dissect.target 3.23.2.dev29__tar.gz → 3.23.2.dev32__tar.gz

dissect_target-3.23.2.dev32/.vscode/launch.json

@@ -0,0 +1,36 @@
+{
+    "configurations": [
+        {
+            "type": "debugpy",
+            "request": "launch",
+            "name": "target-query",
+            "module": "dissect.target.tools.query",
+            "args": [
+                "${input:target}",
+                "-f",
+                "${input:functions}"
+            ]
+        },
+        {
+            "type": "debugpy",
+            "request": "launch",
+            "name": "target-shell",
+            "module": "dissect.target.tools.shell",
+            "args": [
+                "${input:target}"
+            ]
+        }
+    ],
+    "inputs": [
+        {
+            "type": "promptString",
+            "id": "target",
+            "description": "Path to target file (e.g. /path/to/image.vmdk)"
+        },
+        {
+            "type": "promptString",
+            "id": "functions",
+            "description": "Comma separated target-query function names (e.g. hostname,users)"
+        },
+    ]
+}

{dissect_target-3.23.2.dev29 → dissect_target-3.23.2.dev32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.2.dev29
+Version: 3.23.2.dev32
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later
@@ -40,7 +40,7 @@ Requires-Dist: dissect.btrfs<2,>=1; extra == "full"
 Requires-Dist: dissect.cim<4,>=3; extra == "full"
 Requires-Dist: dissect.clfs<2,>=1; extra == "full"
 Requires-Dist: dissect.cramfs<2,>=1; extra == "full"
-Requires-Dist: dissect.esedb<4,>=3; extra == "full"
+Requires-Dist: dissect.esedb<4,>=3.17.dev1; extra == "full"
 Requires-Dist: dissect.etl<4,>=3; extra == "full"
 Requires-Dist: dissect.extfs<4,>=3; extra == "full"
 Requires-Dist: dissect.fat<4,>=3; extra == "full"

{dissect_target-3.23.2.dev29 → dissect_target-3.23.2.dev32}/dissect/target/plugins/os/windows/generic.py

@@ -578,8 +578,9 @@ class GenericPlugin(Plugin):
                 sid=f"S-1-5-21-{sid[0]}-{sid[1]}-{sid[2]}",
                 _target=self.target,
             )
-        except (RegistryError, struct.error):
-            self.target.log.exception("Cannot read machine SID from registry")
+        except (RegistryError, struct.error) as e:
+            self.target.log.error("Cannot read machine SID from registry")  # noqa: TRY400
+            self.target.log.debug("", exc_info=e)
             return None
 
     @export(record=ComputerSidRecord)

{dissect_target-3.23.2.dev29 → dissect_target-3.23.2.dev32}/dissect/target/plugins/os/windows/recyclebin.py

@@ -23,7 +23,7 @@ RecycleBinRecord = create_extended_descriptor([UserRecordDescriptorExtension])(
         ("path", "path"),
         ("filesize", "filesize"),
         ("path", "deleted_path"),
-        ("string", "source"),
+        ("path", "source"),
     ],
 )
 
@@ -80,12 +80,12 @@ class RecyclebinPlugin(Plugin):
           hostname (string): The target hostname
           domain (string): The target domain
           ts (datetime): The time of deletion
-          path (uri): The file original location before deletion
-          filesize (filesize): Filesize of the deleted file
-          sid (string): SID of the user deleted the file, parsed from $I filepath
+          path (path): The file original location before deletion
+          filesize (filesize): Filesize of the deleted path
+          deleted_path (path): Location of the deleted file after deletion $R file
+          source (path): Location of $I meta file on disk
+          user_id (string): SID of the user deleted the file, parsed from $I filepath
           user (string): Username matching SID, lookup using Dissect user plugin
-          deleted_path (uri): Location of the deleted file after deletion $R file
-          source (uri): Location of $I meta file on disk
         """
 
         for recyclebin in self.recyclebin_paths:
@@ -97,36 +97,54 @@ class RecyclebinPlugin(Plugin):
 
     def read_recycle_bin(self, bin_path: TargetPath) -> Iterator[RecycleBinRecord]:
         if self._is_recycle_file(bin_path):
-            yield self.read_bin_file(bin_path)
+            yield from self.read_bin_file(bin_path)
             return
 
         if bin_path.is_dir():
             for new_file in bin_path.iterdir():
                 yield from self.read_recycle_bin(new_file)
 
