dissect.target 3.25.dev20__tar.gz → 3.25.dev22__tar.gz

{dissect_target-3.25.dev20 → dissect_target-3.25.dev22}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev20
+Version: 3.25.dev22
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{dissect_target-3.25.dev20 → dissect_target-3.25.dev22}/dissect/target/plugins/os/unix/linux/fortios/_os.py

@@ -13,6 +13,7 @@ from dissect.util import cpio
 from dissect.util.compression import xz
 
 from dissect.target.filesystems.tar import TarFilesystem
+from dissect.target.helpers import keychain
 from dissect.target.helpers.fsutil import open_decompress
 from dissect.target.helpers.record import TargetRecordDescriptor, UnixUserRecord
 from dissect.target.plugin import OperatingSystem, export
@@ -117,9 +118,37 @@ class FortiOSPlugin(LinuxPlugin):
             try:
                 kernel_hash = get_kernel_hash(sysvol)
                 target.log.info("Kernel hash: %s", kernel_hash)
-                key = key_iv_for_kernel_hash(kernel_hash)
-                target.log.info("Trying to decrypt_rootfs using key: %r", key)
-                rfs_fh = decrypt_rootfs(rootfs.open(), key)
+
+                keys: list[ChaCha20Key | AesKey] = []
+
+                # Loads known key from built-in map
+                try:
+                    keys.append(key_iv_for_kernel_hash(kernel_hash))
+                except ValueError:
+                    target.log.warning("No known decryption key for kernel hash (%s)", kernel_hash)
+
+                # Load keys from keychain
+                keychain_keys = key_iv_from_keychain(target, kernel_hash=kernel_hash)
+                keys.extend(keychain_keys)
+                target.log.warning("Found %d key(s) in keychain", len(keychain_keys))
+
+                if not keys:
+                    raise ValueError("No decryption keys available")  # noqa: TRY301
+
+                # Try to decrypt with all available keys
+                rfs_fh = None
+                for key in keys:
+                    target.log.warning("Trying to decrypt_rootfs using key: %r", key)
+                    try:
+                        rfs_fh = decrypt_rootfs(rootfs.open(), key)
+                        break
+                    except ValueError:
+                        target.log.info("Decryption with key %r failed", key)
+                        continue
+
+                if not rfs_fh:
+                    raise ValueError("All decryption attempts failed")  # noqa: TRY301
+
                 target.log.info("Decrypted fh: %r", rfs_fh)
                 vfs = create_tar_filesystem(rfs_fh)
             except RuntimeError:
@@ -528,6 +557,50 @@ def key_iv_for_kernel_hash(kernel_hash: str) -> AesKey | ChaCha20Key:
     raise ValueError(f"No known decryption keys for kernel hash: {kernel_hash}")
 
 
+def key_iv_from_keychain(target: Target, kernel_hash: str) -> list[ChaCha20Key | AesKey]:
+    """Return list of ChaCha20Key and AesKey from keychain.
+
+    When using the ``--keychain-file`` option, the CSV format is:
+
+        provider,key_type,identifier,value
+        fortios-chacha20seed,recovery_key,<kernel_hash>,<chacha20_seed>
+        fortios-chacha20key,recovery_key,<kernel_hash>,<chacha20_key>:<chacha20_iv>
+        fortios-aeskey,recovery_key,<kernel_hash>,<aes_key>:<aes_iv>
+
+    When using the ``--keychain-value`` option, multiple keys are returned due to missing provider.
+
+    Args:
+        target: Target instance.
+        kernel_hash: SHA256 hash of the kernel file used to match key identifiers in the keychain.
+
+    Returns:
+        List of ChaCha20Key or AesKey.
+    """
+    keys: list[ChaCha20Key | AesKey] = []
+    keychain_keys = keychain.get_all_keys()
+
+    # We prioritize keys with matching identifier (kernel hash)
+    identifier_keys = [key for key in keychain_keys if key.identifier == kernel_hash]
+    other_keys = [key for key in keychain_keys if key.identifier is None]
+
+    for key in identifier_keys + other_keys:
+        if not isinstance(key.value, str):
+            continue
+        if key.provider in ("fortios-chacha20seed", None) and len(key.value) == 64:
+            # 32 bytes hex string
+            key_data, key_iv = _kdf_7_4_x(key.value)
+            keys.append(ChaCha20Key(key_data, key_iv))
+        elif key.provider in ("fortios-aeskey", None) and len(key.value) == 97 and ":" in key.value:
+            # 48 bytes hex string with colon separator
+            key_data, _, key_iv = key.value.partition(":")
+            keys.append(AesKey(key_data, key_iv))
+        elif key.provider in ("fortios-chacha20key", None) and len(key.value) == 97 and ":" in key.value:
+            # 48 bytes hex string with colon separator
+            key_data, _, key_iv = key.value.partition(":")
+            keys.append(ChaCha20Key(key_data, key_iv))
+    return keys
+
+
 def chacha20_decrypt(fh: BinaryIO, key: ChaCha20Key) -> bytes:
     """Decrypt file using ChaCha20 with given ChaCha20Key.
 
