dissect.target 3.23.2.dev14__tar.gz → 3.23.2.dev16__tar.gz

{dissect_target-3.23.2.dev14 → dissect_target-3.23.2.dev16}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.2.dev14
+Version: 3.23.2.dev16
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{dissect_target-3.23.2.dev14 → dissect_target-3.23.2.dev16}/dissect/target/loaders/kape.py

@@ -2,8 +2,7 @@ from __future__ import annotations
 
 from typing import TYPE_CHECKING
 
-from dissect.target import filesystem, volume
-from dissect.target.containers.vhdx import VhdxContainer
+from dissect.target import container, filesystem, volume
 from dissect.target.loader import Loader
 from dissect.target.loaders.dir import find_and_map_dirs, find_dirs
 from dissect.target.plugin import OperatingSystem
@@ -21,10 +20,9 @@ if TYPE_CHECKING:
 USNJRNL_PATHS = ["$Extend/$J", "$Extend/$UsnJrnl$J"]
 
 
-def open_vhdx(path: Path) -> Iterator[Filesystem]:
-    container = VhdxContainer(path)
-    volume_system = volume.open(container)
-    for vol in volume_system.volumes:
+def open_kape_file(path: Path) -> Iterator[Filesystem]:
+    vs = volume.open(container.open(path))
+    for vol in vs.volumes:
         yield filesystem.open(vol)
 
 
@@ -39,13 +37,13 @@ def is_valid_kape_dir(path: Path) -> bool:
     return False
 
 
-def is_valid_kape_vhdx(path: Path) -> bool:
-    if path.suffix == ".vhdx":
-        try:
-            for fs in open_vhdx(path):
+def is_valid_kape_file(path: Path) -> bool:
+    try:
+        if path.suffix.lower() in (".vhdx", ".vhd"):
+            for fs in open_kape_file(path):
                 return is_valid_kape_dir(fs.path())
-        except Exception:
-            return False
+    except Exception:
+        return False
 
     return False
 
@@ -55,18 +53,19 @@ class KapeLoader(Loader):
 
     References:
         - https://www.kroll.com/en/insights/publications/cyber/kroll-artifact-parser-extractor-kape
+        - https://ericzimmerman.github.io/KapeDocs/#!Pages\3.-Using-KAPE.md#container-switches
     """
 
     @staticmethod
     def detect(path: Path) -> bool:
         if path.is_dir():
             return is_valid_kape_dir(path)
-        if path.suffix.lower() == ".vhdx":
-            return is_valid_kape_vhdx(path)
+        if path.suffix.lower() in (".vhdx", ".vhd"):
+            return is_valid_kape_file(path)
         return False
 
     def map(self, target: Target) -> None:
-        path = self.absolute_path if self.absolute_path.is_dir() else next(open_vhdx(self.absolute_path)).path()
+        path = self.absolute_path if self.absolute_path.is_dir() else next(open_kape_file(self.absolute_path)).path()
 
         find_and_map_dirs(
             target,

{dissect_target-3.23.2.dev14 → dissect_target-3.23.2.dev16}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.2.dev14
+Version: 3.23.2.dev16
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{dissect_target-3.23.2.dev14 → dissect_target-3.23.2.dev16}/tests/loaders/test_vbk.py

@@ -116,7 +116,7 @@ def test_mock_vmx() -> None:
         assert len(t.disks) == 1
 
         t.disks[0].seek(0)
-        assert t.disks[0].read(-1).decode() == "🍖👑"
+        assert t.disks[0].read(8).decode() == "🍖👑"
 
 
 def test_mock_vmcx() -> None:

dissect_target-3.23.2.dev16/tests/plugins/os/windows/test_everything.py

@@ -0,0 +1,217 @@
+from datetime import datetime, timezone
+
+import pytest
+
+from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugins.os.windows.everything._plugin import EverythingPlugin
+from dissect.target.target import Target
+from tests._utils import absolute_path
+
+DIRECTORY = "directory"
+FILE = "file"
+
+
+def test_everything_1_7_20_ntfs_only(target_win: Target, fs_win: VirtualFilesystem) -> None:
+    fs_win.map_file(
+        "\\Program Files\\Everything\\Everything.db",
+        absolute_path("_data/plugins/os/windows/everything/1.7.20/Everything_NTFS_ONLY.db.gz"),
+        compression="gzip",
+    )
+    target_win.add_plugin(EverythingPlugin)
+
+    records = []
+    idx = 0
+    for idx, record in enumerate(target_win.everything.locate()):
+        if idx not in [0, 86828]:
+            continue
+        records.append(record)
+
+    length = idx + 1
+    assert length == 126828
+
+    assert records[0].type == DIRECTORY
+    assert records[0].path == "C:\\$Recycle.Bin"
+    assert records[0].date_modified == datetime(2023, 12, 16, 9, 8, 42, 726189, tzinfo=timezone.utc)
+    assert records[1].type == FILE
+    assert records[1].path == "C:\\Windows\\System32\\msidntld.dll"
+    assert records[1].date_modified == datetime(2021, 5, 8, 8, 14, 34, 642525, tzinfo=timezone.utc)
+
+
+def test_everything_1_7_20_ntfs_and_folder(target_win: Target, fs_win: VirtualFilesystem) -> None:
+    fs_win.map_file(
+        "\\Program Files\\Everything\\Everything.db",
+        absolute_path("_data/plugins/os/windows/everything/1.7.20/Everything_NTFS_AND_FOLDER.db.gz"),
+        compression="gzip",
+    )
+    target_win.add_plugin(EverythingPlugin)
+
+    records = []
+
+    idx = 0
+    for idx, record in enumerate(target_win.everything.locate()):
+        if idx not in [0, 1, 94783]:
+            continue
+        records.append(record)
+
+    length = idx + 1
+    assert length == 127042
+
+    assert records[0].type == DIRECTORY
+    assert records[0].path == "C:\\$Recycle.Bin"
+    assert records[0].date_modified == datetime(2023, 12, 16, 9, 8, 42, 726189, tzinfo=timezone.utc)
+
+    assert records[1].type == DIRECTORY
+    assert records[1].path == "E:\\$RECYCLE.BIN"
+    assert records[1].date_modified == datetime(2024, 1, 27, 9, 54, 32, tzinfo=timezone.utc)
+
+    assert records[2].type == FILE
+    assert records[2].path == "E:\\potato.txt"
+    assert records[2].date_modified == datetime(2024, 1, 27, 9, 54, 32, tzinfo=timezone.utc)
+
+
+def test_everything_1_7_20_ntfs_and_refs(target_win: Target, fs_win: VirtualFilesystem) -> None:
+    fs_win.map_file(
+        "\\Program Files\\Everything\\Everything.db",
+        absolute_path("_data/plugins/os/windows/everything/1.7.20/Everything_NTFS_AND_REFS.db.gz"),
+        compression="gzip",
+    )
+    target_win.add_plugin(EverythingPlugin)
+
+    records = []
+    idx = 0
+    for idx, record in enumerate(target_win.everything.locate()):
+        if idx not in [0, 1, 94937, 108011]:
+            continue
+
+        records.append(record)
+
+    length = idx + 1
+    assert length == 127227
+
+    assert records[0].type == DIRECTORY
+    assert records[0].path == "C:\\$Recycle.Bin"
+    assert records[0].date_modified == datetime(2023, 12, 16, 9, 8, 42, 726189, tzinfo=timezone.utc)
+
+    assert records[1].type == DIRECTORY
+    assert records[1].path == "E:\\$RECYCLE.BIN"
+    assert records[1].date_modified == datetime(2024, 1, 27, 21, 37, 6, 675776, tzinfo=timezone.utc)
+
+    assert records[2].type == FILE
+    assert records[2].path == "E:\\potato.txt"
+    assert records[2].date_modified == datetime(2024, 1, 27, 21, 37, 13, 425810, tzinfo=timezone.utc)
+
+    assert records[3].type == FILE
+    assert records[3].path == "E:\\test.txt"
+    assert records[3].date_modified == datetime(2024, 1, 27, 21, 56, 57, 597593, tzinfo=timezone.utc)
+
+
+def test_everything_1_7_20_refs_with_disabled_ntfs(target_win: Target, fs_win: VirtualFilesystem) -> None:
+    # Just making sure that disabling a drive doesn't mess up parsing
+    fs_win.map_file(
+        "\\Program Files\\Everything\\Everything.db",