-    def read_bin_file(self, bin_path: TargetPath) -> RecycleBinRecord:
+    def read_bin_file(self, bin_path: TargetPath) -> Iterator[RecycleBinRecord]:
         data = bin_path.read_bytes()
 
         header = self.select_header(data)
         entry = header(data)
 
         sid = self.find_sid(bin_path)
-        source_path = str(bin_path).lstrip("/")
-        deleted_path = str(bin_path.parent / bin_path.name.replace("/$i", "/$r")).lstrip("/")
+        deleted_path = bin_path.parent / bin_path.name.replace("$I", "$R")
 
         user_details = self.target.user_details.find(sid=sid)
         user = user_details.user if user_details else None
 
-        return RecycleBinRecord(
-            ts=wintimestamp(entry.timestamp),
-            path=self.target.fs.path(entry.filename.rstrip("\x00")),
-            source=self.target.fs.path(source_path),
+        original_path = self.target.fs.path(entry.filename.rstrip("\x00"))
+        deleted_timestamp = wintimestamp(entry.timestamp)
+
+        # Yield the deleted entry from the metadata
+        yield RecycleBinRecord(
+            ts=deleted_timestamp,
+            path=original_path,
+            # This is the size of the all the deleted data
             filesize=entry.file_size,
-            deleted_path=self.target.fs.path(deleted_path),
+            deleted_path=deleted_path,
+            source=bin_path,
             _target=self.target,
             _user=user,
         )
 
+        if deleted_path.is_dir():
+            for path in deleted_path.rglob("*"):
+                # Yield all the path inside a deleted directory
+                yield RecycleBinRecord(
+                    ts=deleted_timestamp,
+                    path=original_path.joinpath(path.relative_to(deleted_path)),
+                    # The size of this deleted file
+                    filesize=path.stat().st_size,
+                    deleted_path=path,
+                    source=bin_path,
+                    _target=self.target,
+                    _user=user,
+                )
+
     def find_sid(self, path: TargetPath) -> str:
         parent_path = path.parent
         if parent_path.name.lower() == "$recycle.bin":

