dissect.target 3.23.dev22__tar.gz → 3.23.dev24__tar.gz

{dissect_target-3.23.dev22 → dissect_target-3.23.dev24}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev22
+Version: 3.23.dev24
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.23.dev22 → dissect_target-3.23.dev24}/dissect/target/loader.py

@@ -222,6 +222,7 @@ register("remote", "RemoteLoader")
 register("mqtt", "MqttLoader")
 register("asdf", "AsdfLoader")
 register("tar", "TarLoader")
+register("zip", "ZipLoader")
 register("vmx", "VmxLoader")
 register("vmwarevm", "VmwarevmLoader")
 register("hyperv", "HyperVLoader")

dissect_target-3.23.dev24/dissect/target/loaders/acquire.py

@@ -0,0 +1,117 @@
+from __future__ import annotations
+
+import logging
+import re
+from typing import TYPE_CHECKING
+
+from dissect.target import filesystem
+from dissect.target.filesystems.tar import TarFilesystemDirectoryEntry, TarFilesystemEntry
+from dissect.target.helpers import fsutil, loaderutil
+from dissect.target.loaders.dir import find_and_map_dirs
+from dissect.target.loaders.tar import TarSubLoader
+from dissect.target.loaders.zip import ZipSubLoader
+
+if TYPE_CHECKING:
+    import tarfile as tf
+    import zipfile as zf
+
+    from dissect.target.target import Target
+
+
+log = logging.getLogger(__name__)
+
+FILESYSTEMS_ROOT = "fs"
+FILESYSTEMS_LEGACY_ROOT = "sysvol"
+
+ANON_FS_RE = re.compile(r"^fs[0-9]+$")
+
+
+class AcquireTarSubLoader(TarSubLoader):
+    """Loader for tar-based Acquire collections."""
+
+    @staticmethod
+    def detect(tarfile: tf.TarFile) -> bool:
+        for member in tarfile.getmembers():
+            if member.name.startswith(
+                (
+                    f"/{FILESYSTEMS_ROOT}/",
+                    f"{FILESYSTEMS_ROOT}/",
+                    f"/{FILESYSTEMS_LEGACY_ROOT}/",
+                    f"{FILESYSTEMS_LEGACY_ROOT}/",
+                )
+            ):
+                return True
+        return False
+
+    def map(self, target: Target) -> None:
+        volumes = {}
+
+        for member in self.tar.getmembers():
+            if member.name == ".":
+                continue
+
+            if member.name.startswith(("/fs/", "fs/")):
+                # Current acquire
+                parts = member.name.replace("fs/", "").split("/")
+                if parts[0] == "":
+                    parts.pop(0)
+            else:
+                # Legacy acquire
+                parts = member.name.lstrip("/").split("/")
+            volume_name = parts[0].lower()
+
+            # NOTE: older versions of acquire would write to "sysvol" instead of a driver letter
+            # Figuring out the sysvol from the drive letters is easier than the drive letter from "sysvol",
+            # so this was swapped in acquire 3.12. Now we map all volumes to a drive letter and let the
+            # Windows OS plugin figure out which is the sysvol
+            # For backwards compatibility we're forced to keep this check, and assume that "c:" is our sysvol
+            if volume_name == "sysvol":
+                volume_name = "c:"
+
+            if volume_name == "$fs$":
+                if len(parts) == 1:
+                    # The fs/$fs$ entry is ignored, only the directories below it are processed.
+                    continue
+                fs_name = parts[1]
+                if ANON_FS_RE.match(fs_name):
+                    parts.pop(0)
+                    volume_name = f"{volume_name}/{fs_name}"
+
+            if volume_name not in volumes:
+                vol = filesystem.VirtualFilesystem(case_sensitive=False)
+                vol.tar = self.tar
+                volumes[volume_name] = vol
+                target.filesystems.add(vol)
+
+            volume = volumes[volume_name]
+            mname = "/".join(parts[1:])
+
+            entry_cls = TarFilesystemDirectoryEntry if member.isdir() else TarFilesystemEntry
+            entry = entry_cls(volume, fsutil.normpath(mname), member)
+            volume.map_file_entry(entry.path, entry)
+
+        for vol_name, vol in volumes.items():
+            loaderutil.add_virtual_ntfs_filesystem(
+                target,
+                vol,
+                usnjrnl_path=[
+                    "$Extend/$Usnjrnl:$J",
+                    "$Extend/$Usnjrnl:J",  # Old versions of acquire used $Usnjrnl:J
+                ],
+            )
+
+            target.fs.mount(vol_name, vol)
+
+
+class AcquireZipSubLoader(ZipSubLoader):
+    """Loader for zip-based Acquire collections."""
+
+    @staticmethod
+    def detect(zipfile: zf.Path) -> bool:
+        return zipfile.joinpath(FILESYSTEMS_ROOT).exists() or zipfile.joinpath(FILESYSTEMS_LEGACY_ROOT).exists()
+
+    def map(self, target: Target) -> None:
+        path = self.zip
+        if path.joinpath(FILESYSTEMS_ROOT).exists():
+            path = path.joinpath(FILESYSTEMS_ROOT)
+        find_and_map_dirs(target, path)

