dissect.target 3.23.dev30__tar.gz → 3.23.dev32__tar.gz

{dissect_target-3.23.dev30 → dissect_target-3.23.dev32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.23.dev30
+Version: 3.23.dev32
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License: Affero General Public License v3

{dissect_target-3.23.dev30 → dissect_target-3.23.dev32}/dissect/target/helpers/regutil.py

@@ -5,7 +5,6 @@ from __future__ import annotations
 import fnmatch
 import re
 from collections import defaultdict
-from enum import IntEnum
 from functools import cached_property
 from io import BytesIO
 from typing import TYPE_CHECKING, BinaryIO, NewType, TextIO, Union
@@ -17,6 +16,7 @@ from dissect.target.exceptions import (
     RegistryKeyNotFoundError,
     RegistryValueNotFoundError,
 )
+from dissect.target.helpers.utils import IntEnumMissing
 
 if TYPE_CHECKING:
     from collections.abc import Iterator
@@ -33,7 +33,7 @@ ValueType = Union[int, str, bytes, list[str], None]
 """The possible value types that can be returned from the registry."""
 
 
-class RegistryValueType(IntEnum):
+class RegistryValueType(IntEnumMissing):
     """Registry value types as defined in ``winnt.h``.
 
     Resources:
@@ -54,14 +54,6 @@ class RegistryValueType(IntEnum):
     RESOURCE_REQUIREMENTS_LIST = c_regf.REG_RESOURCE_REQUIREMENTS_LIST
     QWORD = c_regf.REG_QWORD
 
-    @classmethod
-    def _missing_(cls, value: int) -> IntEnum:
-        # Allow values other than defined members
-        member = int.__new__(cls, value)
-        member._name_ = None
-        member._value_ = value
-        return member
-
 
 class RegistryHive:
     """Base class for registry hives."""

{dissect_target-3.23.dev30 → dissect_target-3.23.dev32}/dissect/target/helpers/utils.py

@@ -4,7 +4,7 @@ import logging
 import re
 import urllib.parse
 from datetime import datetime, timezone, tzinfo
-from enum import Enum
+from enum import Enum, IntEnum
 from typing import TYPE_CHECKING, BinaryIO, TypeVar
 
 from dissect.util.ts import from_unix
@@ -53,6 +53,17 @@ class StrEnum(str, Enum):
     """Sortable and serializible string-based enum."""
 
 
+class IntEnumMissing(IntEnum):
+    """Integer-based enum that allows for values other than defined members."""
+
+    @classmethod
+    def _missing_(cls, value: int) -> IntEnum:
+        member = int.__new__(cls, value)
+        member._name_ = str(value)
+        member._value_ = value
+        return member
+
+
 def parse_path_uri(path: Path) -> tuple[str | None, str | None, str | None]:
     if path is None:
         return None, None, None

{dissect_target-3.23.dev30 → dissect_target-3.23.dev32}/dissect/target/plugins/apps/av/symantec.py

@@ -27,8 +27,8 @@ SEPLogRecord = TargetRecordDescriptor(
         ("path", "source_file"),
         ("string", "action_taken"),
         ("string", "virus_type"),
-        ("varint", "scan_id"),
-        ("varint", "quarantine_id"),
+        ("string", "scan_id"),
+        ("string", "quarantine_id"),
         ("varint", "virus_id"),
         ("varint", "depth"),
         ("boolean", "still_infected"),
@@ -312,7 +312,7 @@ class SymantecPlugin(Plugin):
             source_file (path): File that contains the virus.
             action_taken (string): Action taken by SEP.
             virus_type (string): Description of the type of virus.
-            scan_id (varint): ID of the scan associated with the event.
+            scan_id (string): ID of the scan associated with the event.
             event_data (string): String or bytes from a virus event.
             quarantine_id (varint): ID associated with the quarantined virus.
             still_infected (boolean): Whether the system is still infected.