@@ -636,7 +709,8 @@ def decrypt_rootfs(fh: BinaryIO, key: ChaCha20Key | AesKey) -> BinaryIO:
         result = chacha20_decrypt(fh, key)
     elif isinstance(key, AesKey):
         result = aes_decrypt(fh, key)
-        result = result[:-256]  # strip off the 256 byte footer
+        if len(result) > 256:
+            result = result[:-256]  # strip off the 256 byte footer
 
     if result[0:2] != b"\x1f\x8b":
         raise ValueError("Failed to decrypt: No gzip magic header found.")

{dissect_target-3.25.dev20 → dissect_target-3.25.dev22}/dissect/target/target.py

@@ -269,7 +269,7 @@ class Target:
         return target_name
 
     @classmethod
-    def open(cls, path: str | Path) -> Self:
+    def open(cls, path: str | Path, *, apply: bool = True) -> Self:
         """Try to find a suitable loader for the given path and load a ``Target`` from it.
 
         Args:
@@ -307,20 +307,22 @@ class Target:
         except Exception as e:
             raise TargetError(f"Failed to initiate {loader_cls.__name__} for target {spec}: {e}") from e
 
-        return cls._load(spec, loader_instance)
+        return cls._load(spec, loader_instance, apply=apply)
 
     @classmethod
-    def open_raw(cls, path: str | Path) -> Self:
+    def open_raw(cls, path: str | Path, *, apply: bool = True) -> Self:
         """Open a Target with the given path using the :class:`~dissect.target.loaders.raw.RawLoader`.
 
         Args:
             path: Path to load the ``Target`` from.
         """
         adjusted_path = Path(path) if not isinstance(path, os.PathLike) else path
-        return cls._load(path, loader.RawLoader(adjusted_path))
+        return cls._load(path, loader.RawLoader(adjusted_path), apply=apply)
 
     @classmethod
-    def open_all(cls, paths: str | Path | list[str | Path], include_children: bool = False) -> Iterator[Self]:
+    def open_all(
+        cls, paths: str | Path | list[str | Path], include_children: bool = False, *, apply: bool = True
+    ) -> Iterator[Self]:
         """Yield all targets from one or more paths or directories.
 
         If the path is a directory, iterate files one directory deep.
@@ -336,7 +338,7 @@ class Target:
             TargetError: Raised when not a single ``Target`` can be loaded.
         """
 