+        absolute_path("_data/plugins/os/windows/everything/1.7.20/Everything_REFS_WITH_DISABLED_NTFS.db.gz"),
+        compression="gzip",
+    )
+    target_win.add_plugin(EverythingPlugin)
+
+    records = list(target_win.everything.locate())
+    assert len(records) == 7
+    record = records[0]
+    assert record.type == DIRECTORY
+    assert record.path == "E:\\$RECYCLE.BIN"
+    assert record.date_modified == datetime(2024, 1, 27, 21, 37, 6, 675776, tzinfo=timezone.utc)
+
+    record = records[5]
+    assert record.type == FILE
+    assert record.path == "E:\\potato.txt"
+    assert record.date_modified == datetime(2024, 1, 27, 21, 37, 13, 425810, tzinfo=timezone.utc)
+
+
+def test_everything_1_7_20_refs_include_only(target_win: Target, fs_win: VirtualFilesystem) -> None:
+    # Just making sure that including specific subfolders doesn't mess up parsing
+    fs_win.map_file(
+        "\\Program Files\\Everything\\Everything.db",
+        absolute_path("_data/plugins/os/windows/everything/1.7.20/Everything_REFS_INCLUDE_ONLY.db.gz"),
+        compression="gzip",
+    )
+    target_win.add_plugin(EverythingPlugin)
+
+    records = list(target_win.everything.locate())
+    assert len(records) == 4
+    record = records[0]
+    assert record.type == DIRECTORY
+    assert record.path == "E:\\test"
+    assert record.date_modified == datetime(2024, 1, 27, 22, 6, 9, 597820, tzinfo=timezone.utc)
+
+    record = records[3]
+    assert record.type == FILE
+    assert record.path == "E:\\test\\test.txt"
+    assert record.date_modified == datetime(2024, 1, 27, 21, 56, 57, 597593, tzinfo=timezone.utc)
+
+
+def test_everything_1_7_20_efu(target_win: Target, fs_win: VirtualFilesystem) -> None:
+    fs_win.map_file(
+        "\\Program Files\\Everything\\Everything.db",
+        absolute_path("_data/plugins/os/windows/everything/1.7.20/Everything_FILE_LIST.db.gz"),
+        compression="gzip",
+    )
+    target_win.add_plugin(EverythingPlugin)
+
+    records = list(target_win.everything.locate())
+    assert len(records) == 5
+    record = records[0]
+    assert record.type == DIRECTORY
+    assert record.path == "E:"
+    assert record.date_modified is None
+
+    record = records[1]
+    assert record.type == DIRECTORY
+    assert record.path == "E:\\test"
+    assert record.date_modified == datetime(2024, 1, 27, 22, 6, 9, 597820, tzinfo=timezone.utc)
+
+
+def test_everything_1_7_17_ntfs_refs_efu_folder(target_win: Target, fs_win: VirtualFilesystem) -> None:
+    fs_win.map_file(
+        "\\Program Files\\Everything\\Everything.db",
+        absolute_path("_data/plugins/os/windows/everything/1.7.17/Everything_NTFS_REFS_EFU_FOLDER.db.gz"),
+        compression="gzip",
+    )
+    target_win.add_plugin(EverythingPlugin)
+
+    records = []
+    idx = 0
+    for idx, record in enumerate(target_win.everything.locate()):
+        if idx not in [0, 1]:
+            continue
+        records.append(record)
+
+    length = idx + 1
+    assert length == 127577
+
+    assert records[0].type == DIRECTORY
+    assert records[0].path == "C:\\$Recycle.Bin"
+    assert records[0].date_modified == datetime(2023, 12, 16, 9, 8, 42, 726189, tzinfo=timezone.utc)
+    assert records[0].date_created is None
+
+    assert records[1].type == DIRECTORY
+    assert records[1].path == "C:\\$WinREAgent"
+    assert records[1].date_modified == datetime(2024, 1, 26, 20, 49, 55, 41714, tzinfo=timezone.utc)
+
+
+@pytest.mark.parametrize(
+    "map_path",
+    [
+        "\\Program Files\\Everything\\Everything.db",
+        "\\Program Files\\Everything\\Everything.COMPNAME.USERNAME.db",
+        "\\Program Files (x86)\\Everything\\Everything.db",
+        "\\Users\\John\\AppData\\Local\\Everything\\Everything.db",
+        "\\Users\\John\\AppData\\Local\\Everything\\Everything.COMPNAME.John.db",
+    ],
+)
+def test_everything_path_mapper(target_win_users: Target, fs_win: VirtualFilesystem, map_path: str) -> None:
+    fs_win.map_file(
+        map_path,
+        absolute_path("_data/plugins/os/windows/everything/1.7.20/Everything_NTFS_ONLY.db.gz"),
+        compression="gzip",
+    )
+    assert EverythingPlugin(target_win_users).check_compatible() is None