dissect_target-3.23.2.dev32/dissect/target/plugins/os/windows/search.py

@@ -0,0 +1,289 @@
+from __future__ import annotations
+
+import re
+import urllib.parse
+from typing import TYPE_CHECKING, Any, Union, get_args
+
+from dissect.esedb import EseDB
+from dissect.sql import SQLite3
+from dissect.util.ts import wintimestamp
+
+from dissect.target.exceptions import FilesystemError, UnsupportedPluginError
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, export
+from dissect.target.plugins.apps.browser.browser import BrowserHistoryRecord
+from dissect.target.plugins.apps.browser.edge import EdgePlugin
+from dissect.target.plugins.apps.browser.iexplore import InternetExplorerPlugin
+
+if TYPE_CHECKING:
+    from collections.abc import Iterator
+    from pathlib import Path
+
+    from dissect.esedb.record import Record as EseDBRecord
+    from dissect.esedb.table import Table as EseDBTable
+
+    from dissect.target.plugins.general.users import UserDetails
+    from dissect.target.target import Target
+
+SearchIndexRecord = TargetRecordDescriptor(
+    "windows/search/index/entry",
+    [
+        ("datetime", "ts"),
+        ("datetime", "ts_mtime"),
+        ("datetime", "ts_btime"),
+        ("datetime", "ts_atime"),
+        ("path", "path"),
+        ("string", "type"),
+        ("filesize", "size"),
+        ("string", "data"),
+        ("path", "source"),
+    ],
+)
+
+SearchIndexActivityRecord = TargetRecordDescriptor(
+    "windows/search/index/activity",
+    [
+        ("datetime", "ts_start"),
+        ("datetime", "ts_end"),
+        ("varint", "duration"),
+        ("string", "application_name"),
+        ("string", "application_id"),
+        ("string", "activity_id"),
+        ("path", "source"),
+    ],
+)
+
+RE_URL = re.compile(r"(?P<browser>.+)\:\/\/\{(?P<sid>.+)\}\/(?P<url>.+)$")
+
+BROWSER_RECORD_MAP = {
+    "iehistory": InternetExplorerPlugin.BrowserHistoryRecord,
+    "winrt": EdgePlugin.BrowserHistoryRecord,
+}
+
+SearchIndexRecords = Union[SearchIndexRecord, SearchIndexActivityRecord, BrowserHistoryRecord]  # noqa: UP007
+
+
+class SearchIndexPlugin(Plugin):
+    """Windows Search Index plugin."""
+
+    SYSTEM_PATHS = (
+        # Windows 11 22H2 (SQLite3)
+        "sysvol/ProgramData/Microsoft/Search/Data/Applications/Windows/Windows.db",
+        # Windows Vista and Windows 10 (EseDB)
+        "sysvol/ProgramData/Microsoft/Search/Data/Applications/Windows/Windows.edb",
+        # Windows XP (EseDB)
+        "sysvol/Documents and Settings/All Users/Application Data/Microsoft/Search/Data/Applications/Windows/Windows.edb",  # noqa: E501
+    )
+
+    USER_PATHS = (
+        # Windows 10 Server Roaming (EseDB / SQLite)
+        "AppData/Roaming/Microsoft/Search/Data/Applications/S-1-*/*.*db",
+    )
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self.databases = set(self.find_databases())
+
+    def find_databases(self) -> Iterator[tuple[Path, UserDetails | None]]:
+        seen = set()
+
+        for system_path in self.SYSTEM_PATHS:
+            if (path := self.target.fs.path(system_path)).is_file():
+                try:
+                    if any(seen_file.samefile(path) for seen_file in seen):
+                        continue
+                except FilesystemError:
+                    pass
+
+                seen.add(path)
+                yield path.resolve(), None
+
+        for user_details in self.target.user_details.all_with_home():
+            for user_path in self.USER_PATHS:
+                for path in user_details.home_path.glob(user_path):
+                    if not path.is_file():
+                        continue
+                    try:
+                        if any(seen_file.samefile(path) for seen_file in seen):
+                            continue
+                    except FilesystemError:
+                        pass
+
+                    seen.add(path)
+                    yield path.resolve(), user_details
+
+    def check_compatible(self) -> None:
+        if not self.databases:
+            raise UnsupportedPluginError("No Windows Search Index database files found on target")
+
+    @export(record=get_args(SearchIndexRecords))
+    def search(self) -> Iterator[SearchIndexRecords]:
+        """Yield Windows Search Index records.
+
+        Parses ``Windows.edb`` EseDB and ``Windows.db`` SQLite3 databases. Currently does not parse
+        ``GatherLogs/SystemIndex/SystemIndex.*.(Crwl|gthr)`` files or ``Windows-gather.db`` and ``Windows-usn.db`` files.
+
+        Windows Search is a standard component of Windows 7 and Windows Vista, and is enabled by default. The standard (non-Windows Server)
+        configuration of Windows Search indexes the following paths: ``C:\\Users\\*`` and ``C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\*``,
+        with some exceptions for certain file extensions (see the linked references for more information).
+
+        The difference between the fields ``System_Date*`` and ``System_Document_Date*`` should be researched further.
+        It is unclear what the field ``InvertedOnlyMD5`` is a checksum of (record or file content?). It might be possible
+        to correlate the field ``System_FileOwner`` with a ``UserRecordDescriptor``. The field ``System_FileAttributes`` should be
+        investigated further.
+
+        No test data available for indexed Outlook emails, this plugin might not be able to handle indexed email messages.
+
+        References:
+            - https://learn.microsoft.com/en-us/windows/win32/search/-search-3x-wds-overview
+            - https://github.com/libyal/esedb-kb/blob/main/documentation/Windows%20Search.asciidoc
+            - https://www.aon.com/en/insights/cyber-labs/windows-search-index-the-forensic-artifact-youve-been-searching-for
+            - https://github.com/strozfriedberg/sidr
+            - https://devblogs.microsoft.com/windows-search-platform/configuration-and-settings/
+            - https://learn.microsoft.com/en-us/windows/win32/search/-search-3x-wds-included-in-index
+        """  # noqa: E501
+
+        for db_path, user_details in self.databases:
+            if db_path.suffix == ".edb":
+                yield from self.parse_esedb(db_path, user_details)
+
+            elif db_path.suffix == ".db":