-        def _open_all(spec: str | Path, include_children: bool = False) -> Iterator[Target]:
+        def _open_all(spec: str | Path, include_children: bool = False, *, apply: bool = True) -> Iterator[Target]:
             # If the path is a URI-like string, separate the path component
             adjusted_path, parsed_path = parse_path_uri(spec)
             # We always need a path to work with, so convert the spec into one if it's not one already
@@ -390,7 +392,9 @@ class Target:
                     # load_spec is the original "spec"
                     # For URI-like paths it's the full original URI
                     # For file/dir-like paths it's a Path object
-                    target = cls._load(load_spec, ldr)
+                    # If include_children is True, we override the apply parameter so we can find child targets
+                    # The apply parameter will then be used on the children
+                    target = cls._load(load_spec, ldr, apply=include_children or apply)
                 except Exception as e:
                     get_target_logger(load_spec).error("Failed to load target with loader %s", ldr)
                     get_target_logger(load_spec).debug("", exc_info=e)
@@ -400,7 +404,7 @@ class Target:
 
                 if include_children:
                     try:
-                        yield from target.open_children()
+                        yield from target.open_children(apply=apply)
                     except Exception as e:
                         get_target_logger(load_spec).error("Failed to load child target from %s", target, exc_info=e)
 
@@ -413,7 +417,7 @@ class Target:
         for spec in paths:
             loaded = False
 
-            for target in _open_all(spec, include_children=include_children):
+            for target in _open_all(spec, include_children=include_children, apply=apply):
                 loaded = True
                 at_least_one_loaded = True
                 yield target
@@ -434,7 +438,7 @@ class Target:
 
                 if path.is_dir():
                     for entry in path.iterdir():
-                        for target in _open_all(entry, include_children=include_children):
+                        for target in _open_all(entry, include_children=include_children, apply=apply):
                             at_least_one_loaded = True
                             yield target
 
@@ -492,7 +496,7 @@ class Target:
                 )
                 self.log.debug("", exc_info=e)
 
-    def open_child(self, child: int | str | Path) -> Target:
+    def open_child(self, child: int | str | Path, *, apply: bool = True) -> Target:
         """Open a child target.
 
         Allows opening a nested child target by path, index or child pattern.
@@ -516,7 +520,7 @@ class Target:
             for child_idx in map(int, str(child).split(".")):
                 for _, child in current_target.list_children():
                     if child_idx == 0:
-                        current_target = Target.open(current_target.fs.path(child.path))
+                        current_target = Target.open(current_target.fs.path(child.path), apply=apply)
                         break
                     child_idx -= 1
                 else:
@@ -525,9 +529,9 @@ class Target:
             return current_target
 
         # Open child by path
-        return Target.open(self.fs.path(child))
+        return Target.open(self.fs.path(child), apply=apply)
 
-    def open_children(self, recursive: bool = False) -> Iterator[Target]:
+    def open_children(self, recursive: bool = False, *, apply: bool = True) -> Iterator[Target]:
         """Open all the child targets on a ``Target``.
 
         Will open all discovered child targets if the current ``Target`` has them, such as VMs on a hypervisor.
@@ -540,7 +544,7 @@ class Target:
         """
         for _, child in self.list_children():
             try:
-                target = self.open_child(child.path)
+                target = self.open_child(child.path, apply=apply)
             except TargetError:
                 self.log.exception("Failed to open child target %s", child)
                 continue
@@ -548,7 +552,7 @@ class Target:
             yield target
 
             if recursive:
-                yield from target.open_children(recursive=recursive)
+                yield from target.open_children(recursive=recursive, apply=apply)
 
     def list_children(self, recursive: bool = False) -> Iterator[tuple[str, ChildTargetRecord]]:
         """Lists all discovered child targets."""
@@ -569,7 +573,7 @@ class Target:
 
                 idx += 1
 
-    def reload(self) -> Target:
+    def reload(self, *, apply: bool = True) -> Target:
         """Reload the current target.
 
         Using the loader with which the target was originally loaded,
@@ -584,12 +588,12 @@ class Target:
         """
 
         if self._loader and self.path:
-            return self._load(self.path, self._loader)
+            return self._load(self.path, self._loader, apply=apply)
 
         raise TargetError("Target has no path and/or loader")
 
     @classmethod
-    def _load(cls, path: str | Path | None, ldr: loader.Loader) -> Self:
+    def _load(cls, path: str | Path | None, ldr: loader.Loader, *, apply: bool = True) -> Self:
         """Internal function that attemps to load a path using a given loader.
 