dissect_target-3.23.2.dev14/tests/plugins/os/windows/test_everything.py

@@ -1,197 +0,0 @@
-from datetime import datetime, timezone
-
-import pytest
-
-from dissect.target.filesystem import VirtualFilesystem
-from dissect.target.plugins.os.windows.everything._plugin import EverythingPlugin
-from dissect.target.target import Target
-from tests._utils import absolute_path
-
-DIRECTORY = "directory"
-FILE = "file"
-
-
-def test_everything_1_7_20_ntfs_only(target_win: Target, fs_win: VirtualFilesystem) -> None:
-    fs_win.map_file(
-        "\\Program Files\\Everything\\Everything.db",
-        absolute_path("_data/plugins/os/windows/everything/1.7.20/Everything_NTFS_ONLY.db.gz"),
-        compression="gzip",
-    )
-    target_win.add_plugin(EverythingPlugin)
-
-    records = list(target_win.everything.locate())
-    assert len(records) == 126828
-
-    recycle_bin = records[0]
-    assert recycle_bin.type == DIRECTORY
-    assert recycle_bin.path == "C:\\$Recycle.Bin"
-    assert recycle_bin.date_modified == datetime(2023, 12, 16, 9, 8, 42, 726189, tzinfo=timezone.utc)
-
-    entry = records[-40000]
-    assert entry.type == FILE
-    assert entry.path == "C:\\Windows\\System32\\msidntld.dll"
-
-    assert entry.date_modified == datetime(2021, 5, 8, 8, 14, 34, 642525, tzinfo=timezone.utc)
-
-
-def test_everything_1_7_20_ntfs_and_folder(target_win: Target, fs_win: VirtualFilesystem) -> None:
-    fs_win.map_file(
-        "\\Program Files\\Everything\\Everything.db",
-        absolute_path("_data/plugins/os/windows/everything/1.7.20/Everything_NTFS_AND_FOLDER.db.gz"),
-        compression="gzip",
-    )
-    target_win.add_plugin(EverythingPlugin)
-
-    records = list(target_win.everything.locate())
-    assert len(records) == 127042
-    recycle_bin_c = records[0]
-    assert recycle_bin_c.type == DIRECTORY
-    assert recycle_bin_c.path == "C:\\$Recycle.Bin"
-    assert recycle_bin_c.date_modified == datetime(2023, 12, 16, 9, 8, 42, 726189, tzinfo=timezone.utc)
-
-    recycle_bin_e = records[1]
-    assert recycle_bin_e.type == DIRECTORY
-    assert recycle_bin_e.path == "E:\\$RECYCLE.BIN"
-    assert recycle_bin_e.date_modified == datetime(2024, 1, 27, 9, 54, 32, tzinfo=timezone.utc)
-
-    entry = records[94783]
-    assert entry.type == FILE
-    assert entry.path == "E:\\potato.txt"
-    assert entry.date_modified == datetime(2024, 1, 27, 9, 54, 32, tzinfo=timezone.utc)
-
-
-def test_everything_1_7_20_ntfs_and_refs(target_win: Target, fs_win: VirtualFilesystem) -> None:
-    fs_win.map_file(
-        "\\Program Files\\Everything\\Everything.db",
-        absolute_path("_data/plugins/os/windows/everything/1.7.20/Everything_NTFS_AND_REFS.db.gz"),
