dissect.target 3.23.2.dev28__tar.gz → 3.23.2.dev30__tar.gz

{dissect_target-3.23.2.dev28 → dissect_target-3.23.2.dev30}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.2.dev28
+Version: 3.23.2.dev30
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{dissect_target-3.23.2.dev28 → dissect_target-3.23.2.dev30}/dissect/target/plugins/os/unix/esxi/_os.py

@@ -102,6 +102,11 @@ class ESXiPlugin(UnixPlugin):
 
     @classmethod
     def detect(cls, target: Target) -> Filesystem | None:
+        # First handle 'simple' case where we have to deal with a live collection
+        for fs in target.filesystems:
+            if fs.path("/etc/vmware/esx.conf").exists():
+                return fs
+
         bootbanks = [
             fs for fs in target.filesystems if fs.path("boot.cfg").exists() and list(fs.path("/").glob("*.v00"))
         ]
@@ -113,6 +118,10 @@ class ESXiPlugin(UnixPlugin):
 
     @classmethod
     def create(cls, target: Target, sysvol: Filesystem) -> Self:
+        if sysvol.path("/etc/vmware/esx.conf").exists():
+            target.fs.mount("/", sysvol)
+            return cls(target)
+
         cfg = parse_boot_cfg(sysvol.path("boot.cfg").open("rt"))
 
         # Mount all the visor tars in individual filesystem layers
@@ -164,7 +173,8 @@ class ESXiPlugin(UnixPlugin):
     def version(self) -> str | None:
         boot_cfg = self.target.fs.path("/bootbank/boot.cfg")
         if not boot_cfg.exists():
-            return None
+            # Default to retrieve version, but without build number
+            return self._cfg("/resourceGroups/version")
 
         for line in boot_cfg.read_text().splitlines():
             if not line.startswith("build="):

{dissect_target-3.23.2.dev28 → dissect_target-3.23.2.dev30}/dissect/target/plugins/os/windows/recyclebin.py

@@ -23,7 +23,7 @@ RecycleBinRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
         ("path", "path"),
         ("filesize", "filesize"),
         ("path", "deleted_path"),
-        ("string", "source"),
+        ("path", "source"),
     ],
 )
 
@@ -80,12 +80,12 @@ class RecyclebinPlugin(Plugin):
           hostname (string): The target hostname
           domain (string): The target domain
           ts (datetime): The time of deletion
-          path (uri): The file original location before deletion
-          filesize (filesize): Filesize of the deleted file
-          sid (string): SID of the user deleted the file, parsed from $I filepath
+          path (path): The file original location before deletion
+          filesize (filesize): Filesize of the deleted path
+          deleted_path (path): Location of the deleted file after deletion $R file
+          source (path): Location of $I meta file on disk
+          user_id (string): SID of the user deleted the file, parsed from $I filepath
           user (string): Username matching SID, lookup using Dissect user plugin
-          deleted_path (uri): Location of the deleted file after deletion $R file
-          source (uri): Location of $I meta file on disk
         """
 
         for recyclebin in self.recyclebin_paths:
@@ -97,36 +97,54 @@ class RecyclebinPlugin(Plugin):
 
     def read_recycle_bin(self, bin_path: TargetPath) -> Iterator[RecycleBinRecord]:
         if self._is_recycle_file(bin_path):
-            yield self.read_bin_file(bin_path)
+            yield from self.read_bin_file(bin_path)
             return
 
         if bin_path.is_dir():
             for new_file in bin_path.iterdir():
                 yield from self.read_recycle_bin(new_file)
 
-    def read_bin_file(self, bin_path: TargetPath) -> RecycleBinRecord:
+    def read_bin_file(self, bin_path: TargetPath) -> Iterator[RecycleBinRecord]:
         data = bin_path.read_bytes()
 
         header = self.select_header(data)
         entry = header(data)
 
         sid = self.find_sid(bin_path)
-        source_path = str(bin_path).lstrip("/")
-        deleted_path = str(bin_path.parent / bin_path.name.replace("/$i", "/$r")).lstrip("/")
+        deleted_path = bin_path.parent / bin_path.name.replace("$I", "$R")
 
         user_details = self.target.user_details.find(sid=sid)
         user = user_details.user if user_details else None
 