         Args:
@@ -607,7 +611,9 @@ class Target:
         try:
             ldr.map(target)
             target._loader = ldr
-            target.apply()
+
+            if apply:
+                target.apply()
         except Exception as e:
             raise TargetError(f"Failed to load target: {path}") from e
         else:
@@ -893,6 +899,7 @@ class Collection(Generic[T]):
 
 class DiskCollection(Collection[container.Container]):
     def apply(self) -> None:
+        """Identify (basic) volume systems on all disks and add their volumes to the volume collection."""
         for disk in self.entries:
             # Some LVM configurations (i.e. RAID with the metadata at the end of the disk)
             # may be misidentified as having a valid MBR/GPT on some of the disks
@@ -921,7 +928,13 @@ class DiskCollection(Collection[container.Container]):
 
 
 class VolumeCollection(Collection[volume.Volume]):
-    def apply(self) -> None:
+    def apply(self, *, filesystems: bool = True) -> None:
+        """Identify logical and encrypted volumes on all volumes and add their volumes to the volume collection.
+        Additionally, identify filesystems on all volumes and add them to the filesystem collection.
+
+        Args:
+            filesystems: Whether to identify filesystems on the volumes.
+        """
         # We don't want later additions to modify the todo, so make a copy
         todo = self.entries[:]
         fs_volumes = []
@@ -988,6 +1001,10 @@ class VolumeCollection(Collection[volume.Volume]):
 
             todo = new_volumes
 
+        if not filesystems:
+            # Skip filesystem identification
+            return
+
         mv_fs_volumes = []
         for vol in fs_volumes:
             try:

dissect_target-3.25.dev22/dissect/target/tools/inspect.py

@@ -0,0 +1,235 @@
+#!/usr/bin/env python
+from __future__ import annotations
+
+import argparse
+import logging
+import textwrap
+from pathlib import Path
+from typing import TYPE_CHECKING, Any
+
+from dissect.cstruct.utils import hexdump
+
+from dissect.target.containers.hdd import HddContainer
+from dissect.target.exceptions import TargetError
+from dissect.target.helpers.logging import get_logger
+from dissect.target.plugin import arg
+from dissect.target.tools.shell import python_shell
+from dissect.target.tools.utils.cli import (
+    catch_sigpipe,
+    configure_generic_arguments,
+    open_target,
+    process_generic_arguments,
+)
+
+if TYPE_CHECKING:
+    from collections.abc import Callable, Iterator
+
+    from dissect.target.container import Container
+    from dissect.target.filesystem import Filesystem
+    from dissect.target.target import DiskCollection, FilesystemCollection, Target, VolumeCollection
+    from dissect.target.volume import Volume
+
+log = get_logger(__name__)
+logging.lastResort = None
+logging.raiseExceptions = False
+
+
+def indent(value: str, width: int = 1) -> None:
+    """Indent and print value"""
+    print(textwrap.indent(str(value), " " * (width * 4)))
+
+
+def scope(*args, **kwargs) -> Callable[..., Any]:
+    def decorator(obj: Callable[..., Any]) -> Callable[..., Any]:
+        obj.__scope__ = args
+        return obj
+
+    return decorator
+
+
+def _apply_scope(t: Target, scope: str) -> None:
+    if scope == "disk":
+        log.info("Only loading disks")
+        return
+
+    if scope == "volume":
+        log.info("Only loading disks and volumes")
+        t.disks.apply()
+        t.volumes.apply(filesystems=False)
+        return
+
+    if scope == "filesystem":
+        log.info("Only loading disks, volumes and filesystems")
+        t.disks.apply()
+        t.volumes.apply()
+        t.filesystems.apply()
+        return
+
+    raise ValueError(f"Unknown scope: {scope}")
+
+
+def _get_scope(t: Target, scope: str) -> DiskCollection | VolumeCollection | FilesystemCollection:
+    if scope == "disk":
+        return t.disks
+    if scope == "volume":
+        return t.volumes
+    if scope == "filesystem":
+        return t.filesystems
+
+    raise ValueError(f"Unknown scope: {scope}")
+
+
+def _get_obj(t: Target, args: argparse.Namespace) -> Iterator[Container | Volume | Filesystem]:
+    entries = _get_scope(t, args.scope)
+
+    if args.index is None:
+        yield from entries
+    elif args.index >= len(entries):
+        raise IndexError(f"{args.scope.capitalize()} index {args.index} out of range (max {len(entries) - 1})")
+    else:
+        yield entries[args.index]
+
+
+@scope("disk", "volume")
+@arg("-s", "--skip", type=int, default=0, help="skip offset bytes from the beginning")
+@arg("-n", "--length", type=int, default=512, help="number of bytes to read")
+def cmd_hexdump(t: Target, args: argparse.Namespace) -> None:
+    """hexdump some bytes"""
+    for obj in _get_obj(t, args):
+        print(f"# {obj}")
+
+        obj.seek(args.skip)
+        hexdump(obj.read(args.length), offset=args.skip)
+
+        print()
+
+
+def _info_hdd(obj: HddContainer) -> None:
+    print(f"path={obj.hdd.path}")
+    print()
+
+    print("# Storage data")
+    for storage in obj.hdd.descriptor.storage_data.storages:
+        print(f"start={storage.start} end={storage.end}")
+        for image in storage.images:
+            indent(f"guid={image.guid}")
+            indent(f"file={image.file}")
+            indent(f"type={image.type}")
+            print()
+
+    print("# Snapshots")
+    print(f"top_guid={obj.hdd.descriptor.snapshots.top_guid}")
+    for shot in obj.hdd.descriptor.snapshots.shots:
+        indent(f"guid={shot.guid}")
+        indent(f"parent={shot.parent}")
+        print()
+
+    print("# Stream info")
+    for storage, hds in obj.stream.streams:
+        print(f"start={storage.start} end={storage.end}")
+        i = 1
+        while hds.parent is not None:
+            indent(hds.fh, i)
+            i += 1
+            hds = hds.parent
+
+
+@scope("disk", "volume")
+def cmd_info(t: Target, args: argparse.Namespace) -> None:
+    """print information"""
+    for obj in _get_obj(t, args):
+        print(f"# {obj}")
+
+        if isinstance(obj, HddContainer):
+            _info_hdd(obj)
+
+
+@scope("disk", "volume", "filesystem")
+def cmd_list(t: Target, args: argparse.Namespace) -> None:
+    """list available items"""
+    entries = _get_scope(t, args.scope)
+
+    print(f"{args.scope.capitalize()}s:")
+    for i, entry in enumerate(entries):
+        print(f"[{i}]: {entry}")
+
+
+@scope("disk", "volume", "filesystem")
+def cmd_shell(t: Target, args: argparse.Namespace) -> None:
+    """open (I)Python shell"""
+    try:
+        python_shell([t])
+    except TargetError as e:
+        log.error("Error opening shell: %s", e)  # noqa: TRY400
+        log.debug("", exc_info=e)
+
+
+def _add_cmds(parser: argparse.ArgumentParser, scope: str) -> None:
+    sub = parser.add_subparsers(dest="cmd", required=False, help="available commands")
+
+    for name, obj in globals().items():
+        if not name.startswith("cmd_") or not callable(obj) or scope not in getattr(obj, "__scope__", ()):
+            continue
+
+        cmd_parser = argparse.ArgumentParser(add_help=False)
+        cmd_parser.add_argument(
+            "-i", "--index", type=int, default=None, help="index of the item to inspect", metavar="INDEX"
+        )
+        for args, kwargs in getattr(obj, "__args__", []):
+            cmd_parser.add_argument(*args, **kwargs)
+        cmd_parser.set_defaults(handler=obj)
+
+        sub.add_parser(name[4:], help=obj.__doc__, parents=[cmd_parser])
+
+
+@catch_sigpipe
+def main() -> int:
+    help_formatter = argparse.ArgumentDefaultsHelpFormatter
+    parser = argparse.ArgumentParser(
+        description="dissect.target",
+        fromfile_prefix_chars="@",
+        formatter_class=help_formatter,
+    )
+    scope = parser.add_subparsers(dest="scope", required=True, help="scope to inspect")
+
+    base = argparse.ArgumentParser(add_help=False)
+    base.add_argument("target", type=Path, help="Target to load", metavar="TARGET")
+    configure_generic_arguments(base)
+
+    parser_disk = scope.add_parser("disk", help="inspect disks", parents=[base])
+    _add_cmds(parser_disk, "disk")
+
+    parser_volume = scope.add_parser("volume", help="inspect volumes", parents=[base])
+    _add_cmds(parser_volume, "volume")
+
+    parser_filesystem = scope.add_parser("filesystem", help="inspect filesystems", parents=[base])
+    _add_cmds(parser_filesystem, "filesystem")
+
+    args, _ = parser.parse_known_args()
+    process_generic_arguments(parser, args)
+
+    try:
+        t = open_target(args, apply=False)
+    except TargetError as e:
+        log.error(e)  # noqa: TRY400
+        log.debug("", exc_info=e)
+        return 1
+
+    _apply_scope(t, args.scope)
+
+    if args.index is not None and args.index >= len(_get_scope(t, args.scope)):
+        print(f"{args.scope.capitalize()} index {args.index} out of range")
+        print()
+        cmd_list(t, args)
+        return 1
+
+    if args.cmd is None:
+        cmd_list(t, args)
+    else:
+        args.handler(t, args)
+
+    return 0
+
+
+if __name__ == "__main__":
+    main()