{dissect_target-3.23.dev30 → dissect_target-3.23.dev32}/dissect/target/plugins/apps/browser/browser.py

@@ -19,7 +19,7 @@ GENERIC_DOWNLOAD_RECORD_FIELDS = [
     ("path", "path"),
     ("uri", "url"),
     ("filesize", "size"),
-    ("varint", "state"),
+    ("string", "state"),
     ("path", "source"),
 ]
 
@@ -27,7 +27,7 @@ GENERIC_EXTENSION_RECORD_FIELDS = [
     ("datetime", "ts_install"),
     ("datetime", "ts_update"),
     ("string", "browser"),
-    ("string", "id"),
+    ("string", "extension_id"),
     ("string", "name"),
     ("string", "short_name"),
     ("string", "default_title"),
@@ -58,14 +58,14 @@ GENERIC_COOKIE_FIELDS = [
 GENERIC_HISTORY_RECORD_FIELDS = [
     ("datetime", "ts"),
     ("string", "browser"),
-    ("string", "id"),
+    ("varint", "id"),
     ("uri", "url"),
     ("string", "title"),
     ("string", "description"),
     ("string", "rev_host"),
     ("varint", "visit_type"),
     ("varint", "visit_count"),
-    ("string", "hidden"),
+    ("boolean", "hidden"),
     ("string", "typed"),
     ("varint", "session"),
     ("varint", "from_visit"),

{dissect_target-3.23.dev30 → dissect_target-3.23.dev32}/dissect/target/plugins/apps/browser/chromium.py

@@ -71,6 +71,16 @@ struct GoogleChromeCipher {
 """
 c_elevation = cstruct(endian="<").load(elevation_def)
 
+# Resources:
+# - https://github.com/chromium/chromium/blob/main/components/download/public/common/download_item.h
+DOWNLOAD_STATES = {
+    0: "in_progress",
+    1: "complete",
+    2: "cancelled",
+    3: "interrupted",
+    4: "interrupted",  # Older versions of Chromium can have DownloadState value 4 as interrupted.
+}
+
 
 class ChromiumMixin:
     """Mixin class with methods for Chromium-based browsers."""
@@ -363,6 +373,10 @@ class ChromiumMixin:
                         url = download_chain[-1].url
                         url = try_idna(url)
 
+                    # https://github.com/chromium/chromium/blob/main/components/download/public/common/download_item.h
+                    if state := row.get("state"):
+                        state = DOWNLOAD_STATES.get(state)
+
                     yield self.BrowserDownloadRecord(
                         ts_start=webkittimestamp(row.start_time),
                         ts_end=webkittimestamp(row.end_time) if row.end_time else None,
@@ -374,7 +388,7 @@ class ChromiumMixin:
                         url=url,
                         size=row.get("total_bytes"),
                         mime_type=row.get("mime_type"),
-                        state=row.get("state"),
+                        state=state,
                         source=db_file,
                         _target=self.target,
                         _user=user.user,
@@ -453,7 +467,7 @@ class ChromiumMixin:
                             ts_install=ts_install,
                             ts_update=ts_update,
                             browser=browser_name,
-                            id=extension_id,
+                            extension_id=extension_id,
                             name=name,
                             short_name=short_name,
                             default_title=default_title,
@@ -643,7 +657,7 @@ class ChromiumMixin:
                         cipher = ChaCha20_Poly1305.new(key=key, nonce=data.iv)
 
                     else:
-                        raise ValueError("Unsupported ElevationService key flag {data.flag!r}")  # noqa: TRY301
+                        raise ValueError(f"Unsupported ElevationService key flag {data.flag!r}")  # noqa: TRY301
 
                     aes_key = cipher.decrypt_and_verify(data.ciphertext, data.mac_tag)
 

{dissect_target-3.23.dev30 → dissect_target-3.23.dev32}/dissect/target/plugins/apps/browser/firefox.py

@@ -403,7 +403,7 @@ class FirefoxPlugin(BrowserPlugin):
                         ts_install=from_unix_ms(extension.get("installDate", 0)),
                         ts_update=from_unix_ms(extension.get("updateDate", 0)),
                         browser="firefox",
-                        id=extension.get("id"),
+                        extension_id=extension.get("id"),
                         name=(extension.get("defaultLocale", {}) or {}).get("name"),
                         short_name=None,
                         default_title=None,

