.
+
+        An Acquire file container contains a file hashes csv when the hashes module was used. The content of this csv
+        file is returned.
+        """
+        if self.hash_file.exists():
+            with self.hash_file.open() as fh, gzip.open(fh, "rt") as gz_fh:
+                for row in csv.DictReader(gz_fh):
+                    yield AcquireHashRecord(
+                        path=self.target.fs.path(row["path"]),
+                        filesize=row["file-size"],
+                        digest=(row["md5"] or None, row["sha1"] or None, row["sha256"] or None),
+                        _target=self.target,
+                    )
+
+    @export(record=AcquireOpenHandlesRecord)
+    def handles(self) -> Iterator[AcquireOpenHandlesRecord]:
+        """Return open handles collected by Acquire.
+
+        An Acquire file container contains an open handles csv when the handles module was used. The content of this csv
+        file is returned.
+        """
+        if self.open_handles_file.exists():
+            with self.open_handles_file.open() as fh, gzip.open(fh, "rt") as gz_fh:
+                for row in csv.DictReader(gz_fh):
+                    if name := row.get("name"):
+                        row.update({"name": self.target.fs.path(name)})
+                    yield AcquireOpenHandlesRecord(**row, _target=self.target)

dissect_target-3.22.dev48/dissect/target/plugins/apps/edr/velociraptor.py

@@ -0,0 +1,111 @@
+from __future__ import annotations
+
+import json
+import re
+import urllib.parse
+from functools import lru_cache
+from typing import TYPE_CHECKING
+
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.record import DynamicDescriptor, TargetRecordDescriptor
+from dissect.target.plugin import Plugin, export
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+
+    from flow.record import Record
+
+    from dissect.target.target import Target
+
+VELOCIRAPTOR_RESULTS = "/$velociraptor_results$"
+ISO_8601_PATTERN = r"\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(\.\d+)?(Z|[+-]\d{2}:\d{2})?"
+
+
+class VelociraptorRecordBuilder:
+    def __init__(self, artifact_name: str):
+        self._create_event_descriptor = lru_cache(4096)(self._create_event_descriptor)
+        self.record_name = f"velociraptor/{artifact_name}"
+
+    def build(self, object: dict, target: Target) -> TargetRecordDescriptor:
+        """Builds a Velociraptor record."""
+        record_values = {}
+        record_fields = []
+
+        record_values["_target"] = target
+
+        for key, value in object.items():
+            # Reserved by flow.record
+            if key.startswith("_"):
+                continue
+
+            key = key.lower().replace("(", "_").replace(")", "_")
+
+            if re.match(ISO_8601_PATTERN, str(value)):
+                record_type = "datetime"
+            elif isinstance(value, list):
+                record_type = "string[]"
+            elif isinstance(value, int):
+                record_type = "varint"
+            elif key == "hash":
+                record_type = "digest"
+                value = (value.get("MD5"), value.get("SHA1"), value.get("SHA256"))
+            elif isinstance(value, str):
+                record_type = "string"
+            elif isinstance(value, dict):
+                record_type = "record"
+                value = self.build(value, target)
+            else:
+                record_type = "dynamic"
+
+            record_fields.append((record_type, key))
+            record_values[key] = value
+
+        # tuple conversion here is needed for lru_cache
+        desc = self._create_event_descriptor(tuple(record_fields))
+        return desc(**record_values)
+
+    def _create_event_descriptor(self, record_fields: list[tuple[str, str]]) -> TargetRecordDescriptor:
+        return TargetRecordDescriptor(self.record_name, record_fields)
+
+
+class VelociraptorPlugin(Plugin):
+    """Returns records from Velociraptor artifacts."""
+
+    __namespace__ = "velociraptor"
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self.results_dir = target.fs.path(VELOCIRAPTOR_RESULTS)
+
+    def check_compatible(self) -> None:
+        if not self.results_dir.exists():
+            raise UnsupportedPluginError("No Velociraptor artifacts found")
+
+    @export(record=DynamicDescriptor(["datetime"]))
+    def results(self) -> Iterator[Record]:
+        """Return Rapid7 Velociraptor artifacts.
+
+        References:
+            - https://docs.velociraptor.app/docs/vql/artifacts/
+        """
+        for artifact in self.results_dir.glob("*.json"):
+            # "Windows.KapeFiles.Targets%2FAll\ File\ Metadata.json" becomes "windows_kapefiles_targets"
+            artifact_name = (
+                urllib.parse.unquote(artifact.name.removesuffix(".json")).split("/")[0].lower().replace(".", "_")
+            )
+            record_builder = VelociraptorRecordBuilder(artifact_name)
+
+            for line in artifact.open("rt"):
+                if not (line := line.strip()):
+                    continue
+
+                try:
+                    object = json.loads(line)
+                    yield record_builder.build(object, self.target)
+                except json.decoder.JSONDecodeError:
+                    self.target.log.warning(
+                        "Could not decode Velociraptor JSON log line in file %s: %s",
+                        artifact,
+                        line,
+                    )
+                    continue