+                yield from self.parse_sqlite(db_path, user_details)
+
+            else:
+                self.target.log.warning("Unknown Windows Search Index database file %r", db_path)
+
+    def parse_esedb(self, path: Path, user_details: UserDetails | None) -> Iterator[SearchIndexRecords]:
+        """Parse the EseDB ``SystemIndex_PropertyStore`` table."""
+
+        with path.open("rb") as fh:
+            db = EseDB(fh)
+            table = db.table("SystemIndex_PropertyStore")
+
+            for record in table.records():
+                yield from self.build_record(TableRecord(table, record), user_details, path)
+
+    def parse_sqlite(self, path: Path, user_details: UserDetails | None) -> Iterator[SearchIndexRecords]:
+        """Parse the SQLite3 ``SystemIndex_1_PropertyStore`` table."""
+
+        with path.open("rb") as fh:
+            db = SQLite3(fh)
+
+            # ``ColumnId`` is translated using the ``SystemIndex_1_PropertyStore_Metadata`` table.
+            columns = {
+                row.get("Id"): row.get("UniqueKey", "").split("-", maxsplit=1)[-1]
+                for row in db.table("SystemIndex_1_PropertyStore_Metadata").rows()
+            }
+
+            if not (table := db.table("SystemIndex_1_PropertyStore")):
+                self.target.log.warning("Database %s does not have a table called 'SystemIndex_1_PropertyStore'", path)
+                return
+
+            current_work_id = None
+            values = {}
+
+            for row in table.rows():
+                work_id = row.get("WorkId")
+                if current_work_id is None:
+                    current_work_id = work_id
+                if work_id != current_work_id:
+                    yield from self.build_record(values, user_details, path)
+                    current_work_id = work_id
+                    values = {}
+
+                if value := row.get("Value"):
+                    column_name = columns[row.get("ColumnId")]
+                    values[column_name] = value
+
+            yield from self.build_record(values, user_details, path)
+
+    def build_record(
+        self, values: dict[str, Any] | TableRecord, user_details: UserDetails | None, db_path: Path
+    ) -> Iterator[SearchIndexRecords]:
+        """Build a ``SearchIndexRecord``, ``SearchIndexActivityRecord`` or ``HistoryRecord``."""
+
+        if values.get("System_ItemType") == "ActivityHistoryItem":
+            yield SearchIndexActivityRecord(
+                ts_start=wintimestamp(int.from_bytes(values.get("System_ActivityHistory_StartTime", b""), "little")),
+                ts_end=wintimestamp(int.from_bytes(values.get("System_ActivityHistory_EndTime", b""), "little")),
+                duration=int.from_bytes(values.get("System_ActivityHistory_ActiveDuration", b""), "little"),
+                application_name=values.get("System_Activity_AppDisplayName"),
+                application_id=values.get("System_ActivityHistory_AppId"),
+                activity_id=values.get("System_ActivityHistory_AppActivityId"),
+                source=db_path,
+                _target=self.target,
+            )
+
+        elif values.get("System_Search_Store") in ("iehistory", "winrt"):
+            system_itemurl = values.get("System_ItemUrl")
+
+            if not system_itemurl or not (match := RE_URL.match(system_itemurl)):
+                self.target.log.warning(
+                    "Unable to parse System_ItemUrl: %r (%r) in %s", system_itemurl, values, db_path
+                )
+                return
+
+            browser, sid, url = match.groupdict().values()
+
+            if not (CurrentBrowserHistoryRecord := BROWSER_RECORD_MAP.get(browser)):
+                self.target.log.warning(
+                    "Unable to determine browser history type for %r (%r) in %s", browser, system_itemurl, db_path
+                )
+                return
+
+            user = None
+            if sid and (sid_user_details := self.target.user_details.find(sid)):
+                user = sid_user_details.user
+
+            if not user and user_details:
+                user = user_details.user
+
+            url = values.get("System_Link_TargetUrl") or url
+            host = None
+
+            if url:
+                try:
+                    host = urllib.parse.urlparse(url).hostname
+                except Exception:
+                    pass
+
+            yield CurrentBrowserHistoryRecord(
+                ts=wintimestamp(int.from_bytes(values.get("System_Link_DateVisited", b""), "little")),
+                browser=browser,
+                url=url,
+                title=values.get("System_Title"),
+                host=host,
+                source=db_path,
+                _user=user,
+                _target=self.target,
+            )
+
+        # System_Search_Store = "file"
+        else:
+            yield SearchIndexRecord(
+                ts=wintimestamp(int.from_bytes(values.get("System_Search_GatherTime", b""), "little")),
+                ts_mtime=wintimestamp(int.from_bytes(values.get("System_DateModified", b""), "little")),
+                ts_btime=wintimestamp(int.from_bytes(values.get("System_DateCreated", b""), "little")),
+                ts_atime=wintimestamp(int.from_bytes(values.get("System_DateAccessed", b""), "little")),
+                path=values.get("System_ItemPathDisplay"),
+                type=values.get("System_MIMEType")
+                or values.get("System_ContentType")
+                or values.get("System_ItemTypeText"),
+                size=int.from_bytes(b_size, "little") if (b_size := values.get("System_Size")) else None,
+                data=values.get("System_Search_AutoSummary"),
+                source=db_path,
+                _target=self.target,
+            )
+
+
+class TableRecord:
+    def __init__(self, table: EseDBTable, record: EseDBRecord):
+        self.table = table
+        self.record = record
+
+        # Translates e.g. ``System_DateModified`` to ``15F-System_DateModified`` as these column name prefixes might
+        # be dynamic based on the system version.
+        self.columns = {col.split("-", maxsplit=1)[-1]: col for col in table.column_names}
+
+    def get(self, key: str, default: Any | None = None) -> Any:
+        return self.record.get(self.columns.get(key, default))