{dissect_target-3.23.dev30 → dissect_target-3.23.dev32}/dissect/target/plugins/apps/vpn/wireguard.py

@@ -24,8 +24,8 @@ WireGuardInterfaceRecord = TargetRecordDescriptor(
         ("string", "private_key"),
         ("varint", "listen_port"),
         ("string", "fw_mark"),
-        ("string", "dns"),
-        ("varint", "table"),
+        ("net.ipaddress[]", "dns"),
+        ("string", "table"),
         ("varint", "mtu"),
         ("string", "preup"),
         ("string", "postup"),
@@ -55,6 +55,7 @@ class WireGuardPlugin(Plugin):
     References:
         - https://manpages.debian.org/testing/wireguard-tools/wg.8.en.html#CONFIGURATION_FILE_FORMAT
         - https://github.com/pirate/wireguard-docs
+        - https://wiresock.net/documentation/wireguard/config.html
     """
 
     __namespace__ = "wireguard"
@@ -121,7 +122,7 @@ class WireGuardPlugin(Plugin):
                         listen_port=config_dict("ListenPort"),
                         private_key=config_dict("PrivateKey"),
                         fw_mark=config_dict("FwMark"),
-                        dns=config_dict("DNS"),
+                        dns=[ip.strip() for ip in config_dict("DNS").split(",")] if config_dict("DNS") else None,
                         table=config_dict("Table"),
                         mtu=config_dict("MTU"),
                         preup=config_dict("PreUp"),

{dissect_target-3.23.dev30 → dissect_target-3.23.dev32}/dissect/target/plugins/filesystem/ntfs/usnjrnl.py

@@ -17,7 +17,7 @@ UsnjrnlRecord = TargetRecordDescriptor(
     [
         ("datetime", "ts"),
         ("varint", "usn"),
-        ("string", "segment"),
+        ("string", "segment_id"),
         ("path", "path"),
         ("string", "reason"),
         ("uint32", "security_id"),
@@ -82,13 +82,13 @@ class UsnjrnlPlugin(Plugin):
                     segment = segment_reference(record.record.FileReferenceNumber)
                     yield UsnjrnlRecord(
                         ts=ts,
-                        segment=f"{segment}#{record.FileReferenceNumber.SequenceNumber}",
-                        path=self.target.fs.path(path),
                         usn=record.Usn,
+                        segment_id=f"{segment}#{record.FileReferenceNumber.SequenceNumber}",
+                        path=self.target.fs.path(path),
                         reason=str(record.Reason).replace("USN_REASON.", ""),
-                        attr=str(record.FileAttributes).replace("FILE_ATTRIBUTE.", ""),
-                        source=str(record.SourceInfo).replace("USN_SOURCE.", ""),
                         security_id=record.SecurityId,
+                        source=str(record.SourceInfo).replace("USN_SOURCE.", ""),
+                        attr=str(record.FileAttributes).replace("FILE_ATTRIBUTE.", ""),
                         major=record.MajorVersion,
                         minor=record.MinorVersion,
                         _target=target,

{dissect_target-3.23.dev30 → dissect_target-3.23.dev32}/dissect/target/plugins/os/unix/linux/sockets.py

@@ -18,7 +18,7 @@ if TYPE_CHECKING:
     from dissect.target.target import Target
 
 NetSocketRecord = TargetRecordDescriptor(
-    "linux/proc/sockets",
+    "linux/proc/socket/net",
     [
         ("string", "protocol"),
         ("uint32", "rx_queue"),
@@ -37,11 +37,11 @@ NetSocketRecord = TargetRecordDescriptor(
 )
 
 UnixSocketRecord = TargetRecordDescriptor(
-    "linux/proc/sockets",
+    "linux/proc/socket/unix",
     [
         ("string", "protocol"),
         ("uint32", "ref"),
-        ("string", "flags"),
+        ("string", "socket_flags"),
         ("string", "type"),
         ("string", "state"),
         ("uint32", "inode"),
@@ -50,17 +50,17 @@ UnixSocketRecord = TargetRecordDescriptor(
 )
 