{dissect_target-3.25.dev20 → dissect_target-3.25.dev22}/dissect/target/tools/shell.py

@@ -1537,7 +1537,9 @@ def build_pipe_stdout(pipe_parts: list[str]) -> Iterator[TextIO]:
         yield pipe_stdin
 
 
-def open_shell(targets: list[Target], python: bool, registry: bool, commands: list[str] | None) -> None:
+def open_shell(
+    targets: list[Target], python: bool = False, registry: bool = False, commands: list[str] | None = None
+) -> None:
     """Helper method for starting a regular, Python or registry shell for one or multiple targets."""
     if python:
         python_shell(targets, commands=commands)
@@ -1546,7 +1548,7 @@ def open_shell(targets: list[Target], python: bool, registry: bool, commands: li
         target_shell(targets, cli_cls=cli_cls, commands=commands)
 
 
-def target_shell(targets: list[Target], cli_cls: type[TargetCmd], commands: list[str] | None) -> None:
+def target_shell(targets: list[Target], cli_cls: type[TargetCmd], commands: list[str] | None = None) -> None:
     """Helper method for starting a :class:`TargetCli` or :class:`TargetHubCli` for one or multiple targets."""
     if cli := create_cli(targets, cli_cls):
         if commands is not None:

{dissect_target-3.25.dev20 → dissect_target-3.25.dev22}/dissect/target/tools/utils/cli.py

@@ -213,16 +213,16 @@ def process_plugin_arguments(parser: argparse.ArgumentParser, args: argparse.Nam
     return {func.output for func in funcs if func.path not in args.excluded_functions}
 
 
-def open_target(args: argparse.Namespace) -> Target:
+def open_target(args: argparse.Namespace, *, apply: bool = True) -> Target:
     direct: bool = getattr(args, "direct", False)
     child: str | None = getattr(args, "child", None)
 