-        compression="gzip",
-    )
-    target_win.add_plugin(EverythingPlugin)
-
-    records = list(target_win.everything.locate())
-    assert len(records) == 127227
-    recycle_bin_c = records[0]
-    assert recycle_bin_c.type == DIRECTORY
-    assert recycle_bin_c.path == "C:\\$Recycle.Bin"
-    assert recycle_bin_c.date_modified == datetime(2023, 12, 16, 9, 8, 42, 726189, tzinfo=timezone.utc)
-
-    recycle_bin_e = records[1]
-    assert recycle_bin_e.type == DIRECTORY
-    assert recycle_bin_e.path == "E:\\$RECYCLE.BIN"
-    assert recycle_bin_e.date_modified == datetime(2024, 1, 27, 21, 37, 6, 675776, tzinfo=timezone.utc)
-
-    entry = records[94937]
-    assert entry.type == FILE
-    assert entry.path == "E:\\potato.txt"
-    assert entry.date_modified == datetime(2024, 1, 27, 21, 37, 13, 425810, tzinfo=timezone.utc)
-
-    entry = records[108011]
-    assert entry.type == FILE
-    assert entry.path == "E:\\test.txt"
-    assert entry.date_modified == datetime(2024, 1, 27, 21, 56, 57, 597593, tzinfo=timezone.utc)
-
-
-def test_everything_1_7_20_refs_with_disabled_ntfs(target_win: Target, fs_win: VirtualFilesystem) -> None:
-    # Just making sure that disabling a drive doesn't mess up parsing
-    fs_win.map_file(
-        "\\Program Files\\Everything\\Everything.db",
-        absolute_path("_data/plugins/os/windows/everything/1.7.20/Everything_REFS_WITH_DISABLED_NTFS.db.gz"),
-        compression="gzip",
-    )
-    target_win.add_plugin(EverythingPlugin)
-
-    records = list(target_win.everything.locate())
-    assert len(records) == 7
-    recycle_bin_e = records[0]
-    assert recycle_bin_e.type == DIRECTORY
-    assert recycle_bin_e.path == "E:\\$RECYCLE.BIN"
-    assert recycle_bin_e.date_modified == datetime(2024, 1, 27, 21, 37, 6, 675776, tzinfo=timezone.utc)
-
-    entry = records[5]
-    assert entry.type == FILE
-    assert entry.path == "E:\\potato.txt"
-    assert entry.date_modified == datetime(2024, 1, 27, 21, 37, 13, 425810, tzinfo=timezone.utc)
-
-
-def test_everything_1_7_20_refs_include_only(target_win: Target, fs_win: VirtualFilesystem) -> None:
-    # Just making sure that including specific subfolders doesn't mess up parsing
-    fs_win.map_file(
-        "\\Program Files\\Everything\\Everything.db",
-        absolute_path("_data/plugins/os/windows/everything/1.7.20/Everything_REFS_INCLUDE_ONLY.db.gz"),
-        compression="gzip",
-    )
-    target_win.add_plugin(EverythingPlugin)
-
-    records = list(target_win.everything.locate())
-    assert len(records) == 4
-    recycle_bin_e = records[0]
-    assert recycle_bin_e.type == DIRECTORY
-    assert recycle_bin_e.path == "E:\\test"