 PacketSocketRecord = TargetRecordDescriptor(
-    "linux/proc/sockets",
+    "linux/proc/socket/packet",
     [
         ("string", "protocol"),
         ("string", "protocol_type"),
-        ("string", "sk"),
+        ("uint32", "socket_type"),
+        ("uint32", "sk"),
         ("uint32", "ref"),
-        ("uint32", "type"),
         ("uint32", "iface"),
         ("uint32", "r"),
         ("uint32", "rmem"),
-        ("uint32", "user"),
+        ("uint32", "uid"),
         ("string", "owner"),
         ("uint32", "inode"),
         ("uint32", "pid"),
@@ -93,14 +93,14 @@ class NetSocketPlugin(Plugin):
 
             hostname (string): The target hostname.
             domain (string): The target domain.
-            protocol (int): The captured protocol i.e. 0003 is ETH_P_ALL
-            protocol_type (str): The canonical name of the captured protocol.
-            sk (string): The socket number.
-            type (int): The integer type of the socket (packet).
+            protocol (str): packet.
+            protocol_type (str): The canonical name of the captured protocol i.e. ETH_P_ALL.
+            socket_type (int): The integer type of the socket (packet).
+            sk (int): The socket number.
             iface (int): The interface index of the socket.
             r (int): The number of bytes that have been received by the socket and are waiting to be processed.
             rmem (int): The size of the receive buffer for the socket.
-            user (int): The user ID of the process that created the socket.
+            uid (int): The user ID of the process that created the socket.
             inode (int): The inode associated to the socket.
             pid (int): The pid associated with this socket.
             name (string): The process name associated to this socket.
@@ -120,7 +120,7 @@ class NetSocketPlugin(Plugin):
             hostname (string): The target hostname.
             domain (string): The target domain.
             protocol (string): The protocol used by the socket.
-            flags (bytes): The flags associated with the socket.
+            socket_flags (bytes): The flags associated with the socket.
             type (string): The stream type of the socket.
             state (string): The state of the socket.
             inode (int): The inode associated to the socket.
@@ -210,7 +210,7 @@ class NetSocketPlugin(Plugin):
         return UnixSocketRecord(
             protocol=data.protocol_string,
             ref=data.ref,
-            flags=data.flags,
+            socket_flags=data.flags,
             type=data.stream_type_string,
             state=data.state_string,
             inode=data.inode,
@@ -222,13 +222,13 @@ class NetSocketPlugin(Plugin):
         return PacketSocketRecord(
             protocol=data.protocol_string,
             protocol_type=data.protocol_type,
+            socket_type=data.type,
             sk=data.sk,
             ref=data.ref,
-            type=data.type,
             iface=data.iface,
             r=data.r,
             rmem=data.rmem,
-            user=data.user,
+            uid=data.user,
             inode=data.inode,
             pid=data.pid,
             name=data.name,

{dissect_target-3.23.dev30 → dissect_target-3.23.dev32}/dissect/target/plugins/os/unix/log/journal.py

@@ -11,6 +11,7 @@ from dissect.util.compression import lz4
 
 from dissect.target.exceptions import UnsupportedPluginError
 from dissect.target.helpers.record import TargetRecordDescriptor
+from dissect.target.helpers.utils import IntEnumMissing
 from dissect.target.plugin import Plugin, export
 
 if TYPE_CHECKING:
@@ -28,7 +29,7 @@ JournalRecord = TargetRecordDescriptor(
         # User Journal fields
         ("string", "message"),
         ("string", "message_id"),
-        ("varint", "priority"),
+        ("string", "priority"),
         ("path", "code_file"),
         ("varint", "code_line"),
         ("string", "code_func"),
@@ -61,7 +62,7 @@ JournalRecord = TargetRecordDescriptor(
         ("string", "systemd_session"),
         ("string", "systemd_owner_uid"),
         ("string", "selinux_context"),
-        ("string", "boot_id"),
+        ("string", "kernel_boot_id"),
         ("string", "machine_id"),
         ("string", "systemd_invocation_id"),
         ("string", "transport"),
@@ -266,6 +267,23 @@ struct EntryArrayObject_Compact {
 c_journal = cstruct().load(journal_def)
 
 
+class JournalMessagePriority(IntEnumMissing):
+    """Journal message priority enum.
+
+    Resources:
+        - https://wiki.archlinux.org/title/Systemd/Journal
+    """
+
+    EMERG = 0
+    ALERT = 1
+    CRIT = 2
+    ERR = 3
+    WARNING = 4
+    NOTICE = 5
+    INFO = 6
+    DEBUG = 7
+
+
 def get_optional(value: str, to_type: Callable) -> Any | None:
     """Return the value if True, otherwise return None."""
 