{dissect_target-3.23.dev22 → dissect_target-3.23.dev24}/dissect/target/loaders/tar.py

@@ -1,7 +1,6 @@
 from __future__ import annotations
 
 import logging
-import re
 import tarfile as tf
 from io import BytesIO
 from typing import TYPE_CHECKING
@@ -57,8 +56,6 @@ TAR_MAGIC_COMP = (
 )
 TAR_MAGIC = (tf.GNU_MAGIC, tf.POSIX_MAGIC)
 
-ANON_FS_RE = re.compile(r"^fs[0-9]+$")
-
 WINDOWS_MEMBERS = (
     "windows/system32",
     "/windows/system32",
@@ -85,10 +82,7 @@ class TarSubLoader(SubLoader[tf.TarFile]):
 
 
 class GenericTarSubLoader(TarSubLoader):
-    """Generic tar sub loader.
-
-    Recognises acquire tar files and regular tar files. Attempts to map sysvol and c: volume names.
-    """
+    """Generic tar sub loader."""
 
     @staticmethod
     def detect(tarfile: tf.TarFile) -> bool:
@@ -108,52 +102,14 @@ class GenericTarSubLoader(TarSubLoader):
                     # Root filesystem was already added
                     volumes["/"].case_sensitive = False
 
-            if not member.name.startswith(("/fs/", "fs/", "/sysvol/", "sysvol/")):
-                # Not an acquire tar
-                if "/" not in volumes:
-                    vol = filesystem.VirtualFilesystem(case_sensitive=not windows_found)
-                    vol.tar = self.tar
-                    volumes["/"] = vol
-                    target.filesystems.add(vol)
-
-                volume = volumes["/"]
-                mname = member.name
-            else:
-                if member.name.startswith(("/fs/", "fs/")):
-                    # Current acquire
-                    parts = member.name.replace("fs/", "").split("/")
-                    if parts[0] == "":
-                        parts.pop(0)
-                else:
-                    # Legacy acquire
-                    parts = member.name.lstrip("/").split("/")
-                volume_name = parts[0].lower()
-
-                # NOTE: older versions of acquire would write to "sysvol" instead of a driver letter
-                # Figuring out the sysvol from the drive letters is easier than the drive letter from "sysvol",
-                # so this was swapped in acquire 3.12. Now we map all volumes to a drive letter and let the
-                # Windows OS plugin figure out which is the sysvol
-                # For backwards compatibility we're forced to keep this check, and assume that "c:" is our sysvol
-                if volume_name == "sysvol":
-                    volume_name = "c:"
-
-                if volume_name == "$fs$":
-                    if len(parts) == 1:
-                        # The fs/$fs$ entry is ignored, only the directories below it are processed.
-                        continue
-                    fs_name = parts[1]
-                    if ANON_FS_RE.match(fs_name):
-                        parts.pop(0)
-                        volume_name = f"{volume_name}/{fs_name}"
-
-                if volume_name not in volumes:
-                    vol = filesystem.VirtualFilesystem(case_sensitive=False)
-                    vol.tar = self.tar
-                    volumes[volume_name] = vol
-                    target.filesystems.add(vol)
-
-                volume = volumes[volume_name]
-                mname = "/".join(parts[1:])
+            if "/" not in volumes:
+                vol = filesystem.VirtualFilesystem(case_sensitive=not windows_found)
+                vol.tar = self.tar
+                volumes["/"] = vol
+                target.filesystems.add(vol)
+
+            volume = volumes["/"]
+            mname = member.name
 
             entry_cls = TarFilesystemDirectoryEntry if member.isdir() else TarFilesystemEntry
             entry = entry_cls(volume, fsutil.normpath(mname), member)
@@ -177,6 +133,7 @@ class TarLoader(Loader):
 