{dissect_target-3.22.dev46 → dissect_target-3.22.dev48}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.22.dev46
+Version: 3.22.dev48
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.22.dev46 → dissect_target-3.22.dev48}/dissect.target.egg-info/SOURCES.txt

@@ -166,6 +166,9 @@ dissect/target/plugins/apps/database/__init__.py
 dissect/target/plugins/apps/editor/__init__.py
 dissect/target/plugins/apps/editor/editor.py
 dissect/target/plugins/apps/editor/windowsnotepad.py
+dissect/target/plugins/apps/edr/__init__.py
+dissect/target/plugins/apps/edr/acquire.py
+dissect/target/plugins/apps/edr/velociraptor.py
 dissect/target/plugins/apps/other/__init__.py
 dissect/target/plugins/apps/other/env.py
 dissect/target/plugins/apps/productivity/__init__.py
@@ -211,8 +214,6 @@ dissect/target/plugins/child/virtuozzo.py
 dissect/target/plugins/child/vmware_workstation.py
 dissect/target/plugins/child/wsl.py
 dissect/target/plugins/filesystem/__init__.py
-dissect/target/plugins/filesystem/acquire_handles.py
-dissect/target/plugins/filesystem/acquire_hash.py
 dissect/target/plugins/filesystem/icat.py
 dissect/target/plugins/filesystem/resolver.py
 dissect/target/plugins/filesystem/walkfs.py
@@ -543,6 +544,9 @@ tests/plugins/apps/container/__init__.py
 tests/plugins/apps/container/test_docker.py
 tests/plugins/apps/editor/__init__.py
 tests/plugins/apps/editor/test_windowsnotepad.py
+tests/plugins/apps/edr/__init__.py
+tests/plugins/apps/edr/test_acquire.py
+tests/plugins/apps/edr/test_velociraptor.py
 tests/plugins/apps/other/__init__.py
 tests/plugins/apps/other/test_envfile.py
 tests/plugins/apps/productivity/__init__.py
@@ -584,8 +588,6 @@ tests/plugins/child/test_virtuozzo.py
 tests/plugins/child/test_vmware_workstation.py
 tests/plugins/child/test_wsl.py
 tests/plugins/filesystem/__init__.py
-tests/plugins/filesystem/test_acquire_handles.py
-tests/plugins/filesystem/test_acquire_hash.py
 tests/plugins/filesystem/test_icat.py
 tests/plugins/filesystem/test_resolver.py
 tests/plugins/filesystem/test_walkfs.py

{dissect_target-3.22.dev46 → dissect_target-3.22.dev48}/tests/conftest.py

@@ -34,17 +34,36 @@ if TYPE_CHECKING:
 