-        return RecycleBinRecord(
-            ts=wintimestamp(entry.timestamp),
-            path=self.target.fs.path(entry.filename.rstrip("\x00")),
-            source=self.target.fs.path(source_path),
+        original_path = self.target.fs.path(entry.filename.rstrip("\x00"))
+        deleted_timestamp = wintimestamp(entry.timestamp)
+
+        # Yield the deleted entry from the metadata
+        yield RecycleBinRecord(
+            ts=deleted_timestamp,
+            path=original_path,
+            # This is the size of the all the deleted data
             filesize=entry.file_size,
-            deleted_path=self.target.fs.path(deleted_path),
+            deleted_path=deleted_path,
+            source=bin_path,
             _target=self.target,
             _user=user,
         )
 
+        if deleted_path.is_dir():
+            for path in deleted_path.rglob("*"):
+                # Yield all the path inside a deleted directory
+                yield RecycleBinRecord(
+                    ts=deleted_timestamp,
+                    path=original_path.joinpath(path.relative_to(deleted_path)),
+                    # The size of this deleted file
+                    filesize=path.stat().st_size,
+                    deleted_path=path,
+                    source=bin_path,
+                    _target=self.target,
+                    _user=user,
+                )
+
     def find_sid(self, path: TargetPath) -> str:
         parent_path = path.parent
         if parent_path.name.lower() == "$recycle.bin":

{dissect_target-3.23.2.dev28 → dissect_target-3.23.2.dev30}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.2.dev28
+Version: 3.23.2.dev30
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{dissect_target-3.23.2.dev28 → dissect_target-3.23.2.dev30}/tests/conftest.py

@@ -298,6 +298,13 @@ def fs_bsd() -> VirtualFilesystem:
     return fs
 
 
+@pytest.fixture
+def fs_esxi() -> VirtualFilesystem:
+    fs = VirtualFilesystem()
+    fs.map_file("/etc/vmware/esx.conf", absolute_path("_data/plugins/os/unix/esxi/_os/etc/vmware/esx.conf"))
+    return fs
+
+
 @pytest.fixture
 def fs_android() -> VirtualFilesystem:
     fs = VirtualFilesystem()

{dissect_target-3.23.2.dev28 → dissect_target-3.23.2.dev30}/tests/plugins/os/unix/esxi/test__os.py

@@ -1,7 +1,9 @@
 from unittest.mock import patch
 
 from dissect.target.filesystem import VirtualFilesystem
+from dissect.target.plugin import OperatingSystem
 from dissect.target.plugins.os.unix.esxi._os import (
+    ESXiPlugin,
     _create_local_fs,
     _decrypt_crypto_util,
     esxi_hash,
@@ -78,3 +80,15 @@ def test_hash_full() -> None:
 def test_hash_empty_key() -> None:
     h = esxi_hash(b"", 666)
     assert h == 8664614747486377173
+
+
+def test_esxi_os_detection(target_bare: Target, fs_esxi: VirtualFilesystem) -> None:
+    target_bare.filesystems.add(fs_esxi)
+    target_bare.apply()
+
+    assert ESXiPlugin.detect(target_bare)
+    assert isinstance(target_bare._os, ESXiPlugin)
+    assert target_bare.os == OperatingSystem.ESXI
+    assert target_bare.hostname == "localhost"
+    assert target_bare.version == "6.7.0"
+    assert target_bare.ips == ["192.168.56.101"]

{dissect_target-3.23.2.dev28 → dissect_target-3.23.2.dev30}/tests/plugins/os/windows/test_recyclebin.py