-    assert recycle_bin_e.date_modified == datetime(2024, 1, 27, 22, 6, 9, 597820, tzinfo=timezone.utc)
-
-    entry = records[3]
-    assert entry.type == FILE
-    assert entry.path == "E:\\test\\test.txt"
-    assert entry.date_modified == datetime(2024, 1, 27, 21, 56, 57, 597593, tzinfo=timezone.utc)
-
-
-def test_everything_1_7_20_efu(target_win: Target, fs_win: VirtualFilesystem) -> None:
-    fs_win.map_file(
-        "\\Program Files\\Everything\\Everything.db",
-        absolute_path("_data/plugins/os/windows/everything/1.7.20/Everything_FILE_LIST.db.gz"),
-        compression="gzip",
-    )
-    target_win.add_plugin(EverythingPlugin)
-
-    records = list(target_win.everything.locate())
-    assert len(records) == 5
-    entry = records[0]
-    assert entry.type == DIRECTORY
-    assert entry.path == "E:"
-    assert entry.date_modified is None
-
-    entry = records[1]
-    assert entry.type == DIRECTORY
-    assert entry.path == "E:\\test"
-    assert entry.date_modified == datetime(2024, 1, 27, 22, 6, 9, 597820, tzinfo=timezone.utc)
-
-
-def test_everything_1_7_17_ntfs_refs_efu_folder(target_win: Target, fs_win: VirtualFilesystem) -> None:
-    fs_win.map_file(
-        "\\Program Files\\Everything\\Everything.db",
-        absolute_path("_data/plugins/os/windows/everything/1.7.17/Everything_NTFS_REFS_EFU_FOLDER.db.gz"),
-        compression="gzip",
-    )
-    target_win.add_plugin(EverythingPlugin)
-
-    records = list(target_win.everything.locate())
-    assert len(records) == 127577
-    entry = records[0]
-    assert entry.type == DIRECTORY
-    assert entry.path == "C:\\$Recycle.Bin"
-    assert entry.date_modified == datetime(2023, 12, 16, 9, 8, 42, 726189, tzinfo=timezone.utc)
-    assert entry.date_created is None
-
-    entry = records[1]
-    assert entry.type == DIRECTORY
-    assert entry.path == "C:\\$WinREAgent"
-    assert entry.date_modified == datetime(2024, 1, 26, 20, 49, 55, 41714, tzinfo=timezone.utc)
-
-
-@pytest.mark.parametrize(
-    "map_path",
-    [
-        "\\Program Files\\Everything\\Everything.db",
-        "\\Program Files\\Everything\\Everything.COMPNAME.USERNAME.db",
-        "\\Program Files (x86)\\Everything\\Everything.db",
-        "\\Users\\John\\AppData\\Local\\Everything\\Everything.db",
-        "\\Users\\John\\AppData\\Local\\Everything\\Everything.COMPNAME.John.db",
-    ],
-)
-def test_everything_path_mapper(target_win_users: Target, fs_win: VirtualFilesystem, map_path: str) -> None:
-    fs_win.map_file(
-        map_path,
-        absolute_path("_data/plugins/os/windows/everything/1.7.20/Everything_NTFS_ONLY.db.gz"),
-        compression="gzip",
-    )
-    assert EverythingPlugin(target_win_users).check_compatible() is None