     from dissect.target.plugin import OSPlugin
 
-# Test if the data/ directory is present and if not, as is the case in Python
-# source distributions of dissect.target, we give an error
-data_dir = absolute_path("_data")
-if not pathlib.Path(data_dir).is_dir():
-    raise pytest.PytestConfigWarning(
-        f"No test data directory {data_dir} found.\n"
-        "This can happen when you have downloaded the source distribution\n"
-        "of dissect.target from pypi.org. If so, retrieve the test data from\n"
-        "the dissect.target GitHub repository at:\n"
-        "https://github.com/fox-it/dissect.target"
-    )
+
+def pytest_sessionstart(session: pytest.Session) -> None:
+    # Test if the _data/ directory is present and if not, as is the case in Python
+    # source distributions of dissect.target, we give an error
+    data_dir = absolute_path("_data")
+    if not data_dir.is_dir():
+        session.shouldfail = (
+            "! !\n"
+            f"No test data directory {data_dir} found.\n"
+            "This can happen when you have downloaded the source distribution\n"
+            "of dissect.target from pypi.org. If so, retrieve the test data from\n"
+            "the dissect.target GitHub repository at:\n"
+            "https://github.com/fox-it/dissect.target"
+            "\n! !"
+        )
+    else:
+        # Test if the test data looks like LFS references and if so, we give an error
+        # This can happen when git-lfs is not installed or not configured correctly
+        for file in (path for path in data_dir.rglob("*") if path.is_file()):
+            with file.open("rb") as fh:
+                if fh.read(42) == b"version https://git-lfs.github.com/spec/v1":
+                    session.shouldfail = (
+                        "! !\n"
+                        "Test data files look like git-lfs references.\n"
+                        "This can happen when git-lfs is not installed or not configured correctly.\n"
+                        "Install git-lfs and run: \n"
+                        "git lfs install && git lfs pull"
+                        "\n! !"
+                    )
+            break
 
 
 @pytest.fixture(autouse=True)

{dissect_target-3.22.dev46 → dissect_target-3.22.dev48}/tests/loaders/test_velociraptor.py

@@ -24,6 +24,7 @@ def create_root(sub_dir: str, tmp_path: Path) -> Path:
         f"uploads/{sub_dir}/%5C%5C%3F%5CGLOBALROOT%5CDevice%5CHarddiskVolumeShadowCopy1/$Extend",
         f"uploads/{sub_dir}/%5C%5C%3F%5CGLOBALROOT%5CDevice%5CHarddiskVolumeShadowCopy1/windows/system32",
         f"uploads/{sub_dir}/%5C%5C.%5CC%3A/%2ETEST",
+        "results",
     ]
     root = tmp_path
     mkdirs(root, paths)
@@ -52,16 +53,10 @@ def create_root(sub_dir: str, tmp_path: Path) -> Path:
 
 
 @pytest.mark.parametrize(
-    ("sub_dir", "other_dir"),
-    [
-        ("mft", "auto"),
-        ("ntfs", "auto"),
-        ("ntfs_vss", "auto"),
-        ("lazy_ntfs", "auto"),
-        ("auto", "ntfs"),
-    ],
+    "sub_dir",
+    ["mft", "ntfs", "ntfs_vss", "lazy_ntfs", "auto"],
 )
-def test_windows_ntfs(sub_dir: str, other_dir: str, target_bare: Target, tmp_path: Path) -> None:
+def test_windows_ntfs(sub_dir: str, target_bare: Target, tmp_path: Path) -> None:
     root = create_root(sub_dir, tmp_path)
 
     assert VelociraptorLoader.detect(root) is True

dissect_target-3.22.dev48/tests/plugins/apps/edr/test_acquire.py

@@ -0,0 +1,30 @@
+from __future__ import annotations
+
+from dissect.target.plugins.apps.edr.acquire import AcquirePlugin
+from dissect.target.target import Target
+from tests._utils import absolute_path
+
+
+def test_acquire_handles_plugin() -> None:
+    file_hashes_target = Target().open(absolute_path("_data/plugins/apps/edr/acquire/handles/test-acquire-handles.tar"))
+    file_hashes_target.add_plugin(AcquirePlugin)
+
+    results = list(file_hashes_target.acquire.handles())
+    first_result = results[0]
+
+    assert first_result.name == r"\Windows\Fonts"
+    assert first_result.handle_type == "EtwRegistration"
+    assert first_result.unique_process_id == 1
+    assert first_result.object == "0xfffftest"
+    assert results[-1].unique_process_id == 124
+    assert len(results) == 124
+
+
+def test_acquire_hash_plugin() -> None:
+    file_hashes_target = Target().open(absolute_path("_data/plugins/apps/edr/acquire/hash/test-acquire-hash.tar"))
+    file_hashes_target.add_plugin(AcquirePlugin)
+
+    results = list(file_hashes_target.acquire.hashes())
+
+    assert results[0].path == "/sysvol/Windows/bfsvc.exe"
+    assert len(results) == 998