{dissect_target-3.23.2.dev29 → dissect_target-3.23.2.dev32}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.2.dev29
+Version: 3.23.2.dev32
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later
@@ -40,7 +40,7 @@ Requires-Dist: dissect.btrfs<2,>=1; extra == "full"
 Requires-Dist: dissect.cim<4,>=3; extra == "full"
 Requires-Dist: dissect.clfs<2,>=1; extra == "full"
 Requires-Dist: dissect.cramfs<2,>=1; extra == "full"
-Requires-Dist: dissect.esedb<4,>=3; extra == "full"
+Requires-Dist: dissect.esedb<4,>=3.17.dev1; extra == "full"
 Requires-Dist: dissect.etl<4,>=3; extra == "full"
 Requires-Dist: dissect.extfs<4,>=3; extra == "full"
 Requires-Dist: dissect.fat<4,>=3; extra == "full"

{dissect_target-3.23.2.dev29 → dissect_target-3.23.2.dev32}/dissect.target.egg-info/SOURCES.txt

@@ -5,6 +5,7 @@ MANIFEST.in
 README.md
 pyproject.toml
 tox.ini
+.vscode/launch.json
 dissect.target.egg-info/PKG-INFO
 dissect.target.egg-info/SOURCES.txt
 dissect.target.egg-info/dependency_links.txt
@@ -360,6 +361,7 @@ dissect/target/plugins/os/windows/productkey.py
 dissect/target/plugins/os/windows/rdpcache.py
 dissect/target/plugins/os/windows/recyclebin.py
 dissect/target/plugins/os/windows/registry.py
+dissect/target/plugins/os/windows/search.py
 dissect/target/plugins/os/windows/services.py
 dissect/target/plugins/os/windows/sru.py
 dissect/target/plugins/os/windows/startupinfo.py
@@ -740,6 +742,7 @@ tests/plugins/os/windows/test_productkey.py
 tests/plugins/os/windows/test_rdpcache.py
 tests/plugins/os/windows/test_recyclebin.py
 tests/plugins/os/windows/test_registry.py
+tests/plugins/os/windows/test_search.py
 tests/plugins/os/windows/test_shimcache.py
 tests/plugins/os/windows/test_sru.py
 tests/plugins/os/windows/test_syscache.py

{dissect_target-3.23.2.dev29 → dissect_target-3.23.2.dev32}/dissect.target.egg-info/requires.txt

@@ -54,7 +54,7 @@ dissect.btrfs<2,>=1
 dissect.cim<4,>=3
 dissect.clfs<2,>=1
 dissect.cramfs<2,>=1
-dissect.esedb<4,>=3
+dissect.esedb<4,>=3.17.dev1
 dissect.etl<4,>=3
 dissect.extfs<4,>=3
 dissect.fat<4,>=3

{dissect_target-3.23.2.dev29 → dissect_target-3.23.2.dev32}/pyproject.toml

@@ -53,7 +53,7 @@ full = [
     "dissect.cim>=3,<4",
     "dissect.clfs>=1,<2",
     "dissect.cramfs>=1,<2",
-    "dissect.esedb>=3,<4",
+    "dissect.esedb>=3.17.dev1,<4",  # TODO: update on release!
     "dissect.etl>=3,<4",
     "dissect.extfs>=3,<4",
     "dissect.fat>=3,<4",

{dissect_target-3.23.2.dev29 → dissect_target-3.23.2.dev32}/tests/plugins/os/windows/test_recyclebin.py