-    target = Target.open_direct(args.target) if direct else Target.open(args.target)
+    target = Target.open_direct(args.target) if direct else Target.open(args.target, apply=apply)
 
     if child:
         try:
             target.log.warning("Switching to --child %s", child)
-            target = target.open_child(child)
+            target = target.open_child(child, apply=apply)
         except Exception as e:
             target.log.exception("Exception while opening child %r: %s", child, e)  # noqa: TRY401
             target.log.debug("", exc_info=e)
@@ -233,20 +233,22 @@ def open_target(args: argparse.Namespace) -> Target:
     return target
 
 
-def open_targets(args: argparse.Namespace) -> Iterator[Target]:
+def open_targets(args: argparse.Namespace, *, apply: bool = True) -> Iterator[Target]:
     direct: bool = getattr(args, "direct", False)
     children: bool = getattr(args, "children", False)
     child: str | None = getattr(args, "child", None)
 
     targets: Iterable[Target] = (
-        [Target.open_direct(args.targets)] if direct else Target.open_all(args.targets, children)
+        [Target.open_direct(args.targets)]
+        if direct
+        else Target.open_all(args.targets, include_children=children, apply=apply)
     )
 
     for target in targets:
         if child:
             try:
                 target.log.warning("Switching to --child %s", child)
-                target = target.open_child(child)
+                target = target.open_child(child, apply=apply)
             except Exception as e:
                 target.log.exception("Exception while opening child %r: %s", child, e)  # noqa: TRY401
                 target.log.debug("", exc_info=e)

{dissect_target-3.25.dev20 → dissect_target-3.25.dev22}/dissect.target.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dissect.target
-Version: 3.25.dev20
+Version: 3.25.dev22
 Summary: This module ties all other Dissect modules together, it provides a programming API and command line tools which allow easy access to various data sources inside disk images or file collections (a.k.a. targets)
 Author-email: Dissect Team <dissect@fox-it.com>
 License-Expression: AGPL-3.0-or-later

{dissect_target-3.25.dev20 → dissect_target-3.25.dev22}/dissect.target.egg-info/SOURCES.txt

@@ -453,6 +453,7 @@ dissect/target/tools/diff.py
 dissect/target/tools/dump.py
 dissect/target/tools/fs.py
 dissect/target/tools/info.py
+dissect/target/tools/inspect.py
 dissect/target/tools/mount.py
 dissect/target/tools/qfind.py
 dissect/target/tools/query.py

{dissect_target-3.25.dev20 → dissect_target-3.25.dev22}/dissect.target.egg-info/entry_points.txt

@@ -6,6 +6,7 @@ target-diff = dissect.target.tools.diff:main
 target-dump = dissect.target.tools.dump:main
 target-fs = dissect.target.tools.fs:main
 target-info = dissect.target.tools.info:main
+target-inspect = dissect.target.tools.inspect:main
 target-mount = dissect.target.tools.mount:main
 target-qfind = dissect.target.tools.qfind:main
 target-query = dissect.target.tools.query:main

{dissect_target-3.25.dev20 → dissect_target-3.25.dev22}/pyproject.toml

@@ -153,17 +153,18 @@ dev = [
 [project.scripts]
 target-build-magic = "dissect.target.tools.build_magic:main"
 target-build-pluginlist = "dissect.target.tools.build_pluginlist:main"
-target-dump = "dissect.target.tools.dump:main"
 target-dd = "dissect.target.tools.dd:main"
+target-inspect = "dissect.target.tools.inspect:main"
 target-diff = "dissect.target.tools.diff:main"
+target-dump = "dissect.target.tools.dump:main"
 target-fs = "dissect.target.tools.fs:main"
 target-info = "dissect.target.tools.info:main"
 target-mount = "dissect.target.tools.mount:main"
+target-qfind = "dissect.target.tools.qfind:main"
 target-query = "dissect.target.tools.query:main"
 target-reg = "dissect.target.tools.reg:main"
 target-shell = "dissect.target.tools.shell:main"
 target-yara = "dissect.target.tools.yara:main"
-target-qfind = "dissect.target.tools.qfind:main"
 
 [tool.ruff]
 line-length = 120