dissect_target-3.22.dev48/tests/plugins/apps/edr/test_velociraptor.py

@@ -0,0 +1,48 @@
+from __future__ import annotations
+
+from typing import TYPE_CHECKING
+
+from dissect.target.loaders.velociraptor import VelociraptorLoader
+from dissect.target.plugins.apps.edr.velociraptor import VelociraptorPlugin
+from tests._utils import absolute_path
+from tests.loaders.test_velociraptor import create_root
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+    from dissect.target.target import Target
+
+
+def test_windows_velociraptor(target_win: Target, tmp_path: Path) -> None:
+    """Test that a Windows Velociraptor artefact result is correctly parsed."""
+    root = create_root("ntfs", tmp_path)
+
+    with absolute_path("_data/plugins/apps/edr/velociraptor/windows-uploads.json").open("rb") as fh:
+        root.joinpath("uploads.json").write_bytes(fh.read())
+
+    with absolute_path("_data/plugins/apps/edr/velociraptor/Windows.Memory.ProcessInfo.json").open("rb") as fh:
+        root.joinpath("results/Windows.Memory.ProcessInfo.json").write_bytes(fh.read())
+
+    assert VelociraptorLoader.detect(root) is True
+
+    loader = VelociraptorLoader(root)
+    loader.map(target_win)
+    target_win.apply()
+
+    target_win.add_plugin(VelociraptorPlugin)
+
+    results = list(target_win.velociraptor())
+
+    record = results[0]
+
+    assert record.name == "Microsoft.SharePoint.exe"
+    assert record.pebbaseaddress == "0x295000"
+    assert record.pid == 8120
+    assert (
+        record.imagepathname
+        == "C:\\Users\\IEUser\\AppData\\Local\\Microsoft\\OneDrive\\24.070.0407.0003\\Microsoft.SharePoint.exe"
+    )
+    assert record.commandline == "/silentConfig"
+    assert record.currentdirectory == "C:\\Windows\\system32\\"
+    assert record._desc.name == "velociraptor/windows_memory_processinfo"
+    assert record.env.allusersprofile == "C:\\ProgramData"

dissect_target-3.22.dev46/dissect/target/plugins/filesystem/acquire_handles.py

@@ -1,55 +0,0 @@
-from __future__ import annotations
-
-import csv
-import gzip
-from typing import TYPE_CHECKING
-
-from dissect.target.exceptions import UnsupportedPluginError
-from dissect.target.helpers.record import TargetRecordDescriptor
-from dissect.target.plugin import Plugin, export
-
-if TYPE_CHECKING:
-    from collections.abc import Iterator
-
-    from dissect.target.target import Target
-
-AcquireOpenHandlesRecord = TargetRecordDescriptor(
-    "filesystem/acquire_open_handles",
-    [
-        ("path", "name"),
-        ("string", "handle_type"),
-        ("string", "object"),
-        ("varint", "unique_process_id"),
-        ("varint", "handle_value"),
-        ("varint", "granted_access"),
-        ("varint", "creator_back_trace_index"),
-        ("varint", "object_type_index"),
-        ("varint", "handle_attributes"),
-        ("varint", "reserved"),
-    ],
-)
-
-
-class OpenHandlesPlugin(Plugin):
-    """Plugin to return open file handles collected by Acquire."""
-
-    def __init__(self, target: Target):
-        super().__init__(target)
-        self.open_handles_file = target.fs.path("$metadata$/open_handles.csv.gz")
-
-    def check_compatible(self) -> None:
-        if not self.open_handles_file.exists():
-            raise UnsupportedPluginError("No open handles found")
-
-    @export(record=AcquireOpenHandlesRecord)
-    def acquire_handles(self) -> Iterator[AcquireOpenHandlesRecord]:
-        """Return open handles collected by Acquire.
-
-        An Acquire file container contains an open handles csv when the handles module was used. The content of this csv
-        file is returned.
-        """
-        with self.open_handles_file.open() as fh, gzip.open(fh, "rt") as gz_fh:
-            for row in csv.DictReader(gz_fh):
-                if name := row.get("name"):
-                    row.update({"name": self.target.fs.path(name)})
-                yield AcquireOpenHandlesRecord(_target=self.target, **row)