@@ -441,11 +459,12 @@ class JournalPlugin(Plugin):
                 continue
 
             for entry in journal:
+                priority = int_or_none(entry.get("priority"))
                 yield JournalRecord(
                     ts=entry.get("ts"),
                     message=entry.get("message"),
                     message_id=entry.get("message_id"),
-                    priority=int_or_none(entry.get("priority")),
+                    priority=JournalMessagePriority(priority).name.lower() if priority else None,
                     code_file=get_optional(entry.get("code_file"), path_function),
                     code_line=int_or_none(entry.get("code_line")),
                     code_func=entry.get("code_func"),
@@ -477,7 +496,7 @@ class JournalPlugin(Plugin):
                     systemd_session=entry.get("systemd_session"),
                     systemd_owner_uid=entry.get("systemd_owner_uid"),
                     selinux_context=entry.get("selinux_context"),
-                    boot_id=entry.get("boot_id"),
+                    kernel_boot_id=entry.get("boot_id"),
                     machine_id=entry.get("machine_id"),
                     systemd_invocation_id=entry.get("systemd_invocation_id"),
                     transport=entry.get("transport"),

{dissect_target-3.23.dev30 → dissect_target-3.23.dev32}/dissect/target/plugins/os/windows/activitiescache.py

@@ -25,6 +25,7 @@ ActivitiesCacheRecord = create_extended_descriptor([UserRecordDescriptorExtensio
         ("datetime", "last_modified_on_client"),
         ("datetime", "original_last_modified_on_client"),
         ("datetime", "expiration_time"),
+        ("string", "activity_id"),
         ("string", "app_id"),
         ("string", "enterprise_id"),
         ("string", "app_activity_id"),
@@ -32,7 +33,7 @@ ActivitiesCacheRecord = create_extended_descriptor([UserRecordDescriptorExtensio
         ("string", "group"),
         ("uint32", "activity_type"),
         ("uint32", "activity_status"),
-        ("uint32", "priority"),
+        ("uint32", "activity_priority"),
         ("uint32", "match_id"),
         ("uint32", "etag"),
         ("string", "tag"),
@@ -40,10 +41,10 @@ ActivitiesCacheRecord = create_extended_descriptor([UserRecordDescriptorExtensio
         ("datetime", "created_in_cloud"),
         ("string", "platform_device_id"),
         ("string", "package_id_hash"),
-        ("bytes", "id"),
         ("string", "payload"),
         ("string", "original_payload"),
         ("string", "clipboard_payload"),
+        ("path", "source"),
     ],
 )
 