@@ -37,8 +37,11 @@ def test_read_recycle_bin(target_win: Target) -> None:
 
     mocked_file.is_file.return_value = True
     mocked_file.is_dir.return_value = False
-    with patch.object(RecyclebinPlugin, "read_bin_file") as mocked_bin_file:
-        assert [mocked_bin_file.return_value] == list(RecyclebinPlugin(target_win).read_recycle_bin(mocked_file))
+
+    test_file = Mock()
+    with patch.object(RecyclebinPlugin, "read_bin_file", return_value=[test_file]) as mocked_bin_file:
+        assert [test_file] == list(RecyclebinPlugin(target_win).read_recycle_bin(mocked_file))
+        mocked_bin_file.assert_called_once_with(mocked_file)
 
 
 def test_filtered_name(target_win: Target) -> None:
@@ -64,7 +67,7 @@ def test_read_recycle_bin_directory(target_win: Target) -> None:
 
     mocked_dir.iterdir.return_value = [mocked_file] * 3
 
-    with patch.object(RecyclebinPlugin, "read_bin_file", return_value=mocked_file):
+    with patch.object(RecyclebinPlugin, "read_bin_file", return_value=[mocked_file]):
         data = list(RecyclebinPlugin(target_win).read_recycle_bin(mocked_dir))
 
         assert data == [mocked_file] * 3
@@ -100,25 +103,55 @@ def test_read_bin_file_unknown(target_win: Target, path: str) -> None:
     with patch.object(Path, "open", mock_open(read_data=header_1.dumps())):
         normal_path = Path(path)
 
-        output = recycle_plugin.read_bin_file(normal_path)
+        output = next(recycle_plugin.read_bin_file(normal_path), None)
 
     assert output.filesize == 0x20
     assert output.path == "hello_world"
 
 
-def test_recyclebin_plugin_file(target_win: Target, recycle_bin: VirtualFilesystem) -> None:
+def test_reading_multiple_recyclebins(target_win: Target, recycle_bin: VirtualFilesystem) -> None:
     recycle_bin.map_file_fh("$ihello_world", io.BytesIO())
 
     target_win.fs.mount("C:\\$recycle.bin", recycle_bin)
     target_win.fs.mount("D:\\$recycle.bin", recycle_bin)
     target_win.add_plugin(RecyclebinPlugin)
 
-    with patch.object(RecyclebinPlugin, "read_bin_file") as mocked_bin_file:
+    bin_file = Mock()
+    with patch.object(RecyclebinPlugin, "read_bin_file", return_value=[bin_file]):
         recycle_bin_entries = list(target_win.recyclebin())
-        assert recycle_bin_entries == [mocked_bin_file.return_value, mocked_bin_file.return_value]
+        assert recycle_bin_entries == [bin_file] * 2
+
+
+def test_reading_deleted_directory_entries(target_win: Target, tmp_path: Path) -> None:
+    """Test whether a records gets created for all the entries within a deleted directory."""
+    filename = "c:\\path\\to\\hello_world\0"
+    header = c_recyclebin.header_v2(version=2, file_size=0, filename_length=len(filename), filename=filename)
+
+    tmp_path.joinpath("$Ihello_world").write_bytes(header.dumps())
+    tmp_path.joinpath("$Rhello_world").mkdir()
+    tmp_path.joinpath("$Rhello_world/data.txt").touch()
+
+    recycle_bin = VirtualFilesystem()
+    recycle_bin.map_dir("/", tmp_path)
+
+    target_win.fs.mount("C:\\$recycle.bin", recycle_bin)
+    target_win.add_plugin(RecyclebinPlugin)
+
+    path = target_win.fs.path(filename.strip("\0"))
+
+    records = list(target_win.recyclebin())
+    start_dir = records[0]
+    assert start_dir.path == filename.rstrip("\0")
+    assert start_dir.deleted_path == "\\c:\\$recycle.bin\\$Rhello_world"
+    assert start_dir.source == "\\c:\\$recycle.bin\\$Ihello_world"
+
+    file_dir = records[1]
+    assert file_dir.path == str(path.joinpath("data.txt"))
+    assert file_dir.deleted_path == "\\c:\\$recycle.bin\\$Rhello_world\\data.txt"
+    assert file_dir.source == "\\c:\\$recycle.bin\\$Ihello_world"
 
 
-def test_recyclebin_plugin_wrong_prefix(target_win: Target, recycle_bin: VirtualFilesystem) -> None:
+def test_recyclebin_wrong_prefix(target_win: Target, recycle_bin: VirtualFilesystem) -> None:
     recycle_bin.map_file_fh("hello_world", io.BytesIO())
     target_win.fs.mount("C:\\$recycle.bin", recycle_bin)
     target_win.add_plugin(RecyclebinPlugin)