dissect_target-3.22.dev46/dissect/target/plugins/filesystem/acquire_hash.py

@@ -1,52 +0,0 @@
-from __future__ import annotations
-
-import csv
-import gzip
-from typing import TYPE_CHECKING
-
-from dissect.target.exceptions import UnsupportedPluginError
-from dissect.target.helpers.record import TargetRecordDescriptor
-from dissect.target.plugin import Plugin, export
-
-if TYPE_CHECKING:
-    from collections.abc import Iterator
-
-    from dissect.target.target import Target
-
-AcquireHashRecord = TargetRecordDescriptor(
-    "filesystem/acquire_hash",
-    [
-        ("path", "path"),
-        ("filesize", "filesize"),
-        ("digest", "digest"),
-    ],
-)
-
-
-class AcquireHashPlugin(Plugin):
-    """Plugin to return file hashes collected by Acquire."""
-
-    def __init__(self, target: Target):
-        super().__init__(target)
-        self.hash_file = target.fs.path("$metadata$/file-hashes.csv.gz")
-
-    def check_compatible(self) -> None:
-        if not self.hash_file.exists():
-            raise UnsupportedPluginError("No hash file found")
-
-    @export(record=AcquireHashRecord)
-    def acquire_hashes(self) -> Iterator[AcquireHashRecord]:
-        """Return file hashes collected by Acquire.
-
-        An Acquire file container contains a file hashes csv when the hashes module was used. The content of this csv
-        file is returned.
-        """
-
-        with self.hash_file.open() as fh, gzip.open(fh, "rt") as gz_fh:
-            for row in csv.DictReader(gz_fh):
-                yield AcquireHashRecord(
-                    path=self.target.fs.path(row["path"]),
-                    filesize=row["file-size"],
-                    digest=(row["md5"] or None, row["sha1"] or None, row["sha256"] or None),
-                    _target=self.target,
-                )

dissect_target-3.22.dev46/tests/plugins/filesystem/test_acquire_handles.py

@@ -1,22 +0,0 @@
-from __future__ import annotations
-
-from dissect.target.plugins.filesystem.acquire_handles import OpenHandlesPlugin
-from dissect.target.target import Target
-from tests._utils import absolute_path
-
-
-def test_acquire_handles_plugin() -> None:
-    file_hashes_target = Target().open(
-        absolute_path("_data/plugins/filesystem/acquire_handles/test-acquire-handles.tar")
-    )
-    file_hashes_target.add_plugin(OpenHandlesPlugin)
-
-    results = list(file_hashes_target.acquire_handles())
-    first_result = results[0]
-
-    assert first_result.name == r"\Windows\Fonts"
-    assert first_result.handle_type == "EtwRegistration"
-    assert first_result.unique_process_id == 1
-    assert first_result.object == "0xfffftest"
-    assert results[-1].unique_process_id == 124
-    assert len(results) == 124

dissect_target-3.22.dev46/tests/plugins/filesystem/test_acquire_hash.py

@@ -1,15 +0,0 @@
-from __future__ import annotations
-
-from dissect.target.plugins.filesystem.acquire_hash import AcquireHashPlugin
-from dissect.target.target import Target
-from tests._utils import absolute_path
-
-
-def test_acquire_hash_plugin() -> None:
-    file_hashes_target = Target().open(absolute_path("_data/plugins/filesystem/acquire_hash/test-acquire-hash.tar"))
-    file_hashes_target.add_plugin(AcquireHashPlugin)
-
-    results = list(file_hashes_target.acquire_hashes())
-
-    assert results[0].path == "/sysvol/Windows/bfsvc.exe"
-    assert len(results) == 998