@@ -98,6 +99,7 @@ class ActivitiesCachePlugin(Plugin):
             last_modified_on_client (datetime): LastModifiedOnClient field.
             original_last_modified_on_client (datetime): OriginalLastModifiedOnClient field.
             expiration_time (datetime): ExpirationTime field.
+            activity_id (string): Id field in hex.
             app_id (string): AppId field, JSON string containing multiple types of app name definitions.
             enterprise_id (string): EnterpriseId field.
             app_activity_id (string): AppActivityId field.
@@ -105,7 +107,7 @@ class ActivitiesCachePlugin(Plugin):
             group (string): Group field.
             activity_type (int): ActivityType field.
             activity_status (int): ActivityStatus field.
-            priority (int): Priority field.
+            activity_priority (int): Priority field.
             match_id (int): MatchId field.
             etag (int): ETag field.
             tag (string): Tag field.
@@ -113,7 +115,6 @@ class ActivitiesCachePlugin(Plugin):
             created_in_cloud (datetime): CreatedInCloud field.
             platform_device_id (string): PlatformDeviceId field.
             package_id_hash (string): PackageIdHash field.
-            id (bytes): Id field.
             payload (string): Payload field. JSON string containing payload data, varies per type.
             original_payload (string): OriginalPayload field.
             clipboard_payload (string): ClipboardPayload field.
@@ -131,14 +132,15 @@ class ActivitiesCachePlugin(Plugin):
                         last_modified_on_client=mkts(r["[LastModifiedOnClient]"]),
                         original_last_modified_on_client=mkts(r["[OriginalLastModifiedOnClient]"]),
                         expiration_time=mkts(r["[ExpirationTime]"]),
+                        activity_id=r["[Id]"].hex(),
                         app_id=r["[AppId]"],
-                        enterprise_id=r["[EnterpriseId]"],
+                        enterprise_id=r["[EnterpriseId]"] or None,
                         app_activity_id=r["[AppActivityId]"],
-                        group_app_activity_id=r["[GroupAppActivityId]"],
+                        group_app_activity_id=r["[GroupAppActivityId]"] or None,
                         group=r["[Group]"],
                         activity_type=r["[ActivityType]"],
                         activity_status=r["[ActivityStatus]"],
-                        priority=r["[Priority]"],
+                        activity_priority=r["[Priority]"],
                         match_id=r["[MatchId]"],
                         etag=r["[ETag]"],
                         tag=r["[Tag]"],
@@ -146,10 +148,10 @@ class ActivitiesCachePlugin(Plugin):
                         created_in_cloud=r["[CreatedInCloud]"],
                         platform_device_id=r["[PlatformDeviceId]"],
                         package_id_hash=r["[PackageIdHash]"],
-                        id=r["[Id]"],
                         payload=r["[Payload]"],
                         original_payload=r["[OriginalPayload]"],
                         clipboard_payload=r["[ClipboardPayload]"],
+                        source=cache_file,
                         _target=self.target,
                         _user=user,
                     )

{dissect_target-3.23.dev30 → dissect_target-3.23.dev32}/dissect/target/plugins/os/windows/amcache.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 from datetime import datetime, timezone
+from enum import IntEnum
 from typing import TYPE_CHECKING
 
 from dissect.util.ts import wintimestamp
@@ -207,17 +208,31 @@ PcaGeneralAppcompatRecord = TargetRecordDescriptor(
     [
         ("datetime", "ts"),
         ("path", "path"),
-        ("varint", "type"),
+        ("string", "type"),
         ("string", "name"),
         ("string", "copyright"),
         ("string", "version"),
         ("string", "program_id"),
-        ("string", "exit_code"),
+        ("string", "exit_message"),
         ("path", "source"),
     ],
 )
 
 
+class PcaGeneralDbType(IntEnum):
+    """``PcaGeneralDb`` type enum.
+
+    Resource:
+        - https://www.sygnia.co/blog/new-windows-11-pca-artifact/
+    """
+
+    INSTALLER_FAILED = 0
+    DRIVER_BLOCKED = 1
+    ABNORMAL_PROCESS_EXIT = 2
+    PCA_RESOLVE_CALLED = 3
+    UNKNOWN = 4
+
+
 class AmcachePluginOldMixin:
     __namespace__ = "amcache"
 
@@ -680,17 +695,17 @@ class AmcachePlugin(AmcachePluginOldMixin, Plugin):
                     self.target.log.warning("Invalid line in %s, ignoring: %s", path.name, line)
                     continue
 
-                ts, type_, app_path, name, copyright, version, program_id, exit_code = parts
+                ts, type_, app_path, name, copyright, version, program_id, exit_message = parts
 
                 yield PcaGeneralAppcompatRecord(
                     ts=datetime.strptime(ts, "%Y-%m-%d %H:%M:%S.%f").replace(tzinfo=timezone.utc),
                     path=self.target.resolve(app_path),
-                    type=int(type_),
+                    type=PcaGeneralDbType(int(type_)).name,
                     name=name,
                     copyright=copyright,
                     version=version,
                     program_id=program_id,
-                    exit_code=exit_code,
+                    exit_message=exit_message,
                     source=path,
                     _target=self.target,
                 )