@@ -37,8 +37,11 @@ def test_read_recycle_bin(target_win: Target) -> None:
 
     mocked_file.is_file.return_value = True
     mocked_file.is_dir.return_value = False
-    with patch.object(RecyclebinPlugin, "read_bin_file") as mocked_bin_file:
-        assert [mocked_bin_file.return_value] == list(RecyclebinPlugin(target_win).read_recycle_bin(mocked_file))
+
+    test_file = Mock()
+    with patch.object(RecyclebinPlugin, "read_bin_file", return_value=[test_file]) as mocked_bin_file:
+        assert [test_file] == list(RecyclebinPlugin(target_win).read_recycle_bin(mocked_file))
+        mocked_bin_file.assert_called_once_with(mocked_file)
 
 
 def test_filtered_name(target_win: Target) -> None:
@@ -64,7 +67,7 @@ def test_read_recycle_bin_directory(target_win: Target) -> None:
 
     mocked_dir.iterdir.return_value = [mocked_file] * 3
 
-    with patch.object(RecyclebinPlugin, "read_bin_file", return_value=mocked_file):
+    with patch.object(RecyclebinPlugin, "read_bin_file", return_value=[mocked_file]):
         data = list(RecyclebinPlugin(target_win).read_recycle_bin(mocked_dir))
 
         assert data == [mocked_file] * 3
@@ -100,25 +103,55 @@ def test_read_bin_file_unknown(target_win: Target, path: str) -> None:
     with patch.object(Path, "open", mock_open(read_data=header_1.dumps())):
         normal_path = Path(path)
 
-        output = recycle_plugin.read_bin_file(normal_path)
+        output = next(recycle_plugin.read_bin_file(normal_path), None)
 
     assert output.filesize == 0x20
     assert output.path == "hello_world"
 
 
-def test_recyclebin_plugin_file(target_win: Target, recycle_bin: VirtualFilesystem) -> None:
+def test_reading_multiple_recyclebins(target_win: Target, recycle_bin: VirtualFilesystem) -> None:
     recycle_bin.map_file_fh("$ihello_world", io.BytesIO())
 
     target_win.fs.mount("C:\\$recycle.bin", recycle_bin)
     target_win.fs.mount("D:\\$recycle.bin", recycle_bin)
     target_win.add_plugin(RecyclebinPlugin)
 
-    with patch.object(RecyclebinPlugin, "read_bin_file") as mocked_bin_file:
+    bin_file = Mock()
+    with patch.object(RecyclebinPlugin, "read_bin_file", return_value=[bin_file]):
         recycle_bin_entries = list(target_win.recyclebin())
-        assert recycle_bin_entries == [mocked_bin_file.return_value, mocked_bin_file.return_value]
+        assert recycle_bin_entries == [bin_file] * 2
+
+
+def test_reading_deleted_directory_entries(target_win: Target, tmp_path: Path) -> None:
+    """Test whether a records gets created for all the entries within a deleted directory."""
+    filename = "c:\\path\\to\\hello_world\0"
+    header = c_recyclebin.header_v2(version=2, file_size=0, filename_length=len(filename), filename=filename)
+
+    tmp_path.joinpath("$Ihello_world").write_bytes(header.dumps())
+    tmp_path.joinpath("$Rhello_world").mkdir()
+    tmp_path.joinpath("$Rhello_world/data.txt").touch()
+
+    recycle_bin = VirtualFilesystem()
+    recycle_bin.map_dir("/", tmp_path)
+
+    target_win.fs.mount("C:\\$recycle.bin", recycle_bin)
+    target_win.add_plugin(RecyclebinPlugin)
+
+    path = target_win.fs.path(filename.strip("\0"))
+
+    records = list(target_win.recyclebin())
+    start_dir = records[0]
+    assert start_dir.path == filename.rstrip("\0")
+    assert start_dir.deleted_path == "\\c:\\$recycle.bin\\$Rhello_world"
+    assert start_dir.source == "\\c:\\$recycle.bin\\$Ihello_world"
+
+    file_dir = records[1]
+    assert file_dir.path == str(path.joinpath("data.txt"))
+    assert file_dir.deleted_path == "\\c:\\$recycle.bin\\$Rhello_world\\data.txt"
+    assert file_dir.source == "\\c:\\$recycle.bin\\$Ihello_world"
 
 
-def test_recyclebin_plugin_wrong_prefix(target_win: Target, recycle_bin: VirtualFilesystem) -> None:
+def test_recyclebin_wrong_prefix(target_win: Target, recycle_bin: VirtualFilesystem) -> None:
     recycle_bin.map_file_fh("hello_world", io.BytesIO())
     target_win.fs.mount("C:\\$recycle.bin", recycle_bin)
     target_win.add_plugin(RecyclebinPlugin)