     __subloaders__ = (
         import_lazy("dissect.target.loaders.containerimage").ContainerImageTarSubLoader,
+        import_lazy("dissect.target.loaders.acquire").AcquireTarSubLoader,
         GenericTarSubLoader,  # should be last
     )
 

dissect_target-3.23.dev24/dissect/target/loaders/zip.py

@@ -0,0 +1,71 @@
+from __future__ import annotations
+
+import zipfile as zf
+from typing import TYPE_CHECKING
+
+from dissect.target.helpers.lazy import import_lazy
+from dissect.target.loader import Loader, SubLoader
+from dissect.target.loaders.dir import find_and_map_dirs
+
+if TYPE_CHECKING:
+    from pathlib import Path
+
+    from dissect.target import target
+
+
+ZIP_EXT = (".zip",)
+
+
+class ZipSubLoader(SubLoader[zf.Path]):
+    """Zip implementation of a :class:`SubLoader`."""
+
+    def __init__(self, zipfile: zf.Path, *args, **kwargs):
+        super().__init__(zipfile, *args, **kwargs)
+        self.zip = zipfile
+
+    @staticmethod
+    def detect(zipfile: zf.Path) -> bool:
+        """Only to be called internally by :class:`ZipLoader`."""
+        raise NotImplementedError
+
+    def map(self, target: target.Target) -> None:
+        """Only to be called internally by :class:`ZipLoader`."""
+        raise NotImplementedError
+
+
+class GenericZipSubLoader(ZipSubLoader):
+    """Generic zip sub loader."""
+
+    @staticmethod
+    def detect(zipfile: zf.Path) -> bool:
+        return True
+
+    def map(self, target: target.Target) -> None:
+        find_and_map_dirs(target, self.zip)
+
+
+class ZipLoader(Loader):
+    """Load zip files."""
+
+    __subloaders__ = (
+        import_lazy("dissect.target.loaders.acquire").AcquireZipSubLoader,
+        GenericZipSubLoader,  # should be last
+    )
+
+    def __init__(self, path: Path, **kwargs):
+        super().__init__(path, **kwargs)
+
+        self.fh = path.open("rb")
+        self.zip = zf.Path(self.fh)
+        self.subloader = None
+
+    @staticmethod
+    def detect(path: Path) -> bool:
+        return path.name.lower().endswith(ZIP_EXT)
+
+    def map(self, target: target.Target) -> None:
+        for candidate in self.__subloaders__:
+            if candidate.detect(self.zip):
+                self.subloader = candidate(self.zip)
+                self.subloader.map(target)
+                break

dissect_target-3.23.dev24/dissect/target/plugins/os/windows/everything/_plugin.py

@@ -0,0 +1,78 @@
+from collections.abc import Iterator
+from typing import ClassVar
+
+from dissect.target import Target
+from dissect.target.exceptions import UnsupportedPluginError
+from dissect.target.helpers.fsutil import TargetPath
+from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.plugin import Plugin, export
+from dissect.target.plugins.os.windows.everything.parser import (
+    EverythingDB,
+)
+
+EverythingRecord = TargetRecordDescriptor(
+    "windows/everything/record",
+    [
+        ("path", "path"),
+        ("filesize", "size"),
+        ("datetime", "date_created"),
+        ("datetime", "date_modified"),
+        ("datetime", "date_accessed"),
+        ("uint32", "attributes"),
+        ("string", "type"),
+        ("string", "source"),
+    ],
+)
+
+
+class EverythingPlugin(Plugin):
+    """Voidtools Everything database parser.
+
+    Extracts files and metadata from the Everything database, which is stored in a proprietary format.
+    """
+
+    __namespace__ = "everything"
+
+    PATH_GLOBS: ClassVar = [
+        "sysvol\\Program Files\\Everything\\Everything*.db",
+        "sysvol\\Program Files (x86)\\Everything\\Everything*.db",
+    ]
+    USER_PATH: ClassVar = "AppData\\Local\\Everything\\Everything*.db"
+
+    def __init__(self, target: Target):
+        super().__init__(target)
+        self.configs = []
+        for path_option in self.PATH_GLOBS:
+            self.configs.extend(self.target.fs.path().glob(path_option))
+
+        self.configs.extend(self.find_user_files())
+
+    def find_user_files(self) -> Iterator[TargetPath]:
+        for user_details in self.target.user_details.all_with_home():
+            yield from user_details.home_path.glob(self.USER_PATH)
+
+    def check_compatible(self) -> None:
+        if not self.configs:
+            raise UnsupportedPluginError("No everything.db files found")
+
+    @export(record=EverythingRecord)
+    def locate(self) -> Iterator[EverythingRecord]:
+        """Yield file and directory names from everything.db file."""
+        for path in self.configs:
+            try:
+                with self.target.fs.path(path).open() as fh:
+                    db = EverythingDB(fh)
+                    for item in db:
+                        yield EverythingRecord(
+                            path=item.file_path,
+                            size=item.size,
+                            date_created=item.date_created,
+                            date_modified=item.date_modified,
+                            date_accessed=item.date_accessed,
+                            attributes=item.attributes,
+                            type=item.file_type,
+                            source=path,
+                            _target=self.target,
+                        )
+            except (NotImplementedError, ValueError) as e:  # noqa: PERF203
+                self.target.log.warning("Invalid EverythingDB %s: %s", path, e)