{dissect_target-3.23.dev30 → dissect_target-3.23.dev32}/dissect/target/plugins/os/windows/clfs.py

@@ -18,16 +18,16 @@ ClfsRecord = TargetRecordDescriptor(
     "filesystem/windows/clfs",
     [
         ("string", "stream_name"),
-        ("uint32", "stream_id"),
         ("string", "type"),
         ("string", "file_attributes"),
         ("uint32", "offset"),
         ("string", "container_name"),
-        ("uint32", "container_id"),
         ("uint32", "container_size"),
         ("uint32", "record_offset"),
         ("bytes", "record_data"),
         ("bytes", "block_data"),
+        ("uint32", "clfs_stream_id"),
+        ("uint32", "clfs_container_id"),
     ],
 )
 
@@ -107,15 +107,15 @@ class ClfsPlugin(Plugin):
                         for record_offset, record_data, block_data in trans.records():
                             yield ClfsRecord(
                                 stream_name=stream.name,
-                                stream_id=stream.id,
                                 type=stream.type,
                                 file_attributes=stream.file_attributes,
                                 offset=stream.offset,
                                 container_name=container_file.name,
-                                container_id=stream.lsn_base.Offset.ContainerId,
                                 container_size=blf_container.size,
                                 record_offset=record_offset,
                                 record_data=record_data,
                                 block_data=block_data,
+                                clfs_stream_id=stream.id,
+                                clfs_container_id=stream.lsn_base.Offset.ContainerId,
                                 _target=self.target,
                             )

{dissect_target-3.23.dev30 → dissect_target-3.23.dev32}/dissect/target/plugins/os/windows/defender/_plugin.py

@@ -196,8 +196,8 @@ class MicrosoftDefenderPlugin(Plugin):
             # These fields are present for all (currently known) quarantine entry types
             fields = {
                 "ts": entry.timestamp,
-                "quarantine_id": entry.quarantine_id,
-                "scan_id": entry.scan_id,
+                "quarantine_id": entry.quarantine_id.hex(),
+                "scan_id": entry.scan_id.hex(),
                 "threat_id": entry.threat_id,
                 "detection_name": entry.detection_name,
             }

{dissect_target-3.23.dev30 → dissect_target-3.23.dev32}/dissect/target/plugins/os/windows/defender/mplog.py

@@ -89,7 +89,7 @@ DefenderMPLogEMSRecord = TargetRecordDescriptor(
         ("varint", "pid"),
         ("string", "sigseq"),
         ("varint", "send_memory_scan_report"),
-        ("varint", "source"),
+        ("varint", "source_id"),
     ],
 )
 
@@ -249,7 +249,7 @@ DEFENDER_MPLOG_PATTERNS = [
                 pid:\s(?P<pid>\d*),\s
                 sigseq:\s(?P<sigseq>\w*),\s
                 sendMemoryScanReport:\s(?P<send_memory_scan_report>\d*),\s
-                source:\s(?P<source>\d*)
+                source:\s(?P<source_id>\d*)
             """,
             re.VERBOSE,
         ),

{dissect_target-3.23.dev30 → dissect_target-3.23.dev32}/dissect/target/plugins/os/windows/defender/quarantine.py

@@ -15,8 +15,8 @@ DefenderQuarantineRecord = TargetRecordDescriptor(
     "filesystem/windows/defender/quarantine",
     [
         ("datetime", "ts"),
-        ("bytes", "quarantine_id"),
-        ("bytes", "scan_id"),
+        ("string", "quarantine_id"),
+        ("string", "scan_id"),
         ("varint", "threat_id"),
         ("string", "detection_type"),
         ("string", "detection_name"),
@@ -27,8 +27,8 @@ DefenderFileQuarantineRecord = TargetRecordDescriptor(
     "filesystem/windows/defender/quarantine/file",
     [
         ("datetime", "ts"),
-        ("bytes", "quarantine_id"),
-        ("bytes", "scan_id"),
+        ("string", "quarantine_id"),
+        ("string", "scan_id"),
         ("varint", "threat_id"),
         ("string", "detection_type"),
         ("string", "detection_name"),